linux-kernel - Re: x86/microcode update on systems without INITRD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151119225828.GB4926@pd.tnic>
Date:	Thu, 19 Nov 2015 23:58:28 +0100
From:	Borislav Petkov <bp@...e.de>
To:	Markus Trippelsdorf <markus@...ppelsdorf.de>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: x86/microcode update on systems without INITRD

On Thu, Nov 19, 2015 at 10:55:43PM +0100, Borislav Petkov wrote:
> On Thu, Nov 19, 2015 at 10:43:01PM +0100, Markus Trippelsdorf wrote:
> > It looks like the ability to update x86/microcode without using an
> > initrd was removed this merge window.
> 
> Whoops, that shouldnt've happened. Will debug it tomorrow and provide a
> fix.

Btw, you should consider changing your setup to use the initrd for
loading microcode early because microcode should be loaded as early as
possible.

The ".../reload" method is aimed at updating microcode on long-running
boxes without rebooting them. And that means those updates need to be
tested first in a lab environment before running them on the production
systems because not every microcode patch can be applied late. Some
shouldn't be even tried.

Anyway, the hunk below seems to work in my guest here, I'll run it
on the rest of the boxes tomorrow. In case you want to give it a try
before:

---
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 3aaffb601c91..faec7120c508 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -698,3 +698,4 @@ int __init microcode_init(void)
 	return error;
 
 }
+late_initcall(microcode_init);
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 29db25f9a745..d2bbe343fda7 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1250,8 +1250,6 @@ void __init setup_arch(char **cmdline_p)
 	if (efi_enabled(EFI_BOOT))
 		efi_apply_memmap_quirks();
 #endif
-
-	microcode_init();
 }
 
 #ifdef CONFIG_X86_32
---

Thanks!

-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
-- 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/