A hardware-assisted virtualization instruction emulation error detection method and system

Abstract

The application discloses a hardware-assisted virtualization instruction error detection method and system. The method is as follows: two hosts with the same configuration are selected, and a Qemu system is installed on each host to build a Qemu virtual machine, and a KVM system is installed on each host to build a KVM virtual machine; when the Qemu virtual machine is running, a Qemu virtual machine running snapshot is saved at a fixed time; when an exception occurs in the Qemu virtual machine, the Qemu virtual machine and the KVM virtual machine are simultaneously restored to the position of the last snapshot; a program is synchronously executed in the Qemu virtual machine and the KVM virtual machine in units of basic blocks, a snapshot of the Qemu virtual machine is created before execution, an instruction basic block being executed is monitored, and a position of an error occurrence is detected; a basic block in which the error occurs is determined according to the position of the error occurrence, and then the Qemu virtual machine and the KVM virtual machine are simultaneously started from the last basic block snapshot of the Qemu virtual machine, and an instruction position of the error occurrence is detected.

Description

Technical Field

[0001] This invention belongs to the field of computer science and technology, specifically relating to a hardware-assisted method and system for detecting virtualization instruction simulation errors. This invention, through hardware assistance, synchronizes actual instruction blocks and individual instructions to detect instruction simulation errors on the virtualization hardware platform, quickly locates the error's position, reports the cause of the error, and assists in manually repairing the virtualization platform's simulation rules to achieve correct instruction simulation and ensure the normal operation of the virtualized program. Background Technology

[0002] Virtualization-based dynamic analysis is a crucial technique for binary program analysis. Currently, virtualization-based analysis is primarily conducted using the hardware emulator Qemu. Qemu employs a dynamic decoding mechanism, translating the instructions of the virtualized CPU into executable target instruction code through stages such as disassembly, intermediate language parsing, and target instruction translation. However, due to the complexity of CPU instructions and the inevitable errors that occur during the manual rule-making process, Qemu suffers from numerous instruction simulation problems, leading to program malfunctions and system crashes. Traditional instruction simulation error detection mainly relies on manual debugging or fuzzing, which is time-consuming and prone to false positives, failing to meet the requirements for instruction simulation error detection under complex CPU instruction conditions.

[0003] Current instruction simulation error detection techniques typically employ the following methods:

[0004] 1. Manually analyzed instruction simulation error detection

[0005] Manual analysis-based instruction simulation error detection is a traditional approach. It involves cross-checking among developers to identify errors in the simulated instructions, or observing crashes during program execution and then manually reproducing the process to locate and analyze the errors. However, this manual analysis method is technically demanding and time-consuming, making it unsuitable for large-scale instruction detection.

[0006] 2. Instruction simulation error detection based on fuzzing

[0007] Instruction simulation error detection based on fuzzing is a widely used method. Developers write an instruction generator to randomly generate instructions and run them in Qemu. By observing the anomalies generated by the system, instruction simulation errors are detected. The main problem with this method is that CPU instruction addressing modes and operands are complex and dependent on program context. Fuzzing cannot construct program context, so in many cases, anomalies caused by a lack of context are easily mistaken for instruction simulation errors. The subsequent analysis based on fuzzing also relies on manual analysis. While its effectiveness is better than direct manual analysis, it has limitations in terms of both technology and time complexity.

[0008] In summary, the main drawback of current methods for extracting program API behavior monitoring information is that the difficulty in constructing the context and locating erroneous instructions results in high time complexity and manual costs for existing analysis methods, making it difficult to achieve instruction simulation error detection for large-scale complex instruction sets. Summary of the Invention

[0009] To address the issue that existing Qemu system hardware virtualization technology requires writing translation rules for each virtualized instruction individually, which can easily lead to errors and system crashes, this invention aims to provide a hardware-assisted virtualization instruction simulation error detection method and system. This method constructs a hardware-supported virtual machine (KVM) and simultaneously verifies the correctness of the Qemu virtual machine program simulation while running the virtual machine program. It quickly locates errors in the Qemu virtual machine instruction simulation process, rapidly pinpointing and reporting the location and conditions of these errors. This method effectively improves the efficiency and accuracy of Qemu virtual machine instruction simulation error detection.

