linux-kernel - Re: [PATCH v4] x86/microcode/intel: Blacklist the specific BDW-EP for late loading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <24972441-6e70-749f-7edb-18c3e26c5df6@alibaba-inc.com>
Date:   Fri, 29 Dec 2017 22:12:34 +0800
From:   "Jia Zhang" <qianyue.zj@...baba-inc.com>
To:     Borislav Petkov <bp@...en8.de>
Cc:     Ingo Molnar <mingo@...nel.org>, tglx@...utronix.de,
        mingo@...hat.com, hpa@...or.com, x86@...nel.org,
        linux-kernel@...r.kernel.org, tony.luck@...el.com
Subject: Re: [PATCH v4] x86/microcode/intel: Blacklist the specific BDW-EP for
 late loading

在 2017/12/29 下午9:44, Borislav Petkov 写道:
> On Fri, Dec 29, 2017 at 09:17:34PM +0800, Jia Zhang wrote:
>> Namely, the end user has to make a BIOS update to uprev the microcode.
> 
> Not quite: end user is dependent on the OEM to get a BIOS update.
> 
> What is meant with early loading in this context is, to put the
> microcode in the initrd so that it gets loaded very early during the
> *kernel* boot. And early-initrd-based loading is the default method we
> do microcode loading with, anyway.

Thanks for clarifying the terms. What I meant was the microcode update
has to be launched in BIOS rather than late loading in linux runtime.

But I'm not quite sure whether or not the early-initrd-based loading is
affected. I used a shared BDW-EP machine with a rev of microcode less
than 0x0b000021 and observed the late loading is prohibited. I attempted
to remove the is_blacklisted() and observed a system hang with the late
loading. Eventually I followed up the erratum and updated the microcode
through BIOS update.

It is impossible to downgrade the BIOS to recover the old rev of
microcode for me to have a test with early-initrd-based loading.

Anyway, is_blacklisted() initially was introduced by Borislav to
prohibit late loading only, so the early-initrd-based loading seems to
be OK.

Thanks,
Jia

> 
> So the blacklisting is only for *late* loading, through the sysfs
> trigger. Which is only there for historical reasons and for some
> configurations.
>