diff options
| author | Alexander Potapenko <glider@google.com> | 2025-11-21 15:34:10 +0100 |
|---|---|---|
| committer | Alexander Potapenko <glider@google.com> | 2025-11-21 17:19:12 +0000 |
| commit | b301f8dd05f04b4501b44b4b698f9e65fab533a1 (patch) | |
| tree | dda663721b1178b837ea4072591c9a5e726e1de6 /executor | |
| parent | accb0c33653744b8f36fdfea18d4d5888188b2fb (diff) | |
executor: sys/linux: implement SYZOS_API_NESTED_AMD_VMCB_WRITE_MASK
The new command allows mutation of AMD VMCB block with plain 64-bit writes.
In addition to VM ID and VMCB offset, @nested_amd_vmcb_write_mask takes
three 64-bit numbers: the set mask, the unset mask, and the flip mask.
This allows to make bitwise modifications to VMCB without disturbing
the execution too much.
Also add sys/linux/test/amd64-syz_kvm_nested_amd_vmcb_write_mask to test the
new command behavior.
Diffstat (limited to 'executor')
| -rw-r--r-- | executor/common_kvm_amd64_syzos.h | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/executor/common_kvm_amd64_syzos.h b/executor/common_kvm_amd64_syzos.h index ea9aec800..baabbef7e 100644 --- a/executor/common_kvm_amd64_syzos.h +++ b/executor/common_kvm_amd64_syzos.h @@ -32,6 +32,7 @@ typedef enum { SYZOS_API_NESTED_VMLAUNCH = 303, SYZOS_API_NESTED_VMRESUME = 304, SYZOS_API_NESTED_INTEL_VMWRITE_MASK = 340, + SYZOS_API_NESTED_AMD_VMCB_WRITE_MASK = 380, SYZOS_API_STOP, // Must be the last one } syzos_api_id; @@ -111,6 +112,7 @@ GUEST_CODE static void guest_handle_nested_load_code(struct api_call_nested_load GUEST_CODE static void guest_handle_nested_vmlaunch(struct api_call_1* cmd, uint64 cpu_id); GUEST_CODE static void guest_handle_nested_vmresume(struct api_call_1* cmd, uint64 cpu_id); GUEST_CODE static void guest_handle_nested_intel_vmwrite_mask(struct api_call_5* cmd, uint64 cpu_id); +GUEST_CODE static void guest_handle_nested_amd_vmcb_write_mask(struct api_call_5* cmd, uint64 cpu_id); typedef enum { UEXIT_END = (uint64)-1, @@ -223,6 +225,9 @@ guest_main(uint64 size, uint64 cpu) } else if (call == SYZOS_API_NESTED_INTEL_VMWRITE_MASK) { // Write to a VMCS field using masks. guest_handle_nested_intel_vmwrite_mask((struct api_call_5*)cmd, cpu); + } else if (call == SYZOS_API_NESTED_AMD_VMCB_WRITE_MASK) { + // Write to a VMCB field using masks. + guest_handle_nested_amd_vmcb_write_mask((struct api_call_5*)cmd, cpu); } addr += cmd->size; size -= cmd->size; @@ -1256,4 +1261,22 @@ guest_handle_nested_intel_vmwrite_mask(struct api_call_5* cmd, uint64 cpu_id) vmwrite(field, new_value); } +GUEST_CODE static noinline void +guest_handle_nested_amd_vmcb_write_mask(struct api_call_5* cmd, uint64 cpu_id) +{ + if (get_cpu_vendor() != CPU_VENDOR_AMD) + return; + uint64 vm_id = cmd->args[0]; + uint64 vmcb_addr = X86_SYZOS_ADDR_VMCS_VMCB(cpu_id, vm_id); + uint64 offset = cmd->args[1]; + uint64 set_mask = cmd->args[2]; + uint64 unset_mask = cmd->args[3]; + uint64 flip_mask = cmd->args[4]; + + uint64 current_value = vmcb_read64((volatile uint8*)vmcb_addr, offset); + uint64 new_value = (current_value & ~unset_mask) | set_mask; + new_value ^= flip_mask; + vmcb_write64(vmcb_addr, offset, new_value); +} + #endif // EXECUTOR_COMMON_KVM_AMD64_SYZOS_H |