nyx-fuzz / kvm-nyx Goto Github PK

I encounter KVM crash when spawning 8 instances of qemu. Core i9-12900k and 64GB of ram. I don't encounter the crash if pt tracing is disabled.

I am using KVM-Nyx on a processor that supports Intel PT.
I've installed the kernel according to the installation instructions provided here : https://intellabs.github.io/kAFL/tutorials/installation.html
And I have verified that the kafl kernel is being used

$ uname -a
Linux jay 5.10.73-kafl+ #1 SMP Fri Mar 18 13:20:22 CET 2022 x86_64 x86_64 x86_64 GNU/Linux

However, when I try to run the tests under usermode-test/, I do not see any output of the Intel PT data stream.
I compiled the tests using usermode-test/compile.sh and upon running test-verbose, the output is as follows

$ ./test_verbose

KVM-PT: CPU supports 2 IP filters!
KVM_VMX_PT_GET_TOPA_SIZE: 0x410000
KVM_EXIT_IO
KVM_EXIT_IO
KVM_EXIT_IO
KVM_EXIT_IO
KVM_EXIT_HLT (Final ToPA dump)
$

I was wondering if this was the intended result or if Intel PT is supposed to be generating some output here ?
Please advise.

I am using KVM-Nyx on Ubuntu 20.04 with a processor that supports intel-pt.
I was following the tutorial listed here: https://github.com/Kharos102/kAFL/blob/master/docs/windows_tutorial.md
Whenever I run this command,

/kAFL/qemu-5.0.0/x86_64-softmmu/qemu-system-x86_64 -machine q35 -enable-kvm -m 1024 -hda ./windows.qcow2 -cdrom ./windows.iso

the qemu binary crashes with the following error

qemu-system-x86_64: /home/blank/Downloads/kAFL/kafl/qemu/nyx/pt.c:326: pt_pre_kvm_run: Assertion `cpu->pt_mmap != (void*)0xFFFFFFFFFFFFFFFF' failed.

How should I fix this?

https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.10.73/amd64/linux-image-unsigned-5.10.73-051073-generic_5.10.73-051073.202110131013_amd64.deb

and all the links in the releases.

Hi,

I have a question regarding the size of the ToPA buffer.
I found that the value returned by the ioctl KVM_VMX_PT_GET_TOPA_SIZE is controlled by the constants TOPA_MAIN_SIZE and TOPA_FALLBACK_SIZE.

Is this value determined empirically or constrained by some other dependent factors ?