grsecurity forums

Posted: **Sat Jun 28, 2014 11:41 am**

I have a laptop with 2 graphic cards (intel + radeon). I am using vgaswitcheroo to disable radeon (which otherwise just pointlessly spins the laptops fan).
Unfortunatelly after patching the kernel with latest grsecurity patch, vgaswitcheroo doesn't work. I tried it over last weeks with few grsecurity and kernel versions (3.14.6, 3.14.8, 3.14.9, 3.15.1, 3.15.2). Result is always the same - after patching the kernel with grsecurity, vgaswitcheroo directory is no longer present in /sys/kernel/debug (debugfs is mounted).
There's also no mention about vgaswitcheroo in kern.log (When I boot vanilla kernel there is:

Code: Select all: VGA switcheroo: detected switching method \_SB_.PCI0.GFX0.ATPX handle vga_switcheroo: enabled

The thing is - it happens even if grsecurity is completly disabled in menuconfig. So it looks like the very fact of patching the kernel (even without enabling grsecurity in kernel's config) is causing this problem.

Here are some logs and informations about my system:
lspci

00:00.0 Host bridge: Intel Corporation 2nd Generation Core Processor Family DRAM Controller (rev 09)
00:01.0 PCI bridge: Intel Corporation Xeon E3-1200/2nd Generation Core Processor Family PCI Express Root Port (rev 09)
00:02.0 VGA compatible controller: Intel Corporation 2nd Generation Core Processor Family Integrated Graphics Controller (rev 09)
00:16.0 Communication controller: Intel Corporation 6 Series/C200 Series Chipset Family MEI Controller #1 (rev 04)
00:1a.0 USB controller: Intel Corporation 6 Series/C200 Series Chipset Family USB Enhanced Host Controller #2 (rev 05)
00:1b.0 Audio device: Intel Corporation 6 Series/C200 Series Chipset Family High Definition Audio Controller (rev 05)
00:1c.0 PCI bridge: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 1 (rev b5)
00:1c.1 PCI bridge: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 2 (rev b5)
00:1c.3 PCI bridge: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 4 (rev b5)
00:1c.4 PCI bridge: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 5 (rev b5)
00:1c.7 PCI bridge: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 8 (rev b5)
00:1d.0 USB controller: Intel Corporation 6 Series/C200 Series Chipset Family USB Enhanced Host Controller #1 (rev 05)
00:1f.0 ISA bridge: Intel Corporation HM67 Express Chipset Family LPC Controller (rev 05)
00:1f.2 SATA controller: Intel Corporation 6 Series/C200 Series Chipset Family 6 port SATA AHCI Controller (rev 05)
00:1f.3 SMBus: Intel Corporation 6 Series/C200 Series Chipset Family SMBus Controller (rev 05)
01:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Whistler [Radeon HD 6630M/6650M/6750M/7670M/7690M] (rev ff)
05:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 06)
09:00.0 Network controller: Intel Corporation Centrino Wireless-N 1030 [Rainbow Peak] (rev 34)
0b:00.0 USB controller: NEC Corporation uPD720200 USB 3.0 Host Controller (rev 04)

zgrep -i switcheroo /proc/config.gz

Code: Select all: CONFIG_VGA_SWITCHEROO=y

zgrep -i radeon /proc/config.gz

Code: Select all: CONFIG_DRM_RADEON=m # CONFIG_DRM_RADEON_UMS is not set # CONFIG_FB_RADEON is not set

zgrep -i i915 /proc/config.gz

Code: Select all: CONFIG_DRM_I915=m CONFIG_DRM_I915_KMS=y # CONFIG_SND_HDA_I915 is not set

