x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY

PATCH In review Borislav Petkov 5 participants 11 messages Jul 26, 2016 – Jul 27, 2016

Subsystems (2)

x86 x86 microcode update support

lore

Share & tools

lore

Borislav Petkov

author maintainer

2016-07-26 09:51 UTC #0 lore raw

PATCH 1/1 x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY

From: Borislav Petkov <[email protected]>

CONFIG_RANDOMIZE_MEMORY randomizes the physical memmap and thus the address where the initrd is located. Therefore, we need to add the offset KASLR put us to in order to find the initrd again on the AP path.

In the future, we will get rid of the initrd address caching and query the address on both the BSP and AP paths but that would need more work.

Thanks to Nicolai Stange for the good bisection and debugging work.

Reported-and-tested-by Nicolai Stange <[email protected]>

Signed-off-by Borislav Petkov <[email protected]>

Cc Kees Cook <[email protected]>

---
 arch/x86/kernel/cpu/microcode/intel.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

arch/x86/kernel/cpu/microcode/intel.c +14 -2

index 6515c802346a..c5a7d74a9fa6 100644
@@ -793,10 +793,10 @@ void __init load_ucode_intel_bsp(void)
 void load_ucode_intel_ap(void)
 {
 	struct ucode_blobs *blobs_p;
+	unsigned long *ptrs, start = 0;
 	struct mc_saved_data *mcs;
 	struct ucode_cpu_info uci;
 	enum ucode_state ret;
-	unsigned long *ptrs;
 
 #ifdef CONFIG_X86_32
 	mcs	= (struct mc_saved_data *)__pa_nodebug(&mc_saved_data);

@@ -815,8 +815,20 @@ void load_ucode_intel_ap(void)
 	if (!mcs->num_saved)
 		return;
 
+	if (blobs_p->valid) {
+		start = blobs_p->start;
+
+#ifdef CONFIG_RANDOMIZE_MEMORY
+		/*
+		 * Pay attention to CONFIG_RANDOMIZE_MEMORY as it shuffles
+		 * physmem mapping too and there we have the initrd.
+		 */
+		start += (PAGE_OFFSET - __PAGE_OFFSET_BASE);
+#endif
+	}
+
 	collect_cpu_info_early(&uci);
-	ret = load_microcode(mcs, ptrs, blobs_p->start, &uci);
+	ret = load_microcode(mcs, ptrs, start, &uci);
 	if (ret != UCODE_OK)
 		return;

Signature · 1 line

2.8.4

tip-bot for Borislav Petkov

merge bot

2016-07-26 17:37 UTC #1 lore raw

[tip:x86/microcode] x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY=y

x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY=y

Commit-ID:  efaad554b4ffae1840a2759e09e21325ddbc8b05
Gitweb:     http://git.kernel.org/tip/efaad554b4ffae1840a2759e09e21325ddbc8b05
Author:     Borislav Petkov <[email protected]>
AuthorDate: Tue, 26 Jul 2016 11:51:38 +0200
Committer:  Ingo Molnar <[email protected]>
CommitDate: Tue, 26 Jul 2016 19:32:57 +0200

x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY=y

CONFIG_RANDOMIZE_MEMORY=y randomizes the physical memmap and thus the address where the initrd is located. Therefore, we need to add the offset KASLR put us to in order to find the initrd again on the AP path.

In the future, we will get rid of the initrd address caching and query the address on both the BSP and AP paths but that would need more work.

Thanks to Nicolai Stange for the good bisection and debugging work.

Reported-and-tested-by Nicolai Stange <[email protected]>

Signed-off-by Borislav Petkov <[email protected]>

Cc Kees Cook <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Ingo Molnar <[email protected]>

---
 arch/x86/kernel/cpu/microcode/intel.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

arch/x86/kernel/cpu/microcode/intel.c +14 -2

index 6515c80..0f97ae9 100644
@@ -793,10 +793,10 @@ void __init load_ucode_intel_bsp(void)
 void load_ucode_intel_ap(void)
 {
 	struct ucode_blobs *blobs_p;
+	unsigned long *ptrs, start = 0;
 	struct mc_saved_data *mcs;
 	struct ucode_cpu_info uci;
 	enum ucode_state ret;
-	unsigned long *ptrs;
 
