Re: [tip:x86/microcode] x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY=y

[Kees Cook]

On Tue, Jul 26, 2016 at 10:37 AM, tip-bot for Borislav Petkov
<tipbot@xxxxxxxxx> wrote:
> Commit-ID:  efaad554b4ffae1840a2759e09e21325ddbc8b05
> Gitweb:     http://git.kernel.org/tip/efaad554b4ffae1840a2759e09e21325ddbc8b05
> Author:     Borislav Petkov <bp@xxxxxxx>
> AuthorDate: Tue, 26 Jul 2016 11:51:38 +0200
> Committer:  Ingo Molnar <mingo@xxxxxxxxxx>
> CommitDate: Tue, 26 Jul 2016 19:32:57 +0200
>
> x86/microcode/intel: Fix initrd loading with CONFIG_RANDOMIZE_MEMORY=y
>
> CONFIG_RANDOMIZE_MEMORY=y randomizes the physical memmap and thus the
> address where the initrd is located. Therefore, we need to add the
> offset KASLR put us to in order to find the initrd again on the AP path.
>
> In the future, we will get rid of the initrd address caching and query
> the address on both the BSP and AP paths but that would need more work.
>
> Thanks to Nicolai Stange for the good bisection and debugging work.
>
> Reported-and-tested-by: Nicolai Stange <nicstange@xxxxxxxxx>
> Signed-off-by: Borislav Petkov <bp@xxxxxxx>
> Cc: Kees Cook <keescook@xxxxxxxxxxxx>
> Cc: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
> Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
> Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> Link: http://lkml.kernel.org/r/20160726095138.3470-1-bp@xxxxxxxxx
> Signed-off-by: Ingo Molnar <mingo@xxxxxxxxxx>
> ---
>  arch/x86/kernel/cpu/microcode/intel.c | 16 ++++++++++++++--
>  1 file changed, 14 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
> index 6515c80..0f97ae9 100644
> --- a/arch/x86/kernel/cpu/microcode/intel.c
> +++ b/arch/x86/kernel/cpu/microcode/intel.c
> @@ -793,10 +793,10 @@ void __init load_ucode_intel_bsp(void)
>  void load_ucode_intel_ap(void)
>  {
>         struct ucode_blobs *blobs_p;
> +       unsigned long *ptrs, start = 0;
>         struct mc_saved_data *mcs;
>         struct ucode_cpu_info uci;
>         enum ucode_state ret;
> -       unsigned long *ptrs;
>
>  #ifdef CONFIG_X86_32
>         mcs     = (struct mc_saved_data *)__pa_nodebug(&mc_saved_data);
> @@ -815,8 +815,20 @@ void load_ucode_intel_ap(void)
>         if (!mcs->num_saved)
>                 return;
>
> +       if (blobs_p->valid) {
> +               start = blobs_p->start;
> +
> +#ifdef CONFIG_RANDOMIZE_MEMORY

These ifdefs aren't needed if we added a no-op __PAGE_OFFSET_BASE to
the 32-bit page table headers. Then the compiler will DTRT with the
start calculation. When CONFIG_RANDOMIZE_MEMORY is set, start will
have a non-zero value, and when not set it'll be 0.

> +               /*
> +                * Pay attention to CONFIG_RANDOMIZE_MEMORY=y as it shuffles
> +                * physmem mapping too and there we have the initrd.
> +                */
> +               start += PAGE_OFFSET - __PAGE_OFFSET_BASE;
> +#endif
> +       }
> +
>         collect_cpu_info_early(&uci);
> -       ret = load_microcode(mcs, ptrs, blobs_p->start, &uci);
> +       ret = load_microcode(mcs, ptrs, start, &uci);
>         if (ret != UCODE_OK)
>                 return;
>



-- 
Kees Cook
Chrome OS & Brillo Security