After the first session about introducing #Kernel #livepatching there will be a new session about tools to help you create livepatches. I'll be presenting with @joe-lawrence so stay tuned!
https://www.linuxfoundation.org/webinars/kernel-livepatching-hands-on?hsLang=en
After almost one year I finally published a new post on my personal blog, this time to talking about the work we at SUSE have done to the kernel livepatch selftests.
The post details the process of moving code from lib/livepatch to livepatch selftests, the problems found in the process, and sheds some light on Kbuild recursive Makefile calls.
Enjoy!
Stick the following in your ~/.gitconfig to make `git branch` sort by most recently committed (thanks to @wingo for this one!):
[branch]
sort = -committerdate
Interesting post from @vegard about backdooring linux kernel in a sneaky way by abusing the build process, and about potential mitigations. I do agree that that the fundamental issues are quite tricky to solve. https://www.openwall.com/lists/oss-security/2024/04/17/3 #infosec #cybersecurity
TIL: gcc’s -H flag to untangle header files
While backporting upstream patches to an older distro kernel:
f6ac18fafcf6 sched: Improve try_invoke_on_locked_down_task()
9b3c4ab3045e sched,rcu: Rework try_invoke_on_locked_down_task()
00619f7c650e sched,livepatch: Use task_call_func()
8850cb663b5c sched: Simplify wake_up_*idle*()
5de62ea84abd sched,livepatch: Use wake_up_if_idle()
I ran into compilation error:
kernel/livepatch/transition.c:434:33: error: implicit declaration of function ‘wake_up_if_idle’
A closer look at the upstream commits shows (“sched,livepatch: Use task_call_func()”) removed “../sched/sched.h” from kernel/livepatch/transition.c. wake_up_if_idle() is defined in include/linux/sched/idle.h so there is probably a connection – but how does this even build upstream and how to untangle the rat’s nest of kernel includes?
Enter gcc and the -H flag.
I rebuilt the upstream kernel kernel/livepatch/transition.o with V=1 and snarfed its gcc compilation line. Pasted into the terminal, added -H, and gcc generates a long header file stack. The header of interest was six includes deep:
. ./include/linux/cpu.h
.. ./include/linux/node.h
... ./include/linux/device.h
.... ./include/linux/energy_model.h
..... ./include/linux/sched/topology.h
...... ./include/linux/sched/idle.h
Moving back to my distro kernel, its device.h did not include energy_model.h (introduced upstream by 1bc138c62295 (“PM / EM: add support for other devices than CPUs in Energy Model”).
Mystery solved and a new trick to remember for a future problem.
Had to verify. And yes. Kernighan and Ritchie really did this. TIL :)