Bug #13901
closedIncorrect calculation of Intel microcode extended patch signature checksum
100%
Description
The calculation that is currently done to validate entries in the Extended Processor Signature Table within Intel microcode updates is incorrect. With the latest Intel microcode files, ucodeadm generates errors such as:
% ucodeadm -i -R . intel-06-86-04 ucodeadm: intel-06-86-04: Checksum is invalid
From IntelĀ® 64 and IA-32 Architectures Software Developer's Manual Volume 3A: System Programming Guide, Part 1, Table 9-7:
To calculate the Checksum, substitute the Primary Processor Signature entry and the Processor Flags entry with the corresponding Extended Patch entry. Delete the Extended Processor Signature Table entries. The Checksum is correct when the summation of all DWORDs that comprise the created Extended Processor Patch results in 00000000H.
.. and we are not doing that, we're just expecting each individual extended signature entry (including its checksum) to sum to uint32_t zero.
Related issues
Updated by Andy Fiddaman over 2 years ago
Having corrected the checksum verification for this, the 06-86-04 update file contains two extended signatures, one which matches the file header (0x80665) and one additional (0x80664)
% mdb intel-06-86-04 > ::typedef -r ucodeadm > 0::print ucode_header_intel_t { uh_header_ver = 0x1 uh_rev = 0xb00000f uh_date = 0x2172021 uh_signature = 0x80665 uh_checksum = 0xed327ec0 uh_loader_ver = 0x1 uh_proc_flags = 0x1 uh_body_size = 0x1fba4 uh_total_size = 0x1fc00 uh_reserved = [ 0, 0, 0 ] } > ::sizeof ucode_header_intel_t sizeof (ucode_header_intel_t) = 0x30 > 0x1fba4 + 0x30::print ucode_ext_table_intel_t { uet_count = 0x2 uet_checksum = 0x258af5b2 uet_reserved = [ 0, 0, 0 ] uet_ext_sig = [ { ues_signature = 0x80665 ues_proc_flags = 0x1 ues_checksum = 0xed327ec0 }, ] } > 0x1fba4 + 0x30::print ucode_ext_table_intel_t uet_ext_sig[1] mdb: index 1 is outside of array bounds [0 .. 0] uet_ext_sig[1] = { uet_ext_sig[1].ues_signature = 0x80664 uet_ext_sig[1].ues_proc_flags = 0x1 uet_ext_sig[1].ues_checksum = 0xed327ec1 }
Running the updated ucodeadm
generates both files as expected (as hardlinks)
% ./ucodeadm -i -R . intel-06-86-04 % ls -li 000* 49735 -r--r--r-- 3 af other 127K Jun 24 10:47 00080664-01 49735 -r--r--r-- 3 af other 127K Jun 24 10:47 00080665-01
Updated by Andy Fiddaman over 2 years ago
- Related to Bug #13900: Update Intel microcode to 20210608 added
Updated by Andy Fiddaman over 2 years ago
I've tested that ucodeadm
can now properly process microcode files which have an extended signature table and generate the correct output. I have not booted one of the affected CPUs to confirm that the kernel will accept the generated update.
Updated by Electric Monk over 2 years ago
- Status changed from In Progress to Closed
- % Done changed from 0 to 100
git commit afcdc73a9924f4ee06d1c0e75823ab1db7d742c3
commit afcdc73a9924f4ee06d1c0e75823ab1db7d742c3 Author: Andy Fiddaman <omnios@citrus-it.co.uk> Date: 2021-07-06T20:48:32.000Z 13901 Incorrect calculation of Intel microcode extended patch signature checksum Reviewed by: Toomas Soome <tsoome@me.com> Reviewed by: Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org> Approved by: Robert Mustacchi <rm@fingolfin.org>