RVCK-Project · jiewu9823 · Jul 21, 2026 · May 22, 2026
diff --git a/lava-job-template/qemu/qemu-syzkaller.yaml b/lava-job-template/qemu/qemu-syzkaller.yaml
@@ -0,0 +1,103 @@
+# Your first LAVA JOB definition for an riscv_64 QEMU
+device_type: qemu
+job_name: ${job_name}
+timeouts:
+  job:
+    minutes: 10150
+  action:
+    minutes: 10140
+  connection:
+    minutes: 10
+priority: medium
+visibility: public
+# context allows specific values to be overridden or included
+context:
+  # tell the qemu template which architecture is being tested
+  # the template uses that to ensure that qemu-system-riscv64 is executed.
+  arch: riscv64
+  machine: virt
+  guestfs_interface: virtio
+  extra_options:
+    - -machine virt
+    - -nographic
+    - -smp 8
+    - -m 8G
+    - -device virtio-blk-device,drive=hd0
+    - -device virtio-blk-device,drive=hd1
+    - -append "root=/dev/vda rw console=ttyS0 selinux=0"
+    - -device virtio-net-device,netdev=usernet
+    - -netdev user,id=usernet,hostfwd=tcp::10001-:22
+metadata:
+  # please change these fields when modifying this job for your own tests.
+  format: Lava-Test Test Definition 1.0
+  name: qemu-riscv64-test
+  description: "test for riscv64 qemu"
+  version: "1.0"
+# ACTION_BLOCK
+actions:
+# DEPLOY_BLOCK
+- deploy:
+    timeout:
+      minutes: 20
+    to: tmpfs
+    images:
+      kernel:
+        image_arg: -kernel {kernel}
+        url: ${kernel_image_url}
+      rootfs:
+        image_arg: -drive file={rootfs},format=raw,id=hd0,if=none
+        url: ${rootfs_image_url}
+        compression: zstd
+      data_disk:
+        image_arg: -drive file={data_disk},format=raw,id=hd1,if=none
+        url: ${data_disk_url}
+        compression: zstd
+
+# BOOT_BLOCK
+- boot:
+    timeout:
+      minutes: 20
+    method: qemu
+    media: tmpfs
+    prompts: ["root@riscv64"]
+    auto_login:
+      login_prompt: "riscv64 login:"
+      username: root
+      password_prompt: "Password:"
+      password: openEuler12#$
+
+# TEST_BLOCK: 准备kexec切换所需的内核及软件包
+- test:
+    timeout:
+      minutes: 10100
+    definitions:
+    - from: git
+      name: ${testitem_name}
+      path: ${testcase_path}
+      repository: ${testcase_repo}
+
+# SECOND_BOOT_BLOCK: 热启动切换新内核
+- boot:
+    timeout:
+      minutes: 60
+    method: kexec
+    boot_message: "Bye..."
+    kernel: /build/linux-build/arch/riscv/boot/Image   # 虚拟机内编译的内核地址
+    prompts: ["root@riscv64"]
+    auto_login:
+      login_prompt: "riscv64 login:"
+      username: root
+      password_prompt: "Password:"
+      password: openEuler12#$
+
+# HEARTBEAT_BLOCK: 在新内核中运行心跳监控
+- test:
+    timeout:
+      minutes: 10010
+    definitions:
+    - from: git
+      name: ${testitem_name}
+      path: ${testcase_path}
+      repository: ${testcase_repo}
+      parameters:
+          HOURS: "24"  # fuzzing时长
diff --git a/lava-testcases/security-test/syzkaller/README.md b/lava-testcases/security-test/syzkaller/README.md
@@ -0,0 +1,4 @@
+使用 syzkaller 对 Linux 内核进行模糊测试时，需启用 CONFIG_KCOV=y（覆盖率收集）和 CONFIG_KASAN=y（内存错误检测）等必要配置。
+
+当前测试流程为：先在虚拟机中编译目标内核，再直接加载并切换至新内核进行测试。
+然而，目前 OERV 的 kernel+rootfs 通过kexec加载并切换至新内核仅支持 QEMU 环境，在其他真实硬件上执行内核切换均会失败，详见https://github.com/RVCK-Project/lavaci/pull/42。
diff --git a/lava-testcases/security-test/syzkaller/make_kernel.sh b/lava-testcases/security-test/syzkaller/make_kernel.sh
@@ -0,0 +1,122 @@
+# 加载数据盘
+load_disk(){
+  DISK=/dev/vdb
+  PART=${DISK}1
+  MNT=/build
+
+  # 1. 分区并格式化
+  parted -s $DISK mklabel gpt
+  parted -s $DISK mkpart primary ext4 0% 100%
+  mkfs.ext4 -F $PART
+
+  # 2. 挂载并写入fstab（重启生效）
+  mkdir -p $MNT
+  UUID=$(blkid -s UUID -o value $PART)
+  echo "UUID=$UUID $MNT ext4 defaults,noatime 0 2" >> /etc/fstab
+  mount -a
+
+  # 3. 验证
+  df -h $MNT
+}
+
+KERNEL_SRC=/usr/src/linux-$(uname -r)
+KERNEL_DEST=/build/linux-build
+
+
+#编译内核
+make_kernel(){
+  mkdir -p $KERNEL_DEST
+  dnf install -y kernel-source
+  dnf install -y gcc make flex bison openssl-devel elfutils-libelf-devel \
+               perl python3 bc dwarves cpio gzip tar xz util-linux
+  cd $KERNEL_SRC
+  make ARCH=riscv -C $KERNEL_SRC mrproper
+  # 生成默认配置
+  zcat /proc/config.gz > $KERNEL_DEST/.config
+  FILE="$KERNEL_SRC/drivers/acpi/pci_mcfg.c"
+
+  sed -i \
+	      -e 's/^#ifdef CONFIG_RISCV$/#ifdef CONFIG_PCIE_DW_SOPHGO/' \