 #ifdef CONFIG_X86_32
 	mcs	= (struct mc_saved_data *)__pa_nodebug(&mc_saved_data);

@@ -815,8 +815,20 @@ void load_ucode_intel_ap(void)
 	if (!mcs->num_saved)
 		return;
 
+	if (blobs_p->valid) {
+		start = blobs_p->start;
+
+#ifdef CONFIG_RANDOMIZE_MEMORY
+		/*
+		 * Pay attention to CONFIG_RANDOMIZE_MEMORY=y as it shuffles
+		 * physmem mapping too and there we have the initrd.
+		 */
+		start += PAGE_OFFSET - __PAGE_OFFSET_BASE;
+#endif
+	}
+
 	collect_cpu_info_early(&uci);
-	ret = load_microcode(mcs, ptrs, blobs_p->start, &uci);
+	ret = load_microcode(mcs, ptrs, start, &uci);
 	if (ret != UCODE_OK)
 		return;

Kees Cook

2016-07-26 20:37 UTC #2 lore raw

Re: [tip:x86/microcode] x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY=y

Quoted 47 lines · tip-bot for Borislav Petkov

Commit-ID:  efaad554b4ffae1840a2759e09e21325ddbc8b05
Gitweb:     http://git.kernel.org/tip/efaad554b4ffae1840a2759e09e21325ddbc8b05
Author:     Borislav Petkov <[email protected]>
AuthorDate: Tue, 26 Jul 2016 11:51:38 +0200
Committer:  Ingo Molnar <[email protected]>
CommitDate: Tue, 26 Jul 2016 19:32:57 +0200
x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY=y
CONFIG_RANDOMIZE_MEMORY=y randomizes the physical memmap and thus the address where the initrd is located. Therefore, we need to add the offset KASLR put us to in order to find the initrd again on the AP path.
In the future, we will get rid of the initrd address caching and query the address on both the BSP and AP paths but that would need more work.
Thanks to Nicolai Stange for the good bisection and debugging work.
Reported-and-tested-by Nicolai Stange <[email protected]>
Signed-off-by Borislav Petkov <[email protected]>
Cc Kees Cook <[email protected]>
Cc Linus Torvalds <[email protected]>
Cc Peter Zijlstra <[email protected]>
Cc Thomas Gleixner <[email protected]>
Link http://lkml.kernel.org/r/[email protected] open here
Signed-off-by Ingo Molnar <[email protected]>
---
 arch/x86/kernel/cpu/microcode/intel.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/microcode/intel.c +1 -1
index 6515c80..0f97ae9 100644
@@ -793,10 +793,10 @@ void __init load_ucode_intel_bsp(void)
 void load_ucode_intel_ap(void)
 {
        struct ucode_blobs *blobs_p;
+       unsigned long *ptrs, start = 0;
        struct mc_saved_data *mcs;
        struct ucode_cpu_info uci;
        enum ucode_state ret;
-       unsigned long *ptrs;
 
 #ifdef CONFIG_X86_32
        mcs     = (struct mc_saved_data *)__pa_nodebug(&mc_saved_data);

arch/x86/kernel/cpu/microcode/intel.c void load_ucode_intel_ap(void) · line 821

Quoted 7 lines

arch/x86/kernel/cpu/microcode/intel.c +4 -0

@@ -815,8 +815,20 @@ void load_ucode_intel_ap(void)
        if (!mcs->num_saved)
                return;
 
+       if (blobs_p->valid) {
+               start = blobs_p->start;
+
+#ifdef CONFIG_RANDOMIZE_MEMORY

These ifdefs aren't needed if we added a no-op __PAGE_OFFSET_BASE to the 32-bit page table headers. Then the compiler will DTRT with the start calculation. When CONFIG_RANDOMIZE_MEMORY is set, start will have a non-zero value, and when not set it'll be 0.

