Commit Graph

47 Commits

Author SHA1 Message Date
Dmitry Vyukov
429ff326c3 vm/qemu: update kernel command line
+nmi_watchdog=panic
-slub_debug=UZ

Also refactor cmd line generation code to make it more resilent to bugs.
2017-06-15 18:29:47 +02:00
Dmitry Vyukov
af643baa32 vm: overhaul
VM infrastructure currently has several problems:
 - Config struct is complete mess with a superset of params for all VM types
 - verification of Config is mess spread across several places
 - there is no place where VM code could do global initialization
   like creating GCE connection, uploading GCE image to GCS,
   matching adb devices with consoles, etc
 - it hard to add private VM implementations
   such impl would need to add code to config package
   which would lead to constant merge conflicts
 - interface for VM implementation is mixed with interface for VM users
   this does not allow to provide best interface for both of them
 - there is no way to add common code for all VM implementations

This change solves these problems by:
 - splitting VM interface for users (vm package) and VM interface
   for VM implementations (vmimpl pacakge), this in turn allows
   to add common code
 - adding Pool concept that allows to do global initialization
   and config checking at the right time
 - decoupling manager config from VM-specific config
   each VM type now defines own config

Note: manager configs need to be changed after this change:
VM-specific parts are moved to own "vm" subobject.

Note: this change also drops "local" VM type.
Its story was long unclear and there is now syz-stress which solves the same problem.
2017-06-03 11:31:42 +02:00
Dmitry Vyukov
23b94422d3 pkg/log: move from log 2017-06-03 10:41:09 +02:00
baishuai
118ec7aea5 vm: validate if cfg.Bin is in $PATH for kvm,adb,qemu 2017-05-21 12:47:51 +08:00
Dmitry Vyukov
3558653771 vm: properly detect when a program exits
syz-fuzzer never exits (normally) so this does not affect syz-manager.
But during reproduction we can run a short running program (no repeat mode)
and currently VMs treat premature exit as an error.

Properly detect when a program exits and let callers decide what to do with it.
2017-02-02 20:23:40 +01:00
Dmitry Vyukov
86c334f459 vm/qemu: use static network config in 9p mode
Static config is faster than dhcp.
2017-01-27 20:46:09 +01:00
Dmitry Vyukov
83a8f430c9 vm/qemu: add some kvm-related kernel cmd line flags
In particular it is useful to enable nested.
Enable a bunch of others as well.
2017-01-09 20:20:49 +01:00
Dmitry Vyukov
3f9152d9e2 vm/qemu: enable more kvm features in test kernel 2017-01-09 20:19:44 +01:00
Dmitry Vyukov
a074da17a4 vm/adb: support BeagleBone console
BeagleBone console requires some special tty-ism to work.
Fortunately, this code also works with Suzy-Q.
2016-12-19 15:56:10 +01:00
Dmitry Vyukov
d105629ea2 vm/qemu: use panic=86400 instead of panic=-1
panic=-1 causes instant reboot, which is bad for crash logs.
panic=86400 makes it hang. Use panic=86400 as create-gce-image.sh does.
2016-12-06 20:06:45 +01:00
Alexander Popov
3a5ae29218 vm/qemu: prevent eth0 renaming
create-image.sh tries to enable eth0 network interface of the virtual machine,
but there is no eth0 in a fresh debian-wheezy, since biosdevname renames interfaces.
VM log quotation:
  e1000 0000:00:03.0 eth0: (PCI:33MHz:32-bit) 52:54:00:12:34:56
  e1000 0000:00:03.0 eth0: Intel(R) PRO/1000 Network Connection
  e1000 0000:00:03.0 ens3: renamed from eth0
  ...
  Cannot find device "eth0"
  Bind socket to interface: No such device
  Failed to bring up eth0.

The simplest fix is disabling biosdevname by adding "net.ifnames=0 biosdevname=0"
to the kernel command line.

Signed-off-by: Alexander Popov <alex.popov@linux.com>
2016-11-28 16:11:24 +03:00
Dmitry Vyukov
3356f68f1a vm/qemu: support non-native mode
Add config bin_args parameter that contains additional arguments for qemu binary.
This allows to specify e.g. "bin_args": "-machine virt -cpu cortex-a57".
Also restore qemu debugging output when -debug flag is specified.
2016-11-22 17:00:47 +01:00
Dmitry Vyukov
c9ae0f69d8 vm: add ability to interrupt commands
This is required for crash reproduction in manager.
2016-11-19 11:14:11 +01:00
Dmitry Vyukov
6f057a2c04 vm/qemu: remove debug, add rodata=n to kernel cmd line
Debug leads to too verbose output in some cases.
Rodata is very slow with KASAN.
2016-10-16 08:15:24 +02:00
Dmitry Vyukov
cac2fbeb8c vm/qemu: fix spurious failure during VM creation
When we recover from a transient failure, we want to cleanup
everything except for the workdir, because we will use it again
during next VM creation attempt.
Currently the next attempt always fails.
2016-09-05 12:49:47 +02:00
Dmitry Vyukov
76f68d6039 vm: merger console/fuzzer output line-by-line
Fixes #57
2016-08-28 19:21:57 +02:00
Dmitry Vyukov
6eb48645a4 vm/qemu: support 9p host-based image
If "image" is set to "9p" in config file,
qemu VM will create a minimalistic image based
on readonly-mapped host filesystem.
The main things that we need are working sshd and ssh-keygen.
/tmp, /etc/, /var, /root are remounted as tmpfs.
2016-08-22 13:48:51 -07:00
Dmitry Vyukov
a949600ee5 vm/qemu: use -no-reboot and -display=none
Rebooting only confuses syz-manager as it thinks that it's the same
dirty instance. Let syz-manager recreate the VM from scratch instead.

