https://wiki.xenproject.org/index.php?title=LivePatch/Example/XSA-182&feed=atom&action=historyLivePatch/Example/XSA-182 - Revision history2024-03-28T15:30:28ZRevision history for this page on the wikiMediaWiki 1.31.3https://wiki.xenproject.org/index.php?title=LivePatch/Example/XSA-182&diff=17211&oldid=prevLars.kurth: Created page with "= How to enable Livepatching = Xen 4.7 implements v1 of the [http://xenbits.xen.org/docs/unstable/misc/livepatch.html Live Patch Design]. The code for hypervisor is '''NOT''..."2016-08-10T14:27:29Z<p>Created page with "= How to enable Livepatching = Xen 4.7 implements v1 of the [http://xenbits.xen.org/docs/unstable/misc/livepatch.html Live Patch Design]. The code for hypervisor is '''NOT''..."</p>
<p><b>New page</b></p><div>= How to enable Livepatching =<br />
<br />
Xen 4.7 implements v1 of the [http://xenbits.xen.org/docs/unstable/misc/livepatch.html Live Patch Design].<br />
<br />
The code for hypervisor is '''NOT''' enabled by default. When compiling the hypervisor one must enable it to build it.<br />
<br />
It can be done by enabling ''CONFIG_LIVEPATCH=y'' via <code>make menuconfig</code><nowiki>:</nowiki><br />
<br />
<syntaxhighlight lang='sh'> <br />
$ git clone git://xenbits.xen.org/xen.git<br />
$ git checkout RELEASE-4.7.0<br />
$ cd xen/xen<br />
$ make menuconfig<br />
</syntaxhighlight><br />
<br />
And selecting Common Features|Live Patch live patching support.<br />
<br />
It is marked as ''TECH PREVIEW''.<br />
<br />
Once you have it built and booted, you can verify that Live Patch works via:<br />
<br />
<syntaxhighlight lang='sh'> <br />
$ xen-livepatch list<br />
ID | status<br />
---------------------------------------- ------------<br />
</syntaxhighlight><br />
<br />
If you see:<br />
<br />
<syntaxhighlight lang='sh'> <br />
$ xen-livepatch list<br />
ID | status<br />
---------------------------------------- ------------<br />
Failed to list 0/0: 38(Function not implemented)!<br />
</syntaxhighlight><br />
<br />
Then the hypervisor does '''NOT''' have Live Patching built in.<br />
<br />
'''NOTE'''<nowiki>: The tool to patch/load/etc called </nowiki>''xen-livepatch'' is part of the Xen source tree.<br />
<br />
= Build XSA hot-patches =<br />
<br />
To build hot-patches aka payloads aka binary fixes against the hypervisor, you need<br />
<br />
* Xen hypervisor which supports Live Patch hypercalls.<br />
* Tool to build binary fixes against hypervisor.<br />
* Your source of Xen in a temporary directory.<br />
* Build-id of the hypervisor you are compiling against.<br />
* The .config the hypervisor was built with.<br />
* The XSA-182 patch.<br />
<br />
The tool is available at:<br />
<br />
<syntaxhighlight lang='sh'> <br />
git://xenbits.xen.org/livepatch-build-tools.git<br />
</syntaxhighlight><br />
<br />
'''NOTE'''<nowiki>: The payload </nowiki>'''MUST''' be compiled with the same GCC version which the hypervisor was built. To find the version run:<br />
<br />
<syntaxhighlight lang='sh'> <br />
# xl info | grep cc_compiler<br />
cc_compiler : gcc (GCC) 4.4.7 20120313 (Red Hat 4.4.7-16)<br />
</syntaxhighlight><br />
<br />
== Figure out source of hypervisor. ==<br />
<br />
This documents assumes you have installed ''RELEASE-4.7.0'' Xen with ''CONFIG_LIVEPATCH=y'' enabled.<br />
<br />
<syntaxhighlight lang='sh'> <br />
# xl info | grep xen_changeset<br />
$ Mon Junl 20 11:38:15 2016 0100 git:9a6cc4f<br />
</syntaxhighlight><br />
<br />
The ''9a6cc4f'' commit is the ''RELEASE-4.7.0'' tag in Xen source code. Your commit may be different if you have extra patches on top.<br />
