linux-kernel - Re: [PATCH 1/2] x86/microcode: Update late microcode in parallel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2242cc6c-720d-e1bc-817b-c4bb7fddd420@oracle.com>
Date:   Mon, 26 Aug 2019 08:53:05 -0400
From:   Boris Ostrovsky <boris.ostrovsky@...cle.com>
To:     Borislav Petkov <bp@...en8.de>,
        Mihai Carabas <mihai.carabas@...cle.com>
Cc:     linux-kernel@...r.kernel.org, ashok.raj@...el.com,
        konrad.wilk@...cle.com, patrick.colp@...cle.com,
        kanth.ghatraju@...cle.com, Jon.Grimm@....com,
        Thomas.Lendacky@....com
Subject: Re: [PATCH 1/2] x86/microcode: Update late microcode in parallel

On 8/24/19 4:53 AM, Borislav Petkov wrote:
>  
> +wait_for_siblings:
> +	if (__wait_for_cpus(&late_cpus_out, NSEC_PER_SEC))
> +		panic("Timeout during microcode update!\n");
> +
>  	/*
> -	 * Increase the wait timeout to a safe value here since we're
> -	 * serializing the microcode update and that could take a while on a
> -	 * large number of CPUs. And that is fine as the *actual* timeout will
> -	 * be determined by the last CPU finished updating and thus cut short.
> +	 * At least one thread has completed update on each core.
> +	 * For others, simply call the update to make sure the
> +	 * per-cpu cpuinfo can be updated with right microcode
> +	 * revision.


What is the advantage of having those other threads go through
find_patch() and (in Intel case) intel_get_microcode_revision() (which
involves two MSR accesses) vs. having the master sibling update slaves'
microcode revisions? There are only two things that need to be updated,
uci->cpu_sig.rev and c->microcode.

-boris


>  	 */
> -	if (__wait_for_cpus(&late_cpus_out, NSEC_PER_SEC * num_online_cpus()))
> -		panic("Timeout during microcode update!\n");
> +	if (cpumask_first(topology_sibling_cpumask(cpu)) != cpu)
> +		apply_microcode_local(&err);
>  
>  	return ret;
>  }