On 08/22/2011 10:41 AM, Avi Kivity wrote:
As it is exposed directly to guest code, the x86 emulator is an interesting
target for exploiters: a vulnerability may lead to compromise of the entire
host.
In an attempt to catch vulnerabilities before they make it into production
code, this patchset adds a fuzz tester for the emulator. Instructions
are synthesized and fed into the emulator; a vulnerability will usually
result in an access violation.
I tried to make the emulator test build an run in userspace; this proved too
difficult, so the test is built as part of the kernel. It can still be run
in userspace, via KVM:
qemu -enable-kvm -smp 4 -serial stdio -kernel bzImage \
-append 'console=ttyS0 test_emulator.iterations=1000000000'
...
starting emulator test
emulator fuzz test results
instructions: 1000000000
decoded: 94330032
emulated: 92529152
nofault: 117
failures: 0
emulator test: PASS
...
One billion random instructions failed to find a vulnerability, so either
the emulator is really good, or the test is really bad, or we need a lot more
runtime.
Lucas, how would we go about integrating this into kvm-autotest?
I have applied the 3 patches on your latest tree, compiled the kernel
but I'm having trouble in running the test the way you described.
One thing I've noticed here: I can only compile the test as a kernel
module, not in the kernel image (menuconfig only gives me
(N/m/?). So I believe there's no way to test it the way you have
described... In any case I did try what you have suggested, then the
kernel panics due to the lack of a filesystem/init. After some reading,
I learned to create a bogus fs with a bogus init in it, but still, the
test does not run (I guess it's because the test module is not compiled
into the bzImage).
I assume there are some details you forgot to mention to get this
done... Would you mind posting a more detailed procedure?
To avoid misunderstandings, here is the outline of what I've tried:
1) Updated my kvm.git repo, so it reflects latest upstream
2) Applied all 3 patches of this series
3) make bzImage, make modules
4) Tried to boot with a very recent qemu-kvm compiled from HEAD (exec
name is like this because it's a symlink)
./qemu -smp 4 -serial stdio -kernel ~/Code/kvm/arch/x86_64/boot/bzImage
-append 'console=ttyS0 test_emulator.iterations=1000000000'
No use (kernel panics due to a lack of rootfs and init).
5) Then I tried:
./qemu -smp 4 -serial stdio -kernel ~/Code/kvm/arch/x86_64/boot/bzImage
-initrd rootfs -append 'root=/dev/ram console=ttyS0
test_emulator.iterations=1000000000'
No use either. Kernel will stand on the bogus init and do nothing else.
Cheers,
Lucas
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