+	          -e 's|^#endif /\* RISCV \*/$|#endif /* CONFIG_PCIE_DW_SOPHGO */|' \
+		      "$FILE"
+
+  # 进行内存fuzzing测试需要开启的配置项
+  # === 基础与覆盖率（Syzkaller 核心依赖）===
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --disable KVM
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable KCOV
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable DEBUG_INFO
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable DEBUG_INFO_DWARF4
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable KALLSYMS
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable KALLSYMS_ALL
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable DEBUG_FS          # KCOV/故障注入运行时接口
+
+  # === 命名空间隔离（Syzkaller 沙箱必需）===
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable NAMESPACES
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable USER_NS
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable NET_NS
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable PID_NS
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable UTS_NS
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable IPC_NS
+
+  # === 沙箱文件系统依赖（必须全部内置=y）===
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable BINFMT_MISC       # 解决 mount(binfmt_misc) failed
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable TMPFS             # 沙箱临时文件系统
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable TMPFS_XATTR       # 沙箱文件属性隔离必需
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable DEVTMPFS          # /dev 设备节点自动创建
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable PROC_FS           # /proc 进程信息
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable SYSFS             # /sys 内核对象
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable CGROUPS           # 资源限制隔离
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable MEMCG             # 内存cgroup，防OOM拖垮宿主机
+
+  # === 内存安全检测 ===
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable KASAN
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable KASAN_INLINE
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable UBSAN
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --disable UBSAN_ALIGNMENT  #rv下开启UBSAN，THP（Transparent Huge Pages）与 UBSAN 冲突
+
+  # === 栈回溯与内嵌配置 ===
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable IKCONFIG
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable IKCONFIG_PROC
+
+  # === eBPF 测试支持 ===
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable BPF_SYSCALL
+  $KERNEL_SRC/scripts/config --file $KERNEL_DEST/.config --enable BPF_JIT
+
+  # 修改完成后更新配置
+  make ARCH=riscv -C $KERNEL_SRC O=$KERNEL_DEST olddefconfig
+  # 编译
+  KBUILD_BUILD_USER=builder KBUILD_BUILD_HOST=openEuler make ARCH=riscv -C $KERNEL_SRC O=$KERNEL_DEST -j$(nproc) Image modules
+  ls $KERNEL_DEST/arch/riscv/boot/Image $KERNEL_DEST/vmlinux
+  #dnf install -y sshpass
+  #sshpass -p 'openEuler12#$' scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $KERNEL_DEST/arch/riscv/boot/Image 10.20.237.128:/opt
+  #sshpass -p 'openEuler12#$' scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $KERNEL_DEST/vmlinux 10.20.237.128:/opt
+}
+
+#准备kexec启动
+kexec_prep(){
+  #dnf install -y kexec-tools
+  cd /build
+  dnf install -y git gcc make autoconf automake libtool zlib-devel xz-devel bison flex git pkgconfig
+  git clone https://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git
+  cd kexec-tools
+  ./bootstrap
+  ./configure --host=riscv64-linux-gnu
+  make -j$(nproc)
+  # 替换系统自带的 kexec
+  cp /build/kexec-tools/build/sbin/kexec /sbin/kexec
+  kexec --version
+  #查看系统资源
+  df -h
+  free -h
+}
+
+echo "qemu下挂载数据盘"
+if [ "$(systemd-detect-virt)" == "qemu" ]; then
+  load_disk
+fi
+
+echo "编译内核"
+make_kernel
+
+echo "下载kexec-tools软件包"
+kexec_prep
diff --git a/lava-testcases/security-test/syzkaller/make_kernel.yaml b/lava-testcases/security-test/syzkaller/make_kernel.yaml
@@ -0,0 +1,18 @@
+metadata:
+  name: make_kernel
+  format: "Lava-Test Test Definition 1.0"
+  description: "Run fio on RISC-V device"
+  maintainer:
+    - zhangju@iscas.ac.cn
+  os:
+    - openEuler-riscv64
+  scope:
+      - security
+  devices:
+    - qemu
+run:
+  steps:
+    - cd lava-testcases/security-test/syzkaller
+    - bash make_kernel.sh
+    - chmod +x ../../utils/send-to-lava.sh
+    - ../../utils/send-to-lava.sh ./output/result.txt