2 * core.c - Kernel Live Patching Core
4 * Copyright (C) 2014 Seth Jennings <sjenning@redhat.com>
5 * Copyright (C) 2014 SUSE
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version 2
10 * of the License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
23 #include <linux/module.h>
24 #include <linux/kernel.h>
25 #include <linux/mutex.h>
26 #include <linux/slab.h>
27 #include <linux/ftrace.h>
28 #include <linux/list.h>
29 #include <linux/kallsyms.h>
30 #include <linux/livepatch.h>
33 * struct klp_ops - structure for tracking registered ftrace ops structs
35 * A single ftrace_ops is shared between all enabled replacement functions
36 * (klp_func structs) which have the same old_addr. This allows the switch
37 * between function versions to happen instantaneously by updating the klp_ops
38 * struct's func_stack list. The winner is the klp_func at the top of the
39 * func_stack (front of the list).
41 * @node: node for the global klp_ops list
42 * @func_stack: list head for the stack of klp_func's (active func is on top)
43 * @fops: registered ftrace ops struct
46 struct list_head node;
47 struct list_head func_stack;
48 struct ftrace_ops fops;
52 * The klp_mutex protects the global lists and state transitions of any
53 * structure reachable from them. References to any structure must be obtained
54 * under mutex protection (except in klp_ftrace_handler(), which uses RCU to
55 * ensure it gets consistent data).
57 static DEFINE_MUTEX(klp_mutex);
59 static LIST_HEAD(klp_patches);
60 static LIST_HEAD(klp_ops);
62 static struct kobject *klp_root_kobj;
64 static struct klp_ops *klp_find_ops(unsigned long old_addr)
67 struct klp_func *func;
69 list_for_each_entry(ops, &klp_ops, node) {
70 func = list_first_entry(&ops->func_stack, struct klp_func,
72 if (func->old_addr == old_addr)
79 static bool klp_is_module(struct klp_object *obj)
84 static bool klp_is_object_loaded(struct klp_object *obj)
86 return !obj->name || obj->mod;
89 /* sets obj->mod if object is not vmlinux and module is found */
90 static void klp_find_object_module(struct klp_object *obj)
92 if (!klp_is_module(obj))
95 mutex_lock(&module_mutex);
97 * We don't need to take a reference on the module here because we have
98 * the klp_mutex, which is also taken by the module notifier. This
99 * prevents any module from unloading until we release the klp_mutex.
101 obj->mod = find_module(obj->name);
102 mutex_unlock(&module_mutex);
105 /* klp_mutex must be held by caller */
106 static bool klp_is_patch_registered(struct klp_patch *patch)
108 struct klp_patch *mypatch;
110 list_for_each_entry(mypatch, &klp_patches, list)
111 if (mypatch == patch)
117 static bool klp_initialized(void)
119 return klp_root_kobj;
122 struct klp_find_arg {
127 * If count == 0, the symbol was not found. If count == 1, a unique
128 * match was found and addr is set. If count > 1, there is
129 * unresolvable ambiguity among "count" number of symbols with the same
130 * name in the same object.
135 static int klp_find_callback(void *data, const char *name,
136 struct module *mod, unsigned long addr)
138 struct klp_find_arg *args = data;
140 if ((mod && !args->objname) || (!mod && args->objname))
143 if (strcmp(args->name, name))
146 if (args->objname && strcmp(args->objname, mod->name))
150 * args->addr might be overwritten if another match is found
151 * but klp_find_object_symbol() handles this and only returns the
152 * addr if count == 1.
160 static int klp_find_object_symbol(const char *objname, const char *name,
163 struct klp_find_arg args = {
170 kallsyms_on_each_symbol(klp_find_callback, &args);
173 pr_err("symbol '%s' not found in symbol table\n", name);
174 else if (args.count > 1)
175 pr_err("unresolvable ambiguity (%lu matches) on symbol '%s' in object '%s'\n",
176 args.count, name, objname);
186 struct klp_verify_args {
188 const unsigned long addr;
191 static int klp_verify_callback(void *data, const char *name,
192 struct module *mod, unsigned long addr)
194 struct klp_verify_args *args = data;
197 !strcmp(args->name, name) &&
204 static int klp_verify_vmlinux_symbol(const char *name, unsigned long addr)
206 struct klp_verify_args args = {
211 if (kallsyms_on_each_symbol(klp_verify_callback, &args))
214 pr_err("symbol '%s' not found at specified address 0x%016lx, kernel mismatch?\n",
219 static int klp_find_verify_func_addr(struct klp_object *obj,
220 struct klp_func *func)
224 #if defined(CONFIG_RANDOMIZE_BASE)
225 /* KASLR is enabled, disregard old_addr from user */
229 if (!func->old_addr || klp_is_module(obj))
230 ret = klp_find_object_symbol(obj->name, func->old_name,
233 ret = klp_verify_vmlinux_symbol(func->old_name,
240 * external symbols are located outside the parent object (where the parent
241 * object is either vmlinux or the kmod being patched).
