Re: [PATCH 0/3] Emulator fuzz tester

From: Lucas Meneghel Rodrigues <lmr@redhat.com>
To: Avi Kivity <avi@redhat.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>, kvm@vger.kernel.org
Subject: Re: [PATCH 0/3] Emulator fuzz tester
Date: Thu, 25 Aug 2011 21:11:35 -0300	[thread overview]
Message-ID: <4E56E4B7.1020703@redhat.com> (raw)
In-Reply-To: <1314020469-30882-1-git-send-email-avi@redhat.com>

On 08/22/2011 10:41 AM, Avi Kivity wrote:
> As it is exposed directly to guest code, the x86 emulator is an interesting
> target for exploiters: a vulnerability may lead to compromise of the entire
> host.
>
> In an attempt to catch vulnerabilities before they make it into production
> code, this patchset adds a fuzz tester for the emulator.  Instructions
> are synthesized and fed into the emulator; a vulnerability will usually
> result in an access violation.
>
> I tried to make the emulator test build an run in userspace; this proved too
> difficult, so the test is built as part of the kernel.  It can still be run
> in userspace, via KVM:
>
>    qemu -enable-kvm -smp 4 -serial stdio -kernel bzImage \
>        -append 'console=ttyS0 test_emulator.iterations=1000000000'
>
>    ...
>    starting emulator test
>    emulator fuzz test results
>      instructions:     1000000000
>      decoded:            94330032
>      emulated:           92529152
>      nofault:                 117
>      failures:                  0
>    emulator test: PASS
>    ...
>
> One billion random instructions failed to find a vulnerability, so either
> the emulator is really good, or the test is really bad, or we need a lot more
> runtime.
>
> Lucas, how would we go about integrating this into kvm-autotest?

I have applied the 3 patches on your latest tree, compiled the kernel 
but I'm having trouble in running the test the way you described.

One thing I've noticed here: I can only compile the test as a kernel 
module, not in the kernel image (menuconfig only gives me
(N/m/?). So I believe there's no way to test it the way you have 
described... In any case I did try what you have suggested, then the 
kernel panics due to the lack of a filesystem/init. After some reading, 
I learned to create a bogus fs with a bogus init in it, but still, the 
test does not run (I guess it's because the test module is not compiled 
into the bzImage).

I assume there are some details you forgot to mention to get this 
done... Would you mind posting a more detailed procedure?

To avoid misunderstandings, here is the outline of what I've tried:

1) Updated my kvm.git repo, so it reflects latest upstream
2) Applied all 3 patches of this series
3) make bzImage, make modules
4) Tried to boot with a very recent qemu-kvm compiled from HEAD (exec 
name is like this because it's a symlink)

./qemu -smp 4 -serial stdio -kernel ~/Code/kvm/arch/x86_64/boot/bzImage 
-append 'console=ttyS0 test_emulator.iterations=1000000000'

No use (kernel panics due to a lack of rootfs and init).

5) Then I tried:

./qemu -smp 4 -serial stdio -kernel ~/Code/kvm/arch/x86_64/boot/bzImage 
-initrd rootfs -append 'root=/dev/ram console=ttyS0 
test_emulator.iterations=1000000000'

No use either. Kernel will stand on the bogus init and do nothing else.

Cheers,

Lucas