<br />
== Figure out the build-id of hypervisor. ==<br />
<br />
The build-id in this example is ''9b619b5e9ab1a738123d43f5ece13c5dd8daefdc'' but it will be different on each build. One can extract this by:<br />
<br />
<syntaxhighlight lang='sh'> <br />
# xl info | grep build_id<br />
build_id : 9b619b5e9ab1a738123d43f5ece13c5dd8daefdc<br />
</syntaxhighlight><br />
<br />
(This build-id is used to keep track of payloads dependencies and make sure they are built against the correct hypervisor built).<br />
<br />
== The .config ==<br />
<br />
Usually it is in ''/boot/xen-4.7.0.config''.<br />
<br />
== Source of hypervisor - Clone your sources in a temporary directory. ==<br />
<br />
We will need a temporary location to build the payload patches against.<br />
<br />
<syntaxhighlight lang='sh'> <br />
$ cd /tmp/<br />
$ git clone git://xenbits.xen.org/xen.git<br />
$ cd xen<br />
$ git checkout 9a6cc4f<br />
</syntaxhighlight><br />
<br />
'''NOTE'''<nowiki>: git commit 9a6cc4f is the </nowiki>''RELEASE-4.7.0'' tag. Yours may be different.<br />
<br />
= Build and get livepatching build tools. =<br />
<br />
The work flow of the tool is to:<br />
<br />
* Build a Xen hypervisor without the patch.<br />
* Build a Xen hypervisor with a patch.<br />
* Compare the two above.<br />
* Create an payload with the difference.<br />
<br />
<syntaxhighlight lang='sh'> <br />
$ cd /tmp<br />
$ git clone git://xenbits.xen.org/livepatch-build-tools.git<br />
$ cd livepatch-build-tools<br />
$ make<br />
</syntaxhighlight><br />
<br />
'''NOTE'''<nowiki>: You may need to have </nowiki>''elfutils-libelf'' (RPM package), or ''libelf1'' (Debian package) installed.<br />
<br />
And lastly the exciting part - building the payload.<br />
<br />
The patch is assumed to be in ''$HOME'' directory.<br />
<br />
<syntaxhighlight lang='sh'> <br />
$ ./livepatch-build -c /boot/xen-4.7.0.config -s /tmp/xen -p $HOME/xsa182-unstable.patch -o xsa182-unstable.build --depends 9b619b5e9ab1a738123d43f5ece13c5dd8daefdc<br />
<br />
'''NOTE''' Don’t blindly plug in the build-id value! Use the one your hypervisor is built with.<br />
<br />
= Testing out the livepatch. =<br />
<br />
Copy the livepatches and test them out:<br />
<br />
<syntaxhighlight lang='sh'> <br />
$ # copy xsa*.build/*.livepatch onto the host (or if locally skip this step)<br />
<br />
On the host:<br />
# xen-livepatch load xsa182-unstable.livepatch<br />
# xen-livepatch list<br />
ID | status<br />
---------------------------------------- ------------<br />
xsa182-unstable | APPLIED<br />
</syntaxhighlight><br />
<br />
You can also test that the payload is properly loaded via:<br />
<br />
<syntaxhighlight lang='sh'> <br />
# xl debug-keys x<br />
# xl dmesg<br />
(XEN) build-id: 9b619b5e9ab1a738123d43f5ece13c5dd8daefdc<br />
(XEN) name=xsa182-unstable state=APPLIED(2) ffff82d080409000 (.data=ffff82d08040c000, .rodata=ffff82d08040c000) using 4 pages.<br />
(XEN) mm.c#mod_l4_entry patch ffff82d08017d340(1119) with ffff82d080409280 (1119)<br />
(XEN) mm.c#mod_l1_entry patch ffff82d08017e410(2046) with ffff82d0804096e0 (2046)<br />
(XEN) do_mmu_update patch ffff82d08017ec10(6301) with ffff82d080409ee0 (6291)<br />
(XEN) build-id=b7e6cb62371792f6bc50c644759d2cd8e35b3225<br />
(XEN) depend-on=9b619b5e9ab1a738123d43f5ece13c5dd8daefdc<br />
</syntaxhighlight><br />
<br />
''NOTE'' The buildid of the payload is ''b7e6cb62371792f6bc50c644759d2cd8e35b3225''. If you are going to build other payloads on top of this XSA use this build-id instead of the hypervisor one.<br />
