livepatch: introduce shadow variable API (439e7271) · Commits · 戴 / test

Documentation/livepatch/shadow-vars.txt

0 → 100644

+192 −0

Original line number	Original line	Diff line number	Diff line
			================
			Shadow Variables
			================

			Shadow variables are a simple way for livepatch modules to associate
			additional "shadow" data with existing data structures. Shadow data is
			allocated separately from parent data structures, which are left
			unmodified. The shadow variable API described in this document is used
			to allocate/attach and detach/release shadow variables to their parents.

			The implementation introduces a global, in-kernel hashtable that
			associates pointers to parent objects and a numeric identifier of the
			shadow data. The numeric identifier is a simple enumeration that may be
			used to describe shadow variable version, class or type, etc. More
			specifically, the parent pointer serves as the hashtable key while the
			numeric id subsequently filters hashtable queries. Multiple shadow
			variables may attach to the same parent object, but their numeric
			identifier distinguishes between them.


			1. Brief API summary
			====================

			(See the full API usage docbook notes in livepatch/shadow.c.)

			A hashtable references all shadow variables. These references are
			stored and retrieved through a <obj, id> pair.

			* The klp_shadow variable data structure encapsulates both tracking
			meta-data and shadow-data:
			- meta-data
			- obj - pointer to parent object
			- id - data identifier
			- data[] - storage for shadow data

			It is important to note that the klp_shadow_alloc() and
			klp_shadow_get_or_alloc() calls, described below, store a copy of the
			data that the functions are provided. Callers should provide whatever
			mutual exclusion is required of the shadow data.

			* klp_shadow_get() - retrieve a shadow variable data pointer
			- search hashtable for <obj, id> pair

			* klp_shadow_alloc() - allocate and add a new shadow variable
			- search hashtable for <obj, id> pair
			- if exists
			- WARN and return NULL
			- if <obj, id> doesn't already exist
			- allocate a new shadow variable
			- copy data into the new shadow variable
			- add <obj, id> to the global hashtable

			* klp_shadow_get_or_alloc() - get existing or alloc a new shadow variable
			- search hashtable for <obj, id> pair
			- if exists
			- return existing shadow variable
			- if <obj, id> doesn't already exist
			- allocate a new shadow variable
			- copy data into the new shadow variable
			- add <obj, id> pair to the global hashtable

			* klp_shadow_free() - detach and free a <obj, id> shadow variable
			- find and remove a <obj, id> reference from global hashtable
			- if found, free shadow variable

			* klp_shadow_free_all() - detach and free all <*, id> shadow variables
			- find and remove any <*, id> references from global hashtable
			- if found, free shadow variable


			2. Use cases
			============

			(See the example shadow variable livepatch modules in samples/livepatch/
			for full working demonstrations.)

			For the following use-case examples, consider commit 1d147bfa6429
			("mac80211: fix AP powersave TX vs. wakeup race"), which added a
			spinlock to net/mac80211/sta_info.h :: struct sta_info. Each use-case
			example can be considered a stand-alone livepatch implementation of this
			fix.


			Matching parent's lifecycle
			---------------------------

			If parent data structures are frequently created and destroyed, it may
			be easiest to align their shadow variables lifetimes to the same
			allocation and release functions. In this case, the parent data
			structure is typically allocated, initialized, then registered in some
			manner. Shadow variable allocation and setup can then be considered
			part of the parent's initialization and should be completed before the
			parent "goes live" (ie, any shadow variable get-API requests are made
			for this <obj, id> pair.)

			For commit 1d147bfa6429, when a parent sta_info structure is allocated,
			allocate a shadow copy of the ps_lock pointer, then initialize it:

			#define PS_LOCK 1
			struct sta_info sta_info_alloc(struct ieee80211_sub_if_data sdata,
			const u8 *addr, gfp_t gfp)
			{
			struct sta_info *sta;
			spinlock_t *ps_lock;

			/* Parent structure is created */
			sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp);

			/* Attach a corresponding shadow variable, then initialize it */
			ps_lock = klp_shadow_alloc(sta, PS_LOCK, NULL, sizeof(ps_lock), gfp);
			if (!ps_lock)
			goto shadow_fail;
			spin_lock_init(ps_lock);
			...

			When requiring a ps_lock, query the shadow variable API to retrieve one
			for a specific struct sta_info:

			void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
			{
			spinlock_t *ps_lock;

			/* sync with ieee80211_tx_h_unicast_ps_buf */
			ps_lock = klp_shadow_get(sta, PS_LOCK);
			if (ps_lock)
			spin_lock(ps_lock);
			...

