Home Home > GIT Browse
summaryrefslogtreecommitdiff
blob: 2c796919449ba6dc94833f97f812dfd97dcccb34 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
/*
 * shadow.c - Shadow Variables
 *
 * Copyright (C) 2014 Josh Poimboeuf <jpoimboe@redhat.com>
 * Copyright (C) 2014 Seth Jennings <sjenning@redhat.com>
 * Copyright (C) 2017 Joe Lawrence <joe.lawrence@redhat.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 */

/**
 * DOC: Shadow variable API concurrency notes:
 *
 * The shadow variable API provides a simple relationship between an
 * <obj, id> pair and a pointer value.  It is the responsibility of the
 * caller to provide any mutual exclusion required of the shadow data.
 *
 * Once a shadow variable is attached to its parent object via the
 * klp_shadow_*alloc() API calls, it is considered live: any subsequent
 * call to klp_shadow_get() may then return the shadow variable's data
 * pointer.  Callers of klp_shadow_*alloc() should prepare shadow data
 * accordingly.
 *
 * The klp_shadow_*alloc() API calls may allocate memory for new shadow
 * variable structures.  Their implementation does not call kmalloc
 * inside any spinlocks, but API callers should pass GFP flags according
 * to their specific needs.
 *
 * The kgr_shadow_hash is an RCU-enabled hashtable and is safe against
 * concurrent klp_shadow_free() and klp_shadow_get() operations.
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/hashtable.h>
#include <linux/slab.h>
#include <linux/stringify.h>
#include <linux/module.h>
#include <linux/kallsyms.h>
#include "shadow.h"


#define __concat_1(a, b) a ## b
#define __concat(a, b) __concat_1(a, b)

#define KGR_SHADOW_HASH_BITS 12
#define KGR_SHADOW_HASH_SIZE (1 << KGR_SHADOW_HASH_BITS)

/*
 * The following __concat() game is a safety measure: if anybody ever
 * happens to modify KGR_SHADOW_BITS, then this will ensure that we're
 * using a new symbol and will thus be operating on a different instance.
 */
#define kgr_shadow_hash __concat(kgr_shadow_hash, KGR_SHADOW_HASH_BITS)
#define kgr_shadow_lock __concat(kgr_shadow_lock, KGR_SHADOW_HASH_BITS)

static struct hlist_head (*kgr_shadow_hash)[KGR_SHADOW_HASH_SIZE];

/*
 * kgr_shadow_lock provides exclusive access to the kgr_shadow_hash and
 * the shadow variables it references.
 */
static spinlock_t *kgr_shadow_lock;


/**
 * struct klp_shadow - shadow variable structure
 * @node:	kgr_shadow_hash hash table node
 * @rcu_head:	RCU is used to safely free this structure
 * @obj:	pointer to parent object
 * @id:		data identifier
 * @data:	data area
 */
struct klp_shadow {
	struct hlist_node node;
	struct rcu_head rcu_head;
	void *obj;
	unsigned long id;
	char data[];
};

/**
 * klp_shadow_match() - verify a shadow variable matches given <obj, id>
 * @shadow:	shadow variable to match
 * @obj:	pointer to parent object
 * @id:		data identifier
 *
 * Return: true if the shadow variable matches.
 */
static inline bool klp_shadow_match(struct klp_shadow *shadow, void *obj,
				unsigned long id)
{
	return shadow->obj == obj && shadow->id == id;
}

/**
 * klp_shadow_get() - retrieve a shadow variable data pointer
 * @obj:	pointer to parent object
 * @id:		data identifier
 *
 * Return: the shadow variable data element, NULL on failure.
 */
void *klp_shadow_get(void *obj, unsigned long id)
{
	struct klp_shadow *shadow;

	rcu_read_lock();

	hash_for_each_possible_rcu((*kgr_shadow_hash), shadow, node,
				   (unsigned long)obj) {

		if (klp_shadow_match(shadow, obj, id)) {
			rcu_read_unlock();
			return shadow->data;
		}
	}

	rcu_read_unlock();

	return NULL;
}

static void *__klp_shadow_get_or_alloc(void *obj, unsigned long id, void *data,
		       size_t size, gfp_t gfp_flags, bool warn_on_exist)
{
	struct klp_shadow *new_shadow;
	void *shadow_data;
	unsigned long flags;