zgrep -i grkernsec /proc/config.gz

Code: Select all: # CONFIG_GRKERNSEC is not set

lsmod

Code: Select all: Module Size Used by i915 777108 2 snd_hda_codec_hdmi 37723 1 radeon 1349396 1 ttm 79755 1 radeon snd_hda_codec_idt 49814 1 iwlwifi 88251 0 snd_hda_intel 34215 1 snd_hda_codec 159762 3 snd_hda_codec_hdmi,snd_hda_codec_idt,snd_hda_intel snd_hwdep 8418 1 snd_hda_codec snd_pcm 108457 3 snd_hda_codec_hdmi,snd_hda_codec,snd_hda_intel snd_page_alloc 8918 2 snd_pcm,snd_hda_intel snd_timer 26134 1 snd_pcm snd 82743 9 snd_hwdep,snd_timer,snd_hda_codec_hdmi,snd_hda_codec_idt,snd_pcm,snd_hda_codec,snd_hda_intel x86_pkg_temp_thermal 5385 0 i2c_algo_bit 6289 2 i915,radeon drm_kms_helper 38365 2 i915,radeon drm 320845 6 ttm,i915,drm_kms_helper,radeon fuse 94676 1

eix radeon-ucode

Code: Select all: [I] x11-drivers/radeon-ucode Available versions: 20140204 ~20140430 Installed versions: 20140204(02:29:39 02.06.2014) Homepage: http://people.freedesktop.org/~agd5f/radeon_ucode/ Description: IRQ microcode for r6xx/r7xx/Evergreen/N.Islands/S.Islands Radeon GPUs and APUs

mount | column -t | grep debugfs

Code: Select all: debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)

ls -1F /sys/kernel/debug

Code: Select all: acpi bdi boot_params dell_laptop dma_buf dri extfrag fault_around_order hid ieee80211 intel_powerclamp kprobes kvm mce mei pkg_temp_thermal sleep_time tracing usb x86

Full config of 3.15.2-grsec (grsecurity disabled)
http://bpaste.net/show/417075/

diff of 3.15.2-vanilla config and 3.15.2-grsec config (grsecurity disabled):

--- VANILLA_CONFIG-3.15.2 2014-06-27 20:07:54.073310979 +0200
+++ GRSEC_DISABLED_CONFIG-3.15.2 2014-06-27 20:00:48.218386487 +0200
@@ -3018,7 +3018,7 @@
# CONFIG_PROC_KCORE is not set
CONFIG_PROC_VMCORE=y
CONFIG_PROC_SYSCTL=y
-CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_PROC_PAGE_MONITOR is not set
CONFIG_KERNFS=y
CONFIG_SYSFS=y
CONFIG_TMPFS=y
@@ -3307,9 +3307,6 @@
CONFIG_EARLY_PRINTK_DBGP=y
# CONFIG_EARLY_PRINTK_EFI is not set
# CONFIG_X86_PTDUMP is not set
-CONFIG_DEBUG_RODATA=y
-CONFIG_DEBUG_RODATA_TEST=y
-# CONFIG_DEBUG_SET_MODULE_RONX is not set
# CONFIG_DEBUG_NX_TEST is not set
CONFIG_DOUBLEFAULT=y
# CONFIG_DEBUG_TLBFLUSH is not set
@@ -3334,6 +3331,12 @@
#
# Security options
#
+
+#
+# Grsecurity
+#
+CONFIG_TASK_SIZE_MAX_SHIFT=47
+# CONFIG_GRKERNSEC is not set
CONFIG_KEYS=y
# CONFIG_PERSISTENT_KEYRINGS is not set
# CONFIG_BIG_KEYS is not set

kern.log - full boot procedure on 3.15.2-grsec
http://bpaste.net/show/417084/

Posted: **Sat Jun 28, 2014 7:08 pm**

can you add printk in drivers/gpu/drm/radeon/radeon_atpx_handler.c:radeon_atpx_detect() to print out the values of has_atpx and vga_count just after the second while loop, e.g., something like this:

Code: Select all: printk("PAX: has:%x count:%x\n", has_atpx, vga_count);

you don't need to reboot for this, just recompile the radeon module and unload/reload it. my guess is that it's has_atpx that remains false and that means that we'll have to dig into ACPI code next.

