2018-08-25 03:52:56

by Jacek Tomaka

[permalink] [raw]
Subject: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

/sys/devices/system/cpu/cpuX/microcode

Before:
-r-------- processor_flags
-r-------- version

After:
-r--r--r-- processor_flags
-r--r--r-- version

Microcode version has been already readable for non root users via
/proc/cpuinfo. However it is easier to access it from
/sys/devices/system/cpu/cpuX/microcode/version

Reported-by: Tim Burgess <[email protected]>
Signed-off-by: Jacek Tomaka <[email protected]>
---
arch/x86/kernel/cpu/microcode/core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index b9bc8a1a58..2637ff09d6 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -666,8 +666,8 @@ static ssize_t pf_show(struct device *dev,
}

static DEVICE_ATTR_WO(reload);
-static DEVICE_ATTR(version, 0400, version_show, NULL);
-static DEVICE_ATTR(processor_flags, 0400, pf_show, NULL);
+static DEVICE_ATTR(version, 0444, version_show, NULL);
+static DEVICE_ATTR(processor_flags, 0444, pf_show, NULL);

static struct attribute *mc_default_attrs[] = {
&dev_attr_version.attr,
--
2.17.0



2018-08-26 12:02:50

by Borislav Petkov

[permalink] [raw]
Subject: Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

On August 25, 2018 6:50:39 AM GMT+03:00, Jacek Tomaka <[email protected]> wrote:
>/sys/devices/system/cpu/cpuX/microcode
>
>Before:
>-r-------- processor_flags
>-r-------- version
>
>After:
>-r--r--r-- processor_flags
>-r--r--r-- version
>
>Microcode version has been already readable for non root users via
>/proc/cpuinfo. However it is easier to access it from
>/sys/devices/system/cpu/cpuX/microcode/version

Easier than /proc/cpuinfo?! Sorry, not really.

You'd need to elaborate in greater detail what exactly you're trying to achieve.

--
Sent from a small device: formatting sux and brevity is inevitable.

2018-08-26 13:21:44

by Jacek Tomaka

[permalink] [raw]
Subject: Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags


> On 26 Aug 2018, at 7:52 pm, Boris Petkov <[email protected]> wrote:
>
>> On August 25, 2018 6:50:39 AM GMT+03:00, Jacek Tomaka <[email protected]> wrote:
>> /sys/devices/system/cpu/cpuX/microcode
>>
>> Before:
>> -r-------- processor_flags
>> -r-------- version
>>
>> After:
>> -r--r--r-- processor_flags
>> -r--r--r-- version
>>
>> Microcode version has been already readable for non root users via
>> /proc/cpuinfo. However it is easier to access it from
>> /sys/devices/system/cpu/cpuX/microcode/version
>
> Easier than /proc/cpuinfo?! Sorry, not really.

Why not?

> You'd need to elaborate in greater detail what exactly you're trying to achieve.

I am trying to get microcode version from user space. Reading it from /proc/cpuinfo requires greping/awking to extract the bits of information that are readily available in microcode/version.

Any reason why the same piece of information has different access permissions, depending on the way it is accessed?

Regards.
Jacek Tomaka

2018-08-27 04:08:02

by Borislav Petkov

[permalink] [raw]
Subject: Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

On Sun, Aug 26, 2018 at 08:23:48PM +0800, Jacek Tomaka wrote:
> I am trying to get microcode version from user space. Reading it
> from /proc/cpuinfo requires greping/awking to extract the bits of
> information that are readily available in microcode/version.

If the only reason is because you find it hard to grep/awk, I won't
take it.

> Any reason why the same piece of information has different access
> permissions, depending on the way it is accessed?

I don't see any particular reason in the original commit which added it:

9a4b9efa1d39 ("[PATCH] x86 microcode: add sysfs and hotplug support")

except maybe because the reload interface is root-only so making the
others root-only too, made sense.

However, we've made the microcode revision available to everyone in
/proc/cpuinfo, in the meantime, so I guess there's no point in keeping
the version file root-only anymore. And I guess the processor flags too,
while we're at it.

--
Regards/Gruss,
Boris.

