xen-devel.lists.xenproject.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v4] xSplice v1 design and implementation.
@ 2016-03-15 17:56 Konrad Rzeszutek Wilk
  2016-03-15 17:56 ` [PATCH v4 01/34] compat/x86: Remove unncessary #define Konrad Rzeszutek Wilk
                   ` (33 more replies)
  0 siblings, 34 replies; 124+ messages in thread
From: Konrad Rzeszutek Wilk @ 2016-03-15 17:56 UTC (permalink / raw)
  To: xen-devel, ross.lagerwall, konrad, andrew.cooper3, mpohlack, sasha.levin

Hey!

Changelog:
v3: http://www.gossamer-threads.com/lists/xen/devel/418262
    and 
    http://lists.xenproject.org/archives/html/xen-devel/2016-02/msg04106.html
 - Act on all reviews.
 - Redo the flow of patches
v2: http://lists.xen.org/archives/html/xen-devel/2016-01/msg01597.html
 - Updated code/docs/design with review comments.
 - Make xen also have an PT_NOTE
 - Added more of Ross's patches
 - Combined build-id patchset with this.
(since the RFC and the Seattle Xen presentation)
 - Finished off some of the work around the build-id.
 - Settled on the preemption mechanism.
 - Cleaned the patches a lot up, broke them up to easy
   review for maintainers.
v1: http://lists.xenproject.org/archives/html/xen-devel/2015-09/msg02116.html
  - Put all the design comments in the code
Prototype: http://lists.xenproject.org/archives/html/xen-devel/2015-10/msg02595.html
[Posting by Ross]
 - Took all reviews into account.
 - Redid the patches


*Flow of patches*

The first five patches add the neccessary components that have been
requested by Andrew. There are also four fixes I've included.

I was not sure if it made sense to split it of as a standalone
patchset (similar to how I did it in v3) or just include it in this patchset.
To make it easier for folks to see the whole thing I've just included
them in this giant patchset:

 compat/x86: Remove unncessary #define.
 libxc: Remove dead code (XENVER_capabilities)
 xsm/xen_version: Add XSM for the xen_version hypercall
 HYPERCALL_version_op. New hypercall mirroring XENVER_ but sane.
 libxc/libxl/python/xenstat: Use new XEN_VERSION_OP hypercall
 x86/arm: Add BUGFRAME_NR define and BUILD checks.
 arm/x86: Use struct virtual_region to do bug, symbol, and (x86) exception tables
 vmap: Make the while loop less fishy.
 vmap: ASSERT on NULL.
 vmap: Add vmalloc_cb and vfree_cb

Since they are generic and touch ARM and x86 they have been tested
on x86 (legacy and EFI) and on ARM (CubieTruck). Actually the whole
branch has been tested on those three platforms.

*What is xSplice?*

A mechanism to binarily patch the running hypervisor with new
opcodes that have come about due to primarily security updates.

*What will this patchset do once I've it*

Patch the hypervisor.

*Why are you emailing me?*

Please please review as many patches as possible.

*OK, what do you have?*

They are located at a git tree:
  git://xenbits.xen.org/people/konradwilk/xen.git xsplice.v4

(Copying from Ross's email):

Much of the work is implementing a basic version of the Linux kernel module
loader. The code:
* Loading of xSplice ELF payloads.
* Copying allocated sections into a new executable region of memory.
* Resolving symbols.
* Applying relocations.
* Patching of altinstructions.
* Special handling of bug frames and exception tables.
* Unloading of xSplice ELF payloads.
* Compiling a sample xSplice ELF payload
* Resolving symbols
* Using build-id dependencies
* Support for shadow variable framework
* Support for executing ELF payload functions on load/unload.

The other main bit of this work is applying and reverting the patches safely.
As implemented, the code is patched with each CPU waiting in the
return-to-guest path (i.e. with no stack) or on the cpu-idle path
which appears to be the safest way of patching. While it is safe we should
still (in the next wave of patches) to verify to not patch cetain critical
sections (say the code doing the patching)

All of the following should work:
* Applying patches safely.
* Reverting patches safely.
* Replacing patches safely (e.g. reverting any applied patches and applying
   a new patch).
* Bug frames as part of modules. This means adding or
  changing WARN, ASSERT, BUG, and run_in_exception_handler works correctly.
  Line number only changes _are ignored_.
* Exception tables as part of modules. E.g. wrmsr_safe and copy_to_user work
  correctly when used in a patch module.
* Stacking of patches on top of each other
* Resolving symbols (even of patches)

*Limitations*

The above is enough to fully implement an update system where multiple source
patches are combined (using combinediff) and built into a single binary
which then atomically replaces any existing loaded patches
(this is why Ross added a REPLACE operation). This is the approach used
by kPatch and kGraft.

