[PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

[PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

[Jacek Tomaka]

/sys/devices/system/cpu/cpuX/microcode

Before:
-r-------- processor_flags
-r-------- version

After:
-r--r--r-- processor_flags
-r--r--r-- version

Microcode version has been already readable for non root users via
/proc/cpuinfo. However it is easier to access it from
/sys/devices/system/cpu/cpuX/microcode/version

Reported-by: Tim Burgess <timb@dug.com>
Signed-off-by: Jacek Tomaka <jacek.tomaka@poczta.fm>
---
 arch/x86/kernel/cpu/microcode/core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index b9bc8a1a58..2637ff09d6 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -666,8 +666,8 @@ static ssize_t pf_show(struct device *dev,
 }
 
 static DEVICE_ATTR_WO(reload);
-static DEVICE_ATTR(version, 0400, version_show, NULL);
-static DEVICE_ATTR(processor_flags, 0400, pf_show, NULL);
+static DEVICE_ATTR(version, 0444, version_show, NULL);
+static DEVICE_ATTR(processor_flags, 0444, pf_show, NULL);
 
 static struct attribute *mc_default_attrs[] = {
 	&dev_attr_version.attr,
-- 
2.17.0

Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

[Boris Petkov]

On August 25, 2018 6:50:39 AM GMT+03:00, Jacek Tomaka <jacekt@dugeo.com> wrote:
>/sys/devices/system/cpu/cpuX/microcode
>
>Before:
>-r-------- processor_flags
>-r-------- version
>
>After:
>-r--r--r-- processor_flags
>-r--r--r-- version
>
>Microcode version has been already readable for non root users via
>/proc/cpuinfo. However it is easier to access it from
>/sys/devices/system/cpu/cpuX/microcode/version

Easier than /proc/cpuinfo?! Sorry, not really. 

You'd need to elaborate in greater detail what exactly you're trying to achieve.

-- 
Sent from a small device: formatting sux and brevity is inevitable. 

Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

[Jacek Tomaka]

> On 26 Aug 2018, at 7:52 pm, Boris Petkov <bp@alien8.de> wrote:
> 
>> On August 25, 2018 6:50:39 AM GMT+03:00, Jacek Tomaka <jacekt@dugeo.com> wrote:
>> /sys/devices/system/cpu/cpuX/microcode
>> 
>> Before:
>> -r-------- processor_flags
>> -r-------- version
>> 
>> After:
>> -r--r--r-- processor_flags
>> -r--r--r-- version
>> 
>> Microcode version has been already readable for non root users via
>> /proc/cpuinfo. However it is easier to access it from
>> /sys/devices/system/cpu/cpuX/microcode/version
> 
> Easier than /proc/cpuinfo?! Sorry, not really. 

Why not?

> You'd need to elaborate in greater detail what exactly you're trying to achieve.

I am trying to get microcode version from user space. Reading it from /proc/cpuinfo requires greping/awking to extract the bits of information that are readily available in microcode/version.

Any reason why the same piece of information has different access permissions, depending on the way it is accessed?

Regards.
Jacek Tomaka

Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

[Borislav Petkov]

On Sun, Aug 26, 2018 at 08:23:48PM +0800, Jacek Tomaka wrote:
> I am trying to get microcode version from user space. Reading it
> from /proc/cpuinfo requires greping/awking to extract the bits of
> information that are readily available in microcode/version.

If the only reason is because you find it hard to grep/awk, I won't
take it.

> Any reason why the same piece of information has different access
> permissions, depending on the way it is accessed?

I don't see any particular reason in the original commit which added it:

  9a4b9efa1d39 ("[PATCH] x86 microcode: add sysfs and hotplug support")

except maybe because the reload interface is root-only so making the
others root-only too, made sense.

However, we've made the microcode revision available to everyone in
/proc/cpuinfo, in the meantime, so I guess there's no point in keeping
the version file root-only anymore. And I guess the processor flags too,
while we're at it.

