linux-kernel - Re: [PATCH v4] x86/microcode/intel: Blacklist the specific BDW-EP for late loading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 29 Dec 2017 15:40:32 +0100
From:   Borislav Petkov <bp@...en8.de>
To:     Jia Zhang <qianyue.zj@...baba-inc.com>
Cc:     Ingo Molnar <mingo@...nel.org>, tglx@...utronix.de,
        mingo@...hat.com, hpa@...or.com, x86@...nel.org,
        linux-kernel@...r.kernel.org, tony.luck@...el.com
Subject: Re: [PATCH v4] x86/microcode/intel: Blacklist the specific BDW-EP
 for late loading

On Fri, Dec 29, 2017 at 10:12:34PM +0800, Jia Zhang wrote:
> Thanks for clarifying the terms. What I meant was the microcode update
> has to be launched in BIOS rather than late loading in linux runtime.

Microcode update on those machines can happen in two ways:

* loaded by the BIOS

OR

* loaded early by the kernel from the initrd.

  [ There's also the builtin microcode option which happens early too
    but I'm mentioning it here only for completeness sake - don't get
    confused by it. ]

> But I'm not quite sure whether or not the early-initrd-based loading is
> affected.

Apparently it isn't.

> I used a shared BDW-EP machine with a rev of microcode less than
> 0x0b000021 and observed the late loading is prohibited. I attempted
> to remove the is_blacklisted() and observed a system hang with the
> late loading. Eventually I followed up the erratum and updated the
> microcode through BIOS update.

Yap, you confirmed the erratum. Which is a good data point. :-)

> It is impossible to downgrade the BIOS to recover the old rev of
> microcode for me to have a test with early-initrd-based loading.

Some BIOSes allow that. Depends on the platform.

> Anyway, is_blacklisted() initially was introduced by Borislav to
> prohibit late loading only, so the early-initrd-based loading seems to
> be OK.

Yes, Borislav, that is me. :-)

And yes, the blacklisting is for late loading only. This has a greater
importance for old kernels where the initrd method is not supported yet
and we wanted to prevent machine hangs from microcode update. Thus this
solution which got backported.

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--