kernel/livepatch/core.c

   1 /*
   2  * core.c - Kernel Live Patching Core
   3  *
   4  * Copyright (C) 2014 Seth Jennings <sjenning@redhat.com>
   5  * Copyright (C) 2014 SUSE
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  22
  23 #include <linux/module.h>
  24 #include <linux/kernel.h>
  25 #include <linux/mutex.h>
  26 #include <linux/slab.h>
  27 #include <linux/list.h>
  28 #include <linux/kallsyms.h>
  29 #include <linux/livepatch.h>
  30 #include <linux/elf.h>
  31 #include <linux/moduleloader.h>
  32 #include <linux/completion.h>
  33 #include <asm/cacheflush.h>
  34 #include "core.h"
  35 #include "patch.h"
  36 #include "transition.h"
  37
  38 /*
  39  * klp_mutex is a coarse lock which serializes access to klp data.  All
  40  * accesses to klp-related variables and structures must have mutex protection,
  41  * except within the following functions which carefully avoid the need for it:
  42  *
  43  * - klp_ftrace_handler()
  44  * - klp_update_patch_state()
  45  */
  46 DEFINE_MUTEX(klp_mutex);
  47
  48 /*
  49  * Actively used patches: enabled or in transition. Note that replaced
  50  * or disabled patches are not listed even though the related kernel
  51  * module still can be loaded.
  52  */
  53 LIST_HEAD(klp_patches);
  54
  55 static struct kobject *klp_root_kobj;
  56
  57 static bool klp_is_module(struct klp_object *obj)
  58 {
  59         return obj->name;
  60 }
  61
  62 /* sets obj->mod if object is not vmlinux and module is found */
  63 static void klp_find_object_module(struct klp_object *obj)
  64 {
  65         struct module *mod;
  66
  67         if (!klp_is_module(obj))
  68                 return;
  69
  70         mutex_lock(&module_mutex);
  71         /*
  72          * We do not want to block removal of patched modules and therefore
  73          * we do not take a reference here. The patches are removed by
  74          * klp_module_going() instead.
  75          */
  76         mod = find_module(obj->name);
  77         /*
  78          * Do not mess work of klp_module_coming() and klp_module_going().
  79          * Note that the patch might still be needed before klp_module_going()
  80          * is called. Module functions can be called even in the GOING state
  81          * until mod->exit() finishes. This is especially important for
  82          * patches that modify semantic of the functions.
  83          */
  84         if (mod && mod->klp_alive)
  85                 obj->mod = mod;
  86
  87         mutex_unlock(&module_mutex);
  88 }
  89
  90 static bool klp_initialized(void)
  91 {
  92         return !!klp_root_kobj;
  93 }
  94
  95 static struct klp_func *klp_find_func(struct klp_object *obj,
  96                                       struct klp_func *old_func)
  97 {
  98         struct klp_func *func;
  99
 100         klp_for_each_func(obj, func) {
 101                 if ((strcmp(old_func->old_name, func->old_name) == 0) &&
 102                     (old_func->old_sympos == func->old_sympos)) {
 103                         return func;
 104                 }
 105         }
 106
 107         return NULL;
 108 }
 109
 110 static struct klp_object *klp_find_object(struct klp_patch *patch,
 111                                           struct klp_object *old_obj)
 112 {
 113         struct klp_object *obj;
 114
 115         klp_for_each_object(patch, obj) {
 116                 if (klp_is_module(old_obj)) {
 117                         if (klp_is_module(obj) &&
 118                             strcmp(old_obj->name, obj->name) == 0) {
 119                                 return obj;
 120                         }
 121                 } else if (!klp_is_module(obj)) {
 122                         return obj;
 123                 }
 124         }
 125
 126         return NULL;
 127 }
 128
 129 struct klp_find_arg {
 130         const char *objname;
 131         const char *name;
 132         unsigned long addr;
 133         unsigned long count;
 134         unsigned long pos;
 135 };
 136
 137 static int klp_find_callback(void *data, const char *name,
 138                              struct module *mod, unsigned long addr)
 139 {
 140         struct klp_find_arg *args = data;
 141
 142         if ((mod && !args->objname) || (!mod && args->objname))
 143                 return 0;
 144
 145         if (strcmp(args->name, name))
 146                 return 0;
 147
 148         if (args->objname && strcmp(args->objname, mod->name))
 149                 return 0;
 150
 151         args->addr = addr;
 152         args->count++;
 153
 154         /*
 155          * Finish the search when the symbol is found for the desired position
 156          * or the position is not defined for a non-unique symbol.
 157          */
 158         if ((args->pos && (args->count == args->pos)) ||
 159             (!args->pos && (args->count > 1)))
 160                 return 1;
 161
 162         return 0;
 163 }
 164
 165 static int klp_find_object_symbol(const char *objname, const char *name,
 166                                   unsigned long sympos, unsigned long *addr)
 167 {
 168         struct klp_find_arg args = {
 169                 .objname = objname,
 170                 .name = name,
 171                 .addr = 0,
 172                 .count = 0,
 173                 .pos = sympos,
 174         };
 175
 176         mutex_lock(&module_mutex);
 177         if (objname)
 178                 module_kallsyms_on_each_symbol(klp_find_callback, &args);
 179         else
 180                 kallsyms_on_each_symbol(klp_find_callback, &args);
 181         mutex_unlock(&module_mutex);
 182
 183         /*
 184          * Ensure an address was found. If sympos is 0, ensure symbol is unique;
 185          * otherwise ensure the symbol position count matches sympos.
