[PATCH] x86/microcode/amd: Don't attempt to load older microcode patch

[PATCH] x86/microcode/amd: Don't attempt to load older microcode patch

[Lendacky, Thomas]

The load_microcode_amd() function searches for microcode patches and
attempts to apply a microcode patch if is a different level than the
currently installed level. While the processor won't actually load a
level that is less than what is installed, the logic is followed as if
the patch should be installed. If the file-system contains an older
version of microcode than what is currently running, a late microcode
load check can result in the following messages:

x86/CPU: CPU features have changed after loading microcode, but might not take effect.
x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.

These messages were issued on a system where SME/SEV are not enabled by
the BIOS (MSR C001_0010[23] = 0b). During boot, early_detect_mem_encrypt()
is called and clears the SME and SEV features. However, after the (non)
late load of the firmware, get_cpu_cap() is called and resets the SME and
SEV features resulting in the messages.

Update the microcode level check to not attempt microcode loading if
the current level is greater than or equal to the patch level.

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
---
 arch/x86/kernel/cpu/microcode/amd.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 51adde0a0f1a..e1f3ba19ba54 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -855,7 +855,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
 	if (!p) {
 		return ret;
 	} else {
-		if (boot_cpu_data.microcode == p->patch_id)
+		if (boot_cpu_data.microcode >= p->patch_id)
 			return ret;
 
 		ret = UCODE_NEW;

[tip:x86/urgent] x86/microcode/amd: Don't falsely trick the late loading mechanism

[tip-bot for Thomas Lendacky]

Commit-ID:  912139cfbfa6a2bc1da052314d2c29338dae1f6a
Gitweb:     https://git.kernel.org/tip/912139cfbfa6a2bc1da052314d2c29338dae1f6a
Author:     Thomas Lendacky <Thomas.Lendacky@amd.com>
AuthorDate: Thu, 31 Jan 2019 14:33:06 +0000
Committer:  Borislav Petkov <bp@suse.de>
CommitDate: Thu, 31 Jan 2019 16:54:32 +0100

x86/microcode/amd: Don't falsely trick the late loading mechanism

The load_microcode_amd() function searches for microcode patches and
attempts to apply a microcode patch if it is of different level than the
currently installed level.

While the processor won't actually load a level that is less than
what is already installed, the logic wrongly returns UCODE_NEW thus
signaling to its caller reload_store() that a late loading should be
attempted.

If the file-system contains an older microcode revision than what is
currently running, such a late microcode reload can result in these
misleading messages:

  x86/CPU: CPU features have changed after loading microcode, but might not take effect.
  x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.

These messages were issued on a system where SME/SEV are not
enabled by the BIOS (MSR C001_0010[23] = 0b) because during boot,
early_detect_mem_encrypt() is called and cleared the SME and SEV
features in this case.

However, after the wrong late load attempt, get_cpu_cap() is called and
reloads the SME and SEV feature bits, resulting in the messages.

Update the microcode level check to not attempt microcode loading if the
current level is greater than(!) and not only equal to the current patch
level.

 [ bp: massage commit message. ]

Fixes: 2613f36ed965 ("x86/microcode: Attempt late loading only when new microcode is present")
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: x86-ml <x86@kernel.org>
Link: https://lkml.kernel.org/r/154894518427.9406.8246222496874202773.stgit@tlendack-t1.amdoffice.net
---
 arch/x86/kernel/cpu/microcode/amd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 51adde0a0f1a..e1f3ba19ba54 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -855,7 +855,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
 	if (!p) {
 		return ret;
 	} else {
-		if (boot_cpu_data.microcode == p->patch_id)
+		if (boot_cpu_data.microcode >= p->patch_id)
 			return ret;
 
 		ret = UCODE_NEW;