Implement clock_step()

[cyruscyliu]

not having clock_step() stops hyperpill to trigger CVE-2021-3947
see a poc: https://github.com/HexHive/HyperPill/tree/test-cve-2021-3947

quote: Can be implemented by adding a breakpoint to a common function. E.g. address_space write and inserting a call to clock_step. Another option is to insert any call (e.g. pio write) which triggers qemu to run the main loop and then catch the timer check to return the corresponding clock.

[cyruscyliu]

A solution,

inject_a_valid_mmio_read_or_write() // don't use pio because arm devices don't have one
start_cpu()

// hook somewhere of the mmio r/w
// direct the control flow to clock_step()

we need to know where to hook and where to go (the address of clock_step())
this also requires the loading address of the qemu binary