| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <884d1d23-84ee-38ad-2bff-40b2d046fbf2@linux.microsoft.com>
Date: Fri, 1 Jul 2022 14:53:30 -0500
From: "Madhavan T. Venkataraman" <madvenka@...ux.microsoft.com>
To: Miroslav Benes <mbenes@...e.cz>
Cc: jpoimboe@...hat.com, peterz@...radead.org, chenzhongjin@...wei.com,
mark.rutland@....com, broonie@...nel.org, nobuta.keiya@...itsu.com,
sjitindarsingh@...il.com, catalin.marinas@....com, will@...nel.org,
jamorris@...ux.microsoft.com, linux-arm-kernel@...ts.infradead.org,
live-patching@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH v2 19/20] arm64: Miscellaneous changes required for
enabling livepatch
Thanks for the review.
On 7/1/22 09:16, Miroslav Benes wrote:
> Hi,
>
> sorry for the late reply...
>
> On Mon, 23 May 2022, madvenka@...ux.microsoft.com wrote:
>
>> From: "Madhavan T. Venkataraman" <madvenka@...ux.microsoft.com>
>>
>> - Create arch/arm64/include/asm/livepatch.h and define
>> klp_arch_set_pc() and klp_get_ftrace_location() which
>> are required for livepatch.
>>
>> - Define TIF_PATCH_PENDING in arch/arm64/include/asm/thread_info.h
>> for livepatch.
>>
>> - Check TIF_PATCH_PENDING in do_notify_resume() to patch the
>> current task for livepatch.
>>
>> Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@...il.com>
>> Signed-off-by: Madhavan T. Venkataraman <madvenka@...ux.microsoft.com>
>> ---
>> arch/arm64/include/asm/livepatch.h | 42 ++++++++++++++++++++++++++++
>> arch/arm64/include/asm/thread_info.h | 4 ++-
>> arch/arm64/kernel/signal.c | 4 +++
>> 3 files changed, 49 insertions(+), 1 deletion(-)
>> create mode 100644 arch/arm64/include/asm/livepatch.h
>>
>> diff --git a/arch/arm64/include/asm/livepatch.h b/arch/arm64/include/asm/livepatch.h
>> new file mode 100644
>> index 000000000000..72d7cd86f158
>> --- /dev/null
>> +++ b/arch/arm64/include/asm/livepatch.h
>> @@ -0,0 +1,42 @@
>> +/* SPDX-License-Identifier: GPL-2.0
>> + *
>> + * livepatch.h - arm64-specific Kernel Live Patching Core
>> + */
>> +#ifndef _ASM_ARM64_LIVEPATCH_H
>> +#define _ASM_ARM64_LIVEPATCH_H
>> +
>> +#include <linux/ftrace.h>
>> +
>> +static inline void klp_arch_set_pc(struct ftrace_regs *fregs, unsigned long ip)
>> +{
>> + struct pt_regs *regs = ftrace_get_regs(fregs);
>> +
>> + regs->pc = ip;
>> +}
>
> kernel/livepatch/ does not use klp_arch_set_pc() anymore. It was replaced
> by ftrace_instruction_pointer_set() and
> CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS.
>
OK. I will address this in the next version.
Thanks for pointing it out.
>> +/*
>> + * klp_get_ftrace_location is expected to return the address of the BL to the
>> + * relevant ftrace handler in the callsite. The location of this can vary based
>> + * on several compilation options.
>> + * CONFIG_DYNAMIC_FTRACE_WITH_REGS
>> + * - Inserts 2 nops on function entry the second of which is the BL
>> + * referenced above. (See ftrace_init_nop() for the callsite sequence)
>> + * (this is required by livepatch and must be selected)
>> + * CONFIG_ARM64_BTI_KERNEL:
>> + * - Inserts a hint #0x22 on function entry if the function is called
>> + * indirectly (to satisfy BTI requirements), which is inserted before
>> + * the two nops from above.
>> + */
>> +#define klp_get_ftrace_location klp_get_ftrace_location
>> +static inline unsigned long klp_get_ftrace_location(unsigned long faddr)
>> +{
>> + unsigned long addr = faddr + AARCH64_INSN_SIZE;
>> +
>> +#if IS_ENABLED(CONFIG_ARM64_BTI_KERNEL)
>> + addr = ftrace_location_range(addr, addr + AARCH64_INSN_SIZE);
>> +#endif
>> +
>> + return addr;
>> +}
>
> This is not needed either. peterz improved the ftrace code and livepatch
> now uses ftrace_location() which gives the proper location directly.
>
OK. I will remove this in the next version.
>> diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h
>> index e1317b7c4525..a1d8999dbdcc 100644
>> --- a/arch/arm64/include/asm/thread_info.h
>> +++ b/arch/arm64/include/asm/thread_info.h
>> @@ -68,6 +68,7 @@ int arch_dup_task_struct(struct task_struct *dst,
>> #define TIF_UPROBE 4 /* uprobe breakpoint or singlestep */
>> #define TIF_MTE_ASYNC_FAULT 5 /* MTE Asynchronous Tag Check Fault */
>> #define TIF_NOTIFY_SIGNAL 6 /* signal notifications exist */
>> +#define TIF_PATCH_PENDING 7 /* pending live patching update */
>> #define TIF_SYSCALL_TRACE 8 /* syscall trace active */
>> #define TIF_SYSCALL_AUDIT 9 /* syscall auditing */
>> #define TIF_SYSCALL_TRACEPOINT 10 /* syscall tracepoint for ftrace */
>> @@ -98,11 +99,12 @@ int arch_dup_task_struct(struct task_struct *dst,
>> #define _TIF_SVE (1 << TIF_SVE)
>> #define _TIF_MTE_ASYNC_FAULT (1 << TIF_MTE_ASYNC_FAULT)
>> #define _TIF_NOTIFY_SIGNAL (1 << TIF_NOTIFY_SIGNAL)
>> +#define _TIF_PATCH_PENDING (1 << TIF_PATCH_PENDING)
>>
>> #define _TIF_WORK_MASK (_TIF_NEED_RESCHED | _TIF_SIGPENDING | \
>> _TIF_NOTIFY_RESUME | _TIF_FOREIGN_FPSTATE | \
>> _TIF_UPROBE | _TIF_MTE_ASYNC_FAULT | \
>> - _TIF_NOTIFY_SIGNAL)
>> + _TIF_NOTIFY_SIGNAL | _TIF_PATCH_PENDING)
>>
>> #define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
>> _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP | \
>> diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c
>> index 4a4122ef6f39..cbec9597349f 100644
>> --- a/arch/arm64/kernel/signal.c
>> +++ b/arch/arm64/kernel/signal.c
>> @@ -17,6 +17,7 @@
>> #include <linux/sizes.h>
>> #include <linux/string.h>
>> #include <linux/resume_user_mode.h>
>> +#include <linux/livepatch.h>
>> #include <linux/ratelimit.h>
>> #include <linux/syscalls.h>
>>
>> @@ -938,6 +939,9 @@ void do_notify_resume(struct pt_regs *regs, unsigned long thread_flags)
>> (void __user *)NULL, current);
>> }
>>
>> + if (thread_flags & _TIF_PATCH_PENDING)
>> + klp_update_patch_state(current);
>> +
>> if (thread_flags & (_TIF_SIGPENDING | _TIF_NOTIFY_SIGNAL))
>> do_signal(regs);
>
> The rest should be fine.
>
Thanks!
Madhavan
Powered by blists - more mailing lists