 186          */
 187         if (args.addr == 0)
 188                 pr_err("symbol '%s' not found in symbol table\n", name);
 189         else if (args.count > 1 && sympos == 0) {
 190                 pr_err("unresolvable ambiguity for symbol '%s' in object '%s'\n",
 191                        name, objname);
 192         } else if (sympos != args.count && sympos > 0) {
 193                 pr_err("symbol position %lu for symbol '%s' in object '%s' not found\n",
 194                        sympos, name, objname ? objname : "vmlinux");
 195         } else {
 196                 *addr = args.addr;
 197                 return 0;
 198         }
 199
 200         *addr = 0;
 201         return -EINVAL;
 202 }
 203
 204 static int klp_resolve_symbols(Elf_Shdr *relasec, struct module *pmod)
 205 {
 206         int i, cnt, vmlinux, ret;
 207         char objname[MODULE_NAME_LEN];
 208         char symname[KSYM_NAME_LEN];
 209         char *strtab = pmod->core_kallsyms.strtab;
 210         Elf_Rela *relas;
 211         Elf_Sym *sym;
 212         unsigned long sympos, addr;
 213
 214         /*
 215          * Since the field widths for objname and symname in the sscanf()
 216          * call are hard-coded and correspond to MODULE_NAME_LEN and
 217          * KSYM_NAME_LEN respectively, we must make sure that MODULE_NAME_LEN
 218          * and KSYM_NAME_LEN have the values we expect them to have.
 219          *
 220          * Because the value of MODULE_NAME_LEN can differ among architectures,
 221          * we use the smallest/strictest upper bound possible (56, based on
 222          * the current definition of MODULE_NAME_LEN) to prevent overflows.
 223          */
 224         BUILD_BUG_ON(MODULE_NAME_LEN < 56 || KSYM_NAME_LEN != 128);
 225
 226         relas = (Elf_Rela *) relasec->sh_addr;
 227         /* For each rela in this klp relocation section */
 228         for (i = 0; i < relasec->sh_size / sizeof(Elf_Rela); i++) {
 229                 sym = pmod->core_kallsyms.symtab + ELF_R_SYM(relas[i].r_info);
 230                 if (sym->st_shndx != SHN_LIVEPATCH) {
 231                         pr_err("symbol %s is not marked as a livepatch symbol\n",
 232                                strtab + sym->st_name);
 233                         return -EINVAL;
 234                 }
 235
 236                 /* Format: .klp.sym.objname.symname,sympos */
 237                 cnt = sscanf(strtab + sym->st_name,
 238                              ".klp.sym.%55[^.].%127[^,],%lu",
 239                              objname, symname, &sympos);
 240                 if (cnt != 3) {
 241                         pr_err("symbol %s has an incorrectly formatted name\n",
 242                                strtab + sym->st_name);
 243                         return -EINVAL;
 244                 }
 245
 246                 /* klp_find_object_symbol() treats a NULL objname as vmlinux */
 247                 vmlinux = !strcmp(objname, "vmlinux");
 248                 ret = klp_find_object_symbol(vmlinux ? NULL : objname,
 249                                              symname, sympos, &addr);
 250                 if (ret)
 251                         return ret;
 252
 253                 sym->st_value = addr;
 254         }
 255
 256         return 0;
 257 }
 258
 259 static int klp_write_object_relocations(struct module *pmod,
 260                                         struct klp_object *obj)
 261 {
 262         int i, cnt, ret = 0;
 263         const char *objname, *secname;
 264         char sec_objname[MODULE_NAME_LEN];
 265         Elf_Shdr *sec;
 266
 267         if (WARN_ON(!klp_is_object_loaded(obj)))
 268                 return -EINVAL;
 269
 270         objname = klp_is_module(obj) ? obj->name : "vmlinux";
 271
 272         /* For each klp relocation section */
 273         for (i = 1; i < pmod->klp_info->hdr.e_shnum; i++) {
 274                 sec = pmod->klp_info->sechdrs + i;
 275                 secname = pmod->klp_info->secstrings + sec->sh_name;
 276                 if (!(sec->sh_flags & SHF_RELA_LIVEPATCH))
 277                         continue;
 278
 279                 /*
 280                  * Format: .klp.rela.sec_objname.section_name
 281                  * See comment in klp_resolve_symbols() for an explanation
 282                  * of the selected field width value.