243 static int klp_find_external_symbol(struct module *pmod, const char *name,
246 const struct kernel_symbol *sym;
248 /* first, check if it's an exported symbol */
250 sym = find_symbol(name, NULL, NULL, true, true);
258 /* otherwise check if it's in another .o within the patch module */
259 return klp_find_object_symbol(pmod->name, name, addr);
262 static int klp_write_object_relocations(struct module *pmod,
263 struct klp_object *obj)
266 struct klp_reloc *reloc;
268 if (WARN_ON(!klp_is_object_loaded(obj)))
271 if (WARN_ON(!obj->relocs))
274 for (reloc = obj->relocs; reloc->name; reloc++) {
275 if (!klp_is_module(obj)) {
276 ret = klp_verify_vmlinux_symbol(reloc->name,
281 /* module, reloc->val needs to be discovered */
283 ret = klp_find_external_symbol(pmod,
287 ret = klp_find_object_symbol(obj->mod->name,
293 ret = klp_write_module_reloc(pmod, reloc->type, reloc->loc,
294 reloc->val + reloc->addend);
296 pr_err("relocation failed for symbol '%s' at 0x%016lx (%d)\n",
297 reloc->name, reloc->val, ret);
305 static void notrace klp_ftrace_handler(unsigned long ip,
306 unsigned long parent_ip,
307 struct ftrace_ops *fops,
308 struct pt_regs *regs)
311 struct klp_func *func;
313 ops = container_of(fops, struct klp_ops, fops);
316 func = list_first_or_null_rcu(&ops->func_stack, struct klp_func,
318 if (WARN_ON_ONCE(!func))
321 klp_arch_set_pc(regs, (unsigned long)func->new_func);
326 static int klp_disable_func(struct klp_func *func)
331 if (WARN_ON(func->state != KLP_ENABLED))
334 if (WARN_ON(!func->old_addr))
337 ops = klp_find_ops(func->old_addr);
341 if (list_is_singular(&ops->func_stack)) {
342 ret = unregister_ftrace_function(&ops->fops);
344 pr_err("failed to unregister ftrace handler for function '%s' (%d)\n",
345 func->old_name, ret);
349 ret = ftrace_set_filter_ip(&ops->fops, func->old_addr, 1, 0);
351 pr_warn("function unregister succeeded but failed to clear the filter\n");
353 list_del_rcu(&func->stack_node);
354 list_del(&ops->node);
357 list_del_rcu(&func->stack_node);
360 func->state = KLP_DISABLED;
365 static int klp_enable_func(struct klp_func *func)
370 if (WARN_ON(!func->old_addr))
373 if (WARN_ON(func->state != KLP_DISABLED))
376 ops = klp_find_ops(func->old_addr);
378 ops = kzalloc(sizeof(*ops), GFP_KERNEL);
382 ops->fops.func = klp_ftrace_handler;
383 ops->fops.flags = FTRACE_OPS_FL_SAVE_REGS |
384 FTRACE_OPS_FL_DYNAMIC |
385 FTRACE_OPS_FL_IPMODIFY;
387 list_add(&ops->node, &klp_ops);
389 INIT_LIST_HEAD(&ops->func_stack);
390 list_add_rcu(&func->stack_node, &ops->func_stack);
392 ret = ftrace_set_filter_ip(&ops->fops, func->old_addr, 0, 0);
394 pr_err("failed to set ftrace filter for function '%s' (%d)\n",
395 func->old_name, ret);
399 ret = register_ftrace_function(&ops->fops);
