├── LICENSE
├── README.md
├── TODO
├── bootloader
    └── grilled_cheese.asm
├── build.py
└── srcs
    ├── boot
        └── boot.c
    ├── cpu
        ├── acpi.c
        ├── acpi.h
        ├── cpu.c
        └── cpu.h
    ├── disk
        ├── ide.c
        └── ide.h
    ├── disp
        ├── disp.c
        └── disp.h
    ├── dstruc
        ├── hash_table.c
        └── hash_table.h
    ├── emu
        ├── mips.c
        └── mips.h
    ├── fuzzers
        ├── chrome.dc
        ├── chrome.h
        ├── chrome
        │   ├── chrome_ipc.h
        │   ├── ipcgen.dc
        │   └── ipcgen.h
        ├── defender.dc
        ├── defender.h
        ├── font.dc
        ├── font.h
        ├── helpers.c
        ├── helpers.h
        ├── pdf.c
        ├── pdf.h
        ├── r2.dc
        ├── r2.h
        ├── word.c
        └── word.h
    ├── generic
        ├── locks.c
        ├── locks.h
        ├── stdlib.c
        └── stdlib.h
    ├── grilled_cheese.h
    ├── interrupts
        ├── interrupts.asm
        ├── interrupts.c
        └── interrupts.h
    ├── mm
        ├── mm.c
        └── mm.h
    ├── net
        ├── net.c
        ├── net.h
        ├── x540.c
        └── x540.h
    ├── perf
        ├── perf.c
        └── perf.h
    ├── rstate
        ├── rstate.c
        └── rstate.h
    ├── task
        ├── task.c
        └── task.h
    ├── time
        ├── time.c
        └── time.h
    └── vm
        ├── svm.asm
        ├── svm.c
        ├── svm.h
        ├── vm.c
        ├── vm.h
        ├── vm_x86.c
        ├── vm_x86.h
        ├── x86_passthrough.c
        ├── x86_passthrough.h
        ├── x86_user.c
        └── x86_user.h


/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2020 Gamozo Labs, LLC
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | # Falkervisor (grilled_cheese)
  2 | 
  3 | ## Twitter
  4 | 
  5 | Follow me on Twitter, @gamozolabs
  6 | Tweets go out before my reddit post spam, also I announce live streams there
  7 | 
  8 | ## See it in action
  9 | 
 10 | This was me using it to fuzz r2 back when this was under active development. This video should provide enough background to modify it for your own use.
 11 | 
 12 | https://www.youtube.com/watch?v=AqFMSI8e9Qo
 13 | 
 14 | ## History
 15 | 
 16 | This is the latest C version of my hypervisor and probably some of the best C code I've ever written (I've since switched to Rust, you should too). This was used roughly between 2015-2016, and replaced with a Rust version in late 2016.
 17 | 
 18 | ## Building
 19 | 
 20 | Make sure you have `python`, `nasm`, `clang`, and `ld.lld` in your path. Then just type `python build.py`. Use `python build.py clean` to clean.
 21 | 
 22 | It builds on Windows easily with the following (however there are no hard reqs on versions):
 23 | 
 24 | ```
 25 | C:\dev\grilled_cheese>clang --version
 26 | clang version 7.0.0 (trunk)
 27 | Target: x86_64-pc-windows-msvc
 28 | Thread model: posix
 29 | InstalledDir: C:\Program Files\LLVM\bin
 30 | 
 31 | C:\dev\grilled_cheese>python --version
 32 | Python 3.6.5
 33 | 
 34 | C:\dev\grilled_cheese>nasm --version
 35 | NASM version 2.13.03 compiled on Feb  7 2018
 36 | 
 37 | C:\dev\grilled_cheese>ld.lld --version
 38 | LLD 7.0.0 (compatible with GNU linkers)
 39 | ```
 40 | 
 41 | You might see some files with `*.dc` extensions. This because the build system builds any `*.c` file in the tree, thus to disable things I wasn't using I just threw a `d` in the extension.
 42 | 
 43 | ## Feature differences from brownie
 44 | 
 45 | See brownie here: https://github.com/gamozolabs/falkervisor_beta/
 46 | 
 47 | ### Improvements over brownie
 48 | 
 49 | - It was written in C
 50 | - Networking code was greatly improved
 51 | - Kernel was portable to Intel (hypervisor not though)
 52 | - DHCPv4 is used for getting an IP, no more hardcoded packets
 53 | - Remote mapping of files
 54 | - Generic VM support, designed to in theory support AMD, Intel, etc from one API
 55 | - Many design features were made to reduce the chances of heisenbugs. Full page heap, full ASLR, strict mapping requirements really helped here
 56 | - RSTATE error model allowed for human readable call stacks on errors without worrying about unwind info, symbols, or inlining.
 57 | 
 58 | ### Similarities to brownie
 59 | 
 60 | - Performance is about the same, there isn't room for growth in either tools
 61 | - Only supports x540 as a network device
 62 | - UDP only for networking
 63 | - Custom server for communicating over UDP
 64 | 
 65 | ## Cool features
 66 | 
 67 | ### Clang support
 68 | 
 69 | Early versions of my kernel used MSVC instead. Clang offers much better portability. By using `clang` and `ld.lld` this kernel is easily built on any system without special toolchain requirements. Further clang allows for inline assembly which is nice for kernel development, even though I keep usage to an absolute minimum.
 70 | 
 71 | ### Remote mapping
 72 | 
 73 | The remote mapping `net_map_remote()` allows for files to be mapped over the network and faulted in only when they are used. For VMs this is used to map the entire ~4 GiB snapshot. Combined with CoW, this meant that only pages that were ever touched during a fuzz case were present in memory, and only one copy. If memory was ever written during a fuzz case then this memory might be duplicated to each core.
 74 | 
 75 | Typically for a medium size target (1-2 second fuzz case maximum), this meant usually no more than 2-4 MiB was used per VM. Leading to running 64 4GiB VMs with using only a few hundred MiB of RAM!
 76 | 
 77 | ### Full ASLR
 78 | 
 79 | Every bit of every allocation is fully ASLRed. The kernel base and stacks are also fully ASLRed. This ASLR is 36-bits (meaning every bit that isn't a page offset is random). This means you'll get allocations in the `0xffff...` range and the `0x0000...` range.
 80 | 
 81 | ### Page heap
 82 | 
 83 | All allocations are page heaped, their addresses are fully deleted from page tables on free and overflows and underflows can only corrupt data inside the structure itself.
 84 | 
 85 | ### No identity/linear physical memory map
 86 | 
 87 | The machine I developed this for had 512 GiB of RAM. Most kernels have a linear mapping of ALL of physical memory somewhere in the kernel. When dealing with large amounts of memory this uses a huge amount of the virtual address space. This is not really a huge issue, however it makes it so there's a "decent chance" a random address might actually hit valid memory. This makes it possible for heisenbugs for things that "sometimes work".
 88 | 
 89 | Instead I use a design where the bootloader provides a 512-entry dynamic mapping mechanism. This consists of single page directory which is mapped at a random address. This means that using 4 KiB (PD) + 2 MiB of reserved page we are able to have a fast mechanism of accessing all physical memory. This greatly reduces the size of active addresses in the virtual address space, leaving more room for randomness and less chance of a random address hitting valid memory.
 90 | 
 91 | Performance is about 20% slower with this model over a linear mapping, which is really not that bad.
 92 | 
 93 | ### Generic VM model
 94 | 
 95 | The VM model was starting to be designed to be more generic. This was going to allow for an Intel hypervisor being added while still using the same API for managing both. In this version there are actually 2 VM models, one for AMD's SVM, and another using user-VM. User VM was a made up VM model that makes a semi-isolated guest by using ring3 rather than a whole VM itself. This was great for things like JITs which needed a unique address space but I wanted to support on Intel.
 96 | 
 97 | ### Rstate
 98 | 
 99 | You'll see that all error handling is done through `RSTATES`. This model allows for all errors to chain together the origin of the error all the way up to the top which paniced or handled it. This does not rely on symbols or unwind unwalking so it's much more simple. Further it works correctly regardless of optimization levels or inlining as the stack is managed in the C code itself. Getting clean errors out of this really helped keep code quality up and bug fix times to a minimum.
100 | 
101 | ### Probably some other cool stuff I forgot about
102 | 


--------------------------------------------------------------------------------
/TODO:
--------------------------------------------------------------------------------
 1 | Code cleanup
 2 | 	- Since free lists are contained by the task. Do not nuke the task free
 3 | 	  lists on new task creations or destroys.
 4 | 
 5 | 	- Why is there a mm_cow_pf_handler() and a manual implementation in
 6 | 	  page_fault()?
 7 | 
 8 | 	- mm_for_each_dirty_page() could use a more in depth audit
 9 | 
10 | 	- Move rng_seed to task structure?
11 | 
12 | =====================================================
13 | Code Audit
14 | 
15 | - Ensure prototypes are correct and sane
16 | - Ensure code does not exceed 80 character lines
17 | - Write documentation for any undocumented functions
18 | - Read through code and make sure usage is sane and safe
19 | - Add to the TODO list for any things that cannot be immediately fixed, or
20 |   future ideas
21 | - Check for security bugs
22 | - Check for race conditions on globals and current_cpu
23 | - Make sure SAL annotations are correct and as verbose as possible
24 | =====================================================
25 | 
26 | Current code audit status
27 | Started 2016/10/24
28 | 
29 | [complete] mm/mm.c
30 | [complete] time/time.c
31 | [complete] cpu/cpu.c
32 | [complete] cpu/acpi.c
33 | [complete] ide/ide.c
34 | [complete] disp/disp.c
35 | [complete] dstruc/hash_table.c
36 | [complete] generic/locks.c
37 | [complete] generic/stdlib.c
38 | 
39 | 


--------------------------------------------------------------------------------
/build.py:
--------------------------------------------------------------------------------
  1 | import os, subprocess, shlex, sys, re, shutil, threading, time
  2 | 
  3 | # AMD 6376 is Piledriver march, use target-cpu=bdver2
  4 | # Xeon E5-2630 v4 is Broadwell march, use target-cpu=broadwell
  5 | 
  6 | CFLAGS  = "-ffreestanding -target x86_64 -march=native -O2 -fPIE \
  7 |            -g -ansi -pedantic -Wall -Werror -Isrcs -flto -Wno-long-long"
  8 | LDFLAGS = "-pie --lto-O2"
  9 | 
 10 | # Uncomment this line to make a debug friendly binary without optimizations and LTO
 11 | CFLAGS += " -fno-lto -O2"
 12 | 
 13 | OUTPUT_FILENAME       = "grilled_cheese.kern.debug"
 14 | OUTPUT_STRIP_FILENAME = "grilled_cheese.kern"
 15 | BOOTLOADER_FILENAME   = "grilled_cheese.boot"
 16 | 
 17 | printlock = threading.Lock()
 18 | 
 19 | def check_deps(out_file, deps):
 20 |     for dep in deps:
 21 |         # If the dependency was modified more recently than the output file
 22 |         try:
 23 |             if os.path.getmtime(dep) > os.path.getmtime(out_file):
 24 |                 return True
 25 |         except:
 26 |             return True
 27 | 
 28 |     return False
 29 | 
 30 | # Returns true of infile is newer than outfile, or if outfile doesn't exist.
 31 | # Returns false otherwise.
 32 | def is_older(outfile, infile):
 33 |     if not os.path.exists(outfile) or os.path.getmtime(infile) > os.path.getmtime(outfile):
 34 |         return True
 35 |     else:
 36 |         return False
 37 | 
 38 | def get_cc_deps(in_c_fn):
 39 |     deps = []
 40 | 
 41 |     cmd = "clang %s -M %s" % (CFLAGS, in_c_fn)
 42 | 
 43 |     sp = subprocess.Popen(shlex.split(cmd, posix=False), stdout=subprocess.PIPE)
 44 |     stdout = sp.communicate()[0]
 45 |     if sp.wait() != 0:
 46 |         return None
 47 | 
 48 |     # We only care about the dependencies, split off the target
 49 |     stdout = stdout.split(b': ')[1]
 50 | 
 51 |     for include in stdout.split(b' '):
 52 |         if not include.startswith(b"srcs"):
 53 |             continue;
 54 | 
 55 |         deps.append(include.strip())
 56 | 
 57 |     return deps
 58 | 
 59 | def cc(in_c_fn, out_obj_fn):
 60 |     cmd = "clang %s -o %s -c %s" % (CFLAGS, out_obj_fn, in_c_fn)
 61 | 
 62 |     with printlock:
 63 |         print("CC    %s" % out_obj_fn)
 64 | 
 65 |     sp = subprocess.Popen(shlex.split(cmd, posix=False), stderr=subprocess.PIPE)
 66 |     stdout, stderr = sp.communicate()
 67 |     if sp.wait() != 0:
 68 |         with printlock:
 69 |             sp = subprocess.Popen(shlex.split(cmd, posix=False))
 70 |             sp.wait()
 71 | 
 72 |         sys.exit(-1)
 73 | 
 74 |     return
 75 | 
 76 | def asm(in_asm_fn, out_obj_fn):
 77 |     with printlock:
 78 |         print("ASM   %s" % in_asm_fn)
 79 | 
 80 |     cmd = "nasm -f elf64 -o %s %s" % (out_obj_fn, in_asm_fn)
 81 | 
 82 |     sp = subprocess.Popen(shlex.split(cmd, posix=False))
 83 |     if sp.wait() != 0:
 84 |         sys.exit(-1)
 85 | 
 86 |     return
 87 | 
 88 | def link(in_link_objs, out_fn):
 89 |     cmd = "ld.lld %s -o %s %s" % (LDFLAGS, out_fn, in_link_objs)
 90 | 
 91 |     with printlock:
 92 |         print("LD    %s" % out_fn)
 93 | 
 94 |     os.system(cmd)
 95 |     return
 96 | 
 97 | def strip(in_link_objs, out_fn):
 98 |     cmd = "ld.lld %s -strip-all -o %s %s" % (LDFLAGS, out_fn, in_link_objs)
 99 | 
100 |     with printlock:
101 |         print("STRIP %s" % out_fn)
102 | 
103 |     os.system(cmd)
104 |     return
105 | 
106 | def buildfn(fn):
107 |     if fn.find(' ') != -1:
108 |         sys.stderr.write("Path \"%s\" contains a space\n" % fn)
109 |         sys.exit(-1)
110 | 
111 |     obj = "objs" + fn[4:] + ".o"
112 | 
113 |     try:
114 |         os.makedirs(os.path.split(obj)[0])
115 |     except:
116 |         pass
117 | 
118 |     if fn.endswith(".c"):
119 |         deps = get_cc_deps(fn)
120 |         if deps == None or check_deps(obj, deps):
121 |             cc(fn, obj)
122 |             built_objs.append(obj)
123 |         else:
124 |             skipped_objs.append(obj)
125 |     elif fn.endswith(".asm"):
126 |         if is_older(obj, fn):
127 |             asm(fn, obj)
128 |             built_objs.append(obj)
129 |         else:
130 |             skipped_objs.append(obj)
131 |     else:
132 |         sys.stderr.write("Unsupported file type \"%s\"\n" % fn)
133 |         sys.exit(-1)
134 | 
135 | # Build every file with ext recursively in 'srcs' and place in 'objs'. Return
136 | # space separated string of all output objects. Calls sys.exit(-1) on any
137 | # error.
138 | def build_all(ext):
139 |     global built_objs, skipped_objs
140 | 
141 |     for cur, dirs, files in os.walk('srcs'):
142 |         for fn in files:
143 |             fn = os.path.join(cur, fn)
144 | 
145 |             if not fn.endswith(ext):
146 |                 continue
147 | 
148 |             threading.Timer(0.0, buildfn, args=[fn]).start()
149 | 
150 |     while threading.active_count() != 1:
151 |         time.sleep(0.01)
152 | 
153 | if len(sys.argv) == 2 and sys.argv[1] == "clean":
154 |     remove_dirs  = ["objs"]
155 |     remove_files = [OUTPUT_FILENAME, OUTPUT_STRIP_FILENAME, BOOTLOADER_FILENAME]
156 | 
157 |     for rmdir in remove_dirs:
158 |         print("RMDIR %s" % rmdir)
159 |         if os.path.exists(rmdir):
160 |             shutil.rmtree(rmdir)
161 | 
162 |     for rmfile in remove_files:
163 |         print("RM    %s" % rmfile)
164 |         if os.path.exists(rmfile):
165 |             os.remove(rmfile)
166 | 
167 |     sys.exit(0)
168 | 
169 | built_objs   = []
170 | skipped_objs = []
171 | 
172 | build_all(".c")
173 | build_all(".asm")
174 | 
175 | if len(built_objs) or not os.path.exists(OUTPUT_FILENAME) or not os.path.exists(OUTPUT_STRIP_FILENAME):
176 |     link(" ".join(built_objs + skipped_objs), OUTPUT_FILENAME)
177 |     strip(" ".join(built_objs + skipped_objs), OUTPUT_STRIP_FILENAME)
178 | 
179 | if is_older(BOOTLOADER_FILENAME, os.path.join("bootloader", "grilled_cheese.asm")):
180 |     print("ASM   %s" % BOOTLOADER_FILENAME)
181 |     os.system("nasm -f bin -o %s bootloader/grilled_cheese.asm" % BOOTLOADER_FILENAME)
182 | 
183 | sys.exit(0)
184 | 
185 | 


--------------------------------------------------------------------------------
/srcs/boot/boot.c:
--------------------------------------------------------------------------------
  1 | #include <grilled_cheese.h>
  2 | #include <mm/mm.h>
  3 | #include <generic/stdlib.h>
  4 | #include <disp/disp.h>
  5 | #include <interrupts/interrupts.h>
  6 | #include <net/net.h>
  7 | #include <time/time.h>
  8 | #include <cpu/acpi.h>
  9 | #include <vm/svm.h>
 10 | 
 11 | /* __start()
 12 |  *
 13 |  * Summary:
 14 |  *
 15 |  * This is the entry point for our OS. We are passed in a read only
 16 |  * boot_parameters structure from the bootloader describing things about the
 17 |  * system.
 18 |  *
 19 |  * Parameters:
 20 |  *
 21 |  * _In_ params - Pointer to boot_parameters structure containing critical
 22 |  *               information from the bootloader. Read only.
 23 |  */
 24 | void
 25 | _start(_In_ const struct _boot_parameters *params)
 26 | {
 27 | 	RSTATE_LOCALS;
 28 | 
 29 | 	/* Set up CPU locals. This is the first thing we must do. */
 30 | 	mm_init_cpu(params);
 31 | 
 32 | 	/* Set up the init task. This is the second thing we must do. */
 33 | 	task_create_init();
 34 | 
 35 | 	if(is_bsp()){
 36 | 		/* Calibrate the rate RDTSC runs at */
 37 | 		rdtsc_calibrate();
 38 | 
 39 | 		/* Initialize the ACPI system */
 40 | 		rstate = acpi_init();
 41 | 		RSCHECK_NESTED("Failed to initialize ACPI");
 42 | 		printf("ACPI initialized");
 43 | 	}
 44 | 
 45 | 	/* Now that ACPI has been set up, we can set this cpu's node ID */
 46 | 	current_cpu->node_id = acpi_get_node_id(current_cpu->apic_id);
 47 | 
 48 | 	/* Do BSP specific initialization while APs sleep */
 49 | 	if(is_bsp()){
 50 | 		/* Initialize the mm subsystem */
 51 | 		rstate = mm_init();
 52 | 		RSCHECK_NESTED("Failed to initialize the mm subsystem");
 53 | 		printf("MM subsystem initialized");
 54 | 
 55 | 		/* Initialize the APIC */
 56 | 		rstate = mm_init_apic();
 57 | 		RSCHECK_NESTED("Failed to initialize APIC");
 58 | 		printf("APIC initialized");
 59 | 
 60 | 		/* Initialize the PIC */
 61 | 		pic_init();
 62 | 		printf("PIC initialized");
 63 | 
 64 | 		/* Initialize interrupts */
 65 | 		rstate = interrupts_init();
 66 | 		RSCHECK_NESTED("Failed to intialize interrupts");
 67 | 		printf("Interrupts initialized");
 68 | 
 69 | 		/* Initialize networking */
 70 | 		rstate = net_init();
 71 | 		RSCHECK_NESTED("Failed to initialize networking subsystem");
 72 | 		printf("Networking initialized");
 73 | 
 74 | 		/* Create a default queue for this CPU */
 75 | 		rstate = net_init_local_queue();
 76 | 		RSCHECK_NESTED("Failed to create local network queue");
 77 | 		printf("CPU local networking initialized");
 78 | 
 79 | 		/* Create a default queue for this CPU */
 80 | 		rstate = net_notify_server();
 81 | 		RSCHECK_NESTED("Failed to notify grilled_cheese server");
 82 | 		printf("Registered with grilled_cheese server");
 83 | 
 84 | 		/* Dump out MM stats */
 85 | 		mm_dump_stats();
 86 | 
 87 | 		/* Display network devices */
 88 | 		net_display_devices();
 89 | 
 90 | 		/* Dump CPU topology */
 91 | 		cpu_dump_topology();
 92 | 
 93 | #if 1
 94 | 		/* Bring up APs */
 95 | 		cpu_start_aps();
 96 | #endif
 97 | 	} else {
 98 | 		/* Initialize the APIC */
 99 | 		rstate = mm_init_apic();
100 | 		RSCHECK_NESTED("Failed to initialize APIC");
101 | 
102 | 		/* Initialize interrupts */
103 | 		rstate = interrupts_init();
104 | 		RSCHECK_NESTED("Failed to intialize interrupts");
105 | 
106 | 		/* Create a default queue for this CPU */
107 | 		rstate = net_init_local_queue();
108 | 		RSCHECK_NESTED("Failed to create local network queue");
109 | 	}
110 | 
111 | 	printf("Core %u node %u online",
112 | 			current_cpu->cpu_id, current_cpu->node_id);
113 | 
114 | #if 0
115 | 	if(is_bsp()){
116 | 		struct _vm *vm;
117 | 
118 | 		rstate = vm_create("snapshot.core", &vm);
119 | 		RSCHECK_NESTED("Failed to create VM for snapshot");
120 | 		
121 | 		printf("VM created");
122 | 	}
123 | #endif
124 | 
125 | #if 0
126 | 	{
127 | #include <emu/mips.h>
128 | 
129 | 		rstate = emu_mips_create();
130 | 		RSCHECK_NESTED("Failed to create mips emulator");
131 | 
132 | 		printf("DONE!");
133 | 	}
134 | #endif
135 | 
136 | #if 1
137 | 	/* Initialize SVM */
138 | 	rstate = svm_init();
139 | 	RSCHECK_NESTED("Failed to initialize SVM");
140 | 
141 | 	{
142 | #include <fuzzers/word.h>
143 | 
144 | 		rstate = fuzz_word();
145 | 		RSCHECK_NESTED("Failed to fuzz word");
146 | 	}
147 | #endif
148 | 
149 | 	RSCHECK(1 == 0, "Returning from __start");
150 | cleanup:
151 | 	RSTATE_PANIC;
152 | }
153 | 
154 | 


--------------------------------------------------------------------------------
/srcs/cpu/acpi.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | #define CPU_MAX_NUMA_ID 256
 4 | #define CPU_MAX_REGIONS 8
 5 | 
 6 | struct _cpu_info {
 7 | 	int present;
 8 | 
 9 | 	uint32_t apic_id;
10 | 	uint32_t numa_id;
11 | };
12 | 
13 | struct _node_info {
14 | 	int present;
15 | 
16 | 	uint32_t numa_id;
17 | 	uint32_t num_regions;
18 | 
19 | 	struct {
20 | 		uint64_t base;
21 | 		uint64_t size;
22 | 		int      avail;
23 | 	} regions[CPU_MAX_REGIONS];
24 | 
25 | 	uint64_t cur_base;
26 | 	uint64_t cur_remain;
27 | };
28 | 
29 | #pragma pack(push, 1)
30 | struct _rsdp {
31 | 	char     signature[8];
32 | 	uint8_t  checksum;
33 | 	char     oem_id[6];
34 | 	uint8_t  revision;
35 | 	uint32_t rsdt_addr;
36 | };
37 | 
38 | struct _acpi_standard_header {
39 | 	char     signature[4];
40 | 	uint32_t length;
41 | 	uint8_t  revision;
42 | 	uint8_t  checksum;
43 | 	char     oem_id[6];
44 | 	char     oem_table_id[8];
45 | 	uint32_t oem_revision;
46 | 	uint32_t creator_id;
47 | 	uint32_t creator_revision;
48 | };
49 | 
50 | struct _rsdt {
51 | 	struct _acpi_standard_header hdr;
52 | 
53 | 	uint32_t tables[128];
54 | };
55 | 
56 | struct _madt {
57 | 	struct _acpi_standard_header hdr;
58 | 
59 | 	uint32_t local_controller_addr;
60 | 	uint32_t flags;
61 | 
62 | 	uint8_t payload[2048];
63 | };
64 | 
65 | struct _srat {
66 | 	struct _acpi_standard_header hdr;
67 | 
68 | 	uint32_t reserved1;
69 | 	uint64_t reserved2;
70 | 
71 | 	uint8_t payload[8 * 1024];
72 | };
73 | #pragma pack(pop)
74 | 
75 | rstate_t
76 | acpi_get_node_memory(
77 | 		_In_  uint32_t   node_id,
78 | 		_In_  size_t     amount,
79 | 		_Out_ uintptr_t *out_paddr);
80 | 
81 | uint32_t
82 | acpi_get_node_id(_In_ uint32_t apic_id);
83 | 
84 | rstate_t
85 | acpi_init(void);
86 | 
87 | void
88 | cpu_dump_topology(void);
89 | 
90 | 


