linux-kernel - Re: [tip:x86/microcode] x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5jLWbdKMzAKSpwBwF2r0GF5292Ky5OtRafPZCjfpLW91UA@mail.gmail.com>
Date:	Tue, 26 Jul 2016 13:37:07 -0700
From:	Kees Cook <keescook@...omium.org>
To:	Ingo Molnar <mingo@...nel.org>,
	Thomas Garnier <thgarnie@...gle.com>
Cc:	Nicolai Stange <nicstange@...il.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Borislav Petkov <bp@...e.de>, "H. Peter Anvin" <hpa@...or.com>,
	Peter Zijlstra <peterz@...radead.org>,
	"linux-tip-commits@...r.kernel.org" 
	<linux-tip-commits@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [tip:x86/microcode] x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY=y

On Tue, Jul 26, 2016 at 10:37 AM, tip-bot for Borislav Petkov
<tipbot@...or.com> wrote:
> Commit-ID:  efaad554b4ffae1840a2759e09e21325ddbc8b05
> Gitweb:     http://git.kernel.org/tip/efaad554b4ffae1840a2759e09e21325ddbc8b05
> Author:     Borislav Petkov <bp@...e.de>
> AuthorDate: Tue, 26 Jul 2016 11:51:38 +0200
> Committer:  Ingo Molnar <mingo@...nel.org>
> CommitDate: Tue, 26 Jul 2016 19:32:57 +0200
>
> x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY=y
>
> CONFIG_RANDOMIZE_MEMORY=y randomizes the physical memmap and thus the
> address where the initrd is located. Therefore, we need to add the
> offset KASLR put us to in order to find the initrd again on the AP path.
>
> In the future, we will get rid of the initrd address caching and query
> the address on both the BSP and AP paths but that would need more work.
>
> Thanks to Nicolai Stange for the good bisection and debugging work.
>
> Reported-and-tested-by: Nicolai Stange <nicstange@...il.com>
> Signed-off-by: Borislav Petkov <bp@...e.de>
> Cc: Kees Cook <keescook@...omium.org>
> Cc: Linus Torvalds <torvalds@...ux-foundation.org>
> Cc: Peter Zijlstra <peterz@...radead.org>
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Link: http://lkml.kernel.org/r/20160726095138.3470-1-bp@alien8.de
> Signed-off-by: Ingo Molnar <mingo@...nel.org>
> ---
>  arch/x86/kernel/cpu/microcode/intel.c | 16 ++++++++++++++--
>  1 file changed, 14 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
> index 6515c80..0f97ae9 100644
> --- a/arch/x86/kernel/cpu/microcode/intel.c
> +++ b/arch/x86/kernel/cpu/microcode/intel.c
> @@ -793,10 +793,10 @@ void __init load_ucode_intel_bsp(void)
>  void load_ucode_intel_ap(void)
>  {
>         struct ucode_blobs *blobs_p;
> +       unsigned long *ptrs, start = 0;
>         struct mc_saved_data *mcs;
>         struct ucode_cpu_info uci;
>         enum ucode_state ret;
> -       unsigned long *ptrs;
>
>  #ifdef CONFIG_X86_32
>         mcs     = (struct mc_saved_data *)__pa_nodebug(&mc_saved_data);
> @@ -815,8 +815,20 @@ void load_ucode_intel_ap(void)
>         if (!mcs->num_saved)
>                 return;
>
> +       if (blobs_p->valid) {
> +               start = blobs_p->start;
> +
> +#ifdef CONFIG_RANDOMIZE_MEMORY

These ifdefs aren't needed if we added a no-op __PAGE_OFFSET_BASE to
the 32-bit page table headers. Then the compiler will DTRT with the
start calculation. When CONFIG_RANDOMIZE_MEMORY is set, start will
have a non-zero value, and when not set it'll be 0.

> +               /*
> +                * Pay attention to CONFIG_RANDOMIZE_MEMORY=y as it shuffles
> +                * physmem mapping too and there we have the initrd.
> +                */
> +               start += PAGE_OFFSET - __PAGE_OFFSET_BASE;
> +#endif
> +       }
> +
>         collect_cpu_info_early(&uci);
> -       ret = load_microcode(mcs, ptrs, blobs_p->start, &uci);
> +       ret = load_microcode(mcs, ptrs, start, &uci);
>         if (ret != UCODE_OK)
>                 return;
>



-- 
Kees Cook
Chrome OS & Brillo Security