Quoted 14 lines

arch/x86/kernel/cpu/microcode/intel.c +9 -1

+               /*
+                * Pay attention to CONFIG_RANDOMIZE_MEMORY=y as it shuffles
+                * physmem mapping too and there we have the initrd.
+                */
+               start += PAGE_OFFSET - __PAGE_OFFSET_BASE;
+#endif
+       }
+
        collect_cpu_info_early(&uci);
-       ret = load_microcode(mcs, ptrs, blobs_p->start, &uci);
+       ret = load_microcode(mcs, ptrs, start, &uci);
        if (ret != UCODE_OK)
                return;

Signature · 2 lines

Kees Cook
Chrome OS & Brillo Security

Borislav Petkov

2016-07-27 05:46 UTC #3 lore raw

Re: [tip:x86/microcode] x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY=y

Quoted 4 lines · Kees Cook

These ifdefs aren't needed if we added a no-op __PAGE_OFFSET_BASE to the 32-bit page table headers. Then the compiler will DTRT with the start calculation. When CONFIG_RANDOMIZE_MEMORY is set, start will have a non-zero value, and when not set it'll be 0.

Something like this? I'm trying to mimick the 64-bit version:

---

arch/x86/include/asm/page_32_types.h +2 -1

index 3a52ee0e726d..3bae4969ac65 100644
@@ -13,7 +13,8 @@
  * If you want more physical memory than this then see the CONFIG_HIGHMEM4G
  * and CONFIG_HIGHMEM64G options in the kernel configuration.
  */
-#define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
+#define __PAGE_OFFSET_BASE	_AC(CONFIG_PAGE_OFFSET, UL)
+#define __PAGE_OFFSET		__PAGE_OFFSET_BASE
 
 #define __START_KERNEL_map	__PAGE_OFFSET

Signature · 7 lines

Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--

Borislav Petkov

2016-07-27 08:10 UTC #4 lore raw

PATCH 1/2 x86/asm: Add __PAGE_OFFSET_BASE define on 32-bit

From: Borislav Petkov <[email protected]>

... in order to avoid ifdeffery in code computing the ASLR randomization offset.

Suggested-by Kees Cook <[email protected]>

Signed-off-by Borislav Petkov <[email protected]>

---
 arch/x86/include/asm/page_32_types.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/x86/include/asm/page_32_types.h +2 -1

index 3a52ee0e726d..3bae4969ac65 100644
@@ -13,7 +13,8 @@
  * If you want more physical memory than this then see the CONFIG_HIGHMEM4G
  * and CONFIG_HIGHMEM64G options in the kernel configuration.
  */
-#define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
+#define __PAGE_OFFSET_BASE	_AC(CONFIG_PAGE_OFFSET, UL)
+#define __PAGE_OFFSET		__PAGE_OFFSET_BASE
 
 #define __START_KERNEL_map	__PAGE_OFFSET

Signature · 11 lines

2.8.4


-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--

Ingo Molnar

2016-07-27 09:05 UTC #5 lore raw

Re: [PATCH -v2 1/2] x86/asm: Add __PAGE_OFFSET_BASE define on 32-bit

Quoted 16 lines · Borislav Petkov

From: Borislav Petkov <[email protected]>
... in order to avoid ifdeffery in code computing the ASLR randomization offset.
Suggested-by Kees Cook <[email protected]>
Signed-off-by Borislav Petkov <[email protected]>
---
 arch/x86/include/asm/page_32_types.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/include/asm/page_32_types.h +0 -0
index 3a52ee0e726d..3bae4969ac65 100644

arch/x86/include/asm/page_32_types.h line 17

Quoted 6 lines

arch/x86/include/asm/page_32_types.h +2 -1

@@ -13,7 +13,8 @@
  * If you want more physical memory than this then see the CONFIG_HIGHMEM4G
  * and CONFIG_HIGHMEM64G options in the kernel configuration.
  */
-#define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
+#define __PAGE_OFFSET_BASE	_AC(CONFIG_PAGE_OFFSET, UL)
+#define __PAGE_OFFSET		__PAGE_OFFSET_BASE

Could you please send a delta patch for this? I've already applied the original fix, with a few minor edits.

Thanks,

Ingo

Borislav Petkov

2016-07-27 09:10 UTC #6 lore raw

Re: [PATCH -v2 1/2] x86/asm: Add __PAGE_OFFSET_BASE define on 32-bit

Quoted 2 lines · Ingo Molnar

Could you please send a delta patch for this? I've already applied the original fix, with a few minor edits.

