linux-kernel - Re: [PATCH 1/2] x86/microcode: Add microcode= cmdline parsing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6b345bdd-d5f6-4967-9f2a-15c2d371ef1b@intel.com>
Date: Thu, 14 Aug 2025 16:08:57 -0700
From: "Chang S. Bae" <chang.seok.bae@...el.com>
To: Borislav Petkov <bp@...nel.org>, X86 ML <x86@...nel.org>
CC: LKML <linux-kernel@...r.kernel.org>, "Borislav Petkov (AMD)"
	<bp@...en8.de>
Subject: Re: [PATCH 1/2] x86/microcode: Add microcode= cmdline parsing

On 8/9/2025 2:42 AM, Borislav Petkov wrote:
>   
> -	microcode.force_minrev=	[X86]
> -			Format: <bool>
> +	microcode=      [X86] Control the behavior of the microcode loader.
> +	                Available options, comma separated:

It looks like microcode=dis_ucode_ldr is also supported.
This could be added here:
			ldr_ucode_ldr
			Disable the microcode loader.		

> +			force_minrev
>   			Enable or disable the microcode minimal revision
> -			enforcement for the runtime microcode loader.
> + 			enforcement for the runtime microcode loader.

I also noticed in arch/x86/Kconfig:

config MICROCODE_LATE_LOADING
	bool "Late microcode loading (DANGEROUS)"
	default n
	depends on MICROCODE && SMP
	help
	  ...
	  the kernel command line with "microcode.minrev=Y".

This outdated has been there already. Perhaps, it might be better to fix 
this typo with the new one while updating the option.
> -bool force_minrev = IS_ENABLED(CONFIG_MICROCODE_LATE_FORCE_MINREV);
> -module_param(force_minrev, bool, S_IRUSR | S_IWUSR);
> +bool force_minrev = false;

<snip>

> +static void early_parse_cmdline(void)
> +{
> +	char cmd_buf[64] = {};
> +	char *s, *p = cmd_buf;
> +
> +	if (cmdline_find_option(boot_command_line, "microcode", cmd_buf, 64) > 0) {

nit: s/64/sizeof(cmd_bug)/

> +		while ((s = strsep(&p, ","))) {
> +			if (IS_ENABLED(CONFIG_MICROCODE_LATE_FORCE_MINREV)) {
> +				if (!strcmp("force_minrev", s))
> +					force_minrev = true;
> +			}

I think the behavior here differs from before:

Previously, the minrev requirement could be enforced by either
   (a) Build with MICROCODE_LATE_FORCE_MINREV=y, or
   (b) microcode.force_minrev with MICROCODE_LATE=y.

Now, this requires both. I don't know this is intentional, but it’s like 
asking for more from the user.

Thanks,
Chang