Posted: **Sat Jun 28, 2014 7:44 pm**

Thank you VERY much for quick answer!
My coding skills are limited (but I'm always eager to learn

) , so forgive me silly questions.
From what I understand you are referring to this part of code, is that correct?

Code: Select all: static bool radeon_atpx_detect(void) { char acpi_method_name[255] = { 0 }; struct acpi_buffer buffer = {sizeof(acpi_method_name), acpi_method_name}; struct pci_dev *pdev = NULL; bool has_atpx = false; int vga_count = 0; while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) { vga_count++; has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true); } if (has_atpx && vga_count == 2) { acpi_get_name(radeon_atpx_priv.atpx.handle, ACPI_FULL_PATHNAME, &buffer); printk(KERN_INFO "VGA switcheroo: detected switching method %s handle\n", acpi_method_name); radeon_atpx_priv.atpx_detected = true; /* * On some systems hotplug events are generated for the device * being switched off when ATPX is executed. They cause ACPI * hotplug to trigger and attempt to remove the device from * the system, which causes it to break down. Prevent that from * happening by setting the no_hotplug flag for the involved * ACPI device objects. */ acpi_bus_no_hotplug(radeon_atpx_priv.dhandle); acpi_bus_no_hotplug(radeon_atpx_priv.other_handle); return true; } return false; }

You said to put this line after second while loop, but I can see only one loop there. Should I put your printk after it? So something like this:

while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
vga_count++;

has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
}

printk("PAX: has:%x count:%x\n", has_atpx, vga_count);

if (has_atpx && vga_count == 2) {
...
}

Once again, thank you for answer and sorry for my noobishness :oops:

Posted: **Sat Jun 28, 2014 8:04 pm**

yes, that placement is fine, i thought you were using 3.15 which has two loops

.

Posted: **Sat Jun 28, 2014 8:13 pm**

You got me - I checked it on the other machine with 3.14.5

It's little late in my timezone - I'll continue tomorrow.
Thank you again !

Posted: **Sun Jun 29, 2014 1:32 pm**

Ok, here's the output:

Code: Select all: Jun 29 19:14:56 gentoo kernel: [ 345.449036] PAX: has:1 count:6

And whole unload/load radeon log:

