[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] [PATCH v8] xSplice v1 design and implementation.



Hey!

Changelog:
v7: since http://lists.xen.org/archives/html/xen-devel/2016-04/msg01476.html
 - Ingested newer version of x86/mm: Introduce modify_xen_mappings()
 - Implemented faster symbol table lookup (NEW)
 - Carried out tests on large CPU machine (240CPUs)
 - Made the struct xsplice_patch_func work on ARM32 and changed its size
   (64bit it is 64bytes, 32bit is 52 bytes - and the offset is different too)
 - Changed a bunch of printk to dprintk, adjusted XENLOG_ levels.
 - Resurrected the XENVER_build_id.
 - Reverted VERSION_op.
v6: http://lists.xen.org/archives/html/xen-devel/2016-04/msg00871.html
 - Acted on all comments from Andrew, Julien, and Jan.
 - Got help from Andrew on one of them over the weekend.
 - Dropped: xsplice: Add .xsplice.hooks functions and test-case,
   xsplice: Add support for shadow variables.
v5: http://lists.xen.org/archives/html/xen-devel/2016-03/msg03286.html
 - Acted at all comments from Jan.
v4: http://lists.xen.org/archives/html/xen-devel/2016-03/msg01776.html
 - Lots of review. Lots of rework. Some patches checked in.
v3: http://www.gossamer-threads.com/lists/xen/devel/418262
    and 
    http://lists.xenproject.org/archives/html/xen-devel/2016-02/msg04106.html
 - Act on all reviews.
 - Redo the flow of patches
v2: http://lists.xen.org/archives/html/xen-devel/2016-01/msg01597.html
 - Updated code/docs/design with review comments.
 - Make xen also have an PT_NOTE
 - Added more of Ross's patches
 - Combined build-id patchset with this.
(since the RFC and the Seattle Xen presentation)
 - Finished off some of the work around the build-id.
 - Settled on the preemption mechanism.
 - Cleaned the patches a lot up, broke them up to easy
   review for maintainers.
v1: http://lists.xenproject.org/archives/html/xen-devel/2015-09/msg02116.html
  - Put all the design comments in the code
Prototype: 
http://lists.xenproject.org/archives/html/xen-devel/2015-10/msg02595.html
[Posting by Ross]
 - Took all reviews into account.
 - Redid the patches


*Tools Maintainers*

Since v7, two new patches, please review:

    XENVER_build_id/libxc: Provide ld-embedded build-id
    libxl: info: Display build_id of the hypervisor.

*Maintainers*

Legend:
 *    - See below
 R    - Reviewed 
 R+   - Reviewed by two folks
 A    - Acked by maintainer of the area (hypervisor or toolstack)

*     Revert "libxc/libxl/python/xenstat/ocaml: Use new
*     Revert "HYPERCALL_version_op. New hypercall mirroring
  A   xsplice: Design document
   R  xen/xsplice: Hypervisor implementation of XEN_XSPLICE_op
  AR  libxc: Implementation of XEN_XSPLICE_op in libxc
  AR  xen-xsplice: Tool to manipulate xsplice payloads
  AR  arm/x86: Use struct virtual_region to do bug, symbol, and (x86) exception 
tables lookup.
        [Julien Acked the ARM part]
  AR  arm/x86/vmap: Add vmalloc_xen, vfree_xen and vm_init_type
        [Julien Acked the ARM part]
   R+  x86/mm: Introduce modify_xen_mappings()
   R  xsplice: Add helper elf routines
   R  xsplice: Implement payload loading
*  R  xsplice: Implement support for applying/reverting/replacing patches.
   R  x86/xen_hello_world.xsplice: Test payload for patching 
'xen_extra_version'.
   R  xsplice,symbols: Implement symbol name resolution on address.
*     xsplice, symbols: Implement fast symbol names -> virtual addresses lookup
   R  x86, xsplice: Print payload's symbol name and payload name in backtraces
   R  xsplice: Add support for bug frames.
   R  xsplice: Add support for exception tables.
   R  xsplice: Add support for alternatives
  AR  build_id: Provide ld-embedded build-ids
        [Julien Acked the ARM part]
  AR  xsplice: Print build_id in keyhandler and on bootup.
*     XENVER_build_id/libxc: Provide ld-embedded build-id
*     libxl: info: Display build_id of the hypervisor.
   R  xsplice: Stacking build-id dependency checking.
   R  xsplice/xen_replace_world: Test-case for XSPLICE_ACTION_REPLACE
   R  xsplice: Prevent duplicate payloads from being loaded.
   R  MAINTAINERS/xsplice: Add myself and Ross as the maintainers.

