search

compsec-snu / razzer

A Kernel fuzzer focusing on race bugs
358 stars 61 forks source link

Question about hypercall implementation in kernel_repo #18

Open c2hpxq opened 3 years ago

c2hpxq commented 3 years ago

I find nop instead of vmcall instruction in each kernel/hypercall.c

I'm not that familiar with virtualization but it seems that the hypercall implementation will never call into VMM?

Please help me with it. Do I misunderstand sth about the implementation or how should I modify it to make razzer work?

Thanks.

lifeasageek commented 3 years ago

It's our hacky custom hypercall implementation --- I don't recall, but we faced several challenges to implement a direct hypercall interface.

So what we do is following: QEMU takes kernel's hypercall address, and it keeps monitoring if the guest kernel is executing the hypercall. You can have a look at _HYPERCALL_ADDR in QEMU.

c2hpxq commented 3 years ago

It's our hacky custom hypercall implementation --- I don't recall, but we faced several challenges to implement a direct hypercall interface.

So what we do is following: QEMU takes kernel's hypercall address, and it keeps monitoring if the guest kernel is executing the hypercall. You can have a look at _HYPERCALL_ADDR in QEMU.

Oh, I see. Thanks a lot!

By the way, do you have any recommending material about QEMU&KVM? I can understand the static analysis part. However, as for your modification to QEMU... It's somewhat complicated to me but I really want to understand it in detail.

As you can tell I'm quite a newbie in VMM, so do you have any suggestion for me?

Thanks again!