[0010] The technical solution of this invention is as follows:

[0011] A hardware-assisted virtualization instruction simulation error detection method, comprising the following steps:

[0012] Since both Qemu and KVM are Linux-based virtualization systems, this invention selects two hosts with identical configurations, one with Qemu installed and the other with KVM installed. The same operating system and software are installed in both virtualization systems (hereinafter referred to as Qemu virtual machine and KVM virtual machine). The instruction execution program will be synchronized in these two virtual machines.

[0013] • While the Qemu virtual machine is running, save snapshots of the Qemu virtual machine at regular intervals;

[0014] • When a program inside the Qemu virtual machine encounters an error, both the Qemu and KVM virtual machines will be restored to their most recent snapshot positions.

[0015] • The program is executed synchronously in both the Qemu and KVM virtual machines, using basic blocks as the unit. Before each basic block is executed, the Qemu virtual machine creates a snapshot, monitors the running instruction basic blocks, and detects the location of errors. The basic block where the error occurred can be identified here, denoted as BasicBlock. Error ;

[0016] After identifying the erroneous basic block, start Qemu and KVM simultaneously, using the most recent basic block snapshot of the Qemu virtual machine as the starting point. Execute commands synchronously on both virtual machines, analyzing the BasicBlock. Error The instructions in the code detect the location of the error.

[0017] Furthermore, a controllable virtual machine is constructed based on hardware virtualization on a hardware system with the same configuration as the hardware emulated by Qemu, and the instruction execution program is synchronized. The purpose of the comparison is to detect errors in the instruction emulation of the Qemu virtual machine. The method is to install the modified KVM virtual machine of this invention on a host with the same hardware configuration as the hardware emulated by Qemu, and run the same operating system as Qemu.

[0018] Furthermore, the modified KVM virtual machine requires modifications to the KVM image loading, emulation execution startup, and shutdown mechanisms. The method involves changing Qemu's direct modification of software-emulated virtual registers such as EIP and CS (Code Segment) to a method based on Intel CPU privileged instructions that modify the MSR register to set the hardware CPU's EIP and CS registers, enabling KVM to load images generated by Qemu. It also requires setting the SingleStep flag in the hardware CPU's virtual execution state based on the MSR register, allowing it to monitor the execution of basic blocks and instructions. Based on Intel VT technology, in the KVM virtual machine, the CPU EIP and CS register values ​​at the start of execution can be directly set by modifying the MSR register, ensuring that the KVM virtual machine starts running from the specified instruction location.

[0019] Furthermore, the phrase "saving Qemu virtual machine runtime snapshots periodically while the Qemu virtual machine is running" refers to capturing the entire virtual machine's registers, interrupts, exceptions, and memory state at specific time intervals during Qemu's operation and saving them to a snapshot file. The snapshot time interval can be configured by the user.

[0020] Furthermore, the phrase "restoring the program and virtual machine to the snapshot position when an exception occurs" refers to extracting the most recently saved Qemu system snapshot after the program running Qemu crashes or the system crashes (blue screen).

[0021] Furthermore, the step of simultaneously running basic blocks in the virtual machine and the synchronous execution program to detect the location of errors, using basic blocks as units, refers to starting with the most recently saved Qemu system snapshot. Qemu and KVM are loaded and started simultaneously. A system snapshot is captured at the beginning of each basic block, and the register and memory contents modified by the CPUs of KVM and Qemu during the execution of the basic block are compared at the beginning and end to determine if they are consistent. If they are inconsistent, it indicates that there is an error in Qemu's instruction emulation. Since both virtual machines start from the same snapshot and only compare a small segment of the execution process after the snapshot, the consistency of the running process can be guaranteed.

