linux-kernel - Re: [patch 29/30] x86/microcode: Prepare for minimal revision check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c565b5a1-df02-8dfb-e93b-fa72254c896c@linux.intel.com>
Date:   Fri, 11 Aug 2023 07:20:04 -0700
From:   Arjan van de Ven <arjan@...ux.intel.com>
To:     Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>, x86@...nel.org,
        Borislav Petkov <bp@...en8.de>, Ashok Raj <ashok.raj@...el.com>
Subject: Re: [patch 29/30] x86/microcode: Prepare for minimal revision check

On 8/10/2023 1:54 PM, Peter Zijlstra wrote:
> On Thu, Aug 10, 2023 at 08:38:09PM +0200, Thomas Gleixner wrote:
>> From: Thomas Gleixner <tglx@...utronix.de>
>>
>> Applying microcode late can be fatal for the running kernel when the update
>> changes functionality which is in use already in a non-compatible way,
>> e.g. by removing a CPUID bit.
> 
> This includes all compatibility constraints? Because IIRC we've also had
> trouble because a CPUID bit got set. Kernel didn't know about, didn't

do you have the details on that -- I don't know of any of those outside
of enumerating the sidechannel status cpuid bits.

> manage it, but userspace saw the bit and happily tried to use it.

yes it contains all the compatibility constraints the OS folks (e.g. the intel kernel folks)
could convey to the microcode team. If you think the constraints are
not complete please help us improve them

> 
> Ofc I can't remember the exact case :/ but anything that changes the
> xsave size/state would obviously cause trouble.

of course that cant' happen at runtime at all correctly.
>