linux-kernel - Re: [PATCH 0/3] x86/microcode: support for microcode update in Xen dom0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4E96146C.5070701@goop.org>
Date:	Wed, 12 Oct 2011 15:27:56 -0700
From:	Jeremy Fitzhardinge <jeremy@...p.org>
To:	Borislav Petkov <bp@...64.org>
CC:	"H. Peter Anvin" <hpa@...or.com>,
	the arch/x86 maintainers <x86@...nel.org>,
	Tigran Aivazian <tigran@...azian.fsnet.co.uk>,
	Xen Devel <xen-devel@...ts.xensource.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Jeremy Fitzhardinge <jeremy.fitzhardinge@...rix.com>,
	Ingo Molnar <mingo@...e.hu>,
	Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [PATCH 0/3] x86/microcode: support for microcode update in Xen
 dom0

On 10/12/2011 12:45 PM, Borislav Petkov wrote:
> On Wed, Oct 12, 2011 at 03:18:22PM -0400, Jeremy Fitzhardinge wrote:
>> While doing the whole boot time multiboot thing may offer some small
>> hypothetical technical advantages, it has the significant cost of just
>> complicating the whole deployment and use story.
> You simply can't call the need to apply ucode as early as possible a
> "hypothetical techical advantage."

The current scheme has worked pretty well so far; there doesn't seem to
be a huge concern about it.  Have there been actual observed failures
with the current mechanism, or is the drive to make it earlier driven by
an aesthetic desire to make it "as it should be"?

>  Other issues like how to handle ucode
> images and how to put them together and how distros distribute them
> and whether xen minimizes the amount of "specialness" or not are only
> secondary.

No, they're not.  If users end up with a broken setup then they get no
microcode updates at all, which makes everything else moot.  It has to
be deployed correctly for it to be worth anything at all.

What is secondary, or rather, completely irrelevant is whether Xen is
involved or not.

    J
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/