设备驱动故障注入方法的研究与实现

doi:10.3969/j.issn.1671-1122.2019.06.003

信息网络安全 ›› 2019, Vol. 19 ›› Issue (6): 19-27.doi: 10.3969/j.issn.1671-1122.2019.06.003

设备驱动故障注入方法的研究与实现

翟高寿(), 翟瑞霞, 刘峰, 李红辉

北京交通大学计算机与信息技术学院,北京 100044

收稿日期:2019-03-20 出版日期:2019-06-10 发布日期:2020-05-11
作者简介:
作者简介：翟高寿（1971—）,男,山西,副教授,博士,主要研究方向为操作系统、系统安全、系统软件;翟瑞霞（1994—）,女,山西,硕士研究生,主要研究方向为操作系统安全;刘峰（1961—）,男,山西,教授,博士,主要研究方向为网络管理、软件测试;李红辉（1964—）,女,湖南,研究员,硕士,主要研究方向为网络管理、软件测试。
基金资助:
国家重点研发计划[2016YFF0204002];教育部产学合作协同育人项目[201702025004]

Study and Implementation of Fault Injection Method for Device Drivers

Gaoshou ZHAI(), Ruixia ZHAI, Feng LIU, Honghui LI

School of Computer and Information Technology, Beijing Jiaotong University, Beijing 100044, China

Received:2019-03-20 Online:2019-06-10 Published:2020-05-11

摘要/Abstract

摘要：

文章以Linux设备驱动为研究对象,提出了一种灵活可控的基于加载时函数调用指令检测替换及运行时自动恢复与交互式再触发相结合的故障注入模型,设计并实现了相应的故障注入原型。目标驱动模块的加载监测利用了内核事件通知链机制,故障注入采用了函数调用指令检测替换方法,目标函数集的设置综合运用了Shell程序命令行参数和内核模块加载时参数传入方式,故障再触发机制利用了内核调试伪文件系统。与其他故障注入工具相比,该原型系统存储开销小,灵活性和可用性更佳,能够更加高效地进行健壮性和可靠性的测试验证。

关键词: 内核安全, 设备驱动, 故障注入, 事件通知链, 内核调试伪文件系统

Abstract:

In this paper, a flexible and controllable model of fault injection is put forward based on location and replacement of function invocation instructions at the time of module installation and based on automatic recovery and interactive re-triggering at run-time. The corresponding prototype is designed and implemented where notifier chain is used for monitoring the installation of target modules, command line arguments of Shell programs and module parameters are used comprehensively for the configuration of target functions of fault injection, and debugfs is exploited for triggering fault again. Compared with other fault injection tools, our prototype has more flexible and more controllable features in routines of triggering faults of multiple kernel functions so that robustness and dependability of kernel modules such as device drivers can be verified more effectively.

Key words: security of kernel, device drivers, fault injection, notifier chain, pseudo file system for kernel debugging

中图分类号:

TP309

翟高寿, 翟瑞霞, 刘峰, 李红辉. 设备驱动故障注入方法的研究与实现[J]. 信息网络安全, 2019, 19(6): 19-27.

Gaoshou ZHAI, Ruixia ZHAI, Feng LIU, Honghui LI. Study and Implementation of Fault Injection Method for Device Drivers[J]. Netinfo Security, 2019, 19(6): 19-27.

