Loading...
1// SPDX-License-Identifier: GPL-2.0
2// Copyright (C) 2018 Joe Lawrence <joe.lawrence@redhat.com>
3
4#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
5
6#include <linux/module.h>
7#include <linux/kernel.h>
8#include <linux/list.h>
9#include <linux/livepatch.h>
10#include <linux/slab.h>
11
12/*
13 * Keep a small list of pointers so that we can print address-agnostic
14 * pointer values. Use a rolling integer count to differentiate the values.
15 * Ironically we could have used the shadow variable API to do this, but
16 * let's not lean too heavily on the very code we're testing.
17 */
18static LIST_HEAD(ptr_list);
19struct shadow_ptr {
20 void *ptr;
21 int id;
22 struct list_head list;
23};
24
25static void free_ptr_list(void)
26{
27 struct shadow_ptr *sp, *tmp_sp;
28
29 list_for_each_entry_safe(sp, tmp_sp, &ptr_list, list) {
30 list_del(&sp->list);
31 kfree(sp);
32 }
33}
34
35static int ptr_id(void *ptr)
36{
37 struct shadow_ptr *sp;
38 static int count;
39
40 list_for_each_entry(sp, &ptr_list, list) {
41 if (sp->ptr == ptr)
42 return sp->id;
43 }
44
45 sp = kmalloc(sizeof(*sp), GFP_ATOMIC);
46 if (!sp)
47 return -ENOMEM;
48 sp->ptr = ptr;
49 sp->id = count++;
50
51 list_add(&sp->list, &ptr_list);
52
53 return sp->id;
54}
55
56/*
57 * Shadow variable wrapper functions that echo the function and arguments
58 * to the kernel log for testing verification. Don't display raw pointers,
59 * but use the ptr_id() value instead.
60 */
61static void *shadow_get(void *obj, unsigned long id)
62{
63 int **sv;
64
65 sv = klp_shadow_get(obj, id);
66 pr_info("klp_%s(obj=PTR%d, id=0x%lx) = PTR%d\n",
67 __func__, ptr_id(obj), id, ptr_id(sv));
68
69 return sv;
70}
71
72static void *shadow_alloc(void *obj, unsigned long id, size_t size,
73 gfp_t gfp_flags, klp_shadow_ctor_t ctor,
74 void *ctor_data)
75{
76 int **var = ctor_data;
77 int **sv;
78
79 sv = klp_shadow_alloc(obj, id, size, gfp_flags, ctor, var);
80 pr_info("klp_%s(obj=PTR%d, id=0x%lx, size=%zx, gfp_flags=%pGg), ctor=PTR%d, ctor_data=PTR%d = PTR%d\n",
81 __func__, ptr_id(obj), id, size, &gfp_flags, ptr_id(ctor),
82 ptr_id(*var), ptr_id(sv));
83
84 return sv;
85}
86
87static void *shadow_get_or_alloc(void *obj, unsigned long id, size_t size,
88 gfp_t gfp_flags, klp_shadow_ctor_t ctor,
89 void *ctor_data)
90{
91 int **var = ctor_data;
92 int **sv;
93
94 sv = klp_shadow_get_or_alloc(obj, id, size, gfp_flags, ctor, var);
95 pr_info("klp_%s(obj=PTR%d, id=0x%lx, size=%zx, gfp_flags=%pGg), ctor=PTR%d, ctor_data=PTR%d = PTR%d\n",
96 __func__, ptr_id(obj), id, size, &gfp_flags, ptr_id(ctor),
97 ptr_id(*var), ptr_id(sv));
98
99 return sv;
100}
101
102static void shadow_free(void *obj, unsigned long id, klp_shadow_dtor_t dtor)
103{
104 klp_shadow_free(obj, id, dtor);
105 pr_info("klp_%s(obj=PTR%d, id=0x%lx, dtor=PTR%d)\n",
106 __func__, ptr_id(obj), id, ptr_id(dtor));
107}
108
109static void shadow_free_all(unsigned long id, klp_shadow_dtor_t dtor)
110{
111 klp_shadow_free_all(id, dtor);
