Hi,
Currently Linux lacks support for live patching in arm64, and recently we have some patches to help enable this feature.
But I still don't know how much gap do we have from finishing arm64 live-patching support.
So I just have some questions:
1. What do we need to implement to support aarch64 live-patching?
2. Is there any plan or roadmap for this support?
3. What can I do, if I want to contribute to enabling this feature?
Thanks
On 12/7/21 7:49 PM, Hubin wrote:
Hi,
Currently Linux lacks support for live patching in arm64, and recently we have some patches to help enable this feature.
But I still don't know how much gap do we have from finishing arm64 live-patching support.
So I just have some questions:
1. What do we need to implement to support aarch64 live-patching?
2. Is there any plan or roadmap for this support?
3. What can I do, if I want to contribute to enabling this feature?
Thanks
Essentially, it needs two pieces:
1. The arm64 stack trace code has to supply a reliable stack trace function. Live patch needs that for its
consistency model to check if any task in the system is currently executing a function that is being
live patched. I am working on that piece right now. The work is being reviewed by Mark Rutland and
Mark Brown. We have made good progress on it. I feel that it is fairly close to being accepted.
2. Now, the arm64 stack trace code is based on the frame pointer. There needs to be a way to validate the
frame pointer. X86 uses a build-time tool called objtool to perform static analysis of objects produced during
the kernel build process. It walks each function and makes sure (among other things) that the frame pointer
is handled in accordance with calling convention rules. If all the functions examined by the tool pass the
checks, the kernel can then be used for live patching.
Julien Thierry posted a patchset a while ago for objtool for arm64. Not much has happened on that.
I am not sure at this point who is working on it. So, I don't have a clue about its ETA.
I am currently working on another solution. This solution validates the frame pointer dynamically
rather than statically. It works differently from objtool. I feel that this tool is simpler than objtool.
I have successfully run all the selftests (and some new tests that I have written). I plan to post a
patchset some time in December. I am sure that there will be a lot of back and forth on it. But I am hoping
that the community can converge on something in 2022.
Madhavan
Oh, and the other piece that is needed for arm64 is that some re-organization of code is required to
make sure that the functions that are used in patching other functions themselves do not get patched.
Mark Rutland is working on it.
This is work where you can potentially participate. Please contact Mark Rutland, if you are interested.
You can also review Julien Thierry's patchset, if you are interested.
Madhavan
On 12/8/21 1:42 AM, Madhavan T. Venkataraman wrote:
On 12/7/21 7:49 PM, Hubin wrote:
quoted
Hi,
Currently Linux lacks support for live patching in arm64, and recently we have some patches to help enable this feature.
But I still don't know how much gap do we have from finishing arm64 live-patching support.
So I just have some questions:
1. What do we need to implement to support aarch64 live-patching?
2. Is there any plan or roadmap for this support?
3. What can I do, if I want to contribute to enabling this feature?
Thanks
Essentially, it needs two pieces:
1. The arm64 stack trace code has to supply a reliable stack trace function. Live patch needs that for its
consistency model to check if any task in the system is currently executing a function that is being
live patched. I am working on that piece right now. The work is being reviewed by Mark Rutland and
Mark Brown. We have made good progress on it. I feel that it is fairly close to being accepted.
2. Now, the arm64 stack trace code is based on the frame pointer. There needs to be a way to validate the
frame pointer. X86 uses a build-time tool called objtool to perform static analysis of objects produced during
the kernel build process. It walks each function and makes sure (among other things) that the frame pointer
is handled in accordance with calling convention rules. If all the functions examined by the tool pass the
checks, the kernel can then be used for live patching.
Julien Thierry posted a patchset a while ago for objtool for arm64. Not much has happened on that.
I am not sure at this point who is working on it. So, I don't have a clue about its ETA.
I am currently working on another solution. This solution validates the frame pointer dynamically
rather than statically. It works differently from objtool. I feel that this tool is simpler than objtool.
I have successfully run all the selftests (and some new tests that I have written). I plan to post a
patchset some time in December. I am sure that there will be a lot of back and forth on it. But I am hoping
that the community can converge on something in 2022.
Madhavan