linux-kernel - Re: new cmdline parameter disable_cpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEApFrhJzPkrP3jSiZUd4f-vqf89y6T7q9fRpDPsPumvByC+6g@mail.gmail.com>
Date:	Tue, 5 Jan 2016 01:27:21 +0100
From:	Piotr Dąbrowski <ultr@...r.pl>
To:	Borislav Petkov <bp@...en8.de>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: new cmdline parameter disable_cpu_features= (microcode update?)

Thank you for your reply.

> You cannot change the microcode patches - they're supplied by the CPU
> vendors as is and are signed/encrypted.

Is the microcode's header encrypted too?
I thought there are two Processor Flags fields ('pf') available [1].
Are they what I think they are?
Is the header signed too, or only the actual microcode blob below the
headers is?
Sorry if I get it all wrong and there is no use for further discussion.

Do you think there is any point in actually implementing the
kernel-only disable_cpu_features= option upstream
and then somehow convince the userland to respect flags reported by
the kernel instead of those from the CPU?

[1] arch/x86/include/asm/microcode_intel.h:
struct microcode_header_intel {
unsigned int            hdrver;
unsigned int            rev;
unsigned int            date;
unsigned int            sig;
unsigned int            cksum;
unsigned int            ldrver;
unsigned int            pf;
unsigned int            datasize;
unsigned int            totalsize;
unsigned int            reserved[3];
};
[...]
/* microcode format is extended from prescott processors */
struct extended_signature {
unsigned int            sig;
unsigned int            pf;
unsigned int            cksum;
};

Best Regards,
Piotr Dąbrowski
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/