From f89fe08c7227fc4fa4bc40ab8d0e1eacca6c20f0 Mon Sep 17 00:00:00 2001
From: Alexander Potapenko <glider@google.com>
Date: Tue, 6 Aug 2024 14:59:07 +0200
Subject: executor: arm64: add SYZOS_API_SMC

Provide an API call to invoke the ARM64 Secure Monitor Call instruction
with user-supplied function id and 5 parameters passed in registers x1-x5.

For now only `smc #0` is invoked, although in the future we may want to
pass other (reserved) immediate values to SMC.
---
 sys/linux/dev_kvm.txt                      | 17 +++++++++++++++++
 sys/linux/test/syz_kvm_setup_cpu_arm64-smc | 15 +++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 sys/linux/test/syz_kvm_setup_cpu_arm64-smc

(limited to 'sys/linux')

diff --git a/sys/linux/dev_kvm.txt b/sys/linux/dev_kvm.txt
index 2066b8d78..4b702ed29 100644
--- a/sys/linux/dev_kvm.txt
+++ b/sys/linux/dev_kvm.txt
@@ -268,10 +268,27 @@ syzos_api_msr {
 	arg_value	int64
 }
 
+# Based on the "SMC Calling Convention" doc, https://documentation-service.arm.com/static/5f8ea482f86e16515cdbe3c6
+# Bit 31 is Standard (0) / Fast Call (1)
+# Bit 30 is SMC32 (0) / SMC64 (1)
+# Bits 29:24 denote the owning entity (relevant constants below are 0x01000000-0x3f000000
+# Bits 23:16 are ignored (must be zero in most cases)
+# Bits 15:0 denote the function number (0-0xffff) within the specified range, so we list all the possible bit values
+# here and hope that the fuzzer will be able to combine them into a number.
+kvm_smc_id = 0x80000000, 0x40000000, 0x1000000, 0x2000000, 0x3000000, 0x4000000, 0x30000000, 0x31000000, 0x32000000, 0x3f000000, 0x0, 0x1, 0x2, 0x4, 0x8, 0x10, 0x20, 0x40, 0x80, 0x100, 0x200, 0x400, 0x800, 0x1000, 0x2000, 0x4000, 0x8000, 0xffff
+
+syzos_api_smc {
+	call		const[3, int64]
+	size		bytesize[parent, int64]
+	arg_id		flags[kvm_smc_id, int32]
+	arg_params	array[int64, 5]
+}
+
 syzos_api_call [
 	uexit	syzos_api_uexit
 	code	syzos_api_code
 	msr	syzos_api_msr
+	smc	syzos_api_smc
 ] [varlen]
 
 kvm_text_ppc64 {
diff --git a/sys/linux/test/syz_kvm_setup_cpu_arm64-smc b/sys/linux/test/syz_kvm_setup_cpu_arm64-smc
new file mode 100644
index 000000000..77588b1cb
--- /dev/null
+++ b/sys/linux/test/syz_kvm_setup_cpu_arm64-smc
@@ -0,0 +1,15 @@
+#
+# requires: arch=arm64
+#
+r0 = openat$kvm(0, &AUTO='/dev/kvm\x00', 0x0, 0x0)
+r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0)
+#
+# KVM_SET_DEVICE_ATTR: group=KVM_ARM_VM_SMCCC_CTRL, attr=KVM_ARM_VM_SMCCC_FILTER
+# Filter: base=0xef000000, nr_functions=0x1000, action=KVM_SMCCC_FILTER_FWD_TO_USER
+# (Per SMC Calling Convention, 0xef000000-0xef001000 is an SMC64 fast call reserved range)
+# 
+ioctl$KVM_SET_DEVICE_ATTR_vm(r1, AUTO, &AUTO=@attr_arm64={0x0, 0x0, 0x0, &AUTO={0xef000000, 0x1000, 0x2, ""}})
+
+r2 = ioctl$KVM_CREATE_VCPU(r1, AUTO, 0x0)
+syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &AUTO=[{0x0, &AUTO=[@smc={AUTO, AUTO, 0xef000000, [0x0, 0x1, 0x2, 0x3, 0x4]}], AUTO}], 0x1, 0x0, 0x0, 0x0)
+ioctl$KVM_RUN(r2, AUTO, 0x0)
-- 
cgit mrf-deployment