From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lucas Meneghel Rodrigues Subject: Re: [PATCH 0/3] Emulator fuzz tester Date: Thu, 25 Aug 2011 21:11:35 -0300 Message-ID: <4E56E4B7.1020703@redhat.com> References: <1314020469-30882-1-git-send-email-avi@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: Marcelo Tosatti , kvm@vger.kernel.org To: Avi Kivity Return-path: Received: from mx1.redhat.com ([209.132.183.28]:39946 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752318Ab1HZALi (ORCPT ); Thu, 25 Aug 2011 20:11:38 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p7Q0BbEK017794 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 25 Aug 2011 20:11:37 -0400 In-Reply-To: <1314020469-30882-1-git-send-email-avi@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: On 08/22/2011 10:41 AM, Avi Kivity wrote: > As it is exposed directly to guest code, the x86 emulator is an interesting > target for exploiters: a vulnerability may lead to compromise of the entire > host. > > In an attempt to catch vulnerabilities before they make it into production > code, this patchset adds a fuzz tester for the emulator. Instructions > are synthesized and fed into the emulator; a vulnerability will usually > result in an access violation. > > I tried to make the emulator test build an run in userspace; this proved too > difficult, so the test is built as part of the kernel. It can still be run > in userspace, via KVM: > > qemu -enable-kvm -smp 4 -serial stdio -kernel bzImage \ > -append 'console=ttyS0 test_emulator.iterations=1000000000' > > ... > starting emulator test > emulator fuzz test results > instructions: 1000000000 > decoded: 94330032 > emulated: 92529152 > nofault: 117 > failures: 0 > emulator test: PASS > ... > > One billion random instructions failed to find a vulnerability, so either > the emulator is really good, or the test is really bad, or we need a lot more > runtime. > > Lucas, how would we go about integrating this into kvm-autotest? I have applied the 3 patches on your latest tree, compiled the kernel but I'm having trouble in running the test the way you described. One thing I've noticed here: I can only compile the test as a kernel module, not in the kernel image (menuconfig only gives me (N/m/?). So I believe there's no way to test it the way you have described... In any case I did try what you have suggested, then the kernel panics due to the lack of a filesystem/init. After some reading, I learned to create a bogus fs with a bogus init in it, but still, the test does not run (I guess it's because the test module is not compiled into the bzImage). I assume there are some details you forgot to mention to get this done... Would you mind posting a more detailed procedure? To avoid misunderstandings, here is the outline of what I've tried: 1) Updated my kvm.git repo, so it reflects latest upstream 2) Applied all 3 patches of this series 3) make bzImage, make modules 4) Tried to boot with a very recent qemu-kvm compiled from HEAD (exec name is like this because it's a symlink) ./qemu -smp 4 -serial stdio -kernel ~/Code/kvm/arch/x86_64/boot/bzImage -append 'console=ttyS0 test_emulator.iterations=1000000000' No use (kernel panics due to a lack of rootfs and init). 5) Then I tried: ./qemu -smp 4 -serial stdio -kernel ~/Code/kvm/arch/x86_64/boot/bzImage -initrd rootfs -append 'root=/dev/ram console=ttyS0 test_emulator.iterations=1000000000' No use either. Kernel will stand on the bogus init and do nothing else. Cheers, Lucas