linux-kernel - Re: early microcode: how to disable at runtime?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140903124302.GA18507@khazad-dum.debian.net>
Date:	Wed, 3 Sep 2014 09:43:02 -0300
From:	Henrique de Moraes Holschuh <hmh@....eng.br>
To:	Borislav Petkov <bp@...en8.de>
Cc:	"H. Peter Anvin" <hpa@...or.com>,
	Fenghua Yu <fenghua.yu@...el.com>, linux-kernel@...r.kernel.org
Subject: Re: early microcode: how to disable at runtime?

On Wed, 03 Sep 2014, Borislav Petkov wrote:
> On Tue, Sep 02, 2014 at 10:16:51AM -0300, Henrique de Moraes Holschuh wrote:
> > Things do go wrong in other ways, not just corrupt microcode data/initramfs
> > images.
> > 
> > This stuff runs too early.  It is easy to break, and annoying to debug.
> 
> How is this stuff easy to break? Please stop with the conjectures and
> give concrete issues, if any.

Half the things you'd usually do when writing kernel code cannot be done
that early, that's how.  It is not that the code is bad or especially
fragile (at least not the core or the AMD driver.  The Intel driver is
convoluted).

You have fixed several such bugs recently, commit ids:
75a1ba5b2c529db60ca49626bcaf0bddf4548438,
84516098b58e05821780dc0b89abcee434b4dca5,
5335ba5cf475369f88db8e6835764efdcad8ab96.

> > Although, on the corrupted microcode topic, I have this very strong
> > feeling that at least the Intel driver would benefit from a careful
> > audit on the microcode container handling if we want to be sure it
> > won't do stupid things when fed specially crafted hostile data.
> 
> If loading the microcode can disrupt the system (and not simply be
> ignored if faulty) then we have to fix that. Disabling the loader is only
> a stop-gap measure in such situation anyway - not a real solution.

Yes.  It is a stop gap solution, I never claimed it to be anything else.

What I did claim is that it is going to be a far more user-friendly stop gap
than the "boot from rescue media" option.

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/