401 pr_err("failed to register ftrace handler for function '%s' (%d)\n",
402 func->old_name, ret);
403 ftrace_set_filter_ip(&ops->fops, func->old_addr, 1, 0);
409 list_add_rcu(&func->stack_node, &ops->func_stack);
412 func->state = KLP_ENABLED;
417 list_del_rcu(&func->stack_node);
418 list_del(&ops->node);
423 static int klp_disable_object(struct klp_object *obj)
425 struct klp_func *func;
428 for (func = obj->funcs; func->old_name; func++) {
429 if (func->state != KLP_ENABLED)
432 ret = klp_disable_func(func);
437 obj->state = KLP_DISABLED;
442 static int klp_enable_object(struct klp_object *obj)
444 struct klp_func *func;
447 if (WARN_ON(obj->state != KLP_DISABLED))
450 if (WARN_ON(!klp_is_object_loaded(obj)))
453 for (func = obj->funcs; func->old_name; func++) {
454 ret = klp_enable_func(func);
458 obj->state = KLP_ENABLED;
463 WARN_ON(klp_disable_object(obj));
467 static int __klp_disable_patch(struct klp_patch *patch)
469 struct klp_object *obj;
472 /* enforce stacking: only the last enabled patch can be disabled */
473 if (!list_is_last(&patch->list, &klp_patches) &&
474 list_next_entry(patch, list)->state == KLP_ENABLED)
477 pr_notice("disabling patch '%s'\n", patch->mod->name);
479 for (obj = patch->objs; obj->funcs; obj++) {
480 if (obj->state != KLP_ENABLED)
483 ret = klp_disable_object(obj);
488 patch->state = KLP_DISABLED;
494 * klp_disable_patch() - disables a registered patch
495 * @patch: The registered, enabled patch to be disabled
497 * Unregisters the patched functions from ftrace.
499 * Return: 0 on success, otherwise error
501 int klp_disable_patch(struct klp_patch *patch)
505 mutex_lock(&klp_mutex);
507 if (!klp_is_patch_registered(patch)) {
512 if (patch->state == KLP_DISABLED) {
517 ret = __klp_disable_patch(patch);
520 mutex_unlock(&klp_mutex);
523 EXPORT_SYMBOL_GPL(klp_disable_patch);
525 static int __klp_enable_patch(struct klp_patch *patch)
527 struct klp_object *obj;
530 if (WARN_ON(patch->state != KLP_DISABLED))
533 /* enforce stacking: only the first disabled patch can be enabled */
534 if (patch->list.prev != &klp_patches &&
535 list_prev_entry(patch, list)->state == KLP_DISABLED)
538 pr_notice_once("tainting kernel with TAINT_LIVEPATCH\n");
539 add_taint(TAINT_LIVEPATCH, LOCKDEP_STILL_OK);
541 pr_notice("enabling patch '%s'\n", patch->mod->name);
543 for (obj = patch->objs; obj->funcs; obj++) {
544 klp_find_object_module(obj);
546 if (!klp_is_object_loaded(obj))
549 ret = klp_enable_object(obj);
554 patch->state = KLP_ENABLED;
559 WARN_ON(__klp_disable_patch(patch));
564 * klp_enable_patch() - enables a registered patch
565 * @patch: The registered, disabled patch to be enabled
567 * Performs the needed symbol lookups and code relocations,
568 * then registers the patched functions with ftrace.