Multiple completely independent patches can also be loaded but unexpected
interactions may occur.

As it stands, the patches are statically linked which means that independent
patches cannot be linked against one another (e.g. if one introduces a
new symbol). Using the combinediff approach above fixes this.

Backtraces containing functions from a patch module do not show the symbol name.

There is no checking that a patch which is loaded is built for the
correct hypervisor (need to use build-id).

Binary patching works at the function level.

*Testing*

You can use the example code included in this patchset:

# xl info | grep extra
xen_extra              : -unstable
# xen-xsplice load /usr/lib/debug/xen_hello_world.xsplice
Uploading /usr/lib/debug/xen_hello_world.xsplice (2071 bytes)
Performing check: completed
Performing apply:. completed
# xl info | grep extra
xen_extra              : Hello World
# xen-xsplice revert xen_hello_world
Performing revert:. completed
# xen-xsplice unload xen_hello_world
Performing unload: completed
# xl info | grep extra
xen_extra              : -unstable

Or you can use git://xenbits.xen.org/people/konradwilk/xsplice-build-tools.git
which generates the ELF payloads.

This link has a nice description of how to use the tool:
http://lists.xenproject.org/archives/html/xen-devel/2015-10/msg02595.html


 .gitignore                                   |    3 +
 Config.mk                                    |   12 +
 MAINTAINERS                                  |   10 +
 docs/misc/xsplice.markdown                   | 1115 +++++++++++++++++++
 tools/flask/policy/policy/modules/xen/xen.te |   21 +
 tools/libxc/include/xenctrl.h                |   86 +-
 tools/libxc/xc_core.c                        |   35 +-
 tools/libxc/xc_dom_boot.c                    |   12 +-
 tools/libxc/xc_dom_x86.c                     |    7 -
 tools/libxc/xc_domain.c                      |    3 +-
 tools/libxc/xc_misc.c                        |  337 ++++++
 tools/libxc/xc_private.c                     |   53 +-
 tools/libxc/xc_private.h                     |    7 +-
 tools/libxc/xc_resume.c                      |    3 +-
 tools/libxc/xc_sr_save.c                     |    9 +-
 tools/libxc/xg_save_restore.h                |    6 +-
 tools/libxl/libxl.c                          |   94 +-
 tools/libxl/libxl.h                          |    5 +
 tools/libxl/libxl_types.idl                  |    1 +
 tools/libxl/xl_cmdimpl.c                     |    1 +
 tools/misc/Makefile                          |    4 +
 tools/misc/xen-xsplice.c                     |  463 ++++++++
 tools/ocaml/libs/xc/xenctrl_stubs.c          |   39 +-
 tools/python/xen/lowlevel/xc/xc.c            |   30 +-
 tools/xenstat/libxenstat/src/xenstat.c       |   12 +-
 tools/xentrace/xenctx.c                      |    3 +-
 xen/Makefile                                 |    2 +
 xen/arch/arm/Makefile                        |    7 +-
 xen/arch/arm/traps.c                         |   46 +-
 xen/arch/arm/xen.lds.S                       |   20 +-
 xen/arch/arm/xsplice.c                       |   76 ++
 xen/arch/x86/Makefile                        |   45 +-
 xen/arch/x86/alternative.c                   |   20 +-
 xen/arch/x86/boot/mkelf32.c                  |  137 ++-
 xen/arch/x86/domain.c                        |    4 +
 xen/arch/x86/extable.c                       |   44 +-
 xen/arch/x86/hvm/hvm.c                       |    1 +
 xen/arch/x86/hvm/svm/svm.c                   |    2 +
 xen/arch/x86/hvm/vmx/vmcs.c                  |    2 +
 xen/arch/x86/setup.c                         |   10 +-
 xen/arch/x86/test/Makefile                   |   87 ++
 xen/arch/x86/test/xen_bye_world.c            |   35 +
 xen/arch/x86/test/xen_bye_world_func.c       |   25 +
 xen/arch/x86/test/xen_hello_world.c          |   54 +
 xen/arch/x86/test/xen_hello_world_func.c     |   26 +
 xen/arch/x86/test/xen_replace_world.c        |   35 +
 xen/arch/x86/test/xen_replace_world_func.c   |   25 +
 xen/arch/x86/traps.c                         |   51 +-
 xen/arch/x86/x86_64/compat/entry.S           |    2 +
 xen/arch/x86/x86_64/entry.S                  |    2 +
 xen/arch/x86/xen.lds.S                       |   23 +
 xen/arch/x86/xsplice.c                       |  295 +++++
 xen/common/Kconfig                           |   16 +
 xen/common/Makefile                          |    4 +
 xen/common/bug_ex_symbols.c                  |  119 +++
 xen/common/compat/kernel.c                   |    4 +-
 xen/common/kernel.c                          |  328 +++++-
 xen/common/symbols.c                         |   62 +-
 xen/common/sysctl.c                          |    7 +
 xen/common/version.c                         |   82 ++
 xen/common/vmap.c                            |   45 +-
 xen/common/vsprintf.c                        |   15 +-
 xen/common/xsplice.c                         | 1476 ++++++++++++++++++++++++++
 xen/common/xsplice_elf.c                     |  385 +++++++
 xen/common/xsplice_shadow.c                  |  109 ++
 xen/include/asm-arm/bug.h                    |    2 +
 xen/include/asm-arm/nmi.h                    |   13 +
 xen/include/asm-x86/alternative.h            |    6 +
 xen/include/asm-x86/bug.h                    |    3 +-
 xen/include/asm-x86/uaccess.h                |    5 +
 xen/include/asm-x86/x86_64/page.h            |    2 +
 xen/include/public/arch-arm.h                |    3 +
 xen/include/public/sysctl.h                  |  169 +++
 xen/include/public/version.h                 |   75 +-
 xen/include/public/xen.h                     |    1 +
 xen/include/xen/bug_ex_symbols.h             |   74 ++
 xen/include/xen/hypercall.h                  |    4 +
 xen/include/xen/kernel.h                     |    2 +
 xen/include/xen/symbols.h                    |   11 +
 xen/include/xen/version.h                    |    6 +
 xen/include/xen/vmap.h                       |   14 +
 xen/include/xen/xsplice.h                    |  129 +++
 xen/include/xen/xsplice_elf.h                |   56 +
 xen/include/xen/xsplice_patch.h              |   95 ++
 xen/include/xsm/dummy.h                      |   41 +
 xen/include/xsm/xsm.h                        |   12 +
 xen/xsm/dummy.c                              |    2 +
 xen/xsm/flask/hooks.c                        |   91 ++
 xen/xsm/flask/policy/access_vectors          |   52 +
 xen/xsm/flask/policy/security_classes        |    1 +
 90 files changed, 6661 insertions(+), 307 deletions(-)