Code: Select all: Jun 29 19:14:54 gentoo kernel: [ 343.496621] [drm] radeon: finishing device. Jun 29 19:14:54 gentoo kernel: [ 343.504495] [TTM] Finalizing pool allocator Jun 29 19:14:54 gentoo kernel: [ 343.504501] [TTM] Finalizing DMA pool allocator Jun 29 19:14:54 gentoo kernel: [ 343.504560] [TTM] Zone kernel: Used memory at exit: 0 kiB Jun 29 19:14:54 gentoo kernel: [ 343.504562] [TTM] Zone dma32: Used memory at exit: 0 kiB Jun 29 19:14:54 gentoo kernel: [ 343.504564] [drm] radeon: ttm finalized Jun 29 19:14:54 gentoo kernel: [ 343.504725] [drm] Module unloaded Jun 29 19:14:56 gentoo kernel: [ 345.449019] [drm] radeon kernel modesetting enabled. Jun 29 19:14:56 gentoo kernel: [ 345.449036] PAX: has:1 count:6 Jun 29 19:14:56 gentoo kernel: [ 345.449310] [drm] initializing kernel modesetting (TURKS 0x1002:0x6741 0x1028:0x04CD). Jun 29 19:14:56 gentoo kernel: [ 345.449329] [drm] register mmio base: 0xF7B20000 Jun 29 19:14:56 gentoo kernel: [ 345.449330] [drm] register mmio size: 131072 Jun 29 19:14:57 gentoo kernel: [ 346.169043] ATOM BIOS: Dell Jun 29 19:14:57 gentoo kernel: [ 346.169127] radeon 0000:01:00.0: VRAM: 1024M 0x0000000000000000 - 0x000000003FFFFFFF (1024M used) Jun 29 19:14:57 gentoo kernel: [ 346.169129] radeon 0000:01:00.0: GTT: 1024M 0x0000000040000000 - 0x000000007FFFFFFF Jun 29 19:14:57 gentoo kernel: [ 346.169131] [drm] Detected VRAM RAM=1024M, BAR=256M Jun 29 19:14:57 gentoo kernel: [ 346.169132] [drm] RAM width 128bits DDR Jun 29 19:14:57 gentoo kernel: [ 346.169259] [TTM] Zone kernel: Available graphics memory: 4040528 kiB Jun 29 19:14:57 gentoo kernel: [ 346.169262] [TTM] Zone dma32: Available graphics memory: 2097152 kiB Jun 29 19:14:57 gentoo kernel: [ 346.169263] [TTM] Initializing pool allocator Jun 29 19:14:57 gentoo kernel: [ 346.169268] [TTM] Initializing DMA pool allocator Jun 29 19:14:57 gentoo kernel: [ 346.169290] [drm] radeon: 1024M of VRAM memory ready Jun 29 19:14:57 gentoo kernel: [ 346.169291] [drm] radeon: 1024M of GTT memory ready. Jun 29 19:14:57 gentoo kernel: [ 346.169303] [drm] Loading TURKS Microcode Jun 29 19:14:57 gentoo kernel: [ 346.169309] [drm] Internal thermal controller without fan control Jun 29 19:14:57 gentoo kernel: [ 346.170197] [drm] radeon: power management initialized Jun 29 19:14:57 gentoo kernel: [ 346.170447] [drm] GART: num cpu pages 262144, num gpu pages 262144 Jun 29 19:14:57 gentoo kernel: [ 346.171366] [drm] PCIE gen 2 link speeds already enabled Jun 29 19:14:57 gentoo kernel: [ 346.173775] [drm] PCIE GART of 1024M enabled (table at 0x0000000000273000). Jun 29 19:14:57 gentoo kernel: [ 346.173874] radeon 0000:01:00.0: WB enabled Jun 29 19:14:57 gentoo kernel: [ 346.173877] radeon 0000:01:00.0: fence driver on ring 0 use gpu addr 0x0000000040000c00 and cpu addr 0xffff880221c71c00 Jun 29 19:14:57 gentoo kernel: [ 346.173879] radeon 0000:01:00.0: fence driver on ring 3 use gpu addr 0x0000000040000c0c and cpu addr 0xffff880221c71c0c Jun 29 19:14:57 gentoo kernel: [ 346.174280] radeon 0000:01:00.0: fence driver on ring 5 use gpu addr 0x0000000000072118 and cpu addr 0xffffc90017f32118 Jun 29 19:14:57 gentoo kernel: [ 346.174282] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013). Jun 29 19:14:57 gentoo kernel: [ 346.174283] [drm] Driver supports precise vblank timestamp query. Jun 29 19:14:57 gentoo kernel: [ 346.174301] radeon 0000:01:00.0: irq 52 for MSI/MSI-X Jun 29 19:14:57 gentoo kernel: [ 346.174311] radeon 0000:01:00.0: radeon: using MSI. Jun 29 19:14:57 gentoo kernel: [ 346.174332] [drm] radeon: irq initialized. Jun 29 19:14:57 gentoo kernel: [ 346.190915] [drm] ring test on 0 succeeded in 1 usecs Jun 29 19:14:57 gentoo kernel: [ 346.190972] [drm] ring test on 3 succeeded in 1 usecs Jun 29 19:14:57 gentoo kernel: [ 346.388485] [drm] ring test on 5 succeeded in 1 usecs Jun 29 19:14:57 gentoo kernel: [ 346.388489] [drm] UVD initialized successfully. Jun 29 19:14:57 gentoo kernel: [ 346.388726] [drm] ib test on ring 0 succeeded in 0 usecs Jun 29 19:14:57 gentoo kernel: [ 346.388748] [drm] ib test on ring 3 succeeded in 0 usecs Jun 29 19:14:57 gentoo kernel: [ 346.560551] [drm] ib test on ring 5 succeeded Jun 29 19:14:57 gentoo kernel: [ 346.560858] [drm] Radeon Display Connectors Jun 29 19:14:57 gentoo kernel: [ 346.561006] radeon 0000:01:00.0: No connectors reported connected with modes Jun 29 19:14:57 gentoo kernel: [ 346.561008] [drm] Cannot find any crtc or sizes - going 1024x768 Jun 29 19:14:57 gentoo kernel: [ 346.561728] [drm] fb mappable at 0xE0476000 Jun 29 19:14:57 gentoo kernel: [ 346.561729] [drm] vram apper at 0xE0000000 Jun 29 19:14:57 gentoo kernel: [ 346.561730] [drm] size 3145728 Jun 29 19:14:57 gentoo kernel: [ 346.561731] [drm] fb depth is 24 Jun 29 19:14:57 gentoo kernel: [ 346.561732] [drm] pitch is 4096 Jun 29 19:14:57 gentoo kernel: [ 346.561783] radeon 0000:01:00.0: fb1: radeondrmfb frame buffer device Jun 29 19:14:57 gentoo kernel: [ 346.561793] [drm] Initialized radeon 2.38.0 20080528 for 0000:01:00.0 on minor 1

