update spectre v2 microcodes blacklist

update spectre v2 microcodes blacklist

[Alexander Sergeyev]

Hello,

Intel released an updated microcode revision guidance [1] (8 Feb). The link is 
available in press-release [2], but it's quite easy to miss.

Some microcode revisions that were blacklisted before are now tested and 
pronounced production-ready:

> Lines with “***” were previously recommended to discontinue use. 
> Subsequent testing by Intel has determined that these were unaffected 
> by the stability issues and have been re-released without 
> modification.

I didn't fully match the updated revision guidance and spectre_bad_microcodes[] 
in arch/x86/kernel/cpu/intel.c, but at least microcode 0xc2 for intel skylakes 
should not be blacklisted anymore.

The update is also revelant to a recent blacklist backport to 4.9-stable:
https://patchwork.kernel.org/patch/10209021/

[1] https://newsroom.intel.com/wp-content/uploads/sites/11/2018/02/microcode-update-guidance.pdf
[2] https://newsroom.intel.com/news/security-issue-update-progress-continues-firmware-updates/

Re: update spectre v2 microcodes blacklist

[Alexander Sergeyev]

[-- Attachment #1: Type: text/plain, Size: 1933 bytes --]

>I didn't fully match the updated revision guidance and spectre_bad_microcodes

I compared these lists and it seems that the only difference is about skylakes. 
Everything else is covered by less-or-equal criteria on revision version.

Both desktop and mobile skylakes are stated to be unaffected for 0xC2:

{ INTEL_FAM6_SKYLAKE_DESKTOP,    0x03, 0xc2 }, // signature 0x000506E3
{ INTEL_FAM6_SKYLAKE_MOBILE,     0x03, 0xc2 }, // signature 0x000406E3

I reformated the Intel bulletin into json format for ease of automation and 
batch processing -- it is attached.

Raw diff between the mainline blacklist and the bulletin looks like:
@@ -1,5 +1,6 @@
 { INTEL_FAM6_BROADWELL_CORE,     0x04, 0x28 },
 { INTEL_FAM6_BROADWELL_GT3E,     0x01, 0x1b },
+{ INTEL_FAM6_BROADWELL_X,        0x01, 0x0b000023 },
 { INTEL_FAM6_BROADWELL_X,        0x01, 0x0b000025 },
 { INTEL_FAM6_BROADWELL_XEON_D,   0x02, 0x14 },
 { INTEL_FAM6_BROADWELL_XEON_D,   0x03, 0x07000011 },
@@ -9,12 +10,10 @@
 { INTEL_FAM6_HASWELL_X,          0x02, 0x3b },
 { INTEL_FAM6_HASWELL_X,          0x04, 0x10 },
 { INTEL_FAM6_IVYBRIDGE_X,        0x04, 0x42a },
-{ INTEL_FAM6_KABYLAKE_DESKTOP,   0x09, 0x84 },
-{ INTEL_FAM6_KABYLAKE_DESKTOP,   0x0a, 0x84 },
-{ INTEL_FAM6_KABYLAKE_DESKTOP,   0x0b, 0x84 },
-{ INTEL_FAM6_KABYLAKE_MOBILE,    0x09, 0x84 },
-{ INTEL_FAM6_KABYLAKE_MOBILE,    0x0a, 0x84 },
-{ INTEL_FAM6_SKYLAKE_DESKTOP,    0x03, 0xc2 },
-{ INTEL_FAM6_SKYLAKE_MOBILE,     0x03, 0xc2 },
-{ INTEL_FAM6_SKYLAKE_X,          0x03, 0x0100013e },
+{ INTEL_FAM6_KABYLAKE_DESKTOP,   0x09, 0x80 },
+{ INTEL_FAM6_KABYLAKE_DESKTOP,   0x0a, 0x80 },
+{ INTEL_FAM6_KABYLAKE_DESKTOP,   0x0b, 0x80 },
+{ INTEL_FAM6_KABYLAKE_MOBILE,    0x09, 0x80 },
+{ INTEL_FAM6_KABYLAKE_MOBILE,    0x0a, 0x80 },
+{ INTEL_FAM6_SKYLAKE_X,          0x04, 0x0200003a },
 { INTEL_FAM6_SKYLAKE_X,          0x04, 0x0200003c },

Note: Gemini Lake and Sandy Bridge are not considered (observed in wild).