Since v7, the
 [PATCH v8 01/27] Revert "libxc/libxl/python/xenstat/ocaml: Use new
 [PATCH v8 02/27] Revert "HYPERCALL_version_op. New hypercall mirroring

 [PATCH v8 15/27] xsplice, symbols: Implement fast symbol names ->
 [PATCH v8 22/27] XENVER_build_id/libxc: Provide ld-embedded build-id
 [PATCH v8 23/27] libxl: info: Display build_id of the hypervisor.

haven't been reviewed (they are new). Thought honestly the reverts don't really
need a review.

Julien, Stefano, I dropped Julien's Ack on

 [PATCH v8 11/27] xsplice: Implement payload loading

as Jan's expressed a desire not to have BITS_PER_LONG exposed
in the public headers. I've put CONFIG_ARM_32 in there. On IRC
Stefano was OK (relucantly) with it.

Patchset has been tested on ARM (tweaking the Kconfig to build xSplice and then
booting and using it under ARM CubieTruck - granted there is no patching
yet but the hypercalls work), ARM64 (only built it), and x86 (legacy and EFI)

*VERSION_OP being reverted?*

Ian (thank you taking the stressful role of tiebreaker) pointed out that
at the end of the day - less code from a maintaince perspective is easier.
Hence the revert. We can always revisit this in Xen 4.8 :-)

*Are there any TODOs left from v5,v6,v7 reviews?*

Just how the sysctl.h definition for 'struct xsplice_patch_func' should be:

#define XSPLICE_PAYLOAD_VERSION 1
/*
 * .xsplice.funcs structure layout defined in the `Payload format`
 * section in the xSplice design document.
 *
 * The size should be exactly 64 bytes (64) or 52 bytes (32).
 *
 * We guard this with __XEN__ as toolstacks do not need to use it.
 */
#ifdef __XEN__
struct xsplice_patch_func {
    const char *name;       /* Name of function to be patched. */
#if CONFIG_ARM_32
    uint32_t new_addr;
    uint32_t old_addr;
#else
    uint64_t new_addr;
    uint64_t old_addr;      /* Can be zero and name will be looked up. */
#endif
    uint32_t new_size;
    uint32_t old_size;
    uint8_t version;        /* MUST be XSPLICE_PAYLOAD_VERSION. */
    uint8_t pad[31];        /* MUST be zero filled. */
};
typedef struct xsplice_patch_func xsplice_patch_func_t;
#endif

Please note the __XEN__ so even if toolstack does include the public/sysctl.h
it won't find it the structure.

With this I am able to compile early-test-cases-prototype-work xSplice on ARM32.

*What is xSplice?*

A mechanism to binarily patch the running hypervisor with new
opcodes that have come about due to primarily security updates.

*What will this patchset do once I've it*

Patch the hypervisor.

*Why are you emailing me?*

Please please review as many patches as possible.

*OK, what do you have?*

They are located at a git tree:
  git://xenbits.xen.org/people/konradwilk/xen.git   xsplice.v8.drop_VERSION_op

(Copying from Ross's email):

Much of the work is implementing a basic version of the Linux kernel module
loader. The code:
* Loading of xSplice ELF payloads.
* Copying allocated sections into a new executable region of memory.
* Resolving symbols.
* Applying relocations.
* Patching of altinstructions.
* Special handling of bug frames and exception tables.
* Unloading of xSplice ELF payloads.
* Compiling a sample xSplice ELF payload
* Resolving symbols
* Using build-id dependencies
* Support for shadow variable framework
* Support for executing ELF payload functions on load/unload.