 283                  */
 284                 cnt = sscanf(secname, ".klp.rela.%55[^.]", sec_objname);
 285                 if (cnt != 1) {
 286                         pr_err("section %s has an incorrectly formatted name\n",
 287                                secname);
 288                         ret = -EINVAL;
 289                         break;
 290                 }
 291
 292                 if (strcmp(objname, sec_objname))
 293                         continue;
 294
 295                 ret = klp_resolve_symbols(sec, pmod);
 296                 if (ret)
 297                         break;
 298
 299                 ret = apply_relocate_add(pmod->klp_info->sechdrs,
 300                                          pmod->core_kallsyms.strtab,
 301                                          pmod->klp_info->symndx, i, pmod);
 302                 if (ret)
 303                         break;
 304         }
 305
 306         return ret;
 307 }
 308
 309 /*
 310  * Sysfs Interface
 311  *
 312  * /sys/kernel/livepatch
 313  * /sys/kernel/livepatch/<patch>
 314  * /sys/kernel/livepatch/<patch>/enabled
 315  * /sys/kernel/livepatch/<patch>/transition
 316  * /sys/kernel/livepatch/<patch>/force
 317  * /sys/kernel/livepatch/<patch>/<object>
 318  * /sys/kernel/livepatch/<patch>/<object>/<function,sympos>
 319  */
 320 static int __klp_disable_patch(struct klp_patch *patch);
 321
 322 static ssize_t enabled_store(struct kobject *kobj, struct kobj_attribute *attr,
 323                              const char *buf, size_t count)
 324 {
 325         struct klp_patch *patch;
 326         int ret;
 327         bool enabled;
 328
 329         ret = kstrtobool(buf, &enabled);
 330         if (ret)
 331                 return ret;
 332
 333         patch = container_of(kobj, struct klp_patch, kobj);
 334
 335         mutex_lock(&klp_mutex);
 336
 337         if (patch->enabled == enabled) {
 338                 /* already in requested state */
 339                 ret = -EINVAL;
 340                 goto out;
 341         }
 342
 343         /*
 344          * Allow to reverse a pending transition in both ways. It might be
 345          * necessary to complete the transition without forcing and breaking
 346          * the system integrity.
 347          *
 348          * Do not allow to re-enable a disabled patch.
 349          */
 350         if (patch == klp_transition_patch)
 351                 klp_reverse_transition();
 352         else if (!enabled)
 353                 ret = __klp_disable_patch(patch);
 354         else
 355                 ret = -EINVAL;
 356
 357 out:
 358         mutex_unlock(&klp_mutex);
 359
 360         if (ret)
 361                 return ret;
 362         return count;
 363 }
 364
 365 static ssize_t enabled_show(struct kobject *kobj,
 366                             struct kobj_attribute *attr, char *buf)
 367 {
 368         struct klp_patch *patch;
 369
 370         patch = container_of(kobj, struct klp_patch, kobj);
 371         return snprintf(buf, PAGE_SIZE-1, "%d\n", patch->enabled);
 372 }
 373
 374 static ssize_t transition_show(struct kobject *kobj,
 375                                struct kobj_attribute *attr, char *buf)
 376 {
 377         struct klp_patch *patch;
 378
 379         patch = container_of(kobj, struct klp_patch, kobj);
 380         return snprintf(buf, PAGE_SIZE-1, "%d\n",
 381                         patch == klp_transition_patch);
 382 }
 383
 384 static ssize_t force_store(struct kobject *kobj, struct kobj_attribute *attr,
 385                            const char *buf, size_t count)
 386 {
 387         struct klp_patch *patch;
 388         int ret;
 389         bool val;
 390
 391         ret = kstrtobool(buf, &val);
 392         if (ret)
 393                 return ret;
 394
 395         if (!val)
 396                 return count;
 397
 398         mutex_lock(&klp_mutex);
 399
 400         patch = container_of(kobj, struct klp_patch, kobj);
 401         if (patch != klp_transition_patch) {
 402                 mutex_unlock(&klp_mutex);
 403                 return -EINVAL;
 404         }
 405
 406         klp_force_transition();
 407
 408         mutex_unlock(&klp_mutex);
 409
 410         return count;
 411 }
 412
 413 static struct kobj_attribute enabled_kobj_attr = __ATTR_RW(enabled);
 414 static struct kobj_attribute transition_kobj_attr = __ATTR_RO(transition);
 415 static struct kobj_attribute force_kobj_attr = __ATTR_WO(force);
 416 static struct attribute *klp_patch_attrs[] = {
 417         &enabled_kobj_attr.attr,
 418         &transition_kobj_attr.attr,
 419         &force_kobj_attr.attr,
 420         NULL
 421 };
 422
 423 static void klp_free_object_dynamic(struct klp_object *obj)
 424 {
 425         kfree(obj->name);
 426         kfree(obj);
 427 }
 428
 429 static struct klp_object *klp_alloc_object_dynamic(const char *name)
 430 {
 431         struct klp_object *obj;
 432
 433         obj = kzalloc(sizeof(*obj), GFP_KERNEL);
 434         if (!obj)
 435                 return NULL;
 436
 437         if (name) {
 438                 obj->name = kstrdup(name, GFP_KERNEL);
 439                 if (!obj->name) {
 440                         kfree(obj);
 441                         return NULL;
 442                 }
 443         }
 444
 445         INIT_LIST_HEAD(&obj->func_list);
 446         obj->dynamic = true;
 447
 448         return obj;
 449 }
 450
 451 static void klp_free_func_nop(struct klp_func *func)
 452 {
 453         kfree(func->old_name);
 454         kfree(func);
 455 }
 456
 457 static struct klp_func *klp_alloc_func_nop(struct klp_func *old_func,
 458                                            struct klp_object *obj)
 459 {
 460         struct klp_func *func;
 461
 462         func = kzalloc(sizeof(*func), GFP_KERNEL);
 463         if (!func)
 464                 return NULL;
 465
 466         if (old_func->old_name) {
 467                 func->old_name = kstrdup(old_func->old_name, GFP_KERNEL);
 468                 if (!func->old_name) {
 469                         kfree(func);
 470                         return NULL;
 471                 }
 472         }
 473
 474         /*
 475          * func->new_func is same as func->old_func. These addresses are
 476          * set when the object is loaded, see klp_init_object_loaded().
