Some questions about arm64 live-patching support

Some questions about arm64 live-patching support

[Hubin]

Hi,

Currently Linux lacks support for live patching in arm64, and recently we have some patches to help enable this feature.
But I still don't know how much gap do we have from finishing arm64 live-patching support.
So I just have some questions:
1. What do we need to implement to support aarch64 live-patching?
2. Is there any plan or roadmap for this support?
3. What can I do, if I want to contribute to enabling this feature?

Thanks

Re: Some questions about arm64 live-patching support

[Madhavan T. Venkataraman]

On 12/7/21 7:49 PM, Hubin wrote:
> Hi,
> 
> Currently Linux lacks support for live patching in arm64, and recently we have some patches to help enable this feature.
> But I still don't know how much gap do we have from finishing arm64 live-patching support.
> So I just have some questions:
> 1. What do we need to implement to support aarch64 live-patching?
> 2. Is there any plan or roadmap for this support?
> 3. What can I do, if I want to contribute to enabling this feature?
> 
> Thanks
> 

Essentially, it needs two pieces:

1. The arm64 stack trace code has to supply a reliable stack trace function. Live patch needs that for its
   consistency model to check if any task in the system is currently executing a function that is being
   live patched. I am working on that piece right now. The work is being reviewed by Mark Rutland and
   Mark Brown. We have made good progress on it. I feel that it is fairly close to being accepted.

2. Now, the arm64 stack trace code is based on the frame pointer. There needs to be a way to validate the
   frame pointer. X86 uses a build-time tool called objtool to perform static analysis of objects produced during
   the kernel build process. It walks each function and makes sure (among other things) that the frame pointer
   is handled in accordance with calling convention rules. If all the functions examined by the tool pass the
   checks, the kernel can then be used for live patching.

   Julien Thierry posted a patchset a while ago for objtool for arm64. Not much has happened on that.
   I am not sure at this point who is working on it. So, I don't have a clue about its ETA.

   I am currently working on another solution. This solution validates the frame pointer dynamically
   rather than statically. It works differently from objtool. I feel that this tool is simpler than objtool.
   I have successfully run all the selftests (and some new tests that I have written). I plan to post a
   patchset some time in December. I am sure that there will be a lot of back and forth on it. But I am hoping
   that the community can converge on something in 2022.

Madhavan

Re: Some questions about arm64 live-patching support

[Madhavan T. Venkataraman]

Oh, and the other piece that is needed for arm64 is that some re-organization of code is required to
make sure that the functions that are used in patching other functions themselves do not get patched.
Mark Rutland is working on it.

This is work where you can potentially participate. Please contact Mark Rutland, if you are interested.
You can also review Julien Thierry's patchset, if you are interested.

Madhavan

On 12/8/21 1:42 AM, Madhavan T. Venkataraman wrote:
> 
> 
> On 12/7/21 7:49 PM, Hubin wrote:
>> Hi,
>>
>> Currently Linux lacks support for live patching in arm64, and recently we have some patches to help enable this feature.
>> But I still don't know how much gap do we have from finishing arm64 live-patching support.
>> So I just have some questions:
>> 1. What do we need to implement to support aarch64 live-patching?
>> 2. Is there any plan or roadmap for this support?
>> 3. What can I do, if I want to contribute to enabling this feature?
>>
>> Thanks
>>
> 
> Essentially, it needs two pieces:
> 
> 1. The arm64 stack trace code has to supply a reliable stack trace function. Live patch needs that for its
>    consistency model to check if any task in the system is currently executing a function that is being
>    live patched. I am working on that piece right now. The work is being reviewed by Mark Rutland and
>    Mark Brown. We have made good progress on it. I feel that it is fairly close to being accepted.
> 
> 2. Now, the arm64 stack trace code is based on the frame pointer. There needs to be a way to validate the
>    frame pointer. X86 uses a build-time tool called objtool to perform static analysis of objects produced during
>    the kernel build process. It walks each function and makes sure (among other things) that the frame pointer
>    is handled in accordance with calling convention rules. If all the functions examined by the tool pass the
>    checks, the kernel can then be used for live patching.
> 
>    Julien Thierry posted a patchset a while ago for objtool for arm64. Not much has happened on that.
>    I am not sure at this point who is working on it. So, I don't have a clue about its ETA.
> 
>    I am currently working on another solution. This solution validates the frame pointer dynamically
>    rather than statically. It works differently from objtool. I feel that this tool is simpler than objtool.
>    I have successfully run all the selftests (and some new tests that I have written). I plan to post a
>    patchset some time in December. I am sure that there will be a lot of back and forth on it. But I am hoping
>    that the community can converge on something in 2022.
> 
> Madhavan
>