Konrad Rzeszutek Wilk (24):
      compat/x86: Remove unncessary #define.
      libxc: Remove dead code (XENVER_capabilities)
      xsm/xen_version: Add XSM for the xen_version hypercall
      HYPERCALL_version_op. New hypercall mirroring XENVER_ but sane.
      libxc/libxl/python/xenstat: Use new XEN_VERSION_OP hypercall
      x86/arm: Add BUGFRAME_NR define and BUILD checks.
      arm/x86: Use struct virtual_region to do bug, symbol, and (x86) exception tables
      vmap: Make the while loop less fishy.
      vmap: ASSERT on NULL.
      vmap: Add vmalloc_cb and vfree_cb
      xsplice: Design document
      xen/xsplice: Hypervisor implementation of XEN_XSPLICE_op
      libxc: Implementation of XEN_XSPLICE_op in libxc
      xen-xsplice: Tool to manipulate xsplice payloads
      x86/xen_hello_world.xsplice: Test payload for patching 'xen_extra_version'.
      xsplice,symbols: Implement symbol name resolution on address.
      build_id: Provide ld-embedded build-ids
      HYPERCALL_version_op: Add VERSION_OP_build_id to retrieve build-id.
      libxl: info: Display build_id of the hypervisor using XEN_VERSION_OP_build_id
      xsplice: Print build_id in keyhandler and on bootup.
      xsplice: Stacking build-id dependency checking.
      xsplice/xen_replace_world: Test-case for XSPLICE_ACTION_REPLACE
      xsplice: Print dependency and payloads build_id in the keyhandler.
      MAINTAINERS/xsplice: Add myself and Ross as the maintainers.

Ross Lagerwall (10):
      xsplice: Add helper elf routines
      xsplice: Implement payload loading
      xsplice: Implement support for applying/reverting/replacing patches.
      x86, xsplice: Print payload's symbol name and payload name in backtraces
      xsplice: Add .xsplice.hooks functions and test-case
      xsplice: Add support for bug frames.
      xsplice: Add support for exception tables.
      xsplice: Add support for alternatives
      xsplice: Prevent duplicate payloads to be loaded.
      xsplice: Add support for shadow variables.


