linux-kernel - Re: [patch V2 02/37] x86/microcode: Hide the config knob

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZNq/agLqraP0IYwR@localhost>
Date:   Mon, 14 Aug 2023 16:57:30 -0700
From:   Josh Triplett <josh@...htriplett.org>
To:     Borislav Petkov <bp@...en8.de>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        LKML <linux-kernel@...r.kernel.org>, x86@...nel.org,
        Ashok Raj <ashok.raj@...el.com>,
        Arjan van de Ven <arjan@...ux.intel.com>,
        Nikolay Borisov <nik.borisov@...e.com>
Subject: Re: [patch V2 02/37] x86/microcode: Hide the config knob

On Mon, Aug 14, 2023 at 11:19:12PM +0200, Borislav Petkov wrote:
> On Mon, Aug 14, 2023 at 02:01:03PM -0700, Josh Triplett wrote:
> > I'd be happy to help keep this case building. Would you consider
> > accepting a patch atop this series re-introducing minimal support for
> > disabling this?
> 
> And a couple more KBs of builtin code is a problem because?

Multiple reasons. First, because "a couple more KBs" (concretely, 4637
bytes in this case) add up across the kernel. Second, because disabling
something is the easiest way to guarantee spending *zero* boot time on
it. And third, because I just confirmed that this requires a *trivial*
patch to support (apart from re-enabling the config option):

--- a/arch/x86/include/asm/microcode.h
+++ b/arch/x86/include/asm/microcode.h
@@ -68,11 +68,12 @@ static inline u32 intel_get_microcode_revision(void)
 
         return rev;
 }
+#endif /* CONFIG_CPU_SUP_INTEL */
 
+#if defined(CONFIG_MICROCODE) && defined(CONFIG_CPU_SUP_INTEL)
 void show_ucode_info_early(void);
-
-#else /* CONFIG_CPU_SUP_INTEL */
+#else
 static inline void show_ucode_info_early(void) { }
-#endif /* !CONFIG_CPU_SUP_INTEL */
+#endif
 
 #endif /* _ASM_X86_MICROCODE_H */