From nobody Sat Apr 11 03:55:25 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ADBBCC25B08 for ; Wed, 17 Aug 2022 05:12:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232554AbiHQFMJ (ORCPT ); Wed, 17 Aug 2022 01:12:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49434 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231761AbiHQFMC (ORCPT ); Wed, 17 Aug 2022 01:12:02 -0400 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E237A6DFB7 for ; Tue, 16 Aug 2022 22:12:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1660713121; x=1692249121; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=EQ+YUi710ASUR/UiftqoykJfpdPYLLzMNph5Lwb1jZw=; b=JL30gLUThHkagKdW4VQ+rt7SlfDbxRTlr67vBIW+u0k7cd1El2Qd1G3J /hL/OQPZl3WMXXF0UaT2DRIWNF7ReRMt8e4DTpyRZ+Dq/g3TGWlmjMlxx OdqulrmDENkpn0pP38hb7k8PW0w+eQ4W5CbQjiGU8HG4RKmxbBnFuDSb7 yCI5hdokEgrwmllPWy0/eDLDGg3yizZKFcnIvNChc5nl4niRL7Lm52BiA C7HddWScPAsPP/gC3m1YK8xH76RGne/YMYB2ZdhIIj1Y/zchrHX3NOfOF GsU+Hs6XXPqZdAsn3D5qe6kbti5GXL6Uk3JzVxUkoiPFImZvupLZIAztg g==; X-IronPort-AV: E=McAfee;i="6400,9594,10441"; a="289972497" X-IronPort-AV: E=Sophos;i="5.93,242,1654585200"; d="scan'208";a="289972497" Received: from orsmga003.jf.intel.com ([10.7.209.27]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 Aug 2022 22:12:00 -0700 X-IronPort-AV: E=Sophos;i="5.93,242,1654585200"; d="scan'208";a="557976687" Received: from araj-dh-work.jf.intel.com ([10.165.157.158]) by orsmga003-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 Aug 2022 22:11:59 -0700 From: Ashok Raj To: Borislav Petkov , Thomas Gleixner Cc: Tony Luck , Dave Hansen , "LKML Mailing List" , X86-kernel , Andy Lutomirski , Tom Lendacky , "Jacon Jun Pan" , Ashok Raj Subject: [PATCH v3 2/5] x86/microcode/intel: Allow a late-load only if a min rev is specified Date: Wed, 17 Aug 2022 05:11:24 +0000 Message-Id: <20220817051127.3323755-3-ashok.raj@intel.com> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20220817051127.3323755-1-ashok.raj@intel.com> References: <20220817051127.3323755-1-ashok.raj@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In general users don't have the necessary information to determine whether a late-load of a new microcode version has removed any feature (MSR, CPUID etc) between what is currently loaded and this new microcode. To address this issue, Intel has added a "minimum required version" field to a previously reserved field in the file header. Microcode updates should only be applied if the current microcode version is equal to, or greater than this minimum required version. https://lore.kernel.org/linux-kernel/alpine.DEB.2.21.1909062237580.1902@nan= os.tec.linutronix.de/ Thomas made some suggestions on how meta-data in the microcode file could provide Linux with information to decide if the new microcode is suitable candidate for late-load. But even the "simpler" option#1 requires a lot of metadata and corresponding kernel code to parse it. The proposal here is an even simpler option. The criteria for a microcode to be a viable late-load candidate is that no CPUID or OS visible MSR features are removed with respect to an earlier version of the microcode. Pseudocode for late-load is as follows: if header.min_required_id =3D=3D 0 This is old format microcode, block late-load else if current_ucode_version < header.min_required_id Current version is too old, block late-load of this microcode. else OK to proceed with late-load. Any microcode that removes a feature will set the min_version to itself. This will enforce this microcode is not suitable for late-loading. The enforcement is not in hardware and limited to kernel loader enforcing the requirement. It is not required for early loading of microcode to enforce this requirement, since the new features are only evaluated after early loading in the boot process. Test cases covered: 1. With new kernel, attempting to load an older format microcode with the min_rev=3D0 should be blocked by kernel. [ 210.541802] microcode: Header MUST specify min version for late-load 2. New microcode with a non-zero min_rev in the header, but the specified min_rev is greater than what is currently loaded in the CPU should be blocked by kernel. 245.139828] microcode: Current revision 0x8f685300 is too old to update, must be at 0xaa000050 version or higher 3. New microcode with a min_rev < currently loaded should allow loading the microcode 4. Build initrd with microcode that has min_rev=3D0, or min_rev > currently loaded should permit early loading microcode from initrd. Tested-by: William Xie Reviewed-by: Tony Luck Signed-off-by: Ashok Raj --- arch/x86/include/asm/microcode_intel.h | 4 +++- arch/x86/kernel/cpu/microcode/intel.c | 20 ++++++++++++++++++++ 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/microcode_intel.h b/arch/x86/include/asm/= microcode_intel.h index 4c92cea7e4b5..16b8715e0984 100644 --- a/arch/x86/include/asm/microcode_intel.h +++ b/arch/x86/include/asm/microcode_intel.h @@ -14,7 +14,9 @@ struct microcode_header_intel { unsigned int pf; unsigned int datasize; unsigned int totalsize; - unsigned int reserved[3]; + unsigned int reserved1; + unsigned int min_req_id; + unsigned int reserved3; }; =20 struct microcode_intel { diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/mi= crocode/intel.c index c4b11e2fbe33..1eb202ec2302 100644 --- a/arch/x86/kernel/cpu/microcode/intel.c +++ b/arch/x86/kernel/cpu/microcode/intel.c @@ -178,6 +178,7 @@ static int microcode_sanity_check(void *mc, int print_e= rr) struct extended_sigtable *ext_header =3D NULL; u32 sum, orig_sum, ext_sigcount =3D 0, i; struct extended_signature *ext_sig; + struct ucode_cpu_info uci; =20 total_size =3D get_totalsize(mc_header); data_size =3D get_datasize(mc_header); @@ -248,6 +249,25 @@ static int microcode_sanity_check(void *mc, int print_= err) return -EINVAL; } =20 + /* + * Enforce for late-load that min_req_id is specified in the header. + * Otherwise its an old format microcode, reject it. + */ + if (print_err) { + if (!mc_header->min_req_id) { + pr_warn("Header MUST specify min version for late-load\n"); + return -EINVAL; + } + + intel_cpu_collect_info(&uci); + if (uci.cpu_sig.rev < mc_header->min_req_id) { + pr_warn("Current revision 0x%x is too old to update," + "must be at 0x%x version or higher\n", + uci.cpu_sig.rev, mc_header->min_req_id); + return -EINVAL; + } + } + if (!ext_table_size) return 0; =20 --=20 2.32.0