linux-kernel - Re: [PATCH] livepatch: introduce klp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 20 May 2024 15:10:40 +0800
From: zhang warden <zhangwarden@...il.com>
To: Miroslav Benes <mbenes@...e.cz>
Cc: Josh Poimboeuf <jpoimboe@...nel.org>,
 Jiri Kosina <jikos@...nel.org>,
 Petr Mladek <pmladek@...e.com>,
 Joe Lawrence <joe.lawrence@...hat.com>,
 live-patching@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] livepatch: introduce klp_func called interface



> On May 20, 2024, at 14:46, Miroslav Benes <mbenes@...e.cz> wrote:
> 
> Hi,
> 
> On Mon, 20 May 2024, Wardenjohn wrote:
> 
>> Livepatch module usually used to modify kernel functions.
>> If the patched function have bug, it may cause serious result
>> such as kernel crash.
>> 
>> This is a kobject attribute of klp_func. Sysfs interface named
>> "called" is introduced to livepatch which will be set as true
>> if the patched function is called.
>> 
>> /sys/kernel/livepatch/<patch>/<object>/<function,sympos>/called
>> 
>> This value "called" is quite necessary for kernel stability
>> assurance for livepatching module of a running system.
>> Testing process is important before a livepatch module apply to
>> a production system. With this interface, testing process can
>> easily find out which function is successfully called.
>> Any testing process can make sure they have successfully cover
>> all the patched function that changed with the help of this interface.
> 
> Even easier is to use the existing tracing infrastructure in the kernel 
> (ftrace for example) to track the new function. You can obtain much more 
> information with that than the new attribute provides.
> 
> Regards,
> Miroslav
Hi Miroslav

First, in most cases, testing process is should be automated, which make using existing tracing infrastructure inconvenient. Second, livepatch is already use ftrace for functional replacement, I don’t think it is a good choice of using kernel tracing tool to trace a patched function.

At last, this attribute can be thought of as a state of a livepatch function. It is a state, like the "patched" "transition" state of a klp_patch.  Adding this state will not break the state consistency of livepatch.

Regards,
Wardenjohn