this code doesn't work on Xeon E5-1650 v4

[nemo5566]

Hi, I met some troubles when running the code on Xeon E5 cpu.

1.When I try to run the loader binary in VM, the VM didn't freeze.

Execute loader binary which is in path/to/kAFL/kAFL-Fuzzer/agents/linux_x86_64/loader/ as root VM should freeze. 

2.When I try to start the Qemu-PT as your instructions, KVM failed

./qemu-2.9.0/x86_64-softmmu/qemu-system-x86_64 -hdb /path/to/snapshot/ram.qcow2 -hda /path/to/snapshot/overlay_0.qcow2 -machine pc-i440fx-2.6 -serial mon:stdio -enable-kvm -k de -m 512

ly@ly-Precision-Tower-5810:~/kAFL$ ./qemu-2.9.0/x86_64-softmmu/qemu-system-x86_64 -hdb /home/ly/kAFL/snapshot/ram.qcow2 -hda /home/ly/kAFL/snapshot/overlay_0.qcow2 -machine pc-i440fx-2.6 -serial mon:stdio -enable-kvm -k de -m 512 KVM: entry failed, hardware error 0x7 EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000663 ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000 EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 00000000 0000ffff 00009300 CS =f000 ffff0000 0000ffff 00009b00 SS =0000 00000000 0000ffff 00009300 DS =0000 00000000 0000ffff 00009300 FS =0000 00000000 0000ffff 00009300 GS =0000 00000000 0000ffff 00009300 LDT=0000 00000000 0000ffff 00008200 TR =0000 00000000 0000ffff 00008b00 GDT= 00000000 0000ffff IDT= 00000000 0000ffff CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000000 Code=00 66 89 d8 66 e8 0c ad ff ff 66 83 c4 0c 66 5b 66 5e 66 c3 <ea> 5b e0 00 f0 30 36 2f 32 33 2f 39 39 00 fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

3.When I try to run kafl_info.py, it says "Intel PT is not supported on this CPU!". But I checked my cpuinfo, it contents the support for Inter_pt

processor : 11 vendor_id : GenuineIntel cpu family : 6 model : 79 model name : Intel(R) Xeon(R) CPU E5-1650 v4 @ 3.60GHz stepping : 1 microcode : 0xb000021 cpu MHz : 1237.640 cache size : 15360 KB physical id : 0 siblings : 12 core id : 5 cpu cores : 6 apicid : 11 initial apicid : 11 fpu : yes fpu_exception : yes cpuid level : 20 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm rdseed adx smap xsaveopt cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts bugs : bogomips : 7184.53 clflush size : 64 cache_alignment : 64 address sizes : 46 bits physical, 48 bits virtual power management:

Why the code doesn't work on my cpu?

[schumilo]

Please verify that you are using the patched 4.6.2 Linux Kernel: #7

Apart from that, it seems like your CPU is not support (it's a Broadwell CPU, right?), since the first generation of Intel PT was unable to trace VMX non-root operations. As far as I know, only Skylake and Kaby-Lake CPUs do support this feature. This kernel code checks that (14th bit in IA32_VMX_MISC):
https://github.com/RUB-SysSec/kAFL/blob/master/KVM-PT/arch/x86/kvm/vmx_pt.c#L837

[nemo5566]

Yes,I'm using the 4.6.2 Linux Kernel which is patched. But the KVM-PT is not loaded.
You're right, the cpu is a Broadwell CPU, it seems that if I have to use one of the Skylake and Kaby-Lake CPUs to run the code.
Anyway, thank you!

[gjm-anban]

hi, does 11th Gen Intel(R) Core(TM) i7-1165G7 support intel pt, I use the code but it seems not support

[il-steffen]

Can you give the output of lscpu, or at least lscpu|grep intel_pt

[gjm-anban]

Can you give the output of lscpu, or at least lscpu|grep intel_pt

[il-steffen]

Looks like you don't have intel_pt feature on this core. Also looks like you are running on a hypervisor. Using PT tracing for a nested guest is not working and the feature is not normally exposed by hypervisors. IntelLabs/kAFL#142

[gjm-anban]

Looks like you don't have intel_pt feature on this core. Also looks like you are running on a hypervisor. Using PT tracing for a nested guest is not working and the feature is not normally exposed by hypervisors. IntelLabs/kAFL#142

thanks,do you know how can I do to see whether the core supports intel pt on win10 .I can't find the way

[il-steffen]

Nope..

[gjm-anban]

or can you tell which cpu core you used that support pt

Nope..