ECO tip #101: Trim your mails when you reply.
--

2018-08-27 07:31:49

by Borislav Petkov

[permalink] [raw]
Subject: Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

On Mon, Aug 27, 2018 at 01:01:41PM +0800, Jacek Tomaka wrote:
> Not sure if you are leaning towards removing microcode/version interface
> altogether or you are writing your thoughts to justify merging this patch.

The latter. We cannot *ever* remove sysfs files. Never.

--
Regards/Gruss,
Boris.

ECO tip #101: Trim your mails when you reply.
--

2018-08-27 07:55:17

by Borislav Petkov

[permalink] [raw]
Subject: Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

On Sat, Aug 25, 2018 at 11:50:39AM +0800, Jacek Tomaka wrote:
> /sys/devices/system/cpu/cpuX/microcode
>
> Before:
> -r-------- processor_flags
> -r-------- version
>
> After:
> -r--r--r-- processor_flags
> -r--r--r-- version
>
> Microcode version has been already readable for non root users via
> /proc/cpuinfo. However it is easier to access it from
> /sys/devices/system/cpu/cpuX/microcode/version
>
> Reported-by: Tim Burgess <[email protected]>
> Signed-off-by: Jacek Tomaka <[email protected]>

Your From: is Jacek Tomaka <[email protected]> and your SOB is different.
Which one should I use?

(Having a single email address for both is easier...)

--
Regards/Gruss,
Boris.

ECO tip #101: Trim your mails when you reply.
--

2018-08-27 08:07:43

by Jacek Tomaka

[permalink] [raw]
Subject: Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

On Mon, Aug 27, 2018 at 3:52 PM, Borislav Petkov <[email protected]> wrote:

> Your From: is Jacek Tomaka <[email protected]> and your SOB is different.
> Which one should I use?
Please use my SOB: Jacek Tomaka <[email protected]>

> (Having a single email address for both is easier...)
Sorry about the trouble.

Regards.
Jacek Tomaka

2018-08-27 14:51:58

by Borislav Petkov

[permalink] [raw]
Subject: Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

On Mon, Aug 27, 2018 at 04:05:35PM +0800, Jacek Tomaka wrote:
> On Mon, Aug 27, 2018 at 3:52 PM, Borislav Petkov <[email protected]> wrote:
>
> > Your From: is Jacek Tomaka <[email protected]> and your SOB is different.
> > Which one should I use?
> Please use my SOB: Jacek Tomaka <[email protected]>
>
> > (Having a single email address for both is easier...)
> Sorry about the trouble.

No worries, applied.

Thx.

--
Regards/Gruss,
Boris.

ECO tip #101: Trim your mails when you reply.
--

Subject: [tip:x86/microcode] x86/microcode: Make revision and processor flags world-readable

Commit-ID: f4661d293eb2d01dfc742982761a36fafe456d46
Gitweb: https://git.kernel.org/tip/f4661d293eb2d01dfc742982761a36fafe456d46
Author: Jacek Tomaka <[email protected]>
AuthorDate: Sat, 25 Aug 2018 11:50:39 +0800
Committer: Thomas Gleixner <[email protected]>
CommitDate: Sun, 2 Sep 2018 14:09:13 +0200

x86/microcode: Make revision and processor flags world-readable

The microcode revision is already readable for non-root users via
/proc/cpuinfo. Thus, there's no reason to keep the same information
readable by root only in /sys/devices/system/cpu/cpuX/microcode/.

Make .../processor_flags world-readable too, while at it.

Reported-by: Tim Burgess <[email protected]>
Signed-off-by: Jacek Tomaka <[email protected]>
Signed-off-by: Borislav Petkov <[email protected]>
Signed-off-by: Thomas Gleixner <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]

---
arch/x86/kernel/cpu/microcode/core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index b9bc8a1a584e..2637ff09d6a0 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -666,8 +666,8 @@ static ssize_t pf_show(struct device *dev,
}

static DEVICE_ATTR_WO(reload);
-static DEVICE_ATTR(version, 0400, version_show, NULL);
-static DEVICE_ATTR(processor_flags, 0400, pf_show, NULL);
+static DEVICE_ATTR(version, 0444, version_show, NULL);
+static DEVICE_ATTR(processor_flags, 0444, pf_show, NULL);

static struct attribute *mc_default_attrs[] = {
&dev_attr_version.attr,