linux-kernel - Re: [PATCH 1/1] Update AMD cpu microcode for family 15h

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 1 Sep 2018 19:09:47 +0200
From:   Rudolf Marek <r.marek@...embler.cz>
To:     "Hurwitz, Sherry" <sherry.hurwitz@....com>,
        Henrique de Moraes Holschuh <hmh@....eng.br>,
        Ivan Ivanov <qmastery16@...il.com>
Cc:     Josh Boyer <jwboyer@...nel.org>,
        Linux Firmware <linux-firmware@...nel.org>,
        "Linux-Kernel@...r. Kernel. Org" <linux-kernel@...r.kernel.org>,
        "Suthikulpanit, Suravee" <Suravee.Suthikulpanit@....com>,
        "Lendacky, Thomas" <Thomas.Lendacky@....com>,
        "Grimm, Jon" <Jon.Grimm@....com>
Subject: Re: [PATCH 1/1] Update AMD cpu microcode for family 15h

Hi again,

Here is a short summary of what is missing in the microcode containers [1] [2]. I only included AMD family 15h and 17h.
Similar could be done for Intel CPUs. 

I do believe having a latest microcode is a vital for the userspace security because it provides
IBPB barrier.

Family 15h [1] container parsed with [4] (with some lines omitted)

-- Processor Signature:       : 0x00600f20
-- Processor Revision ID:     : 0x00006020

-- Processor Signature:       : 0x00610f01
-- Processor Revision ID:     : 0x00006101

-- Processor Signature:       : 0x00600f12
-- Processor Revision ID:     : 0x00006012

Contains following microcodes:

| # | eqrev| urev     |    date    | latest|
| 1 | 6012 | 0600063E | 2018/02/07 |  yes  |
| 2 | 6020 | 06000852 | 2018/02/06 |  yes  |
| 3 | 6101 | 06001119 | 2012/07/13 |  no   |

Note the #3 is what I have been complaining about.

Family 17h [2] parsed with [4]

The container seems to include the equivalent versions for various CPUs (not even a family17h) but only a microcode for a "Naples/EPYC" chips.

Container Processor Signature Table: 
-- Processor Signature:       : 0x00600f20 (not even a fam17h)
-- Processor Revision ID:     : 0x00006020

-- Processor Signature:       : 0x00610f01 (not even a fam17h)
-- Processor Revision ID:     : 0x00006101

-- Processor Signature:       : 0x00700f01 (not even a fam17h)
-- Processor Revision ID:     : 0x00007001

-- Processor Signature:       : 0x00800f12 (update is OK)
-- Processor Revision ID:     : 0x00008012

-- Processor Signature:       : 0x00800f11 (update is missing!)
-- Processor Revision ID:     : 0x00008011

-- Processor Signature:       : 0x00600f12 (not even a fam17h)
-- Processor Revision ID:     : 0x00006012

-- Processor Signature:       : 0x00800f13 (future CPU?)
-- Processor Revision ID:     : 0x00008013

-- Processor Signature:       : 0x00800f00 (perhaps ES?)
-- Processor Revision ID:     : 0x00008000

Microcode Type:               : 0x00000001
Microcode Size:               : 0x00000c80
Date                          : 2018/02/09
Patch ID                      : 0x08001227
Patch Data ID                 : 0x00008004

| # | eqrev| urev     |    date    | latest|
| 1 | 8004 | 08001227 | 2018/02/09 | yes   |

It misses microcode update for 00800F11 - latest known should be 2018/02/14 and for other CPUs like Pinacle Ridge 00800F82 - latest known should be 2018/02/12
Or Ryzen mobile 00810F10 etc...

Thanks
Rudolf

Resources used to construct this tables:

[1] https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/amd-ucode/microcode_amd_fam15h.bin
[2] https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/amd-ucode/microcode_amd_fam17h.bin
[3] http://users.atw.hu/instlatx64/
[4] https://github.com/ddcc/microparse