--------------------------------------------------------------------------------
/srcs/cpu/cpu.c:
--------------------------------------------------------------------------------
  1 | #include <grilled_cheese.h>
  2 | #include <disp/disp.h>
  3 | #include <generic/stdlib.h>
  4 | #include <time/time.h>
  5 | 
  6 | /* get_current_cpu()
  7 |  *
  8 |  * Summary:
  9 |  *
 10 |  * Get a pointer to the current CPU's _cpu structure. This can only be used
 11 |  * after mm_init_cpu() was called. The gs segment's base always points to
 12 |  * the _cpu structure, and the first entry of this structure is a pointer
 13 |  * to itself. Thus we dereference qword [gs:0] to get this pointer.
 14 |  *
 15 |  * This function is what is internally used by the 'current_cpu' macro.
 16 |  *
 17 |  * Returns:
 18 |  *
 19 |  * Pointer to current CPU's _cpu structure.
 20 |  */
 21 | struct _cpu*
 22 | get_current_cpu(void)
 23 | {
 24 | 	struct _cpu *ret;
 25 | 	__asm__ volatile("movq %%gs:0, %0" : "=r"(ret));
 26 | 	return ret;
 27 | }
 28 | 
 29 | /* halt()
 30 |  *
 31 |  * Summary:
 32 |  *
 33 |  * Halt the system forever.
 34 |  */
 35 | void
 36 | halt(void)
 37 | {
 38 | 	for( ; ; ){
 39 | 		__asm__ volatile("hlt");
 40 | 	}
 41 | }
 42 | 
 43 | /* panic()
 44 |  *
 45 |  * Summary:
 46 |  *
 47 |  * Put the screen into error mode, print a panic reason, and then halt
 48 |  * forever. If we are the BSP, enable interrupts such that we can still get
 49 |  * timer interrupts to check for a reboot command.
 50 |  *
 51 |  * Parameters:
 52 |  *
 53 |  * _In_z_ reason - Null-terminated string with the reason of why we are
 54 |  *                 panicing.
 55 |  */
 56 | void
 57 | panic(_In_z_ const char *reason)
 58 | {
 59 | 	/* Put the display into error mode, flashing text */
 60 | 	disp_err_mode();
 61 | 
 62 | 	/* Print out the panic reason */
 63 | 	printf("!!! PANIC !!!");
 64 | 	printf("%s", reason);
 65 | 
 66 | 	/* BSP needs interrupts enabled so we can soft reboot */
 67 | 	if(is_bsp()){
 68 | 		printf("Panic occured on BSP, enabling interrupts for soft reboot");
 69 | 
 70 | 		/* Allow timer interrupts on this task */
 71 | 		current_cpu->task->interrupt_allowed[69] = 1;
 72 | 
 73 | 		/* Enable interrupts so we can soft reboot */
 74 | 		interrupts_enable_force();
 75 | 	}
 76 | 
 77 | 	halt();
 78 | }
 79 | 
 80 | /* sync_bool_compare_and_swap_si128()
 81 |  *
 82 |  * Summary:
 83 |  *
 84 |  * This function uses the cmpxchg16b instruction to do an atomic compare
 85 |  * exchange of a 128-bit value.
 86 |  *
 87 |  * src is compared against with cmp. If src matches cmp, val will be swapped
 88 |  * into val. If the match (and thus the swap) occurs, 1 will be returned.
 89 |  * Otherwise 0 will be returned.
 90 |  *
 91 |  * Parameters:
 92 |  *
 93 |  * _In_ src - Source memory location to be compared against and potentially
 94 |  *            written to.
 95 |  * _In_ cmp - Value to compare against
 96 |  * _In_ val - Value to place into *src if cmp matches src.
 97 |  *
 98 |  * Returns:
 99 |  *
100 |  * If the compare matched and thus the swap occured returns 1.
101 |  * Otherwise returns 0.
102 |  */
103 | int
104 | sync_bool_compare_and_swap_si128(
105 | 		_In_ volatile __m128i *src, _In_ __m128i cmp, _In_ __m128i val)
106 | {
107 | 	uint8_t result;
108 | 
109 | 	uint64_t cmp_low, cmp_high;
110 | 	uint64_t val_low, val_high;
111 | 
112 | 	cmp_low  = _mm_extract_epi64(cmp, 0);
113 | 	cmp_high = _mm_extract_epi64(cmp, 1);
114 | 	
115 | 	val_low  = _mm_extract_epi64(val, 0);
116 | 	val_high = _mm_extract_epi64(val, 1);
117 | 
118 | 	__asm__ volatile("lock cmpxchg16b %1 ; setz %0" :
119 | 			"=r"(result) :
120 | 			"m"(*src), "d"(cmp_high), "a"(cmp_low),
121 | 			"c"(val_high), "b"(val_low));
122 | 
123 | 	return (int)result;
124 | }
125 | 
126 | /* rdpmc()
127 |  *
128 |  * Summary:
129 |  *
130 |  * This function performs a rdpmc instruction using the counter provided by
131 |  * ctr_id.
132 |  *
133 |  * Paramters:
134 |  *
135 |  * _In_ ctr_id - Performance counter ID to read
136 |  *
137 |  * Returns:
138 |  *
139 |  * 64-bit value containing the contents of performance counter ctr_id
140 |  */
141 | uint64_t
142 | rdpmc(_In_ uint32_t ctr_id)
143 | {
144 | 	uint64_t low, high;
145 | 
146 | 	__asm__ volatile("rdpmc" : "=a"(low), "=d"(high) : "c"(ctr_id));
147 | 
148 | 	return (high << 32) | low;
149 | }
150 | 
151 | /* interrupts_enable_force()
152 |  *
153 |  * Summary:
154 |  *
155 |  * This function enables interrupts without any checks. This function should
156 |  * never be used by non-internal code. Instead, use interrupts_enable().
157 |  */
158 | void
159 | interrupts_enable_force(void)
160 | {
161 | 	__asm__ volatile("sti");
162 | }
163 | 
164 | /* interrupts_disable_force()
165 |  *
166 |  * Summary:
167 |  *
168 |  * This function disables interrupts without any checks. This function should
169 |  * never be used by non-internal code. Instead, use interrupts_disable().
170 |  */
171 | void
172 | interrupts_disable_force(void)
173 | {
174 | 	__asm__ volatile("cli");
175 | }
176 | 
177 | /* writedr0()
178 |  *
179 |  * Summary:
180 |  *
181 |  * This function writes the value val into debug register 0.
182 |  *
183 |  * Parameters:
184 |  *
185 |  * _In_ val - Value to write into debug register
186 |  */
187 | void
188 | writedr0(_In_ uint64_t val)
189 | {
190 | 	__asm__ volatile("movq %0, %%dr0" :: "r"(val));
191 | }
192 | 
193 | /* writedr1()
194 |  *
195 |  * Summary:
196 |  *
197 |  * This function writes the value val into debug register 1.
198 |  *
199 |  * Parameters:
200 |  *
201 |  * _In_ val - Value to write into debug register
202 |  */
203 | void
204 | writedr1(_In_ uint64_t val)
205 | {
206 | 	__asm__ volatile("movq %0, %%dr1" :: "r"(val));
207 | }
208 | 
209 | /* writedr2()
210 |  *
211 |  * Summary:
212 |  *
213 |  * This function writes the value val into debug register 2.
214 |  *
215 |  * Parameters:
216 |  *
217 |  * _In_ val - Value to write into debug register
218 |  */
219 | void
220 | writedr2(_In_ uint64_t val)
221 | {
222 | 	__asm__ volatile("movq %0, %%dr2" :: "r"(val));
223 | }
224 | 
225 | /* writedr3()
226 |  *
227 |  * Summary:
228 |  *
229 |  * This function writes the value val into debug register 3.
230 |  *
231 |  * Parameters:
232 |  *
233 |  * _In_ val - Value to write into debug register
234 |  */
235 | void
236 | writedr3(_In_ uint64_t val)
237 | {
238 | 	__asm__ volatile("movq %0, %%dr3" :: "r"(val));
239 | }
240 | 
241 | /* invlpg()
242 |  *
243 |  * Summary:
244 |  *
245 |  * This function invalidates the page tables responsible for translating the
246 |  * page indicated by virtual address vaddr.
247 |  *
248 |  * Parameters:
249 |  *
250 |  * _In_ addr - Virtual address indicating page to invalidate
251 |  */
252 | void
253 | invlpg(_In_ void *addr)
254 | {
255 | 	__asm__ volatile("invlpg (%0)" :: "r"(addr));
256 | }
257 | 
258 | /* lgdt()
259 |  *
260 |  * Summary:
261 |  *
262 |  * This function uses the lgdt instruction to load up the gdt specified by gdt.
263 |  * gdt must point to the gdt pseudo-descriptor containing both the base and
264 |  * limit.
265 |  *
266 |  * Parameters:
267 |  *
268 |  * _In_ gdt - Virtual address pointing to gdt pseudo descriptor
269 |  */
270 | void
271 | lgdt(_In_ void *gdt)
272 | {
273 | 	__asm__ volatile("lgdt (%0)" :: "r"(gdt));
274 | }
275 | 
276 | /* lidt()
277 |  *
278 |  * Summary:
279 |  *
280 |  * This function uses the lidt instruction to load up the idt specified by idt.
281 |  * idt must point to the idt pseudo-descriptor containing both the base and
282 |  * limit.
283 |  *
284 |  * Parameters:
285 |  *
286 |  * _In_ idt - Virtual address pointing to idt pseudo descriptor
287 |  */
288 | void
289 | lidt(_In_ void *idt)
290 | {
291 | 	__asm__ volatile("lidt (%0)" :: "r"(idt));
292 | }
293 | 
294 | /* ltr()
295 |  *
296 |  * Summary:
297 |  *
298 |  * This function uses the ltr instruction to load up a new TSS segment. The
299 |  * tr value passed in indicates the selector for the TSS segment in the
300 |  * GDT.
301 |  *
302 |  * Parameters:
303 |  *
304 |  * _In_ tr - Segment selector of the TSS in the GDT.
305 |  */
306 | void
307 | ltr(_In_ uint16_t tr)
308 | {
309 | 	__asm__ volatile("ltr %0" :: "c"(tr));
310 | }
311 | 
312 | /* outb()
313 |  *
314 |  * Summary:
315 |  *
316 |  * This function writes 8-bit val to I/O port port.
317 |  *
318 |  * Parameters:
319 |  *
320 |  * _In_ port - I/O port to write to
321 |  * _In_ val  - Value to write to I/O port
322 |  */
323 | void
324 | outb(_In_ uint16_t port, _In_ uint8_t val)
325 | {
326 | 	__asm__ volatile("outb %0, %1" :: "a"(val), "d"(port));
327 | }
328 | 
329 | /* outd()
330 |  *
331 |  * Summary:
332 |  *
333 |  * This function writes 32-bit val to I/O port port.
334 |  *
335 |  * Parameters:
336 |  *
337 |  * _In_ port - I/O port to write to
338 |  * _In_ val  - Value to write to I/O port
339 |  */
340 | void
341 | outd(_In_ uint16_t port, _In_ uint32_t val)
342 | {
343 | 	__asm__ volatile("outl %0, %1" :: "a"(val), "d"(port));
344 | }
345 | 
346 | /* inb()
347 |  *
348 |  * Summary:
349 |  *
350 |  * This function reads an 8-bit value from the I/O port specified by port.
351 |  *
352 |  * Parameters:
353 |  *
354 |  * _In_ port - I/O port to read from
355 |  *
356 |  * Returns:
357 |  *
358 |  * Value read from I/O port
359 |  */
360 | uint8_t
361 | inb(_In_ uint16_t port)
362 | {
363 | 	uint8_t ret;
364 | 	__asm__ volatile("inb %1, %0" : "=a"(ret) : "d"(port));
365 | 	return ret;
366 | }
367 | 
368 | /* ind()
369 |  *
370 |  * Summary:
371 |  *
372 |  * This function reads a 32-bit value from the I/O port specified by port.
373 |  *
374 |  * Parameters:
375 |  *
376 |  * _In_ port - I/O port to read from
377 |  *
378 |  * Returns:
379 |  *
380 |  * Value read from I/O port
381 |  */
382 | uint32_t
383 | ind(_In_ uint16_t port)
384 | {
385 | 	uint32_t ret;
386 | 	__asm__ volatile("inl %1, %0" : "=a"(ret) : "d"(port));
387 | 	return ret;
388 | }
389 | 
390 | /* readcr2()
391 |  *
392 |  * Summary:
393 |  *
394 |  * This function reads the value contained in control register 2.
395 |  *
396 |  * Returns:
397 |  *
398 |  * Contents of cr2 register
399 |  */
400 | uintptr_t
401 | readcr2(void)
402 | {
403 | 	uintptr_t cr2;
404 | 	__asm__ volatile("movq %%cr2, %0" : "=r"(cr2));
405 | 	return cr2;
406 | }
407 | 
408 | /* readcr3()
409 |  *
410 |  * Summary:
411 |  *
412 |  * This function reads the value contained in control register 3.
413 |  *
414 |  * Returns:
415 |  *
416 |  * Contents of cr3 register
417 |  */
418 | uintptr_t
419 | readcr3(void)
420 | {
421 | 	uintptr_t cr3;
422 | 	__asm__ volatile("movq %%cr3, %0" : "=r"(cr3));
423 | 	return cr3;
424 | }
425 | 
426 | /* cpuid()
427 |  *
428 |  * Summary:
429 |  *
430 |  * This function performs a cpuid instruction using val to select the ID.
431 |  * It outputs a 4 dword tuple in the form (eax, ebx, ecx, edx).
432 |  *
433 |  * Parameters:
434 |  *
435 |  * _In_  val    - cpuid id
436 |  * _Out_ output - Tuple in the form (eax, ebx, ecx, edx) containing the results
437 |  *                of the cpuid instruction. Caller allocated storage, must be
438 |  *                large enough to hold 4 dwords (16 bytes)
439 |  */
440 | void
441 | cpuid(_In_ uint32_t val, _Out_writes_bytes_all_(16) uint32_t *output)
442 | {
443 | 	__asm__ volatile("cpuid" :
444 | 			"=a"(output[0]), "=b"(output[1]),
445 | 			"=c"(output[2]), "=d"(output[3]) :
446 | 			"a"(val));
447 | }
448 | 
449 | /* wrmsr()
450 |  *
451 |  * Summary:
452 |  *
453 |  * This function writes val to the MSR specified by msr_id.
454 |  *
455 |  * Parameters:
456 |  *
457 |  * _In_ msr_id - MSR to write to
458 |  * _In_ val    - 64-bit value to write into MSR msr_id.
459 |  */
460 | void
461 | wrmsr(_In_ uint32_t msr_id, _In_ uint64_t val)
462 | {
463 | 	__asm__ volatile("wrmsr" :: "d"(val >> 32), "a"(val & 0xffffffff), "c"(msr_id));
464 | }
465 | 
466 | /* rdmsr()
467 |  *
468 |  * Summary:
469 |  *
470 |  * This function reads from the MSR specified by msr_id.
471 |  *
472 |  * Returns:
473 |  *
474 |  * Contents of MSR msr_id.
475 |  */
476 | uint64_t
477 | rdmsr(_In_ uint32_t msr_id)
478 | {
479 | 	uint64_t high;
480 | 	uint64_t low;
481 | 
482 | 	__asm__ volatile("rdmsr" : "=d"(high), "=a"(low) : "c"(msr_id));
483 | 
484 | 	return ((high << 32) | low);
485 | }
486 | 
487 | /* get_cpu_type()
488 |  *
489 |  * Summary:
490 |  *
491 |  * This function gets the current CPU model. Either INTEL, AMD, or UNKNOWN.
492 |  * It internally uses the CPU vendor string CPUID and a memcmp. Thus this is
493 |  * very slow.
494 |  *
495 |  * Returns:
496 |  *
497 |  * CPU manufacturer enum, either INTEL, AMD, or UNKNOWN.
498 |  */
499 | enum _cpu_type
500 | get_cpu_type(void)
501 | {
502 | 	uint32_t res[4];
503 | 	uint8_t  cpu_string[12] = { 0 };
504 | 
505 | 	cpuid(0, res);
506 | 
507 | 	*(uint32_t*)(cpu_string + 0) = res[1];
508 | 	*(uint32_t*)(cpu_string + 4) = res[3];
509 | 	*(uint32_t*)(cpu_string + 8) = res[2];
510 | 
511 | 	if(!memcmp(cpu_string, "GenuineIntel", 12)){
512 | 		return INTEL;
513 | 	} else if(!memcmp(cpu_string, "AuthenticAMD", 12)){
514 | 		return AMD;
515 | 	} else {
516 | 		return UNKNOWN;
517 | 	}
518 | }
519 | 
520 | /* is_bsp()
521 |  *
522 |  * Summary:
523 |  *
524 |  * This function returns 1 if the current running CPU is the BSP. Returns 0
525 |  * otherwise. This just reads out the contents of is_bsp from current_cpu.
526 |  * This value is populated during current_cpu initialization in mm_init_cpu().
527 |  */
528 | int
529 | is_bsp(void)
530 | {
531 | 	return current_cpu->is_bsp;
532 | }
533 | 
534 | /* cpu_start_aps()
535 |  *
536 |  * Summary:
537 |  *
538 |  * This function broadcasts to all-but-self an INIT-SIPI-SIPI sequence to
539 |  * bring up the APs on the system.
540 |  */
541 | void
542 | cpu_start_aps(void)
543 | {
544 | 	/* Bring up all other CPUs by sending INIT and SIPI to all but self */
545 | 	*(volatile uint32_t*)(current_cpu->apic + 0x300) = 0xc4500;
546 | 	rdtsc_sleep(1000);
547 | 	*(volatile uint32_t*)(current_cpu->apic + 0x300) = 0xc4608;
548 | 	rdtsc_sleep(1000);
549 | 	*(volatile uint32_t*)(current_cpu->apic + 0x300) = 0xc4608;
550 | 	rdtsc_sleep(1000);
551 | 
552 | 	return;
553 | }
554 | 
555 | 


--------------------------------------------------------------------------------
/srcs/cpu/cpu.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | /* Different CPU types */
 4 | enum _cpu_type {
 5 | 	UNKNOWN,
 6 | 	INTEL,
 7 | 	AMD
 8 | };
 9 | 
10 | struct _cpu*
11 | get_current_cpu(void);
12 | 
13 | void
14 | halt(void);
15 | 
16 | void
17 | panic(_In_z_ const char *reason);
18 | 
19 | int
20 | sync_bool_compare_and_swap_si128(
21 | 		_In_ volatile __m128i *src, _In_ __m128i cmp, _In_ __m128i val);
22 | 
23 | uint64_t
24 | rdpmc(_In_ uint32_t ctr_id);
25 | 
26 | void
27 | interrupts_enable_force(void);
28 | 
29 | void
30 | interrupts_disable_force(void);
31 | 
32 | void
33 | writedr0(_In_ uint64_t val);
34 | 
35 | void
36 | writedr1(_In_ uint64_t val);
37 | 
38 | void
39 | writedr2(_In_ uint64_t val);
40 | 
41 | void
42 | writedr3(_In_ uint64_t val);
43 | 
44 | void
45 | invlpg(_In_ void *addr);
46 | 
47 | void
48 | lgdt(_In_ void *gdt);
49 | 
50 | void
51 | lidt(_In_ void *idt);
52 | 
53 | void
54 | ltr(_In_ uint16_t tr);
55 | 
56 | void
57 | outb(_In_ uint16_t port, _In_ uint8_t val);
58 | 
59 | void
60 | outd(_In_ uint16_t port, _In_ uint32_t val);
61 | 
62 | uint8_t
63 | inb(_In_ uint16_t port);
64 | 
65 | uint32_t
66 | ind(_In_ uint16_t port);
67 | 
68 | uintptr_t
69 | readcr2(void);
70 | 
71 | uintptr_t
72 | readcr3(void);
73 | 
74 | void
75 | cpuid(_In_ uint32_t val, _Out_writes_bytes_all_(16) uint32_t *output);
76 | 
77 | void
78 | wrmsr(_In_ uint32_t msr_id, _In_ uint64_t val);
79 | 
80 | uint64_t
81 | rdmsr(_In_ uint32_t msr_id);
82 | 
83 | enum _cpu_type
84 | get_cpu_type(void);
85 | 
86 | int
87 | is_bsp(void);
88 | 
89 | void
90 | cpu_start_aps(void);
91 | 
92 | 


--------------------------------------------------------------------------------
/srcs/disk/ide.c:
--------------------------------------------------------------------------------
  1 | #include <grilled_cheese.h>
  2 | #include <disp/disp.h>
  3 | #include <generic/stdlib.h>
  4 | 
  5 | #define IO_ADDR_BASE 0x1f0
  6 | 
  7 | #define IDE_DATA      (IO_ADDR_BASE + 0)
  8 | #define IDE_ERROR     (IO_ADDR_BASE + 1)
  9 | #define IDE_FEATURES  (IO_ADDR_BASE + 1)
 10 | #define IDE_SECCOUNT0 (IO_ADDR_BASE + 2)
 11 | #define IDE_SECCOUNT1 (IO_ADDR_BASE + 2)
 12 | #define IDE_LBA0      (IO_ADDR_BASE + 3)
 13 | #define IDE_LBA3      (IO_ADDR_BASE + 3)
 14 | #define IDE_LBA1      (IO_ADDR_BASE + 4)
 15 | #define IDE_LBA4      (IO_ADDR_BASE + 4)
 16 | #define IDE_LBA2      (IO_ADDR_BASE + 5)
 17 | #define IDE_LBA5      (IO_ADDR_BASE + 5)
 18 | #define IDE_HDDEVSEL  (IO_ADDR_BASE + 6)
 19 | #define IDE_COMMAND   (IO_ADDR_BASE + 7)
 20 | #define IDE_STATUS    (IO_ADDR_BASE + 7)
 21 | 
 22 | #define IDE_CONTROL 0x3f6
 23 | 
 24 | #define IDE_OUT_WAIT(port, byte) {outb(port, byte); ide_wait_busy();}
 25 | 
 26 | /* ide_wait_busy()
 27 |  *
 28 |  * Summary:
 29 |  *
 30 |  * This function waits until the busy bit is no longer set on the IDE drive.
 31 |  */
 32 | void
 33 | ide_wait_busy(void)
 34 | {
 35 | 	while(inb(IDE_STATUS) & 0x80);
 36 | 	return;
 37 | }
 38 | 
 39 | /* ide_pio_read_sectors()
 40 |  *
 41 |  * Summary:
 42 |  *
 43 |  * This function reads a single sector from the IDE drive starting at
 44 |  * an LBA. It does the read via PIO mode, thus this is extremely slow.
 45 |  * This code is NOT thread safe.
 46 |  *
 47 |  * Parameters:
 48 |  *
 49 |  * _In_  lba     - LBA of the data to read
 50 |  * _Out_ buf     - Pointer to caller allocated buffer to receive 1 sector (512
 51 |  *                 bytes).
 52 |  * _In_  buf_len - Length of the buffer provided (in bytes)
 53 |  *
 54 |  * Returns:
 55 |  *
 56 |  * RSTATE_SUCCESS on success, otherwise error.
 57 |  */
 58 | rstate_t
 59 | ide_pio_read_sectors(
 60 | 		_In_ uint64_t                        lba,
 61 | 		_Out_writes_bytes_all_(512) uint8_t *buf,
 62 | 		_In_ size_t                          buf_len)
 63 | {
 64 | 	int ii;
 65 | 
 66 | 	static int reset = 0;
 67 | 
 68 | 	RSTATE_LOCALS;
 69 | 
 70 | 	RSCHECK(buf_len >= 512,
 71 | 			"Buffer supplied not large enough for 512-byte sector");
 72 | 
 73 | 	/* If the device is busy or this is our first entry of the function,
 74 | 	 * reset the device.
 75 | 	 */
 76 | 	if(!reset || (inb(IDE_STATUS) & (1 << 7))){
 77 | 		/* Reset the device */
 78 | 		outb(IDE_CONTROL, (1 << 2));
 79 | 		outb(IDE_CONTROL, 0);
 80 | 		ide_wait_busy();
 81 | 
 82 | 		reset = 1;
 83 | 	}
 84 | 
 85 | 	/* Disable interrupts */
 86 | 	IDE_OUT_WAIT(IDE_CONTROL, 2);
 87 | 	
 88 | 	/* Select master drive with LBA addressing mode */
 89 | 	IDE_OUT_WAIT(IDE_HDDEVSEL, 0xE0);
 90 | 
 91 | 	/* Set up to read one sector with the LBA specified */
 92 | 	IDE_OUT_WAIT(IDE_SECCOUNT1, 0);
 93 | 	IDE_OUT_WAIT(IDE_LBA5, (lba >> (8 * 5)) & 0xff);
 94 | 	IDE_OUT_WAIT(IDE_LBA4, (lba >> (8 * 4)) & 0xff);
 95 | 	IDE_OUT_WAIT(IDE_LBA3, (lba >> (8 * 3)) & 0xff);
 96 | 	IDE_OUT_WAIT(IDE_SECCOUNT0, 1);
 97 | 	IDE_OUT_WAIT(IDE_LBA2, (lba >> (8 * 2)) & 0xff);
 98 | 	IDE_OUT_WAIT(IDE_LBA1, (lba >> (8 * 1)) & 0xff);
 99 | 	IDE_OUT_WAIT(IDE_LBA0, (lba >> (8 * 0)) & 0xff);
100 | 
101 | 	/* Send the 48-bit LBA PIO read request command */
102 | 	outb(IDE_COMMAND, 0x24);
103 | 
104 | 	/* Poll for busy to clear, check for errors as well. */
105 | 	for( ; ; ){
106 | 		uint8_t status = inb(IDE_STATUS);
107 | 
108 | 		/* Check for an error */
109 | 		RSCHECK(!(status & (1 << 0)),
110 | 				"Error bit was set in status during IDE read");
111 | 		
112 | 		/* Check for a drive fault */
113 | 		RSCHECK(!(status & (1 << 5)),
114 | 				"Drive fault bit was set in status during IDE read");
115 | 
116 | 		/* Check if we're still busy, if we're not, end the loop */
117 | 		if(!(status & (1 << 7))){
118 | 			break;
119 | 		}
120 | 	}
121 | 
122 | 	/* Read in all 512 bytes of data */
123 | 	for(ii = 0; ii < 512; ii++){
124 | 		buf[ii] = inb(IDE_DATA);
125 | 	}
126 | 
127 | 	rstate_ret = rstate = RSTATE_SUCCESS;
128 | cleanup:
129 | 	RSTATE_RETURN;
130 | }
131 | 
132 | 


--------------------------------------------------------------------------------
/srcs/disk/ide.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | 
3 | rstate_t
4 | ide_pio_read_sectors(
5 | 		_In_ uint64_t                        lba,
6 | 		_Out_writes_bytes_all_(512) uint8_t *buf,
7 | 		_In_ size_t                          buf_len);
8 | 
9 | 


--------------------------------------------------------------------------------
/srcs/disp/disp.c:
--------------------------------------------------------------------------------
  1 | #include <grilled_cheese.h>
  2 | #include <generic/stdlib.h>
  3 | #include <interrupts/interrupts.h>
  4 | #include <net/net.h>
  5 | 
  6 | static uint8_t backing_screen[80*25*2] = { 0 };
  7 | static int backing_screen_init = 0;
  8 | 
  9 | static int screen_color = 0x0f00;
 10 | 
 11 | /* disp_err_mode()
 12 |  * 
 13 |  * Summary:
 14 |  *
 15 |  * Calling this function sets the screen color to be flashing text on a grey
 16 |  * background. This cannot be undone. This is used for when we panic or have
 17 |  * an error to change the screen output forever. Since we allow one core to
 18 |  * panic while still resuming execution on others, this allows a visual
 19 |  * reference to show that something occured, even if the panic output has
 20 |  * since been scrolled off screen.
 21 |  */
 22 | void
 23 | disp_err_mode(void)
 24 | {
 25 | 	screen_color = 0xf000;
 26 | }
 27 | 
 28 | /* puts_nolock()
 29 |  *
 30 |  * Summary:
 31 |  *
 32 |  * This function prints the null terminated string specified by str to the
 33 |  * screen. Interrupts are disabled when this function occurs to allow for
 34 |  * interrupt handlers to use the screen. We also acquire a lock during prints
 35 |  * to allow multiple CPUs to print to the screen without clobbering
 36 |  * eachother.
 37 |  *
 38 |  * The print first goes to the backing_screen. When it is complete this buffer
 39 |  * replaces the entire contents of the existing screen. This is done due to
 40 |  * the cost of reading the MMIO space of the screen. This way all the screen
 41 |  * reads are done in RAM, and only writes are done via MMIO.
 42 |  *
 43 |  * Parameters:
 44 |  *
 45 |  * _In_z_ str - Null terminated string to display.
 46 |  */
 47 | void
 48 | puts_nolock(_In_z_ const char *str)
 49 | {
 50 | 	uint8_t  *screen, *ptr, *end;
 51 | 	uint64_t  len;
 52 | 
 53 | 	screen = (uint8_t*)current_cpu->boot_params->screen;
 54 | 
 55 | 	/* Get the length of the string. This should also fault here if the
 56 | 	 * pointer or string is bad.
 57 | 	 */
 58 | 	len = strlen(str);
 59 | 
 60 | 	/* If we have a networking queue associated with this CPU end the string
 61 | 	 * over the network, with a maximum of 8192 bytes.
 62 | 	 */
 63 | 	if(current_cpu->net_queue){
 64 | 		struct _net_print {
 65 | 			uint64_t magic;
 66 | 			uint64_t req_id;
 67 | 			uint8_t  buf[8192];
 68 | 		} net_print;
 69 | 
 70 | 		uint64_t to_send;
 71 | 
 72 | 		/* Max size is 8k */
 73 | 		to_send = MIN(len, sizeof(net_print.buf));
 74 | 
 75 | 		/* Set up the string print structure packet */
 76 | 		net_print.magic  = NET_TERM_PRINTSTR;
 77 | 		net_print.req_id = aes_rand();
 78 | 		memcpy(net_print.buf, str, to_send);
 79 | 
 80 | 		if(net_start(current_cpu->net_queue) == RSTATE_SUCCESS){
 81 | 			/* Send the string to the server */
 82 | 			if(net_send_udp(current_cpu->net_queue, &net_print,
 83 | 					(uint32_t)offsetof(struct _net_print, buf)+to_send,
 84 | 					0, 0) != RSTATE_SUCCESS){
 85 | 				/* We cant really do anything in an error case. A panic would
 86 | 				 * cause a recursive print. A halt would just be confusing.
 87 | 				 */
 88 | 			}
 89 | 
 90 | 			net_stop(current_cpu->net_queue);
 91 | 		}
 92 | 	}
 93 | 
 94 | 	/* On the first time we use puts(), copy the original screen conents */
 95 | 	if(!backing_screen_init){
 96 | 		memcpy(backing_screen, screen, 80 * 25 * 2);
 97 | 		backing_screen_init = 1;
 98 | 	}
 99 | 
100 | 	/* Copy up the bottom 24 lines of the screen one line */
101 | 	memcpy(backing_screen, backing_screen + 80 * 2, 80 * 2 * 24);
102 | 
103 | 	/* Zero out the last line of the screen */
104 | 	memset(backing_screen + 80 * 2 * 24, 0, 80 * 2);
105 | 
106 | 	/* Seek to the end of the screen */
107 | 	ptr = backing_screen + 80 * 2 * 24;
108 | 	end = ptr + 80 * 2;
109 | 
110 | 	while(*str){
111 | 		if(ptr == end || *str == '\n'){
112 | 			/* Copy up the bottom 24 lines of the screen one line and zero out
113 | 			 * the last line
114 | 			 */
115 | 			memcpy(backing_screen, backing_screen + 80 * 2, 80 * 2 * 24);
116 | 			memset(backing_screen + 80 * 2 * 24, 0, 80 * 2);
117 | 
118 | 			ptr = backing_screen + 80 * 2 * 24;
119 | 			end = ptr + 80 * 2;
120 | 		}
121 | 
122 | 		/* If the character was not a newline, print it out to the screen */
123 | 		if(*str != '\n'){
124 | 			*(uint16_t*)ptr = screen_color | *str;
125 | 			ptr += 2;
126 | 		}
127 | 
128 | 		str++;
129 | 	}
130 | 
131 | 	/* Swap in the backing screen to the actual hardware screen */
132 | 	memcpy(screen, backing_screen, 80 * 25 * 2);
133 | 
134 | 	return;
135 | }
136 | 
137 | /* puts()
138 |  *
139 |  * Summary:
140 |  *
141 |  * This function outputs the null terminated string str to the screen. See
142 |  * puts_nolock() for more information.
143 |  *
144 |  * Parameters:
145 |  *
146 |  * _In_z_ str - Null terminated string to display.
147 |  */
148 | static void
149 | puts(_In_z_ const char *str)
150 | {
151 | 	/* Disable interrupts */
152 | 	interrupts_disable();
153 | 
154 | 	/* Acquire lock */
155 | 	spinlock_acquire(DISP_LOCK);
156 | 
157 | 	puts_nolock(str);
158 | 	
159 | 	/* Release the lock */
160 | 	spinlock_release(DISP_LOCK);
161 | 
162 | 	/* Re-enable interrupts */
163 | 	interrupts_enable();
164 | }
165 | 
166 | /* printf()
167 |  *
168 |  * Summary:
169 |  *
170 |  * Print out a formatted string to the screen. The maximum printable size is
171 |  * 4096.
172 |  *
173 |  * Parameters:
174 |  *
175 |  * _In_z_ format - printf format string
176 |  */
177 | void
178 | printf(_In_z_ _Printf_format_string_ const char *format, ...)
179 | {
180 | 	va_list ap;
181 | 
182 | 	char     buf[4096];
183 | 	uint64_t len;
184 | 
185 | 	va_start(ap, format);
186 | 
187 | 	len = vsnprintf(buf, sizeof(buf), format, ap);
188 | 	if(len){
189 | 		puts(buf);
190 | 	} else {
191 | 		puts("!!! printf format error !!!");
192 | 	}
193 | 
194 | 	va_end(ap);
195 | 	return;
196 | }
197 | 
198 | 


--------------------------------------------------------------------------------
/srcs/disp/disp.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | void
 4 | disp_err_mode(void);
 5 | 
 6 | void
 7 | puts_nolock(_In_z_ const char *str);
 8 | 
 9 | void
10 | printf(_In_z_ _Printf_format_string_ const char *format, ...)
11 | 	__attribute__((format(printf, 1, 2)));
12 | 
13 | 