[0022] Furthermore, the step of determining the basic block and then running it on an instruction-by-instruction basis in the virtual machine and synchronous execution program to detect the instruction that caused the error refers to, after identifying the basic block where the error occurred, starting from a snapshot of that basic block, loading and running it in Qemu and KVM, and comparing the changes in CPU registers and memory after executing each instruction. If the same instruction produces different register and memory changes after execution in Qemu and KVM, it is considered that the instruction simulating the error has been located, and the instruction EIP, instruction disassembly, and error comparison data are extracted and reported.

[0023] A hardware-assisted virtualization instruction simulation error detection system, characterized in that it includes a first host and a second host with identical configurations, wherein:

[0024] The first host is equipped with the Qemu system to build a Qemu virtual machine, and the second host is equipped with the KVM system to build a KVM virtual machine; the same operating system and software are installed in both the Qemu system and the KVM system.

[0025] The first host is used to periodically save snapshots of the Qemu virtual machine during runtime. When an exception occurs in the program inside the Qemu virtual machine, the host restores the Qemu virtual machine to the most recent snapshot position based on the saved snapshot information. Then, the host executes the program in the Qemu virtual machine in units of basic blocks. Before each basic block is executed, the Qemu virtual machine creates a snapshot, monitors the running instruction basic blocks, and detects the location of the error. Based on the detected error location, the host determines the basic block (BasicBlock) where the error occurred. ErrorThen, starting from the most recent basic block snapshot of the Qemu virtual machine, the Qemu virtual machine is started, and basic blocks (BasicBlocks) are run on the Qemu virtual machine in units of instructions. Error Instructions in the text;

[0026] The second host is used to restore the KVM virtual machine to the most recent snapshot position based on the saved snapshot information when an exception occurs in the program inside the Qemu virtual machine; then execute the program in the KVM virtual machine in units of basic blocks; and determine the basic block BasicBlock where the error occurred based on the location of the error detected by the Qemu virtual machine. Error Then, starting with the most recent basic block snapshot of the Qemu virtual machine, start the KVM virtual machine and run the basic block BasicBlock on the KVM virtual machine in units of instructions. Error The instructions in the text.

[0027] The advantages and positive effects of this invention are as follows:

[0028] This invention, based on hardware support (KVM uses Intel PT virtualization technology to actually execute instructions), can automatically locate the position of instruction simulation errors. This method eliminates the need for programmers to manually locate or analyze code, boasts high accuracy, and provides support for virtualization system development. Attached Figure Description

[0029] Figure 1 This is a system structure diagram of a hardware-assisted virtualization instruction simulation error detection method according to the present invention.

[0030] Figure 2 This is a flowchart illustrating the logic of a hardware-assisted virtualization instruction simulation error detection method according to the present invention. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0032] Appendix Figure 1 This is a structural diagram of a hardware-assisted virtualization instruction simulation error detection method, described in detail below:

[0033] 1) The system consists of two parts: a Qemu virtual machine, which is the virtual machine used in this invention to detect instruction simulation errors; and a KVM virtual machine, which uses Intel PT technology to run simulations using hardware-supported instructions, providing benchmark information for Qemu instruction comparison.

[0034] 2) Qemu virtual machine emulates a set of virtualized hardware. KVM mainly selects the same CPU type and memory size as this virtualized hardware. If other peripherals differ, it will not affect the accuracy of instruction emulation.

[0035] 3) Both systems rely on Qemu snapshot information to ensure that the two virtual machines start in the same state. Only Qemu saves snapshots, and KVM uses Qemu snapshots to load and execute each time.