 477          */
 478         func->old_sympos = old_func->old_sympos;
 479         func->nop = true;
 480
 481         return func;
 482 }
 483
 484 static int klp_add_object_nops(struct klp_patch *patch,
 485                                struct klp_object *old_obj)
 486 {
 487         struct klp_object *obj;
 488         struct klp_func *func, *old_func;
 489
 490         obj = klp_find_object(patch, old_obj);
 491
 492         if (!obj) {
 493                 obj = klp_alloc_object_dynamic(old_obj->name);
 494                 if (!obj)
 495                         return -ENOMEM;
 496
 497                 list_add_tail(&obj->node, &patch->obj_list);
 498         }
 499
 500         klp_for_each_func(old_obj, old_func) {
 501                 func = klp_find_func(obj, old_func);
 502                 if (func)
 503                         continue;
 504
 505                 func = klp_alloc_func_nop(old_func, obj);
 506                 if (!func)
 507                         return -ENOMEM;
 508
 509                 list_add_tail(&func->node, &obj->func_list);
 510         }
 511
 512         return 0;
 513 }
 514
 515 /*
 516  * Add 'nop' functions which simply return to the caller to run
 517  * the original function. The 'nop' functions are added to a
 518  * patch to facilitate a 'replace' mode.
 519  */
 520 static int klp_add_nops(struct klp_patch *patch)
 521 {
 522         struct klp_patch *old_patch;
 523         struct klp_object *old_obj;
 524
 525         list_for_each_entry(old_patch, &klp_patches, list) {
 526                 klp_for_each_object(old_patch, old_obj) {
 527                         int err;
 528
 529                         err = klp_add_object_nops(patch, old_obj);
 530                         if (err)
 531                                 return err;
 532                 }
 533         }
 534
 535         return 0;
 536 }
 537
 538 static void klp_kobj_release_patch(struct kobject *kobj)
 539 {
 540         struct klp_patch *patch;
 541
 542         patch = container_of(kobj, struct klp_patch, kobj);
 543         complete(&patch->finish);
 544 }
 545
 546 static struct kobj_type klp_ktype_patch = {
 547         .release = klp_kobj_release_patch,
 548         .sysfs_ops = &kobj_sysfs_ops,
 549         .default_attrs = klp_patch_attrs,
 550 };
 551
 552 static void klp_kobj_release_object(struct kobject *kobj)
 553 {
 554         struct klp_object *obj;
 555
 556         obj = container_of(kobj, struct klp_object, kobj);
 557
 558         if (obj->dynamic)
 559                 klp_free_object_dynamic(obj);
 560 }
 561
 562 static struct kobj_type klp_ktype_object = {
 563         .release = klp_kobj_release_object,
 564         .sysfs_ops = &kobj_sysfs_ops,
 565 };
 566
 567 static void klp_kobj_release_func(struct kobject *kobj)
 568 {
 569         struct klp_func *func;
 570
 571         func = container_of(kobj, struct klp_func, kobj);
 572
 573         if (func->nop)
 574                 klp_free_func_nop(func);
 575 }
 576
 577 static struct kobj_type klp_ktype_func = {
 578         .release = klp_kobj_release_func,
 579         .sysfs_ops = &kobj_sysfs_ops,
 580 };
 581
 582 static void __klp_free_funcs(struct klp_object *obj, bool nops_only)
 583 {
 584         struct klp_func *func, *tmp_func;
 585
 586         klp_for_each_func_safe(obj, func, tmp_func) {
 587                 if (nops_only && !func->nop)
 588                         continue;
 589
 590                 list_del(&func->node);
 591
 592                 /* Might be called from klp_init_patch() error path. */
 593                 if (func->kobj_added) {
 594                         kobject_put(&func->kobj);
 595                 } else if (func->nop) {
 596                         klp_free_func_nop(func);
 597                 }
 598         }
 599 }
 600
 601 /* Clean up when a patched object is unloaded */
 602 static void klp_free_object_loaded(struct klp_object *obj)
 603 {
 604         struct klp_func *func;
 605
 606         obj->mod = NULL;
 607
 608         klp_for_each_func(obj, func) {
 609                 func->old_func = NULL;
 610
 611                 if (func->nop)
 612                         func->new_func = NULL;
 613         }
 614 }
 615
 616 static void __klp_free_objects(struct klp_patch *patch, bool nops_only)
 617 {
 618         struct klp_object *obj, *tmp_obj;
 619
 620         klp_for_each_object_safe(patch, obj, tmp_obj) {
 621                 __klp_free_funcs(obj, nops_only);
 622
 623                 if (nops_only && !obj->dynamic)
 624                         continue;
 625
 626                 list_del(&obj->node);
 627
 628                 /* Might be called from klp_init_patch() error path. */
 629                 if (obj->kobj_added) {
 630                         kobject_put(&obj->kobj);
 631                 } else if (obj->dynamic) {
 632                         klp_free_object_dynamic(obj);
 633                 }
 634         }
 635 }
 636
 637 static void klp_free_objects(struct klp_patch *patch)
 638 {
 639         __klp_free_objects(patch, false);
 640 }
 641
 642 static void klp_free_objects_dynamic(struct klp_patch *patch)
 643 {
 644         __klp_free_objects(patch, true);
 645 }
 646
 647 /*
 648  * This function implements the free operations that can be called safely
 649  * under klp_mutex.
