From patchwork Mon Oct 2 12:00:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thomas Gleixner X-Patchwork-Id: 147363 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:2a8e:b0:403:3b70:6f57 with SMTP id in14csp1537323vqb; Mon, 2 Oct 2023 09:20:07 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHe8Bf84Xc+Ug9d5+GgtSaMWqOPRz+lS3OWqBcpn0AeL5n7Ux6+qNyKq8DVoq5dJfKzvBv3 X-Received: by 2002:a05:6a21:6811:b0:161:2bed:6b3a with SMTP id wr17-20020a056a21681100b001612bed6b3amr2647053pzb.17.1696263607641; Mon, 02 Oct 2023 09:20:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1696263607; cv=none; d=google.com; s=arc-20160816; b=uEhJPseKy5H+Wgp9fKDzV55VP/uBFAP/TKU1CAY0Zh8OEL9Ds/E6mHaSWnI/C2GpFn VuP6tC9JVKhpilMDSPU2ZfGC4xwIQR9MrSJ5MAIHxlfIZaTz+rxcM1ZY9k7u4zYcWpGI K+mCHO2LhMcfuPPuNhgwh61pd4tjIxU8FWT+lS2DsWV6hBMGco0mLWk15hqk016iS1hJ OKUk3Ki4ii0FM4fPrGKqKAV8MY51MuByvSVZTWJnCbLn7+65zP5xquJAn5OOhyCdC8P6 Nsai34TFp4rh+RePYl9ktwR0dyeSYwCnueBr1t+u2cd7meDjwzOyeo4KDn10rDDtRUIX idqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:date:mime-version:references:subject:cc:to:from :dkim-signature:dkim-signature:message-id; bh=XoE7TiDQteSLrCQRHgJsABz3dix8qDu4/P0GvYZKzRs=; fh=Fw4dspu3lEWS7xf2bQx5+rNTgFONiGLilI8487/7QuM=; b=or0bCTc9fKSbqyHvfWzfa6Brv1JztRigXM0ZlUiUAd9vzgu13LEeVNg5DjMM1lsSnv vGV+B6T66CdTLQSeEeKG5CqMh8qJNAZHQ1gQx2M1ugfTobmYt7hKEKraoiiYR/+lR7b0 54dLklktFCSDGNJNbZNlu/mrtYCtG+HVLv0b+qO+G9O3DICYQmdt988LOWv+sNKPCAne HeR6ZA1jF7Tco6c1Bgwxb+qzj/WR6uj+ThhCOiT8n+Gv8UcSFhMYW011jBrc5Se30vby hs97TTUcat3YIj9c8nau8wEtvYFdBGm9C0/bOKSUc5LYm521V+bXzgP+sAwmP2exb+VG xqbg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=irvTR4sH; dkim=neutral (no key) header.i=@linutronix.de header.s=2020e header.b=dFRt+way; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from groat.vger.email (groat.vger.email. [2620:137:e000::3:5]) by mx.google.com with ESMTPS id h12-20020a056a00230c00b006934390d0casi13226953pfh.36.2023.10.02.09.20.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Oct 2023 09:20:07 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) client-ip=2620:137:e000::3:5; Authentication-Results: mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=irvTR4sH; dkim=neutral (no key) header.i=@linutronix.de header.s=2020e header.b=dFRt+way; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by groat.vger.email (Postfix) with ESMTP id 99A8080CFD14; Mon, 2 Oct 2023 05:03:08 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at groat.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236998AbjJBMBQ (ORCPT + 18 others); Mon, 2 Oct 2023 08:01:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33720 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236966AbjJBMAc (ORCPT ); Mon, 2 Oct 2023 08:00:32 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E396110FD for ; Mon, 2 Oct 2023 05:00:12 -0700 (PDT) Message-ID: <20231002115903.776467264@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1696248011; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=XoE7TiDQteSLrCQRHgJsABz3dix8qDu4/P0GvYZKzRs=; b=irvTR4sHHgh1UZ38/SgCh4jtEYh2L50NahHblK6dy7VyYdokrEaf0huo0AAw+SMB2ksh0z ILoa7nzjoQv2NXXlqSSlvmfTF/fpHB7asmV9fRLcYirJ4BgGWv+IylVnmiJG4ZNwIdGKOb ILuxX+s/P9Lh8qhDZXh0vdrdIcZ9JkaS9Ui9JRa46YefbnH7VAHwAjl6mZuCpsIOVLxGHN x9KtbUVbfhqJyYMVWMoYdEj+UNlOQbALp8Yw0e30LpwbHCypf8GzGVVXHtRjWRYBzj6eSk civSTknjmchaS5rxyDuZcabpRZIjRbYc+4TA9ph674nRiHZod79RNN91Qgb48g== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1696248011; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=XoE7TiDQteSLrCQRHgJsABz3dix8qDu4/P0GvYZKzRs=; b=dFRt+way33Pp0Ua1ppbl+f4fVRnAvEyriC/Jc6A1keoMEYbRfJ6vlErwu+iWzL9s0gGqHr DuL1cWj8OU39EnAg== From: Thomas Gleixner To: LKML Cc: x86@kernel.org, Borislav Petkov , "Chang S. Bae" , Arjan van de Ven , Nikolay Borisov , Ashok Raj Subject: [patch V4 30/30] x86/microcode/intel: Add a minimum required revision for late-loads References: <20231002115506.217091296@linutronix.de> MIME-Version: 1.0 Date: Mon, 2 Oct 2023 14:00:11 +0200 (CEST) X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Mon, 02 Oct 2023 05:03:08 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1778661308366235823 X-GMAIL-MSGID: 1778661308366235823 From: Ashok Raj In general users don't have the necessary information to determine whether late loading of a new microcode version is safe and does not modify anything which the currently running kernel uses already, e.g. removal