112 pr_info("klp_%s(id=0x%lx, dtor=PTR%d)\n", __func__, id, ptr_id(dtor));
113}
114
115
116/* Shadow variable constructor - remember simple pointer data */
117static int shadow_ctor(void *obj, void *shadow_data, void *ctor_data)
118{
119 int **sv = shadow_data;
120 int **var = ctor_data;
121
122 if (!var)
123 return -EINVAL;
124
125 *sv = *var;
126 pr_info("%s: PTR%d -> PTR%d\n", __func__, ptr_id(sv), ptr_id(*var));
127
128 return 0;
129}
130
131/*
132 * With more than one item to free in the list, order is not determined and
133 * shadow_dtor will not be passed to shadow_free_all() which would make the
134 * test fail. (see pass 6)
135 */
136static void shadow_dtor(void *obj, void *shadow_data)
137{
138 int **sv = shadow_data;
139
140 pr_info("%s(obj=PTR%d, shadow_data=PTR%d)\n",
141 __func__, ptr_id(obj), ptr_id(sv));
142}
143
144/* number of objects we simulate that need shadow vars */
145#define NUM_OBJS 3
146
147/* dynamically created obj fields have the following shadow var id values */
148#define SV_ID1 0x1234
149#define SV_ID2 0x1235
150
151/*
152 * The main test case adds/removes new fields (shadow var) to each of these
153 * test structure instances. The last group of fields in the struct represent
154 * the idea that shadow variables may be added and removed to and from the
155 * struct during execution.
156 */
157struct test_object {
158 /* add anything here below and avoid to define an empty struct */
159 struct shadow_ptr sp;
160
161 /* these represent shadow vars added and removed with SV_ID{1,2} */
162 /* char nfield1; */
163 /* int nfield2; */
164};
165
166static int test_klp_shadow_vars_init(void)
167{
168 struct test_object objs[NUM_OBJS];
169 char nfields1[NUM_OBJS], *pnfields1[NUM_OBJS], **sv1[NUM_OBJS];
170 char *pndup[NUM_OBJS];
171 int nfields2[NUM_OBJS], *pnfields2[NUM_OBJS], **sv2[NUM_OBJS];
172 void **sv;
173 int ret;
174 int i;
175
176 ptr_id(NULL);
177
178 /*
179 * With an empty shadow variable hash table, expect not to find
180 * any matches.
181 */
182 sv = shadow_get(&objs[0], SV_ID1);
183 if (!sv)
184 pr_info(" got expected NULL result\n");
185
186 /* pass 1: init & alloc a char+int pair of svars for each objs */
187 for (i = 0; i < NUM_OBJS; i++) {
188 pnfields1[i] = &nfields1[i];
189 ptr_id(pnfields1[i]);
190
191 if (i % 2) {
192 sv1[i] = shadow_alloc(&objs[i], SV_ID1,
193 sizeof(pnfields1[i]), GFP_KERNEL,
194 shadow_ctor, &pnfields1[i]);
195 } else {
196 sv1[i] = shadow_get_or_alloc(&objs[i], SV_ID1,
197 sizeof(pnfields1[i]), GFP_KERNEL,
198 shadow_ctor, &pnfields1[i]);
199 }
200 if (!sv1[i]) {
201 ret = -ENOMEM;
202 goto out;
203 }
204
205 pnfields2[i] = &nfields2[i];
206 ptr_id(pnfields2[i]);
207 sv2[i] = shadow_alloc(&objs[i], SV_ID2, sizeof(pnfields2[i]),
208 GFP_KERNEL, shadow_ctor, &pnfields2[i]);
209 if (!sv2[i]) {
210 ret = -ENOMEM;
211 goto out;
212 }
213 }
214
215 /* pass 2: verify we find allocated svars and where they point to */
216 for (i = 0; i < NUM_OBJS; i++) {
217 /* check the "char" svar for all objects */
218 sv = shadow_get(&objs[i], SV_ID1);
