executor: sys/linux: arm64: implement SYZOS_API_MEMWRITE

The new API call will be used to write values to guest memory specified
by base+offset.

Writing to e.g. MMIO registers for VGIC (or any other MMIO ranges) may
result in new coverage.

3 files changed, 67 insertions, 0 deletions

diff --git a/executor/common_kvm_arm64_syzos.h b/executor/common_kvm_arm64_syzos.h
index 183e35342..0f11a7b00 100644
--- a/executor/common_kvm_arm64_syzos.h
+++ b/executor/common_kvm_arm64_syzos.h
@@ -19,6 +19,7 @@ typedef enum {
 	SYZOS_API_SMC,
 	SYZOS_API_HVC,
 	SYZOS_API_IRQ_SETUP,
+	SYZOS_API_MEMWRITE,
 	SYZOS_API_STOP, // Must be the last one
 } syzos_api_id;
 
@@ -54,12 +55,21 @@ struct api_call_irq_setup {
 	uint32 nr_spis;
 };
 
+struct api_call_memwrite {
+	struct api_call_header header;
+	uint64 base_addr;
+	uint64 offset;
+	uint64 value;
+	uint64 len;
+};
+
 static void guest_uexit(uint64 exit_code);
 static void guest_execute_code(uint32* insns, uint64 size);
 static void guest_handle_msr(uint64 reg, uint64 val);
 static void guest_handle_smc(struct api_call_smccc* cmd);
 static void guest_handle_hvc(struct api_call_smccc* cmd);
 static void guest_handle_irq_setup(struct api_call_irq_setup* cmd);
+static void guest_handle_memwrite(struct api_call_memwrite* cmd);
 
 typedef enum {
 	UEXIT_END = (uint64)-1,
@@ -107,6 +117,10 @@ GUEST_CODE static void guest_main(uint64 size)
 			guest_handle_irq_setup((struct api_call_irq_setup*)cmd);
 			break;
 		}
+		case SYZOS_API_MEMWRITE: {
+			guest_handle_memwrite((struct api_call_memwrite*)cmd);
+			break;
+		}
 		}
 		addr += cmd->size;
 		size -= cmd->size;
@@ -467,6 +481,35 @@ GUEST_CODE static void guest_handle_irq_setup(struct api_call_irq_setup* cmd)
 	    : "x1");
 }
 
+GUEST_CODE static void guest_handle_memwrite(struct api_call_memwrite* cmd)
+{
+	uint64 dest = cmd->base_addr + cmd->offset;
+	switch (cmd->len) {
+	case 1: {
+		volatile uint8* p = (uint8*)dest;
+		*p = (uint8)cmd->value;
+		break;
+	}
+
+	case 2: {
+		volatile uint16* p = (uint16*)dest;
+		*p = (uint16)cmd->value;
+		break;
+	}
+	case 4: {
+		volatile uint32* p = (uint32*)dest;
+		*p = (uint32)cmd->value;
+		break;
+	}
+	case 8:
+	default: {
+		volatile uint64* p = (uint64*)dest;
+		*p = (uint64)cmd->value;
+		break;
+	}
+	}
+}
+
 // Registers saved by one_irq_handler() and received by guest_irq_handler().
 struct ex_regs {
 	uint64 regs[31];
diff --git a/sys/linux/dev_kvm.txt b/sys/linux/dev_kvm.txt
index efda70b47..c4aa97b84 100644
--- a/sys/linux/dev_kvm.txt
+++ b/sys/linux/dev_kvm.txt
@@ -288,6 +288,15 @@ syzos_api_irq_setup {
 	nr_spis	int32[0:987]
 }
 
+syzos_memwrite_len = 1, 2, 4, 8
+
+syzos_api_memwrite {
+	base	flags[kvm_guest_addrs, int64]
+	offset	int64[0:4096]
+	value	int64
+	len	flags[syzos_memwrite_len, int64]
+}
+
 type syzos_api[NUM, PAYLOAD] {
 	call	const[NUM, int64]
 	size	bytesize[parent, int64]
@@ -301,6 +310,7 @@ syzos_api_call [
 	smc		syzos_api[3, syzos_api_smccc]
 	hvc		syzos_api[4, syzos_api_smccc]
 	irq_setup	syzos_api[5, syzos_api_irq_setup]
+	memwrite	syzos_api[6, syzos_api_memwrite]
 ] [varlen]
 
 kvm_text_ppc64 {
diff --git a/sys/linux/test/syz_kvm_setup_cpu_arm64-memwrite b/sys/linux/test/syz_kvm_setup_cpu_arm64-memwrite
new file mode 100644
index 000000000..00b866dd2
--- /dev/null
+++ b/sys/linux/test/syz_kvm_setup_cpu_arm64-memwrite
@@ -0,0 +1,14 @@
+#
+# requires: arch=arm64
+#
+r0 = openat$kvm(0, &AUTO='/dev/kvm\x00', 0x0, 0x0)
+r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0)
+r2 = ioctl$KVM_CREATE_VCPU(r1, AUTO, 0x0)
+r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, AUTO)
+r4 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r3, 0x3, 0x1, r2, 0x0)
+# Emulate a uexit with the memwrite API command: write 0 at address ARM64_ADDR_UEXIT.
+#
+syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000), &AUTO=[{0x0, &AUTO=[@memwrite={AUTO, AUTO, {0xdddd0000, 0x100, 0x0, 0x8}}], AUTO}], 0x1, 0x0, 0x0, 0x0)
+# Run till uexit.
+#
+ioctl$KVM_RUN(r2, AUTO, 0x0)