 650  *
 651  * The operation must be completed by calling klp_free_patch_finish()
 652  * outside klp_mutex.
 653  */
 654 void klp_free_patch_start(struct klp_patch *patch)
 655 {
 656         if (!list_empty(&patch->list))
 657                 list_del(&patch->list);
 658
 659         klp_free_objects(patch);
 660 }
 661
 662 /*
 663  * This function implements the free part that must be called outside
 664  * klp_mutex.
 665  *
 666  * It must be called after klp_free_patch_start(). And it has to be
 667  * the last function accessing the livepatch structures when the patch
 668  * gets disabled.
 669  */
 670 static void klp_free_patch_finish(struct klp_patch *patch)
 671 {
 672         /*
 673          * Avoid deadlock with enabled_store() sysfs callback by
 674          * calling this outside klp_mutex. It is safe because
 675          * this is called when the patch gets disabled and it
 676          * cannot get enabled again.
 677          */
 678         if (patch->kobj_added) {
 679                 kobject_put(&patch->kobj);
 680                 wait_for_completion(&patch->finish);
 681         }
 682
 683         /* Put the module after the last access to struct klp_patch. */
 684         if (!patch->forced)
 685                 module_put(patch->mod);
 686 }
 687
 688 /*
 689  * The livepatch might be freed from sysfs interface created by the patch.
 690  * This work allows to wait until the interface is destroyed in a separate
 691  * context.
 692  */
 693 static void klp_free_patch_work_fn(struct work_struct *work)
 694 {
 695         struct klp_patch *patch =
 696                 container_of(work, struct klp_patch, free_work);
 697
 698         klp_free_patch_finish(patch);
 699 }
 700
 701 static int klp_init_func(struct klp_object *obj, struct klp_func *func)
 702 {
 703         int ret;
 704
 705         if (!func->old_name)
 706                 return -EINVAL;
 707
 708         /*
 709          * NOPs get the address later. The patched module must be loaded,
 710          * see klp_init_object_loaded().
 711          */
 712         if (!func->new_func && !func->nop)
 713                 return -EINVAL;
 714
 715         if (strlen(func->old_name) >= KSYM_NAME_LEN)
 716                 return -EINVAL;
 717
 718         INIT_LIST_HEAD(&func->stack_node);
 719         func->patched = false;
 720         func->transition = false;
 721
 722         /* The format for the sysfs directory is <function,sympos> where sympos
 723          * is the nth occurrence of this symbol in kallsyms for the patched
 724          * object. If the user selects 0 for old_sympos, then 1 will be used
 725          * since a unique symbol will be the first occurrence.
 726          */
 727         ret = kobject_init_and_add(&func->kobj, &klp_ktype_func,
 728                                    &obj->kobj, "%s,%lu", func->old_name,
 729                                    func->old_sympos ? func->old_sympos : 1);
 730         if (!ret)
 731                 func->kobj_added = true;
 732
 733         return ret;
 734 }
 735
 736 /* Arches may override this to finish any remaining arch-specific tasks */
 737 void __weak arch_klp_init_object_loaded(struct klp_patch *patch,
 738                                         struct klp_object *obj)
 739 {
 740 }
 741
 742 /* parts of the initialization that is done only when the object is loaded */
 743 static int klp_init_object_loaded(struct klp_patch *patch,
 744                                   struct klp_object *obj)
 745 {
 746         struct klp_func *func;
 747         int ret;
 748
 749         module_disable_ro(patch->mod);
 750         ret = klp_write_object_relocations(patch->mod, obj);
 751         if (ret) {
 752                 module_enable_ro(patch->mod, true);
 753                 return ret;
 754         }
 755
 756         arch_klp_init_object_loaded(patch, obj);
 757         module_enable_ro(patch->mod, true);
 758
 759         klp_for_each_func(obj, func) {
 760                 ret = klp_find_object_symbol(obj->name, func->old_name,
 761                                              func->old_sympos,
 762                                              (unsigned long *)&func->old_func);
 763                 if (ret)
 764                         return ret;
 765
 766                 ret = kallsyms_lookup_size_offset((unsigned long)func->old_func,
 767                                                   &func->old_size, NULL);
 768                 if (!ret) {
 769                         pr_err("kallsyms size lookup failed for '%s'\n",
 770                                func->old_name);
 771                         return -ENOENT;
 772                 }
 773
 774                 if (func->nop)
 775                         func->new_func = func->old_func;
 776
 777                 ret = kallsyms_lookup_size_offset((unsigned long)func->new_func,
 778                                                   &func->new_size, NULL);
 779                 if (!ret) {
 780                         pr_err("kallsyms size lookup failed for '%s' replacement\n",
 781                                func->old_name);
 782                         return -ENOENT;