The other main bit of this work is applying and reverting the patches safely.
As implemented, the code is patched with each CPU waiting in the
return-to-guest path (i.e. with no stack) or on the cpu-idle path
which appears to be the safest way of patching. While it is safe we should
still (in the next wave of patches) to verify to not patch cetain critical
sections (say the code doing the patching)

All of the following should work:
* Applying patches safely.
* Reverting patches safely.
* Replacing patches safely (e.g. reverting any applied patches and applying
   a new patch).
* Bug frames as part of modules. This means adding or
  changing WARN, ASSERT, BUG, and run_in_exception_handler works correctly.
  Line number only changes _are ignored_.
* Exception tables as part of modules. E.g. wrmsr_safe and copy_to_user work
  correctly when used in a patch module.
* Stacking of patches on top of each other
* Resolving symbols (even of patches)

*Limitations*

The above is enough to fully implement an update system where multiple source
patches are combined (using combinediff) and built into a single binary
which then atomically replaces any existing loaded patches
(this is why Ross added a REPLACE operation). This is the approach used
by kPatch and kGraft.

Multiple completely independent patches can also be loaded but unexpected
interactions may occur.

As it stands, the patches are statically linked which means that independent
patches cannot be linked against one another (e.g. if one introduces a
new symbol). Using the combinediff approach above fixes this.

Backtraces containing functions from a patch module do not show the symbol name.

There is no checking that a patch which is loaded is built for the
correct hypervisor (need to use build-id).

Binary patching works at the function level.

*Testing*

You can use the example code included in this patchset:

# xl info | grep extra
xen_extra              : -unstable
# xen-xsplice load /usr/lib/debug/xen_hello_world.xsplice
Uploading /usr/lib/debug/xen_hello_world.xsplice (2071 bytes)
Performing check: completed
Performing apply:. completed
# xl info | grep extra
xen_extra              : Hello World
# xen-xsplice revert xen_hello_world
Performing revert:. completed
# xen-xsplice unload xen_hello_world
Performing unload: completed
# xl info | grep extra
xen_extra              : -unstable

Or you can use git://xenbits.xen.org/people/konradwilk/xsplice-build-tools.git
which generates the ELF payloads.

This link has a nice description of how to use the tool:
http://lists.xenproject.org/archives/html/xen-devel/2015-10/msg02595.html