	/* Check if the shadow variable already exists */
	shadow_data = klp_shadow_get(obj, id);
	if (shadow_data)
		goto exists;

	/* Allocate a new shadow variable for use inside the lock below */
	new_shadow = kzalloc(size + sizeof(*new_shadow), gfp_flags);
	if (!new_shadow)
		return NULL;

	new_shadow->obj = obj;
	new_shadow->id = id;

	/* Initialize the shadow variable if data provided */
	if (data)
		memcpy(new_shadow->data, data, size);

	/* Look for <obj, id> again under the lock */
	spin_lock_irqsave(kgr_shadow_lock, flags);
	shadow_data = klp_shadow_get(obj, id);
	if (unlikely(shadow_data)) {
		/*
		 * Shadow variable was found, throw away speculative
		 * allocation.
		 */
		spin_unlock_irqrestore(kgr_shadow_lock, flags);
		kfree(new_shadow);
		goto exists;
	}

	/* No <obj, id> found, so attach the newly allocated one */
	hash_add_rcu((*kgr_shadow_hash), &new_shadow->node,
		     (unsigned long)new_shadow->obj);
	spin_unlock_irqrestore(kgr_shadow_lock, flags);

	return new_shadow->data;

exists:
	if (warn_on_exist) {
		WARN(1, "Duplicate shadow variable <%p, %lx>\n", obj, id);
		return NULL;
	}

	return shadow_data;
}

/**
 * klp_shadow_alloc() - allocate and add a new shadow variable
 * @obj:	pointer to parent object
 * @id:		data identifier
 * @data:	pointer to data to attach to parent
 * @size:	size of attached data
 * @gfp_flags:	GFP mask for allocation
 *
 * Allocates @size bytes for new shadow variable data using @gfp_flags
 * and copies @size bytes from @data into the new shadow variable's own
 * data space.  If @data is NULL, @size bytes are still allocated, but
 * no copy is performed.  The new shadow variable is then added to the
 * global hashtable.
 *
 * If an existing <obj, id> shadow variable can be found, this routine
 * will issue a WARN, exit early and return NULL.
 *
 * Return: the shadow variable data element, NULL on duplicate or
 * failure.
 */
void *klp_shadow_alloc(void *obj, unsigned long id, void *data,
		       size_t size, gfp_t gfp_flags)
{
	return __klp_shadow_get_or_alloc(obj, id, data, size, gfp_flags, true);
}

/**
 * klp_shadow_get_or_alloc() - get existing or allocate a new shadow variable
 * @obj:	pointer to parent object
 * @id:		data identifier
 * @data:	pointer to data to attach to parent
 * @size:	size of attached data
 * @gfp_flags:	GFP mask for allocation
 *
 * Returns a pointer to existing shadow data if an <obj, id> shadow
 * variable is already present.  Otherwise, it creates a new shadow
 * variable like klp_shadow_alloc().
 *
 * This function guarantees that only one shadow variable exists with
 * the given @id for the given @obj.  It also guarantees that the shadow
 * variable will be initialized by the given @data only when it did not
 * exist before.
 *
 * Return: the shadow variable data element, NULL on failure.
 */
void *klp_shadow_get_or_alloc(void *obj, unsigned long id, void *data,
			       size_t size, gfp_t gfp_flags)
{
	return __klp_shadow_get_or_alloc(obj, id, data, size, gfp_flags, false);
}

/**
 * klp_shadow_free() - detach and free a <obj, id> shadow variable
 * @obj:	pointer to parent object
 * @id:		data identifier
 *
 * This function releases the memory for this <obj, id> shadow variable
 * instance, callers should stop referencing it accordingly.
 */
void klp_shadow_free(void *obj, unsigned long id)
{
	struct klp_shadow *shadow;
	unsigned long flags;

	spin_lock_irqsave(kgr_shadow_lock, flags);

