system-state.rst 5.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167
  1. ====================
  2. System State Changes
  3. ====================
  4. Some users are really reluctant to reboot a system. This brings the need
  5. to provide more livepatches and maintain some compatibility between them.
  6. Maintaining more livepatches is much easier with cumulative livepatches.
  7. Each new livepatch completely replaces any older one. It can keep,
  8. add, and even remove fixes. And it is typically safe to replace any version
  9. of the livepatch with any other one thanks to the atomic replace feature.
  10. The problems might come with shadow variables and callbacks. They might
  11. change the system behavior or state so that it is no longer safe to
  12. go back and use an older livepatch or the original kernel code. Also
  13. any new livepatch must be able to detect what changes have already been
  14. done by the already installed livepatches.
  15. This is where the livepatch system state tracking gets useful. It
  16. allows to:
  17. - store data needed to manipulate and restore the system state
  18. - define compatibility between livepatches using a change id
  19. and version
  20. 1. Livepatch system state API
  21. =============================
  22. The state of the system might get modified either by several livepatch callbacks
  23. or by the newly used code. Also it must be possible to find changes done by
  24. already installed livepatches.
  25. Each modified state is described by struct klp_state, see
  26. include/linux/livepatch.h.
  27. Each livepatch defines an array of struct klp_states. They mention
  28. all states that the livepatch modifies.
  29. The livepatch author must define the following two fields for each
  30. struct klp_state:
  31. - *id*
  32. - Non-zero number used to identify the affected system state.
  33. - *version*
  34. - Number describing the variant of the system state change that
  35. is supported by the given livepatch.
  36. The state can be manipulated using two functions:
  37. - *klp_get_state(patch, id)*
  38. - Get struct klp_state associated with the given livepatch
  39. and state id.
  40. - *klp_get_prev_state(id)*
  41. - Get struct klp_state associated with the given feature id and
  42. already installed livepatches.
  43. 2. Livepatch compatibility
  44. ==========================
  45. The system state version is used to prevent loading incompatible livepatches.
  46. The check is done when the livepatch is enabled. The rules are:
  47. - Any completely new system state modification is allowed.
  48. - System state modifications with the same or higher version are allowed
  49. for already modified system states.
  50. - Cumulative livepatches must handle all system state modifications from
  51. already installed livepatches.
  52. - Non-cumulative livepatches are allowed to touch already modified
  53. system states.
  54. 3. Supported scenarios
  55. ======================
  56. Livepatches have their life-cycle and the same is true for the system
  57. state changes. Every compatible livepatch has to support the following
  58. scenarios:
  59. - Modify the system state when the livepatch gets enabled and the state
  60. has not been already modified by a livepatches that are being
  61. replaced.
  62. - Take over or update the system state modification when is has already
  63. been done by a livepatch that is being replaced.
  64. - Restore the original state when the livepatch is disabled.
  65. - Restore the previous state when the transition is reverted.
  66. It might be the original system state or the state modification
  67. done by livepatches that were being replaced.
  68. - Remove any already made changes when error occurs and the livepatch
  69. cannot get enabled.
  70. 4. Expected usage
  71. =================
  72. System states are usually modified by livepatch callbacks. The expected
  73. role of each callback is as follows:
  74. *pre_patch()*
  75. - Allocate *state->data* when necessary. The allocation might fail
  76. and *pre_patch()* is the only callback that could stop loading
  77. of the livepatch. The allocation is not needed when the data
  78. are already provided by previously installed livepatches.
  79. - Do any other preparatory action that is needed by
  80. the new code even before the transition gets finished.
  81. For example, initialize *state->data*.
  82. The system state itself is typically modified in *post_patch()*
  83. when the entire system is able to handle it.
  84. - Clean up its own mess in case of error. It might be done by a custom
  85. code or by calling *post_unpatch()* explicitly.
  86. *post_patch()*
  87. - Copy *state->data* from the previous livepatch when they are
  88. compatible.
  89. - Do the actual system state modification. Eventually allow
  90. the new code to use it.
  91. - Make sure that *state->data* has all necessary information.
  92. - Free *state->data* from replaces livepatches when they are
  93. not longer needed.
  94. *pre_unpatch()*
  95. - Prevent the code, added by the livepatch, relying on the system
  96. state change.
  97. - Revert the system state modification..
  98. *post_unpatch()*
  99. - Distinguish transition reverse and livepatch disabling by
  100. checking *klp_get_prev_state()*.
  101. - In case of transition reverse, restore the previous system
  102. state. It might mean doing nothing.
  103. - Remove any not longer needed setting or data.
  104. .. note::
  105. *pre_unpatch()* typically does symmetric operations to *post_patch()*.
  106. Except that it is called only when the livepatch is being disabled.
  107. Therefore it does not need to care about any previously installed
  108. livepatch.
  109. *post_unpatch()* typically does symmetric operations to *pre_patch()*.
  110. It might be called also during the transition reverse. Therefore it
  111. has to handle the state of the previously installed livepatches.