From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lucas Meneghel Rodrigues Subject: Re: [PATCH 0/3] Emulator fuzz tester Date: Thu, 25 Aug 2011 16:07:10 -0300 Message-ID: <4E569D5E.60208@redhat.com> References: <1314020469-30882-1-git-send-email-avi@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: Marcelo Tosatti , kvm@vger.kernel.org To: Avi Kivity Return-path: Received: from mx1.redhat.com ([209.132.183.28]:32799 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755306Ab1HYTHN (ORCPT ); Thu, 25 Aug 2011 15:07:13 -0400 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p7PJ7Dj2005317 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 25 Aug 2011 15:07:13 -0400 In-Reply-To: <1314020469-30882-1-git-send-email-avi@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: On 08/22/2011 10:41 AM, Avi Kivity wrote: > As it is exposed directly to guest code, the x86 emulator is an interesting > target for exploiters: a vulnerability may lead to compromise of the entire > host. > > In an attempt to catch vulnerabilities before they make it into production > code, this patchset adds a fuzz tester for the emulator. Instructions > are synthesized and fed into the emulator; a vulnerability will usually > result in an access violation. > > I tried to make the emulator test build an run in userspace; this proved too > difficult, so the test is built as part of the kernel. It can still be run > in userspace, via KVM: > > qemu -enable-kvm -smp 4 -serial stdio -kernel bzImage \ > -append 'console=ttyS0 test_emulator.iterations=1000000000' > > ... > starting emulator test > emulator fuzz test results > instructions: 1000000000 > decoded: 94330032 > emulated: 92529152 > nofault: 117 > failures: 0 > emulator test: PASS > ... > > One billion random instructions failed to find a vulnerability, so either > the emulator is really good, or the test is really bad, or we need a lot more > runtime. > > Lucas, how would we go about integrating this into kvm-autotest? I'm thinking about it. Some ideas that come to my mind: 1) Create a test that boots a bzImage with the emulator params. This way we could: a) Use the bzImage built for the host, on our daily upstream jobs, or b) We can simply have a step that compiles a kernel tree, provided that your patch is present there and then pass the bzImage to qemu-kvm. I'm currently trying out b) manually to get a grasp of how this would work. Cheers, Lucas