219 if (!sv) {
220 ret = -EINVAL;
221 goto out;
222 }
223 if ((char **)sv == sv1[i] && *sv1[i] == pnfields1[i])
224 pr_info(" got expected PTR%d -> PTR%d result\n",
225 ptr_id(sv1[i]), ptr_id(*sv1[i]));
226
227 /* check the "int" svar for all objects */
228 sv = shadow_get(&objs[i], SV_ID2);
229 if (!sv) {
230 ret = -EINVAL;
231 goto out;
232 }
233 if ((int **)sv == sv2[i] && *sv2[i] == pnfields2[i])
234 pr_info(" got expected PTR%d -> PTR%d result\n",
235 ptr_id(sv2[i]), ptr_id(*sv2[i]));
236 }
237
238 /* pass 3: verify that 'get_or_alloc' returns already allocated svars */
239 for (i = 0; i < NUM_OBJS; i++) {
240 pndup[i] = &nfields1[i];
241 ptr_id(pndup[i]);
242
243 sv = shadow_get_or_alloc(&objs[i], SV_ID1, sizeof(pndup[i]),
244 GFP_KERNEL, shadow_ctor, &pndup[i]);
245 if (!sv) {
246 ret = -EINVAL;
247 goto out;
248 }
249 if ((char **)sv == sv1[i] && *sv1[i] == pnfields1[i])
250 pr_info(" got expected PTR%d -> PTR%d result\n",
251 ptr_id(sv1[i]), ptr_id(*sv1[i]));
252 }
253
254 /* pass 4: free <objs[*], SV_ID1> pairs of svars, verify removal */
255 for (i = 0; i < NUM_OBJS; i++) {
256 shadow_free(&objs[i], SV_ID1, shadow_dtor); /* 'char' pairs */
257 sv = shadow_get(&objs[i], SV_ID1);
258 if (!sv)
259 pr_info(" got expected NULL result\n");
260 }
261
262 /* pass 5: check we still find <objs[*], SV_ID2> svar pairs */
263 for (i = 0; i < NUM_OBJS; i++) {
264 sv = shadow_get(&objs[i], SV_ID2); /* 'int' pairs */
265 if (!sv) {
266 ret = -EINVAL;
267 goto out;
268 }
269 if ((int **)sv == sv2[i] && *sv2[i] == pnfields2[i])
270 pr_info(" got expected PTR%d -> PTR%d result\n",
271 ptr_id(sv2[i]), ptr_id(*sv2[i]));
272 }
273
274 /* pass 6: free all the <objs[*], SV_ID2> svar pairs too. */
275 shadow_free_all(SV_ID2, NULL); /* 'int' pairs */
276 for (i = 0; i < NUM_OBJS; i++) {
277 sv = shadow_get(&objs[i], SV_ID2);
278 if (!sv)
279 pr_info(" got expected NULL result\n");
280 }
281
282 free_ptr_list();
283
284 return 0;
285out:
286 shadow_free_all(SV_ID1, NULL); /* 'char' pairs */
287 shadow_free_all(SV_ID2, NULL); /* 'int' pairs */
288 free_ptr_list();
289
290 return ret;
291}
292
293static void test_klp_shadow_vars_exit(void)
294{
295}
296
297module_init(test_klp_shadow_vars_init);
298module_exit(test_klp_shadow_vars_exit);
299MODULE_LICENSE("GPL");
300MODULE_AUTHOR("Joe Lawrence <joe.lawrence@redhat.com>");
301MODULE_DESCRIPTION("Livepatch test: shadow variables");
1// SPDX-License-Identifier: GPL-2.0
2// Copyright (C) 2018 Joe Lawrence <joe.lawrence@redhat.com>
3
4#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
5
6#include <linux/module.h>
7#include <linux/kernel.h>
8#include <linux/list.h>
9#include <linux/livepatch.h>
10#include <linux/slab.h>
11
12/*
13 * Keep a small list of pointers so that we can print address-agnostic
14 * pointer values. Use a rolling integer count to differentiate the values.
15 * Ironically we could have used the shadow variable API to do this, but
16 * let's not lean too heavily on the very code we're testing.