[0036] Appendix Figure 2 This is a system flowchart for a hardware-assisted virtualization instruction simulation error detection method. The specific steps are described below:

[0037] 1) Because Qemu and KVM images are incompatible, the reason is that KVM uses a different state recovery method when loading an image than Qemu. This invention modifies the KVM state recovery function by reading and writing the VMCS register and simultaneously writing video memory information, enabling KVM to recover its runtime state based on a Qemu snapshot. Proceed to step 2);

[0038] 2) Based on Qemu, create a hard disk image, use the hard disk image to boot, install the operating system and application software, and proceed to step 3);

[0039] 3) After Qemu has finished installing the operating system and application software, create an initial system snapshot. Proceed to step 4);

[0040] 4) Copy the Qemu disk image. During troubleshooting, KVM will use the image and snapshot provided by Qemu to boot; proceed to step 5).

[0041] 5) The user configures the snapshot capture interval. Proceed to step 6);

[0042] 6) During operation, Qemu continuously creates snapshots according to the user-configured time intervals. This continues until a program in Qemu encounters an error or the operating system in Qemu crashes with a blue screen. Proceed to step 7).

[0043] 7) After Qemu encounters an error, locate the most recent snapshot of Qemu. Boot both KVM and Qemu based on the disk image and the snapshot simultaneously. Proceed to step 8);

[0044] 8) Create a new snapshot before executing each basic block, and synchronously compare the running results of Qemu and KVM. If there is no difference, proceed to the comparison of the next basic block; if there is a difference, proceed to step 9).

[0045] 9) Load snapshots of the basic blocks before execution using Qemu and KVM, and synchronously compare the results of each instruction executed thereafter until an instruction erroneous is found. Collect instruction information and generate a report. This comparison can be performed manually by observing the execution on both machines. Alternatively, the execution log can be output to a file, and a comparison program can be run on a third-party machine to detect differences in the execution locations of the EIP in the Qemu and KVM virtual machines.

[0046] This invention proposes a hardware-assisted virtualization instruction simulation error detection method. It synchronizes actual instruction blocks and individual instructions to detect instruction simulation errors in the virtualization hardware platform. By detecting these errors, it quickly generates corresponding execution rules, corrects the simulation rules of the virtualization platform, and achieves correct instruction simulation, ensuring the normal operation of the virtualized program. This method rapidly detects erroneous instructions in the virtual machine without human intervention, thereby significantly improving the instruction simulation capabilities of the virtual machine.

[0047] Although specific embodiments and accompanying drawings of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments and drawings, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A hardware-assisted virtualization instruction simulation error detection method, comprising the following steps: Select two hosts with identical configurations. Install the Qemu system on the first host to build a Qemu virtual machine, and install the KVM system on the second host to build a KVM virtual machine. The same operating system and software are installed in both the Qemu and KVM systems. During the runtime of the Qemu virtual machine, save snapshots of the Qemu virtual machine at regular intervals; When an error occurs in the program inside the Qemu virtual machine, the Qemu virtual machine and the KVM virtual machine are restored to the most recent snapshot position based on the saved snapshot information. The program is executed synchronously in the Qemu virtual machine and the KVM virtual machine, with basic blocks as the unit. Before each basic block is executed, the Qemu virtual machine creates a snapshot, monitors the running instruction basic blocks, and detects the location of errors. The method for detecting the location of errors is as follows: taking the most recently saved Qemu virtual machine snapshot as the starting point, the Qemu virtual machine and the KVM virtual machine are loaded and started simultaneously. A system snapshot is captured at the beginning of each basic block. At the beginning and end of the execution of the basic block, the register and memory contents modified by the CPUs of the KVM virtual machine and the Qemu virtual machine during the execution of the basic block are compared to see if they are consistent. If they are inconsistent, it is determined that there is an error in the instruction simulation of the Qemu virtual machine and the location of the error is determined. The basic block (BasicBlock) that caused the error is determined based on the location of the detected error. Error Then, starting from the most recent basic block snapshot of the Qemu virtual machine, both the Qemu and KVM virtual machines are started simultaneously. The process is then executed synchronously on both the Qemu and KVM virtual machines, in units of instructions, to detect the basic block (BasicBlock). Error The location of the instruction where the error occurred.

