From 80c748800e07c28955c3cf696e7eda464a3f0634 Mon Sep 17 00:00:00 2001 From: Andrey Konovalov Date: Fri, 27 Oct 2017 15:09:26 +0200 Subject: docs: assorted improvements --- docs/internals.md | 3 +++ docs/linux/internals.md | 4 ++++ docs/linux/setup.md | 11 ++++++++++- docs/setup.md | 14 ++++++-------- docs/usage.md | 3 --- 5 files changed, 23 insertions(+), 12 deletions(-) create mode 100644 docs/linux/internals.md (limited to 'docs') diff --git a/docs/internals.md b/docs/internals.md index 77efb7b31..aa166adf3 100644 --- a/docs/internals.md +++ b/docs/internals.md @@ -1,5 +1,8 @@ # How syzkaller works +Below is the generic descriptions of how syzkaller works. +Check [this](linux/internals.md) for Linux kernel specific things. + ## Overview The process structure for the syzkaller system is shown in the following diagram; diff --git a/docs/linux/internals.md b/docs/linux/internals.md new file mode 100644 index 000000000..e02607626 --- /dev/null +++ b/docs/linux/internals.md @@ -0,0 +1,4 @@ +# How syzkaller works + +It's possible to fuzz some external Linux kernel interfaces with syzkaller. +Right now there's only support for [external fuzzing of the networking stack](external_fuzzing_network.md). diff --git a/docs/linux/setup.md b/docs/linux/setup.md index 7c5fffef1..2ef9114db 100644 --- a/docs/linux/setup.md +++ b/docs/linux/setup.md @@ -1,4 +1,13 @@ -# Generic setup instructions +# How to set up syzkaller + +Below are the generic instructions for how to set up syzkaller to fuzz the Linux kernel. +Instructions for a particular VM type or kernel arch can be found on these pages: + +- [Setup: Ubuntu host, QEMU vm, x86-64 kernel](setup_ubuntu-host_qemu-vm_x86-64-kernel.md) +- [Setup: Ubuntu host, Odroid C2 board, arm64 kernel](setup_ubuntu-host_odroid-c2-board_arm64-kernel.md) +- [Setup: Linux host, QEMU vm, arm64 kernel](setup_linux-host_qemu-vm_arm64-kernel.md) +- [Setup: Linux host, Android device, arm64 kernel](setup_linux-host_android-device_arm64-kernel.md) +- [Setup: Linux isolated host](setup_linux-host_isolated.md) ## Install diff --git a/docs/setup.md b/docs/setup.md index d06887bfa..c071d554d 100644 --- a/docs/setup.md +++ b/docs/setup.md @@ -1,13 +1,7 @@ -# How to install syzkaller +# How to set up syzkaller Generic setup instructions for fuzzing Linux kernel are outlined [here](linux/setup.md). -Instructions for a particular VM or kernel arch can be found on these pages: - -- [Setup: Ubuntu host, QEMU vm, x86-64 kernel](linux/setup_ubuntu-host_qemu-vm_x86-64-kernel.md) -- [Setup: Ubuntu host, Odroid C2 board, arm64 kernel](linux/setup_ubuntu-host_odroid-c2-board_arm64-kernel.md) -- [Setup: Linux host, QEMU vm, arm64 kernel](linux/setup_linux-host_qemu-vm_arm64-kernel.md) -- [Setup: Linux host, Android device, arm64 kernel](linux/setup_linux-host_android-device_arm64-kernel.md) -- [Setup: Linux isolated host](linux/setup_linux-host_isolated.md) +For other OS kernels check: [Akaros](/docs/akaros.md), [FreeBSD](/docs/freebsd.md), [Fuchsia](/docs/fuchsia.md), [NetBSD](/docs/netbsd.md), [Windows](/docs/windows.md). After following these instructions you should be able to run `syz-manager`, see it executing programs and be able to access statistics exposed at `http://127.0.0.1:56741`: @@ -26,6 +20,10 @@ $ ./bin/syz-manager -config=my.cfg 2017/06/14 16:40:35 executed 15504, cover 132403, crashes 0, repro 0 ``` +At this point it's important to ensure that syzkaller is able to collect code coverage of the executed programs +(unless you specified `"cover": false` in the config or coverage is not yet supported for the kernel you're fuzzing). +The `cover` counter on the web page should be non zero. + More information on the configuration file format is available [here](configuration.md). See [this page](troubleshooting.md) for troubleshooting tips. diff --git a/docs/usage.md b/docs/usage.md index 6925c233a..308c8583f 100644 --- a/docs/usage.md +++ b/docs/usage.md @@ -11,9 +11,6 @@ The `syz-manager` process will wind up VMs and start fuzzing in them. The `-config` command line option gives the location of the configuration file, which is [described here](configuration.md). Found crashes, statistics and other information is exposed on the HTTP address specified in the manager config. -At this point it's important to ensure that syzkaller is able to collect code coverage of the executed programs (unless you specified `"cover": false` in the config). -The `cover` counter on the web page should be non zero. - ## Crashes Once syzkaller detected a kernel crash in one of the VMs, it will automatically start the process of reproducing this crash (unless you specified `"reproduce": false` in the config). -- cgit mrf-deployment