linux-kernel - Re: x86, microcode: BUG: microcode update that changes x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140924174557.GD31678@khazad-dum.debian.net>
Date:	Wed, 24 Sep 2014 14:45:57 -0300
From:	Henrique de Moraes Holschuh <hmh@....eng.br>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	Borislav Petkov <bp@...en8.de>,
	Chuck Ebbert <cebbert.lkml@...il.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: x86, microcode: BUG: microcode update that changes x86_capability

On Wed, 24 Sep 2014, Andy Lutomirski wrote:
> On Wed, Sep 24, 2014 at 7:56 AM, Henrique de Moraes Holschuh
> <hmh@....eng.br> wrote:
> > And I'd really prefer it to be "update x86_capability, warn the user and
> > carry on" for anything that is not going to crash the kernel.  Several
> > distros will really want this backported to -stable, as the older kernels
> > cannot do early microcode updates.
> >
> 
> I'm trying to see if Intel is willing to document any additional
> controls for the TSX bits in this ucode.  No word yet, but I might
> hear something soon.

If they do document it, please make sure to ask what will happen in the
following situation:

   Assume there is a newer release of Intel microcode for these
   processors, i.e. newer than the microcodes in the 2014-09-13 release.
   IOW assume there are at least two public microcode updates in which the
   Intel TSX feature has been disabled by default, but can be enabled by
   the BIOS/UEFI.

   1. BIOS/UEFI has recent microcode (which has the Intel TSX on/off
      switch), but it is not the latest microcode, and installed this
      update on the processor.

   2. BIOS/UEFI has *enabled* Intel TSX on user request.

   3. Microcode is updated to the latest microcode by the operating
      system, newer than the one in BIOS/UEFI.

   After step 3, will Intel TSX be enabled, or disabled ?

Or, to be more explicit: will future microcode updates preserve Intel TSX
enabled/disabled state, or will they always reset it to disabled?

This is really important, for obvious reasons.

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/