--------------------------------------------------------------------------------
/srcs/dstruc/hash_table.c:
--------------------------------------------------------------------------------
  1 | #include <grilled_cheese.h>
  2 | #include <mm/mm.h>
  3 | #include <dstruc/hash_table.h>
  4 | #include <generic/stdlib.h>
  5 | 
  6 | /* ht_create()
  7 |  *
  8 |  * Summary:
  9 |  *
 10 |  * This function creates a new hash table capable of holding 2^size entries.
 11 |  *
 12 |  * Parameters:
 13 |  *
 14 |  * _In_ size       - Order of the hash table (can hold 2^size entries)
 15 |  * _Outptr_ out_ht - Caller allocated storage to receive pointer to newly
 16 |  *                   allocated hash table.
 17 |  *
 18 |  * Returns:
 19 |  *
 20 |  * RSTATE_SUCCESS on success, otherwise error.
 21 |  */
 22 | rstate_t
 23 | ht_create(_In_ uint64_t size, _Outptr_ struct _hash_table **out_ht)
 24 | {
 25 | 	struct _hash_table *ht;
 26 | 
 27 | 	RSTATE_LOCALS;
 28 | 
 29 | 	rstate = phalloc(offsetof(struct _hash_table, entry) +
 30 | 			(1UL << size) * sizeof(ht->entry), (void**)&ht);
 31 | 	RSCHECK_NESTED("Failed to allocate room for hash table");
 32 | 
 33 | 	rstate = phalloc(8 * (1UL << size), (void**)&ht->seq_data);
 34 | 	RSCHECK_NESTED("Failed to allocate room for hash table seq data");
 35 | 
 36 | 	ht->bits = size;
 37 | 
 38 | 	*out_ht = ht;
 39 | 
 40 | 	rstate_ret = RSTATE_SUCCESS;
 41 | cleanup:
 42 | 	RSTATE_RETURN;
 43 | }
 44 | 
 45 | /* ht_rand()
 46 |  *
 47 |  * Summary:
 48 |  * 
 49 |  * This function selects and returns a random entry in a hash table. Note that
 50 |  * hash tables don't necessaraly contain pointers to things. Use this only
 51 |  * if you know the entries of the hash table are pointers.
 52 |  *
 53 |  * Parmeters:
 54 |  *
 55 |  * _In_ ht - Hash table to select random entry from
 56 |  *
 57 |  * Returns:
 58 |  *
 59 |  * Pointer to random hash table entry on success
 60 |  * NULL if the hash table is empty
 61 |  */
 62 | void*
 63 | ht_rand(_In_ volatile struct _hash_table *ht)
 64 | {
 65 | 	uint64_t ent;
 66 | 
 67 | 	if(!ht->entries)
 68 | 		return NULL;
 69 | 
 70 | 	for( ; ; ){
 71 | 		ent = aes_rand() % ht->entries;
 72 | 		if(!ht->seq_data[ent])
 73 | 			continue;
 74 | 
 75 | 		if(!ht->seq_data[ent][0])
 76 | 			continue;
 77 | 
 78 | 		return ht->seq_data[ent][0];
 79 | 	}
 80 | }
 81 | 
 82 | /* ht_fetch_or_lock()
 83 |  *
 84 |  * Summary:
 85 |  *
 86 |  * This function either returns out the entry indexed by hash, or acquires
 87 |  * a lock on the entry allowing the caller to insert an entry.
 88 |  *
 89 |  * This function is a bit strange, in that the 'ret' parameter can either
 90 |  * receive the contents of the entry in the hash table (if this function
 91 |  * returns 0. Or if this function returns 1, it returns a pointer to the
 92 |  * location in the hash table itself that needs to be populated.
 93 |  *
 94 |  * The value inserted into the page table must never be NULL, as the NULL state
 95 |  * indicates a lock is held and the entry is waiting to be populated. Inserting
 96 |  * a NULL may result in a deadlock.
 97 |  *
 98 |  * There is also no protection if the table grows to maximum size, in this case
 99 |  * it'll get stuck in an infinite loop. In the future we may change this, but
100 |  * until then, just make a large enough hash table for what you theoretically
101 |  * will store.
102 |  *
103 |  * Parameters:
104 |  *
105 |  * _In_     ht   - Hash table to operate on
106 |  * _In_     hash - Hash to use to index the hash table
107 |  * _Outptr_ ret  - If function returns 1:
108 |  *                     Pointer to location to populate with hash table entry
109 |  *                     this entry is locked until it is populated, and other
110 |  *                     accesses to this entry spin until it has been filled in.
111 |  *                 If function returns 0:
112 |  *                     Hash table entry
113 |  *
114 |  * Returns:
115 |  *
116 |  * 0 - If the hash table entry is returned
117 |  * 1 - If a pointer to the hash table entry to populate is returned
118 |  */
119 | int
120 | ht_fetch_or_lock(
121 | 		_In_     volatile struct _hash_table  *ht,
122 | 		_In_     __m128i                       hash,
123 | 		_Outptr_ void                        **ret)
124 | {
125 | 	uint64_t ent, qhash[2], nullhash[2];
126 | 
127 | 	/* A hash value of 0 is not allowed! */
128 | 	if(hashnull(hash))
129 | 		return -1;
130 | 
131 | 	/* Copy the 128-bit hash to 2 64-bit ints for convience */
132 | 	_mm_storeu_si128((void*)qhash, hash);
133 | 
134 | 	/* Mask the hash against the mask of the hash table */
135 | 	ent = qhash[0] & ((1UL << ht->bits) - 1);
136 | 
137 | 	for( ; ; ){
138 | 		if(!hashnull(ht->entry[ent].hash)){
139 | 			/* If the entry matches our hash, we're done! */
140 | 			if(hasheq(ht->entry[ent].hash, hash)){
141 | 				goto wait_for_data;
142 | 			}
143 | 
144 | 			/* Hash did not match ours, go to the next one */
145 | 			ent++;
146 | 			continue;
147 | 		}
148 | 
149 | 		/* Zero out the value for the compare exchange */
150 | 		memset(nullhash, 0, 16);
151 | 
152 | 		/* Hash was empty, try to win the race */
153 | 		if(sync_bool_compare_and_swap_si128(&ht->entry[ent].hash,
154 | 					_mm_setzero_si128(), hash)){
155 | 			uint64_t seq_id;
156 | 
157 | 			/* We won the race, return a pointer to the value to fill in */
158 | 			seq_id = __sync_fetch_and_add((volatile int64_t*)&ht->entries, 1);
159 | 			ht->seq_data[seq_id] = (void*)&ht->entry[ent].data;
160 | 
161 | 			*ret = (void*)&ht->entry[ent].data;
162 | 			return 1;
163 | 		} else {
164 | 			/* We may have lost the race to a colliding input, verify
165 | 			 * that the hash matches.
166 | 			 */
167 | 			if(!hasheq(ht->entry[ent].hash, hash)){
168 | 				/* Hash did not match, try the next entry */
169 | 				ent++;
170 | 				continue;
171 | 			}
172 | 
173 | wait_for_data:
174 | 			/* We lost the race to a matching hash, wait until the entry
175 | 			 * is filled in.
176 | 			 */
177 | 			while(!ht->entry[ent].data) _mm_pause();
178 | 
179 | 			/* Sadly we need this to please /analyze */
180 | 			if(!ht->entry[ent].data){
181 | 				return -1;
182 | 			}
183 | 
184 | 			*ret = (void*)ht->entry[ent].data;
185 | 			return 0;
186 | 		}
187 | 	}
188 | }
189 | 
190 | /* ht_probe()
191 |  *
192 |  * Summary:
193 |  *
194 |  * Attempts to fetch the entry in the hash table ht indexed by hash. If there
195 |  * is no entry matching hash, NULL is returned. Otherwise, the entry itself
196 |  * is returned.
197 |  *
198 |  * Parameters:
199 |  *
200 |  * _In_ ht   - Hash table to operate on
201 |  * _In_ hash - Hash to index hash table with
202 |  *
203 |  * Returns:
204 |  *
205 |  * NULL if no entry is present in the hash table
206 |  * Otherwise returns entry corresponding to hash in the hash table.
207 |  */
208 | void*
209 | ht_probe(
210 | 		_In_ volatile struct _hash_table *ht,
211 | 		_In_ __m128i                      hash)
212 | {
213 | 	uint64_t ent, qhash[2];
214 | 
215 | 	/* A hash value of 0 is not allowed! */
216 | 	if(hashnull(hash)){
217 | 		return NULL;
218 | 	}
219 | 
220 | 	/* Copy the 128-bit hash to 2 64-bit ints for convience */
221 | 	_mm_storeu_si128((void*)qhash, hash);
222 | 
223 | 	/* Mask the hash against the mask of the hash table */
224 | 	ent = qhash[0] & ((1UL << ht->bits) - 1);
225 | 
226 | 	for( ; ; ){
227 | 		if(!hashnull(ht->entry[ent].hash)){
228 | 			/* If the entry matches our hash, we're done! */
229 | 			if(hasheq(ht->entry[ent].hash, hash)){
230 | 				return ht->entry[ent].data;
231 | 			}
232 | 
233 | 			/* Hash did not match ours, go to the next one */
234 | 			ent++;
235 | 			continue;
236 | 		}
237 | 
238 | 		return NULL;
239 | 	}
240 | }
241 | 
242 | 


--------------------------------------------------------------------------------
/srcs/dstruc/hash_table.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | struct _hash_table {
 4 | 	uint64_t bits;
 5 | 	uint64_t entries;
 6 | 
 7 | 	void ***seq_data;
 8 | 
 9 | 	struct {
10 | 		__m128i  hash;
11 | 		void    *data;
12 | 	} entry[1];
13 | };
14 | 
15 | rstate_t
16 | ht_create(_In_ uint64_t size, _Outptr_ struct _hash_table **out_ht);
17 | 
18 | void*
19 | ht_rand(_In_ volatile struct _hash_table *ht);
20 | 
21 | int
22 | ht_fetch_or_lock(
23 | 		_In_     volatile struct _hash_table  *ht,
24 | 		_In_     __m128i                       hash,
25 | 		_Outptr_ void                        **ret);
26 | 
27 | void*
28 | ht_probe(
29 | 		_In_ volatile struct _hash_table *ht,
30 | 		_In_ __m128i                      hash);
31 | 
32 | 


