executor: arm64: add SYZOS_API_HVC

Make the necessary changes to support HVC in addition to SMC.
These two may subtly differ, so they are handled separately.

3 files changed, 47 insertions, 13 deletions

diff --git a/executor/common_kvm_arm64_syzos.h b/executor/common_kvm_arm64_syzos.h
index 104a07945..9cf0aeb43 100644
--- a/executor/common_kvm_arm64_syzos.h
+++ b/executor/common_kvm_arm64_syzos.h
@@ -17,6 +17,7 @@ typedef enum {
 	SYZOS_API_CODE,
 	SYZOS_API_MSR,
 	SYZOS_API_SMC,
+	SYZOS_API_HVC,
 	SYZOS_API_STOP, // Must be the last one
 } syzos_api_id;
 
@@ -40,16 +41,17 @@ struct api_call_code {
 	uint32 insns[];
 };
 
-struct api_call_smc {
+struct api_call_smccc {
 	struct api_call_header header;
-	uint32 smc_id;
+	uint32 func_id;
 	uint64 params[5];
 };
 
 static void guest_uexit(uint64 exit_code);
 static void guest_execute_code(uint32* insns, uint64 size);
 static void guest_handle_msr(uint64 reg, uint64 val);
-static void guest_handle_smc(struct api_call_smc* cmd);
+static void guest_handle_smc(struct api_call_smccc* cmd);
+static void guest_handle_hvc(struct api_call_smccc* cmd);
 
 // Main guest function that performs necessary setup and passes the control to the user-provided
 // payload.
@@ -80,7 +82,11 @@ GUEST_CODE static void guest_main(uint64 size)
 			break;
 		}
 		case SYZOS_API_SMC: {
-			guest_handle_smc((struct api_call_smc*)cmd);
+			guest_handle_smc((struct api_call_smccc*)cmd);
+			break;
+		}
+		case SYZOS_API_HVC: {
+			guest_handle_hvc((struct api_call_smccc*)cmd);
 			break;
 		}
 		}
@@ -134,11 +140,11 @@ guest_handle_msr(uint64 reg, uint64 val)
 	    : "x0", "x30", "memory");
 }
 
-// See "SMC Calling Convention", https://documentation-service.arm.com/static/5f8ea482f86e16515cdbe3c6
-GUEST_CODE static void guest_handle_smc(struct api_call_smc* cmd)
+// See "SMC Calling Convention", https://documentation-service.arm.com/static/5f8edaeff86e16515cdbe4c6
+GUEST_CODE static void guest_handle_smc(struct api_call_smccc* cmd)
 {
 	asm volatile(
-	    "mov x0, %[smc_id]\n"
+	    "mov x0, %[func_id]\n"
 	    "mov x1, %[arg1]\n"
 	    "mov x2, %[arg2]\n"
 	    "mov x3, %[arg3]\n"
@@ -148,7 +154,7 @@ GUEST_CODE static void guest_handle_smc(struct api_call_smc* cmd)
 	    // they are ignored as per the calling convention.
 	    "smc #0\n"
 	    : // Ignore the outputs for now
-	    : [smc_id] "r"((uint32)cmd->smc_id),
+	    : [func_id] "r"((uint32)cmd->func_id),
 	      [arg1] "r"(cmd->params[0]), [arg2] "r"(cmd->params[1]),
 	      [arg3] "r"(cmd->params[2]), [arg4] "r"(cmd->params[3]),
 	      [arg5] "r"(cmd->params[4])
@@ -157,3 +163,25 @@ GUEST_CODE static void guest_handle_smc(struct api_call_smc* cmd)
 	      "x6", "x7", "x8", "x9", "x10", "x11", "x12", "x13", "x14", "x15", "x16", "x17",
 	      "memory");
 }
+
+GUEST_CODE static void guest_handle_hvc(struct api_call_smccc* cmd)
+{
+	asm volatile(
+	    "mov x0, %[func_id]\n"
+	    "mov x1, %[arg1]\n"
+	    "mov x2, %[arg2]\n"
+	    "mov x3, %[arg3]\n"
+	    "mov x4, %[arg4]\n"
+	    "mov x5, %[arg5]\n"
+	    // TODO(glider): nonzero immediate values are designated for use by hypervisor vendors.
+	    "hvc #0\n"
+	    : // Ignore the outputs for now
+	    : [func_id] "r"((uint32)cmd->func_id),
+	      [arg1] "r"(cmd->params[0]), [arg2] "r"(cmd->params[1]),
+	      [arg3] "r"(cmd->params[2]), [arg4] "r"(cmd->params[3]),
+	      [arg5] "r"(cmd->params[4])
+	    : "x0", "x1", "x2", "x3", "x4", "x5",
+	      // These registers are not used above, but may be clobbered by the HVC call.
+	      "x6", "x7", "x8", "x9", "x10", "x11", "x12", "x13", "x14", "x15", "x16", "x17",
+	      "memory");
+}
diff --git a/sys/linux/dev_kvm.txt b/sys/linux/dev_kvm.txt
index b5c019ec7..3a8403eb5 100644
--- a/sys/linux/dev_kvm.txt
+++ b/sys/linux/dev_kvm.txt
@@ -258,16 +258,16 @@ syzos_api_msr {
 	arg_value	int64
 }
 