Posted: **Sun Jun 29, 2014 2:03 pm**

looks like PCI_ANY_ID bites again

. can you revert the first hunk of the patch to include/linux/mod_devicetable.h (i.e., which adds an __u16 cast to PCI_ANY_ID)? and if that works, can you make it an __u32 cast and see if that works too?

Posted: **Sun Jun 29, 2014 2:28 pm**

Just to make sure :oops:

in include/linux/mod_devicetable.h , I need to change this:

Code: Select all: #define PCI_ANY_ID ((__u16)~0)

to that:

Code: Select all: #define PCI_ANY_ID (~0)

see if that works and then check if it also works with:

Code: Select all: #define PCI_ANY_ID ((__u32)~0)

is that right?

See, I wasn't joking with my noobishness :oops:

Posted: **Sun Jun 29, 2014 3:05 pm**

yes, it's correct and on second thought you don't really need the __32 one as it's a no-op anyway (but will suppress a compiler warning which is what i wanted to fix 5 years ago with this).

Posted: **Sun Jun 29, 2014 5:01 pm**

With #define PCI_ANY_ID (~0) it's working again!

But another silly question here: Does reverting this hunk of patch is actual fix, or it's just another step to identify the source of the problem, and we have to dig further?

Posted: **Sun Jun 29, 2014 5:42 pm**

well, the problem is that PCI_ANY_ID is used in different kinds of contexts, some are 16 bits in size and others are 32 bits. the compiler warning happens in both cases when PCI_ANY_ID is assigned to an unsigned variable since the current definition tries to shove -1 (a signed negative value) into it. the obvious fix of using (~0U) is only a half solution as it'll still cause a warning due to integer truncation when it's stored into an unsigned short variable. as i don't feel like figuring out which of the 3k uses of PCI_ANY_ID should become separate 16/32 bit values, i'll just revert this hunk myself in the next patch and live with the warnings until someone comes up with a better idea

.

Posted: **Sun Jun 29, 2014 6:35 pm**

THANK YOU for explanation, and kind and quick help!

grsecurity forums

Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)

Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)

Re: Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)

Re: Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)

Re: Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)

Re: Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)

Re: Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)

Re: Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)

Re: Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)

Re: Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)

Re: Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)

Re: Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)

Re: Grsecurity vs vgaswitcheroo (hybrid-graphic laptop)