图/表 9

图1

表1

图2

图3

图4

图5

图6

图7

图8

参考文献 22

[1]	JABEEN S H, ZHAI Gaoshou, ZHAI Ruixia.Fault Simulation and Memory Leak Detection over Custom Kernel Module by Using KEDR[C]//SCIEIA. The 7th International Workshop on Computer Science and Engineering, June 25-27, 2017, Beijing, China. California: SCIEI, 2017: 244-248.
[2]	LUTZ R R.Analyzing Software Requirements Errors in Safety-critical, Embedded Systems[C]//IEEE. IEEE International Symposium on Requirements Engineering, January 4-6, 1993, San Diego, California, USA. New Jersey: IEEE, 1993: 126-133.
[3]	SCHMID M, GHOSH A, HILL F.Techniques for Evaluating the Robustness of Windows NT Software[C]//IEEE. DARPA Information Survivability Conference and Exposition: Discex’00, January 25-27, 2000, Hilton Head, South Carolina, USA. New Jersey: IEEE, 2000, 347-360.
[4]	HSUEH M C, TSAI T K., IYER R K.Fault Injection Techniques and Tools[J]. Computer, 1997, 30(4): 75-82.
[5]	CONG Kai, LEI Li, YANG Zhenkun, et al.Automatic Fault Injection for Driver Robustness Testing[C]//ACM. 2015 International Symposium on Software Testing and Analysis, July 14-17, 2015, Baltimore, Maryland, USA. New York: ACM, 2015: 361-372.
[6]	MA Pei, ZHAI Gaoshou.Automatic Analysis and Detection of Sensitive Codes Relating to Transient Hardware-faults for Linux Drivers[J]. Computer Engineering & Software, 2015, 36(12): 9-15.
	马培,翟高寿. 面向硬件瞬时故障的Linux设备驱动敏感代码的自动分析与检测[J]. 软件,2015,36(12):9-15.
[7]	ZHAI Gaoshou, LIU Chen, XIANG Yong.Study and Implementation of Systematic Protection by Monitoring Abnormal Invocation of Linux Kernel Functions[J]. Netinfo Security, 2018, 18(3): 26-38.
	翟高寿,刘晨,向勇. 基于内核函数监控的Linux系统防护方法的研究与实现[J]. 信息网络安全,2018,18(3):26-38
[8]	TAN Zhuo, ZHAI Gaoshou.Study and Implementation of Communication Mechanism for Non-kernel Device Drivers[J]. Netinfo Security, 2016, 16(11): 57-65.
	谭茁,翟高寿. 设备驱动非内核化通信架构的研究与实现[J]. 信息网络安全,2016,16(11):57-65.
[9]	REN Yanyan, ZHAI Gaoshou, ZHANG Junhong.Automatic Updating and Auxiliary Tools of Linux Device Drivers[J]. Computer Systems & Applications, 2018, 27(7): 211-218
	任艳艳,翟高寿,张俊红. Linux设备驱动程序自动更新及辅助工具[J]. 计算机系统应用,2018,27(7):211-218.
[10]	SUN Junzhao, WANG Jianying, YANG Xiaozong.The Present Situation for Research of Fault Injection Methodology and Tools[J]. Journal of Astronautics, 2001, 22(1): 99-104.
	孙峻朝,王建莹,杨孝宗. 故障注入方法与工具的研究现状[J]. 宇航学报,2001,22(1):99-104.
[11]	MARINESCU P D, CANDEA G.LFI: A Practical and General Library-level Fault Injector[C]//IEEE. 2009 IEEE/IFIP International Conference on Dependable Systems and Networks, June 29-July 2, 2009, Lisbon, Portugal. New Jersey: IEEE, 2009: 379-388.
[12]	NAUGHTON T, BLAND W, VALLÉE G, et al. Fault Injection Framework for System Resilience Evaluation: Fake Faults for Finding Future Failures[C]//ACM. 2009 Workshop on Resiliency in High Performance, June 9, 2009, Munich, Germany. New York: ACM, 2009: 23-28.
[13]	WANG Bo.Design and Implementation of Fault Injectors for High-end Fault-tolerant Computer[D]. Harbin: Harbin Institute of Technology, 2011.
	王波. 高端容错计算机故障注入工具的设计与实现[D]. 哈尔滨:哈尔滨工业大学,2011.
[14]	MENG Xuemei.Research of Software Fault Injection and Software Vulnerabilities Identifying[J]. Public Communication of Science & Technology, 2013, 5(24): 216-217.
	孟雪梅. 软件故障注入及软件脆弱点检测方法研究[J]. 科技传播,2013,5(24):216-217.
[15]	LV Wenjuan.Research of Software Fault Injection and Software Vulnerabilities Identifying[D]. Harbin: Harbin Institute of Technology, 2009.
	吕文娟. 软件故障注入及软件脆弱点检测方法研究[D]. 哈尔滨:哈尔滨工业大学,2009.
[16]	NIE Hongjie, DING Cheng. Linux Kernel Memory Checker: Kmemcheck[EB/OL]. , 2009-11-19.
	聂洪杰,丁成. Linux内核内存检测工具——Kmemcheck[EB/OL]. , 2009-11-19.
[17]	The Kernel Development Community. Kernel Memory Leak Detector[EB/OL]. , 2019-1-26.
[18]	SystemTap. SystemTap[EB/OL]. , 2019-1-26.
[19]	TANAKA K, HAMAGUCHI M, SATO T, et al.SCSI Fault Injection Test[C]//Linux Symposium. 2008 Linux Symposium, July 23-26, 2008, Ottawa, Ontario, Canada. Ottawa: Linux Symposium, 2008: 205-214.
[20]	RUBANOV V V, SHATOKHIN E A.Runtime Verification of Linux Kernel Modules Based on Call Interception[C]//IEEE. IEEE Fourth International Conference on Software Testing, Verification and Validation, March 21-25, 2011, Berlin, Germany. New Jersey: IEEE, 2011: 180-189.
[21]	CORBET Jonathan. Debugfs[EB/OL]. , 20192019-1-26.
[22]	XIA An, YAN Jiangyu, HUANG Jingchang.Understanding Linux Network Internals[M]. Beijing: China Electric Power Press, 2009.
	夏安,闫江毓,黄景昌,译. 深入理解LINUX网络技术内幕[M]. 北京:中国电力出版社,2009.