of CPUID bits or behavioural changes of MSRs. To address this issue, Intel has added a "minimum required version" field to a previously reserved field in the microcode header. Microcode updates should only be applied if the current microcode version is equal to, or greater than this minimum required version. Thomas made some suggestions on how meta-data in the microcode file could provide Linux with information to decide if the new microcode is suitable candidate for late loading. But even the "simpler" option requires a lot of metadata and corresponding kernel code to parse it, so the final suggestion was to add the 'minimum required version' field in the header. When microcode changes visible features, microcode will set the minimum required version to its own revision which prevents late loading. Old microcode blobs have the minimum revision field always set to 0, which indicates that there is no information and the kernel considers it as unsafe. This is a pure OS software mechanism. The hardware/firmware ignores this header field. For early loading there is no restriction because OS visible features are enumerated after the early load and therefor a change has no effect. The check is always enabled, but by default not enforced. It can be enforced via Kconfig or kernel command line. If enforced, the kernel refuses to late load microcode with a minium required version field which is zero or when the currently loaded microcode revision is smaller than the minimum required revision. If not enforced the load happens independent of the revision check to stay compatible with the existing behaviour, but it influences the decision whether the kernel is tainted or not. If the check signals that the late load is safe, then the kernel is not tainted. Early loading is not affected by this. [ tglx: Massaged changelog and fixed up the implementation ] Suggested-by: Thomas Gleixner Signed-off-by: Ashok Raj Signed-off-by: Thomas Gleixner --- arch/x86/include/asm/microcode.h | 3 +- arch/x86/kernel/cpu/microcode/intel.c | 37 ++++++++++++++++++++++++++++++---- 2 files changed, 35 insertions(+), 5 deletions(-) --- --- a/arch/x86/include/asm/microcode.h +++ b/arch/x86/include/asm/microcode.h @@ -36,7 +36,8 @@ struct microcode_header_intel { unsigned int datasize; unsigned int totalsize; unsigned int metasize; - unsigned int reserved[2]; + unsigned int min_req_ver; + unsigned int reserved; }; struct microcode_intel { --- a/arch/x86/kernel/cpu/microcode/intel.c +++ b/arch/x86/kernel/cpu/microcode/intel.c @@ -463,16 +463,40 @@ static enum ucode_state apply_microcode_ return ret; } +static bool ucode_validate_minrev(struct microcode_header_intel *mc_header) +{ + int cur_rev = boot_cpu_data.microcode; + + /* + * When late-loading, ensure the header declares a minimum revision + * required to perform a late-load. The previously reserved field + * is 0 in older microcode blobs. + */ + if (!mc_header->min_req_ver) { + pr_info("Unsafe microcode update: Microcode header does not specify a required min version\n"); + return false; + } + + /* + * Check whether the minimum revision specified in the header is either + * greater or equal to the current revision. + */ + if (cur_rev < mc_header->min_req_ver) { + pr_info("Unsafe microcode update: Current revision 0x%x too old\n", cur_rev); + pr_info("Current should be at 0x%x or higher. Use early loading instead\n", mc_header->min_req_ver); + return false; + } + return true; +} + static enum ucode_state parse_microcode_blobs(int cpu, struct iov_iter *iter) { struct ucode_cpu_info *uci = ucode_cpu_info + cpu; + bool is_safe, new_is_safe = false; int cur_rev = uci->cpu_sig.rev; unsigned int curr_mc_size = 0; u8 *new_mc = NULL, *mc = NULL; - if (force_minrev) - return UCODE_NFOUND; - while (iov_iter_count(iter)) { struct microcode_header_intel mc_header; unsigned int mc_size, data_size; @@ -515,9 +539,14 @@ static enum ucode_state parse_microcode_ if (!intel_find_matching_signature(mc, &uci->cpu_sig)) continue; + is_safe = ucode_validate_minrev(&mc_header); + if (force_minrev && !is_safe) + continue; + kvfree(new_mc); cur_rev = mc_header.rev; new_mc = mc; + new_is_safe = is_safe; mc = NULL; } @@ -529,7 +558,7 @@ static enum ucode_state parse_microcode_ return UCODE_NFOUND; ucode_patch_late = (struct microcode_intel *)new_mc; - return UCODE_NEW; + return new_is_safe ? UCODE_NEW_SAFE : UCODE_NEW; fail: kvfree(mc);