 783                 }
 784         }
 785
 786         return 0;
 787 }
 788
 789 static int klp_init_object(struct klp_patch *patch, struct klp_object *obj)
 790 {
 791         struct klp_func *func;
 792         int ret;
 793         const char *name;
 794
 795         if (klp_is_module(obj) && strlen(obj->name) >= MODULE_NAME_LEN)
 796                 return -EINVAL;
 797
 798         obj->patched = false;
 799         obj->mod = NULL;
 800
 801         klp_find_object_module(obj);
 802
 803         name = klp_is_module(obj) ? obj->name : "vmlinux";
 804         ret = kobject_init_and_add(&obj->kobj, &klp_ktype_object,
 805                                    &patch->kobj, "%s", name);
 806         if (ret)
 807                 return ret;
 808         obj->kobj_added = true;
 809
 810         klp_for_each_func(obj, func) {
 811                 ret = klp_init_func(obj, func);
 812                 if (ret)
 813                         return ret;
 814         }
 815
 816         if (klp_is_object_loaded(obj))
 817                 ret = klp_init_object_loaded(patch, obj);
 818
 819         return ret;
 820 }
 821
 822 static int klp_init_patch_early(struct klp_patch *patch)
 823 {
 824         struct klp_object *obj;
 825         struct klp_func *func;
 826
 827         if (!patch->objs)
 828                 return -EINVAL;
 829
 830         INIT_LIST_HEAD(&patch->list);
 831         INIT_LIST_HEAD(&patch->obj_list);
 832         patch->kobj_added = false;
 833         patch->enabled = false;
 834         patch->forced = false;
 835         INIT_WORK(&patch->free_work, klp_free_patch_work_fn);
 836         init_completion(&patch->finish);
 837
 838         klp_for_each_object_static(patch, obj) {
 839                 if (!obj->funcs)
 840                         return -EINVAL;
 841
 842                 INIT_LIST_HEAD(&obj->func_list);
 843                 obj->kobj_added = false;
 844                 list_add_tail(&obj->node, &patch->obj_list);
 845
 846                 klp_for_each_func_static(obj, func) {
 847                         func->kobj_added = false;
 848                         list_add_tail(&func->node, &obj->func_list);
 849                 }
 850         }
 851
 852         if (!try_module_get(patch->mod))
 853                 return -ENODEV;
 854
 855         return 0;
 856 }
 857
 858 static int klp_init_patch(struct klp_patch *patch)
 859 {
 860         struct klp_object *obj;
 861         int ret;
 862
 863         ret = kobject_init_and_add(&patch->kobj, &klp_ktype_patch,
 864                                    klp_root_kobj, "%s", patch->mod->name);
 865         if (ret)
 866                 return ret;
 867         patch->kobj_added = true;
 868
 869         if (patch->replace) {
 870                 ret = klp_add_nops(patch);
 871                 if (ret)
 872                         return ret;
 873         }
 874
 875         klp_for_each_object(patch, obj) {
 876                 ret = klp_init_object(patch, obj);
 877                 if (ret)
 878                         return ret;
 879         }
 880
 881         list_add_tail(&patch->list, &klp_patches);
 882
 883         return 0;
 884 }
 885
 886 static int __klp_disable_patch(struct klp_patch *patch)
 887 {
 888         struct klp_object *obj;
 889
 890         if (WARN_ON(!patch->enabled))
 891                 return -EINVAL;
 892
 893         if (klp_transition_patch)
 894                 return -EBUSY;
 895
 896         klp_init_transition(patch, KLP_UNPATCHED);
 897
 898         klp_for_each_object(patch, obj)
 899                 if (obj->patched)
 900                         klp_pre_unpatch_callback(obj);
 901
 902         /*
 903          * Enforce the order of the func->transition writes in
 904          * klp_init_transition() and the TIF_PATCH_PENDING writes in
 905          * klp_start_transition().  In the rare case where klp_ftrace_handler()
 906          * is called shortly after klp_update_patch_state() switches the task,
 907          * this ensures the handler sees that func->transition is set.
 908          */
 909         smp_wmb();
 910
 911         klp_start_transition();
 912         patch->enabled = false;
 913         klp_try_complete_transition();
 914
 915         return 0;
 916 }
 917
 918 static int __klp_enable_patch(struct klp_patch *patch)
 919 {
 920         struct klp_object *obj;
 921         int ret;
 922
 923         if (klp_transition_patch)
 924                 return -EBUSY;
 925
 926         if (WARN_ON(patch->enabled))
 927                 return -EINVAL;
 928
 929         if (!patch->kobj_added)
 930                 return -EINVAL;
 931
 932         pr_notice("enabling patch '%s'\n", patch->mod->name);
 933
 934         klp_init_transition(patch, KLP_PATCHED);
 935
 936         /*
 937          * Enforce the order of the func->transition writes in
 938          * klp_init_transition() and the ops->func_stack writes in
 939          * klp_patch_object(), so that klp_ftrace_handler() will see the
 940          * func->transition updates before the handler is registered and the
 941          * new funcs become visible to the handler.
