[RFC 04/16] kgr: add testing kgraft patch

[Jiri Slaby <jslaby@suse.cz>]

This is intended to be a presentation of the kgraft engine, so it is
placed into samples/ directory.

It patches sys_iopl() and sys_capable() to print an additional message
to the original functionality.

Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Ingo Molnar <mingo@redhat.com>
---
 samples/Kconfig           |  4 ++
 samples/Makefile          |  3 +-
 samples/kgr/Makefile      |  1 +
 samples/kgr/kgr_patcher.c | 97 +++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 104 insertions(+), 1 deletion(-)
 create mode 100644 samples/kgr/Makefile
 create mode 100644 samples/kgr/kgr_patcher.c

diff --git a/samples/Kconfig b/samples/Kconfig
index 6181c2cc9ca0..a923510443de 100644
--- a/samples/Kconfig
+++ b/samples/Kconfig
@@ -55,6 +55,10 @@ config SAMPLE_KDB
 	  Build an example of how to dynamically add the hello
 	  command to the kdb shell.
 
+config SAMPLE_KGR_PATCHER
+	tristate "Build kgr patcher example -- loadable modules only"
+	depends on KGR && m
+
 config SAMPLE_RPMSG_CLIENT
 	tristate "Build rpmsg client sample -- loadable modules only"
 	depends on RPMSG && m
diff --git a/samples/Makefile b/samples/Makefile
index 1a60c62e2045..a141b219c019 100644
--- a/samples/Makefile
+++ b/samples/Makefile
@@ -1,4 +1,5 @@
 # Makefile for Linux samples code
 
 obj-$(CONFIG_SAMPLES)	+= kobject/ kprobes/ trace_events/ \
-			   hw_breakpoint/ kfifo/ kdb/ hidraw/ rpmsg/ seccomp/
+			   hw_breakpoint/ kfifo/ kdb/ kgr/ \
+			   hidraw/ rpmsg/ seccomp/
diff --git a/samples/kgr/Makefile b/samples/kgr/Makefile
new file mode 100644
index 000000000000..202eee7d050e
--- /dev/null
+++ b/samples/kgr/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_SAMPLE_KGR_PATCHER) += kgr_patcher.o
diff --git a/samples/kgr/kgr_patcher.c b/samples/kgr/kgr_patcher.c
new file mode 100644
index 000000000000..828543e36f3f
--- /dev/null
+++ b/samples/kgr/kgr_patcher.c
@@ -0,0 +1,97 @@
+/*
+ * kgr_patcher -- just kick kgr infrastructure for test
+ *
+ *  Copyright (c) 2013-2014 SUSE
+ *   Authors: Jiri Kosina
+ *	      Vojtech Pavlik
+ *	      Jiri Slaby
+ */
+
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/kgr.h>
+#include <linux/kallsyms.h>
+#include <linux/sched.h>
+#include <linux/types.h>
+#include <linux/capability.h>
+#include <linux/ptrace.h>
+
+#include <asm/processor.h>
+
+/*
+ * This all should be autogenerated from the patched sources
+ *
+ * IMPORTANT TODO: we have to handle cases where the new code is calling out
+ * into functions which are not exported to modules.
+ *
+ * This can either be handled by calling all such functions indirectly, i.e
+ * obtaining pointer from kallsyms in the stub (and transforming all callsites
+ * to do pointer dereference), or by modifying the kernel module linker.
+ */
+
+asmlinkage long kgr_new_sys_iopl(unsigned int level)
+{
+        struct pt_regs *regs = current_pt_regs();
+        unsigned int old = (regs->flags >> 12) & 3;
+        struct thread_struct *t = &current->thread;
+
+	printk(KERN_DEBUG "kgr-patcher: this is a new sys_iopl()\n");
+
+        if (level > 3)
+                return -EINVAL;
+        /* Trying to gain more privileges? */
+        if (level > old) {
+                if (!capable(CAP_SYS_RAWIO))
+                        return -EPERM;
+        }
+        regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
+        t->iopl = level << 12;
+        set_iopl_mask(t->iopl);
+
+        return 0;
+}
+KGR_PATCHED_FUNCTION(patch, SyS_iopl, kgr_new_sys_iopl);
+
+static bool new_capable(int cap)
+{
+	printk(KERN_DEBUG "kgr-patcher: this is a new capable()\n");
+
+        return ns_capable(&init_user_ns, cap);
+}
+KGR_PATCHED_FUNCTION(patch, capable, new_capable);
+
+static const struct kgr_patch patch = {
+	.patches = {
+		KGR_PATCH(SyS_iopl),
+		KGR_PATCH(capable),
+		KGR_PATCH_END
+	}
+};
+
+static int __init kgr_patcher_init(void)
+{
+	/* removing not supported (yet?) */
+	__module_get(THIS_MODULE);
+	kgr_start_patching(&patch);
+	return 0;
+}
+
+static void __exit kgr_patcher_cleanup(void)
+{
+	/* extra care needs to be taken when freeing ftrace_ops->private */
+	printk(KERN_ERR "removing now buggy!\n");
+}
+
+module_init(kgr_patcher_init);
+module_exit(kgr_patcher_cleanup);
+
+MODULE_LICENSE("GPL");
+
-- 
1.9.2