linux-kernel - Re: [PATCH][v2] x86/microcode/intel: check cpu stepping and processor flag before saving microcode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201117091837.GA5719@zn.tnic>
Date:   Tue, 17 Nov 2020 10:18:37 +0100
From:   Borislav Petkov <bp@...en8.de>
To:     Chen Yu <yu.c.chen@...el.com>
Cc:     Andy Lutomirski <luto@...capital.net>,
        Ashok Raj <ashok.raj@...el.com>,
        "Hansen, Dave" <dave.hansen@...el.com>,
        Len Brown <len.brown@...el.com>,
        "Rafael J. Wysocki" <rjw@...ysocki.net>,
        Tony Luck <tony.luck@...el.com>, x86@...nel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH][v2] x86/microcode/intel: check cpu stepping and
 processor flag before saving microcode

On Tue, Nov 17, 2020 at 10:25:18AM +0800, Chen Yu wrote:
> If I understand correctly, the only place that invokes
> save_mc_for_early() is in generic_load_microcode(). While in
> generic_load_microcode() only microcode has a newer version will be
> saved by checking has_newer_microcode(), and this function leverages
> find_matching_signature() to check if the candidate is of the same
> signature. So when it comes to save_microcode_patch(), the signature
> already matches. In case save_mc_for_early() will be invoked by other
> function in the future, it is okay to add this check too.

The important aspect is that you need to save in intel_ucode_patch
the *exact* patch for the CPU you're running on. The code above that
in save_microcode_patch() adds patches of the same family/model but
*not* same stepping to the microcode cache in case we want to support
mixed-stepping revisions. And those you don't need to check for exact
match.

What I'd like, however, is to get rid of that mixed-stepping support -
which is total nonsense anyway, if you ask me - and that would simplify
the code a *lot* more.

Thx for testing.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette