Re: [RFC PATCH tip/master V3 0/8] kprobes/x86: Make kprobes instruction buffers read-only

[Masami Hiramatsu]

Ping?

On Wed, 29 Mar 2017 13:55:44 +0900
Masami Hiramatsu  wrote:

> Hi,
> 
> This is the 3rd version of the series. I just updated 4/8 according
> to Ingo's comment.
> 
> This series tries to make kprobes instruction buffers read-only
> pages. Since those buffers are used for trampoline code, those
> are a part of "text area" and it should be marked as ro for
> avoiding unexpected modification. And this actually fix a warning
> rodata sanity check reported by lkp-robot.
> 
> https://lkml.org/lkml/2017/2/27/161
> 
> This change requires changing the kprobe-booster at first
> because it can modify the instruction buffer to add a jump while
> resuming from single-stepping. Of course after we make the buffer
> readonly, we may not be able to modify it while probing.
> 
> So, at first this series checks the current bootable instructions
> and fixes a missed instruction (call far), modifies can_boost to
> use x86 instruction decoder, and inserts "booster" jump while
> preparing instruction buffer instead of resuming from single-stepping.
> At last, it makes the buffers for kprobes and optprobe readonly.
> 
> This series also has some cleanup patches related to above 
> changes.
> 
> Changes from V2:
>  - [4/8]: Fix imbalanced curly braces and remove unneeded
>(void *) cast.
> 
> ---
> 
> Masami Hiramatsu (8):
>   kprobes/x86: Fix not to boost call far instruction
>   kprobes/x86: Fix the description of __copy_instruction()
>   kprobes/x86: Use instruction decoder for booster
>   kprobes/x86: Do not modify singlestep buffer while resuming
>   kprobes/x86: Make boostable flag boolean
>   kprobes/x86: Set kprobes pages readonly
>   kprobes/x86: Use probe_kernel_read instead of memcpy
>   kprobes/x86: Consolidate insn decoder users for copying code
> 
> 
>  arch/x86/include/asm/kprobes.h   |7 +-
>  arch/x86/kernel/kprobes/common.h |4 +
>  arch/x86/kernel/kprobes/core.c   |  149 
> +++---
>  arch/x86/kernel/kprobes/ftrace.c |2 -
>  arch/x86/kernel/kprobes/opt.c|   13 +++
>  5 files changed, 90 insertions(+), 85 deletions(-)
> 
> --
> Masami Hiramatsu (Linaro) 


-- 
Masami Hiramatsu 

Re: [RFC PATCH tip/master V3 0/8] kprobes/x86: Make kprobes instruction buffers read-only

[Masami Hiramatsu]

Ping?

On Wed, 29 Mar 2017 13:55:44 +0900
Masami Hiramatsu  wrote:

> Hi,
> 
> This is the 3rd version of the series. I just updated 4/8 according
> to Ingo's comment.
> 
> This series tries to make kprobes instruction buffers read-only
> pages. Since those buffers are used for trampoline code, those
> are a part of "text area" and it should be marked as ro for
> avoiding unexpected modification. And this actually fix a warning
> rodata sanity check reported by lkp-robot.
> 
> https://lkml.org/lkml/2017/2/27/161
> 
> This change requires changing the kprobe-booster at first
> because it can modify the instruction buffer to add a jump while
> resuming from single-stepping. Of course after we make the buffer
> readonly, we may not be able to modify it while probing.
> 
> So, at first this series checks the current bootable instructions
> and fixes a missed instruction (call far), modifies can_boost to
> use x86 instruction decoder, and inserts "booster" jump while
> preparing instruction buffer instead of resuming from single-stepping.
> At last, it makes the buffers for kprobes and optprobe readonly.
> 
> This series also has some cleanup patches related to above 
> changes.
> 
> Changes from V2:
>  - [4/8]: Fix imbalanced curly braces and remove unneeded
>(void *) cast.
> 
> ---
> 
> Masami Hiramatsu (8):
>   kprobes/x86: Fix not to boost call far instruction
>   kprobes/x86: Fix the description of __copy_instruction()
>   kprobes/x86: Use instruction decoder for booster
>   kprobes/x86: Do not modify singlestep buffer while resuming
>   kprobes/x86: Make boostable flag boolean
>   kprobes/x86: Set kprobes pages readonly
>   kprobes/x86: Use probe_kernel_read instead of memcpy
>   kprobes/x86: Consolidate insn decoder users for copying code
> 
> 
>  arch/x86/include/asm/kprobes.h   |7 +-
>  arch/x86/kernel/kprobes/common.h |4 +
>  arch/x86/kernel/kprobes/core.c   |  149 
> +++---
>  arch/x86/kernel/kprobes/ftrace.c |2 -
>  arch/x86/kernel/kprobes/opt.c|   13 +++
>  5 files changed, 90 insertions(+), 85 deletions(-)
> 
> --
> Masami Hiramatsu (Linaro) 


-- 
Masami Hiramatsu 

[RFC PATCH tip/master V3 0/8] kprobes/x86: Make kprobes instruction buffers read-only

[Masami Hiramatsu]

Hi,

This is the 3rd version of the series. I just updated 4/8 according
to Ingo's comment.

This series tries to make kprobes instruction buffers read-only
pages. Since those buffers are used for trampoline code, those
are a part of "text area" and it should be marked as ro for
avoiding unexpected modification. And this actually fix a warning
rodata sanity check reported by lkp-robot.

https://lkml.org/lkml/2017/2/27/161

This change requires changing the kprobe-booster at first
because it can modify the instruction buffer to add a jump while
resuming from single-stepping. Of course after we make the buffer
readonly, we may not be able to modify it while probing.

So, at first this series checks the current bootable instructions
and fixes a missed instruction (call far), modifies can_boost to
use x86 instruction decoder, and inserts "booster" jump while
preparing instruction buffer instead of resuming from single-stepping.
At last, it makes the buffers for kprobes and optprobe readonly.

This series also has some cleanup patches related to above 
changes.

Changes from V2:
 - [4/8]: Fix imbalanced curly braces and remove unneeded
   (void *) cast.

---

Masami Hiramatsu (8):
  kprobes/x86: Fix not to boost call far instruction
  kprobes/x86: Fix the description of __copy_instruction()
  kprobes/x86: Use instruction decoder for booster
  kprobes/x86: Do not modify singlestep buffer while resuming
  kprobes/x86: Make boostable flag boolean
  kprobes/x86: Set kprobes pages readonly
  kprobes/x86: Use probe_kernel_read instead of memcpy
  kprobes/x86: Consolidate insn decoder users for copying code


 arch/x86/include/asm/kprobes.h   |7 +-
 arch/x86/kernel/kprobes/common.h |4 +
 arch/x86/kernel/kprobes/core.c   |  149 +++---
 arch/x86/kernel/kprobes/ftrace.c |2 -
 arch/x86/kernel/kprobes/opt.c|   13 +++
 5 files changed, 90 insertions(+), 85 deletions(-)

--
Masami Hiramatsu (Linaro) 

[RFC PATCH tip/master V3 0/8] kprobes/x86: Make kprobes instruction buffers read-only

[Masami Hiramatsu]

Hi,

This is the 3rd version of the series. I just updated 4/8 according
to Ingo's comment.

This series tries to make kprobes instruction buffers read-only
pages. Since those buffers are used for trampoline code, those
are a part of "text area" and it should be marked as ro for
avoiding unexpected modification. And this actually fix a warning
rodata sanity check reported by lkp-robot.

https://lkml.org/lkml/2017/2/27/161

This change requires changing the kprobe-booster at first
because it can modify the instruction buffer to add a jump while
resuming from single-stepping. Of course after we make the buffer
readonly, we may not be able to modify it while probing.

So, at first this series checks the current bootable instructions
and fixes a missed instruction (call far), modifies can_boost to
use x86 instruction decoder, and inserts "booster" jump while
preparing instruction buffer instead of resuming from single-stepping.
At last, it makes the buffers for kprobes and optprobe readonly.

This series also has some cleanup patches related to above 
changes.

Changes from V2:
 - [4/8]: Fix imbalanced curly braces and remove unneeded
   (void *) cast.

---

Masami Hiramatsu (8):
  kprobes/x86: Fix not to boost call far instruction
  kprobes/x86: Fix the description of __copy_instruction()
  kprobes/x86: Use instruction decoder for booster
  kprobes/x86: Do not modify singlestep buffer while resuming
  kprobes/x86: Make boostable flag boolean
  kprobes/x86: Set kprobes pages readonly
  kprobes/x86: Use probe_kernel_read instead of memcpy
  kprobes/x86: Consolidate insn decoder users for copying code


 arch/x86/include/asm/kprobes.h   |7 +-
 arch/x86/kernel/kprobes/common.h |4 +
 arch/x86/kernel/kprobes/core.c   |  149 +++---
 arch/x86/kernel/kprobes/ftrace.c |2 -
 arch/x86/kernel/kprobes/opt.c|   13 +++
 5 files changed, 90 insertions(+), 85 deletions(-)

--
Masami Hiramatsu (Linaro)