17 */
18static LIST_HEAD(ptr_list);
19struct shadow_ptr {
20 void *ptr;
21 int id;
22 struct list_head list;
23};
24
25static void free_ptr_list(void)
26{
27 struct shadow_ptr *sp, *tmp_sp;
28
29 list_for_each_entry_safe(sp, tmp_sp, &ptr_list, list) {
30 list_del(&sp->list);
31 kfree(sp);
32 }
33}
34
35static int ptr_id(void *ptr)
36{
37 struct shadow_ptr *sp;
38 static int count;
39
40 list_for_each_entry(sp, &ptr_list, list) {
41 if (sp->ptr == ptr)
42 return sp->id;
43 }
44
45 sp = kmalloc(sizeof(*sp), GFP_ATOMIC);
46 if (!sp)
47 return -ENOMEM;
48 sp->ptr = ptr;
49 sp->id = count++;
50
51 list_add(&sp->list, &ptr_list);
52
53 return sp->id;
54}
55
56/*
57 * Shadow variable wrapper functions that echo the function and arguments
58 * to the kernel log for testing verification. Don't display raw pointers,
59 * but use the ptr_id() value instead.
60 */
61static void *shadow_get(void *obj, unsigned long id)
62{
63 void *ret = klp_shadow_get(obj, id);
64
65 pr_info("klp_%s(obj=PTR%d, id=0x%lx) = PTR%d\n",
66 __func__, ptr_id(obj), id, ptr_id(ret));
67
68 return ret;
69}
70
71static void *shadow_alloc(void *obj, unsigned long id, size_t size,
72 gfp_t gfp_flags, klp_shadow_ctor_t ctor,
73 void *ctor_data)
74{
75 void *ret = klp_shadow_alloc(obj, id, size, gfp_flags, ctor,
76 ctor_data);
77 pr_info("klp_%s(obj=PTR%d, id=0x%lx, size=%zx, gfp_flags=%pGg), ctor=PTR%d, ctor_data=PTR%d = PTR%d\n",
78 __func__, ptr_id(obj), id, size, &gfp_flags, ptr_id(ctor),
79 ptr_id(ctor_data), ptr_id(ret));
80 return ret;
81}
82
83static void *shadow_get_or_alloc(void *obj, unsigned long id, size_t size,
84 gfp_t gfp_flags, klp_shadow_ctor_t ctor,
85 void *ctor_data)
86{
87 void *ret = klp_shadow_get_or_alloc(obj, id, size, gfp_flags, ctor,
88 ctor_data);
89 pr_info("klp_%s(obj=PTR%d, id=0x%lx, size=%zx, gfp_flags=%pGg), ctor=PTR%d, ctor_data=PTR%d = PTR%d\n",
90 __func__, ptr_id(obj), id, size, &gfp_flags, ptr_id(ctor),
91 ptr_id(ctor_data), ptr_id(ret));
92 return ret;
93}
94
95static void shadow_free(void *obj, unsigned long id, klp_shadow_dtor_t dtor)
96{
97 klp_shadow_free(obj, id, dtor);
98 pr_info("klp_%s(obj=PTR%d, id=0x%lx, dtor=PTR%d)\n",
99 __func__, ptr_id(obj), id, ptr_id(dtor));
100}
101
102static void shadow_free_all(unsigned long id, klp_shadow_dtor_t dtor)
103{
104 klp_shadow_free_all(id, dtor);
105 pr_info("klp_%s(id=0x%lx, dtor=PTR%d)\n",
106 __func__, id, ptr_id(dtor));
107}
108
109
110/* Shadow variable constructor - remember simple pointer data */
111static int shadow_ctor(void *obj, void *shadow_data, void *ctor_data)
112{
113 int **shadow_int = shadow_data;
114 *shadow_int = ctor_data;
115 pr_info("%s: PTR%d -> PTR%d\n",
116 __func__, ptr_id(shadow_int), ptr_id(ctor_data));
117
118 return 0;
119}
120
121static void shadow_dtor(void *obj, void *shadow_data)
122{
123 pr_info("%s(obj=PTR%d, shadow_data=PTR%d)\n",
124 __func__, ptr_id(obj), ptr_id(shadow_data));
125}
126
127static int test_klp_shadow_vars_init(void)
128{
129 void *obj = THIS_MODULE;
130 int id = 0x1234;
131 size_t size = sizeof(int *);
132 gfp_t gfp_flags = GFP_KERNEL;
133
134 int var1, var2, var3, var4;
135 int **sv1, **sv2, **sv3, **sv4;
136
137 void *ret;
138
139 ptr_id(NULL);
140 ptr_id(&var1);
141 ptr_id(&var2);
142 ptr_id(&var3);
143 ptr_id(&var4);
144
145 /*
146 * With an empty shadow variable hash table, expect not to find
147 * any matches.