相关设备驱动	内核函数
字符设备驱动	__kmalloc, _copy_to_user, _copy_from_user
pcnet32网卡驱动	dma_alloc_coherent, dma_unmap_single_attrs, dma_mapping_error, dma_sync_single_for_cpu, dma_sync_single_for_device, netdev_priv, __netdev_alloc_skb, skb_put, skb_copy_to_linear_data, skb_reserve, spin_unlock_irqrestore, kmalloc_array, __napi_complete, netif_running, netif_receive_skb, netif_wake_queue, netif_tx_disable, pci_enable_device, generic_mii_ioctl
ens1371/ens1370 声卡驱动	spin_lock, frames_to_bytes, snd_pcm_trigger_done, spin_lock_irq, snd_pcm_format_width, snd_info_set_text_ops, gameport_allocate_port, __gameport_register_port, snd_pcm_new, snd_pcm_set_ops, snd_card_free, snd_pcm_add_chmap_ctls, snd_card_register, snd_device_new, snd_pcm_lib_malloc_pages, snd_ctl_add,snd_pcm_period_elapsed, snd_ac97_bus, snd_ac97_mixer
其他	krealloc, __krealloc, kmem_cache_alloc, kmem_cache_alloc_trace, kmalloc_order_trace, __get_free_pages, get_zeroed_page, __alloc_pages_nodemask, alloc_pages_exact, strndup_user, memdup_user, capable, kstrdup, kstrndup, kmemdup, posix_acl_alloc, posix_acl_from_mode, posix_acl_from_xattr, match_strdup, __posix_acl_create, __posix_acl_chmod, vmalloc, __vmalloc, vmalloc_user, vmalloc_node, vmalloc_32, vmalloc_32_user, vzalloc, vzalloc_node

设备驱动故障注入方法的研究与实现

Study and Implementation of Fault Injection Method for Device Drivers

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 9

参考文献 22

相关文章 2

编辑推荐

Metrics

本文评价

[1]	翟高寿, 刘晨, 向勇. 基于内核函数监控的Linux系统防护方法的研究与实现[J]. 信息网络安全, 2018, 18(3): 26-38.
[2]	谭茁, 翟高寿. 设备驱动非内核化通信架构的研究与实现[J]. 信息网络安全, 2016, 16(11): 57-65.