linux-kernel - Re: [PATCH v5] x86/microcode/intel: Blacklist the specific BDW-EP for late loading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <565e00ca-d9a5-53ef-3448-d8783a9fb854@alibaba-inc.com>
Date:   Tue, 02 Jan 2018 09:19:42 +0800
From:   "Jia Zhang" <qianyue.zj@...baba-inc.com>
To:     Borislav Petkov <bp@...en8.de>
Cc:     mingo@...hat.com, hpa@...or.com, tglx@...utronix.de,
        tony.luck@...el.com, x86@...nel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v5] x86/microcode/intel: Blacklist the specific BDW-EP for
 late loading

Thanks for your comments. Happy new year!

Jia

在 2018/1/2 上午6:10, Borislav Petkov 写道:
> On Mon, Jan 01, 2018 at 10:04:47AM +0800, Jia Zhang wrote:
>> Instead of blacklisting all types of Broadwell processor when running
>> a late loading, only BDW-EP (signature 0x406f1, aka family 6, model 79,
>> stepping 1) with the microcode version less than 0x0b000021 needs to
>> be blacklisted.
>>
>> The erratum is documented in the the public documentation #334165 (See
>> the item BDF90 for details).
>>
>> Signed-off-by: Jia Zhang <qianyue.zj@...baba-inc.com>
>> ---
>>  arch/x86/kernel/cpu/microcode/intel.c | 14 +++++++++++---
>>  1 file changed, 11 insertions(+), 3 deletions(-)
> 
> Ok, I went and massaged your version, here's what I committed:
> 
> ---
> From: Jia Zhang <qianyue.zj@...baba-inc.com>
> Date: Mon, 1 Jan 2018 10:04:47 +0800
> Subject: [PATCH] x86/microcode/intel: Extend BDW late-loading with a revision
>  check
> 
> Instead of blacklisting all model 79 CPUs when attempting a late
> microcode loading, limit that only to CPUs with microcode revisions <
> 0x0b000021 because only on those late loading may cause a system hang.
> 
> For such processors either:
> 
> a) a BIOS update which might contain a newer microcode revision
> 
> or
> 
> b) the early microcode loading method
> 
> should be considered.
> 
> Processors with revisions 0x0b000021 or higher will not experience such
> hangs.
> 
> For more details, see erratum BDF90 in document #334165 (Intel Xeon
> Processor E7-8800/4800 v4 Product Family Specification Update) from
> September 2017.
> 
> Signed-off-by: Jia Zhang <qianyue.zj@...baba-inc.com>
> Acked-by: Tony Luck <tony.luck@...el.com>
> Cc: x86-ml <x86@...nel.org>
> Link: http://lkml.kernel.org/r/1514772287-92959-1-git-send-email-qianyue.zj@alibaba-inc.com
> [ Heavily massage commit message and pr_* statements. ]
> Signed-off-by: Borislav Petkov <bp@...e.de>
> ---
>  arch/x86/kernel/cpu/microcode/intel.c | 13 +++++++++++--
>  1 file changed, 11 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
> index 8ccdca6d3f9e..d9e460fc7a3b 100644
> --- a/arch/x86/kernel/cpu/microcode/intel.c
> +++ b/arch/x86/kernel/cpu/microcode/intel.c
> @@ -910,8 +910,17 @@ static bool is_blacklisted(unsigned int cpu)
>  {
>  	struct cpuinfo_x86 *c = &cpu_data(cpu);
>  
> -	if (c->x86 == 6 && c->x86_model == INTEL_FAM6_BROADWELL_X) {
> -		pr_err_once("late loading on model 79 is disabled.\n");
> +	/*
> +	 * Late loading on model 79 with microcode revision less than 0x0b000021
> +	 * may result in a system hang. This behavior is documented in item
> +	 * BDF90, #334165 (Intel Xeon Processor E7-8800/4800 v4 Product Family).
> +	 */
> +	if (c->x86 == 6 &&
> +	    c->x86_model == INTEL_FAM6_BROADWELL_X &&
> +	    c->x86_mask == 0x01 &&
> +	    c->microcode < 0x0b000021) {
> +		pr_err_once("Erratum BDF90: late loading with revision < 0x0b000021 (0x%x) disabled.\n", c->microcode);
> +		pr_err_once("Please consider either early loading through initrd/built-in or a potential BIOS update.\n");
>  		return true;
>  	}
>  
>