linux-kernel - Re: x86: AMD Zen2 ymm registers rolling back

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8eff0a18-7faa-1135-a558-40150f4443e5@citrix.com>
Date:   Tue, 28 Feb 2023 19:38:53 +0000
From:   Andrew Cooper <andrew.cooper3@...rix.com>
To:     Alexander Monakov <amonakov@...ras.ru>,
        Borislav Petkov <bp@...en8.de>
Cc:     Tavis Ormandy <taviso@...il.com>, linux-kernel@...r.kernel.org,
        x86@...nel.org
Subject: Re: x86: AMD Zen2 ymm registers rolling back

On 28/02/2023 7:29 pm, Alexander Monakov wrote:
> On Tue, 28 Feb 2023, Borislav Petkov wrote:
>
>> On Tue, Feb 28, 2023 at 10:24:40PM +0300, Alexander Monakov wrote:
>>> No, on the contrary, if there were no updates I would not be able to
>>> see microcode version increase after updating.
>> So what are you saying then?
> That I can reproduce the bug even with the latest BIOS, i.e. the microcode
> in the latest BIOS update does not have the fix, and the linux-firmware.git
> microcode does not have a patch for this CPU family at all.
>
> Hence the question how to get fixed microcode for this CPU family.

I shouldn't be recommending this, but I've begged AMD many times to be
better at publishing microcode...

https://github.com/platomav/CPUMicrocodes

and you'll need

---8<---
#!/usr/bin/env python3
# -*- coding:utf-8 -*-

import sys
from pathlib import Path
from struct import pack

fout = sys.stdout

def stream_write(_):
    """Write to the output"""
    return fout.buffer.write(_)

blobs = []
for ucode in sorted(sys.argv[1:]):

    # cpu00xx0Fxx_
    fm = int(ucode[3:11], 16)

    eq = int("".join([ucode[5], ucode[6], ucode[9], ucode[10]]), 16)
    sz = Path(ucode).stat().st_size

    print("%08x, %s => %04x" % (fm, ucode[3:11], eq), file=sys.stderr)

    blobs.append((fm, eq, sz, open(ucode, "rb").read()))

equiv = []
for x in blobs:
    equiv.append(pack(b"=IIIHH", x[0], 0, 0, x[1], 0))
equiv.append(pack("=IIIHH", 0, 0, 0, 0, 0))

stream_write(pack("I", 0x00414d44)) # Magic

equiv_bin = b"".join(equiv)

stream_write(pack("II", 0, len(equiv_bin))) # Equiv table
stream_write(equiv_bin)

for blob in blobs:
    stream_write(pack("II", 1, len(blob[3])))
    stream_write(blob[3])
---8<---

to wrap the blob(s) from that git repo into the container format that
Linux and others know how to parse.

~Andrew