Re: [GIT PULL] x86/urgent for v5.11-rc7

On Tue, Feb 9, 2021 at 6:49 AM Steven Rostedt [off-list ref] wrote:

On Tue, 9 Feb 2021 09:32:34 +0100 (CET)
Miroslav Benes [off-list ref] wrote:

quoted

powerpc has this

static inline unsigned long klp_get_ftrace_location(unsigned long faddr)
{
        /*
         * Live patch works only with -mprofile-kernel on PPC. In this case,
         * the ftrace location is always within the first 16 bytes.
         */
        return ftrace_location_range(faddr, faddr + 16);
}

quoted

quoted

I suppose the trivial fix is to see if it points to endbr64 and if so,
increment the addr by the length of that.

I thought of that too. But one thing that may be possible, is to use
kallsym. I believe you can get the range of a function (start and end of
the function) from kallsyms. Then ask ftrace for the addr in that range
(there should only be one).

And we can do this if a hard-coded value live above is not welcome. If I
remember correctly, we used to have exactly this in the old versions of
kGraft. We walked through all ftrace records, called
kallsyms_lookup_size_offset() on every record's ip and if the offset+ip
matched faddr (in this case), we returned the ip.

Either way is fine. Question is, should we just wait till CET is
implemented for the kernel before making any of these changes? Just knowing
that we have a solution to handle it may be good enough for now.

I think the issue is more fundamental than what appears on the surface.
According to endbr64 documentation it's not just any instruction.
The cpu will wait for it and if it's replaced with int3 or not seen at
the branch target the cpu will throw an exception.
If I understood the doc correctly it means that endbr64 can never be
replaced with a breakpoint. If that's the case text_poke_bp and kprobe
need to do extra safety checks.