 942          */
 943         smp_wmb();
 944
 945         klp_for_each_object(patch, obj) {
 946                 if (!klp_is_object_loaded(obj))
 947                         continue;
 948
 949                 ret = klp_pre_patch_callback(obj);
 950                 if (ret) {
 951                         pr_warn("pre-patch callback failed for object '%s'\n",
 952                                 klp_is_module(obj) ? obj->name : "vmlinux");
 953                         goto err;
 954                 }
 955
 956                 ret = klp_patch_object(obj);
 957                 if (ret) {
 958                         pr_warn("failed to patch object '%s'\n",
 959                                 klp_is_module(obj) ? obj->name : "vmlinux");
 960                         goto err;
 961                 }
 962         }
 963
 964         klp_start_transition();
 965         patch->enabled = true;
 966         klp_try_complete_transition();
 967
 968         return 0;
 969 err:
 970         pr_warn("failed to enable patch '%s'\n", patch->mod->name);
 971
 972         klp_cancel_transition();
 973         return ret;
 974 }
 975
 976 /**
 977  * klp_enable_patch() - enable the livepatch
 978  * @patch:      patch to be enabled
 979  *
 980  * Initializes the data structure associated with the patch, creates the sysfs
 981  * interface, performs the needed symbol lookups and code relocations,
 982  * registers the patched functions with ftrace.
 983  *
 984  * This function is supposed to be called from the livepatch module_init()
 985  * callback.
 986  *
 987  * Return: 0 on success, otherwise error
 988  */
 989 int klp_enable_patch(struct klp_patch *patch)
 990 {
 991         int ret;
 992
 993         if (!patch || !patch->mod)
 994                 return -EINVAL;
 995
 996         if (!is_livepatch_module(patch->mod)) {
 997                 pr_err("module %s is not marked as a livepatch module\n",
 998                        patch->mod->name);
 999                 return -EINVAL;
1000         }
1001
1002         if (!klp_initialized())
1003                 return -ENODEV;
1004
1005         if (!klp_have_reliable_stack()) {
1006                 pr_err("This architecture doesn't have support for the livepatch consistency model.\n");
1007                 return -ENOSYS;
1008         }
1009
1010
1011         mutex_lock(&klp_mutex);
1012
1013         ret = klp_init_patch_early(patch);
1014         if (ret) {
1015                 mutex_unlock(&klp_mutex);
1016                 return ret;
1017         }
1018
1019         ret = klp_init_patch(patch);
1020         if (ret)
1021                 goto err;
1022
1023         ret = __klp_enable_patch(patch);
1024         if (ret)
1025                 goto err;
1026
1027         mutex_unlock(&klp_mutex);
1028
1029         return 0;
1030
1031 err:
1032         klp_free_patch_start(patch);
1033
1034         mutex_unlock(&klp_mutex);
1035
1036         klp_free_patch_finish(patch);
1037
1038         return ret;
1039 }
1040 EXPORT_SYMBOL_GPL(klp_enable_patch);
1041
1042 /*
1043  * This function removes replaced patches.
1044  *
1045  * We could be pretty aggressive here. It is called in the situation where
1046  * these structures are no longer accessible. All functions are redirected
1047  * by the klp_transition_patch. They use either a new code or they are in
1048  * the original code because of the special nop function patches.
1049  *
1050  * The only exception is when the transition was forced. In this case,
1051  * klp_ftrace_handler() might still see the replaced patch on the stack.
1052  * Fortunately, it is carefully designed to work with removed functions
1053  * thanks to RCU. We only have to keep the patches on the system. Also
1054  * this is handled transparently by patch->module_put.
1055  */
1056 void klp_discard_replaced_patches(struct klp_patch *new_patch)
1057 {
1058         struct klp_patch *old_patch, *tmp_patch;
1059
1060         list_for_each_entry_safe(old_patch, tmp_patch, &klp_patches, list) {
1061                 if (old_patch == new_patch)
1062                         return;
1063
1064                 old_patch->enabled = false;
1065                 klp_unpatch_objects(old_patch);
1066                 klp_free_patch_start(old_patch);
1067                 schedule_work(&old_patch->free_work);
1068         }
1069 }
1070
1071 /*
1072  * This function removes the dynamically allocated 'nop' functions.
1073  *
1074  * We could be pretty aggressive. NOPs do not change the existing
1075  * behavior except for adding unnecessary delay by the ftrace handler.
1076  *
1077  * It is safe even when the transition was forced. The ftrace handler
1078  * will see a valid ops->func_stack entry thanks to RCU.
1079  *
1080  * We could even free the NOPs structures. They must be the last entry
1081  * in ops->func_stack. Therefore unregister_ftrace_function() is called.
1082  * It does the same as klp_synchronize_transition() to make sure that
1083  * nobody is inside the ftrace handler once the operation finishes.
1084  *
1085  * IMPORTANT: It must be called right after removing the replaced patches!
