linux-kernel - Re: x86/microcode update on systems without INITRD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <568FB028.1030706@suse.cz>
Date:	Fri, 8 Jan 2016 13:48:40 +0100
From:	Michal Marek <mmarek@...e.cz>
To:	Borislav Petkov <bp@...e.de>
Cc:	Markus Trippelsdorf <markus@...ppelsdorf.de>,
	Måns Rullgård <mans@...sr.com>,
	Thomas Voegtle <tv@...96.de>, linux-kernel@...r.kernel.org
Subject: Re: x86/microcode update on systems without INITRD

On 2016-01-08 13:27, Borislav Petkov wrote:
> On Fri, Jan 08, 2016 at 01:16:01PM +0100, Markus Trippelsdorf wrote:
>> But you take the choice away from people like me, who don't need initrd
>> at all. BLK_DEV_INITRD is a superfluous dependency in this case, because
>> microcode update works perfectly well without it.
> 
> Damn, you have a valid point too. I need to think about it...
> 
> ... well, the only thing I can think of right now is to remove the
> dependency on BLK_DEV_INITRD completely - I believe this is what you
> proposed initially Markus - and add a BIG FAT SUGGESTION to Kconfig
> saying that people should strive for enabling early microcode loading if
> possible.
> 
> This is the only way I see we can handle "make oldconfig" without
> BLK_DEV_INITRD and microcode built-in into the kernel cases relatively
> fair.
> 
> Hmmm.
> 
> Or I could hack "oldconfig" to issue that warning... Lemme think about
> it and see how much Michal would scream at me for it. :-)

You can add a conditional comment like this

comment "WARNING: Early microcode loader requires initramfs support"
	depends on MICROCODE && !BLK_DEV_INITRD

and hope that somebody reads it.

Michal