linux-kernel - Re: [v2 1/3] x86/microcode/intel: Check microcode revision before updating sibling threads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 22 Feb 2018 05:19:18 -0800
From:   "Raj, Ashok" <ashok.raj@...el.com>
To:     Borislav Petkov <bp@...e.de>
Cc:     X86 ML <x86@...nel.org>, LKML <linux-kernel@...r.kernel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...nel.org>,
        Tony Luck <tony.luck@...el.com>,
        Andi Kleen <andi.kleen@...el.com>,
        Tom Lendacky <thomas.lendacky@....com>,
        Arjan Van De Ven <arjan.van.de.ven@...el.com>,
        Ashok Raj <ashok.raj@...el.com>
Subject: Re: [v2 1/3] x86/microcode/intel: Check microcode revision before
 updating sibling threads

On Thu, Feb 22, 2018 at 01:15:06PM +0100, Borislav Petkov wrote:
> On Thu, Feb 22, 2018 at 03:55:54AM -0800, Raj, Ashok wrote:
> > The current code wasn't trying to enforce checking the loaded microcode revision on a thread
> > before attempting to load the microcode. While you comeback from resume, if C0T0 already
> > is up, and we loaded the early microcode, then when handling C0T1 there is no need to 
> > do a wrmsrl to reapply microcode since its already loaded as part of C0T0. 
> 
> And I'm asking exactly this: is it simply "we don't need to do WRMSR" or
> "we should not"?
> 
> Because avoiding the WRMSR costs more than simply doing it and letting
> the HT thread ignore the supplied microcode.

This isn't a simple WRMSR like others. Microcode engine needs to do 
a bunch of validation.

> 
> If it is "we don't need to but there's nothing wrong when we do it" then
> we don't need this patch. And I'm pretty sure "nothing wrong when we do
> it" would be the answer. Otherwise we have bigger problems.

In the past the only guidance was to not load microcode at the same time to the 
thread siblings of a core. We now have new guidance that the sibling must be 
spinning and not doing other things that can introduce instability around loading 
microcode.

I think its safer to not load when its not required vs forcing a load and depending
on the microcode interface to not interfere. If the rules change in future we don't
have to adapt again.