 .gitignore                                   |    5 +
 Config.mk                                    |   12 +
 MAINTAINERS                                  |   10 +
 docs/misc/xsplice.markdown                   | 1116 +++++++++++++++++++
 tools/flask/policy/policy/modules/xen/xen.te |    2 +
 tools/libxc/include/xenctrl.h                |   62 ++
 tools/libxc/xc_misc.c                        |  355 ++++++
 tools/libxl/libxl.c                          |   18 +-
 tools/libxl/libxl.h                          |    6 +
 tools/libxl/libxl_types.idl                  |    1 +
 tools/libxl/xl_cmdimpl.c                     |    1 +
 tools/misc/Makefile                          |    4 +
 tools/misc/xen-xsplice.c                     |  463 ++++++++
 xen/Makefile                                 |    8 +-
 xen/arch/arm/Makefile                        |    5 +-
 xen/arch/arm/kernel.c                        |    2 +-
 xen/arch/arm/mm.c                            |    2 +-
 xen/arch/arm/setup.c                         |    4 +
 xen/arch/arm/traps.c                         |   39 +-
 xen/arch/arm/xen.lds.S                       |   15 +-
 xen/arch/arm/xsplice.c                       |   87 ++
 xen/arch/x86/Makefile                        |   58 +-
 xen/arch/x86/alternative.c                   |   42 +-
 xen/arch/x86/boot/mkelf32.c                  |  129 ++-
 xen/arch/x86/domain.c                        |    2 +
 xen/arch/x86/extable.c                       |   41 +-
 xen/arch/x86/mm.c                            |   77 +-
 xen/arch/x86/setup.c                         |   28 +-
 xen/arch/x86/test/Makefile                   |   85 ++
 xen/arch/x86/test/xen_bye_world.c            |   34 +
 xen/arch/x86/test/xen_bye_world_func.c       |   24 +
 xen/arch/x86/test/xen_hello_world.c          |   33 +
 xen/arch/x86/test/xen_hello_world_func.c     |   38 +
 xen/arch/x86/test/xen_replace_world.c        |   34 +
 xen/arch/x86/test/xen_replace_world_func.c   |   24 +
 xen/arch/x86/traps.c                         |   45 +-
 xen/arch/x86/xen.lds.S                       |   28 +
 xen/arch/x86/xsplice.c                       |  264 +++++
 xen/common/Kconfig                           |   28 +
 xen/common/Makefile                          |    3 +
 xen/common/kernel.c                          |    4 +
 xen/common/symbols-dummy.c                   |    6 +
 xen/common/symbols.c                         |  118 +-
 xen/common/sysctl.c                          |    6 +
 xen/common/version.c                         |   70 ++
 xen/common/virtual_region.c                  |  148 +++
 xen/common/vmap.c                            |  202 ++--
 xen/common/vsprintf.c                        |   19 +-
 xen/common/xsplice.c                         | 1541 ++++++++++++++++++++++++++
 xen/common/xsplice_elf.c                     |  495 +++++++++
 xen/drivers/acpi/osl.c                       |    2 +-
 xen/include/asm-x86/alternative.h            |    4 +
 xen/include/asm-x86/current.h                |   10 +-
 xen/include/asm-x86/uaccess.h                |    2 +
 xen/include/public/sysctl.h                  |  193 ++++
 xen/include/public/version.h                 |    3 +
 xen/include/xen/elfstructs.h                 |    7 +
 xen/include/xen/mm.h                         |    2 +
 xen/include/xen/symbols.h                    |   11 +
 xen/include/xen/version.h                    |    1 +
 xen/include/xen/virtual_region.h             |   47 +
 xen/include/xen/vmap.h                       |   21 +-
 xen/include/xen/xsplice.h                    |  146 +++
 xen/include/xen/xsplice_elf.h                |   58 +
 xen/tools/symbols.c                          |   93 +-
 xen/xsm/flask/hooks.c                        |    7 +
 xen/xsm/flask/policy/access_vectors          |    4 +
 67 files changed, 6237 insertions(+), 217 deletions(-)

Andrew Cooper (1):
      x86/mm: Introduce modify_xen_mappings()

Konrad Rzeszutek Wilk (15):
      xsplice: Design document
      xen/xsplice: Hypervisor implementation of XEN_XSPLICE_op
      libxc: Implementation of XEN_XSPLICE_op in libxc
      xen-xsplice: Tool to manipulate xsplice payloads
      arm/x86: Use struct virtual_region to do bug, symbol, and (x86) exception 
tables lookup.
      arm/x86/vmap: Add vmalloc_xen, vfree_xen and vm_init_type
      x86/xen_hello_world.xsplice: Test payload for patching 
'xen_extra_version'.
      xsplice, symbols: Implement fast symbol names -> virtual addresses lookup
      build_id: Provide ld-embedded build-ids
      HYPERCALL_version_op: Add VERSION_build_id to retrieve build-id.
      libxl: info: Display build_id of the hypervisor using XEN_VERSION_build_id
      xsplice: Print build_id in keyhandler and on bootup.
      xsplice: Stacking build-id dependency checking.
      xsplice/xen_replace_world: Test-case for XSPLICE_ACTION_REPLACE
      MAINTAINERS/xsplice: Add myself and Ross as the maintainers.

Ross Lagerwall (9):
      xsplice: Add helper elf routines
      xsplice: Implement payload loading
      xsplice: Implement support for applying/reverting/replacing patches.
      xsplice,symbols: Implement symbol name resolution on address.
      x86, xsplice: Print payload's symbol name and payload name in backtraces
      xsplice: Add support for bug frames.
      xsplice: Add support for exception tables.
      xsplice: Add support for alternatives
      xsplice: Prevent duplicate payloads from being loaded.


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel

 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.