--------------------------------------------------------------------------------
/srcs/emu/mips.h:
--------------------------------------------------------------------------------
  1 | #pragma once
  2 | 
  3 | #define MIPS_REG_ZERO 0
  4 | #define MIPS_REG_AT   1
  5 | #define MIPS_REG_V0   2
  6 | #define MIPS_REG_V1   3
  7 | #define MIPS_REG_A0   4
  8 | #define MIPS_REG_A1   5
  9 | #define MIPS_REG_A2   6
 10 | #define MIPS_REG_A3   7
 11 | #define MIPS_REG_T0   8
 12 | #define MIPS_REG_T1   9
 13 | #define MIPS_REG_T2   10
 14 | #define MIPS_REG_T3   11
 15 | #define MIPS_REG_T4   12
 16 | #define MIPS_REG_T5   13
 17 | #define MIPS_REG_T6   14
 18 | #define MIPS_REG_T7   15
 19 | #define MIPS_REG_S0   16
 20 | #define MIPS_REG_S1   17
 21 | #define MIPS_REG_S2   18
 22 | #define MIPS_REG_S3   19
 23 | #define MIPS_REG_S4   20
 24 | #define MIPS_REG_S5   21
 25 | #define MIPS_REG_S6   22
 26 | #define MIPS_REG_S7   23
 27 | #define MIPS_REG_T8   24
 28 | #define MIPS_REG_T9   25
 29 | #define MIPS_REG_K0   26
 30 | #define MIPS_REG_K1   27
 31 | #define MIPS_REG_GP   28
 32 | #define MIPS_REG_SP   29
 33 | #define MIPS_REG_S8   30
 34 | #define MIPS_REG_FP   30
 35 | #define MIPS_REG_RA   31
 36 | 
 37 | /* Non-traditional numbering */
 38 | #define MIPS_REG_PC   32
 39 | #define MIPS_REG_HI   33
 40 | #define MIPS_REG_LO   34
 41 | 
 42 | #define MIPS_REG_COP0_STATUS 35
 43 | #define MIPS_REG_COP0_COUNT  36
 44 | 
 45 | #define MIPS_ADDRESS_SPACE_SIZE (4UL * 1024 * 1024 * 1024)
 46 | #define MIPS_RAM_BASE           0x80000000UL
 47 | #define MIPS_RAM_END            (MIPS_RAM_BASE + 128 * 1024 * 1024)
 48 | 
 49 | #define MIPS_PC_TO_JIT(pc) \
 50 | 	(((pc) >= MIPS_RAM_BASE && (pc) < MIPS_RAM_END) ? \
 51 | 		((uint8_t*)pc_to_jit[(pc) - MIPS_RAM_BASE]) : NULL);
 52 | 
 53 | #define JIT_XCHG_EAX_EBX() \
 54 | 	*jitbuf++ = 0x93;
 55 | 
 56 | #define JIT_READ_REG_INTO_EAX(reg) \
 57 | 	*(uint16_t*)(jitbuf + 0) = 0x858b; /* mov eax, dword [rbp + imm32] */ \
 58 | 	*(uint32_t*)(jitbuf + 2) = (reg)*4; \
 59 | 	jitbuf += 6;
 60 | 
 61 | #define JIT_READ_REG_INTO_EBX(reg) \
 62 | 	*(uint16_t*)(jitbuf + 0) = 0x9d8b; /* mov ebx, dword [rbp + imm32] */ \
 63 | 	*(uint32_t*)(jitbuf + 2) = (reg)*4; \
 64 | 	jitbuf += 6;
 65 | 
 66 | #define JIT_READ_REG_INTO_ECX(reg) \
 67 | 	*(uint16_t*)(jitbuf + 0) = 0x8d8b; /* mov ecx, dword [rbp + imm32] */ \
 68 | 	*(uint32_t*)(jitbuf + 2) = (reg)*4; \
 69 | 	jitbuf += 6;
 70 | 
 71 | #define JIT_READ_REG_INTO_ESI(reg) \
 72 | 	*(uint16_t*)(jitbuf + 0) = 0xb58b; /* mov esi, dword [rbp + imm32] */ \
 73 | 	*(uint32_t*)(jitbuf + 2) = (reg)*4; \
 74 | 	jitbuf += 6;
 75 | 
 76 | #define JIT_READ_REG_INTO_EDI(reg) \
 77 | 	*(uint16_t*)(jitbuf + 0) = 0xbd8b; /* mov edi, dword [rbp + imm32] */ \
 78 | 	*(uint32_t*)(jitbuf + 2) = (reg)*4; \
 79 | 	jitbuf += 6;
 80 | 
 81 | #define JIT_WRITE_REG_FROM_EAX(reg) \
 82 | 	*(uint16_t*)(jitbuf + 0) = 0x8589; /* mov dword [rbp + imm32], eax */ \
 83 | 	*(uint32_t*)(jitbuf + 2) = (reg)*4; \
 84 | 	jitbuf += 6;
 85 | 
 86 | #define JIT_WRITE_REG_FROM_EBX(reg) \
 87 | 	*(uint16_t*)(jitbuf + 0) = 0x9d89; /* mov dword [rbp + imm32], ebx */ \
 88 | 	*(uint32_t*)(jitbuf + 2) = (reg)*4; \
 89 | 	jitbuf += 6;
 90 | 
 91 | #define JIT_WRITE_REG_FROM_EDX(reg) \
 92 | 	*(uint16_t*)(jitbuf + 0) = 0x9589; /* mov dword [rbp + imm32], edx */ \
 93 | 	*(uint32_t*)(jitbuf + 2) = (reg)*4; \
 94 | 	jitbuf += 6;
 95 | 
 96 | #define JIT_ADD_EAX_IMM32(imm32) \
 97 | 	*(uint8_t* )(jitbuf + 0) = 0x05; /* add eax, imm32 */ \
 98 | 	*(uint32_t*)(jitbuf + 1) = (imm32); \
 99 | 	jitbuf += 5;
100 | 
101 | #define JIT_MOV_EAX_IMM32(imm32) \
102 | 	*(uint8_t* )(jitbuf + 0) = 0xb8; /* mov eax, imm32 */ \
103 | 	*(uint32_t*)(jitbuf + 1) = (imm32); \
104 | 	jitbuf += 5;
105 | 
106 | #define JIT_ADD_EAX_EBX() \
107 | 	*(uint16_t*)jitbuf = 0xd801; /* add eax, ebx */ \
108 | 	jitbuf += 2;
109 | 
110 | #define JIT_AND_EAX_EBX() \
111 | 	*(uint16_t*)jitbuf = 0xd821; /* and eax, ebx */ \
112 | 	jitbuf += 2;
113 | 
114 | #define JIT_OR_EAX_EBX() \
115 | 	*(uint16_t*)jitbuf = 0xd809; /* or eax, ebx */ \
116 | 	jitbuf += 2;
117 | 
118 | #define JIT_XOR_EAX_EBX() \
119 | 	*(uint16_t*)jitbuf = 0xd831; /* xor eax, ebx */ \
120 | 	jitbuf += 2;
121 | 
122 | #define JIT_NOT_EAX() \
123 | 	*(uint16_t*)jitbuf = 0xd0f7; /* not eax */ \
124 | 	jitbuf += 2;
125 | 
126 | #define JIT_SUB_EAX_EBX() \
127 | 	*(uint16_t*)jitbuf = 0xd829; /* sub eax, ebx */ \
128 | 	jitbuf += 2;
129 | 
130 | #define JIT_CMP_EAX_EBX() \
131 | 	*(uint16_t*)jitbuf = 0xd839; /* cmp eax, ebx */ \
132 | 	jitbuf += 2;
133 | 
134 | #define JIT_SETB_AL() \
135 | 	memcpy(jitbuf, "\x0f\x92\xc0", 3); /* setb al */ \
136 | 	jitbuf += 3;
137 | 
138 | #define JIT_SETL_AL() \
139 | 	memcpy(jitbuf, "\x0f\x9c\xc0", 3); /* setl al */ \
140 | 	jitbuf += 3;
141 | 
142 | #define JIT_AND_EAX_IMM32(imm32) \
143 | 	*(uint8_t* )(jitbuf + 0) = 0x25; /* and eax, imm32 */ \
144 | 	*(uint32_t*)(jitbuf + 1) = (imm32); \
145 | 	jitbuf += 5;
146 | 
147 | #define JIT_XOR_EAX_IMM32(imm32) \
148 | 	*(uint8_t* )(jitbuf + 0) = 0x35; /* xor eax, imm32 */ \
149 | 	*(uint32_t*)(jitbuf + 1) = (imm32); \
150 | 	jitbuf += 5;
151 | 
152 | #define JIT_OR_EAX_IMM32(imm32) \
153 | 	*(uint8_t* )(jitbuf + 0) = 0x0d; /* and eax, imm32 */ \
154 | 	*(uint32_t*)(jitbuf + 1) = (imm32); \
155 | 	jitbuf += 5;
156 | 
157 | #define JIT_CMP_EAX_IMM32(imm32) \
158 | 	*(uint8_t* )(jitbuf + 0) = 0x3d; /* cmp eax, imm32 */ \
159 | 	*(uint32_t*)(jitbuf + 1) = (imm32); \
160 | 	jitbuf += 5;
161 | 
162 | #define JIT_CMP_ESI_IMM32(imm32) \
163 | 	*(uint16_t*)(jitbuf + 0) = 0xfe81; /* cmp esi, imm32 */ \
164 | 	*(uint32_t*)(jitbuf + 2) = (imm32); \
165 | 	jitbuf += 6;
166 | 
167 | #define JIT_CMP_ESI_EDI() \
168 | 	*(uint16_t*)(jitbuf + 0) = 0xfe39; /* cmp esi, edi */ \
169 | 	jitbuf += 2;
170 | 
171 | #define JIT_JMP() \
172 | 	*(uint8_t* )(jitbuf + 0) = 0xe9; /* jmp near imm32 */ \
173 | 	*(uint32_t*)(jitbuf + 1) = 0; \
174 | 	jitbuf += 5;
175 | 
176 | #define JIT_JLE() \
177 | 	*(uint16_t*)(jitbuf + 0) = 0x8e0f; /* jle near imm32 */ \
178 | 	*(uint32_t*)(jitbuf + 2) = 0; \
179 | 	jitbuf += 6;
180 | 
181 | #define JIT_JG() \
182 | 	*(uint16_t*)(jitbuf + 0) = 0x8f0f; /* jg near imm32 */ \
183 | 	*(uint32_t*)(jitbuf + 2) = 0; \
184 | 	jitbuf += 6;
185 | 
186 | #define JIT_JL() \
187 | 	*(uint16_t*)(jitbuf + 0) = 0x8c0f; /* jl near imm32 */ \
188 | 	*(uint32_t*)(jitbuf + 2) = 0; \
189 | 	jitbuf += 6;
190 | 
191 | #define JIT_JGE() \
192 | 	*(uint16_t*)(jitbuf + 0) = 0x8d0f; /* jge near imm32 */ \
193 | 	*(uint32_t*)(jitbuf + 2) = 0; \
194 | 	jitbuf += 6;
195 | 
196 | #define JIT_JZ() \
197 | 	*(uint16_t*)(jitbuf + 0) = 0x840f; /* jz near imm32 */ \
198 | 	*(uint32_t*)(jitbuf + 2) = 0; \
199 | 	jitbuf += 6;
200 | 
201 | #define JIT_JNZ() \
202 | 	*(uint16_t*)(jitbuf + 0) = 0x850f; /* jnz near imm32 */ \
203 | 	*(uint32_t*)(jitbuf + 2) = 0; \
204 | 	jitbuf += 6;
205 | 
206 | #define JIT_SHL_EAX(shamt) \
207 | 	*(uint16_t*)(jitbuf + 0) = 0xe0c1; /* shl eax, shamt */ \
208 | 	*(uint8_t* )(jitbuf + 2) = shamt; \
209 | 	jitbuf += 3;
210 | 
211 | #define JIT_SHR_EAX(shamt) \
212 | 	*(uint16_t*)(jitbuf + 0) = 0xe8c1; /* shr eax, shamt */ \
213 | 	*(uint8_t* )(jitbuf + 2) = shamt; \
214 | 	jitbuf += 3;
215 | 
216 | #define JIT_SHR_EAX_CL() \
217 | 	*(uint16_t*)(jitbuf + 0) = 0xe8d3; /* shr eax, cl */ \
218 | 	jitbuf += 2;
219 | 
220 | #define JIT_SAR_EAX_CL() \
221 | 	*(uint16_t*)(jitbuf + 0) = 0xf8d3; /* sar eax, cl */ \
222 | 	jitbuf += 2;
223 | 
224 | #define JIT_SHL_EAX_CL() \
225 | 	*(uint16_t*)(jitbuf + 0) = 0xe0d3; /* shl eax, cl */ \
226 | 	jitbuf += 2;
227 | 
228 | #define JIT_SAR_EAX(shamt) \
229 | 	*(uint16_t*)(jitbuf + 0) = 0xf8c1; /* sar eax, shamt */ \
230 | 	*(uint8_t* )(jitbuf + 2) = shamt; \
231 | 	jitbuf += 3;
232 | 
233 | #define JIT_CMOVZ_EAX_EBX() \
234 | 	memcpy(jitbuf, "\x0f\x44\xc3", 3); /* cmovz eax, ebx */ \
235 | 	jitbuf += 3;
236 | 
237 | #define JIT_CMOVNZ_EAX_EBX() \
238 | 	memcpy(jitbuf, "\x0f\x45\xc3", 3); /* cmovnz eax, ebx */ \
239 | 	jitbuf += 3;
240 | 
241 | #define JIT_DIV_EAX_EBX() \
242 | 	memcpy(jitbuf, "\x31\xd2\xf7\xf3", 4); /* xor edx, edx ; div ebx */ \
243 | 	jitbuf += 4;
244 | 
245 | #define JIT_IDIV_EAX_EBX() \
246 | 	memcpy(jitbuf, "\x31\xd2\xf7\xfb", 4); /* xor edx, edx ; idiv ebx */ \
247 | 	jitbuf += 4;
248 | 
249 | #define JIT_MUL_EAX_EBX() \
250 | 	memcpy(jitbuf, "\x31\xd2\xf7\xe3", 4); /* xor edx, edx ; mul ebx */ \
251 | 	jitbuf += 4;
252 | 
253 | #define JIT_IMUL_EAX_EBX() \
254 | 	memcpy(jitbuf, "\x31\xd2\xf7\xeb", 4); /* xor edx, edx ; imul ebx */ \
255 | 	jitbuf += 4;
256 | 
257 | #define JIT_WRITE_MEM_BYTE() \
258 | 	memcpy(jitbuf, "\x88\x1c\x04", 3); /* mov byte [rsp + rax], bl */\
259 | 	jitbuf += 3;
260 | 
261 | #define JIT_WRITE_MEM_WORD() \
262 | 	memcpy(jitbuf, "\x86\xdf\x66\x89\x1c\x04", 6); /* xchg bl, bh ; mov word [rsp + rax], bx */\
263 | 	jitbuf += 6;
264 | 
265 | #define JIT_WRITE_MEM() \
266 | 	memcpy(jitbuf, "\x0f\xcb\x89\x1c\x04", 5); /* bswap ebx
267 | 												  mov dword [rsp + rax], ebx */\
268 | 	jitbuf += 5;
269 | 
270 | #define JIT_READ_MEM_BYTE_ZX() \
271 | 	memcpy(jitbuf, "\x0f\xb6\x1c\x04", 4); /* movzx ebx, byte [rsp + rax] */\
272 | 	jitbuf += 4;
273 | 
274 | #define JIT_READ_MEM_BYTE_SX() \
275 | 	memcpy(jitbuf, "\x0f\xbe\x1c\x04", 4); /* movsx ebx, byte [rsp + rax]  */\
276 | 	jitbuf += 4;
277 | 
278 | #define JIT_READ_MEM_WORD_ZX() \
279 | 	memcpy(jitbuf, "\x0f\xb7\x1c\x04\x86\xdf", 6); /* movzx ebx, word [rsp + rax] ; xchg bl, bh  */\
280 | 	jitbuf += 6;
281 | 
282 | #define JIT_READ_MEM_WORD_SX() \
283 | 	memcpy(jitbuf, "\x0f\xbf\x1c\x04\x86\xdf", 6); /* movzx ebx, word [rsp + rax] ; xchg bl, bh  */\
284 | 	jitbuf += 6;
285 | 
286 | #define JIT_READ_MEM() \
287 | 	memcpy(jitbuf, "\x8b\x1c\x04\x0f\xcb", 5); /* mov ebx, dword [rsp + rax]
288 | 												  bswap ebx */\
289 | 	jitbuf += 5;
290 | 
291 | #define JIT_MOV_R10_IMM32(x) \
292 | 	*(uint16_t*)(jitbuf + 0) = 0xba41; \
293 | 	*(uint32_t*)(jitbuf + 2) = x; \
294 | 	jitbuf += 6;
295 | 
296 | /* inc  r11
297 |  * cmp  r11, imm32
298 |  * jnae short .good
299 |  * icebp
300 |  * .good:
301 |  */
302 | #define JIT_UPDATE_COUNT(x) \
303 | 	memcpy(jitbuf, "\x49\xff\xc3\x49\x81\xfb\x41\x41\x41\x41\x72\x01\xf1", 13); \
304 | 	*(uint32_t*)(jitbuf + 6) = x; \
305 | 	jitbuf += 13;
306 | 
307 | /* inc r11 */
308 | #define JIT_UPDATE_COUNT_UNSAFE(x) \
309 | 	memcpy(jitbuf, "\x49\xff\xc3", 3); \
310 | 	jitbuf += 3;
311 | 
312 | /* xor  edx, edx
313 |  * imul ebx
314 |  * add  eax, dword [rbp + 34*4]
315 |  * adc  edx, dword [rbp + 33*4]
316 |  */
317 | #define JIT_MADD_SPECIAL() \
318 | 	memcpy(jitbuf, "\x31\xd2\xf7\xeb\x03\x85\x88\x00\x00\x00\x13\x95\x84\x00\x00\x00", 16); \
319 | 	jitbuf += 16;
320 | 
321 | /* mov edx, 0x80000000
322 |  * sub rdi, rdx
323 |  * jmp qword [r9 + rdi*8]
324 |  */
325 | #define JIT_REG_JMP_EDI() \
326 | 	memcpy(jitbuf, "\xba\x00\x00\x00\x80\x48\x29\xd7\x41\xff\x24\xf9", 12); \
327 | 	jitbuf += 12;
328 | 
329 | /* mov dword [r12+r11*4], r10d */
330 | #define JIT_STORE_PC_R12_DWORD() \
331 | 	memcpy(jitbuf, "\x47\x89\x14\x9c", 4); \
332 | 	jitbuf += 4;
333 | 
334 | /* mov qword [r12+r11*8], r10 */
335 | #define JIT_STORE_PC_R12_QWORD() \
336 | 	memcpy(jitbuf, "\x4f\x89\x14\xdc", 4); \
337 | 	jitbuf += 4;
338 | 
339 | /* jit calling convention:
340 |  *
341 |  * rbp - Points to register state
342 |  * rsp - Points to memory base (PA: 0x00000000)
343 |  * r9  - Points to PC to JIT translation array
344 |  * r10 - PC, stored on each instruction
345 |  * r11 - Instruction count
346 |  * r12 - Pointer to PC buffer
347 |  */
348 | 
349 | struct _emu_mips {
350 | 	/* 4GB reserved memory range */
351 | 	uint8_t  *address_space;
352 | 	uint64_t  address_space_key;
353 | 
354 | 	/* MIPS register state */
355 | 	uint32_t *regs;
356 | 	uint64_t  regs_map_key;
357 | 
358 | 	/* x86 register state */
359 | 	uint64_t rax;
360 | 	uint64_t rbx;
361 | 	uint64_t rcx;
362 | 	uint64_t rdx;
363 | 	uint64_t rsi;
364 | 	uint64_t rdi;
365 | 	uint64_t rbp;
366 | 	uint64_t r9;
367 | 	uint64_t r10;
368 | 	uint64_t r11;
369 | 	uint64_t r12;
370 | };
371 | 
372 | union _emu_mips_inst {
373 | 	uint32_t backing;
374 | 
375 | 	struct {
376 | 		uint32_t imm:16;
377 | 		uint32_t rt:5;
378 | 		uint32_t rs:5;
379 | 		uint32_t opcode:6;
380 | 	} i;
381 | 
382 | 	struct {
383 | 		uint32_t func:6;
384 | 		uint32_t shamt:5;
385 | 		uint32_t rd:5;
386 | 		uint32_t rt:5;
387 | 		uint32_t rs:5;
388 | 		uint32_t opcode:6;
389 | 	} r;
390 | 
391 | 	struct {
392 | 		uint32_t addr:26;
393 | 		uint32_t opcode:6;
394 | 	} j;
395 | 
396 | 	struct {
397 | 		uint32_t sel:3;
398 | 		uint32_t zero:8;
399 | 		uint32_t rd:5;
400 | 		uint32_t rt:5;
401 | 		uint32_t mf:5;
402 | 		uint32_t inst:6;
403 | 	} cop;
404 | };
405 | 
406 | struct _emu_mips_reloc {
407 | 	uint32_t  mips_src;  /* Address of the mips branch instruction */
408 | 	uint32_t  mips_dest; /* Desired target of the branch */
409 | 	uint8_t  *jit_broff; /* Pointer to the JIT branch 32-bit offset. For
410 | 							example if the instruction was 'jmp target' the
411 | 							op would be e9 41 41 41 41. This would point to the
412 | 							41 41 41 41. */
413 | };
414 | 
415 | rstate_t
416 | emu_mips_create(void);
417 | 
418 | rstate_t
419 | emu_mips_translate(
420 | 		const uint8_t *instructions,
421 | 		uint64_t       length,
422 | 		uint8_t       *jit_output);
423 | 
424 | void
425 | emu_mips_print(const uint32_t *regs);
426 | 
427 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/chrome.dc:
--------------------------------------------------------------------------------
  1 | #include <falkos.h>
  2 | #include <generic/stdlib.h>
  3 | #include <fuzzers/chrome/ipcgen.h>
  4 | #include <net/x540.h>
  5 | #include <mm/mm.h>
  6 | #include <fuzzers/chrome.h>
  7 | #include <dstruc/hash_table.h>
  8 | #include <vm/vm.h>
  9 | #include <vm/svm.h>
 10 | #include <fuzzers/helpers.h>
 11 | #include <time/time.h>
 12 | #include <profiling/profiling.h>
 13 | #include <disp/disp.h>
 14 | 
 15 | static uint8_t *pnd_corpus = NULL;
 16 | static uint64_t pnd_corpus_len = 0;
 17 | 
 18 | static void
 19 | ftar_l2_random(uint8_t *ftar, uint8_t **pipc, uint64_t *pipc_len)
 20 | {
 21 | 	struct _ftar {
 22 | 		uint64_t num_entries;
 23 | 
 24 | 		struct {
 25 | 			uint64_t off;
 26 | 			uint64_t len;
 27 | 		} entry[];
 28 | 	} *level1, *level2;
 29 | 
 30 | 	uint8_t  *ipc;
 31 | 	uint64_t  sel, ipc_len;
 32 | 
 33 | 	level1 = (struct _ftar*)ftar;
 34 | 
 35 | 	sel    = rand() % level1->num_entries;
 36 | 	level2 = (struct _ftar*)((uint8_t*)level1 + level1->entry[sel].off);
 37 | 
 38 | 	sel     = rand() % level2->num_entries;
 39 | 	ipc     = (uint8_t*)level2 + level2->entry[sel].off;
 40 | 	ipc_len = level2->entry[sel].len;
 41 | 
 42 | 	if(ipc_len < 0x14){
 43 | 		panic("Corrupt database, length");
 44 | 	}
 45 | 
 46 | 	if(!contains((uint64_t)ipc, (uint64_t)ipc+ipc_len-1,
 47 | 				(uint64_t)ftar, (uint64_t)ftar+pnd_corpus_len-1)){
 48 | 		panic("Corrupt database, bounds");
 49 | 	}
 50 | 
 51 | 	if(ipc_len != (*(uint32_t*)ipc + 0x14)){
 52 | 		*pipc_len = -1;
 53 | 		return;
 54 | 	}
 55 | 
 56 | 	*pipc     = ipc;
 57 | 	*pipc_len = ipc_len;
 58 | 
 59 | 	return;
 60 | }
 61 | 
 62 | _Success_(return == RSTATE_SUCCESS)
 63 | _Ret_maybenull_
 64 | rstate_t
 65 | fill_ipc_stream(uint8_t *fuzz_input, uint64_t *fuzz_input_len)
 66 | {
 67 | 	THREAD_LOCALS;
 68 | 	RSTATE_LOCALS;
 69 | 
 70 | 	struct _ipc_stream *ipc_stream;
 71 | 
 72 | 	uint64_t i;
 73 | 
 74 | 	if(!pnd_corpus){
 75 | 		x540_map_remote("file_storage\\chrome_corpus.ftar", &pnd_corpus,
 76 | 				&pnd_corpus_len);
 77 | 	}
 78 | 
 79 | 	if(!current->ipc_stream){
 80 | 		rstate = alloc(sizeof(struct _ipc_stream), &current->ipc_stream);
 81 | 		RSCHECK_NESTED("Failed to allocate room for IPC stream");
 82 | 	}
 83 | 	ipc_stream = current->ipc_stream;
 84 | 
 85 | 	if(!(rand() % 1)){
 86 | 		struct _input_ent *input;
 87 | 		struct _hash_table *input_db;
 88 | 
 89 | 		fuzz_get_input_db(&input_db);
 90 | 
 91 | 		if(input_db){
 92 | 			input = ht_rand(input_db);
 93 | 			if(input){
 94 | 				memcpy(ipc_stream, input->buf, input->len);
 95 | 			}
 96 | 		}
 97 | 	} else {
 98 | 		bzero(ipc_stream, sizeof(struct _ipc_stream));
 99 | 	}
100 | 
101 | 	for(i = 0; i < NUM_IPC_MESSAGES; i++){
102 | 		uint8_t *ipc_a, holding[64 * 1024];
103 | 		uint64_t ipc_a_len, ipc_test_len;
104 | 
105 | 		/* Random chance to replace an IPC message */
106 | 		if(!(rand() % 16)){
107 | 			if(rand() % 2){
108 | 				ipc_a_len = gen_ipc_stream(holding, sizeof(holding), 1);
109 | 				if(ipc_a_len <= MAX_IPC_SIZE){
110 | 					memcpy(ipc_stream->ipc[i].msg, holding, ipc_a_len);
111 | 					ipc_stream->ipc[i].filled = 1;
112 | 				}
113 | 			} else {
114 | 				ftar_l2_random(pnd_corpus, &ipc_a, &ipc_a_len);
115 | 				if(ipc_a_len <= MAX_IPC_SIZE){
116 | 					memcpy(ipc_stream->ipc[i].msg, ipc_a, ipc_a_len);
117 | 					ipc_stream->ipc[i].filled = 1;
118 | 				}
119 | 			}
120 | 
121 | 			if(ipc_stream->ipc[i].filled){
122 | 				ipc_test_len = *(uint32_t*)ipc_stream->ipc[i].msg + 0x14;
123 | 				if(ipc_test_len != ipc_a_len){
124 | 					ipc_stream->ipc[i].filled = 0;
125 | 				}
126 | 			}
127 | 		}
128 | 
129 | 		/* Random generation */
130 | 		if(!(rand() % 16)){
131 | 			if(gen_ipc_rand(ipc_stream->ipc[i].msg, MAX_IPC_SIZE, 1)){
132 | 				ipc_stream->ipc[i].filled = 1;
133 | 			}
134 | 		}
135 | 
136 | 		/* Random chance to delete an IPC message */
137 | 		if(!(rand() % 16))
138 | 			ipc_stream->ipc[i].filled = 0;
139 | 
140 | 		/* Random chance to corrupt an IPC message */
141 | 		if(!(rand() % 16)){
142 | 			uint32_t jj;
143 | 
144 | 			struct {
145 | 				uint32_t len;
146 | 				uint32_t route;
147 | 				uint32_t msg_id;
148 | 				uint32_t flags;
149 | 				uint32_t unk;
150 | 				uint8_t  data[];
151 | 			} *ipc;
152 | 
153 | 			ipc = (void*)ipc_stream->ipc[i].msg;
154 | 
155 | 			if(!(rand() % 64)){
156 | 				ipc->route = rand() % 16;
157 | 			}
158 | 
159 | 			if(!(rand() % 64)){
160 | 				ipc->msg_id = ((rand() % 113) << 16) | (rand() % 24856);
161 | 			}
162 | 
163 | 			for(jj = 0; jj < ipc->len; jj++){
164 | 				if(!(rand() % 256)){
165 | 					ipc->data[jj] = (uint8_t)rand();
166 | 				}
167 | 			}
168 | 		}
169 | 	}
170 | 
171 | 	{
172 | 		uint8_t *ptr = fuzz_input;
173 | 
174 | 		*fuzz_input_len = 0;
175 | 		for(i = 0; i < NUM_IPC_MESSAGES; i++){
176 | 			uint32_t ipc_len;
177 | 
178 | 			if(!ipc_stream->ipc[i].filled)
179 | 				continue;
180 | 
181 | 			ipc_len = *(uint32_t*)ipc_stream->ipc[i].msg + 0x14;
182 | 
183 | 			memcpy(ptr, ipc_stream->ipc[i].msg, ipc_len);
184 | 			ptr             += ipc_len;
185 | 			*fuzz_input_len += ipc_len;
186 | 		}
187 | 	}
188 | 
189 | 	rstate_ret = RSTATE_SUCCESS;
190 | cleanup:
191 | 	RSTATE_RETURN;
192 | }
193 | 
194 | volatile uint64_t num_guest_instrs = 0;
195 | volatile uint64_t fuzzes = 0;
196 | volatile uint64_t fuzz_start = 0;
197 | 
198 | _Success_(return == RSTATE_SUCCESS)
199 | _Ret_maybenull_
200 | rstate_t
201 | fuzz_chrome(void)
202 | {
203 | 	RSTATE_LOCALS;
204 | 	THREAD_LOCALS;
205 | 
206 | 	struct _vm *vm;
207 | 
208 | 	uint64_t stop = 0, last_fuzzes = 0;
209 | 	uint64_t report_freq = 1000000;
210 | 	static volatile uint64_t active_cores = 0;
211 | 	uint8_t fuzz_buf[512 * 1024];
212 | 
213 | 	struct _hash_table *cc_db;
214 | 	struct _hash_table *input_db;
215 | 	struct _hash_table *crash_db;
216 | 
217 | 	rstate = fuzz_get_cc_db(&cc_db);
218 | 	RSCHECK_NESTED("Could not get cc_db");
219 | 
220 | 	rstate = fuzz_get_input_db(&input_db);
221 | 	RSCHECK_NESTED("Could not get input_db");
222 | 
223 | 	rstate = fuzz_get_crash_db(&crash_db);
224 | 	RSCHECK_NESTED("Could not get crash_db");
225 | 
226 | 	if(is_bsp()){
227 | 		stop = rdtsc_future(report_freq);
228 | 		fuzz_start = rdtsc_uptime();
229 | 	}
230 | 
231 | 	rstate = svm_init();
232 | 	RSCHECK_NESTED("Failed to initialize SVM");
233 | 
234 | 	rstate = vm_create(&vm, 4ULL * 1024 * 1024 * 1024);
235 | 	RSCHECK_NESTED("Failed to create a VM");
236 | 
237 | 	for( ; ; ){
238 | 		rstate = vm_load_snapshot(vm, "file_storage\\chrome_00.img");
239 | 		RSCHECK_NESTED("Failed to load VM snapshot");
240 | 
241 | #if 1
242 | 		{
243 | 			uint64_t ipc_buf = 0x133700000000, ipc_buf_len = 0;
244 | 
245 | 			fill_ipc_stream(fuzz_buf, &ipc_buf_len);
246 | 
247 | 			rstate = vm_mm_write_guest_virt(vm, ipc_buf, fuzz_buf, ipc_buf_len);
248 | 			RSCHECK_NESTED("Failed to get backing for IPC buffer");
249 | 
250 | 			vm->gprs->rdx = ipc_buf;
251 | 			vm->gprs->r8  = ipc_buf_len;
252 | 
253 | 			vm->fuzz_input     = fuzz_buf;
254 | 			vm->fuzz_input_len = ipc_buf_len;
255 | 		}
256 | #endif
257 | 
258 | 		rstate = vm_step(vm);
259 | 		RSCHECK_NESTED("VM single step failure");
260 | 
261 | 		if(vm->vmcb->exitcode >= 0x40 && vm->vmcb->exitcode < 0x60){
262 | 			void **hte;
263 | 
264 | 			__m128i hash = _mm_aesenc_si128(_mm_cvtsi64_si128(vm->gprs->rip),
265 | 					_mm_cvtsi64_si128(vm->vmcb->exitcode));
266 | 
267 | 			if(ht_fetch_or_lock(crash_db, hash, (void**)&hte)){
268 | 				printf("New crash %.4I64x %.16I64x %.16I64x",
269 | 						vm->vmcb->exitcode,
270 | 						vm->gprs->rip, vm->vmcb->exitinfo2);
271 | 				*hte = (void*)100;
272 | 			}
273 | 		}
274 | 
275 | 		active_cores |= (1ULL << current->core_id);
276 | 
277 | 		fuzzes++;
278 | 		if(is_bsp() && __rdtsc() > stop){
279 | 			uint64_t fuzz_delta = fuzzes - last_fuzzes;
280 | 
281 | 			printf(
282 | 					"%8I64u %6I64u %8I64u %8I64u %7I64u %7I64u %5I64u %.16I64x",
283 | 					fuzzes, fuzzes * 1000000 / (rdtsc_uptime() - fuzz_start),
284 | 					mm_get_memuse() / 1024 / 1024,
285 | 					num_guest_instrs / fuzzes,
286 | 					cc_db->entries, input_db->entries, crash_db->entries,
287 | 					active_cores);
288 | 
289 | 			profiling_dump();
290 | 			stop = rdtsc_future(report_freq);
291 | 			last_fuzzes = fuzzes;
292 | 			active_cores = 0;
293 | 		}
294 | 	}
295 | 
296 | 	rstate_ret = RSTATE_SUCCESS;
297 | cleanup:
298 | 	RSTATE_RETURN;
299 | }
300 | 
301 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/chrome.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | #define MAX_IPC_SIZE     (4 * 1024)
 4 | #define NUM_IPC_MESSAGES 64
 5 | 
 6 | struct _ipc_stream {
 7 | 	struct {
 8 | 		int     filled;
 9 | 		uint8_t msg[MAX_IPC_SIZE];
10 | 	} ipc[NUM_IPC_MESSAGES];
11 | };
12 | 
13 | rstate_t
14 | fuzz_chrome(void);
15 | 
16 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/chrome/ipcgen.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | enum _chrome_ipctype {
 4 | 	IPCTYPE_INT,
 5 | 	IPCTYPE_STD_STRING,
 6 | 	IPCTYPE_BOOL,
 7 | 	IPCTYPE_GURL,
 8 | 	IPCTYPE_INT64,
 9 | 	IPCTYPE_STRING16,
10 | 
11 | 	IPCTYPE_HOSTRESOURCE,
12 | 	IPCTYPE_SHARED_MEMORY_HANDLE,
13 | 	IPCTYPE_POINT,
14 | 	IPCTYPE_SIZE,
15 | 	IPCTYPE_RECT,
16 | 	IPCTYPE_DOUBLE,
17 | };
18 | 
19 | struct _chrome_ipc {
20 | 	const char *msg_class;
21 | 
22 | 	void *func;
23 | 	uint32_t ipc_id;
24 | 
25 | 	int in_params;
26 | 	int out_params;
27 | 
28 | 	enum _chome_ipctype params[32];
29 | };
30 | 
31 | #pragma pack(push, 1)
32 | struct _cipc_hostresource {
33 | 	int32_t instance;
34 | 	int32_t host_resource;
35 | };
36 | 
37 | struct _cipc_point {
38 | 	int32_t x;
39 | 	int32_t y;
40 | };
41 | 
42 | struct _cipc_size {
43 | 	int32_t width;
44 | 	int32_t height;
45 | };
46 | 
47 | struct _cipc_rect {
48 | 	struct _cipc_point origin;
49 | 	struct _cipc_size  size;
50 | };
51 | 
52 | struct _cipc_shared_memory_handle {
53 | 	uint64_t handle;
54 | 	uint32_t pid;
55 | };
56 | 
57 | struct _chrome_ipc_header {
58 | 	uint32_t length;
59 | 	uint32_t route;
60 | 	uint32_t msg_id;
61 | 
62 | 	union {
63 | 		struct {
64 | 			uint32_t priority_mask:2;
65 | 			uint32_t sync:1;
66 | 			uint32_t reply:1;
67 | 			uint32_t reply_error:1;
68 | 			uint32_t unblock:1;
69 | 			uint32_t pumping_msgs:1;
70 | 			uint32_t has_sent_time:1;
71 | 
72 | 			uint32_t ref_number:24;
73 | 		} fields;
74 | 
75 | 		uint32_t backing;
76 | 	} flags;
77 | 
78 | 	uint32_t unknown;
79 | };
80 | #pragma pack(pop)
81 | 
82 | uint64_t
83 | gen_ipc_stream(_Out_writes_bytes_(len) uint8_t *payload, _In_ uint64_t len,
84 | 		_In_ uint64_t max_messages);
85 | 
86 | uint64_t
87 | gen_ipc_rand(_Out_writes_bytes_(len) uint8_t *payload, _In_ uint64_t len,
88 | 		_In_ uint64_t max_messages);
89 | 
90 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/defender.dc:
--------------------------------------------------------------------------------
  1 | #include <fleeb.h>
  2 | #include <generic/stdlib.h>
  3 | #include <fuzzers/chrome/ipcgen.h>
  4 | #include <net/net.h>
  5 | #include <mm/mm.h>
  6 | #include <fuzzers/chrome.h>
  7 | #include <dstruc/hash_table.h>
  8 | #include <vm/vm.h>
  9 | #include <vm/svm.h>
 10 | #include <fuzzers/helpers.h>
 11 | #include <time/time.h>
 12 | #include <disp/disp.h>
 13 | #include <fuzzers/pdf.h>
 14 | 
 15 | static uint8_t *pnd_corpus = NULL;
 16 | static uint64_t pnd_corpus_len = 0;
 17 | 
 18 | static void
 19 | ftar_l2_random(uint8_t *ftar, uint8_t **pipc, uint64_t *pipc_len)
 20 | {
 21 | 	struct _ftar {
 22 | 		uint64_t num_entries;
 23 | 
 24 | 		struct {
 25 | 			uint64_t off;
 26 | 			uint64_t len;
 27 | 		} entry[];
 28 | 	} *level1, *level2;
 29 | 
 30 | 	uint8_t  *ipc;
 31 | 	uint64_t  sel, ipc_len;
 32 | 
 33 | 	level1 = (struct _ftar*)ftar;
 34 | 
 35 | 	sel    = aes_rand() % level1->num_entries;
 36 | 	level2 = (struct _ftar*)((uint8_t*)level1 + level1->entry[sel].off);
 37 | 
 38 | 	sel     = aes_rand() % level2->num_entries;
 39 | 	ipc     = (uint8_t*)level2 + level2->entry[sel].off;
 40 | 	ipc_len = level2->entry[sel].len;
 41 | 
 42 | 	if(ipc_len < 0x14){
 43 | 		panic("Corrupt database, length");
 44 | 	}
 45 | 
 46 | 	if(!contains((uint64_t)ipc, (uint64_t)ipc+ipc_len-1,
 47 | 				(uint64_t)ftar, (uint64_t)ftar+pnd_corpus_len-1)){
 48 | 		panic("Corrupt database, bounds");
 49 | 	}
 50 | 
 51 | 	if(ipc_len != (*(uint32_t*)ipc + 0x14)){
 52 | 		*pipc_len = -1;
 53 | 		return;
 54 | 	}
 55 | 
 56 | 	*pipc     = ipc;
 57 | 	*pipc_len = ipc_len;
 58 | 
 59 | 	return;
 60 | }
 61 | 
 62 | static void
 63 | rand_ftar(
 64 | 		_In_reads_bytes_(ftar_len) void     *ftar,
 65 | 		_In_                       uint64_t   ftar_len,
 66 | 		_Outptr_                   uint8_t  **entry,
 67 | 		_Out_                      uint64_t  *entry_len)
 68 | {
 69 | 	struct _ftar {
 70 | 		uint64_t num_entries;
 71 | 
 72 | 		struct {
 73 | 			uint64_t off;
 74 | 			uint64_t len;
 75 | 		} entry[];
 76 | 	} *level1 = ftar;
 77 | 
 78 | 	uint8_t *uftar = ftar;
 79 | 
 80 | 	uint64_t rand_ent, rand_off, rand_len;
 81 | 
 82 | 	if(ftar_len < sizeof(uint64_t)){
 83 | 		panic("ftar too small, header");
 84 | 	}
 85 | 
 86 | 	if(!level1->num_entries || level1->num_entries > 1000000){
 87 | 		panic("ftar invalid");
 88 | 	}
 89 | 
 90 | 	if(((level1->num_entries * 16) + 8) > ftar_len){
 91 | 		panic("ftar too small, entries");
 92 | 	}
 93 | 
 94 | 	rand_ent = aes_rand() % level1->num_entries;
 95 | 	rand_off = level1->entry[rand_ent].off;
 96 | 	rand_len = level1->entry[rand_ent].len;
 97 | 
 98 | 	if(!contains((uint64_t)uftar+rand_off, (uint64_t)uftar+rand_off+rand_len-1,
 99 | 				(uint64_t)uftar, (uint64_t)uftar+ftar_len-1)){
100 | 		panic("ftar entry is OOB");
101 | 	}
102 | 
103 | 	*entry     = uftar+rand_off;
104 | 	*entry_len = rand_len;
105 | 	return;
106 | }
107 | 
108 | volatile uint64_t num_guest_instrs = 0;
109 | volatile uint64_t fuzzes = 0;
110 | volatile uint64_t fuzz_start = 0;
111 | 
112 | uint8_t *volatile exe_ftar = NULL;
113 | uint64_t exe_ftar_len;
114 | 
115 | uint8_t *volatile old_input_ftar = NULL;
116 | uint64_t old_input_ftar_len;
117 | 
118 | _Success_(return == RSTATE_SUCCESS)
119 | _Ret_maybenull_
120 | rstate_t
121 | fuzz_defender(void)
122 | {
123 | 	RSTATE_LOCALS;
124 | 	CPU_LOCALS;
125 | 
126 | 	struct _svm_vm *vm;
127 | 
128 | 	uint64_t stop = 0, last_fuzzes = 0;
129 | 	uint64_t report_freq = 1000000, last_report = 0;
130 | 	static volatile uint64_t active_cores = 0, vmexits = 0;
131 | 
132 | 	struct _hash_table *cc_db;
133 | 	struct _hash_table *input_db;
134 | 	struct _hash_table *crash_db;
135 | 
136 | 	rstate = fuzz_get_cc_db(&cc_db);
137 | 	RSCHECK_NESTED("Could not get cc_db");
138 | 
139 | 	rstate = fuzz_get_input_db(&input_db);
140 | 	RSCHECK_NESTED("Could not get input_db");
141 | 
142 | 	rstate = fuzz_get_crash_db(&crash_db);
143 | 	RSCHECK_NESTED("Could not get crash_db");
144 | 	
145 | 	if(!_InterlockedCompareExchangePointer(&exe_ftar, (void*)1, NULL)){
146 | 		rstate = net_map_remote(cpu->net_queue,
147 | 				"hugepdf.ftar", 1024 * 1024,
148 | 				(void*)&exe_ftar, &exe_ftar_len);
149 | 		RSCHECK_NESTED("Failed to download hugepdf");
150 | 	} else {
151 | 		while((uint64_t)exe_ftar <= 1);
152 | 	}
153 | 
154 | 	if(!_InterlockedCompareExchangePointer(&old_input_ftar, (void*)1, NULL)){
155 | 		rstate = net_map_remote(cpu->net_queue, "waffle.ftar",
156 | 				1024 * 1024,
157 | 				(void*)&old_input_ftar, &old_input_ftar_len);
158 | 		RSCHECK_NESTED("Failed to download ftar");
159 | 	} else {
160 | 		while((uint64_t)old_input_ftar <= 1);
161 | 	}
162 | 
163 | 	if(is_bsp()){
164 | 		stop = rdtsc_future(report_freq);
165 | 		last_report = fuzz_start = rdtsc_uptime();
166 | 	}
167 | 
168 | 	rstate = svm_init();
169 | 	RSCHECK_NESTED("Failed to initialize SVM");
170 | 
171 | 	rstate = svm_create_legacy(&vm, 4ULL * 1024 * 1024 * 1024);
172 | 	RSCHECK_NESTED("Failed to create a VM");
173 | 
174 | 	vm->fuzz_input_max = 16 * 1024 * 1024;
175 | 	rstate = phalloc(vm->fuzz_input_max, &vm->fuzz_input);
176 | 	RSCHECK_NESTED("Failed to allocate room for fuzz input");
177 | 
178 | 	for( ; ; ){
179 | 		rstate = vm_load_snapshot(vm, "defender_0.img");
180 | 		RSCHECK_NESTED("Failed to load VM snapshot");
181 | 
182 | #if 1
183 | 		{
184 | 			struct _input_ent *input;
185 | 
186 | 			uint8_t *rand_exe;
187 | 			uint64_t rand_exe_len;
188 | 
189 | try_again:
190 | 			input = ht_rand(input_db);
191 | 			if((aes_rand() % 8) && input){
192 | 				memcpy(vm->fuzz_input, input->buf, input->len);
193 | 				vm->fuzz_input_len = input->len;
194 | 			} else {
195 | 				if(aes_rand() % 8){
196 | 					rand_ftar(exe_ftar, exe_ftar_len, &rand_exe, &rand_exe_len);
197 | 					if(!rand_exe_len || rand_exe_len > vm->fuzz_input_max){
198 | 						goto try_again;
199 | 					}
200 | 					memcpy(vm->fuzz_input, rand_exe, rand_exe_len);
201 | 					vm->fuzz_input_len = rand_exe_len;
202 | 				} else {
203 | 					rand_ftar(old_input_ftar, old_input_ftar_len, &rand_exe, &rand_exe_len);
204 | 					if(!rand_exe_len || rand_exe_len > vm->fuzz_input_max){
205 | 						goto try_again;
206 | 					}
207 | 					memcpy(vm->fuzz_input, rand_exe, rand_exe_len);
208 | 					vm->fuzz_input_len = rand_exe_len;
209 | 				}
210 | 			}
211 | 		}
212 | 
213 | 		{
214 | #if 1
215 | 			uint64_t corrupts;
216 | 
217 | 			for(corrupts = 0; corrupts < aes_rand() % 4; corrupts++){
218 | 				uint64_t offset, size, pdf_offset;
219 | 
220 | 				if(!vm->fuzz_input_len){
221 | 					goto try_again;
222 | 				}
223 | 
224 | 				offset     = aes_rand() % vm->fuzz_input_len;
225 | 				pdf_offset = aes_rand() % exe_ftar_len;
226 | 				size       = aes_rand() % (32 * 1024);
227 | 
228 | 				if((pdf_offset + size) > exe_ftar_len ||
229 | 						(vm->fuzz_input_len + size) > vm->fuzz_input_max){
230 | 					continue;
231 | 				}
232 | 
233 | 				/* Move back size bytes */
234 | 				memcpy(vm->fuzz_input + offset + size, vm->fuzz_input + offset,
235 | 						vm->fuzz_input_len - offset);
236 | 
237 | 				/* Inject at location */
238 | 				memcpy(vm->fuzz_input + offset, exe_ftar + pdf_offset, size);
239 | 
240 | 				vm->fuzz_input_len += size;
241 | 			}
242 | 
243 | 			for(corrupts = 0; corrupts < aes_rand() % 4; corrupts++){
244 | 				uint64_t offset, size;
245 | 
246 | 				if(!vm->fuzz_input_len){
247 | 					goto try_again;
248 | 				}
249 | 
250 | 				offset = aes_rand() % vm->fuzz_input_len;
251 | 				size   = aes_rand() % vm->fuzz_input_len;
252 | 
253 | 				if((offset + size) > vm->fuzz_input_len){
254 | 					continue;
255 | 				}
256 | 
257 | 				memcpy(vm->fuzz_input + offset, vm->fuzz_input + offset + size,
258 | 						vm->fuzz_input_len - (offset + size));
259 | 				vm->fuzz_input_len -= size;
260 | 			}
261 | 
262 | 			for(corrupts = 0; corrupts < aes_rand() % 4; corrupts++){
263 | 				if(!vm->fuzz_input_len){
264 | 					goto try_again;
265 | 				}
266 | 
267 | 				vm->fuzz_input[aes_rand() % vm->fuzz_input_len] = aes_rand() & 0xff;
268 | 			}
269 | 
270 | 			bzero(vm->fuzz_input + vm->fuzz_input_len,
271 | 					vm->fuzz_input_max - vm->fuzz_input_len);
272 | #endif
273 | 		}
274 | #endif
275 | 
276 | 		vm_write_virt(vm, vm->gprs->rip, "\xcc", 1);
277 | 
278 | 		rstate = win32_gen_modlist(vm);
279 | 		RSCHECK_NESTED("Failed to generate windows modlist");
280 | 
281 | 		rstate = vm_step(vm);
282 | 		RSCHECK_NESTED("VM single step failure");
283 | 
284 | 		if(vm->vmcb->exitcode >= 0x40 && vm->vmcb->exitcode < 0x60){
285 | 			void **hte;
286 | 
287 | 			__m128i hash = win32_classify_crash(vm);
288 | 			//hash = _mm_aesenc_si128(hash, _mm_cvtsi64_si128(vm->gprs->rcx));
289 | 
290 | 			if(ht_fetch_or_lock(crash_db, hash, (void**)&hte)){
291 | 				char crashfn[256];
292 | 				__m128i input;
293 | 
294 | 				struct _modlist *mod = win32_resolve_module(vm, vm->gprs->rip);
295 | 
296 | 				if(mod){
297 | 					printf("New crash @ %.*s", (unsigned int)mod->namelen, mod->name);
298 | 				}
299 | 
300 | 				fuzz_report_crash(vm);
301 | 
302 | 				snprintf(crashfn, 128,
303 | 						"file_storage\\fuzz_out\\%.4I64x_%.16I64x_%.16I64x.inp",
304 | 						vm->vmcb->exitcode, vm->gprs->rip, vm->vmcb->exitinfo2);
305 | 				//x540_save_file(crashfn, vm->fuzz_input, vm->fuzz_input_len);
306 | 
307 | 				fuzz_input_create(vm->fuzz_input, vm->fuzz_input_len, &input, NULL);
308 | 
309 | 				printf("New crash %.4I64x %.16I64x %.16I64x %I64u",
310 | 						vm->vmcb->exitcode,
311 | 						vm->gprs->rip, vm->vmcb->exitinfo2,
312 | 						vm->instrs);
313 | 
314 | 				*hte = (void*)100;
315 | 			}
316 | 		}
317 | 
318 | 		active_cores |= (1ULL << cpu->cpu_id);
319 | 
320 | 		_InterlockedExchangeAdd64(&fuzzes, 1);
321 | 		_InterlockedExchangeAdd64(&vmexits, vm->vmexits);
322 | 
323 | 		if(is_bsp() && __rdtsc() > stop){
324 | 			uint64_t fuzz_delta = fuzzes - last_fuzzes;
325 | 
326 | 			printf(
327 | 					"%10s %6s %8s %11s %7s %7s %7s %7s %7s %16s",
328 | 					"fuzzes", "fcps", "memuse", "instrs",
329 | 					"ccdb", "inputs", "crashes", "vmepfc", "uspfc", "cores");
330 | 
331 | 			printf(
332 | 					"%10I64u %6I64u %8I64u %11I64u %7I64u %7I64u %7I64u %7I64u %7I64u %.16I64x",
333 | 					fuzzes, fuzz_delta * 1000000 / (rdtsc_uptime() - last_report),
334 | 					0ULL,
335 | 					num_guest_instrs / fuzzes,
336 | 					cc_db->entries, input_db->entries, crash_db->entries,
337 | 					vmexits / fuzzes,
338 | 					(rdtsc_uptime() - fuzz_start) / fuzzes,
339 | 					active_cores);
340 | 
341 | 			//profiling_dump();
342 | 			stop = rdtsc_future(report_freq);
343 | 			last_fuzzes = fuzzes;
344 | 			active_cores = 0;
345 | 			last_report = rdtsc_uptime();
346 | 		}
347 | 
348 | 		//halt();
349 | 	}
350 | 
351 | 	rstate_ret = RSTATE_SUCCESS;
352 | cleanup:
353 | 	RSTATE_RETURN;
354 | }
355 | 
356 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/defender.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | 
3 | _Success_(return == RSTATE_SUCCESS)
4 | _Ret_maybenull_
5 | rstate_t
6 | fuzz_defender(void);
7 | 
8 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/font.dc:
--------------------------------------------------------------------------------
  1 | #include <falkos.h>
  2 | #include <generic/stdlib.h>
  3 | #include <fuzzers/chrome/ipcgen.h>
  4 | #include <net/x540.h>
  5 | #include <mm/mm.h>
  6 | #include <fuzzers/chrome.h>
  7 | #include <dstruc/hash_table.h>
  8 | #include <vm/vm.h>
  9 | #include <vm/svm.h>
 10 | #include <fuzzers/helpers.h>
 11 | #include <time/time.h>
 12 | #include <profiling/profiling.h>
 13 | #include <disp/disp.h>
 14 | 
 15 | static uint8_t *pnd_corpus = NULL;
 16 | static uint64_t pnd_corpus_len = 0;
 17 | 
 18 | static void
 19 | ftar_l2_random(uint8_t *ftar, uint8_t **pipc, uint64_t *pipc_len)
 20 | {
 21 | 	struct _ftar {
 22 | 		uint64_t num_entries;
 23 | 
 24 | 		struct {
 25 | 			uint64_t off;
 26 | 			uint64_t len;
 27 | 		} entry[];
 28 | 	} *level1, *level2;
 29 | 
 30 | 	uint8_t  *ipc;
 31 | 	uint64_t  sel, ipc_len;
 32 | 
 33 | 	level1 = (struct _ftar*)ftar;
 34 | 
 35 | 	sel    = rand() % level1->num_entries;
 36 | 	level2 = (struct _ftar*)((uint8_t*)level1 + level1->entry[sel].off);
 37 | 
 38 | 	sel     = rand() % level2->num_entries;
 39 | 	ipc     = (uint8_t*)level2 + level2->entry[sel].off;
 40 | 	ipc_len = level2->entry[sel].len;
 41 | 
 42 | 	if(ipc_len < 0x14){
 43 | 		panic("Corrupt database, length");
 44 | 	}
 45 | 
 46 | 	if(!contains((uint64_t)ipc, (uint64_t)ipc+ipc_len-1,
 47 | 				(uint64_t)ftar, (uint64_t)ftar+pnd_corpus_len-1)){
 48 | 		panic("Corrupt database, bounds");
 49 | 	}
 50 | 
 51 | 	if(ipc_len != (*(uint32_t*)ipc + 0x14)){
