Merge branch 'for-5.5/system-state' into for-linus

    cumulative-patches

    module-elf-format

    shadow-vars

    system-state

.. only::  subproject and html

====================

System State Changes

====================

Some users are really reluctant to reboot a system. This brings the need

to provide more livepatches and maintain some compatibility between them.

Maintaining more livepatches is much easier with cumulative livepatches.

Each new livepatch completely replaces any older one. It can keep,

add, and even remove fixes. And it is typically safe to replace any version

of the livepatch with any other one thanks to the atomic replace feature.

The problems might come with shadow variables and callbacks. They might

change the system behavior or state so that it is no longer safe to

go back and use an older livepatch or the original kernel code. Also

any new livepatch must be able to detect what changes have already been

done by the already installed livepatches.

This is where the livepatch system state tracking gets useful. It

allows to:

  - store data needed to manipulate and restore the system state

  - define compatibility between livepatches using a change id

    and version

1. Livepatch system state API

=============================

The state of the system might get modified either by several livepatch callbacks

or by the newly used code. Also it must be possible to find changes done by

already installed livepatches.

Each modified state is described by struct klp_state, see

include/linux/livepatch.h.

Each livepatch defines an array of struct klp_states. They mention

all states that the livepatch modifies.

The livepatch author must define the following two fields for each

struct klp_state:

  - *id*

    - Non-zero number used to identify the affected system state.

  - *version*

    - Number describing the variant of the system state change that

      is supported by the given livepatch.

The state can be manipulated using two functions:

  - *klp_get_state(patch, id)*

    - Get struct klp_state associated with the given livepatch

      and state id.

  - *klp_get_prev_state(id)*

    - Get struct klp_state associated with the given feature id and

      already installed livepatches.

2. Livepatch compatibility

==========================

The system state version is used to prevent loading incompatible livepatches.

The check is done when the livepatch is enabled. The rules are:

  - Any completely new system state modification is allowed.

  - System state modifications with the same or higher version are allowed

    for already modified system states.

  - Cumulative livepatches must handle all system state modifications from

    already installed livepatches.

  - Non-cumulative livepatches are allowed to touch already modified

    system states.

3. Supported scenarios

======================

Livepatches have their life-cycle and the same is true for the system

state changes. Every compatible livepatch has to support the following

scenarios:

  - Modify the system state when the livepatch gets enabled and the state

    has not been already modified by a livepatches that are being

    replaced.

  - Take over or update the system state modification when is has already

    been done by a livepatch that is being replaced.

  - Restore the original state when the livepatch is disabled.

  - Restore the previous state when the transition is reverted.

    It might be the original system state or the state modification

    done by livepatches that were being replaced.

  - Remove any already made changes when error occurs and the livepatch

    cannot get enabled.

4. Expected usage

=================

System states are usually modified by livepatch callbacks. The expected

role of each callback is as follows:

*pre_patch()*

  - Allocate *state->data* when necessary. The allocation might fail

    and *pre_patch()* is the only callback that could stop loading

    of the livepatch. The allocation is not needed when the data

    are already provided by previously installed livepatches.

  - Do any other preparatory action that is needed by

    the new code even before the transition gets finished.

    For example, initialize *state->data*.

    The system state itself is typically modified in *post_patch()*

    when the entire system is able to handle it.

  - Clean up its own mess in case of error. It might be done by a custom

    code or by calling *post_unpatch()* explicitly.

*post_patch()*

  - Copy *state->data* from the previous livepatch when they are

    compatible.

  - Do the actual system state modification. Eventually allow

    the new code to use it.

  - Make sure that *state->data* has all necessary information.

  - Free *state->data* from replaces livepatches when they are

    not longer needed.

*pre_unpatch()*

  - Prevent the code, added by the livepatch, relying on the system

    state change.

  - Revert the system state modification..

*post_unpatch()*

  - Distinguish transition reverse and livepatch disabling by

    checking *klp_get_prev_state()*.

  - In case of transition reverse, restore the previous system

    state. It might mean doing nothing.

  - Remove any not longer needed setting or data.

.. note::

   *pre_unpatch()* typically does symmetric operations to *post_patch()*.

   Except that it is called only when the livepatch is being disabled.

   Therefore it does not need to care about any previously installed

   livepatch.

   *post_unpatch()* typically does symmetric operations to *pre_patch()*.