Ontop of this?

http://git.kernel.org/tip/efaad554b4ffae1840a2759e09e21325ddbc8b05

Signature · 7 lines

Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--

Ingo Molnar

2016-07-27 10:37 UTC #7 lore raw

Re: [PATCH -v2 1/2] x86/asm: Add __PAGE_OFFSET_BASE define on 32-bit

Quoted 7 lines · Borislav Petkov

Quoted 2 lines · Ingo Molnar
Could you please send a delta patch for this? I've already applied the original fix, with a few minor edits.
Ontop of this?
http://git.kernel.org/tip/efaad554b4ffae1840a2759e09e21325ddbc8b05

On top of:

tip/x86/microcode df15929f8f5c: Merge branch 'linus' into x86/microcode, to pick up merge window changes

(the merge commit is fresh, I just pushed it out)

... because this way there's actually a CONFIG_RANDOMIZE_MEMORY option available in that kernel tree.

Thanks,

Ingo

Borislav Petkov

2016-07-27 12:09 UTC #8 lore raw

PATCH 1/1 x86/asm, microcode: Add __PAGE_OFFSET_BASE define on 32-bit

Quoted 8 lines · Ingo Molnar

On top of:
tip/x86/microcode df15929f8f5c: Merge branch 'linus' into x86/microcode, to pick up merge window changes
(the merge commit is fresh, I just pushed it out)
... because this way there's actually a CONFIG_RANDOMIZE_MEMORY option available in that kernel tree.

Here it is:

---
From: Borislav Petkov <[email protected]>
Subject: [PATCH] x86/asm, microcode: Add __PAGE_OFFSET_BASE define on 32-bit

... in order to avoid ifdeffery in code computing the ASLR randomization offset. Remove that ifdeffery in the microcode loader.

Suggested-by Kees Cook <[email protected]>

Signed-off-by Borislav Petkov <[email protected]>

---
 arch/x86/include/asm/page_32_types.h  | 3 ++-
 arch/x86/kernel/cpu/microcode/intel.c | 2 --
 2 files changed, 2 insertions(+), 3 deletions(-)

arch/x86/include/asm/page_32_types.h +2 -1

index 3a52ee0e726d..3bae4969ac65 100644
@@ -13,7 +13,8 @@
  * If you want more physical memory than this then see the CONFIG_HIGHMEM4G
  * and CONFIG_HIGHMEM64G options in the kernel configuration.
  */
-#define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
+#define __PAGE_OFFSET_BASE	_AC(CONFIG_PAGE_OFFSET, UL)
+#define __PAGE_OFFSET		__PAGE_OFFSET_BASE
 
 #define __START_KERNEL_map	__PAGE_OFFSET

arch/x86/kernel/cpu/microcode/intel.c +0 -2

index 0f97ae93441b..cdc0deab00c9 100644
@@ -818,13 +818,11 @@ void load_ucode_intel_ap(void)
 	if (blobs_p->valid) {
 		start = blobs_p->start;
 
-#ifdef CONFIG_RANDOMIZE_MEMORY
 		/*
 		 * Pay attention to CONFIG_RANDOMIZE_MEMORY=y as it shuffles
 		 * physmem mapping too and there we have the initrd.
 		 */
 		start += PAGE_OFFSET - __PAGE_OFFSET_BASE;
-#endif
 	}
 
 	collect_cpu_info_early(&uci);

Signature · 10 lines

2.8.4

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--

tip-bot for Borislav Petkov

merge bot

2016-07-27 17:10 UTC #9 lore raw

[tip:x86/microcode] x86/asm, x86/microcode: Add __PAGE_OFFSET_BASE define on 32-bit

x86/asm, x86/microcode: Add __PAGE_OFFSET_BASE define on 32-bit

Commit-ID:  4a1a8e1b8f9f37bdbba416eb0a5ff3f47d31cb28
Gitweb:     http://git.kernel.org/tip/4a1a8e1b8f9f37bdbba416eb0a5ff3f47d31cb28
Author:     Borislav Petkov <[email protected]>
AuthorDate: Wed, 27 Jul 2016 14:09:39 +0200
Committer:  Ingo Molnar <[email protected]>
CommitDate: Wed, 27 Jul 2016 14:59:59 +0200

x86/asm, x86/microcode: Add __PAGE_OFFSET_BASE define on 32-bit

... in order to avoid #ifdeffery in code computing the ASLR randomization offset. Remove that #ifdeffery in the microcode loader.