	/* Delete <obj, id> from hash */
	hash_for_each_possible((*kgr_shadow_hash), shadow, node,
			       (unsigned long)obj) {

		if (klp_shadow_match(shadow, obj, id)) {
			hash_del_rcu(&shadow->node);
			kfree_rcu(shadow, rcu_head);
			break;
		}
	}

	spin_unlock_irqrestore(kgr_shadow_lock, flags);
}

/**
 * klp_shadow_free_all() - detach and free all <*, id> shadow variables
 * @id:		data identifier
 *
 * This function releases the memory for all <*, id> shadow variable
 * instances, callers should stop referencing them accordingly.
 */
void klp_shadow_free_all(unsigned long id)
{
	struct klp_shadow *shadow;
	unsigned long flags;
	int i;

	spin_lock_irqsave(kgr_shadow_lock, flags);

	/* Delete all <*, id> from hash */
	hash_for_each((*kgr_shadow_hash), i, shadow, node) {
		if (klp_shadow_match(shadow, shadow->obj, id)) {
			hash_del_rcu(&shadow->node);
			kfree_rcu(shadow, rcu_head);
		}
	}

	spin_unlock_irqrestore(kgr_shadow_lock, flags);
}

static int __kgr_find_other_module_shadow(void *data, const char *name,
					  struct module *mod,
					  unsigned long addr)
{
	spinlock_t **lock_addr;
	struct hlist_head (**hash_addr)[KGR_SHADOW_HASH_SIZE];
	char symname[MODULE_NAME_LEN + 1 +
		     sizeof(__stringify(kgr_shadow_hash))];

	if (!mod || mod == THIS_MODULE)
		return 0;

	if (strcmp(__stringify(kgr_shadow_lock), name))
		return 0;

	lock_addr = (spinlock_t **)addr;
	if (!*lock_addr)
		return 0;

	snprintf(symname, sizeof(symname), "%s:" __stringify(kgr_shadow_hash),
		 mod->name);
	hash_addr = (struct hlist_head (**)[KGR_SHADOW_HASH_SIZE])
		      kallsyms_lookup_name(symname);
	if (!hash_addr || !*hash_addr) {
		WARN(1, "Module %s has a %s but no %s\n", mod->name,
			__stringify(kgr_shadow_lock),
			__stringify(kgr_shadow_hash));
		return 0;
	}

	kgr_shadow_lock = *lock_addr;
	kgr_shadow_hash = *hash_addr;

	return 1;
}

int kgr_shadow_init(void)
{
	int ret = 0;

	if (kgr_shadow_lock)
		return 0;

	mutex_lock(&module_mutex);
	if (kallsyms_on_each_symbol(__kgr_find_other_module_shadow, NULL))
		goto out;

	kgr_shadow_hash = kmalloc(sizeof(*kgr_shadow_hash), GFP_KERNEL);
	if (!kgr_shadow_hash) {
		pr_err("kgraft-patch: failed to allocate shadow management data\n");
		ret = -ENOMEM;
		goto out;
	}

	kgr_shadow_lock = kmalloc(sizeof(*kgr_shadow_lock), GFP_KERNEL);
	if (!kgr_shadow_lock) {
		pr_err("kgraft-patch: failed to allocate shadow management data\n");
		kfree(kgr_shadow_hash);
		kgr_shadow_hash = NULL;
		ret = -ENOMEM;
		goto out;
	}

	hash_init(*kgr_shadow_hash);
	spin_lock_init(kgr_shadow_lock);

out:
	mutex_unlock(&module_mutex);
	return ret;
}

void kgr_shadow_cleanup(void)
{
	struct hlist_head (*shadow_hash)[KGR_SHADOW_HASH_SIZE];
	spinlock_t *shadow_lock;
	int found_other = 0;
	struct klp_shadow *shadow;
	struct hlist_node *tmp;
	int i;

	if (!kgr_shadow_lock)
		return;

	shadow_hash = kgr_shadow_hash;
	shadow_lock = kgr_shadow_lock;
	mutex_lock(&module_mutex);
	found_other = kallsyms_on_each_symbol(__kgr_find_other_module_shadow,
					      NULL);

	/*
	 * Clear out our references to the data structures with
	 * module_mutex being held such that other modules won't
	 * consider us being an active user anymore.
	 */
	kgr_shadow_hash = NULL;
	kgr_shadow_lock = NULL;
	mutex_unlock(&module_mutex);

	if (found_other)
		return;

	hash_for_each_safe((*shadow_hash), i, tmp, shadow, node) {
		hash_del(&shadow->node);
		kfree(shadow);
	}
	kfree(shadow_hash);
	kfree(shadow_lock);
}