			When the parent sta_info structure is freed, first free the shadow
			variable:

			void sta_info_free(struct ieee80211_local local, struct sta_info sta)
			{
			klp_shadow_free(sta, PS_LOCK);
			kfree(sta);
			...


			In-flight parent objects
			------------------------

			Sometimes it may not be convenient or possible to allocate shadow
			variables alongside their parent objects. Or a livepatch fix may
			require shadow varibles to only a subset of parent object instances. In
			these cases, the klp_shadow_get_or_alloc() call can be used to attach
			shadow variables to parents already in-flight.

			For commit 1d147bfa6429, a good spot to allocate a shadow spinlock is
			inside ieee80211_sta_ps_deliver_wakeup():

			#define PS_LOCK 1
			void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
			{
			DEFINE_SPINLOCK(ps_lock_fallback);
			spinlock_t *ps_lock;

			/* sync with ieee80211_tx_h_unicast_ps_buf */
			ps_lock = klp_shadow_get_or_alloc(sta, PS_LOCK,
			&ps_lock_fallback, sizeof(ps_lock_fallback),
			GFP_ATOMIC);
			if (ps_lock)
			spin_lock(ps_lock);
			...

			This usage will create a shadow variable, only if needed, otherwise it
			will use one that was already created for this <obj, id> pair.

			Like the previous use-case, the shadow spinlock needs to be cleaned up.
			A shadow variable can be freed just before its parent object is freed,
			or even when the shadow variable itself is no longer required.


			Other use-cases
			---------------

			Shadow variables can also be used as a flag indicating that a data
			structure was allocated by new, livepatched code. In this case, it
			doesn't matter what data value the shadow variable holds, its existence
			suggests how to handle the parent object.


			3. References
			=============

			* https://github.com/dynup/kpatch
			The livepatch implementation is based on the kpatch version of shadow
			variables.

			* http://files.mkgnu.net/files/dynamos/doc/papers/dynamos_eurosys_07.pdf
			Dynamic and Adaptive Updates of Non-Quiescent Subsystems in Commodity
			Operating System Kernels (Kritis Makris, Kyung Dong Ryu 2007) presented
			a datatype update technique called "shadow data structures".

include/linux/livepatch.h

+8 −0

Original line number	Original line	Diff line number	Diff line
	@@ -164,6 +164,14 @@ static inline bool klp_have_reliable_stack(void)
	IS_ENABLED(CONFIG_HAVE_RELIABLE_STACKTRACE);		IS_ENABLED(CONFIG_HAVE_RELIABLE_STACKTRACE);
	}		}

			void klp_shadow_get(void obj, unsigned long id);
			void klp_shadow_alloc(void obj, unsigned long id, void *data,
			size_t size, gfp_t gfp_flags);
			void klp_shadow_get_or_alloc(void obj, unsigned long id, void *data,
			size_t size, gfp_t gfp_flags);
			void klp_shadow_free(void *obj, unsigned long id);
			void klp_shadow_free_all(unsigned long id);

	#else /* !CONFIG_LIVEPATCH */		#else /* !CONFIG_LIVEPATCH */

	static inline int klp_module_coming(struct module *mod) { return 0; }		static inline int klp_module_coming(struct module *mod) { return 0; }

kernel/livepatch/Makefile

+1 −1

Original line number	Original line	Diff line number	Diff line
	obj-$(CONFIG_LIVEPATCH) += livepatch.o		obj-$(CONFIG_LIVEPATCH) += livepatch.o

	livepatch-objs := core.o patch.o transition.o		livepatch-objs := core.o patch.o shadow.o transition.o

kernel/livepatch/shadow.c

0 → 100644

+277 −0

Original line number	Original line	Diff line number	Diff line
			/*
			* shadow.c - Shadow Variables
			*
			* Copyright (C) 2014 Josh Poimboeuf <jpoimboe@redhat.com>
			* Copyright (C) 2014 Seth Jennings <sjenning@redhat.com>
			* Copyright (C) 2017 Joe Lawrence <joe.lawrence@redhat.com>
			*
			* This program is free software; you can redistribute it and/or
			* modify it under the terms of the GNU General Public License
			* as published by the Free Software Foundation; either version 2
			* of the License, or (at your option) any later version.
			*
			* This program is distributed in the hope that it will be useful,
			* but WITHOUT ANY WARRANTY; without even the implied warranty of
			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
			* GNU General Public License for more details.
			*
			* You should have received a copy of the GNU General Public License
			* along with this program; if not, see <http://www.gnu.org/licenses/>.
			*/

