linux-kernel - Re: Fix built-in early-load Intel microcode alignment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200203201047.GL11244@42.do-not-panic.com>
Date:   Mon, 3 Feb 2020 20:10:47 +0000
From:   Luis Chamberlain <mcgrof@...nel.org>
To:     Jari Ruusu <jari.ruusu@...il.com>
Cc:     Borislav Petkov <bp@...en8.de>, Fenghua Yu <fenghua.yu@...el.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: Fix built-in early-load Intel microcode alignment

On Sun, Jan 12, 2020 at 03:00:53PM +0200, Jari Ruusu wrote:
> Intel Software Developer's Manual, volume 3, chapter 9.11.6 says:
> "Note that the microcode update must be aligned on a 16-byte
> boundary and the size of the microcode update must be 1-KByte
> granular"
> 
> When early-load Intel microcode is loaded from initramfs,
> userspace tool 'iucode_tool' has already 16-byte aligned those
> microcode bits in that initramfs image. Image that was created
> something like this:
> 
>  iucode_tool --write-earlyfw=FOO.cpio microcode-files...
> 
> However, when early-load Intel microcode is loaded from built-in
> firmware BLOB using CONFIG_EXTRA_FIRMWARE= kernel config option,
> that 16-byte alignment is not guaranteed.
> 
> Fix this by forcing all built-in firmware BLOBs to 16-byte
> alignment.
> 
> 
> Signed-off-by: Jari Ruusu <jari.ruusu@...il.com>
> 
> --- a/drivers/base/firmware_loader/builtin/Makefile
> +++ b/drivers/base/firmware_loader/builtin/Makefile
> @@ -17,7 +17,7 @@
>  filechk_fwbin = \
>  	echo "/* Generated by $(src)/Makefile */"		;\
>  	echo "    .section .rodata"				;\
> -	echo "    .p2align $(ASM_ALIGN)"			;\
> +	echo "    .p2align 4"					;\

Why not just keep ASM_ALIGN and define it to 4, with a nice
comment explaining the ucode stuff. Now we have a raw 4 here
and still use ASM_ALIGN which will depend on 64-bit or not.

  Luis

>  	echo "_fw_$(FWSTR)_bin:"				;\
>  	echo "    .incbin \"$(fwdir)/$(FWNAME)\""		;\
>  	echo "_fw_end:"						;\
> 
> -- 
> Jari Ruusu  4096R/8132F189 12D6 4C3A DCDA 0AA4 27BD  ACDF F073 3C80 8132 F189