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

^ permalink raw reply	[flat|nested] 124+ messages in thread

end of thread, other threads:[~2016-03-24 19:19 UTC | newest]

Thread overview: 124+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-03-15 17:56 [PATCH v4] xSplice v1 design and implementation Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 01/34] compat/x86: Remove unncessary #define Konrad Rzeszutek Wilk
2016-03-15 18:57   ` Andrew Cooper
2016-03-16 11:08   ` Jan Beulich
2016-03-17  0:44     ` Konrad Rzeszutek Wilk
2016-03-17  7:45       ` Jan Beulich
2016-03-15 17:56 ` [PATCH v4 02/34] libxc: Remove dead code (XENVER_capabilities) Konrad Rzeszutek Wilk
2016-03-15 18:04   ` Andrew Cooper
2016-03-15 18:08     ` Konrad Rzeszutek Wilk
2016-03-16 18:11   ` Wei Liu
2016-03-15 17:56 ` [PATCH v4 03/34] xsm/xen_version: Add XSM for the xen_version hypercall Konrad Rzeszutek Wilk
2016-03-18 11:55   ` Jan Beulich
2016-03-18 17:26     ` Konrad Rzeszutek Wilk
2016-03-21 11:22       ` Jan Beulich
2016-03-22 16:10         ` Konrad Rzeszutek Wilk
2016-03-22 17:54           ` Daniel De Graaf
2016-03-22 17:49   ` Daniel De Graaf
2016-03-24 15:34   ` anshul makkar
2016-03-24 19:19     ` Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 04/34] HYPERCALL_version_op. New hypercall mirroring XENVER_ but sane Konrad Rzeszutek Wilk
2016-03-15 18:29   ` Andrew Cooper
2016-03-15 20:19     ` Konrad Rzeszutek Wilk
2016-03-17  1:38       ` Konrad Rzeszutek Wilk
2016-03-17 14:28         ` Andrew Cooper
2016-03-18 12:36         ` Jan Beulich
2016-03-18 19:22           ` Konrad Rzeszutek Wilk
2016-03-21 12:45             ` Jan Beulich
2016-03-22 15:52               ` Konrad Rzeszutek Wilk
2016-03-22 16:06                 ` Jan Beulich
2016-03-22 18:57                   ` Konrad Rzeszutek Wilk
2016-03-22 19:28                     ` Andrew Cooper
2016-03-22 20:39                       ` Konrad Rzeszutek Wilk
2016-03-23  8:56                         ` Jan Beulich
2016-03-24  2:37                           ` Konrad Rzeszutek Wilk
2016-03-24  9:15                             ` Jan Beulich
2016-03-24 11:39                               ` Konrad Rzeszutek Wilk
2016-03-22 17:51   ` Daniel De Graaf
2016-03-15 17:56 ` [PATCH v4 05/34] libxc/libxl/python/xenstat: Use new XEN_VERSION_OP hypercall Konrad Rzeszutek Wilk
2016-03-15 18:45   ` Andrew Cooper
2016-03-16 12:31   ` George Dunlap
2016-03-16 18:11   ` Wei Liu
2016-03-17  1:08     ` Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 06/34] x86/arm: Add BUGFRAME_NR define and BUILD checks Konrad Rzeszutek Wilk
2016-03-15 18:54   ` Andrew Cooper
2016-03-16 11:49   ` Julien Grall
2016-03-18 12:40   ` Jan Beulich
2016-03-18 19:59     ` Konrad Rzeszutek Wilk
2016-03-21 12:49       ` Jan Beulich
2016-03-22 15:39         ` Konrad Rzeszutek Wilk
2016-03-22 15:58           ` Jan Beulich
2016-03-15 17:56 ` [PATCH v4 07/34] arm/x86: Use struct virtual_region to do bug, symbol, and (x86) exception tables Konrad Rzeszutek Wilk
2016-03-15 19:24   ` Andrew Cooper
2016-03-15 19:34     ` Konrad Rzeszutek Wilk
2016-03-15 19:51       ` Andrew Cooper
2016-03-15 20:02         ` Andrew Cooper
2016-03-16 10:33           ` Jan Beulich
2016-03-18 13:07   ` Jan Beulich
2016-03-22 20:18     ` Konrad Rzeszutek Wilk
2016-03-23  8:19       ` Jan Beulich
2016-03-23 11:17         ` Julien Grall
2016-03-23 11:21           ` Jan Beulich
2016-03-24  2:49         ` Konrad Rzeszutek Wilk
2016-03-24  9:20           ` Jan Beulich
2016-03-15 17:56 ` [PATCH v4 08/34] vmap: Make the while loop less fishy Konrad Rzeszutek Wilk
2016-03-15 19:33   ` Andrew Cooper
2016-03-17 11:49     ` Jan Beulich
2016-03-17 14:37       ` Andrew Cooper
2016-03-17 15:30         ` Jan Beulich
2016-03-17 16:06           ` Ian Jackson
2016-03-17 11:48   ` Jan Beulich
2016-03-17 16:08   ` Ian Jackson
2016-03-21 12:04     ` George Dunlap
2016-03-21 13:26       ` Jan Beulich