2. The method according to claim 1, characterized in that, The KVM virtual machine uses Intel CPU privileged instructions and modifies the MSR register to set the EIP and CS of the hardware CPU, enabling the KVM virtual machine to load images generated by Qemu. The state recovery function of the KVM virtual machine is modified by reading and writing the VMCS register and simultaneously writing video memory information, so that the KVM virtual machine can recover its running state based on Qemu snapshots.

3. The method according to claim 1 or 2, characterized in that, A Qemu virtual machine runtime snapshot includes Qemu virtual machine register information, interrupt information, exception information, and memory state information.

4. The method according to claim 1 or 2, characterized in that, When an exception occurs in a program inside the Qemu virtual machine, it means that the program running on the Qemu virtual machine crashes or the system displays a blue screen.

5. The method according to claim 1 or 2, characterized in that, The method for detecting the instruction location where the error occurred is as follows: Qemu virtual machine and KVM virtual machine load and run BasicBlock. Error The changes in CPU registers and memory are compared after executing each instruction. If the changes in registers and memory are different after executing the same instruction on Qemu virtual machine and KVM virtual machine, it is considered that the instruction location of the simulated error has been located, and the instruction EIP, instruction disassembly, and error comparison data are extracted and reported.

6. A hardware-assisted virtualization instruction simulation error detection system, characterized in that, Including a first host and a second host with identical configurations, wherein: The first host is equipped with the Qemu system to build a Qemu virtual machine, and the second host is equipped with the KVM system to build a KVM virtual machine; the same operating system and software are installed in both the Qemu system and the KVM system. The first host is used to periodically save snapshots of the Qemu virtual machine during runtime. When an exception occurs in the program inside the Qemu virtual machine, the host restores the Qemu virtual machine to the most recent snapshot position based on the saved snapshot information. Then, the host executes the program in the Qemu virtual machine in units of basic blocks. Before each basic block is executed, the Qemu virtual machine creates a snapshot, monitors the running instruction basic blocks, and detects the location of the error. Based on the detected error location, the host determines the basic block (BasicBlock) where the error occurred. Error Then, starting from the most recent basic block snapshot of the Qemu virtual machine, the Qemu virtual machine is started, and basic blocks (BasicBlocks) are run on the Qemu virtual machine in units of instructions. Error The method for detecting the location of the error is as follows: starting from the most recently saved Qemu virtual machine snapshot, the Qemu virtual machine and the KVM virtual machine are loaded and started simultaneously. A system snapshot is captured at the beginning of each basic block. At the beginning and end of the execution of the basic block, the register and memory contents modified by the CPUs of the KVM virtual machine and the Qemu virtual machine during the execution of the basic block are compared to see if they are consistent. If they are inconsistent, it is determined that there is an error in the instruction simulation of the Qemu virtual machine and the location of the error is determined. The second host is used to restore the KVM virtual machine to the most recent snapshot position based on the saved snapshot information when an exception occurs in the program inside the Qemu virtual machine; then execute the program in the KVM virtual machine in units of basic blocks; and determine the basic block BasicBlock where the error occurred based on the location of the error detected by the Qemu virtual machine. Error Then, starting with the most recent basic block snapshot of the Qemu virtual machine, start the KVM virtual machine and run the basic block BasicBlock on the KVM virtual machine in units of instructions. Error The instructions in the text.

7. The system according to claim 6, characterized in that, The KVM virtual machine uses Intel CPU privileged instructions and modifies the MSR register to set the EIP and CS of the hardware CPU, enabling the KVM virtual machine to load images generated by Qemu. The state recovery function of the KVM virtual machine is modified by reading and writing the VMCS register and simultaneously writing video memory information, so that the KVM virtual machine can recover its running state based on Qemu snapshots.

8. The system according to claim 6, characterized in that, A Qemu virtual machine runtime snapshot includes Qemu virtual machine register information, interrupt information, exception information, and memory state information.

Images