Re: [PATCH 0/3] Emulator fuzz tester

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 08/22/2011 10:41 AM, Avi Kivity wrote:
As it is exposed directly to guest code, the x86 emulator is an interesting
target for exploiters: a vulnerability may lead to compromise of the entire
host.

In an attempt to catch vulnerabilities before they make it into production
code, this patchset adds a fuzz tester for the emulator.  Instructions
are synthesized and fed into the emulator; a vulnerability will usually
result in an access violation.

I tried to make the emulator test build an run in userspace; this proved too
difficult, so the test is built as part of the kernel.  It can still be run
in userspace, via KVM:

   qemu -enable-kvm -smp 4 -serial stdio -kernel bzImage \
       -append 'console=ttyS0 test_emulator.iterations=1000000000'

   ...
   starting emulator test
   emulator fuzz test results
     instructions:     1000000000
     decoded:            94330032
     emulated:           92529152
     nofault:                 117
     failures:                  0
   emulator test: PASS
   ...

One billion random instructions failed to find a vulnerability, so either
the emulator is really good, or the test is really bad, or we need a lot more
runtime.

Lucas, how would we go about integrating this into kvm-autotest?

I have applied the 3 patches on your latest tree, compiled the kernel but I'm having trouble in running the test the way you described.

One thing I've noticed here: I can only compile the test as a kernel module, not in the kernel image (menuconfig only gives me (N/m/?). So I believe there's no way to test it the way you have described... In any case I did try what you have suggested, then the kernel panics due to the lack of a filesystem/init. After some reading, I learned to create a bogus fs with a bogus init in it, but still, the test does not run (I guess it's because the test module is not compiled into the bzImage).

I assume there are some details you forgot to mention to get this done... Would you mind posting a more detailed procedure?

To avoid misunderstandings, here is the outline of what I've tried:

1) Updated my kvm.git repo, so it reflects latest upstream
2) Applied all 3 patches of this series
3) make bzImage, make modules
4) Tried to boot with a very recent qemu-kvm compiled from HEAD (exec name is like this because it's a symlink)

./qemu -smp 4 -serial stdio -kernel ~/Code/kvm/arch/x86_64/boot/bzImage -append 'console=ttyS0 test_emulator.iterations=1000000000'

No use (kernel panics due to a lack of rootfs and init).

5) Then I tried:

./qemu -smp 4 -serial stdio -kernel ~/Code/kvm/arch/x86_64/boot/bzImage -initrd rootfs -append 'root=/dev/ram console=ttyS0 test_emulator.iterations=1000000000'

No use either. Kernel will stand on the bogus init and do nothing else.

Cheers,

Lucas

--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux