From: "Maciej S. Szmigiero" <mail@maciej.szmigiero.name>
To: Borislav Petkov <bp@alien8.de>
Cc: Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
x86@kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH v7 6/9] x86/microcode/AMD: Check microcode container data in the late loader
Date: Tue, 19 Jun 2018 20:47:36 +0200 [thread overview]
Message-ID: <ca5f0606b9e3591b4b2e9fba27a90498cb3547b8.1529424596.git.mail@maciej.szmigiero.name> (raw)
In-Reply-To: <cover.1529424596.git.mail@maciej.szmigiero.name>
Convert the late loader in the AMD microcode update driver to use newly
introduced microcode container data checking functions as it was previously
done for the early loader.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
---
arch/x86/kernel/cpu/microcode/amd.c | 67 +++++++++++++----------------
1 file changed, 30 insertions(+), 37 deletions(-)
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 9e29374ce4d0..2dbdd7951475 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -717,28 +717,26 @@ static enum ucode_state apply_microcode_amd(int cpu)
return UCODE_UPDATED;
}
-static int install_equiv_cpu_table(const u8 *buf)
+static unsigned int install_equiv_cpu_table(const u8 *buf, size_t buf_size)
{
- unsigned int *ibuf = (unsigned int *)buf;
- unsigned int type = ibuf[1];
- unsigned int size = ibuf[2];
+ const u32 *hdr;
+ u32 equiv_tbl_len;
- if (type != UCODE_EQUIV_CPU_TABLE_TYPE || !size) {
- pr_err("empty section/"
- "invalid type field in container file section header\n");
- return -EINVAL;
- }
+ if (!verify_equivalence_table(buf, buf_size, false))
+ return 0;
+
+ hdr = (const u32 *)buf;
+ equiv_tbl_len = hdr[2];
- equiv_cpu_table = vmalloc(size);
+ equiv_cpu_table = vmalloc(equiv_tbl_len);
if (!equiv_cpu_table) {
pr_err("failed to allocate equivalent CPU table\n");
- return -ENOMEM;
+ return 0;
}
- memcpy(equiv_cpu_table, buf + CONTAINER_HDR_SZ, size);
+ memcpy(equiv_cpu_table, buf + CONTAINER_HDR_SZ, equiv_tbl_len);
- /* add header length */
- return size + CONTAINER_HDR_SZ;
+ return equiv_tbl_len;
}
static void free_equiv_cpu_table(void)
@@ -763,14 +761,18 @@ static void cleanup(void)
static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover,
unsigned int *crnt_size)
{
+ const u32 *hdr;
struct microcode_header_amd *mc_hdr;
struct ucode_patch *patch;
- unsigned int patch_size;
+ u32 patch_size;
u32 proc_fam;
u16 proc_id;
- patch_size = *(u32 *)(fw + 4);
- *crnt_size = patch_size + SECTION_HDR_SIZE;
+ if (!verify_patch(family, fw, leftover, crnt_size, false))
+ return 0;
+
+ hdr = (const u32 *)fw;
+ patch_size = hdr[1];
mc_hdr = (struct microcode_header_amd *)(fw + SECTION_HDR_SIZE);
proc_id = mc_hdr->processor_rev_id;
@@ -791,11 +793,6 @@ static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover,
return 0;
}
- if (!verify_patch(family, fw, leftover, crnt_size, false)) {
- pr_err("Patch-ID 0x%08x: size mismatch.\n", mc_hdr->patch_id);
- return 0;
- }
-
patch = kzalloc(sizeof(*patch), GFP_KERNEL);
if (!patch) {
pr_err("Patch allocation failure.\n");
@@ -828,21 +825,19 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data,
enum ucode_state ret = UCODE_ERROR;
unsigned int leftover;
u8 *fw = (u8 *)data;
- int offset;
+ unsigned int offset;
- offset = install_equiv_cpu_table(data);
- if (offset < 0) {
- pr_err("failed to create equivalent cpu table\n");
+ offset = install_equiv_cpu_table(data, size);
+ if (!offset)
return ret;
- }
- fw += offset;
- leftover = size - offset;
- if (*(u32 *)fw != UCODE_UCODE_TYPE) {
- pr_err("invalid type field in container file section header\n");
- free_equiv_cpu_table();
- return ret;
- }
+ /*
+ * Skip also the container header, since install_equiv_cpu_table()
+ * returns just the raw equivalence table size without the header.
+ */
+ fw += CONTAINER_HDR_SZ;
+ fw += offset;
+ leftover = size - CONTAINER_HDR_SZ - offset;
while (leftover) {
unsigned int crnt_size;
@@ -930,10 +925,8 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device,
}
ret = UCODE_ERROR;
- if (*(u32 *)fw->data != UCODE_MAGIC) {
- pr_err("invalid magic value (0x%08x)\n", *(u32 *)fw->data);
+ if (!verify_container(fw->data, fw->size, false))
goto fw_release;
- }
ret = load_microcode_amd(bsp, c->x86, fw->data, fw->size);
next prev parent reply other threads:[~2018-06-19 18:49 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-19 18:47 [PATCH v7 0/9] x86/microcode/AMD: Check microcode file sanity before loading it Maciej S. Szmigiero
2018-06-19 18:47 ` [PATCH v7 1/9] x86/microcode/AMD: Subtract SECTION_HDR_SIZE from file leftover length Maciej S. Szmigiero
2018-11-19 10:12 ` [tip:x86/microcode] " tip-bot for Maciej S. Szmigiero
2018-06-19 18:47 ` [PATCH v7 2/9] x86/microcode/AMD: Add microcode container data checking functions Maciej S. Szmigiero
2018-11-19 10:13 ` [tip:x86/microcode] x86/microcode/AMD: Add microcode container verification tip-bot for Maciej S. Szmigiero
2018-06-19 18:47 ` [PATCH v7 3/9] x86/microcode/AMD: Integrate verify_patch_size() into verify_patch() Maciej S. Szmigiero
2018-06-21 8:36 ` Borislav Petkov
2018-06-22 22:32 ` [PATCH 1/2] " Maciej S. Szmigiero
2018-06-22 22:33 ` [PATCH 2/2] x86/microcode/AMD: Check patch size for all known CPU families Maciej S. Szmigiero
2018-06-25 18:37 ` Borislav Petkov
2018-06-25 22:18 ` Maciej S. Szmigiero
2018-06-19 18:47 ` [PATCH v7 4/9] x86/microcode/AMD: Check microcode container data in the early loader Maciej S. Szmigiero
2018-06-19 18:47 ` [PATCH v7 5/9] x86/microcode/AMD: Split status from data to skip in verify_and_add_patch() Maciej S. Szmigiero
2018-06-19 18:47 ` Maciej S. Szmigiero [this message]
2018-06-19 18:47 ` [PATCH v7 7/9] x86/microcode/AMD: Add a reminder about PATCH_MAX_SIZE macro Maciej S. Szmigiero
2018-06-19 18:47 ` [PATCH v7 8/9] x86/microcode/AMD: Convert CPU equivalence table variable into a struct Maciej S. Szmigiero
2018-06-19 18:47 ` [PATCH v7 9/9] x86/microcode/AMD: Check the equivalence table size when scanning it Maciej S. Szmigiero
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ca5f0606b9e3591b4b2e9fba27a90498cb3547b8.1529424596.git.mail@maciej.szmigiero.name \
--to=mail@maciej.szmigiero.name \
--cc=bp@alien8.de \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).