Commit b700e7f0 authored by Seth Jennings's avatar Seth Jennings Committed by Jiri Kosina
Browse files

livepatch: kernel: add support for live patching 



This commit introduces code for the live patching core.  It implements
an ftrace-based mechanism and kernel interface for doing live patching
of kernel and kernel module functions.

It represents the greatest common functionality set between kpatch and
kgraft and can accept patches built using either method.

This first version does not implement any consistency mechanism that
ensures that old and new code do not run together.  In practice, ~90% of
CVEs are safe to apply in this way, since they simply add a conditional
check.  However, any function change that can not execute safely with
the old version of the function can _not_ be safely applied in this
version.

[ jkosina@suse.cz: due to the number of contributions that got folded into
  this original patch from Seth Jennings, add SUSE's copyright as well, as
  discussed via e-mail ]

Signed-off-by: default avatarSeth Jennings <sjenning@redhat.com>
Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
Reviewed-by: default avatarMiroslav Benes <mbenes@suse.cz>
Reviewed-by: default avatarPetr Mladek <pmladek@suse.cz>
Reviewed-by: default avatarMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: default avatarMiroslav Benes <mbenes@suse.cz>
Signed-off-by: default avatarPetr Mladek <pmladek@suse.cz>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent c5f45465

Documentation/ABI/testing/sysfs-kernel-livepatch

0 → 100644
+44 −0
Original line number Diff line number Diff line 
What:		/sys/kernel/livepatch

Date:		Nov 2014

KernelVersion:	3.19.0

Contact:	live-patching@vger.kernel.org

Description:

		Interface for kernel live patching



		The /sys/kernel/livepatch directory contains subdirectories for

		each loaded live patch module.



What:		/sys/kernel/livepatch/<patch>

Date:		Nov 2014

KernelVersion:	3.19.0

Contact:	live-patching@vger.kernel.org

Description:

		The patch directory contains subdirectories for each kernel

		object (vmlinux or a module) in which it patched functions.



What:		/sys/kernel/livepatch/<patch>/enabled

Date:		Nov 2014

KernelVersion:	3.19.0

Contact:	live-patching@vger.kernel.org

Description:

		A writable attribute that indicates whether the patched

		code is currently applied.  Writing 0 will disable the patch

		while writing 1 will re-enable the patch.



What:		/sys/kernel/livepatch/<patch>/<object>

Date:		Nov 2014

KernelVersion:	3.19.0

Contact:	live-patching@vger.kernel.org

Description:

		The object directory contains subdirectories for each function

		that is patched within the object.



What:		/sys/kernel/livepatch/<patch>/<object>/<function>

Date:		Nov 2014

KernelVersion:	3.19.0

Contact:	live-patching@vger.kernel.org

Description:

		The function directory contains attributes regarding the

		properties and state of the patched function.



		There are currently no such attributes.

MAINTAINERS

+13 −0
Original line number Diff line number Diff line
@@ -5784,6 +5784,19 @@ F: Documentation/misc-devices/lis3lv02d 
F:	drivers/misc/lis3lv02d/

F:	drivers/platform/x86/hp_accel.c



LIVE PATCHING

M:	Josh Poimboeuf <jpoimboe@redhat.com>

M:	Seth Jennings <sjenning@redhat.com>

M:	Jiri Kosina <jkosina@suse.cz>

M:	Vojtech Pavlik <vojtech@suse.cz>

S:	Maintained

F:	kernel/livepatch/

F:	include/linux/livepatch.h

F:	arch/x86/include/asm/livepatch.h

F:	arch/x86/kernel/livepatch.c

F:	Documentation/ABI/testing/sysfs-kernel-livepatch

L:	live-patching@vger.kernel.org



LLC (802.2)

M:	Arnaldo Carvalho de Melo <acme@ghostprotocols.net>

S:	Maintained

arch/x86/Kconfig

+3 −0
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ config X86_64 
	depends on 64BIT

	select X86_DEV_DMA_OPS

	select ARCH_USE_CMPXCHG_LOCKREF

	select ARCH_HAVE_LIVE_PATCHING



### Arch settings

config X86
@@ -2008,6 +2009,8 @@ config CMDLINE_OVERRIDE 
	  This is used to work around broken boot loaders.  This should

	  be set to 'N' under normal conditions.



source "kernel/livepatch/Kconfig"



endmenu



config ARCH_ENABLE_MEMORY_HOTPLUG

arch/x86/include/asm/livepatch.h

0 → 100644
+37 −0
Original line number Diff line number Diff line 
/*

 * livepatch.h - x86-specific Kernel Live Patching Core

 *

 * Copyright (C) 2014 Seth Jennings <sjenning@redhat.com>

 * Copyright (C) 2014 SUSE

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2

 * of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, see <http://www.gnu.org/licenses/>.

 */



#ifndef _ASM_X86_LIVEPATCH_H

#define _ASM_X86_LIVEPATCH_H



#include <linux/module.h>



#ifdef CONFIG_LIVE_PATCHING

#ifndef CC_USING_FENTRY

#error Your compiler must support -mfentry for live patching to work

#endif

extern int klp_write_module_reloc(struct module *mod, unsigned long type,

				  unsigned long loc, unsigned long value);



#else

#error Live patching support is disabled; check CONFIG_LIVE_PATCHING

#endif



#endif /* _ASM_X86_LIVEPATCH_H */

arch/x86/kernel/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -63,6 +63,7 @@ obj-$(CONFIG_X86_MPPARSE) += mpparse.o 
obj-y				+= apic/

obj-$(CONFIG_X86_REBOOTFIXUPS)	+= reboot_fixups_32.o

obj-$(CONFIG_DYNAMIC_FTRACE)	+= ftrace.o

obj-$(CONFIG_LIVE_PATCHING)	+= livepatch.o

obj-$(CONFIG_FUNCTION_GRAPH_TRACER) += ftrace.o

obj-$(CONFIG_FTRACE_SYSCALLS)	+= ftrace.o

obj-$(CONFIG_X86_TSC)		+= trace_clock.o

CRA Git | Maintained and supported by SUSTech CRA and CCSE