 52 | 		*pipc_len = -1;
 53 | 		return;
 54 | 	}
 55 | 
 56 | 	*pipc     = ipc;
 57 | 	*pipc_len = ipc_len;
 58 | 
 59 | 	return;
 60 | }
 61 | 
 62 | static void
 63 | rand_ftar(
 64 | 		_In_reads_bytes_(ftar_len) void     *ftar,
 65 | 		_In_                       uint64_t   ftar_len,
 66 | 		_Outptr_                   uint8_t  **entry,
 67 | 		_Out_                      uint64_t  *entry_len)
 68 | {
 69 | 	struct _ftar {
 70 | 		uint64_t num_entries;
 71 | 
 72 | 		struct {
 73 | 			uint64_t off;
 74 | 			uint64_t len;
 75 | 		} entry[];
 76 | 	} *level1 = ftar;
 77 | 
 78 | 	uint8_t *uftar = ftar;
 79 | 
 80 | 	uint64_t rand_ent, rand_off, rand_len;
 81 | 
 82 | 	if(ftar_len < sizeof(uint64_t)){
 83 | 		panic("ftar too small, header");
 84 | 	}
 85 | 
 86 | 	if(!level1->num_entries || level1->num_entries > 1000000){
 87 | 		panic("ftar invalid");
 88 | 	}
 89 | 
 90 | 	if(((level1->num_entries * 16) + 8) > ftar_len){
 91 | 		panic("ftar too small, entries");
 92 | 	}
 93 | 
 94 | 	rand_ent = rand() % level1->num_entries;
 95 | 	rand_off = level1->entry[rand_ent].off;
 96 | 	rand_len = level1->entry[rand_ent].len;
 97 | 
 98 | 	if(!contains((uint64_t)uftar+rand_off, (uint64_t)uftar+rand_off+rand_len-1,
 99 | 				(uint64_t)uftar, (uint64_t)uftar+ftar_len-1)){
100 | 		panic("ftar entry is OOB");
101 | 	}
102 | 
103 | 	*entry     = uftar+rand_off;
104 | 	*entry_len = rand_len;
105 | 	return;
106 | }
107 | 
108 | volatile uint64_t num_guest_instrs = 0;
109 | volatile uint64_t fuzzes = 0;
110 | volatile uint64_t fuzz_start = 0;
111 | 
112 | void *exe_ftar = NULL;
113 | uint64_t exe_ftar_len;
114 | 
115 | void *old_input_ftar = NULL;
116 | uint64_t old_input_ftar_len;
117 | 
118 | _Success_(return == RSTATE_SUCCESS)
119 | _Ret_maybenull_
120 | rstate_t
121 | fuzz_font(void)
122 | {
123 | 	RSTATE_LOCALS;
124 | 	THREAD_LOCALS;
125 | 
126 | 	struct _vm *vm;
127 | 
128 | 	uint64_t stop = 0, last_fuzzes = 0;
129 | 	uint64_t report_freq = 1000000, last_report = 0;
130 | 	static volatile uint64_t active_cores = 0;
131 | 
132 | 	struct _hash_table *cc_db;
133 | 	struct _hash_table *input_db;
134 | 	struct _hash_table *crash_db;
135 | 
136 | 	rstate = fuzz_get_cc_db(&cc_db);
137 | 	RSCHECK_NESTED("Could not get cc_db");
138 | 
139 | 	rstate = fuzz_get_input_db(&input_db);
140 | 	RSCHECK_NESTED("Could not get input_db");
141 | 
142 | 	rstate = fuzz_get_crash_db(&crash_db);
143 | 	RSCHECK_NESTED("Could not get crash_db");
144 | 
145 | 	if(!_InterlockedCompareExchangePointer(&exe_ftar, (void*)1, NULL)){
146 | 		x540_map_remote("file_storage\\ftar", &exe_ftar, &exe_ftar_len);
147 | 	} else {
148 | 		while((uint64_t)exe_ftar <= 1);
149 | 	}
150 | 
151 | 	if(!_InterlockedCompareExchangePointer(&old_input_ftar, (void*)1, NULL)){
152 | 		x540_map_remote("file_storage\\ftar", &old_input_ftar, &old_input_ftar_len);
153 | 	} else {
154 | 		while((uint64_t)old_input_ftar <= 1);
155 | 	}
156 | 
157 | 	if(is_bsp()){
158 | 		stop = rdtsc_future(report_freq);
159 | 		last_report = fuzz_start = rdtsc_uptime();
160 | 	}
161 | 
162 | 	rstate = svm_init();
163 | 	RSCHECK_NESTED("Failed to initialize SVM");
164 | 
165 | 	rstate = vm_create(&vm, 4ULL * 1024 * 1024 * 1024);
166 | 	RSCHECK_NESTED("Failed to create a VM");
167 | 
168 | 	vm->fuzz_input_max = 16 * 1024 * 1024;
169 | 	rstate = alloc(vm->fuzz_input_max, &vm->fuzz_input);
170 | 	RSCHECK_NESTED("Failed to allocate room for fuzz input");
171 | 
172 | 	for( ; ; ){
173 | 		rstate = vm_load_snapshot(vm, "file_storage\\font.img");
174 | 		RSCHECK_NESTED("Failed to load VM snapshot");
175 | 
176 | 		{
177 | 			struct _input_ent *input;
178 | 
179 | 			uint8_t *rand_exe;
180 | 			uint64_t rand_exe_len, replacements = 0, repl_try = 0;
181 | 
182 | try_again:
183 | 			input = ht_rand(input_db);
184 | 			if((rand() % 8) && input){
185 | 				memcpy(vm->fuzz_input, input->buf, input->len);
186 | 				vm->fuzz_input_len = input->len;
187 | 			} else {
188 | 				rand_ftar(exe_ftar, exe_ftar_len, &rand_exe, &rand_exe_len);
189 | 				if(!rand_exe_len || rand_exe_len > vm->fuzz_input_max){
190 | 					goto try_again;
191 | 				}
192 | 				memcpy(vm->fuzz_input, rand_exe, rand_exe_len);
193 | 				vm->fuzz_input_len = rand_exe_len;
194 | 			}
195 | 
196 | 			replacements = rand() % 16;
197 | 			repl_try = 10000;
198 | 			while(repl_try && replacements){
199 | 				uint64_t inp_off, corp_off, inp_rem, corp_rem, scan;
200 | 
201 | 				repl_try--;
202 | 
203 | 				inp_off  = rand() % vm->fuzz_input_len;
204 | 				corp_off = rand() % exe_ftar_len;
205 | 
206 | 				inp_rem = vm->fuzz_input_len - inp_off;
207 | 				corp_rem = exe_ftar_len - corp_off;
208 | 
209 | 				scan = 0;
210 | 				while(inp_rem >= 64 && corp_rem >= 64 && scan < 1024){
211 | 					if(!memcmp((uint8_t*)vm->fuzz_input + inp_off,
212 | 								(uint8_t*)exe_ftar + corp_off, 4)){
213 | 						memcpy(
214 | 								(uint8_t*)vm->fuzz_input + inp_off,
215 | 								(uint8_t*)exe_ftar + corp_off,
216 | 								rand() % 64);
217 | 
218 | 						replacements--;
219 | 						break;
220 | 					}
221 | 
222 | 					corp_off++;
223 | 					corp_rem--;
224 | 					scan++;
225 | 				}
226 | 			}
227 | 		}
228 | 
229 | 		rstate = win32_gen_modlist(vm);
230 | 		RSCHECK_NESTED("Failed to generate windows modlist");
231 | 
232 | 		//vm_write_virt(vm, vm->gprs->rcx, vm->fuzz_input, vm->fuzz_input_len);
233 | 		//vm->gprs->r8 = vm->fuzz_input_len;
234 | 
235 | 		rstate = vm_step(vm);
236 | 		RSCHECK_NESTED("VM single step failure");
237 | 
238 | 		if(vm->vmcb->exitcode >= 0x40 && vm->vmcb->exitcode < 0x60){
239 | 			void **hte;
240 | 
241 | 			__m128i hash = win32_classify_crash(vm);
242 | 
243 | 			if(ht_fetch_or_lock(crash_db, hash, (void**)&hte)){
244 | 				char crashfn[256];
245 | 				__m128i input;
246 | 
247 | 				struct _modlist *mod = win32_resolve_module(vm, vm->gprs->rip);
248 | 
249 | 				if(mod){
250 | 					printf("New crash @ %.*s", (unsigned int)mod->namelen, mod->name);
251 | 				}
252 | 
253 | 				fuzz_report_crash(vm);
254 | 
255 | 				snprintf(crashfn, 128,
256 | 						"file_storage\\fuzz_out\\%.4I64x_%.16I64x_%.16I64x.inp",
257 | 						vm->vmcb->exitcode, vm->gprs->rip, vm->vmcb->exitinfo2);
258 | 				x540_save_file(crashfn, vm->fuzz_input, vm->fuzz_input_len);
259 | 
260 | 				fuzz_input_create(vm->fuzz_input, vm->fuzz_input_len, &input, NULL);
261 | 
262 | 				printf("New crash %.4I64x %.16I64x %.16I64x %I64u",
263 | 						vm->vmcb->exitcode,
264 | 						vm->gprs->rip, vm->vmcb->exitinfo2,
265 | 						vm->instrs);
266 | 				*hte = (void*)100;
267 | 			}
268 | 		}
269 | 
270 | 		active_cores |= (1ULL << current->core_id);
271 | 
272 | 		fuzzes++;
273 | 		if(is_bsp() && __rdtsc() > stop){
274 | 			uint64_t fuzz_delta = fuzzes - last_fuzzes;
275 | 
276 | 			printf(
277 | 					"%10s %6s %8s %11s %7s %7s %7s %16s",
278 | 					"fuzzes", "fcps", "memuse", "instrs",
279 | 					"ccdb", "inputs", "crashes", "cores");
280 | 
281 | 			printf(
282 | 					"%10I64u %6I64u %8I64u %11I64u %7I64u %7I64u %7I64u %.16I64x",
283 | 					fuzzes, fuzzes * 1000000 / (rdtsc_uptime() - fuzz_start),
284 | 					mm_get_memuse() / 1024 / 1024,
285 | 					num_guest_instrs / fuzzes,
286 | 					cc_db->entries, input_db->entries, crash_db->entries,
287 | 					active_cores);
288 | 
289 | 			profiling_dump();
290 | 			stop = rdtsc_future(report_freq);
291 | 			last_fuzzes = fuzzes;
292 | 			active_cores = 0;
293 | 			last_report = rdtsc_uptime();
294 | 		}
295 | 
296 | 		halt();
297 | 	}
298 | 
299 | 	rstate_ret = RSTATE_SUCCESS;
300 | cleanup:
301 | 	RSTATE_RETURN;
302 | }
303 | 
304 | 
305 | 
306 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/font.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | 
3 | _Success_(return == RSTATE_SUCCESS)
4 | _Ret_maybenull_
5 | rstate_t
6 | fuzz_font(void);
7 | 
8 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/helpers.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | #define MAX_MODULES 128
 4 | 
 5 | struct _modlist {
 6 | 	uint64_t base;
 7 | 	uint64_t len;
 8 | 	uint64_t end;
 9 | 
10 | 	__m128i hash;
11 | 
12 | 	unsigned int namelen;
13 | 	uint8_t      name[256];
14 | };
15 | 
16 | struct _input_ent {
17 | 	uint64_t len;
18 | 	uint8_t  buf[1];
19 | };
20 | 
21 | struct _cc_entry {
22 | 	__m128i hash;
23 | };
24 | 
25 | struct _crash_entry {
26 | 	__m128i hash;
27 | };
28 | 
29 | struct _fuzzer {
30 | 	struct _hash_table *cc_db;
31 | 	struct _hash_table *input_db;
32 | 	struct _hash_table *crash_db;
33 | };
34 | 
35 | rstate_t
36 | fuzzer_create(struct _fuzzer **fuzzer_out);
37 | 
38 | void
39 | rand_ftar(
40 | 		const void  *ftar,
41 | 		uint64_t     ftar_len,
42 | 		uint8_t    **entry,
43 | 		uint64_t    *entry_len);
44 | 
45 | rstate_t
46 | fuzz_get_cc_db(struct _hash_table **db);
47 | 
48 | rstate_t
49 | fuzz_get_input_db(struct _hash_table **db);
50 | 
51 | rstate_t
52 | fuzz_get_crash_db(struct _hash_table **db);
53 | 
54 | struct _input_ent*
55 | fuzz_get_input(__m128i input_hash);
56 | 
57 | rstate_t
58 | fuzz_input_create(const void *buf, uint64_t len, __m128i *out_hash,
59 | 		int *new_entry);
60 | 
61 | rstate_t
62 | fuzz_cc_report(
63 | 		struct _vm *vm,
64 | 		uint64_t    from,
65 | 		uint64_t    to,
66 | 		const void *buf,
67 | 		uint64_t    len,
68 | 		int        *new_ent);
69 | 
70 | rstate_t
71 | fuzz_report_crash(struct _vm *vm, void *buf, size_t len, int *new_entry);
72 | 
73 | rstate_t
74 | win32_gen_modlist(struct _vm *vm);
75 | 
76 | struct _modlist*
77 | win32_resolve_module(struct _vm *vm, uint64_t rip);
78 | 
79 | int
80 | win32_symhash(struct _vm *vm, uint64_t rip, __m128i *hash);
81 | 
82 | __m128i
83 | win32_classify_crash(struct _vm *vm);
84 | 
85 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/pdf.h:
--------------------------------------------------------------------------------
  1 | #pragma once
  2 | 
  3 | #define PDF_OBJECTS_MAX 500
  4 | 
  5 | enum _pdf_type {
  6 | 	INVALID,
  7 | 	DICT,
  8 | 	NAME,
  9 | 	NUMBER,
 10 | 	REFERENCE,
 11 | 	HEXSTR,
 12 | 	ARRAY,
 13 | 	STRING,
 14 | 	OBJECT,
 15 | 	BOOLEAN,
 16 | 	STREAM,
 17 | 	PDF_FILE,
 18 | 	NULL_OBJ
 19 | };
 20 | 
 21 | struct _pdf_xref {
 22 | 	uint64_t obj_num;
 23 | 	uint64_t gen_num;
 24 | 	uint8_t  type;
 25 | };
 26 | 
 27 | struct _pdf_dict {
 28 | 	uint64_t num_objects;
 29 | 	struct _pdf_object *objects[PDF_OBJECTS_MAX];
 30 | };
 31 | 
 32 | struct _pdf_array {
 33 | 	uint64_t num_objects;
 34 | 	struct _pdf_object *objects[PDF_OBJECTS_MAX];
 35 | };
 36 | 
 37 | struct _pdf_name {
 38 | 	char name[1024];
 39 | 	struct _pdf_object *object;
 40 | };
 41 | 
 42 | struct _pdf_boolean {
 43 | 	int val;
 44 | };
 45 | 
 46 | struct _pdf_reference {
 47 | 	uint64_t obj_num;
 48 | 	uint64_t gen_num;
 49 | };
 50 | 
 51 | struct _pdf_hexstr {
 52 | 	uint8_t  *str;
 53 | 	uint64_t  len;
 54 | };
 55 | 
 56 | struct _pdf_str {
 57 | 	uint8_t  *str;
 58 | 	uint64_t  len;
 59 | };
 60 | 
 61 | struct _pdf_stream {
 62 | 	uint8_t  *payload;
 63 | 	uint64_t  length;
 64 | };
 65 | 
 66 | struct _pdf_indirect_object {
 67 | 	uint64_t obj_num;
 68 | 	uint64_t gen_num;
 69 | 
 70 | 	struct _pdf_object *object;
 71 | 	struct _pdf_object *stream;
 72 | };
 73 | 
 74 | struct _pdf_number {
 75 | 	int64_t  number;
 76 | 	uint64_t decimal;
 77 | 
 78 | 	int is_float;
 79 | };
 80 | 
 81 | struct _pdf_file {
 82 | 	uint64_t num_objects;
 83 | 	struct _pdf_object *objects[PDF_OBJECTS_MAX];
 84 | 	struct _pdf_object *trailer;
 85 | };
 86 | 
 87 | struct _pdf_object {
 88 | 	enum _pdf_type type;
 89 | 
 90 | 	union {
 91 | 		struct _pdf_name name;
 92 | 		struct _pdf_number number;
 93 | 		struct _pdf_reference reference;
 94 | 		struct _pdf_hexstr hexstr;
 95 | 		struct _pdf_dict dict;
 96 | 		struct _pdf_array array;
 97 | 		struct _pdf_str str;
 98 | 		struct _pdf_indirect_object indirect;
 99 | 		struct _pdf_boolean boolean;
100 | 		struct _pdf_stream stream;
101 | 		struct _pdf_file file;
102 | 	} u;
103 | };
104 | 
105 | char*
106 | pdf_type_to_str(enum _pdf_type type);
107 | 
108 | void
109 | pdf_free(struct _pdf_object *object);
110 | 
111 | void
112 | pdf_digest(struct _pdf_object *object);
113 | 
114 | void
115 | pdf_corrupt(struct _pdf_object *object);
116 | 
117 | uint64_t
118 | pdf_genpdf(
119 | 		char                     *buf,
120 | 		uint64_t                  len,
121 | 		const struct _pdf_object *object);
122 | 
123 | rstate_t
124 | pdf_parse_object(
125 | 		const uint8_t       *object_str,
126 | 		uint64_t             object_str_len,
127 | 		const uint8_t      **out_object_str,
128 | 		struct _pdf_object **out_object);
129 | 
130 | rstate_t
131 | loadpdf(
132 | 		const uint8_t       *pdf,
133 | 		uint64_t             pdf_len,
134 | 		struct _pdf_object **out_object);
135 | 
136 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/r2.dc:
--------------------------------------------------------------------------------
  1 | #include <falkos.h>
  2 | #include <generic/stdlib.h>
  3 | #include <fuzzers/chrome/ipcgen.h>
  4 | #include <net/x540.h>
  5 | #include <mm/mm.h>
  6 | #include <fuzzers/chrome.h>
  7 | #include <dstruc/hash_table.h>
  8 | #include <vm/vm.h>
  9 | #include <vm/svm.h>
 10 | #include <fuzzers/helpers.h>
 11 | #include <time/time.h>
 12 | #include <profiling/profiling.h>
 13 | #include <disp/disp.h>
 14 | 
 15 | static uint8_t *pnd_corpus = NULL;
 16 | static uint64_t pnd_corpus_len = 0;
 17 | 
 18 | static void
 19 | ftar_l2_random(uint8_t *ftar, uint8_t **pipc, uint64_t *pipc_len)
 20 | {
 21 | 	struct _ftar {
 22 | 		uint64_t num_entries;
 23 | 
 24 | 		struct {
 25 | 			uint64_t off;
 26 | 			uint64_t len;
 27 | 		} entry[];
 28 | 	} *level1, *level2;
 29 | 
 30 | 	uint8_t  *ipc;
 31 | 	uint64_t  sel, ipc_len;
 32 | 
 33 | 	level1 = (struct _ftar*)ftar;
 34 | 
 35 | 	sel    = rand() % level1->num_entries;
 36 | 	level2 = (struct _ftar*)((uint8_t*)level1 + level1->entry[sel].off);
 37 | 
 38 | 	sel     = rand() % level2->num_entries;
 39 | 	ipc     = (uint8_t*)level2 + level2->entry[sel].off;
 40 | 	ipc_len = level2->entry[sel].len;
 41 | 
 42 | 	if(ipc_len < 0x14){
 43 | 		panic("Corrupt database, length");
 44 | 	}
 45 | 
 46 | 	if(!contains((uint64_t)ipc, (uint64_t)ipc+ipc_len-1,
 47 | 				(uint64_t)ftar, (uint64_t)ftar+pnd_corpus_len-1)){
 48 | 		panic("Corrupt database, bounds");
 49 | 	}
 50 | 
 51 | 	if(ipc_len != (*(uint32_t*)ipc + 0x14)){
 52 | 		*pipc_len = -1;
 53 | 		return;
 54 | 	}
 55 | 
 56 | 	*pipc     = ipc;
 57 | 	*pipc_len = ipc_len;
 58 | 
 59 | 	return;
 60 | }
 61 | 
 62 | static void
 63 | rand_ftar(
 64 | 		_In_reads_bytes_(ftar_len) void     *ftar,
 65 | 		_In_                       uint64_t   ftar_len,
 66 | 		_Outptr_                   uint8_t  **entry,
 67 | 		_Out_                      uint64_t  *entry_len)
 68 | {
 69 | 	struct _ftar {
 70 | 		uint64_t num_entries;
 71 | 
 72 | 		struct {
 73 | 			uint64_t off;
 74 | 			uint64_t len;
 75 | 		} entry[];
 76 | 	} *level1 = ftar;
 77 | 
 78 | 	uint8_t *uftar = ftar;
 79 | 
 80 | 	uint64_t rand_ent, rand_off, rand_len;
 81 | 
 82 | 	if(ftar_len < sizeof(uint64_t)){
 83 | 		panic("ftar too small, header");
 84 | 	}
 85 | 
 86 | 	if(!level1->num_entries || level1->num_entries > 1000000){
 87 | 		panic("ftar invalid");
 88 | 	}
 89 | 
 90 | 	if(((level1->num_entries * 16) + 8) > ftar_len){
 91 | 		panic("ftar too small, entries");
 92 | 	}
 93 | 
 94 | 	rand_ent = rand() % level1->num_entries;
 95 | 	rand_off = level1->entry[rand_ent].off;
 96 | 	rand_len = level1->entry[rand_ent].len;
 97 | 
 98 | 	if(!contains((uint64_t)uftar+rand_off, (uint64_t)uftar+rand_off+rand_len-1,
 99 | 				(uint64_t)uftar, (uint64_t)uftar+ftar_len-1)){
100 | 		panic("ftar entry is OOB");
101 | 	}
102 | 
103 | 	*entry     = uftar+rand_off;
104 | 	*entry_len = rand_len;
105 | 	return;
106 | }
107 | 
108 | volatile uint64_t num_guest_instrs = 0;
109 | volatile uint64_t fuzzes = 0;
110 | volatile uint64_t fuzz_start = 0;
111 | 
112 | void *exe_ftar = NULL;
113 | uint64_t exe_ftar_len;
114 | 
115 | void *old_input_ftar = NULL;
116 | uint64_t old_input_ftar_len;
117 | 
118 | _Success_(return == RSTATE_SUCCESS)
119 | _Ret_maybenull_
120 | rstate_t
121 | fuzz_r2(void)
122 | {
123 | 	RSTATE_LOCALS;
124 | 	THREAD_LOCALS;
125 | 
126 | 	struct _vm *vm;
127 | 
128 | 	uint64_t stop = 0, last_fuzzes = 0;
129 | 	uint64_t report_freq = 1000000, last_report = 0;
130 | 	static volatile uint64_t active_cores = 0;
131 | 
132 | 	struct _hash_table *cc_db;
133 | 	struct _hash_table *input_db;
134 | 	struct _hash_table *crash_db;
135 | 
136 | 	rstate = fuzz_get_cc_db(&cc_db);
137 | 	RSCHECK_NESTED("Could not get cc_db");
138 | 
139 | 	rstate = fuzz_get_input_db(&input_db);
140 | 	RSCHECK_NESTED("Could not get input_db");
141 | 
142 | 	rstate = fuzz_get_crash_db(&crash_db);
143 | 	RSCHECK_NESTED("Could not get crash_db");
144 | 
145 | 	if(!_InterlockedCompareExchangePointer(&exe_ftar, (void*)1, NULL)){
146 | 		x540_map_remote("file_storage\\ftar", &exe_ftar, &exe_ftar_len);
147 | 	} else {
148 | 		while((uint64_t)exe_ftar <= 1);
149 | 	}
150 | 
151 | 	if(!_InterlockedCompareExchangePointer(&old_input_ftar, (void*)1, NULL)){
152 | 		x540_map_remote("file_storage\\ftar", &old_input_ftar, &old_input_ftar_len);
153 | 	} else {
154 | 		while((uint64_t)old_input_ftar <= 1);
155 | 	}
156 | 
157 | 	if(is_bsp()){
158 | 		stop = rdtsc_future(report_freq);
159 | 		last_report = fuzz_start = rdtsc_uptime();
160 | 	}
161 | 
162 | 	rstate = svm_init();
163 | 	RSCHECK_NESTED("Failed to initialize SVM");
164 | 
165 | 	rstate = vm_create(&vm, 4ULL * 1024 * 1024 * 1024);
166 | 	RSCHECK_NESTED("Failed to create a VM");
167 | 
168 | 	vm->fuzz_input_max = 440000;
169 | 	rstate = alloc(vm->fuzz_input_max, &vm->fuzz_input);
170 | 	RSCHECK_NESTED("Failed to allocate room for fuzz input");
171 | 
172 | 	for( ; ; ){
173 | 		rstate = vm_load_snapshot(vm, "file_storage\\r2_ph.img");
174 | 		RSCHECK_NESTED("Failed to load VM snapshot");
175 | 
176 | 		{
177 | 			int corrupt;
178 | 
179 | 			struct _input_ent *input;
180 | 
181 | 			uint8_t *rand_exe;
182 | 			uint64_t rand_exe_len, limit;
183 | 
184 | try_again:
185 | 			bzero(vm->fuzz_input, vm->fuzz_input_max);
186 | 
187 | 			input = ht_rand(input_db);
188 | 			if((rand() % 8) && input){
189 | 				memcpy(vm->fuzz_input, input->buf, input->len);
190 | 				vm->fuzz_input_len = input->len;
191 | 			} else {
192 | 				if(rand() % 2){
193 | 					rand_ftar(exe_ftar, exe_ftar_len, &rand_exe, &rand_exe_len);
194 | 					if(!rand_exe_len || rand_exe_len > vm->fuzz_input_max){
195 | 						goto try_again;
196 | 					}
197 | 					memcpy(vm->fuzz_input, rand_exe, rand_exe_len);
198 | 					vm->fuzz_input_len = rand_exe_len;
199 | 				} else {
200 | 					rand_ftar(old_input_ftar, old_input_ftar_len, &rand_exe, &rand_exe_len);
201 | 					if(!rand_exe_len || rand_exe_len > vm->fuzz_input_max){
202 | 						goto try_again;
203 | 					}
204 | 					memcpy(vm->fuzz_input, rand_exe, rand_exe_len);
205 | 					vm->fuzz_input_len = rand_exe_len;
206 | 				}
207 | 			}
208 | 
209 | #if 1
210 | 			limit = rand() % 1024 + 1;
211 | 			for(corrupt = 0; corrupt < (rand() % limit); corrupt++){
212 | 				((uint8_t*)vm->fuzz_input)[rand() % vm->fuzz_input_len] = rand() & 0xff;
213 | 			}
214 | #endif
215 | 
216 | 			rstate = vm_mm_write_guest_virt(vm, vm->gprs->rax,
217 | 					vm->fuzz_input, vm->fuzz_input_max);
218 | 			RSCHECK_NESTED("Failed to write memory");
219 | 		}
220 | 
221 | 		vm_mm_write_guest_virt(vm, 0x07ffb65861970, "\xcc", 1);
222 | 
223 | 		rstate = vm_step(vm);
224 | 		RSCHECK_NESTED("VM single step failure");
225 | 
226 | 		if(vm->vmcb->exitcode >= 0x40 && vm->vmcb->exitcode < 0x60){
227 | 			void **hte;
228 | 
229 | 			__m128i hash = _mm_aesenc_si128(_mm_cvtsi64_si128(vm->gprs->rip),
230 | 					_mm_cvtsi64_si128(vm->vmcb->exitcode));
231 | 			//hash = _mm_aesenc_si128(_mm_cvtsi64_si128(vm->vmcb->exitinfo2), hash);
232 | 
233 | 			if(ht_fetch_or_lock(crash_db, hash, (void**)&hte)){
234 | 				char crashfn[256];
235 | 				__m128i input;
236 | 
237 | 				snprintf(crashfn, 128,
238 | 						"file_storage\\fuzz_out\\%.4I64x_%.16I64x_%.16I64x.inp",
239 | 						vm->vmcb->exitcode, vm->gprs->rip, vm->vmcb->exitinfo2);
240 | 				x540_save_file(crashfn, vm->fuzz_input, vm->fuzz_input_len);
241 | 
242 | 				fuzz_input_create(vm->fuzz_input, vm->fuzz_input_len, &input);
243 | 
244 | 				printf("New crash %.4I64x %.16I64x %.16I64x %I64u",
245 | 						vm->vmcb->exitcode,
246 | 						vm->gprs->rip, vm->vmcb->exitinfo2,
247 | 						vm->instrs);
248 | 				*hte = (void*)100;
249 | 			}
250 | 		}
251 | 
252 | 		active_cores |= (1ULL << current->core_id);
253 | 
254 | 		fuzzes++;
255 | 		if(is_bsp() && __rdtsc() > stop){
256 | 			uint64_t fuzz_delta = fuzzes - last_fuzzes;
257 | 
258 | 			printf(
259 | 					"%10s %6s %8s %11s %7s %7s %7s %16s",
260 | 					"fuzzes", "fcps", "memuse", "instrs",
261 | 					"ccdb", "inputs", "crashes", "cores");
262 | 
263 | 			printf(
264 | 					"%10I64u %6I64u %8I64u %11I64u %7I64u %7I64u %7I64u %.16I64x",
265 | 					fuzzes, fuzz_delta * 1000000 / (rdtsc_uptime() - last_report),
266 | 					mm_get_memuse() / 1024 / 1024,
267 | 					num_guest_instrs / fuzzes,
268 | 					cc_db->entries, input_db->entries, crash_db->entries,
269 | 					active_cores);
270 | 
271 | 			profiling_dump();
272 | 			stop = rdtsc_future(report_freq);
273 | 			last_fuzzes = fuzzes;
274 | 			active_cores = 0;
275 | 			last_report = rdtsc_uptime();
276 | 		}
277 | 
278 | 		//halt();
279 | 	}
280 | 
281 | 	rstate_ret = RSTATE_SUCCESS;
282 | cleanup:
283 | 	RSTATE_RETURN;
284 | }
285 | 
286 | 
287 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/r2.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | 
3 | _Success_(return == RSTATE_SUCCESS)
4 | _Ret_maybenull_
5 | rstate_t
6 | fuzz_r2(void);
7 | 
8 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/word.c:
--------------------------------------------------------------------------------
  1 | #include <grilled_cheese.h>
  2 | #include <vm/vm.h>
  3 | #include <disp/disp.h>
  4 | #include <time/time.h>
  5 | #include <mm/mm.h>
  6 | #include <generic/stdlib.h>
  7 | #include <net/net.h>
  8 | #include <vm/svm.h>
  9 | #include <dstruc/hash_table.h>
 10 | 
 11 | static uint64_t VM_MEMORY_SIZE = (4UL * 1024 * 1024 * 1024);
 12 | 
 13 | static struct _svm_legacy_snapshot *word_snapshot = NULL;
 14 | static uint64_t word_snapshot_len = 0;
 15 | 
 16 | rstate_t
 17 | x86_fuzz_npf_handler(struct _vm *vm, uint64_t address,
 18 | 		int read_access, int write_access, int exec_access,
 19 | 		int *handled)
 20 | {
 21 | 	uint8_t   *tmp;
 22 | 	uintptr_t  page;
 23 | 
 24 | 	RSTATE_LOCALS;
 25 | 
 26 | 	/* Page align the address */
 27 | 	address &= ~0xfff;
 28 | 
 29 | 	if(address >= VM_MEMORY_SIZE){
 30 | 		*handled = 0;
 31 | 		return RSTATE_SUCCESS;
 32 | 	}
 33 | 
 34 | 	if(!mm_is_avail(address, 4096)){
 35 | 		*handled = 0;
 36 | 		return RSTATE_SUCCESS;
 37 | 	}
 38 | 
 39 | 	rstate = alloc_phys_4k(&page);
 40 | 	RSCHECK_NESTED("Failed to allocate 4k page");
 41 | 
 42 | 	tmp = mm_get_phys_mapping((uint64_t)page);
 43 | 	memcpy(tmp, &word_snapshot->physical_memory[address], 4096);
 44 | 
 45 | 	if(!memcmp(&tmp[0x691],
 46 | 				"\x8b\xc8\xba\x02\x00\x00\x00\x81\xf9\x06\x00\x00\xd0\x74\x41\x81", 16)){
 47 | 		tmp[0x691] = 0xcc;
 48 | 	}
 49 | 
 50 | 	mm_release_phys_mapping(tmp);
 51 | 
 52 | 	rstate = vm->map_phys(vm, address, 1, 1, 1, (uint64_t)page);
 53 | 	RSCHECK_NESTED("Failed to map in physical memory");
 54 | 
 55 | 	*handled = 1;
 56 | 	rstate_ret = RSTATE_SUCCESS;
 57 | cleanup:
 58 | 	RSTATE_RETURN;
 59 | }
 60 | 
 61 | void
 62 | restore_page(void *ctxt, uint64_t vaddr, uint64_t paddr)
 63 | {
 64 | 	void *tmp;
 65 | 	tmp = mm_get_phys_mapping(paddr);
 66 | 	memcpy(tmp, &word_snapshot->physical_memory[vaddr], 4096);
 67 | 	mm_release_phys_mapping(tmp);
 68 | }
 69 | 
 70 | rstate_t
 71 | minimize_rtf(uint8_t *fuzz_input, uint64_t fuzz_input_len)
 72 | {
 73 | 	uint64_t nnl = nonnulllast(fuzz_input, fuzz_input_len);
 74 | 	uint64_t sel = aes_rand() % nnl;
 75 | 	uint64_t cpy = (aes_rand() % nnl);
 76 | 
 77 | 	if(!(aes_rand() % 4)){
 78 | 		cpy = 1;
 79 | 	}
 80 | 
 81 | 	if(cpy > (fuzz_input_len - sel)){
 82 | 		return RSTATE_SUCCESS;
 83 | 	}
 84 | 
 85 | 	memcpy(fuzz_input + sel, fuzz_input + sel + cpy, fuzz_input_len - (sel + cpy));
 86 | 	memset(fuzz_input + fuzz_input_len - cpy, 0, cpy);
 87 | 
 88 | 	return RSTATE_SUCCESS;
 89 | }
 90 | 
 91 | /*#define MINIMIZE*/
 92 | 
 93 | rstate_t
 94 | create_corrupt_rtf(uint8_t *fuzz_input, uint64_t fuzz_input_len)
 95 | {
 96 | 	uint8_t  *entry;
 97 | 	uint64_t  entry_len = 0;
 98 | 
 99 | 	struct _hash_table *input_db;
100 | 	struct _hash_table *crash_db;
101 | 
102 | #ifndef MINIMIZE
103 | 	uint64_t ii;
104 | #endif
105 | 
106 | 	static volatile int ready_for_aps = 0;
107 | 	static uint8_t *corpus = NULL;
108 | 	static uint64_t corpus_len;
109 | 
110 | 	static uint8_t *parsed_rtfs;
111 | 	static uint64_t parsed_rtfs_len;
112 | 
113 | 	static struct _rtf_chunk {
114 | 		uint64_t offset;
115 | 		uint64_t size;
116 | 	} *bkt_db, *cw_db;
117 | 	static uint64_t bkt_db_ents, cw_db_ents;
118 | 
119 | 	RSTATE_LOCALS;
120 | 
121 | 	if(!corpus && is_bsp()){
122 | 		rstate = net_map_remote(current_cpu->net_queue, "waffle.ftar", 1024 * 1024,
123 | 				(void**)&corpus, &corpus_len);
124 | 		RSCHECK_NESTED("Failed to map corpus");
125 | 
126 | 		rstate = net_map_remote(current_cpu->net_queue, "parsed_rtfs", 1024 * 1024,
127 | 				(void**)&parsed_rtfs, &parsed_rtfs_len);
128 | 		RSCHECK_NESTED("Failed to map parsed_rtfs");
129 | 
130 | 		rstate = net_map_remote(current_cpu->net_queue, "bkt_db.bin", 1024 * 1024,
131 | 				(void**)&bkt_db, &bkt_db_ents);
132 | 		RSCHECK_NESTED("Failed to map bkt_db");
133 | 		bkt_db_ents /= 0x10;
134 | 
135 | 		rstate = net_map_remote(current_cpu->net_queue, "cw_db.bin", 1024 * 1024,
136 | 				(void**)&cw_db, &cw_db_ents);
137 | 		RSCHECK_NESTED("Failed to map cw_db");
138 | 		cw_db_ents /= 0x10;
139 | 
140 | 		RSCHECK(bkt_db_ents && cw_db_ents && parsed_rtfs_len && corpus_len,
141 | 				"bkt_db, cw_db, corpus, or parsed_rtfs was empty");
142 | 
143 | 		ready_for_aps = 1;
144 | 	} else {
145 | 		while(!ready_for_aps);
146 | 	}
147 | 
148 | 	RSCHECK(corpus && corpus_len, "No corpus present");
149 | 
150 | 	rstate = fuzz_get_input_db(&input_db);
151 | 	RSCHECK_NESTED("Failed to get input DB");
152 | 	
153 | 	rstate = fuzz_get_crash_db(&crash_db);
154 | 	RSCHECK_NESTED("Failed to get crash DB");
155 | 
156 | 	/* Pick a random entry from out DB */
157 | 	while(!entry_len){
158 | 		rand_ftar(corpus, corpus_len, &entry, &entry_len);
159 | 	}
160 | 	memcpy(fuzz_input, entry, MIN(entry_len, fuzz_input_len));
161 | 
162 | #ifndef MINIMIZE
163 | 	/* 75% chance of using an already existing input */
164 | 	if(aes_rand() % 4){
165 | 		struct _input_ent *ent = ht_rand(input_db);
166 | 		if(ent){
167 | 			memcpy(fuzz_input, ent->buf, ent->len);
168 | 		}
169 | 	}
170 | 
171 | 	{
172 | 		uint64_t donor_off = aes_rand() % (corpus_len     - 32);
173 | 		uint64_t fuzz_off  = aes_rand() % (fuzz_input_len - 32);
174 | 
175 | 		for(ii = 0; ii < aes_rand() % 4; ii++){
176 | 			memcpy(fuzz_input + fuzz_off, corpus + donor_off, aes_rand() % 32);
177 | 		}
178 | 	}
179 | 
180 | 	for(ii = 0; ii < aes_rand() % 256; ii++){
181 | 		uint64_t offset = aes_rand() % fuzz_input_len;
182 | 		uint64_t remain = fuzz_input_len - offset;
183 | 		struct _rtf_chunk *rand_bkt = &bkt_db[aes_rand() % bkt_db_ents];
184 | 
185 | 		memcpy(fuzz_input + offset, parsed_rtfs + rand_bkt->offset,
186 | 				MIN(rand_bkt->size, remain));
187 | 	}
188 | 
189 | 	for(ii = 0; ii < aes_rand() % 8; ii++){
190 | 		uint64_t offset = aes_rand() % fuzz_input_len;
191 | 		uint64_t remain = fuzz_input_len - offset;
192 | 		struct _rtf_chunk *rand_cw = &cw_db[aes_rand() % cw_db_ents];
193 | 
194 | 		memcpy(fuzz_input + offset, parsed_rtfs + rand_cw->offset,
195 | 				MIN(rand_cw->size, remain));
196 | 	}
197 | #else
198 | 	if(aes_rand() % 128){
199 | 		struct _crash_entry *ent = ht_rand(crash_db);
200 | 		if(ent){
201 | 			struct _input_ent *input = fuzz_get_input(ent->hash);
202 | 			if(input){
203 | 				memcpy(fuzz_input, input->buf, input->len);
204 | 			}
205 | 		}
206 | 	}
207 | #endif
208 | 
209 | 	minimize_rtf(fuzz_input, fuzz_input_len);
210 | 	minimize_rtf(fuzz_input, fuzz_input_len);
211 | 
212 | 	rstate_ret = RSTATE_SUCCESS;
213 | cleanup:
214 | 	RSTATE_RETURN;
215 | }
216 | 
217 | volatile uint64_t fuzzes = 0;
218 | 
219 | rstate_t
220 | fuzz_word(void)
221 | {
222 | 	int hit_pf = 0;
223 | 	static volatile int ready_for_aps = 0;
224 | 	static volatile uint64_t sum_vmexits = 0, fuzz_start = 0;
225 | 
226 | 	uint8_t  *fuzz_input;
227 | 	uint64_t  fuzz_input_len = 229376, single_step = 0, vm_timeout, vmexits;
228 | 
229 | 	struct _x86_regs pf_regs;
230 | 	struct _vmcb     pf_vmcb;
231 | 	uint8_t          pf_xsave[4096];
232 | 
233 | 	struct _vm *vm;
234 | 	struct _vmcb *vmcb, old_vmcb;
235 | 
236 | 	RSTATE_LOCALS;
237 | 
238 | 	/* Load the snapshot over the network one time */
239 | 	if(is_bsp()){
240 | 		rstate = net_map_remote(current_cpu->net_queue, "word03_pf.img", 4096,
241 | 				(void**)&word_snapshot, &word_snapshot_len);
242 | 		RSCHECK_NESTED("Failed to map word snapshot");
243 | 
244 | 		fuzz_start = rdtsc_uptime();
245 | 
246 | 		ready_for_aps = 1;
247 | 	} else {
248 | 		while(!ready_for_aps) _mm_pause();
249 | 	}
250 | 
251 | 	rstate = phalloc(fuzz_input_len, (void**)&fuzz_input);
252 | 	RSCHECK_NESTED("Failed to allocate room for fuzz_input");
253 | 
254 | 	rstate = vm_x86_create(&vm, X86_SVM);
255 | 	RSCHECK_NESTED("Failed to create x86 VM");
256 | 	vm->npf_handler = x86_fuzz_npf_handler;
257 | 	vmcb = vm->state.svm_state->vmcb;
258 | 
259 | 	/* Save off the newly created vmcb */
260 | 	memcpy(&old_vmcb, vmcb, sizeof(struct _vmcb));
261 | 
262 | fuzz_again:
263 | 	/* Restore the snapshot vmcb */
264 | 	memcpy(vmcb, word_snapshot->vmcb, 4096);
265 | 
266 | 	/* Restore the snapshot xsave */
267 | 	memcpy(vm->state.svm_state->xsave, word_snapshot->xsave, 4096);
268 | 
269 | 	/* Restore our new VMCB n_cr3, iopm, and msrpm */
270 | 	vmcb->n_cr3 = old_vmcb.n_cr3;
271 | 	vmcb->iopm  = old_vmcb.iopm;
272 | 	vmcb->msrpm = old_vmcb.msrpm;
273 | 
274 | 	/* Restore register state from snapshot */
275 | 	vm->regs.x86_regs.rbx.rbx = word_snapshot->rbx;
276 | 	vm->regs.x86_regs.rcx.rcx = word_snapshot->rcx;
277 | 	vm->regs.x86_regs.rdx.rdx = word_snapshot->rdx;
278 | 	vm->regs.x86_regs.rsi.rsi = word_snapshot->rsi;
279 | 	vm->regs.x86_regs.rdi.rdi = word_snapshot->rdi;
280 | 	vm->regs.x86_regs.rbp.rbp = word_snapshot->rbp;
281 | 	vm->regs.x86_regs.r8.r8  = word_snapshot->r8;
282 | 	vm->regs.x86_regs.r9.r9  = word_snapshot->r9;
283 | 	vm->regs.x86_regs.r10.r10 = word_snapshot->r10;
284 | 	vm->regs.x86_regs.r11.r11 = word_snapshot->r11;
285 | 	vm->regs.x86_regs.r12.r12 = word_snapshot->r12;
286 | 	vm->regs.x86_regs.r13.r13 = word_snapshot->r13;
287 | 	vm->regs.x86_regs.r14.r14 = word_snapshot->r14;
288 | 	vm->regs.x86_regs.r15.r15 = word_snapshot->r15;
289 | 	
290 | 	/* Clear out breakpoints */
291 | 	/*vmcb->dr6 = 0;
292 | 	vmcb->dr7 = 0;*/
293 | 	
294 | 	writedr0(word_snapshot->dr0);
295 | 	writedr1(word_snapshot->dr1);
296 | 	writedr2(word_snapshot->dr2);
297 | 	writedr3(word_snapshot->dr3);
298 | 
299 | 	/* Create the generic segregs copy */
300 | 	svm_exit_regsegs(vm);
301 | 
302 | 	/* Mask all interrupts */
303 | 	vmcb->vint = (1 << 24);
304 | 
305 | 	/* Don't allow reads or writes to CRs */
306 | 	vmcb->CR_icpt = 0;
307 | 
308 | 	/* Don't allow reads or writes to DRs */
309 | 	vmcb->DR_icpt = 0;
310 | 
311 | 	/* Intercept all exceptions */
312 | 	vmcb->except_icpt = 0xFFFFFFFF;
313 | 
314 | 	/* Intercept shutdown, ferr_freeze, task switches, IO, HLT, and all
315 | 	 * interrupts.
316 | 	 */
317 | 	vmcb->icpt_set_1 = (1 << 31) | (1 << 30) | (1 << 29) | (1 << 27) |
318 | 		(1 << 24) | 0x1f;
319 | 
320 | 	/* Intercept everything but RDTSCP */
321 | 	vmcb->icpt_set_2 = 0x3F7F;
322 | 
323 | 	mm_for_each_dirty_page(vmcb->n_cr3, 0, -1, restore_page, vm);
324 | 
325 | 	/* Generate modlist */
326 | 	rstate = win32_gen_modlist(vm);
327 | 	RSCHECK_NESTED("Failed to generate modlist");
328 | 
329 | 	/* Make PMC overflows trigger NMIs */
330 | 	*(volatile uint32_t*)(current_cpu->apic + 0x340) = (4 << 8) | (1 << 17);
331 | 
332 | 	create_corrupt_rtf(fuzz_input, fuzz_input_len);
333 | 
334 | 	vm_timeout  = rdtsc_future(10000000);
335 | 	vmexits     = 0;
336 | 	single_step = 0;
337 | handled_vmexit:
338 | 	/* Enable LBR for the guest */
339 | 	vmcb->lbr_virt_en = 1;
340 | 	vmcb->dbgctrl     = 1;
341 | 	
342 | 	/* Clear debug status */
343 | 	vmcb->dr6 = 0;
344 | 
345 | 	vm->regs.x86_regs.rfl.u.tf = 0;
346 | 
347 | 	if(single_step){
348 | 		vm->regs.x86_regs.rfl.u.tf  = 1;
349 | 		vmcb->dbgctrl              |= 2;
350 | 
351 | 		single_step--;
352 | 	}
353 | 
354 | #if 1
355 | 	/* PMC based code coverage */
356 | 	wrmsr(0xc0010202, 0);
357 | 	wrmsr(0xc0010203, 0x1000000000000 - (aes_rand() % 512 + 1));
358 | 	wrmsr(0xc0010202, (1UL << 40) | (1UL << 20) | (1UL << 22) | (3UL << 16) | 0x83);
359 | #endif
360 | 
361 | 	vmcb->br_from = vmcb->br_to = 0;
362 | 
363 | 	rstate = vm->step(vm);
364 | 	RSCHECK_NESTED("Failed to step VM");
365 | 	vmexits++;
366 | 
367 | 	if(__rdtsc() >= vm_timeout){
368 | 		vmcb->exitcode = 0x1337;
369 | 		goto unhandled_vmexit;
370 | 	}
371 | 
372 | 	if(vmcb->br_from && vmcb->br_to){
373 | 		int new;
374 | 
375 | 		/* Report the code coverage information */
376 | 		rstate = fuzz_cc_report(vm, vmcb->br_from, vmcb->br_to,
377 | 				fuzz_input, fuzz_input_len, &new);
378 | 		RSCHECK_NESTED("Failed to report ode coverage information");
379 | 
380 | 		if(new){
381 | 			/* Enable single stepping on new coverage */
382 | 			single_step = 2048;
383 | 			vm_timeout  = rdtsc_future(10000000);
384 | 		}
385 | 	}
386 | 
387 | 	if(vmcb->exitcode == 0x60){
388 | 		/* External interrupt, ignore */
389 | 		goto handled_vmexit;
390 | 	} else if(vmcb->exitcode == 0x41){
391 | 		/* #DB */
392 | 		if(vmcb->dr6 & (1 << 14)){
393 | 			/* Eat single steps */
394 | 			goto handled_vmexit;
395 | 		}
396 | 
397 | #if 1
398 | 		if(contains(vm->regs.x86_regs.rdi.rdi, vm->regs.x86_regs.rdi.rdi + 511,
399 | 					0, fuzz_input_len)){
400 | 			vm_write_virt(vm, vm->regs.x86_regs.rax.rax,
401 | 					&fuzz_input[vm->regs.x86_regs.rdi.rdi], 512);
402 | 		}
403 | #endif
404 | 
405 | 		vm->regs.x86_regs.rfl.u.rf = 1;
406 | 		goto handled_vmexit;
407 | 	} else if(vmcb->exitcode == 0x4e){
408 | 		/* Inject a page fault, see if it's an actual crash or just a
409 | 		 * normal page fault
410 | 		 */
411 | 		memcpy(&pf_regs, &vm->regs.x86_regs, sizeof(struct _x86_regs));
412 | 		memcpy(&pf_vmcb, vmcb, sizeof(struct _vmcb));
413 | 		memcpy(pf_xsave, vm->state.svm_state->xsave, 4096);
414 | 		hit_pf = 1;
415 | 
416 | 		/* Inject the page fault into the guest */
417 | 		vmcb->eventinj = (vmcb->exitinfo1 << 32UL) |
418 | 			(1UL << 31) | (1 << 11) | (3 << 8) | 0xe;
419 | 		vmcb->cr2 = vmcb->exitinfo2;
420 | 
421 | 		goto handled_vmexit;
422 | 	} else if(vmcb->exitcode == 0x43){
423 | 		if(hit_pf && vm->regs.x86_regs.rip.rip & 0x8000000000000000UL){
424 | 			/* We hit our page fault breakpoint */
425 | 			memcpy(&vm->regs.x86_regs, &pf_regs, sizeof(struct _x86_regs));
426 | 			memcpy(vmcb, &pf_vmcb, sizeof(struct _vmcb));
427 | 			memcpy(vm->state.svm_state->xsave, pf_xsave, 4096);
428 | 			goto unhandled_vmexit;
429 | 		}
430 | 	} else if(vmcb->exitcode == 0x61){
431 | 		/* NMI from PMC overflow ignore */
432 | 		goto handled_vmexit;
433 | 	}
434 | 
435 | unhandled_vmexit:
436 | 	__sync_fetch_and_add(&sum_vmexits, vmexits);
437 | 
438 | 	if(vmcb->exitcode >= 0x40 && vmcb->exitcode < 0x60){
439 | 		int new_crash;
440 | 
441 | 		if(vm_read_virt(vm,
442 | 					vm->regs.x86_regs.cs_base + vm->regs.x86_regs.rip.rip,
443 | 					vmcb->guest_inst, 16) != RSTATE_SUCCESS){
444 | 			memset(vmcb->guest_inst, 0x90, 16);
445 | 		}
446 | 
447 | 		/* Report crash */
448 | 		rstate = fuzz_report_crash(vm, fuzz_input, fuzz_input_len, &new_crash);
449 | 		RSCHECK_NESTED("Failed to report crash");
450 | 
451 | 		if(new_crash){
452 | 			vm->dump_state(vm);
453 | 		}
454 | 	}
455 | 
456 | 	__sync_fetch_and_add(&fuzzes, 1);
457 | 
458 | 	if(is_bsp()){
459 | 		struct _hash_table *cc_db, *crash_db, *input_db;
460 | 
461 | 		rstate = fuzz_get_cc_db(&cc_db);
462 | 		RSCHECK_NESTED("Failed to get cc_db");
463 | 		
464 | 		rstate = fuzz_get_crash_db(&crash_db);
465 | 		RSCHECK_NESTED("Failed to get crash_db");
466 | 		
467 | 		rstate = fuzz_get_input_db(&input_db);
468 | 		RSCHECK_NESTED("Failed to get input_db");
469 | 
470 | 		printf("fuzzes %10lu | fcps %10lu | ccdb %10lu | "
471 | 				"crashes %10lu | vmepfc %10lu | inputs %10lu | "
472 | 				"mem %10lu",
473 | 				fuzzes, fuzzes * 1000000 / (rdtsc_uptime() - fuzz_start),
474 | 				cc_db->entries, crash_db->entries,
475 | 				sum_vmexits / fuzzes, input_db->entries,
476 | 				mm_mem_consumed() / 1024 / 1024);
477 | 	}
478 | 
479 | 	goto fuzz_again;
480 | 
481 | 	rstate_ret = RSTATE_SUCCESS;
482 | cleanup:
483 | 	RSTATE_RETURN;
484 | }
485 | 
486 | 