Suggested-by Kees Cook <[email protected]>

Signed-off-by Borislav Petkov <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Nicolai Stange <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Garnier <[email protected]>

Cc Thomas Gleixner <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Ingo Molnar <[email protected]>

---
 arch/x86/include/asm/page_32_types.h  | 3 ++-
 arch/x86/kernel/cpu/microcode/intel.c | 2 --
 2 files changed, 2 insertions(+), 3 deletions(-)

arch/x86/include/asm/page_32_types.h +2 -1

index 3a52ee0..3bae496 100644
@@ -13,7 +13,8 @@
  * If you want more physical memory than this then see the CONFIG_HIGHMEM4G
  * and CONFIG_HIGHMEM64G options in the kernel configuration.
  */
-#define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
+#define __PAGE_OFFSET_BASE	_AC(CONFIG_PAGE_OFFSET, UL)
+#define __PAGE_OFFSET		__PAGE_OFFSET_BASE
 
 #define __START_KERNEL_map	__PAGE_OFFSET

arch/x86/kernel/cpu/microcode/intel.c +0 -2

index 0f97ae9..cdc0dea 100644
@@ -818,13 +818,11 @@ void load_ucode_intel_ap(void)
 	if (blobs_p->valid) {
 		start = blobs_p->start;
 
-#ifdef CONFIG_RANDOMIZE_MEMORY
 		/*
 		 * Pay attention to CONFIG_RANDOMIZE_MEMORY=y as it shuffles
 		 * physmem mapping too and there we have the initrd.
 		 */
 		start += PAGE_OFFSET - __PAGE_OFFSET_BASE;
-#endif
 	}
 
 	collect_cpu_info_early(&uci);

Borislav Petkov

2016-07-27 08:11 UTC #10 lore raw

PATCH 2/2 x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY

In reply to Borislav Petkov

From: Borislav Petkov <[email protected]>

In the future, we will get rid of the initrd address caching and query the address on both the BSP and AP paths but that would need more work.

Thanks to Nicolai Stange for the good bisection and debugging work.

Reported-and-tested-by Nicolai Stange <[email protected]>

Signed-off-by Borislav Petkov <[email protected]>

Cc Kees Cook <[email protected]>

---
 arch/x86/kernel/cpu/microcode/intel.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

arch/x86/kernel/cpu/microcode/intel.c +12 -2

index 6515c802346a..2a542b71d910 100644
@@ -793,10 +793,10 @@ void __init load_ucode_intel_bsp(void)
 void load_ucode_intel_ap(void)
 {
 	struct ucode_blobs *blobs_p;
+	unsigned long *ptrs, start = 0;
 	struct mc_saved_data *mcs;
 	struct ucode_cpu_info uci;
 	enum ucode_state ret;
-	unsigned long *ptrs;
 
 #ifdef CONFIG_X86_32
 	mcs	= (struct mc_saved_data *)__pa_nodebug(&mc_saved_data);

@@ -815,8 +815,18 @@ void load_ucode_intel_ap(void)
 	if (!mcs->num_saved)
 		return;
 
+	if (blobs_p->valid) {
+		start = blobs_p->start;
+
+		/*
+		 * Pay attention to CONFIG_RANDOMIZE_MEMORY as it shuffles
+		 * physmem mapping too and there we have the initrd.
+		 */
+		start += (PAGE_OFFSET - __PAGE_OFFSET_BASE);
+	}
+
 	collect_cpu_info_early(&uci);
-	ret = load_microcode(mcs, ptrs, blobs_p->start, &uci);
+	ret = load_microcode(mcs, ptrs, start, &uci);
 	if (ret != UCODE_OK)
 		return;

Signature · 8 lines

2.8.4


-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.