Re: Qemu/KVM fuzzing - next steps

[Daniel P . Berrangé]

On Thu, Oct 03, 2019 at 11:58:23AM +0100, Peter Maydell wrote:
> On Thu, 3 Oct 2019 at 11:50, Darren Kenny <address@hidden> wrote:
> > How would you like to move forward? Is there an ordered list of
> > device or machines that we'd like to focus on anywhere? If not,
> > could we create one?
> 
> Roughly, "anything that can be used with KVM" is our
> security boundary, so we should start with fuzzing the
> devices and machines that can be used with it.
> QEMU has a ton of implementations of device and machine
> models that can only be used with TCG emulation, but we
> don't make any promises about guest code not being able
> to escape from a TCG-based machine, so we can leave those
> until later (if at all).

Figuring out what can be used with KVM and what is only TCG is itself
not entirely easy.

One way to identify high priority devices would be to use 'virt-install'
to create some KVM guests and look at what devices it turns on for each
host architecture that is important. I'd probably prioritize x86_64
first, then any of ppc64/aarch64/s390x after, as that reflects where
much of the KVM userbase is likely spread.

Certainly anything virtio based is going to be top, but we do also use
some non-virtio stuff fairly often. eg various graphics cards in
particular, since virtio is quite new there &:

  https://www.kraxel.org/blog/2019/09/display-devices-in-qemu/

vfio PCI passthrough is another common non-virtio device.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|