--------------------------------------------------------------------------------
/srcs/fuzzers/word.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | 
3 | rstate_t
4 | fuzz_word(void);
5 | 
6 | 


--------------------------------------------------------------------------------
/srcs/generic/locks.c:
--------------------------------------------------------------------------------
 1 | #include <grilled_cheese.h>
 2 | #include <disp/disp.h>
 3 | #include <generic/stdlib.h>
 4 | #include <generic/locks.h>
 5 | 
 6 | /* Storage for all locks */
 7 | static volatile struct _spinlock spinlocks[MAX_SPINLOCK_ID] = { { 0 } };
 8 | 
 9 | /* spinlock_acquire()
10 |  *
11 |  * Summary:
12 |  *
13 |  * This function acquires the spinlock corresponding to id. If the spinlock
14 |  * is already held on this CPU, a deadlock will occur. We track this and are
15 |  * able to panic when a deadlock is about to happen.
16 |  *
17 |  * In the special case that the spinlock is the display lock, we will output
18 |  * to the screen without a lock. This may result in mangled output on the
19 |  * screen.
20 |  *
21 |  * Parameters:
22 |  *
23 |  * _In_ id - Spinlock ID to acquire
24 |  */
25 | void
26 | spinlock_acquire(_In_ enum spinlock_id id)
27 | {
28 | 	unsigned int ticket;
29 | 
30 | 	/* Bounds check */
31 | 	if(id >= MAX_SPINLOCK_ID){
32 | 		panic("Spinlock ID invalid for acquire");
33 | 	}
34 | 
35 | 	/* First, validate that this cpu doesn't already have this spinlock
36 | 	 * held
37 | 	 */
38 | 	if(__sync_val_compare_and_swap(
39 | 				&current_cpu->spinlocks_held[id], 0, 1) != 0){
40 | 		if(id == DISP_LOCK){
41 | 			disp_err_mode();
42 | 			puts_nolock("Disp lock deadlock");
43 | 			halt();
44 | 		} else {
45 | 			printf("Already held lock %d", id);
46 | 			panic("Spinlock already held on CPU, deadlock");
47 | 		}
48 | 	}
49 | 
50 | 	/* Grab a ticket to wait in queue until it's our turn */
51 | 	ticket = __sync_fetch_and_add(&spinlocks[id].lock, 1);
52 | 	while(ticket != spinlocks[id].unlock){
53 | 		_mm_pause();
54 | 	}
55 | 	
56 | 	return;
57 | }
58 | 
59 | /* spinlock_release()
60 |  *
61 |  * Summary:
62 |  *
63 |  * This function releases a spinlock acquired by spinlock_acquire(). If the
64 |  * spinlock is not held on this CPU we will panic as we're trying to release a
65 |  * lock not owned by us.
66 |  *
67 |  * Parameters:
68 |  *
69 |  * _In_ id - Spinlock ID to release
70 |  */
71 | void
72 | spinlock_release(_In_ enum spinlock_id id)
73 | {
74 | 	/* Bounds check */
75 | 	if(id >= MAX_SPINLOCK_ID){
76 | 		panic("Spinlock ID invalid for release");
77 | 	}
78 | 
79 | 	/* First, validate that this lock is held on this CPU */
80 | 	if(__sync_val_compare_and_swap(
81 | 				&current_cpu->spinlocks_held[id], 1, 0) != 1){
82 | 		printf("Not held lock %d", id);
83 | 		panic("Spinlock not held at time of release");
84 | 	}
85 | 
86 | 	/* Bump up the unlock count */
87 | 	spinlocks[id].unlock++;
88 | 
89 | 	return;
90 | }
91 | 
92 | 


--------------------------------------------------------------------------------
/srcs/generic/locks.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | /* All spinlock definitions on the system. To add a new spinlock, simply
 4 |  * add another definition to this enum. Make sure that that last entry in the
 5 |  * enum is MAX_SPINLOCK_ID
 6 |  */
 7 | enum spinlock_id {
 8 | 	PAGE_TABLE_LOCK,
 9 | 	DISP_LOCK,
10 | 	NUMA_MEMORY_LOCK,
11 | 	MAX_SPINLOCK_ID
12 | };
13 | 
14 | struct _spinlock {
15 | 	volatile unsigned int lock;
16 | 	volatile unsigned int unlock;
17 | };
18 | 
19 | void
20 | spinlock_acquire(_In_ enum spinlock_id id);
21 | 
22 | void
23 | spinlock_release(_In_ enum spinlock_id id);
24 | 
25 | 


--------------------------------------------------------------------------------
/srcs/generic/stdlib.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | int
 4 | overlaps(_In_ uint64_t x1, _In_ uint64_t x2, _In_ uint64_t y1,
 5 | 		_In_ uint64_t y2);
 6 | 
 7 | int
 8 | contains(_In_ uint64_t x1, _In_ uint64_t x2, _In_ uint64_t y1,
 9 | 		_In_ uint64_t y2);
10 | 
11 | void*
12 | memset(
13 | 		_Out_writes_bytes_all_(size) void    *dest,
14 | 		_In_                         uint8_t  c,
15 | 		_In_                         size_t   size);
16 | 
17 | void*
18 | memcpy(
19 | 		_Out_writes_bytes_all_(size) void       *dest,
20 | 		_In_reads_bytes_(size)       const void *src,
21 | 		_In_                         size_t      size);
22 | 
23 | int
24 | memcmp(
25 | 		_In_reads_bytes_(size) const void *a,
26 | 		_In_reads_bytes_(size) const void *b,
27 | 		_In_                   size_t      size);
28 | 
29 | size_t
30 | strlen(_In_z_ const void *str);
31 | 
32 | __m128i
33 | falkhash(_In_reads_bytes_(len) const void *pbuf, _In_ size_t len);
34 | 
35 | uint64_t
36 | aes_rand(void);
37 | 
38 | size_t
39 | vsnprintf(
40 | 		_Out_writes_bytes_(len)       char       *buf,
41 | 		_In_                          size_t      len,
42 | 		_In_z_ _Printf_format_string_ const char *format,
43 | 		_In_                          va_list     ap);
44 | 
45 | size_t
46 | snprintf(
47 | 		_Out_writes_bytes_(len)       char       *buf,
48 | 		_In_                          size_t      len,
49 | 		_In_z_ _Printf_format_string_ const char *format,
50 | 		...)
51 | 	__attribute__((format(printf, 3, 4)));
52 | 
53 | void*
54 | memrmem(
55 | 		_In_reads_bytes_(haystack_len) const void *haystack,
56 | 		_In_                           size_t      haystack_len,
57 | 		_In_reads_bytes_(needle_len)   const void *needle,
58 | 		_In_                           size_t      needle_len);
59 | 
60 | int
61 | isalnum(_In_ uint8_t c);
62 | 
63 | int
64 | isdigit(_In_ uint8_t c);
65 | 
66 | int
67 | isxdigit(_In_ uint8_t c);
68 | 
69 | size_t
70 | atoi(_In_z_ const char *buf);
71 | 
72 | size_t
73 | nonnullcount(_In_reads_bytes_(len) const uint8_t *buf, _In_ size_t len);
74 | 
75 | size_t
76 | nonnulllast(_In_reads_bytes_(len) const uint8_t *buf, _In_ size_t len);
77 | 
78 | int
79 | hasheq(_In_ __m128i a, _In_ __m128i b);
80 | 
81 | int
82 | hashnull(_In_ __m128i hash);
83 | 
84 | 


--------------------------------------------------------------------------------
/srcs/grilled_cheese.h:
--------------------------------------------------------------------------------
  1 | #pragma once
  2 | 
  3 | #include <stddef.h>
  4 | #include <stdint.h>
  5 | #include <stdarg.h>
  6 | #include <x86intrin.h>
  7 | 
  8 | #define _In_
  9 | #define _In_z_
 10 | #define _In_opt_
 11 | #define _In_reads_bytes_(x)
 12 | #define _Out_
 13 | #define _Outptr_
 14 | #define _Out_writes_bytes_(x)
 15 | #define _Out_writes_bytes_all_(x)
 16 | #define _Printf_format_string_
 17 | 
 18 | #define NULL ((void*)0)
 19 | 
 20 | typedef uintptr_t size_t;
 21 | 
 22 | #define BEXTR(val, high, low) \
 23 | 	(((val) >> (low)) & ((1UL << ((high) - (low) + 1))-1))
 24 | #define MASK(val, high, low) \
 25 | 	((val) & (((1UL << ((high) - (low) + 1))-1)<<(low)))
 26 | 
 27 | #define MIN(a, b) ((a) < (b) ? (a) : (b))
 28 | #define MAX(a, b) ((a) > (b) ? (a) : (b))
 29 | 
 30 | #define htons(val) \
 31 |  ( (((uint16_t)(val) >> 8) & 0x00FF) | (((uint16_t)(val) << 8) & 0xFF00) )
 32 | 
 33 | #define htonl(val) \
 34 |  ( (((uint32_t)(val) >> 24) & 0x000000FF) | \
 35 |    (((uint32_t)(val) >>  8) & 0x0000FF00) | \
 36 |    (((uint32_t)(val) <<  8) & 0x00FF0000) | \
 37 |    (((uint32_t)(val) << 24) & 0xFF000000) )
 38 | 
 39 | #define htonq(val) \
 40 |  ( (((uint64_t)(val) >> 56) & 0x00000000000000FF) | \
 41 |    (((uint64_t)(val) >> 40) & 0x000000000000FF00) | \
 42 |    (((uint64_t)(val) >> 24) & 0x0000000000FF0000) | \
 43 |    (((uint64_t)(val) >>  8) & 0x00000000FF000000) | \
 44 |    (((uint64_t)(val) <<  8) & 0x000000FF00000000) | \
 45 |    (((uint64_t)(val) << 24) & 0x0000FF0000000000) | \
 46 |    (((uint64_t)(val) << 40) & 0x00FF000000000000) | \
 47 |    (((uint64_t)(val) << 56) & 0xFF00000000000000) )
 48 | 
 49 | #define byteswap(val) ((sizeof(val) == 2) ? htons(val) : \
 50 | 		((sizeof(val) == 4) ? htonl(val) : htonq(val)))
 51 | 
 52 | #define ntohs htons
 53 | #define ntohl htohl
 54 | #define ntohq htonq
 55 | 
 56 | #define current_cpu  get_current_cpu()
 57 | #define current_task (get_current_cpu()->task)
 58 | 
 59 | #define STACK_SIZE (1024 * 1024)
 60 | 
 61 | #include <cpu/cpu.h>
 62 | #include <rstate/rstate.h>
 63 | #include <generic/locks.h>
 64 | #include <task/task.h>
 65 | 
 66 | /* Structure of a 64-bit iret frame */
 67 | struct _iret {
 68 | 	uint64_t rip;
 69 | 	uint64_t cs;
 70 | 	uint64_t rflags;
 71 | 	uint64_t rsp;
 72 | 	uint64_t ss;
 73 | };
 74 | 
 75 | /* Exception information structure */
 76 | struct _exception {
 77 | 	/* iret frame */
 78 | 	struct _iret iret;
 79 | 
 80 | 	/* Exception vector */
 81 | 	uintptr_t vector;
 82 | 
 83 | 	/* Exception error code (optional based on vector) */
 84 | 	uintptr_t error;
 85 | 
 86 | 	/* Faulting address for page faults */
 87 | 	uintptr_t cr2;
 88 | };
 89 | 
 90 | /* Boot parameters structure passed in from bootloader. This must match the
 91 |  * definition used in the bootloader otherwise there will be problems. This
 92 |  * structure is read only.
 93 |  */
 94 | struct _boot_parameters {
 95 | 	/* Virtual address mapping in the screen (0xb8000) */
 96 | 	void *screen;
 97 | 
 98 | 	/* Pointer to the end of the stack created by the bootloader. This is
 99 | 	 * the standard stack that will be used during kernel operation. This
100 | 	 * may not be relevant to the current stack if we are in an interrupt.
101 | 	 */
102 | 	void *top_of_stack;
103 | 
104 | 	/* Pointer to e820 map */
105 | 	void *e820_map;
106 | 
107 | 	/* Physical window page table and base. */
108 | 	void      *phy_window_page_table;
109 | 	uintptr_t  phy_window_base;
110 | 
111 | 	/* Address of start of memory available by use for the OS. Anything below
112 | 	 * this is reserved by the bootloader and must not be touched.
113 | 	 */
114 | 	uintptr_t free_memory_base;
115 | 
116 | 	/* Address to jump to perform a soft reboot. When jumping to this the first
117 | 	 * 4GB of memory must be identity mapped.
118 | 	 */
119 | 	void *soft_reboot;
120 | 
121 | 	/* Physical address of the PE download base, physical pointer to the size,
122 | 	 * and maximum size available. When a soft reboot is done it loads the
123 | 	 * kernel from the location and size specified by the base and size.
124 | 	 */
125 | 	void     *kern_download_base;
126 | 	uint32_t *kern_download_size_ptr;
127 | 	uint64_t  kern_download_max_size;
128 | 
129 | 	/* Pointer to the start of this structure itself */
130 | 	void *boot_parameters;
131 | 
132 | 	/* Virtual address of the start and size of the text section. This can be
133 | 	 * used in unwind routines to determine which addresses may be code.
134 | 	 */
135 | 	void     *text_base;
136 | 	uint64_t  text_size;
137 | 
138 | 	/* APIC ID for this core */
139 | 	uint64_t apic_id;
140 | };
141 | 
142 | struct _cpu {
143 | 	/* Do not move this, pointer to self */
144 | 	void *gs_base;
145 | 
146 | 	/* Current running task on the CPU */
147 | 	struct _task *task;
148 | 
149 | 	/* Information about this CPU */
150 | 	unsigned int apic_id; /* APIC ID */
151 | 	unsigned int cpu_id;  /* CPU ID. This number is assigned sequentially
152 | 							 by the OS. The BSP will always be 0. */
153 | 	unsigned int node_id; /* Node ID that this CPU belongs to */
154 | 	unsigned int is_bsp;  /* 1 if this CPU is the BSP, zero otherwise */
155 | 
156 | 	/* Seed for the aes_rand() random number generator */
157 | 	__m128i rng_seed;
158 | 
159 | 	/* Physical window page table, base, and in use information. This is what
160 | 	 * is used to access physical memory on the system.
161 | 	 */
162 | 	volatile uint64_t  *phy_window_page_table;
163 | 	volatile uintptr_t  phy_window_base;
164 | 	volatile int        phy_window_inuse[512];
165 | 
166 | 	/* When interrupts are disabled this gets incremented. When they're enabled
167 | 	 * this gets decremented. When it hits 0 interrupts actually get enabled.
168 | 	 */
169 | 	volatile unsigned int interrupt_level;
170 | 
171 | 	/* Virtual address pointing to this CPU's APIC */
172 | 	volatile uint8_t *apic;
173 | 
174 | 	/* Default network queue for this CPU */
175 |     struct _net_queue *net_queue;
176 | 
177 | 	/* Boot parameters for this CPU */
178 | 	const struct _boot_parameters *boot_params;
179 | 
180 | 	/* For each spinlock on the system we maintain whether or not the current
181 | 	 * CPU has the lock held. This is done for deadlock detection.
182 | 	 */
183 | 	unsigned int spinlocks_held[MAX_SPINLOCK_ID];
184 | 
185 | 	/* Destination to branch to on a usermode exception. When a usermode
186 | 	 * exception occurs we will save the exception state into um_exception
187 | 	 * and then jump to the um_exception_handler.
188 | 	 */
189 | 	struct _iret      um_exception_handler;
190 | 	struct _exception um_exception;
191 | };
192 | 
193 | 


