On Thu, Mar 06, 2025 at 06:50:13AM +0100, Bastian Blank wrote: > On Thu, Mar 06, 2025 at 05:48:56AM +0100, Solar Designer wrote: > > > First of all, there's an equivalent change in Linux. > > > https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bb2281fb05e50108ce95c43ab7e701ee564565c8 > > Oh, I had missed that, thanks! > > Who is expected to maintain this list of hashes? Because this sounds > like a huge maintenance hog, as this will now block any security updates > of the microcode.
Per my skimming of the Linux patch above, need_sha_check() _partially_ addresses this concern by only requiring hashes for new microcode when the currently loaded microcode is below certain revisions (perhaps those where AMD has fixed this issue). So it appears it won't be possible to load some future microcode off a vulnerable microcode right away, but it should be possible to do the same in two steps - load the current fixed version first, then load whatever future version. An issue is that Linux distros' userland packages and generated initramfs images are not prepared to use such two-step process, so your concern seems valid. I hope someone corrects me if I misunderstood any of this. Alexander
