Linux Virtualization - Nov 2013 - [PATCH -tip RFC v2 01/22] kprobes: Prohibit probing on .entry.text code

On Fri, 15 Nov 2013 04:53:18 +0000
Masami Hiramatsu <masami.hiramatsu.pt at hitachi.com> wrote:
> .entry.text is a code area which is used for interrupt/syscall
> entries, and there are many sensitive codes.
> Thus, it is better to prohibit probing on all of such codes
> instead of a part of that.
> Since some symbols are already registered on kprobe blacklist,
> this also removes them from the blacklist.
This change only works with x86. On other archs, I get this:

kernel/built-in.o: In function `register_kprobe':
(.kprobes.text+0x9f4): undefined reference to `__entry_text_start'
kernel/built-in.o: In function `register_kprobe':
(.kprobes.text+0x9f8): undefined reference to `__entry_text_end'
make[1]: *** [vmlinux] Error 1
make: *** [sub-make] Error 2

-- Steve

On Fri, Nov 15, 2013 at 5:43 PM, Steven Rostedt <rostedt at goodmis.org>
wrote:
> On Fri, 15 Nov 2013 04:53:18 +0000
> Masami Hiramatsu <masami.hiramatsu.pt at hitachi.com> wrote:
>
>> .entry.text is a code area which is used for interrupt/syscall
>> entries, and there are many sensitive codes.
>> Thus, it is better to prohibit probing on all of such codes
>> instead of a part of that.
>> Since some symbols are already registered on kprobe blacklist,
>> this also removes them from the blacklist.
>
> This change only works with x86. On other archs, I get this:
>
> kernel/built-in.o: In function `register_kprobe':
> (.kprobes.text+0x9f4): undefined reference to `__entry_text_start'
> kernel/built-in.o: In function `register_kprobe':
> (.kprobes.text+0x9f8): undefined reference to `__entry_text_end'
> make[1]: *** [vmlinux] Error 1
> make: *** [sub-make] Error 2
X86 is the sole architecture that has ENTRY_TEXT in its
arch/*/kernel/vmlinux.lds.S.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert at
linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or
something like that.
                                -- Linus Torvalds

(2013/11/16 2:46), Geert Uytterhoeven wrote:
> On Fri, Nov 15, 2013 at 5:43 PM, Steven Rostedt <rostedt at
goodmis.org> wrote:
>> On Fri, 15 Nov 2013 04:53:18 +0000
>> Masami Hiramatsu <masami.hiramatsu.pt at hitachi.com> wrote:
>>
>>> .entry.text is a code area which is used for interrupt/syscall
>>> entries, and there are many sensitive codes.
>>> Thus, it is better to prohibit probing on all of such codes
>>> instead of a part of that.
>>> Since some symbols are already registered on kprobe blacklist,
>>> this also removes them from the blacklist.
>>
>> This change only works with x86. On other archs, I get this:
>>
>> kernel/built-in.o: In function `register_kprobe':
>> (.kprobes.text+0x9f4): undefined reference to `__entry_text_start'
>> kernel/built-in.o: In function `register_kprobe':
>> (.kprobes.text+0x9f8): undefined reference to `__entry_text_end'
>> make[1]: *** [vmlinux] Error 1
>> make: *** [sub-make] Error 2
> 
> X86 is the sole architecture that has ENTRY_TEXT in its
> arch/*/kernel/vmlinux.lds.S.
Ah, thanks! I'll fix that.
BTW, should I add CONFIG_HAVE_ENTRY_TEXT for x86 and use it
or just use CONFIG_X86 to detect it?

Thank you,

-- 
Masami HIRAMATSU
IT Management Research Dept. Linux Technology Center
Hitachi, Ltd., Yokohama Research Laboratory
E-mail: masami.hiramatsu.pt at hitachi.com