			/**
			* DOC: Shadow variable API concurrency notes:
			*
			* The shadow variable API provides a simple relationship between an
			* <obj, id> pair and a pointer value. It is the responsibility of the
			* caller to provide any mutual exclusion required of the shadow data.
			*
			* Once a shadow variable is attached to its parent object via the
			* klp_shadow_*alloc() API calls, it is considered live: any subsequent
			* call to klp_shadow_get() may then return the shadow variable's data
			* pointer. Callers of klp_shadow_*alloc() should prepare shadow data
			* accordingly.
			*
			* The klp_shadow_*alloc() API calls may allocate memory for new shadow
			* variable structures. Their implementation does not call kmalloc
			* inside any spinlocks, but API callers should pass GFP flags according
			* to their specific needs.
			*
			* The klp_shadow_hash is an RCU-enabled hashtable and is safe against
			* concurrent klp_shadow_free() and klp_shadow_get() operations.
			*/

			#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

			#include <linux/hashtable.h>
			#include <linux/slab.h>
			#include <linux/livepatch.h>

			static DEFINE_HASHTABLE(klp_shadow_hash, 12);

			/*
			* klp_shadow_lock provides exclusive access to the klp_shadow_hash and
			* the shadow variables it references.
			*/
			static DEFINE_SPINLOCK(klp_shadow_lock);

			/**
			* struct klp_shadow - shadow variable structure
			* @node: klp_shadow_hash hash table node
			* @rcu_head: RCU is used to safely free this structure
			* @obj: pointer to parent object
			* @id: data identifier
			* @data: data area
			*/
			struct klp_shadow {
			struct hlist_node node;
			struct rcu_head rcu_head;
			void *obj;
			unsigned long id;
			char data[];
			};

			/**
			* klp_shadow_match() - verify a shadow variable matches given <obj, id>
			* @shadow: shadow variable to match
			* @obj: pointer to parent object
			* @id: data identifier
			*
			* Return: true if the shadow variable matches.
			*/
			static inline bool klp_shadow_match(struct klp_shadow shadow, void obj,
			unsigned long id)
			{
			return shadow->obj == obj && shadow->id == id;
			}

			/**
			* klp_shadow_get() - retrieve a shadow variable data pointer
			* @obj: pointer to parent object
			* @id: data identifier
			*
			* Return: the shadow variable data element, NULL on failure.
			*/
			void klp_shadow_get(void obj, unsigned long id)
			{
			struct klp_shadow *shadow;

			rcu_read_lock();

			hash_for_each_possible_rcu(klp_shadow_hash, shadow, node,
			(unsigned long)obj) {

			if (klp_shadow_match(shadow, obj, id)) {
			rcu_read_unlock();
			return shadow->data;
			}
			}

			rcu_read_unlock();

			return NULL;
			}
			EXPORT_SYMBOL_GPL(klp_shadow_get);

			void __klp_shadow_get_or_alloc(void obj, unsigned long id, void *data,
			size_t size, gfp_t gfp_flags, bool warn_on_exist)
			{
			struct klp_shadow *new_shadow;
			void *shadow_data;
			unsigned long flags;

			/* Check if the shadow variable already exists */
			shadow_data = klp_shadow_get(obj, id);
			if (shadow_data)
			goto exists;

			/* Allocate a new shadow variable for use inside the lock below */
			new_shadow = kzalloc(size + sizeof(*new_shadow), gfp_flags);
			if (!new_shadow)
			return NULL;

			new_shadow->obj = obj;
			new_shadow->id = id;

			/* Initialize the shadow variable if data provided */
			if (data)
			memcpy(new_shadow->data, data, size);

			/* Look for <obj, id> again under the lock */
			spin_lock_irqsave(&klp_shadow_lock, flags);
			shadow_data = klp_shadow_get(obj, id);
			if (unlikely(shadow_data)) {
			/*
			* Shadow variable was found, throw away speculative
			* allocation.
			*/
			spin_unlock_irqrestore(&klp_shadow_lock, flags);
			kfree(new_shadow);
			goto exists;
			}

