diff options
| author | Alexander Potapenko <glider@google.com> | 2024-07-29 19:59:33 +0200 |
|---|---|---|
| committer | Alexander Potapenko <glider@google.com> | 2024-08-05 14:51:16 +0000 |
| commit | e2c47158756b66f9f8b645e2762bc1b3b15e0dd8 (patch) | |
| tree | 69aeadb3582c789f5930f923f05d3e3aa251520f /executor/common_kvm_arm64.h | |
| parent | ec6639f4fda05eef04a841b812298a932ad6e70f (diff) | |
executor: arm64: add SYZOS_API_MSR
MSR is an ARM64 instruction that writes a value from a GP register to
one of the system CPU registers. Exposing those registers to a fuzzer will
let us trigger unexpected behavior in handling them on the kernel side.
The SYZOS_API_MSR call has two int64 arguments, register ID and value.
Register IDs are 64-bit values obtained from ARM64_SYS_REG() in the Linux asm/kvm.h
UAPI header. Same register IDs are used by ioctl$KVM_GET_ONE_REG and
ioctl$KVM_SET_ONE_REG.
Also add sys/linux/test/syz_kvm_setup_cpu_arm64-msr
Diffstat (limited to 'executor/common_kvm_arm64.h')
| -rw-r--r-- | executor/common_kvm_arm64.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/executor/common_kvm_arm64.h b/executor/common_kvm_arm64.h index e6bb2b665..a4fe7c57a 100644 --- a/executor/common_kvm_arm64.h +++ b/executor/common_kvm_arm64.h @@ -126,6 +126,9 @@ static volatile long syz_kvm_setup_cpu(volatile long a0, volatile long a1, volat next = alloc_guest_mem(&allocator, page_size); vm_set_user_memory_region(vmfd, slot++, 0, ARM64_ADDR_EL1_STACK_BOTTOM, next.size, (uintptr_t)next.addr); + next = alloc_guest_mem(&allocator, page_size); + vm_set_user_memory_region(vmfd, slot++, 0, ARM64_ADDR_SCRATCH_CODE, next.size, (uintptr_t)next.addr); + // Map the remaining pages at address 0. next = alloc_guest_mem(&allocator, allocator.size); vm_set_user_memory_region(vmfd, slot++, 0, 0, next.size, (uintptr_t)next.addr); |