1086  */
1087 void klp_discard_nops(struct klp_patch *new_patch)
1088 {
1089         klp_unpatch_objects_dynamic(klp_transition_patch);
1090         klp_free_objects_dynamic(klp_transition_patch);
1091 }
1092
1093 /*
1094  * Remove parts of patches that touch a given kernel module. The list of
1095  * patches processed might be limited. When limit is NULL, all patches
1096  * will be handled.
1097  */
1098 static void klp_cleanup_module_patches_limited(struct module *mod,
1099                                                struct klp_patch *limit)
1100 {
1101         struct klp_patch *patch;
1102         struct klp_object *obj;
1103
1104         list_for_each_entry(patch, &klp_patches, list) {
1105                 if (patch == limit)
1106                         break;
1107
1108                 klp_for_each_object(patch, obj) {
1109                         if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
1110                                 continue;
1111
1112                         /*
1113                          * Only unpatch the module if the patch is enabled or
1114                          * is in transition.
1115                          */
1116                         if (patch->enabled || patch == klp_transition_patch) {
1117
1118                                 if (patch != klp_transition_patch)
1119                                         klp_pre_unpatch_callback(obj);
1120
1121                                 pr_notice("reverting patch '%s' on unloading module '%s'\n",
1122                                           patch->mod->name, obj->mod->name);
1123                                 klp_unpatch_object(obj);
1124
1125                                 klp_post_unpatch_callback(obj);
1126                         }
1127
1128                         klp_free_object_loaded(obj);
1129                         break;
1130                 }
1131         }
1132 }
1133
1134 int klp_module_coming(struct module *mod)
1135 {
1136         int ret;
1137         struct klp_patch *patch;
1138         struct klp_object *obj;
1139
1140         if (WARN_ON(mod->state != MODULE_STATE_COMING))
1141                 return -EINVAL;
1142
1143         mutex_lock(&klp_mutex);
1144         /*
1145          * Each module has to know that klp_module_coming()
1146          * has been called. We never know what module will
1147          * get patched by a new patch.
1148          */
1149         mod->klp_alive = true;
1150
1151         list_for_each_entry(patch, &klp_patches, list) {
1152                 klp_for_each_object(patch, obj) {
1153                         if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
1154                                 continue;
1155
1156                         obj->mod = mod;
1157
1158                         ret = klp_init_object_loaded(patch, obj);
1159                         if (ret) {
1160                                 pr_warn("failed to initialize patch '%s' for module '%s' (%d)\n",
1161                                         patch->mod->name, obj->mod->name, ret);
1162                                 goto err;
1163                         }
1164
1165                         /*
1166                          * Only patch the module if the patch is enabled or is
1167                          * in transition.
1168                          */
1169                         if (!patch->enabled && patch != klp_transition_patch)
1170                                 break;
1171
1172                         pr_notice("applying patch '%s' to loading module '%s'\n",
1173                                   patch->mod->name, obj->mod->name);
1174
1175                         ret = klp_pre_patch_callback(obj);
1176                         if (ret) {
1177                                 pr_warn("pre-patch callback failed for object '%s'\n",
1178                                         obj->name);
1179                                 goto err;
1180                         }
1181
1182                         ret = klp_patch_object(obj);
1183                         if (ret) {
1184                                 pr_warn("failed to apply patch '%s' to module '%s' (%d)\n",
1185                                         patch->mod->name, obj->mod->name, ret);
1186
1187                                 klp_post_unpatch_callback(obj);
1188                                 goto err;
1189                         }
1190
1191                         if (patch != klp_transition_patch)
1192                                 klp_post_patch_callback(obj);
1193
1194                         break;
1195                 }
1196         }
1197
1198         mutex_unlock(&klp_mutex);
1199
1200         return 0;
1201
1202 err:
1203         /*
1204          * If a patch is unsuccessfully applied, return
1205          * error to the module loader.
1206          */
1207         pr_warn("patch '%s' failed for module '%s', refusing to load module '%s'\n",
1208                 patch->mod->name, obj->mod->name, obj->mod->name);
1209         mod->klp_alive = false;
1210         klp_cleanup_module_patches_limited(mod, patch);
1211         mutex_unlock(&klp_mutex);
1212
1213         return ret;
1214 }
1215
1216 void klp_module_going(struct module *mod)
1217 {
1218         if (WARN_ON(mod->state != MODULE_STATE_GOING &&
1219                     mod->state != MODULE_STATE_COMING))
1220                 return;
1221
1222         mutex_lock(&klp_mutex);
1223         /*
1224          * Each module has to know that klp_module_going()
1225          * has been called. We never know what module will
1226          * get patched by a new patch.
1227          */
1228         mod->klp_alive = false;
1229
1230         klp_cleanup_module_patches_limited(mod, NULL);
1231
1232         mutex_unlock(&klp_mutex);
1233 }
1234
1235 static int __init klp_init(void)
1236 {
1237         int ret;
1238
1239         ret = klp_check_compiler_support();
1240         if (ret) {
1241                 pr_info("Your compiler is too old; turning off.\n");
1242                 return -EINVAL;
1243         }
1244
1245         klp_root_kobj = kobject_create_and_add("livepatch", kernel_kobj);
1246         if (!klp_root_kobj)
1247                 return -ENOMEM;
1248
1249         return 0;
1250 }
1251
1252 module_init(klp_init);