<br />
That is it. Please setup at your convenience your maintenance window.<br />
<br />
= Support in older Xen versions for Live Patching =<br />
<br />
== Xen 4.4 ==<br />
<br />
There is a backport to Xen 4.4.3 which is located at:<br />
<br />
<syntaxhighlight lang='sh'> <br />
git://xenbits.xen.org/people/konradwilk/xen.git livepatch.backport_to.v4.4.3<br />
</syntaxhighlight><br />
<br />
Xen 4.4 did not use Kconfig, and CONFIG_LIVEPATCH is hardcoded to be enabled in the Makefile. To use it with livepatch-build-tools you have to use a dummy config:<br />
<br />
<syntaxhighlight lang='sh'> <br />
$ touch /boot/xen-4.4.3.config<br />
$ ./livepatch-build -c /boot/xen-4.4.3.config -s /tmp/xen -p $HOME/xsa182-4.5.patch -o xsa182-4.5.build --depends 71e9b3db4bd29fef00f0134f12916eaf2d453a88<br />
</syntaxhighlight><br />
<br />
Also the list of functions to patch is different:<br />
<br />
<syntaxhighlight lang='sh'> <br />
(XEN) 'x' pressed - Dumping all livepatch patches<br />
(XEN) build-id: 71e9b3db4bd29fef00f0134f12916eaf2d453a88<br />
(XEN) name=xsa182 state=APPLIED(2) ffff82d080609000 (.data=ffff82d080612000, .rodata=ffff82d080612000) using 11 pages.<br />
(XEN) mm.c#mmio_ro_emulated_write patch ffff82d08027af50(126) with ffff82d080609000 (126)<br />
(XEN) mm.c#get_pg_owner patch ffff82d08027bc90(281) with ffff82d080609410 (281)<br />
(XEN) mm.c#replace_grant_va_mapping patch ffff82d08027d410(739) with ffff82d080609a00 (739)<br />
(XEN) mm.c#unmark_superpage patch ffff82d08027e3d0(277) with ffff82d08060a2f0 (277)<br />
(XEN) mm.c#__get_page_type patch ffff82d08027e9c0(5691) with ffff82d08060a410 (5691)<br />
(XEN) mm.c#mod_l4_entry patch ffff82d080282340(1209) with ffff82d08060c3a0 (1209)<br />
(XEN) mm.c#mod_l1_entry patch ffff82d080284390(2057) with ffff82d08060e410 (2057)<br />
(XEN) mm.c#ptwr_emulated_update patch ffff82d080286b30(1020) with ffff82d080610760 (1020)<br />
(XEN) mm.c#ptwr_emulated_cmpxchg patch ffff82d080286f30(206) with ffff82d080610b60 (206)<br />
(XEN) mm.c#ptwr_emulated_write patch ffff82d080287000(148) with ffff82d080610c30 (148)<br />
(XEN) put_page patch ffff82d08027b0e0(297) with ffff82d080609080 (297)<br />
(XEN) get_page patch ffff82d08027b210(233) with ffff82d0806091b0 (233)<br />
(XEN) steal_page patch ffff82d08027bde0(716) with ffff82d080609530 (716)<br />
(XEN) donate_page patch ffff82d08027ccc0(512) with ffff82d080609800 (512)<br />
(XEN) free_page_type patch ffff82d08027d860(1535) with ffff82d080609cf0 (1535)<br />
(XEN) get_superpage patch ffff82d080280ce0(404) with ffff82d08060ba50 (404)<br />
(XEN) create_grant_host_mapping patch ffff82d080281b90(1959) with ffff82d08060bbf0 (1959)<br />
(XEN) new_guest_cr3 patch ffff82d080282800(685) with ffff82d08060c860 (685)<br />
(XEN) do_mmuext_op patch ffff82d080282ab0(6392) with ffff82d08060cb10 (6392)<br />
(XEN) do_mmu_update patch ffff82d080285040(6885) with ffff82d08060ec20 (6974)<br />
(XEN) replace_grant_host_mapping patch ffff82d0802870a0(1942) with ffff82d080610cd0 (1942)<br />
(XEN) build-id=067df4809fce1344b7ca7e9b4ccc7373f4a68c5e<br />
(XEN) depend-on=71e9b3db4bd29fef00f0134f12916eaf2d453a88<br />
</syntaxhighlight><br />
<br />
= Questions, comments: =<br />
<br />
Please send them to the Xen Security member (who is also the maintainer of the ''livepatch-build_tools''), Konrad Rzeszutek Wilk [mailto:konrad.wilk@oracle.com konrad.wilk@oracle.com]<br />
<br />
= Version of this document. =<br />
<br />
This is version 1.<br />
<br />
[[Category:LivePatch]]<br />
[[Category:Security]]</div>Lars.kurth