   It might be called also during the transition reverse. Therefore it

   has to handle the state of the previously installed livepatches.

	bool patched;

};

/**

 * struct klp_state - state of the system modified by the livepatch

 * @id:		system state identifier (non-zero)

 * @version:	version of the change

 * @data:	custom data

 */

struct klp_state {

	unsigned long id;

	unsigned int version;

	void *data;

};

/**

 * struct klp_patch - patch structure for live patching

 * @mod:	reference to the live patch module

 * @objs:	object entries for kernel objects to be patched

 * @states:	system states that can get modified

 * @replace:	replace all actively used patches

 * @list:	list node for global list of actively used patches

 * @kobj:	kobject for sysfs resources

	/* external */

	struct module *mod;

	struct klp_object *objs;

	struct klp_state *states;

	bool replace;

	/* internal */

void klp_shadow_free(void *obj, unsigned long id, klp_shadow_dtor_t dtor);

void klp_shadow_free_all(unsigned long id, klp_shadow_dtor_t dtor);

struct klp_state *klp_get_state(struct klp_patch *patch, unsigned long id);

struct klp_state *klp_get_prev_state(unsigned long id);

#else /* !CONFIG_LIVEPATCH */

static inline int klp_module_coming(struct module *mod) { return 0; }

# SPDX-License-Identifier: GPL-2.0-only

obj-$(CONFIG_LIVEPATCH) += livepatch.o

livepatch-objs := core.o patch.o shadow.o transition.o

livepatch-objs := core.o patch.o shadow.o state.o transition.o

#include <asm/cacheflush.h>

#include "core.h"

#include "patch.h"

#include "state.h"

#include "transition.h"

/*

 * The operation must be completed by calling klp_free_patch_finish()

 * outside klp_mutex.

 */

void klp_free_patch_start(struct klp_patch *patch)

static void klp_free_patch_start(struct klp_patch *patch)

{

	if (!list_empty(&patch->list))

		list_del(&patch->list);

	klp_free_patch_finish(patch);

}

void klp_free_patch_async(struct klp_patch *patch)

{

	klp_free_patch_start(patch);

	schedule_work(&patch->free_work);

}

void klp_free_replaced_patches_async(struct klp_patch *new_patch)

{

	struct klp_patch *old_patch, *tmp_patch;

	klp_for_each_patch_safe(old_patch, tmp_patch) {

		if (old_patch == new_patch)

			return;

		klp_free_patch_async(old_patch);

	}

}

static int klp_init_func(struct klp_object *obj, struct klp_func *func)

{

	if (!func->old_name)

	mutex_lock(&klp_mutex);

	if (!klp_is_patch_compatible(patch)) {

		pr_err("Livepatch patch (%s) is not compatible with the already installed livepatches.\n",

			patch->mod->name);

		mutex_unlock(&klp_mutex);

		return -EINVAL;

	}

	ret = klp_init_patch_early(patch);

	if (ret) {

		mutex_unlock(&klp_mutex);

EXPORT_SYMBOL_GPL(klp_enable_patch);

/*

 * This function removes replaced patches.

 * This function unpatches objects from the replaced livepatches.

 *

 * We could be pretty aggressive here. It is called in the situation where

 * these structures are no longer accessible. All functions are redirected

 * by the klp_transition_patch. They use either a new code or they are in

 * the original code because of the special nop function patches.

 * these structures are no longer accessed from the ftrace handler.

 * All functions are redirected by the klp_transition_patch. They

 * use either a new code or they are in the original code because

 * of the special nop function patches.

 *

 * The only exception is when the transition was forced. In this case,

 * klp_ftrace_handler() might still see the replaced patch on the stack.

 * thanks to RCU. We only have to keep the patches on the system. Also

 * this is handled transparently by patch->module_put.

 */

void klp_discard_replaced_patches(struct klp_patch *new_patch)

void klp_unpatch_replaced_patches(struct klp_patch *new_patch)

{

	struct klp_patch *old_patch, *tmp_patch;

	struct klp_patch *old_patch;

	klp_for_each_patch_safe(old_patch, tmp_patch) {

	klp_for_each_patch(old_patch) {

		if (old_patch == new_patch)

			return;

		old_patch->enabled = false;

		klp_unpatch_objects(old_patch);

		klp_free_patch_start(old_patch);

		schedule_work(&old_patch->free_work);

	}

}