Support for CONFIG_GCC_PLUGIN_LATENT_ENTROPY option?

[sshedi]

Hi, are there any plans to make Kpatch work with CONFIG_GCC_PLUGIN_LATENT_ENTROPY kernel config enabled?

[joe-lawrence]

Hi @sshedi,

1. See CONFIG_GCC_PLUGIN_LATENT_ENTROPY incompatibility #924 for past kpatch-build issues and CONFIG_GCC_PLUGIN_LATENT_ENTROPY. That said, if the randomness is limited and easily detectable, perhaps kpatch-build could work around it. Patches welcome. 😄
2. Just curious, is there a distribution that has enabled this kernel config?

[sshedi]

Just curious, is there a distribution that has enabled this kernel config?

We have it enabled in Photon OS.
https://github.com/vmware/photon/blob/5.0/SPECS/linux/config_x86_64#L823
We have decided to disable it to support kpatch.

Thanks for the response and pointers.

[jpoimboe]

Can you try the following (untested) patch?

diff --git a/kpatch-build/create-diff-object.c b/kpatch-build/create-diff-object.c
index 531df64..2ecb10b 100644
--- a/kpatch-build/create-diff-object.c
+++ b/kpatch-build/create-diff-object.c
@@ -69,7 +69,7 @@ enum subsection {
 
 enum loglevel loglevel = NORMAL;
 
-bool KLP_ARCH;
+bool KLP_ARCH, IGNORE_INIT;
 
 int jump_label_errors, static_call_errors;
 
@@ -1716,9 +1716,14 @@ static void kpatch_verify_patchability(struct kpatch_elf *kelf)
 
 	list_for_each_entry(sec, &kelf->sections, list) {
 		if (sec->status == CHANGED && !sec->include) {
-			log_normal("changed section %s not selected for inclusion\n",
-				   sec->name);
-			errs++;
+			if (IGNORE_INIT && !strcmp(sec->name, ".init.text")) {
+				warn("CONFIG_GCC_PLUGIN_LATENT_ENTROPY enabled, ignoring __init function changes");
+				sec->status = SAME;
+			} else {
+				log_normal("changed section %s not selected for inclusion\n",
+					   sec->name);
+				errs++;
+			}
 		}
 
 		if (sec->status != SAME && sec->grouped) {
@@ -4097,6 +4102,7 @@ static char args_doc[] = "original.o patched.o parent-name parent-symtab Module.
 static struct argp_option options[] = {
 	{"debug",	'd', NULL, 0, "Show debug output" },
 	{"klp-arch",	'a', NULL, 0, "Kernel supports .klp.arch section" },
+	{"ignore-init",	'i', NULL, 0, "Ignore .init.text changes" },
 	{ NULL }
 };
 
@@ -4114,6 +4120,9 @@ static error_t parse_opt (int key, char *arg, struct argp_state *state)
 		case 'a':
 			arguments->klp_arch = 1;
 			break;
+		case 'i':
+			IGNORE_INIT = true;
+			break;
 		case ARGP_KEY_ARG:
 			if (state->arg_num >= 7)
 				/* Too many arguments. */
diff --git a/kpatch-build/kpatch-build b/kpatch-build/kpatch-build
index bc112fc..4e0a8ca 100755
--- a/kpatch-build/kpatch-build
+++ b/kpatch-build/kpatch-build
@@ -1192,9 +1192,13 @@ else
 	KBUILD_EXTRA_SYMBOLS="$SYMVERSFILE"
 fi
 
+if [[ -n "$CONFIG_GCC_PLUGIN_LATENT_ENTROPY" ]]; then
+	warn "CONFIG_GCC_PLUGIN_LATENT_ENTROPY enabled, ignoring .init.text changes"
+	CDO_FLAGS+=("--ignore-init")
+fi
+
 # unsupported kernel option checking
 [[ -n "$CONFIG_DEBUG_INFO_SPLIT" ]] && die "kernel option 'CONFIG_DEBUG_INFO_SPLIT' not supported"
-[[ -n "$CONFIG_GCC_PLUGIN_LATENT_ENTROPY" ]] && die "kernel option 'CONFIG_GCC_PLUGIN_LATENT_ENTROPY' not supported"
 [[ -n "$CONFIG_GCC_PLUGIN_RANDSTRUCT" ]] && die "kernel option 'CONFIG_GCC_PLUGIN_RANDSTRUCT' not supported"
 [[ -n "$CONFIG_X86_KERNEL_IBT" ]] && die "kernel option 'CONFIG_X86_KERNEL_IBT' not supported"
 

[sshedi]

Than @jpoimboe we will try it.

[jpoimboe]

Hm, actually looking at the latent entropy plugin today, that patch isn't going to work. The plugin doesn't just affect .init.text, it affects any function with the __latent_entropy attribute.

If you really wanted to use this plugin, I think the best way for kpatch to support it would be to edit the plugin in the kernel tree (scripts/gcc-plugins/latent_entropy_plugin.c) so that it adds a new annotation section (.annotate.latent_entropy or so) which has relocations which point to all the instructions which move the random const to a register. Then create-diff-object could read that section and mark those instructions as ones to be ignored in the diff.