⬢ DragonFlyBSD Kernel Audit
DF-5586 / run_vk.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-5586 in-vkernel fault-storm driver: boot the vkernel with 2 vCPUs
# (real cross-CPU SIGUSR1-IPI traffic), run the guest-userland fault storm
# (intdiv/SIGFPE, ud2/SIGILL, RO-write + PROT_NONE SIGSEGV classes, plus a
# shared-mem mprotect-churn sibling), then verify the vkernel is ALIVE.
# Run on the DragonFly guest as root.
VK=/usr/obj/usr/src/sys/VKERNEL64/kernel.debug

pkill -9 -f kernel.debug 2>/dev/null; sleep 1
rm -f /tmp/vkin /tmp/vkconsole.log
mkfifo /tmp/vkin
(sleep 1200 > /tmp/vkin) &
HOLDER=$!

(
  exec 3> /tmp/vkin
  echo "ufs:vkd0" >&3
  i=1
  while [ $i -le 240 ]; do
      grep -q "Mounting root from ufs:vkd0$" /tmp/vkconsole.log 2>/dev/null && break
      sleep 1
      i=$((i+1))
  done
  sleep 15
  echo "/root/storm 500 1; echo STORM_RC=\$?" >&3
  sleep 150
  echo "echo VKDONE" >&3
) &
PUMP=$!

cd /usr/obj/usr/src/sys/VKERNEL64
./kernel.debug -m 512m -r /vkroot.img -n 2 \
    -e init_path=/bin/vkinit \
    -s < /tmp/vkin > /tmp/vkconsole.log 2>&1 &
VKPID=$!
echo "vkernel pid=$VKPID"

i=0
while [ $i -lt 400 ]; do
  grep -q "VKDONE" /tmp/vkconsole.log 2>/dev/null && break
  kill -0 $VKPID 2>/dev/null || break
  sleep 2
  i=$((i+2))
done
sleep 3
echo "=== vkernel alive? ==="
if kill -0 $VKPID 2>/dev/null; then echo "ALIVE"; else echo "DEAD"; fi
echo "=== console (from root mount) ==="
N=$(grep -an "Mounting root from ufs:vkd0$" /tmp/vkconsole.log | tail -1 | cut -d: -f1)
if [ -z "$N" ]; then N=1; fi
awk -v n="$N" 'NR>=n' /tmp/vkconsole.log | tr -d "\000" | tail -60
kill $PUMP $HOLDER 2>/dev/null
pkill -9 -f kernel.debug 2>/dev/null
exit 0