570 * Return: 0 on success, otherwise error
572 int klp_enable_patch(struct klp_patch *patch)
576 mutex_lock(&klp_mutex);
578 if (!klp_is_patch_registered(patch)) {
583 ret = __klp_enable_patch(patch);
586 mutex_unlock(&klp_mutex);
589 EXPORT_SYMBOL_GPL(klp_enable_patch);
594 * /sys/kernel/livepatch
595 * /sys/kernel/livepatch/<patch>
596 * /sys/kernel/livepatch/<patch>/enabled
597 * /sys/kernel/livepatch/<patch>/<object>
598 * /sys/kernel/livepatch/<patch>/<object>/<func>
601 static ssize_t enabled_store(struct kobject *kobj, struct kobj_attribute *attr,
602 const char *buf, size_t count)
604 struct klp_patch *patch;
608 ret = kstrtoul(buf, 10, &val);
612 if (val != KLP_DISABLED && val != KLP_ENABLED)
615 patch = container_of(kobj, struct klp_patch, kobj);
617 mutex_lock(&klp_mutex);
619 if (val == patch->state) {
620 /* already in requested state */
625 if (val == KLP_ENABLED) {
626 ret = __klp_enable_patch(patch);
630 ret = __klp_disable_patch(patch);
635 mutex_unlock(&klp_mutex);
640 mutex_unlock(&klp_mutex);
644 static ssize_t enabled_show(struct kobject *kobj,
645 struct kobj_attribute *attr, char *buf)
647 struct klp_patch *patch;
649 patch = container_of(kobj, struct klp_patch, kobj);
650 return snprintf(buf, PAGE_SIZE-1, "%d\n", patch->state);
653 static struct kobj_attribute enabled_kobj_attr = __ATTR_RW(enabled);
654 static struct attribute *klp_patch_attrs[] = {
655 &enabled_kobj_attr.attr,
659 static void klp_kobj_release_patch(struct kobject *kobj)
662 * Once we have a consistency model we'll need to module_put() the
663 * patch module here. See klp_register_patch() for more details.
667 static struct kobj_type klp_ktype_patch = {
668 .release = klp_kobj_release_patch,
669 .sysfs_ops = &kobj_sysfs_ops,
670 .default_attrs = klp_patch_attrs,
673 static void klp_kobj_release_func(struct kobject *kobj)
677 static struct kobj_type klp_ktype_func = {
678 .release = klp_kobj_release_func,
679 .sysfs_ops = &kobj_sysfs_ops,
683 * Free all functions' kobjects in the array up to some limit. When limit is
684 * NULL, all kobjects are freed.
686 static void klp_free_funcs_limited(struct klp_object *obj,
687 struct klp_func *limit)
689 struct klp_func *func;
691 for (func = obj->funcs; func->old_name && func != limit; func++)
692 kobject_put(&func->kobj);
695 /* Clean up when a patched object is unloaded */
696 static void klp_free_object_loaded(struct klp_object *obj)
698 struct klp_func *func;
702 for (func = obj->funcs; func->old_name; func++)
707 * Free all objects' kobjects in the array up to some limit. When limit is
708 * NULL, all kobjects are freed.
710 static void klp_free_objects_limited(struct klp_patch *patch,
711 struct klp_object *limit)
713 struct klp_object *obj;
715 for (obj = patch->objs; obj->funcs && obj != limit; obj++) {
716 klp_free_funcs_limited(obj, NULL);
717 kobject_put(obj->kobj);
721 static void klp_free_patch(struct klp_patch *patch)
723 klp_free_objects_limited(patch, NULL);
724 if (!list_empty(&patch->list))
725 list_del(&patch->list);
726 kobject_put(&patch->kobj);
729 static int klp_init_func(struct klp_object *obj, struct klp_func *func)
731 INIT_LIST_HEAD(&func->stack_node);
732 func->state = KLP_DISABLED;
734 return kobject_init_and_add(&func->kobj, &klp_ktype_func,
735 obj->kobj, "%s", func->old_name);
738 /* parts of the initialization that is done only when the object is loaded */
739 static int klp_init_object_loaded(struct klp_patch *patch,
740 struct klp_object *obj)
742 struct klp_func *func;
746 ret = klp_write_object_relocations(patch->mod, obj);
751 for (func = obj->funcs; func->old_name; func++) {
752 ret = klp_find_verify_func_addr(obj, func);
760 static int klp_init_object(struct klp_patch *patch, struct klp_object *obj)
762 struct klp_func *func;
769 obj->state = KLP_DISABLED;
771 klp_find_object_module(obj);
773 name = klp_is_module(obj) ? obj->name : "vmlinux";
774 obj->kobj = kobject_create_and_add(name, &patch->kobj);
778 for (func = obj->funcs; func->old_name; func++) {
779 ret = klp_init_func(obj, func);
784 if (klp_is_object_loaded(obj)) {
785 ret = klp_init_object_loaded(patch, obj);
793 klp_free_funcs_limited(obj, func);
794 kobject_put(obj->kobj);
798 static int klp_init_patch(struct klp_patch *patch)
800 struct klp_object *obj;
806 mutex_lock(&klp_mutex);
808 patch->state = KLP_DISABLED;
810 ret = kobject_init_and_add(&patch->kobj, &klp_ktype_patch,
811 klp_root_kobj, "%s", patch->mod->name);
815 for (obj = patch->objs; obj->funcs; obj++) {
816 ret = klp_init_object(patch, obj);
821 list_add_tail(&patch->list, &klp_patches);
823 mutex_unlock(&klp_mutex);
828 klp_free_objects_limited(patch, obj);
829 kobject_put(&patch->kobj);
831 mutex_unlock(&klp_mutex);
836 * klp_unregister_patch() - unregisters a patch
837 * @patch: Disabled patch to be unregistered
839 * Frees the data structures and removes the sysfs interface.