--------------------------------------------------------------------------------
/srcs/interrupts/interrupts.asm:
--------------------------------------------------------------------------------
  1 | [bits 64]
  2 | 
  3 | %macro YMMPUSH 1
  4 | 	sub     rsp, 32
  5 | 	vmovdqu [rsp], %1
  6 | %endmacro
  7 | 
  8 | %macro YMMPOP 1
  9 | 	vmovdqu %1, [rsp]
 10 | 	add     rsp, 32
 11 | %endmacro
 12 | 
 13 | section .data
 14 | 
 15 | global dacount
 16 | dacount: dq 0
 17 | 
 18 | section .text
 19 | 
 20 | extern interrupt_handler
 21 | 
 22 | global syscall_entry
 23 | syscall_entry:
 24 | 	o64 sysret
 25 | 
 26 | ; perform an iret
 27 | ;
 28 | ; struct {
 29 | ; 	uint64_t rip;
 30 | ;	uint64_t cs;
 31 | ;	uint64_t rflags;
 32 | ;	uint64_t rsp;
 33 | ; 	uint64_t ss;
 34 | ; };
 35 | ;
 36 | global enter_um_guest
 37 | enter_um_guest:
 38 | 	push rax
 39 | 	push rbx
 40 | 	push rcx
 41 | 	push rdx
 42 | 	push rsi
 43 | 	push rdi
 44 | 	push rbp
 45 | 	push r8
 46 | 	push r9
 47 | 	push r10
 48 | 	push r11
 49 | 	push r12
 50 | 	push r13
 51 | 	push r14
 52 | 	push r15
 53 | 
 54 | 	lea r12, [rel .return_dest]
 55 | 	mov qword [rsi + 0x00], r12
 56 | 	mov qword [rsi + 0x08], cs
 57 | 	pushfq
 58 | 	pop qword [rsi + 0x10]
 59 | 	mov qword [rsi + 0x18], rsp
 60 | 	mov qword [rsi + 0x20], ss
 61 | 
 62 | 	push qword [rdi + 0x20] ; ss
 63 | 	push qword [rdi + 0x18] ; rsp
 64 | 	push qword [rdi + 0x10] ; rflags
 65 | 	push qword [rdi + 0x08] ; cs
 66 | 	push qword [rdi + 0x00] ; rip
 67 | 
 68 | 	mov r8, rdx
 69 | 
 70 | 	mov rax, qword [r8 + 0x00]
 71 | 	mov rbx, qword [r8 + 0x08]
 72 | 	mov rcx, qword [r8 + 0x10]
 73 | 	mov rdx, qword [r8 + 0x18]
 74 | 	mov rsi, qword [r8 + 0x20]
 75 | 	mov rdi, qword [r8 + 0x28]
 76 | 	mov rbp, qword [r8 + 0x30]
 77 | 	mov r9,  qword [r8 + 0x38]
 78 | 	mov r10, qword [r8 + 0x40]
 79 | 	mov r11, qword [r8 + 0x48]
 80 | 	mov r11, qword [r8 + 0x48]
 81 | 	mov r12, qword [r8 + 0x50]
 82 | 
 83 | 	iretq
 84 | 
 85 | .return_dest:
 86 | 	mov qword [r8 + 0x00], rax
 87 | 	mov qword [r8 + 0x08], rbx
 88 | 	mov qword [r8 + 0x10], rcx
 89 | 	mov qword [r8 + 0x18], rdx
 90 | 	mov qword [r8 + 0x20], rsi
 91 | 	mov qword [r8 + 0x28], rdi
 92 | 	mov qword [r8 + 0x30], rbp
 93 | 	mov qword [r8 + 0x38], r9
 94 | 	mov qword [r8 + 0x40], r10
 95 | 	mov qword [r8 + 0x48], r11
 96 | 	mov qword [r8 + 0x50], r12
 97 | 
 98 | 	pop r15
 99 | 	pop r14
100 | 	pop r13
101 | 	pop r12
102 | 	pop r11
103 | 	pop r10
104 | 	pop r9
105 | 	pop r8
106 | 	pop rbp
107 | 	pop rdi
108 | 	pop rsi
109 | 	pop rdx
110 | 	pop rcx
111 | 	pop rbx
112 | 	pop rax
113 | 	ret
114 | 
115 | enter_c:
116 | 	push rax
117 | 	push rbx
118 | 	push rcx
119 | 	push rdx
120 | 	push rsi
121 | 	push rdi
122 | 	push rbp
123 | 	push r8
124 | 	push r9
125 | 	push r10
126 | 	push r11
127 | 	push r12
128 | 	push r13
129 | 	push r14
130 | 	push r15
131 | 
132 | 	YMMPUSH ymm0
133 | 	YMMPUSH ymm1
134 | 	YMMPUSH ymm2
135 | 	YMMPUSH ymm3
136 | 	YMMPUSH ymm4
137 | 	YMMPUSH ymm5
138 | 	YMMPUSH ymm6
139 | 	YMMPUSH ymm7
140 | 	YMMPUSH ymm8
141 | 	YMMPUSH ymm9
142 | 	YMMPUSH ymm10
143 | 	YMMPUSH ymm11
144 | 	YMMPUSH ymm12
145 | 	YMMPUSH ymm13
146 | 	YMMPUSH ymm14
147 | 	YMMPUSH ymm15
148 | 
149 | 	; Call the rust interrupt handler
150 | 	call interrupt_handler
151 | 
152 | 	YMMPOP ymm15
153 | 	YMMPOP ymm14
154 | 	YMMPOP ymm13
155 | 	YMMPOP ymm12
156 | 	YMMPOP ymm11
157 | 	YMMPOP ymm10
158 | 	YMMPOP ymm9
159 | 	YMMPOP ymm8
160 | 	YMMPOP ymm7
161 | 	YMMPOP ymm6
162 | 	YMMPOP ymm5
163 | 	YMMPOP ymm4
164 | 	YMMPOP ymm3
165 | 	YMMPOP ymm2
166 | 	YMMPOP ymm1
167 | 	YMMPOP ymm0
168 | 
169 | 	pop r15
170 | 	pop r14
171 | 	pop r13
172 | 	pop r12
173 | 	pop r11
174 | 	pop r10
175 | 	pop r9
176 | 	pop r8
177 | 	pop rbp
178 | 	pop rdi
179 | 	pop rsi
180 | 	pop rdx
181 | 	pop rcx
182 | 	pop rbx
183 | 	pop rax
184 | 	ret
185 | 
186 | %macro define_int_handler 2
187 | global vec_interrupt_%1
188 | vec_interrupt_%1:
189 | 	push rdi
190 | 	push rsi
191 | 	push rdx
192 | 
193 | %if %2
194 | 	mov  rdi, %1
195 | 	lea  rsi, [rsp+0x20]
196 | 	mov  rdx, [rsp+0x18]
197 | 	
198 | 	; 16-byte align the stack
199 | 	sub rsp, 8
200 | %else
201 | 	mov rdi, %1
202 | 	lea rsi, [rsp+0x18]
203 | 	mov rdx, 0
204 | %endif
205 | 
206 | 	call enter_c
207 | 	
208 | %if %2
209 | 	; Remove alignment from before
210 | 	add rsp, 8
211 | %endif
212 | 
213 | 	pop rdx
214 | 	pop rsi
215 | 	pop rdi
216 | 
217 | %if %2
218 | 	; 'pop' off the error code
219 | 	add rsp, 8
220 | %endif
221 | 
222 | 	iretq
223 | %endmacro
224 | 
225 | define_int_handler 0, 0
226 | define_int_handler 1, 0
227 | define_int_handler 2, 0
228 | define_int_handler 3, 0
229 | define_int_handler 4, 0
230 | define_int_handler 5, 0
231 | define_int_handler 6, 0
232 | define_int_handler 7, 0
233 | define_int_handler 8, 1
234 | define_int_handler 9, 0
235 | define_int_handler 10, 1
236 | define_int_handler 11, 1
237 | define_int_handler 12, 1
238 | define_int_handler 13, 1
239 | define_int_handler 14, 1
240 | define_int_handler 15, 0
241 | define_int_handler 16, 0
242 | define_int_handler 17, 1
243 | define_int_handler 18, 0
244 | define_int_handler 19, 0
245 | define_int_handler 20, 0
246 | define_int_handler 21, 0
247 | define_int_handler 22, 0
248 | define_int_handler 23, 0
249 | define_int_handler 24, 0
250 | define_int_handler 25, 0
251 | define_int_handler 26, 0
252 | define_int_handler 27, 0
253 | define_int_handler 28, 0
254 | define_int_handler 29, 0
255 | define_int_handler 30, 0
256 | define_int_handler 31, 0
257 | define_int_handler 32, 0
258 | define_int_handler 33, 0
259 | define_int_handler 34, 0
260 | define_int_handler 35, 0
261 | define_int_handler 36, 0
262 | define_int_handler 37, 0
263 | define_int_handler 38, 0
264 | define_int_handler 39, 0
265 | define_int_handler 40, 0
266 | define_int_handler 41, 0
267 | define_int_handler 42, 0
268 | define_int_handler 43, 0
269 | define_int_handler 44, 0
270 | define_int_handler 45, 0
271 | define_int_handler 46, 0
272 | define_int_handler 47, 0
273 | define_int_handler 48, 0
274 | define_int_handler 49, 0
275 | define_int_handler 50, 0
276 | define_int_handler 51, 0
277 | define_int_handler 52, 0
278 | define_int_handler 53, 0
279 | define_int_handler 54, 0
280 | define_int_handler 55, 0
281 | define_int_handler 56, 0
282 | define_int_handler 57, 0
283 | define_int_handler 58, 0
284 | define_int_handler 59, 0
285 | define_int_handler 60, 0
286 | define_int_handler 61, 0
287 | define_int_handler 62, 0
288 | define_int_handler 63, 0
289 | define_int_handler 64, 0
290 | define_int_handler 65, 0
291 | define_int_handler 66, 0
292 | define_int_handler 67, 0
293 | define_int_handler 68, 0
294 | define_int_handler 69, 0
295 | define_int_handler 70, 0
296 | define_int_handler 71, 0
297 | define_int_handler 72, 0
298 | define_int_handler 73, 0
299 | define_int_handler 74, 0
300 | define_int_handler 75, 0
301 | define_int_handler 76, 0
302 | define_int_handler 77, 0
303 | define_int_handler 78, 0
304 | define_int_handler 79, 0
305 | define_int_handler 80, 0
306 | define_int_handler 81, 0
307 | define_int_handler 82, 0
308 | define_int_handler 83, 0
309 | define_int_handler 84, 0
310 | define_int_handler 85, 0
311 | define_int_handler 86, 0
312 | define_int_handler 87, 0
313 | define_int_handler 88, 0
314 | define_int_handler 89, 0
315 | define_int_handler 90, 0
316 | define_int_handler 91, 0
317 | define_int_handler 92, 0
318 | define_int_handler 93, 0
319 | define_int_handler 94, 0
320 | define_int_handler 95, 0
321 | define_int_handler 96, 0
322 | define_int_handler 97, 0
323 | define_int_handler 98, 0
324 | define_int_handler 99, 0
325 | define_int_handler 100, 0
326 | define_int_handler 101, 0
327 | define_int_handler 102, 0
328 | define_int_handler 103, 0
329 | define_int_handler 104, 0
330 | define_int_handler 105, 0
331 | define_int_handler 106, 0
332 | define_int_handler 107, 0
333 | define_int_handler 108, 0
334 | define_int_handler 109, 0
335 | define_int_handler 110, 0
336 | define_int_handler 111, 0
337 | define_int_handler 112, 0
338 | define_int_handler 113, 0
339 | define_int_handler 114, 0
340 | define_int_handler 115, 0
341 | define_int_handler 116, 0
342 | define_int_handler 117, 0
343 | define_int_handler 118, 0
344 | define_int_handler 119, 0
345 | define_int_handler 120, 0
346 | define_int_handler 121, 0
347 | define_int_handler 122, 0
348 | define_int_handler 123, 0
349 | define_int_handler 124, 0
350 | define_int_handler 125, 0
351 | define_int_handler 126, 0
352 | define_int_handler 127, 0
353 | define_int_handler 128, 0
354 | define_int_handler 129, 0
355 | define_int_handler 130, 0
356 | define_int_handler 131, 0
357 | define_int_handler 132, 0
358 | define_int_handler 133, 0
359 | define_int_handler 134, 0
360 | define_int_handler 135, 0
361 | define_int_handler 136, 0
362 | define_int_handler 137, 0
363 | define_int_handler 138, 0
364 | define_int_handler 139, 0
365 | define_int_handler 140, 0
366 | define_int_handler 141, 0
367 | define_int_handler 142, 0
368 | define_int_handler 143, 0
369 | define_int_handler 144, 0
370 | define_int_handler 145, 0
371 | define_int_handler 146, 0
372 | define_int_handler 147, 0
373 | define_int_handler 148, 0
374 | define_int_handler 149, 0
375 | define_int_handler 150, 0
376 | define_int_handler 151, 0
377 | define_int_handler 152, 0
378 | define_int_handler 153, 0
379 | define_int_handler 154, 0
380 | define_int_handler 155, 0
381 | define_int_handler 156, 0
382 | define_int_handler 157, 0
383 | define_int_handler 158, 0
384 | define_int_handler 159, 0
385 | define_int_handler 160, 0
386 | define_int_handler 161, 0
387 | define_int_handler 162, 0
388 | define_int_handler 163, 0
389 | define_int_handler 164, 0
390 | define_int_handler 165, 0
391 | define_int_handler 166, 0
392 | define_int_handler 167, 0
393 | define_int_handler 168, 0
394 | define_int_handler 169, 0
395 | define_int_handler 170, 0
396 | define_int_handler 171, 0
397 | define_int_handler 172, 0
398 | define_int_handler 173, 0
399 | define_int_handler 174, 0
400 | define_int_handler 175, 0
401 | define_int_handler 176, 0
402 | define_int_handler 177, 0
403 | define_int_handler 178, 0
404 | define_int_handler 179, 0
405 | define_int_handler 180, 0
406 | define_int_handler 181, 0
407 | define_int_handler 182, 0
408 | define_int_handler 183, 0
409 | define_int_handler 184, 0
410 | define_int_handler 185, 0
411 | define_int_handler 186, 0
412 | define_int_handler 187, 0
413 | define_int_handler 188, 0
414 | define_int_handler 189, 0
415 | define_int_handler 190, 0
416 | define_int_handler 191, 0
417 | define_int_handler 192, 0
418 | define_int_handler 193, 0
419 | define_int_handler 194, 0
420 | define_int_handler 195, 0
421 | define_int_handler 196, 0
422 | define_int_handler 197, 0
423 | define_int_handler 198, 0
424 | define_int_handler 199, 0
425 | define_int_handler 200, 0
426 | define_int_handler 201, 0
427 | define_int_handler 202, 0
428 | define_int_handler 203, 0
429 | define_int_handler 204, 0
430 | define_int_handler 205, 0
431 | define_int_handler 206, 0
432 | define_int_handler 207, 0
433 | define_int_handler 208, 0
434 | define_int_handler 209, 0
435 | define_int_handler 210, 0
436 | define_int_handler 211, 0
437 | define_int_handler 212, 0
438 | define_int_handler 213, 0
439 | define_int_handler 214, 0
440 | define_int_handler 215, 0
441 | define_int_handler 216, 0
442 | define_int_handler 217, 0
443 | define_int_handler 218, 0
444 | define_int_handler 219, 0
445 | define_int_handler 220, 0
446 | define_int_handler 221, 0
447 | define_int_handler 222, 0
448 | define_int_handler 223, 0
449 | define_int_handler 224, 0
450 | define_int_handler 225, 0
451 | define_int_handler 226, 0
452 | define_int_handler 227, 0
453 | define_int_handler 228, 0
454 | define_int_handler 229, 0
455 | define_int_handler 230, 0
456 | define_int_handler 231, 0
457 | define_int_handler 232, 0
458 | define_int_handler 233, 0
459 | define_int_handler 234, 0
460 | define_int_handler 235, 0
461 | define_int_handler 236, 0
462 | define_int_handler 237, 0
463 | define_int_handler 238, 0
464 | define_int_handler 239, 0
465 | define_int_handler 240, 0
466 | define_int_handler 241, 0
467 | define_int_handler 242, 0
468 | define_int_handler 243, 0
469 | define_int_handler 244, 0
470 | define_int_handler 245, 0
471 | define_int_handler 246, 0
472 | define_int_handler 247, 0
473 | define_int_handler 248, 0
474 | define_int_handler 249, 0
475 | define_int_handler 250, 0
476 | define_int_handler 251, 0
477 | define_int_handler 252, 0
478 | define_int_handler 253, 0
479 | define_int_handler 254, 0
480 | define_int_handler 255, 0
481 | 
482 | 


--------------------------------------------------------------------------------
/srcs/interrupts/interrupts.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | void
 4 | interrupts_enable(void);
 5 | 
 6 | void
 7 | interrupts_disable(void);
 8 | 
 9 | void
10 | iret_stub(void);
11 | 
12 | uintptr_t
13 | enter_um_guest(const struct _iret *iret, struct _iret *save,
14 | 		uint64_t *x86_regs);
15 | 
16 | void
17 | profiling_dump(void);
18 | 
19 | void
20 | request_soft_reboot(const void *dev);
21 | 
22 | void
23 | pic_init(void);
24 | 
25 | rstate_t
26 | interrupts_init(void);
27 | 
28 | 


--------------------------------------------------------------------------------
/srcs/mm/mm.h:
--------------------------------------------------------------------------------
  1 | #pragma once
  2 | 
  3 | #define PT_BIT_COW (1UL << 52)
  4 | 
  5 | struct _mm_key {
  6 | 	/* Page aligned address and length described by this memory area */
  7 | 	uint64_t base_addr;
  8 | 	uint64_t length;
  9 | 
 10 | 	/* Key that identifies this memory area */
 11 | 	uint64_t key;
 12 | 
 13 | 	/* Private data by the creator of the key */
 14 | 	void *param;
 15 | 
 16 | 	/* Function to invoke when a pagefault occurs on this key. */
 17 | 	rstate_t (*pf_handler)(
 18 | 			_In_ struct _mm_key *key,
 19 | 			_In_ void           *param,
 20 | 			_In_ uintptr_t       fault_addr,
 21 | 			_In_ int             read_req,
 22 | 			_In_ int             write_req,
 23 | 			_In_ int             exec_req);
 24 | 
 25 | 	/* Next key in the linked list */
 26 | 	struct _mm_key *next;
 27 | };
 28 | 
 29 | struct _cow_map_state {
 30 | 	const void *backing;
 31 | };
 32 | 
 33 | void
 34 | mm_acquire_paging_lock(void);
 35 | 
 36 | void
 37 | mm_release_paging_lock(void);
 38 | 
 39 | rstate_t
 40 | page_fault(
 41 | 		_In_ uintptr_t     vector,
 42 | 		_In_ struct _iret *iret,
 43 | 		_In_ uintptr_t     error,
 44 | 		_In_ uintptr_t     cr2);
 45 | 
 46 | rstate_t
 47 | mm_init(void);
 48 | 
 49 | void
 50 | mm_dump_stats(void);
 51 | 
 52 | uint64_t
 53 | mm_mem_consumed(void);
 54 | 
 55 | uint64_t
 56 | mm_mem_inuse(void);
 57 | 
 58 | void
 59 | mm_init_cpu(_In_ const struct _boot_parameters *params);
 60 | 
 61 | rstate_t
 62 | mm_init_apic(void);
 63 | 
 64 | void*
 65 | mm_get_phys_mapping(_In_ uintptr_t paddr);
 66 | 
 67 | void
 68 | mm_release_phys_mapping(_In_ void *vaddr);
 69 | 
 70 | uint64_t
 71 | mm_phys_read_qword(_In_ uintptr_t paddr);
 72 | 
 73 | void
 74 | mm_phys_write_qword(_In_ uintptr_t paddr, _In_ uint64_t val);
 75 | 
 76 | void
 77 | mm_read_phys(
 78 |         _In_                        uintptr_t  paddr,
 79 |         _Out_writes_bytes_all_(len) void      *buf,
 80 |         _In_                        size_t     len);
 81 | 
 82 | int
 83 | mm_is_avail(_In_ uintptr_t paddr, _In_ size_t size);
 84 | 
 85 | rstate_t
 86 | alloc_phys(_In_ size_t length, _Out_ uintptr_t *allocation);
 87 | 
 88 | rstate_t
 89 | alloc_phys_4k(_Out_ uintptr_t *allocation);
 90 | 
 91 | void
 92 | free_phys_4k(_In_ uintptr_t allocation);
 93 | 
 94 | rstate_t
 95 | mm_reserve_random(
 96 | 		_In_     uintptr_t    cr3,
 97 | 		_In_     size_t       size,
 98 | 		_Outptr_ void       **addr,
 99 | 		_In_opt_ uint64_t     req_key,
100 | 		_Out_    uint64_t    *key);
101 | 
102 | rstate_t
103 | mm_map_contig(
104 | 		_In_ uintptr_t  cr3,
105 | 		_In_ uintptr_t  addr,
106 | 		_In_ uint64_t   value,
107 | 		_In_ size_t     length,
108 | 		_In_ uint64_t   key);
109 | 
110 | rstate_t
111 | mm_map_4k_int(
112 | 		_In_  uintptr_t  cr3,
113 | 		_In_  uintptr_t  addr,
114 | 		_In_  uint64_t   value,
115 | 		_In_  uint64_t   key,
116 | 		_Out_ uintptr_t *pte_addr);
117 | 
118 | rstate_t
119 | mm_map_4k_nolock(
120 | 		_In_ uintptr_t cr3,
121 | 		_In_ uintptr_t addr,
122 | 		_In_ uint64_t  value,
123 | 		_In_ uint64_t  key);
124 | 
125 | rstate_t
126 | mm_map_4k(
127 | 		_In_ uintptr_t  cr3,
128 | 		_In_ uintptr_t  addr,
129 | 		_In_ uint64_t   value,
130 | 		_In_ uint64_t   key);
131 | 
132 | uintptr_t
133 | mm_get_phys_nolock(
134 |         _In_  uintptr_t  cr3,
135 |         _In_  uintptr_t  addr,
136 | 		_Out_ uint64_t  *out_entry);
137 | 
138 | uintptr_t
139 | mm_get_phys(
140 |         _In_  uintptr_t  cr3,
141 |         _In_  uintptr_t  addr,
142 | 		_Out_ uint64_t  *out_entry);
143 | 
144 | rstate_t
145 | phalloc(_In_ size_t size, _Outptr_ void **allocation);
146 | 
147 | rstate_t
148 | phfree(_In_ void *allocation, _In_ size_t size);
149 | 
150 | void
151 | mm_for_each_dirty_page(
152 | 		_In_ uintptr_t  cr3,
153 | 		_In_ uintptr_t  start_addr,
154 | 		_In_ uintptr_t  end_addr,
155 | 		_In_ void       (*func)(void *ctxt, uintptr_t vaddr, uintptr_t paddr),
156 | 		_In_ void      *ctxt);
157 | 
158 | rstate_t
159 | mm_create_cow(
160 | 		_In_reads_bytes_(orig_len) const void  *orig_buf,
161 | 		_In_                       size_t       orig_len,
162 | 		_In_opt_                   void        *addr,
163 | 		_In_opt_                   uint64_t     key,
164 | 		_Outptr_                   void       **out_buf);
165 | 
166 | rstate_t
167 | alloc_physvirt_4k(_Out_ uintptr_t *phys, _Outptr_ void **virt);
168 | 
169 | void
170 | mm_register_key_handler(_In_ struct _mm_key *key);
171 | 
172 | 


--------------------------------------------------------------------------------
/srcs/net/net.h:
--------------------------------------------------------------------------------
  1 | #pragma once
  2 | 
  3 | #define NET_BASE_PORT 1400
  4 | 
  5 | #define NET_TERM_PRINTSTR 0xc1bc2ea7cd2f4ac6
  6 | 
  7 | #define NET_NOTIFY_REBOOT  0x636300e3c6e4f392
  8 | #define NET_REBOOT_REQUEST 0x9d7367f260ec073a
  9 | 
 10 | #define NET_REPORT_COVERAGE_STATUS 0xc0330f3bd9f585d9
 11 | 
 12 | #define NET_FILE_DOWNLOAD       0x18c59e5b342482c1
 13 | #define NET_FILE_DOWNLOAD_RESP  0x767bc53bc2d2ced0
 14 | #define NET_FILE_DOWNLOAD_CHUNK 0xeb717e7f8d411b03
 15 | #define NET_SNAP_UPLOAD         0x1A8FA024
 16 | #define NET_SNAP_UPLOAD_DATA    0x1E004AFA
 17 | #define NET_SNAP_UPLOAD_CONF    0x4E0E3AFD
 18 | #define NET_FILE_CHUNK_SIZE     8192
 19 | #define NET_COVERAGE_INFO       0xe645244373577400
 20 | 
 21 | #pragma pack(push, 1)
 22 | struct _file_download {
 23 | 	uint64_t magic;
 24 | 	uint64_t req_id;
 25 | 	uint64_t offset;
 26 | 	uint64_t size;
 27 | 	uint64_t info_only;
 28 | 	
 29 | 	char fn[256];
 30 | };
 31 | 
 32 | struct _file_download_response {
 33 | 	uint64_t magic;
 34 | 	uint64_t req_id;
 35 | 
 36 | 	uint64_t hash;
 37 | 	uint64_t file_len; /* -1 if file not found */
 38 | };
 39 | 
 40 | struct _file_download_chunk {
 41 | 	uint64_t magic;
 42 | 	uint64_t req_id;
 43 | 	uint64_t seq_id;
 44 | 
 45 | 	uint8_t  buf[8192];
 46 | };
 47 | 
 48 | struct _snap_upload {
 49 | 	uint64_t magic;
 50 | 	uint64_t req_id;
 51 | 	uint64_t file_len;
 52 | 	uint64_t padding;
 53 | 	uint8_t  fn[256];
 54 | 	__m128i  hash;
 55 | };
 56 | 
 57 | struct _snap_upload_data {
 58 | 	uint64_t magic;
 59 | 	uint64_t req_id;
 60 | 	uint8_t  data[NET_FILE_CHUNK_SIZE];
 61 | };
 62 | 
 63 | struct _snap_upload_conf {
 64 | 	uint64_t magic;
 65 | 	uint64_t req_id;
 66 | };
 67 | 
 68 | struct _coverage_info {
 69 | 	uint64_t magic;
 70 | 	uint64_t fuzzes;
 71 | 	uint64_t cc_count;
 72 | 	uint64_t uniq_crashes;
 73 | };
 74 | #pragma pack(pop)
 75 | 
 76 | struct _net_queue {
 77 | 	/* Identifier of the queue. This number is used directly for NICs with
 78 | 	 * multiple queues, so it should be 0-based.
 79 | 	 *
 80 | 	 * All queues other than queue 0 must have a filter in order for packets
 81 | 	 * to be routed to it.
 82 | 	 *
 83 | 	 * Maximum number of queues:
 84 | 	 *
 85 | 	 * +-------------------------+-----------+-----------+
 86 | 	 * | Device                  | RX Queues | TX Queues |
 87 | 	 * +-------------------------+-----------+-----------+
 88 | 	 * | Intel X540              | 128       | 128       |
 89 | 	 * +-------------------------+-----------+-----------+
 90 | 	 */
 91 | 	int queue_id;
 92 | 
 93 | 	/* UDP port which will be used as the filter to route to this queue. This
 94 | 	 * field is unused for queue 0, as no filters are allowed on queue 0.
 95 | 	 * Filters only apply to RX queues, any TX queue can be used to send any
 96 | 	 * packet.
 97 | 	 *
 98 | 	 * Queues are filtered with the following:
 99 | 	 *
100 | 	 * Packet must be UDP
101 | 	 * Packet destination IP must match queue->device->ip.
102 | 	 * Packet destination port must match queue->filter_port.
103 | 	 */
104 | 	int filter_port;
105 | 
106 | 	/* Per-device specific context related to the queue */
107 | 	void *device_context;
108 | 
109 | 	/* Pointer to routine to send packets on this queue */
110 | 	rstate_t
111 | 	(*send)(
112 | 			struct _net_queue *queue,
113 | 			const void        *packet,
114 | 			uint32_t           length);
115 | 
116 | 	/* Pointer to routine to recv packets on this queue */
117 | 	rstate_t
118 | 	(*recv)(
119 | 			struct _net_queue  *queue,
120 | 			void              **packet,
121 | 			uint32_t           *packet_len);
122 | 
123 | 	/* Pointer to routine to advance recv pointer */
124 | 	rstate_t
125 | 	(*recv_release)(struct _net_queue *queue);
126 | 
127 | 	/* Current task who owns the lock on this structure. If NULL, available
128 | 	 * for use.
129 | 	 */
130 | 	struct _task *task_using;
131 | 
132 | 	/* Network device to which this queue belongs */
133 | 	struct _net_device *device;
134 | 
135 | 	/* Next queue in the linked list of queues for the given device */
136 | 	struct _net_queue *next;
137 | };
138 | 
139 | struct _net_device {
140 | 	/* MAC address and IP of this device, stored in network endianness. If
141 | 	 * DHCP assignment failed, the IP will be 0.
142 | 	 */
143 | 	uint8_t  mac[6];
144 | 	uint32_t ip;
145 | 
146 | 	/* MAC address and IP of the DHCP server, stored in network endianness. If
147 | 	 * DHCP failed both fields will be filled with 0xff.
148 | 	 */
149 | 	uint8_t  dhcp_mac[6];
150 | 	uint32_t dhcp_ip;
151 | 	uint32_t dhcp_lease_time;
152 | 
153 | 	/* PCI BAR0 address */
154 | 	uintptr_t bar0;
155 | 
156 | 	/* Number of queues for this device */
157 | 	uint32_t num_queues;
158 | 
159 | 	/* Linked list of queues associated with this device */
160 | 	struct _net_queue  queues;
161 | 	struct _net_queue *queues_end;
162 | 
163 | 	/* Queue to use in timer interrupts */
164 | 	struct _net_queue *interrupt_queue;
165 | 
166 | 	/* Next network device in the linked list */
167 | 	struct _net_device *next;
168 | };
169 | 
170 | struct _remote_map_state {
171 | 	uint64_t  chunk_size;
172 | 	void     *chunk_tmp;
173 | 
174 | 	char fn[256];
175 | };
176 | 
177 | #pragma pack(push, 1)
178 | struct _udp_packet {
179 | 	/* MAC header */
180 | 	uint8_t  dest_mac[6];
181 | 	uint8_t  src_mac[6];
182 | 	uint16_t type;
183 | 
184 | 	/* IP header */
185 | 	uint8_t  ver;
186 | 	uint8_t  svc;
187 | 	uint16_t len; /* 28 + payload_len */
188 | 	uint16_t ident;
189 | 	uint8_t  flags;
190 | 	uint8_t  frag;
191 | 	uint8_t  ttl;
192 | 	uint8_t  proto; /* 0x11 - UDP */
193 | 	uint16_t ip_chk;
194 | 	uint32_t src_ip;
195 | 	uint32_t dest_ip;
196 | 
197 | 	/* UDP header */
198 | 	uint16_t src_port;
199 | 	uint16_t dest_port;
200 | 	uint16_t ulen; /* 8 + payload_len */
201 | 	uint16_t udp_chk;
202 | 
203 | 	uint8_t payload[8972];
204 | };
205 | #pragma pack(pop)
206 | 
207 | #pragma pack(push, 1)
208 | struct _arp_packet {
209 | 	/* MAC header */
210 | 	uint8_t  dest_mac[6];
211 | 	uint8_t  src_mac[6];
212 | 	uint16_t type;
213 | 
214 | 	uint16_t hw_type;
215 | 	uint16_t proto_type;
216 | 	uint8_t  hw_size;
217 | 	uint8_t  proto_size;
218 | 	uint16_t op;
219 | 	uint8_t  sender_mac[6];
220 | 	uint32_t sender_ip;
221 | 	uint8_t  target_mac[6];
222 | 	uint32_t target_ip;
223 | };
224 | #pragma pack(pop)
225 | 
226 | rstate_t
227 | net_init(void);
228 | 
229 | rstate_t
230 | net_init_local_queue(void);
231 | 
232 | void
233 | net_display_devices(void);
234 | 
235 | rstate_t
236 | net_process_interval(void);
237 | 
238 | rstate_t
239 | net_consume_unwanted(struct _net_device *device,
240 | 		uint8_t *packet, uint32_t packet_len);
241 | 
242 | rstate_t
243 | net_send_udp(
244 | 		struct _net_queue *queue,
245 | 		const void        *payload,
246 | 		uint32_t           len,
247 | 		uint32_t           dest_ip,
248 | 		uint32_t           dest_port);
249 | 
250 | rstate_t
251 | net_parse_udp(
252 | 		const void  *packet,
253 | 		uint32_t     packet_len,
254 | 		void       **udp_payload,
255 | 		uint32_t    *udp_payload_len);
256 | 
257 | rstate_t
258 | net_recv_udp(
259 | 		struct _net_queue   *queue,
260 | 		void               **packet,
261 | 		uint32_t            *packet_len,
262 | 		struct _udp_packet **raw);
263 | 
264 | rstate_t
265 | net_recv_release(struct _net_queue *queue);
266 | 
267 | rstate_t
268 | net_notify_server(void);
269 | 
270 | rstate_t
271 | net_download_file(
272 | 		struct _net_queue  *queue,
273 | 		const char         *filename,
274 | 		uint64_t            offset,
275 | 		void              **outbuf,
276 | 		uint64_t           *outlen);
277 | 
278 | rstate_t
279 | net_map_remote(
280 | 		struct _net_queue  *queue,
281 | 		const char         *filename,
282 | 		uint64_t            chunk_size,
283 | 		void               **outbuf,
284 | 		uint64_t            *outlen);
285 | 
286 | rstate_t
287 | net_start(struct _net_queue *queue);
288 | 
289 | void
290 | net_stop(struct _net_queue *queue);
291 | 
292 | rstate_t
293 | net_upload(
294 | 		struct _net_queue *queue,
295 | 		const char        *fn,
296 | 		void              *buf,
297 | 		size_t             len);
298 | 
299 | 