-# Based on the "SMC Calling Convention" doc, https://documentation-service.arm.com/static/5f8ea482f86e16515cdbe3c6
+# Based on the "SMC Calling Convention" doc, https://documentation-service.arm.com/static/5f8edaeff86e16515cdbe4c6
 # Bit 31 is Standard (0) / Fast Call (1)
 # Bit 30 is SMC32 (0) / SMC64 (1)
 # Bits 29:24 denote the owning entity (relevant constants below are 0x01000000-0x3f000000
 # Bits 23:16 are ignored (must be zero in most cases)
 # Bits 15:0 denote the function number (0-0xffff) within the specified range, so we list all the possible bit values
 # here and hope that the fuzzer will be able to combine them into a number.
-kvm_smc_id = 0x80000000, 0x40000000, 0x1000000, 0x2000000, 0x3000000, 0x4000000, 0x30000000, 0x31000000, 0x32000000, 0x3f000000, 0x0, 0x1, 0x2, 0x4, 0x8, 0x10, 0x20, 0x40, 0x80, 0x100, 0x200, 0x400, 0x800, 0x1000, 0x2000, 0x4000, 0x8000, 0xffff
+kvm_smc_id = 0x80000000, 0x40000000, 0x1000000, 0x2000000, 0x3000000, 0x4000000, 0x5000000, 0x6000000, 0x30000000, 0x31000000, 0x32000000, 0x3f000000, 0x0, 0x1, 0x2, 0x4, 0x8, 0x10, 0x20, 0x40, 0x80, 0x100, 0x200, 0x400, 0x800, 0x1000, 0x2000, 0x4000, 0x8000, 0xffff
 
-syzos_api_smc {
+syzos_api_smccc {
 	arg_id		flags[kvm_smc_id, int32]
 	arg_params	array[int64, 5]
 }
@@ -282,7 +282,8 @@ syzos_api_call [
 	uexit	syzos_api[0, intptr]
 	code	syzos_api[1, syzos_api_code]
 	msr	syzos_api[2, syzos_api_msr]
-	smc	syzos_api[3, syzos_api_smc]
+	smc	syzos_api[3, syzos_api_smccc]
+	hvc	syzos_api[4, syzos_api_smccc]
 ] [varlen]
 
 kvm_text_ppc64 {
diff --git a/sys/linux/test/syz_kvm_setup_cpu_arm64-smc b/sys/linux/test/syz_kvm_setup_cpu_arm64-smc
index 1d319494d..cb577a07a 100644
--- a/sys/linux/test/syz_kvm_setup_cpu_arm64-smc
+++ b/sys/linux/test/syz_kvm_setup_cpu_arm64-smc
@@ -11,5 +11,10 @@ r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0)
 ioctl$KVM_SET_DEVICE_ATTR_vm(r1, AUTO, &AUTO=@attr_arm64={0x0, 0x0, 0x0, &AUTO={0xef000000, 0x1000, 0x2, ""}})
 
 r2 = ioctl$KVM_CREATE_VCPU(r1, AUTO, 0x0)
-syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &AUTO=[{0x0, &AUTO=[@smc={AUTO, AUTO, {0xef000000, [0x0, 0x1, 0x2, 0x3, 0x4]}}], AUTO}], 0x1, 0x0, 0x0, 0x0)
+syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &AUTO=[{0x0, &AUTO=[@smc={AUTO, AUTO, {0xef000000, [0x0, 0x1, 0x2, 0x3, 0x4]}}, @hvc={AUTO, AUTO, {0xef000000, [0x0, 0x1, 0x2, 0x3, 0x4]}}], AUTO}], 0x1, 0x0, 0x0, 0x0)
+
+#
+# Run twice, because both SMC and HVC will exit.
+#
+ioctl$KVM_RUN(r2, AUTO, 0x0)
 ioctl$KVM_RUN(r2, AUTO, 0x0)