841 * Return: 0 on success, otherwise error
843 int klp_unregister_patch(struct klp_patch *patch)
847 mutex_lock(&klp_mutex);
849 if (!klp_is_patch_registered(patch)) {
854 if (patch->state == KLP_ENABLED) {
859 klp_free_patch(patch);
862 mutex_unlock(&klp_mutex);
865 EXPORT_SYMBOL_GPL(klp_unregister_patch);
868 * klp_register_patch() - registers a patch
869 * @patch: Patch to be registered
871 * Initializes the data structure associated with the patch and
872 * creates the sysfs interface.
874 * Return: 0 on success, otherwise error
876 int klp_register_patch(struct klp_patch *patch)
880 if (!klp_initialized())
883 if (!patch || !patch->mod)
887 * A reference is taken on the patch module to prevent it from being
888 * unloaded. Right now, we don't allow patch modules to unload since
889 * there is currently no method to determine if a thread is still
890 * running in the patched code contained in the patch module once
891 * the ftrace registration is successful.
893 if (!try_module_get(patch->mod))
896 ret = klp_init_patch(patch);
898 module_put(patch->mod);
902 EXPORT_SYMBOL_GPL(klp_register_patch);
904 static void klp_module_notify_coming(struct klp_patch *patch,
905 struct klp_object *obj)
907 struct module *pmod = patch->mod;
908 struct module *mod = obj->mod;
911 ret = klp_init_object_loaded(patch, obj);
915 if (patch->state == KLP_DISABLED)
918 pr_notice("applying patch '%s' to loading module '%s'\n",
919 pmod->name, mod->name);
921 ret = klp_enable_object(obj);
926 pr_warn("failed to apply patch '%s' to module '%s' (%d)\n",
927 pmod->name, mod->name, ret);
930 static void klp_module_notify_going(struct klp_patch *patch,
931 struct klp_object *obj)
933 struct module *pmod = patch->mod;
934 struct module *mod = obj->mod;
937 if (patch->state == KLP_DISABLED)
940 pr_notice("reverting patch '%s' on unloading module '%s'\n",
941 pmod->name, mod->name);
943 ret = klp_disable_object(obj);
945 pr_warn("failed to revert patch '%s' on module '%s' (%d)\n",
946 pmod->name, mod->name, ret);
949 klp_free_object_loaded(obj);
952 static int klp_module_notify(struct notifier_block *nb, unsigned long action,
955 struct module *mod = data;
956 struct klp_patch *patch;
957 struct klp_object *obj;
959 if (action != MODULE_STATE_COMING && action != MODULE_STATE_GOING)
962 mutex_lock(&klp_mutex);
964 list_for_each_entry(patch, &klp_patches, list) {
965 for (obj = patch->objs; obj->funcs; obj++) {
966 if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
969 if (action == MODULE_STATE_COMING) {
971 klp_module_notify_coming(patch, obj);
972 } else /* MODULE_STATE_GOING */
973 klp_module_notify_going(patch, obj);
979 mutex_unlock(&klp_mutex);
984 static struct notifier_block klp_module_nb = {
985 .notifier_call = klp_module_notify,
986 .priority = INT_MIN+1, /* called late but before ftrace notifier */
989 static int klp_init(void)
993 ret = klp_check_compiler_support();
995 pr_info("Your compiler is too old; turning off.\n");
999 ret = register_module_notifier(&klp_module_nb);
1003 klp_root_kobj = kobject_create_and_add("livepatch", kernel_kobj);
1004 if (!klp_root_kobj) {
1012 unregister_module_notifier(&klp_module_nb);
1016 module_init(klp_init);