148 */
149 ret = shadow_get(obj, id);
150 if (!ret)
151 pr_info(" got expected NULL result\n");
152
153 /*
154 * Allocate a few shadow variables with different <obj> and <id>.
155 */
156 sv1 = shadow_alloc(obj, id, size, gfp_flags, shadow_ctor, &var1);
157 if (!sv1)
158 return -ENOMEM;
159
160 sv2 = shadow_alloc(obj + 1, id, size, gfp_flags, shadow_ctor, &var2);
161 if (!sv2)
162 return -ENOMEM;
163
164 sv3 = shadow_alloc(obj, id + 1, size, gfp_flags, shadow_ctor, &var3);
165 if (!sv3)
166 return -ENOMEM;
167
168 /*
169 * Verify we can find our new shadow variables and that they point
170 * to expected data.
171 */
172 ret = shadow_get(obj, id);
173 if (!ret)
174 return -EINVAL;
175 if (ret == sv1 && *sv1 == &var1)
176 pr_info(" got expected PTR%d -> PTR%d result\n",
177 ptr_id(sv1), ptr_id(*sv1));
178
179 ret = shadow_get(obj + 1, id);
180 if (!ret)
181 return -EINVAL;
182 if (ret == sv2 && *sv2 == &var2)
183 pr_info(" got expected PTR%d -> PTR%d result\n",
184 ptr_id(sv2), ptr_id(*sv2));
185 ret = shadow_get(obj, id + 1);
186 if (!ret)
187 return -EINVAL;
188 if (ret == sv3 && *sv3 == &var3)
189 pr_info(" got expected PTR%d -> PTR%d result\n",
190 ptr_id(sv3), ptr_id(*sv3));
191
192 /*
193 * Allocate or get a few more, this time with the same <obj>, <id>.
194 * The second invocation should return the same shadow var.
195 */
196 sv4 = shadow_get_or_alloc(obj + 2, id, size, gfp_flags, shadow_ctor, &var4);
197 if (!sv4)
198 return -ENOMEM;
199
200 ret = shadow_get_or_alloc(obj + 2, id, size, gfp_flags, shadow_ctor, &var4);
201 if (!ret)
202 return -EINVAL;
203 if (ret == sv4 && *sv4 == &var4)
204 pr_info(" got expected PTR%d -> PTR%d result\n",
205 ptr_id(sv4), ptr_id(*sv4));
206
207 /*
208 * Free the <obj=*, id> shadow variables and check that we can no
209 * longer find them.
210 */
211 shadow_free(obj, id, shadow_dtor); /* sv1 */
212 ret = shadow_get(obj, id);
213 if (!ret)
214 pr_info(" got expected NULL result\n");
215
216 shadow_free(obj + 1, id, shadow_dtor); /* sv2 */
217 ret = shadow_get(obj + 1, id);
218 if (!ret)
219 pr_info(" got expected NULL result\n");
220
221 shadow_free(obj + 2, id, shadow_dtor); /* sv4 */
222 ret = shadow_get(obj + 2, id);
223 if (!ret)
224 pr_info(" got expected NULL result\n");
225
226 /*
227 * We should still find an <id+1> variable.
228 */
229 ret = shadow_get(obj, id + 1);
230 if (!ret)
231 return -EINVAL;
232 if (ret == sv3 && *sv3 == &var3)
233 pr_info(" got expected PTR%d -> PTR%d result\n",
234 ptr_id(sv3), ptr_id(*sv3));
235
236 /*
237 * Free all the <id+1> variables, too.
238 */
239 shadow_free_all(id + 1, shadow_dtor); /* sv3 */
240 ret = shadow_get(obj, id);
241 if (!ret)
242 pr_info(" shadow_get() got expected NULL result\n");
243
244
245 free_ptr_list();
246
247 return 0;
248}
249
250static void test_klp_shadow_vars_exit(void)
251{
252}
253
254module_init(test_klp_shadow_vars_init);
255module_exit(test_klp_shadow_vars_exit);
256MODULE_LICENSE("GPL");
257MODULE_AUTHOR("Joe Lawrence <joe.lawrence@redhat.com>");
258MODULE_DESCRIPTION("Livepatch test: shadow variables");