linux-kernel - Re: [PATCH 0/4] jump label patches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 06 Oct 2009 10:13:22 -0400
From:	Masami Hiramatsu <mhiramat@...hat.com>
To:	Roland McGrath <roland@...hat.com>
CC:	Jason Baron <jbaron@...hat.com>, linux-kernel@...r.kernel.org,
	mingo@...e.hu, mathieu.desnoyers@...ymtl.ca, tglx@...utronix.de,
	rostedt@...dmis.org, ak@...e.de, rth@...hat.com
Subject: Re: [PATCH 0/4] jump label patches

Roland McGrath wrote:
> I think text_poke_fixup() is a good safe place to start, and it seems wise
> to merge a version using that before worrying anything subtler.  But it's
> almost surely overkill and makes the enable/disable switching cost pretty
> huge.  The rules as documented by Intel seem to indicate that simple
> self-modification can work for UP and for SMP there should be some scheme
> with IPIs that is not too terrible.  
> 
> Those can entail a multi-phase modification like the int3 patching style,
> but int3 is not the only way to do it.  int3 has the benefit of being a
> one-byte instruction you can patch in, but also the downside of requiring
> the trap handling hair.

Hmm, would you want to put tracepoint on the path of int3 handling?

>  Another approach is:
> 
> start:
> 	   .balign 2
> 	2: nopl
> 	7: ...
> 
> phase 1:
> 	2: jmp 7
> 	4: <last 3 bytes of nopl>
> 	7: ...
> 
> phase 2:
> 	2: jmp 7
> 	4: {last 3 bytes of "jmp .Ldo_trace"}
> 	7: ...
> 
> phase 3:
> 	2: jmp .Ldo_trace
> 	7: ...
> 
> A scheme like that requires that the instruction to be patched be 2-byte
> aligned so that the two-byte "jmp .+3" can be an atomic store not
> straddling a word boundary.  On x86-64 (and, according to the Intel book,
> everything >= Pentium), you can atomically store 8 bytes when aligned.  So
> there you will usually actually be able to do this in one or two phases to
> cover each particular 5 byte range with adequately aligned stores.

It is unclear whether we can atomically modify 2 bytes in icache (also, it
can across cache lines or pages.)
I think int3 bypassing is more generic way to patching if you don't mind
tracing int3 path :-)


Thank you,

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America), Inc.
Software Solutions Division

e-mail: mhiramat@...hat.com

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/