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--

Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

[Borislav Petkov]

On Mon, Aug 27, 2018 at 01:01:41PM +0800, Jacek Tomaka wrote:
> Not sure if you are leaning towards removing microcode/version interface
> altogether or you are writing your thoughts to justify merging this patch.

The latter. We cannot *ever* remove sysfs files. Never.

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--

Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

[Borislav Petkov]

On Sat, Aug 25, 2018 at 11:50:39AM +0800, Jacek Tomaka wrote:
> /sys/devices/system/cpu/cpuX/microcode
> 
> Before:
> -r-------- processor_flags
> -r-------- version
> 
> After:
> -r--r--r-- processor_flags
> -r--r--r-- version
> 
> Microcode version has been already readable for non root users via
> /proc/cpuinfo. However it is easier to access it from
> /sys/devices/system/cpu/cpuX/microcode/version
> 
> Reported-by: Tim Burgess <timb@dug.com>
> Signed-off-by: Jacek Tomaka <jacek.tomaka@poczta.fm>

Your From: is Jacek Tomaka <jacekt@dugeo.com> and your SOB is different.
Which one should I use?

(Having a single email address for both is easier...)

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--

Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

[Jacek Tomaka]

On Mon, Aug 27, 2018 at 3:52 PM, Borislav Petkov <bp@alien8.de> wrote:

> Your From: is Jacek Tomaka <jacekt@dugeo.com> and your SOB is different.
> Which one should I use?
Please use my SOB: Jacek Tomaka <jacek.tomaka@poczta.fm>

> (Having a single email address for both is easier...)
Sorry about the trouble.

Regards.
Jacek Tomaka

Re: [PATCH] x86/microcode: allow non-root reading of microcode version and processor flags

[Borislav Petkov]

On Mon, Aug 27, 2018 at 04:05:35PM +0800, Jacek Tomaka wrote:
> On Mon, Aug 27, 2018 at 3:52 PM, Borislav Petkov <bp@alien8.de> wrote:
> 
> > Your From: is Jacek Tomaka <jacekt@dugeo.com> and your SOB is different.
> > Which one should I use?
> Please use my SOB: Jacek Tomaka <jacek.tomaka@poczta.fm>
> 
> > (Having a single email address for both is easier...)
> Sorry about the trouble.

No worries, applied.

Thx.

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--

[tip:x86/microcode] x86/microcode: Make revision and processor flags world-readable

[tip-bot for Jacek Tomaka]

Commit-ID:  f4661d293eb2d01dfc742982761a36fafe456d46
Gitweb:     https://git.kernel.org/tip/f4661d293eb2d01dfc742982761a36fafe456d46
Author:     Jacek Tomaka <jacek.tomaka@poczta.fm>
AuthorDate: Sat, 25 Aug 2018 11:50:39 +0800
Committer:  Thomas Gleixner <tglx@linutronix.de>
CommitDate: Sun, 2 Sep 2018 14:09:13 +0200

x86/microcode: Make revision and processor flags world-readable

The microcode revision is already readable for non-root users via
/proc/cpuinfo. Thus, there's no reason to keep the same information
readable by root only in /sys/devices/system/cpu/cpuX/microcode/.

Make .../processor_flags world-readable too, while at it.

Reported-by: Tim Burgess <timb@dug.com>
Signed-off-by: Jacek Tomaka <jacek.tomaka@poczta.fm>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20180825035039.14409-1-jacekt@dugeo.com

---
 arch/x86/kernel/cpu/microcode/core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index b9bc8a1a584e..2637ff09d6a0 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -666,8 +666,8 @@ static ssize_t pf_show(struct device *dev,
 }
 
 static DEVICE_ATTR_WO(reload);
-static DEVICE_ATTR(version, 0400, version_show, NULL);
-static DEVICE_ATTR(processor_flags, 0400, pf_show, NULL);
+static DEVICE_ATTR(version, 0444, version_show, NULL);
+static DEVICE_ATTR(processor_flags, 0444, pf_show, NULL);
 
 static struct attribute *mc_default_attrs[] = {
 	&dev_attr_version.attr,