linux-kernel - Re: [PATCH] x86/microcode/intel: Allow late loading only if a min rev is specified

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 29 Aug 2022 11:36:12 -0700
From:   Dave Hansen <dave.hansen@...el.com>
To:     Ashok Raj <ashok.raj@...el.com>, Borislav Petkov <bp@...en8.de>,
        Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML Mailing List <linux-kernel@...r.kernel.org>,
        X86-kernel <x86@...nel.org>,
        Andy Lutomirski <luto@...capital.net>,
        Ingo Molnar <mingo@...nel.org>,
        Tom Lendacky <thomas.lendacky@....com>,
        Tony Luck <tony.luck@...el.com>
Subject: Re: [PATCH] x86/microcode/intel: Allow late loading only if a min rev
 is specified

On 8/29/22 11:04, Ashok Raj wrote:
> Any microcode that modifies the interface to an OS-visible feature
> will set the min_version to itself. This will enforce this microcode is
> not suitable for late loading unless the currently loaded revision is greater
> or equal to the new microcode affecting the change.

I know this hasn't quite made it into the normal Intel documentation
channels.  But, it would be nice to make sure that we have a _really_
solid description here of the architecture of min_rev which is *very*
close to what the Intel folks building microcode images agreed to.

This whole thing is useless if the architecture contract isn't ironclad
and agreed to by both sides.

One other thing on that note...  The CPU itself authenticates the
microcode.  The OS trusts that the CPU will verify the integrity of the
image.

But, this min_rev is not part of the image that the CPU verifies, right?
 If you get your microcode images out of the back of a van in the shady
part of town, nobody can promise that min_rev in the header follows the
rules.

I don't think we need to defend against that.  I'm not sure we really
even *can* defend against it.  It's probably good to note, though.