-display=none does not disable graphics subsystem which may be useful for fuzzing.
It also seems to be newer than -nographics.
2016-08-21 17:50:57 -07:00
JeremyHuang
19523ffdcc added an optional initrd flag. 2016-07-07 12:08:20 +08:00
JeremyHuang
6691f801bf add a initrd flag for qemu type and display the qemu command. 2016-06-20 17:54:25 +08:00
Lorenzo Stoakes
7c3d3bb8ae vm/qemu: strip ssh warnings
This patch sets the ssh loglevel to error to avoid noisy warnings, specifically
known host errors like:

Warning: Permanently added '[localhost]:1569' (ECDSA) to the list of known hosts.

Previously this appeared at the top of every crash report.
2016-03-10 07:33:23 +00:00
Dmitry Vyukov
1c8e56b155 vm/qemu: support kernel embed into the image
Fixes #16
2016-02-15 21:33:00 +01:00
Dmitry Vyukov
2fb5e9b0d4 vm/qemu: fix latent output reading bug 2016-01-20 14:01:45 +01:00
Dmitry Vyukov
dfd341e349 vm/qemu: use snapshot mode
This avoids image copy per instance.
Also page cache won't hold multiple copies of the image.
2016-01-19 15:48:32 +01:00
Dmitry Vyukov
91630fe39d sys: add support for /dev/snd/control 2016-01-13 16:54:29 +01:00
Dmitry Vyukov
de48f7b019 vm: refactor VM interface in preparation for adb support
adb has more complex port forwarding setup, also / is mounted read-only.
Make VM interface more flexible to support such cases.
2016-01-11 17:33:44 +01:00
Dmitry Vyukov
0451ffa50a qemu/kvm: improve output buffering
There seems to be some missed pieces in output.
2015-12-28 15:53:51 +01:00
Dmitry Vyukov
05b38edce2 vm/qemu: fix output reading bug
If qemu boot retries several times due to busy tcp port,
it ends up with several output reading goroutines.
That completely messes output.
2015-12-24 12:06:04 +01:00
Dmitry Vyukov
2eb388c0f8 vm: improve VM interface
Current interface is suitable only for running syz-fuzzer.
Make the interface more generic (boot, copy file, run an arbitrary command).
This allows to build other tools on top of vm package
(e.g. reproducer creation).
2015-12-23 19:12:45 +01:00
Dmitry Vyukov
8e7ca7c5ff remove master and naming overhaul
Remove master process entirely, it is not useful in its current form.
We first need to understand what we want from it, and them re-implement it.

Prefix all binaries with syz- to avoid name clashes.
2015-12-17 16:06:33 +01:00
Dmitry Vyukov
41126671ec manager: allow to run fuzzer under root 2015-12-17 14:38:46 +01:00
Dmitry Vyukov
db6bf8626d detect UBSAN error reports 2015-12-17 14:38:46 +01:00
Dmitry Vyukov
cf2089138e support kmemleak
If you set "leak":true in manager config, it will do leak checking.
It's quite slow, though. Also there seems to be false positives
and/or non-reproducible leaks.
2015-12-03 20:38:33 +01:00
Dmitry Vyukov
b1e98de8a6 fuzzer: parallel execution mode
Config now have procs parameter that controls number
of parallel executor's running in each VM.
2015-11-26 15:56:18 +01:00
Dmitry Vyukov
b0131d4eef manager: add support for suppressions
There are always some known bugs...
2015-11-20 19:58:27 +01:00
Dmitry Vyukov
d2c7f41bb0 fix ssh when you have too many keys
IdentitiesOnly=yes disables sending of irrelevant keys
2015-11-09 11:28:26 +01:00
Dmitry Vyukov
7ae6489b27 increase saved context size for crash logs
A bug can be caused by earlier programs,
so it is useful to be able to see them.
2015-11-06 21:51:19 +01:00
Dmitry Vyukov
bb15aa8bfd fix crash output 2015-11-06 21:51:19 +01:00
Dmitry Vyukov
786414e8e9 don't emit unnecessary info into crash log
This was necessary because there was a bug in log offset calculation.
Not the bug is fixed and the additional output makes it harder to grep logs.
2015-11-04 20:23:48 +01:00
Dmitry Vyukov
9c10c5a1fb fix crash report extraction from logs 2015-10-20 17:43:56 +02:00
Dmitry Vyukov
30c9c31819 refactor enabled syscall handling 2015-10-20 15:46:04 +02:00
Dmitry Vyukov
95fb739d94 aggregate vm params into a single struct (for ease of extension) 2015-10-20 15:46:04 +02:00
Dmitry Vyukov
fb190a7fb9 remove ability to execute tests in parallel in fuzzer
it consumes more memory and makes it difficult to find crashing input
2015-10-16 22:21:02 +02:00
Dmitry Vyukov
8d0aa4f7c0 improvements for kdbus 2015-10-15 17:59:01 +02:00
Dmitry Vyukov
2971d4d4e0 allow to omit -kernel flag in vm/qemu
For the case when image already contains the right kernel.
2015-10-15 17:59:01 +02:00
Dmitry Vyukov
7a72606565 allow to specify additional kernel command line arguments in vm/qemu 2015-10-15 17:59:01 +02:00
Dmitry Vyukov
874c5754bb initial commit 2015-10-12 10:16:57 +02:00