linux-kernel - Re: [PATCH v4 00/63] objtool,livepatch: klp-build livepatch module generation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aOVQHknMHwBFmJeg@redhat.com>
Date: Tue, 7 Oct 2025 13:38:38 -0400
From: Joe Lawrence <joe.lawrence@...hat.com>
To: Josh Poimboeuf <jpoimboe@...nel.org>
Cc: x86@...nel.org, linux-kernel@...r.kernel.org,
	Petr Mladek <pmladek@...e.com>, Miroslav Benes <mbenes@...e.cz>,
	live-patching@...r.kernel.org, Song Liu <song@...nel.org>,
	laokz <laokz@...mail.com>, Jiri Kosina <jikos@...nel.org>,
	Marcos Paulo de Souza <mpdesouza@...e.com>,
	Weinan Liu <wnliu@...gle.com>,
	Fazla Mehrab <a.mehrab@...edance.com>,
	Chen Zhongjin <chenzhongjin@...wei.com>,
	Puranjay Mohan <puranjay@...nel.org>,
	Dylan Hatch <dylanbhatch@...gle.com>,
	Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH v4 00/63] objtool,livepatch: klp-build livepatch module
 generation

On Wed, Sep 17, 2025 at 09:03:08AM -0700, Josh Poimboeuf wrote:
> Changes since v3 (https://lore.kernel.org/cover.1750980516.git.jpoimboe@kernel.org):
> 
> - Get rid of the SHF_MERGE+SHF_WRITE toolchain shenanigans in favor of
>   simple .discard.annotate_data annotations
> - Fix potential double free in elf_create_reloc()
> - Sync interval_tree_generic.h (Peter)
> - Refactor prefix symbol creation error handling
> - Rebase on tip/master and fix new issue (--checksum getting added with --noabs)
> 
> (v3..v4 diff below)
> 
> ----
> 
> This series introduces new objtool features and a klp-build script to
> generate livepatch modules using a source .patch as input.
> 
> This builds on concepts from the longstanding out-of-tree kpatch [1]
> project which began in 2012 and has been used for many years to generate
> livepatch modules for production kernels.  However, this is a complete
> rewrite which incorporates hard-earned lessons from 12+ years of
> maintaining kpatch.
> 
> Key improvements compared to kpatch-build:
> 
>   - Integrated with objtool: Leverages objtool's existing control-flow
>     graph analysis to help detect changed functions.
> 
>   - Works on vmlinux.o: Supports late-linked objects, making it
>     compatible with LTO, IBT, and similar.
> 
>   - Simplified code base: ~3k fewer lines of code.
> 
>   - Upstream: No more out-of-tree #ifdef hacks, far less cruft.
> 
>   - Cleaner internals: Vastly simplified logic for symbol/section/reloc
>     inclusion and special section extraction.
> 
>   - Robust __LINE__ macro handling: Avoids false positive binary diffs
>     caused by the __LINE__ macro by introducing a fix-patch-lines script
>     which injects #line directives into the source .patch to preserve
>     the original line numbers at compile time.
> 
> The primary user interface is the klp-build script which does the
> following:
> 
>   - Builds an original kernel with -function-sections and
>     -fdata-sections, plus objtool function checksumming.
> 
>   - Applies the .patch file and rebuilds the kernel using the same
>     options.
> 
>   - Runs 'objtool klp diff' to detect changed functions and generate
>     intermediate binary diff objects.
> 
>   - Builds a kernel module which links the diff objects with some
>     livepatch module init code (scripts/livepatch/init.c).
> 
>   - Finalizes the livepatch module (aka work around linker wreckage)
>     using 'objtool klp post-link'.
> 
> I've tested with a variety of patches on defconfig and Fedora-config
> kernels with both GCC and Clang.
> 
> These patches can also be found at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/jpoimboe/linux.git klp-build-v3
> 
> Please test!
> 

For v4.1, with several dozen small, CVE input patches and gcc 14 +
CentOS-Steam-10 config:

Tested-off-by: Joe Lawrence <joe.lawrence@...hat.com>

--
Joe