			/* No <obj, id> found, so attach the newly allocated one */
			hash_add_rcu(klp_shadow_hash, &new_shadow->node,
			(unsigned long)new_shadow->obj);
			spin_unlock_irqrestore(&klp_shadow_lock, flags);

			return new_shadow->data;

			exists:
			if (warn_on_exist) {
			WARN(1, "Duplicate shadow variable <%p, %lx>\n", obj, id);
			return NULL;
			}

			return shadow_data;
			}

			/**
			* klp_shadow_alloc() - allocate and add a new shadow variable
			* @obj: pointer to parent object
			* @id: data identifier
			* @data: pointer to data to attach to parent
			* @size: size of attached data
			* @gfp_flags: GFP mask for allocation
			*
			* Allocates @size bytes for new shadow variable data using @gfp_flags
			* and copies @size bytes from @data into the new shadow variable's own
			* data space. If @data is NULL, @size bytes are still allocated, but
			* no copy is performed. The new shadow variable is then added to the
			* global hashtable.
			*
			* If an existing <obj, id> shadow variable can be found, this routine
			* will issue a WARN, exit early and return NULL.
			*
			* Return: the shadow variable data element, NULL on duplicate or
			* failure.
			*/
			void klp_shadow_alloc(void obj, unsigned long id, void *data,
			size_t size, gfp_t gfp_flags)
			{
			return __klp_shadow_get_or_alloc(obj, id, data, size, gfp_flags, true);
			}
			EXPORT_SYMBOL_GPL(klp_shadow_alloc);

			/**
			* klp_shadow_get_or_alloc() - get existing or allocate a new shadow variable
			* @obj: pointer to parent object
			* @id: data identifier
			* @data: pointer to data to attach to parent
			* @size: size of attached data
			* @gfp_flags: GFP mask for allocation
			*
			* Returns a pointer to existing shadow data if an <obj, id> shadow
			* variable is already present. Otherwise, it creates a new shadow
			* variable like klp_shadow_alloc().
			*
			* This function guarantees that only one shadow variable exists with
			* the given @id for the given @obj. It also guarantees that the shadow
			* variable will be initialized by the given @data only when it did not
			* exist before.
			*
			* Return: the shadow variable data element, NULL on failure.
			*/
			void klp_shadow_get_or_alloc(void obj, unsigned long id, void *data,
			size_t size, gfp_t gfp_flags)
			{
			return __klp_shadow_get_or_alloc(obj, id, data, size, gfp_flags, false);
			}
			EXPORT_SYMBOL_GPL(klp_shadow_get_or_alloc);

			/**
			* klp_shadow_free() - detach and free a <obj, id> shadow variable
			* @obj: pointer to parent object
			* @id: data identifier
			*
			* This function releases the memory for this <obj, id> shadow variable
			* instance, callers should stop referencing it accordingly.
			*/
			void klp_shadow_free(void *obj, unsigned long id)
			{
			struct klp_shadow *shadow;
			unsigned long flags;

			spin_lock_irqsave(&klp_shadow_lock, flags);

			/* Delete <obj, id> from hash */
			hash_for_each_possible(klp_shadow_hash, shadow, node,
			(unsigned long)obj) {

			if (klp_shadow_match(shadow, obj, id)) {
			hash_del_rcu(&shadow->node);
			kfree_rcu(shadow, rcu_head);
			break;
			}
			}

			spin_unlock_irqrestore(&klp_shadow_lock, flags);
			}
			EXPORT_SYMBOL_GPL(klp_shadow_free);

			/**
			* klp_shadow_free_all() - detach and free all <*, id> shadow variables
			* @id: data identifier
			*
			* This function releases the memory for all <*, id> shadow variable
			* instances, callers should stop referencing them accordingly.
			*/
			void klp_shadow_free_all(unsigned long id)
			{
			struct klp_shadow *shadow;
			unsigned long flags;
			int i;

			spin_lock_irqsave(&klp_shadow_lock, flags);

			/* Delete all <, id> from hash /
			hash_for_each(klp_shadow_hash, i, shadow, node) {
			if (klp_shadow_match(shadow, shadow->obj, id)) {
			hash_del_rcu(&shadow->node);
			kfree_rcu(shadow, rcu_head);
			}
			}

			spin_unlock_irqrestore(&klp_shadow_lock, flags);
			}
			EXPORT_SYMBOL_GPL(klp_shadow_free_all);

samples/Kconfig

+2 −3

Original line number	Original line	Diff line number	Diff line
	@@ -71,11 +71,10 @@ config SAMPLE_RPMSG_CLIENT
	the rpmsg bus.		the rpmsg bus.

	config SAMPLE_LIVEPATCH		config SAMPLE_LIVEPATCH
	tristate "Build live patching sample -- loadable modules only"		tristate "Build live patching samples -- loadable modules only"
	depends on LIVEPATCH && m		depends on LIVEPATCH && m
	help		help
	Builds a sample live patch that replaces the procfs handler		Build sample live patch demonstrations.
	for /proc/cmdline to print "this has been live patched".

	config SAMPLE_CONFIGFS		config SAMPLE_CONFIGFS
	tristate "Build configfs patching sample -- loadable modules only"		tristate "Build configfs patching sample -- loadable modules only"

Admin message