On 1/30/2018 5:11 AM, Borislav Petkov wrote:
On Tue, Jan 30, 2018 at 01:57:21PM +0100, Thomas Gleixner wrote:
So much for the theory. That's not going to work. If the boot cpu has the
feature then the alternatives will have been applied. So even if the flag
mismatch can be observed when a secondary CPU comes up the outcome will be
access to a non existing MSR and #GP.
Yes, with mismatched microcode we're f*cked.
I think in the super early days of SMP there was an occasional broken BIOS.
(and when Linux then did the ucode update it was sane again)
Not since a long time though (I think the various certification suites check
for it now)
So my question is: is there such microcode out there or is this
something theoretical which we want to address?
at this point it's insane theoretical; no OS can actually cope with this, so
if you're an OEM selling this, your customer can run zero OSes ;-)
(.. and adressing this will be ugly, no matter what.)
And if I were able to wish, I'd like to blacklist that microcode in
dracut so that it doesn't come anywhere near my system.
I'm not sure what you'd want dracut to do... panic() the system
on such a bios?