[-- Attachment #2: microcode-update-guidance.json --]
[-- Type: application/json, Size: 34851 bytes --]

Re: update spectre v2 microcodes blacklist

[David Woodhouse]

[-- Attachment #1: Type: text/plain, Size: 2787 bytes --]



On Sat, 2018-02-10 at 20:14 +0300, Alexander Sergeyev wrote:
> > 
> > I didn't fully match the updated revision guidance and spectre_bad_microcodes
> I compared these lists and it seems that the only difference is about skylakes. 
> Everything else is covered by less-or-equal criteria on revision version.
> 
> Both desktop and mobile skylakes are stated to be unaffected for 0xC2:
> 
> { INTEL_FAM6_SKYLAKE_DESKTOP,    0x03, 0xc2 }, // signature 0x000506E3
> { INTEL_FAM6_SKYLAKE_MOBILE,     0x03, 0xc2 }, // signature 0x000406E3
> 
> I reformated the Intel bulletin into json format for ease of automation and 
> batch processing -- it is attached.
> 
> Raw diff between the mainline blacklist and the bulletin looks like:
> @@ -1,5 +1,6 @@
>  { INTEL_FAM6_BROADWELL_CORE,     0x04, 0x28 },
>  { INTEL_FAM6_BROADWELL_GT3E,     0x01, 0x1b },
> +{ INTEL_FAM6_BROADWELL_X,        0x01, 0x0b000023 },
>  { INTEL_FAM6_BROADWELL_X,        0x01, 0x0b000025 },

That's redundant since blacklisting 0x0b000025 will also stop us from
using 0x0b000023 anyway.

> -{ INTEL_FAM6_KABYLAKE_DESKTOP,   0x09, 0x84 },
> -{ INTEL_FAM6_KABYLAKE_DESKTOP,   0x0a, 0x84 },
> -{ INTEL_FAM6_KABYLAKE_DESKTOP,   0x0b, 0x84 },
> -{ INTEL_FAM6_KABYLAKE_MOBILE,    0x09, 0x84 },
> -{ INTEL_FAM6_KABYLAKE_MOBILE,    0x0a, 0x84 },

No, let's not assume 0x84 will be safe on those just yet. Intel
mentioned 0x84 as bad in one of the revisions of the doc, and it's
safer to leave it blacklisted until they explicitly say otherwise.

> -{ INTEL_FAM6_SKYLAKE_DESKTOP,    0x03, 0xc2 },
> -{ INTEL_FAM6_SKYLAKE_MOBILE,     0x03, 0xc2 },

OK. With 0xc2 being exonerated, I believe there is *no* publicly
released microcode for these which needs to be blacklisted, so they can
be removed entirely.

> -{ INTEL_FAM6_SKYLAKE_X,          0x03, 0x0100013e },

Again, that appeared in an earlier version of the document and hasn't
been explicitly cleared.

> +{ INTEL_FAM6_SKYLAKE_X,          0x04, 0x0200003a },
>  { INTEL_FAM6_SKYLAKE_X,          0x04, 0x0200003c },

Redundant again.

> Note: Gemini Lake and Sandy Bridge are not considered (observed in wild).

Ah, but we have more information now from the doc. 

The Gemini Lake 0x22 was observed in the wild, sure, but is also
explicitly mentioned as OK in the latest doc. So I removed it from the
blacklist (again, with no prior Gemini Lake bad microcode, so the line
can be removed entirely).

The Sandy Bridge ones observed in the wild are, however, *newer* than
the "Pre-Mitigation Production MCU" listed for the corresponding CPU in
the table, and thus we should assume they should still be blacklisted.

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5213 bytes --]

RE: update spectre v2 microcodes blacklist

[Van De Ven, Arjan]

> > Raw diff between the mainline blacklist and the bulletin looks like:
> > @@ -1,5 +1,6 @@
> >  { INTEL_FAM6_BROADWELL_CORE,     0x04, 0x28 },
> >  { INTEL_FAM6_BROADWELL_GT3E,     0x01, 0x1b },
> > +{ INTEL_FAM6_BROADWELL_X,        0x01, 0x0b000023 },
> >  { INTEL_FAM6_BROADWELL_X,        0x01, 0x0b000025 },
> 
> That's redundant since blacklisting 0x0b000025 will also stop us from
> using 0x0b000023 anyway.

and 23 is the pre security version so known good.

Re: update spectre v2 microcodes blacklist

[Alexander Sergeyev]

>>> +{ INTEL_FAM6_BROADWELL_X,        0x01, 0x0b000023 },
>> That's redundant since blacklisting 0x0b000025 will also stop us from
>> using 0x0b000023 anyway.

>and 23 is the pre security version so known good.

But 0x0b000023 is listed under "stop deploying these MCU revs" (page 4, row 4).
Has something changed?