2016-03-21 14:22         ` George Dunlap
2016-03-21 15:05           ` Jan Beulich
2016-03-15 17:56 ` [PATCH v4 09/34] vmap: ASSERT on NULL Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 10/34] vmap: Add vmalloc_cb and vfree_cb Konrad Rzeszutek Wilk
2016-03-18 13:20   ` Jan Beulich
2016-03-15 17:56 ` [PATCH v4 11/34] xsplice: Design document Konrad Rzeszutek Wilk
2016-03-23 11:18   ` Jan Beulich
2016-03-23 20:12     ` Konrad Rzeszutek Wilk
2016-03-23 20:21       ` Konrad Rzeszutek Wilk
2016-03-24  3:15     ` Konrad Rzeszutek Wilk
2016-03-24  9:32       ` Jan Beulich
2016-03-15 17:56 ` [PATCH v4 12/34] xen/xsplice: Hypervisor implementation of XEN_XSPLICE_op Konrad Rzeszutek Wilk
2016-03-16 12:12   ` Julien Grall
2016-03-16 19:58     ` Konrad Rzeszutek Wilk
2016-03-23 13:51   ` Jan Beulich
2016-03-24  3:13     ` Konrad Rzeszutek Wilk
2016-03-24  9:29       ` Jan Beulich
2016-03-15 17:56 ` [PATCH v4 13/34] libxc: Implementation of XEN_XSPLICE_op in libxc Konrad Rzeszutek Wilk
2016-03-16 18:12   ` Wei Liu
2016-03-16 20:36     ` Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 14/34] xen-xsplice: Tool to manipulate xsplice payloads Konrad Rzeszutek Wilk
2016-03-16 18:12   ` Wei Liu
2016-03-15 17:56 ` [PATCH v4 15/34] xsplice: Add helper elf routines Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 16/34] xsplice: Implement payload loading Konrad Rzeszutek Wilk
2016-03-22 17:25   ` Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 17/34] xsplice: Implement support for applying/reverting/replacing patches Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 18/34] x86/xen_hello_world.xsplice: Test payload for patching 'xen_extra_version' Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 19/34] xsplice, symbols: Implement symbol name resolution on address Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 20/34] x86, xsplice: Print payload's symbol name and payload name in backtraces Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 21/34] xsplice: Add .xsplice.hooks functions and test-case Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 22/34] xsplice: Add support for bug frames Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 23/34] xsplice: Add support for exception tables Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 24/34] xsplice: Add support for alternatives Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 25/34] build_id: Provide ld-embedded build-ids Konrad Rzeszutek Wilk
2016-03-16 18:34   ` Julien Grall
2016-03-16 21:02     ` Konrad Rzeszutek Wilk
2016-03-17  1:12       ` Konrad Rzeszutek Wilk
2016-03-17 11:08         ` Julien Grall
2016-03-17 13:39           ` Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 26/34] HYPERCALL_version_op: Add VERSION_OP_build_id to retrieve build-id Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 27/34] libxl: info: Display build_id of the hypervisor using XEN_VERSION_OP_build_id Konrad Rzeszutek Wilk
2016-03-16 18:12   ` Wei Liu
2016-03-15 17:56 ` [PATCH v4 28/34] xsplice: Print build_id in keyhandler and on bootup Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 29/34] xsplice: Stacking build-id dependency checking Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 30/34] xsplice/xen_replace_world: Test-case for XSPLICE_ACTION_REPLACE Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 31/34] xsplice: Print dependency and payloads build_id in the keyhandler Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 32/34] xsplice: Prevent duplicate payloads from being loaded Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 33/34] xsplice: Add support for shadow variables Konrad Rzeszutek Wilk
2016-03-15 17:56 ` [PATCH v4 34/34] MAINTAINERS/xsplice: Add myself and Ross as the maintainers Konrad Rzeszutek Wilk
2016-03-16 11:10   ` Jan Beulich
2016-03-17  0:44     ` Konrad Rzeszutek Wilk

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).