--------------------------------------------------------------------------------
/srcs/net/x540.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | #include <net/net.h>
 4 | 
 5 | #define X540_NUM_RX 1024
 6 | #define X540_NUM_TX 1024
 7 | 
 8 | struct _x540_rx_ring {
 9 | 	uintptr_t addr;
10 | 	uint64_t  status;
11 | };
12 | 
13 | struct _x540_tx_ring {
14 | 	uintptr_t addr;
15 | 
16 | 	union {
17 | 		struct {
18 | 			uint64_t length:16;
19 | 			uint64_t cso:8;
20 | 			uint64_t cmd:8;
21 | 			uint64_t dd:1;
22 | 			uint64_t rsvd:7;
23 | 			uint64_t css:8;
24 | 			uint64_t vlan:16;
25 | 		} b;
26 | 		uint64_t val;
27 | 	} status;
28 | };
29 | 
30 | struct _x540_queue {
31 | 	uintptr_t             rx_ring_phys;
32 | 	uintptr_t             tx_ring_phys;
33 | 	struct _x540_rx_ring *rx_ring;
34 | 	struct _x540_tx_ring *tx_ring;
35 | 
36 | 	void *rx_bufs[X540_NUM_RX];
37 | 	void *tx_bufs[X540_NUM_TX];
38 | 
39 | 	uint64_t rx_head;
40 | 	uint64_t tx_head;
41 | 	uint64_t tx_tail;
42 | };
43 | 
44 | rstate_t
45 | x540_init(struct _net_device *device);
46 | 
47 | rstate_t
48 | x540_queue_init(struct _net_queue *queue);
49 | 
50 | 


--------------------------------------------------------------------------------
/srcs/perf/perf.c:
--------------------------------------------------------------------------------
  1 | #include <grilled_cheese.h>
  2 | #include <perf/perf.h>
  3 | 
  4 | #define PERF_INTEL_BROADWELL_PMC_COUNT 177
  5 | 
  6 | static const struct _pmc_desc perf_intel_broadwell_pmc[PERF_INTEL_BROADWELL_PMC_COUNT] = {
  7 | 	{ 0x03, 0x02, "LD_BLOCKS.STORE_FORWARD" },
  8 | 	{ 0x03, 0x08, "LD_BLOCKS.NO_SR" },
  9 | 	{ 0x05, 0x01, "MISALIGN_MEM_REF.LOADS" },
 10 | 	{ 0x05, 0x02, "MISALIGN_MEM_REF.STORES" },
 11 | 	{ 0x07, 0x01, "LD_BLOCKS_PARTIAL.ADDRESS_ALIAS" },
 12 | 	{ 0x08, 0x01, "DTLB_LOAD_MISSES.MISS_CAUSES_A_WALK" },
 13 | 	{ 0x08, 0x02, "DTLB_LOAD_MISSES.WALK_COMPLETED_4K" },
 14 | 	{ 0x08, 0x10, "DTLB_LOAD_MISSES.WALK_DURATION" },
 15 | 	{ 0x08, 0x20, "DTLB_LOAD_MISSES.STLB_HIT_4K" },
 16 | 	{ 0x0d, 0x03, "INT_MISC.RECOVERY_CYCLES" },
 17 | 	{ 0x0e, 0x01, "UOPS_ISSUED.ANY" },
 18 | 	{ 0x0e, 0x10, "UOPS_ISSUED.FLAGS_MERGE" },
 19 | 	{ 0x0e, 0x20, "UOPS_ISSUED.SLOW_LEA" },
 20 | 	{ 0x0e, 0x40, "UOPS_ISSUED.SiNGLE_MUL" },
 21 | 	{ 0x14, 0x01, "ARITH.FPU_DIV_ACTIVE" },
 22 | 	{ 0x24, 0x21, "L2_RQSTS.DEMAND_DATA_RD_MISS" },
 23 | 	{ 0x24, 0x41, "L2_RQSTS.DEMAND_DATA_RD_HIT" },
 24 | 	{ 0x24, 0x50, "L2_RQSTS.L2_PF_HIT" },
 25 | 	{ 0x24, 0x30, "L2_RQSTS.L2_PF_MISS" },
 26 | 	{ 0x24, 0xe1, "L2_RQSTS.ALL_DEMAND_DATA_RD" },
 27 | 	{ 0x24, 0xe2, "L2_RQSTS.ALL_RFO" },
 28 | 	{ 0x24, 0xe4, "L2_RQSTS.ALL_CODE_RD" },
 29 | 	{ 0x24, 0xf8, "L2_RQSTS.ALL_PF" },
 30 | 	{ 0x27, 0x50, "L2_DEMAND_RQSTS.WB_HIT" },
 31 | 	{ 0x2e, 0x4f, "LONGEST_LAT_CACHE.REFERENCE" },
 32 | 	{ 0x2e, 0x41, "LONGEST_LAT_CACHE.MISS" },
 33 | 	{ 0x3c, 0x00, "CPU_CLK_UNHALTED.THREAD_P" },
 34 | 	{ 0x3c, 0x01, "CPU_CLK_THREAD_UNHALTED.REF_XCLK" },
 35 | 	{ 0x48, 0x01, "L1D_PEND_MISS.PENDING" },
 36 | 	{ 0x49, 0x01, "DTLB_STORE_MISSES.MISS_CAUSES_A_WALK" },
 37 | 	{ 0x49, 0x02, "DTLB_STORE_MISSES.WALK_COMPLETED_4K" },
 38 | 	{ 0x49, 0x10, "DTLB_STORE_MISSES.WALK_DURATION" },
 39 | 	{ 0x49, 0x20, "DTLB_STORE_MISSES.STLB_HIT_4K" },
 40 | 	{ 0x4c, 0x02, "LOAD_HIT_PRE.HW_PF" },
 41 | 	{ 0x4f, 0x10, "EPT.WALK_CYCLES" },
 42 | 	{ 0x51, 0x01, "L1D.REPLACEMENT" },
 43 | 	{ 0x58, 0x04, "MOVE_ELIMINATION.INT_NOT_ELIMINATED" },
 44 | 	{ 0x58, 0x08, "MOVE_ELIMINATION.SIMD_NOT_ELIMINATED" },
 45 | 	{ 0x58, 0x01, "MOVE_ELIMINATION.INT_ELIMINATED" },
 46 | 	{ 0x58, 0x02, "MOVE_ELIMINATION.SIMD_ELIMINATED" },
 47 | 	{ 0x5c, 0x01, "CPL_CYCLES.RING0" },
 48 | 	{ 0x5c, 0x02, "CPL_CYCLES.RING123" },
 49 | 	{ 0x5e, 0x01, "RS_EVENTS.EMPTY_CYCLES" },
 50 | 	{ 0x60, 0x01, "OFFCORE_REQUESTS_OUTSTANDING.DEMAND_DATA_RD" },
 51 | 	{ 0x60, 0x02, "OFFCORE_REQUESTS_OUTSTANDING.DEMAND_CODE_RD" },
 52 | 	{ 0x60, 0x04, "OFFCORE_REQUESTS_OUTSTANDING.DEMAND_RFO" },
 53 | 	{ 0x60, 0x08, "OFFCORE_REQUESTS_OUTSTANDING.ALL_DATA_RD" },
 54 | 	{ 0x63, 0x01, "LOCK_CYCLES.SPLIT_LOCK_UC_LOCK_DURATION" },
 55 | 	{ 0x63, 0x02, "LOCK_CYCLES.CACHE_LOCK_DURATION" },
 56 | 	{ 0x79, 0x02, "IDQ.EMPTY" },
 57 | 	{ 0x79, 0x04, "IDQ.MITE_UOPS" },
 58 | 	{ 0x79, 0x08, "IDQ.DSB_UOPS" },
 59 | 	{ 0x79, 0x10, "IDQ.MS_DSB_UOPS" },
 60 | 	{ 0x79, 0x20, "IDQ.MS_MITE_UOPS" },
 61 | 	{ 0x79, 0x30, "IDQ.MS_UOPS" },
 62 | 	{ 0x79, 0x18, "IDQ.ALL_DSB_CYCLES_ANY_UOPS" },
 63 | 	{ 0x79, 0x18, "IDQ.ALL_DSB_CYCLES_4_UOPS" },
 64 | 	{ 0x79, 0x24, "IDQ.ALL_MITE_CYCLES_ANY_UOPS" },
 65 | 	{ 0x79, 0x24, "IDQ.ALL_MITE_CYCLES_4_UOPS" },
 66 | 	{ 0x79, 0x3c, "IDQ.MITE_ALL_UOPS" },
 67 | 	{ 0x80, 0x02, "ICACHE.MISSES" },
 68 | 	{ 0x85, 0x01, "ITLB_MISSES.MISS_CAUSES_A_WALK" },
 69 | 	{ 0x85, 0x02, "ITLB_MISSES.WALK_COMPLETED_4K" },
 70 | 	{ 0x85, 0x10, "ITLB_MISSES.WALK_DURATION" },
 71 | 	{ 0x85, 0x20, "ITLB_MISSES.STLB_HIT_4K" },
 72 | 	{ 0x87, 0x01, "ILD_STALL.LCP" },
 73 | 	{ 0x88, 0x01, "BR_INST_EXEC.COND" },
 74 | 	{ 0x88, 0x02, "BR_INST_EXEC.DIRECT_JMP" },
 75 | 	{ 0x88, 0x04, "BR_INST_EXEC.INDIRECT_JMP_NON_CALL_RET" },
 76 | 	{ 0x88, 0x08, "BR_INST_EXEC.RETURN_NEAR" },
 77 | 	{ 0x88, 0x10, "BR_INST_EXEC.DIRECT_NEAR_CALL" },
 78 | 	{ 0x88, 0x20, "BR_INST_EXEC.INDIRECT_NEAR_CALL" },
 79 | 	{ 0x88, 0x40, "BR_INST_EXEC.NONTAKEN" },
 80 | 	{ 0x88, 0x80, "BR_INST_EXEC.TAKEN" },
 81 | 	{ 0x88, 0xff, "BR_INST_EXEC.ALL_BRANCHES" },
 82 | 	{ 0x89, 0x01, "BR_MISP_EXEC.COND" },
 83 | 	{ 0x89, 0x04, "BR_MISP_EXEC.INDIRECT_JMP_NON_CALL_RET" },
 84 | 	{ 0x89, 0x08, "BR_MISP_EXEC.RETURN_NEAR" },
 85 | 	{ 0x89, 0x10, "BR_MISP_EXEC.DIRECT_NEAR_CALL" },
 86 | 	{ 0x89, 0x20, "BR_MISP_EXEC.INDIRECT_NEAR_CALL" },
 87 | 	{ 0x89, 0x40, "BR_MISP_EXEC.NONTAKEN" },
 88 | 	{ 0x89, 0x80, "BR_MISP_EXEC.TAKEN" },
 89 | 	{ 0x89, 0xff, "BR_MISP_EXEC.ALL_BRANCHES" },
 90 | 	{ 0x9c, 0x01, "IDQ_UOPS_NOT_DELIVERED.CORE" },
 91 | 	{ 0xa1, 0x01, "UOPS_DISPATCHED_PORT.PORT_0" },
 92 | 	{ 0xa1, 0x02, "UOPS_DISPATCHED_PORT.PORT_1" },
 93 | 	{ 0xa1, 0x04, "UOPS_DISPATCHED_PORT.PORT_2" },
 94 | 	{ 0xa1, 0x08, "UOPS_DISPATCHED_PORT.PORT_3" },
 95 | 	{ 0xa1, 0x10, "UOPS_DISPATCHED_PORT.PORT_4" },
 96 | 	{ 0xa1, 0x20, "UOPS_DISPATCHED_PORT.PORT_5" },
 97 | 	{ 0xa1, 0x40, "UOPS_DISPATCHED_PORT.PORT_6" },
 98 | 	{ 0xa1, 0x80, "UOPS_DISPATCHED_PORT.PORT_7" },
 99 | 	{ 0xa2, 0x01, "RESOURCE_STALLS.ANY" },
100 | 	{ 0xa2, 0x04, "RESOURCE_STALLS.RS" },
101 | 	{ 0xa2, 0x08, "RESOURCE_STALLS.SB" },
102 | 	{ 0xa2, 0x10, "RESOURCE_STALLS.ROB" },
103 | 	{ 0xa8, 0x01, "LSD.UOPS" },
104 | 	{ 0xab, 0x02, "DSB2MITE_SWITCHES.PENALTY_CYCLES" },
105 | 	{ 0xae, 0x01, "ITLB.ITLB_FLUSH" },
106 | 	{ 0xb0, 0x01, "OFFCORE_REQUESTS.DEMAND_DATA_RD" },
107 | 	{ 0xb0, 0x02, "OFFCORE_REQUESTS.DEMAND_CODE_RD" },
108 | 	{ 0xb0, 0x04, "OFFCORE_REQUESTS.DEMAND_RFO" },
109 | 	{ 0xb0, 0x08, "OFFCORE_REQUESTS.ALL_DATA_RD" },
110 | 	{ 0xb1, 0x01, "UOPS_EXECUTED.THREAD" },
111 | 	{ 0xb1, 0x02, "UOPS_EXECUTED.CORE" },
112 | 	{ 0xb7, 0x01, "OFF_CORE_RESPONSE_0" },
113 | 	{ 0xbb, 0x01, "OFF_CORE_RESPONSE_1" },
114 | 	{ 0xbc, 0x11, "PAGE_WALKER_LOADS.DTLB_L1" },
115 | 	{ 0xbc, 0x21, "PAGE_WALKER_LOADS.ITLB_L1" },
116 | 	{ 0xbc, 0x12, "PAGE_WALKER_LOADS.DTLB_L2" },
117 | 	{ 0xbc, 0x22, "PAGE_WALKER_LOADS.ITLB_L2" },
118 | 	{ 0xbc, 0x14, "PAGE_WALKER_LOADS.DTLB_L3" },
119 | 	{ 0xbc, 0x24, "PAGE_WALKER_LOADS.ITLB_L3" },
120 | 	{ 0xbc, 0x18, "PAGE_WALKER_LOADS.DTLB_MEMORY" },
121 | 	{ 0xc0, 0x00, "INST_RETIRED.ANY_P" },
122 | 	{ 0xc0, 0x01, "INST_RETIRED.PREC_DIST" },
123 | 	{ 0xc0, 0x02, "INST_RETIRED.X87" },
124 | 	{ 0xc1, 0x08, "OTHER_ASSISTS.AVX_TO_SSE" },
125 | 	{ 0xc1, 0x10, "OTHER_ASSISTS.SSE_TO_AVX" },
126 | 	{ 0xc1, 0x40, "OTHER_ASSISTS.ANY_WB_ASSIST" },
127 | 	{ 0xc2, 0x01, "UOPS_RETIRED.ALL" },
128 | 	{ 0xc2, 0x02, "UOPS_RETIRED.RETIRE_SLOTS" },
129 | 	{ 0xc3, 0x01, "MACHINE_CLEARS.CYCLES" },
130 | 	{ 0xc3, 0x02, "MACHINE_CLEARS.MEMORY_ORDERING" },
131 | 	{ 0xc3, 0x04, "MACHINE_CLEARS.SMC" },
132 | 	{ 0xc3, 0x20, "MACHINE_CLEARS.MASKMOV" },
133 | 	{ 0xc4, 0x00, "BR_INST_RETIRED.ALL_BRANCHES" },
134 | 	{ 0xc4, 0x01, "BR_INST_RETIRED.CONDITIONAL" },
135 | 	{ 0xc4, 0x02, "BR_INST_RETIRED.NEAR_CALL" },
136 | 	{ 0xc4, 0x04, "BR_INST_RETIRED.ALL_BRANCHES" },
137 | 	{ 0xc4, 0x08, "BR_INST_RETIRED.NEAR_RETURN" },
138 | 	{ 0xc4, 0x10, "BR_INST_RETIRED.NOT_TAKEN" },
139 | 	{ 0xc4, 0x20, "BR_INST_RETIRED.NEAR_TAKEN" },
140 | 	{ 0xc4, 0x40, "BR_INST_RETIRED.FAR_BRANCH" },
141 | 	{ 0xc5, 0x00, "BR_MISP_RETIRED.ALL_BRANCHES" },
142 | 	{ 0xc5, 0x01, "BR_MISP_RETIRED.CONDITIONAL" },
143 | 	{ 0xc5, 0x04, "BR_MISP_RETIRED.ALL_BRANCHES" },
144 | 	{ 0xca, 0x02, "FP_ASSIST.X87_OUTPUT" },
145 | 	{ 0xca, 0x04, "FP_ASSIST.X87_INPUT" },
146 | 	{ 0xca, 0x08, "FP_ASSIST.SIMD_OUTPUT" },
147 | 	{ 0xca, 0x10, "FP_ASSIST.SIMD_INPUT" },
148 | 	{ 0xca, 0x1e, "FP_ASSIST.ANY" },
149 | 	{ 0xcc, 0x20, "ROB_MISC_EVENTS.LBR_INSERTS" },
150 | 	{ 0xcd, 0x01, "MEM_TRANS_RETIRED.LOAD_LATENCY" },
151 | 	{ 0xd0, 0x11, "MEM_UOPS_RETIRED.STLB_MISS_LOADS" },
152 | 	{ 0xd0, 0x12, "MEM_UOPS_RETIRED.STLB_MISS_STORES" },
153 | 	{ 0xd0, 0x21, "MEM_UOPS_RETIRED.LOCK_LOADS" },
154 | 	{ 0xd0, 0x41, "MEM_UOPS_RETIRED.SPLIT_LOADS" },
155 | 	{ 0xd0, 0x42, "MEM_UOPS_RETIRED.SPLIT_STORES" },
156 | 	{ 0xd0, 0x81, "MEM_UOPS_RETIRED.ALL_LOADS" },
157 | 	{ 0xd0, 0x82, "MEM_UOPS_RETIRED.ALL_STORES" },
158 | 	{ 0xd1, 0x01, "MEM_LOAD_UOPS_RETIRED.L1_HIT" },
159 | 	{ 0xd1, 0x02, "MEM_LOAD_UOPS_RETIRED.L2_HIT" },
160 | 	{ 0xd1, 0x04, "MEM_LOAD_UOPS_RETIRED.L3_HIT" },
161 | 	{ 0xd1, 0x08, "MEM_LOAD_UOPS_RETIRED.L1_MISS" },
162 | 	{ 0xd1, 0x10, "MEM_LOAD_UOPS_RETIRED.L2_MISS" },
163 | 	{ 0xd1, 0x20, "MEM_LOAD_UOPS_RETIRED.L3_MISS" },
164 | 	{ 0xd1, 0x40, "MEM_LOAD_UOPS_RETIRED.HIT_LFB" },
165 | 	{ 0xd2, 0x01, "MEM_LOAD_UOPS_L3_HIT_RETIRED.XSNP_MISS" },
166 | 	{ 0xd2, 0x02, "MEM_LOAD_UOPS_L3_HIT_RETIRED.XSNP_HIT" },
167 | 	{ 0xd2, 0x04, "MEM_LOAD_UOPS_L3_HIT_RETIRED.XSNP_HITM" },
168 | 	{ 0xd2, 0x08, "MEM_LOAD_UOPS_L3_HIT_RETIRED.XSNP_NONE" },
169 | 	{ 0xd3, 0x01, "MEM_LOAD_UOPS_L3_MISS_RETIRED.LOCAL_DRAM" },
170 | 	{ 0xf0, 0x01, "L2_TRANS.DEMAND_DATA_RD" },
171 | 	{ 0xf0, 0x02, "L2_TRANS.RFO" },
172 | 	{ 0xf0, 0x04, "L2_TRANS.CODE_RD" },
173 | 	{ 0xf0, 0x08, "L2_TRANS.ALL_PF" },
174 | 	{ 0xf0, 0x10, "L2_TRANS.L1D_WB" },
175 | 	{ 0xf0, 0x20, "L2_TRANS.L2_FILL" },
176 | 	{ 0xf0, 0x40, "L2_TRANS.L2_WB" },
177 | 	{ 0xf0, 0x80, "L2_TRANS.ALL_REQUESTS" },
178 | 	{ 0xf1, 0x01, "L2_LINES_IN.I" },
179 | 	{ 0xf1, 0x02, "L2_LINES_IN.S" },
180 | 	{ 0xf1, 0x04, "L2_LINES_IN.E" },
181 | 	{ 0xf1, 0x07, "L2_LINES_IN.ALL" },
182 | 	{ 0xf2, 0x05, "L2_LINES_OUT.DEMAND_CLEAN" },
183 | 	{ 0x54, 0x02, "TX_MEM.ABORT_CAPACITY" },
184 | };
185 | 
186 | rstate_t
187 | perf_get_pmc_by_id(
188 | 		unsigned int             perf_id,
189 | 		const struct _pmc_desc **pmc)
190 | {
191 | 	RSTATE_LOCALS;
192 | 
193 | 	RSCHECK(perf_id < PERF_INTEL_BROADWELL_PMC_COUNT,
194 | 			"Performance counter ID out of range");
195 | 
196 | 	*pmc = &perf_intel_broadwell_pmc[perf_id];
197 | 
198 | 	rstate_ret = rstate = RSTATE_SUCCESS;
199 | cleanup:
200 | 	RSTATE_RETURN;
201 | }
202 | 
203 | 


--------------------------------------------------------------------------------
/srcs/perf/perf.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | struct _pmc_desc {
 4 | 	unsigned int event;
 5 | 	unsigned int umask;
 6 | 
 7 | 	const char *name;
 8 | };
 9 | 
10 | rstate_t
11 | perf_get_pmc_by_id(
12 | 		unsigned int             perf_id,
13 | 		const struct _pmc_desc **pmc);
14 | 
15 | 


--------------------------------------------------------------------------------
/srcs/rstate/rstate.c:
--------------------------------------------------------------------------------
 1 | #include <grilled_cheese.h>
 2 | #include <disp/disp.h>
 3 | 
 4 | const struct _return_state rstate_invalid =
 5 | 	{ RSTATE_CODE_INVALID, __LINE__, __FILE__, "Invalid rstate", "<nofunc>" };
 6 | 
 7 | void
 8 | rstate_push(rstate_t rstate)
 9 | {
10 | 	if(current_task->rstate_stack_depth == RSTATE_STACK_ENTRIES){
11 | 		return;
12 | 	}
13 | 
14 | 	current_task->rstate_stack[current_task->rstate_stack_depth] = rstate;
15 | 	current_task->rstate_stack_depth++;
16 | 
17 | 	return;
18 | }
19 | 
20 | void
21 | rstate_clear(void)
22 | {
23 | 	current_task->rstate_stack_depth = 0;
24 | 	return;
25 | }
26 | 
27 | void
28 | rstate_unwind(void)
29 | {
30 | 	int i;
31 | 
32 | 	for(i = 0; i < current_task->rstate_stack_depth; i++){
33 | 		printf("%s:%u %s() %s",
34 | 				current_task->rstate_stack[i]->source_fn,
35 | 				current_task->rstate_stack[i]->source_line,
36 | 				current_task->rstate_stack[i]->funcname,
37 | 				current_task->rstate_stack[i]->str);
38 | 	}
39 | 
40 | 	return;
41 | }
42 | 
43 | void
44 | rstate_panic(void)
45 | {
46 | 	printf("!!! PANIC !!!");
47 | 	rstate_unwind();
48 | 	panic("rstate_panic() invoked");
49 | }
50 | 
51 | 


--------------------------------------------------------------------------------
/srcs/rstate/rstate.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | /* Success states */
 4 | #define RSTATE_SUCCESS NULL
 5 | 
 6 | /* Error code used indicating invalid rstate. This occurs if an uninitialized
 7 |  * rstate is returned.
 8 |  */
 9 | #define RSTATE_CODE_INVALID 0xe1f2e965
10 | 
11 | /* Error code indicating rstate is nested */
12 | #define RSTATE_CODE_NESTED  0x9f1c0505
13 | 
14 | /* Number of entires in the rstate stack */
15 | #define RSTATE_STACK_ENTRIES 512
16 | 
17 | /* Invalid state. Used for initializing rstate at a function start. */
18 | extern const struct _return_state rstate_invalid;
19 | 
20 | /* Quick defines for locals in any function that uses rstates. */
21 | #define RSTATE_LOCALS rstate_t rstate = (&rstate_invalid), \
22 | 										rstate_ret = (&rstate_invalid);
23 | 
24 | #define RSTATE_RETURN \
25 | 	if(rstate_ret != RSTATE_SUCCESS){ \
26 | 		if(rstate_ret->code != RSTATE_CODE_NESTED) \
27 | 			rstate_clear(); \
28 | 		rstate_push(rstate_ret); \
29 | 	} \
30 | 	return rstate_ret;
31 | 
32 | #define RSCHECK(statement, str) \
33 | 	if(!(statement)){ \
34 | 		static const struct _return_state rs = \
35 | 			{ 0, __LINE__, __FILE__, str, __FUNCTION__ }; \
36 | 		rstate_ret = &rs; \
37 | 		goto cleanup; \
38 | 	}
39 | 
40 | #define RSCHECK_NESTED(str) \
41 | 	if(rstate != RSTATE_SUCCESS){ \
42 | 		static const struct _return_state rs = \
43 | 			{ RSTATE_CODE_NESTED, __LINE__, __FILE__, str, __FUNCTION__ }; \
44 | 		rstate_ret = &rs; \
45 | 		goto cleanup; \
46 | 	}
47 | 
48 | #define RSTATE_PANIC \
49 | 	if(rstate_ret != RSTATE_SUCCESS){ \
50 | 		if(rstate_ret->code != RSTATE_CODE_NESTED) \
51 | 			rstate_clear(); \
52 | 		rstate_push(rstate_ret); \
53 | 	} \
54 | 	rstate_panic();
55 | 
56 | struct _return_state {
57 | 	const uint32_t  code;
58 | 	const uint32_t  source_line;
59 | 	const char     *source_fn;
60 | 	const char     *str;
61 | 	const char     *funcname;
62 | };
63 | 
64 | typedef const struct _return_state *rstate_t;
65 | 
66 | void
67 | rstate_push(rstate_t rstate);
68 | 
69 | void
70 | rstate_clear(void);
71 | 
72 | void
73 | rstate_unwind(void);
74 | 
75 | void
76 | rstate_panic(void);
77 | 
78 | 


--------------------------------------------------------------------------------
/srcs/task/task.c:
--------------------------------------------------------------------------------
 1 | #include <grilled_cheese.h>
 2 | #include <generic/stdlib.h>
 3 | #include <task/task.h>
 4 | 
 5 | #define NUM_TASKS_PER_CPU 4
 6 | 
 7 | struct _cpu_task {
 8 | 	struct _task init;
 9 | 	struct _task tasks[NUM_TASKS_PER_CPU];
10 | };
11 | 
12 | static struct _cpu_task cpu_tasks[256] = { { { 0 } } };
13 | 
14 | void
15 | task_create_init(void)
16 | {
17 | 	struct _task *tmp = &cpu_tasks[current_cpu->apic_id].init;
18 | 
19 | 	/* Set task in use */
20 | 	tmp->in_use = 1;
21 | 
22 | 	/* Set that this is the init task */
23 | 	tmp->is_init = 1;
24 | 
25 | 	/* Allow all interrupts */
26 | 	memset(tmp->interrupt_allowed, 1, 256);
27 | 
28 | 	/* Swap in this task */
29 | 	current_cpu->task = tmp;
30 | 
31 | 	return;
32 | }
33 | 
34 | struct _task*
35 | task_create(void)
36 | {
37 | 	int ii;
38 | 	struct _task *tmp;
39 | 
40 | 	/* Look for a free task */
41 | 	for(ii = 0; ii < NUM_TASKS_PER_CPU; ii++){
42 | 		if(!cpu_tasks[current_cpu->apic_id].tasks[ii].in_use){
43 | 			break;
44 | 		}
45 | 	}
46 | 
47 | 	if(ii == NUM_TASKS_PER_CPU){
48 | 		return NULL;
49 | 	}
50 | 
51 | 	tmp = &cpu_tasks[current_cpu->apic_id].tasks[ii];
52 | 
53 | 	/* Zero out the task */
54 | 	memset(tmp, 0, sizeof(*tmp));
55 | 
56 | 	/* Set task in use */
57 | 	tmp->in_use = 1;
58 | 
59 | 	/* Allow all exceptions */
60 | 	memset(tmp->interrupt_allowed, 1, 32);
61 | 
62 | 	return tmp;
63 | }
64 | 
65 | void
66 | task_destroy(struct _task *task)
67 | {
68 | 	task->in_use = 0;
69 | 	return;
70 | }
71 | 
72 | 


--------------------------------------------------------------------------------
/srcs/task/task.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | struct _task {
 4 | 	/* 0 if this task is available for use, 1 if it is already in use */
 5 | 	int in_use;
 6 | 
 7 | 	/* 0 if this is not an init task, 1 if it is */
 8 | 	int is_init;
 9 | 
10 | 	/* Stack and depth used by the rstate subsystem */
11 | 	const struct _return_state *rstate_stack[RSTATE_STACK_ENTRIES];
12 | 	int rstate_stack_depth;
13 | 
14 | 	/* Interrupts that are allowed when this task is running. If an interrupt
15 | 	 * occurs which is not allowed during a task a panic will occur.
16 | 	 */
17 | 	uint8_t interrupt_allowed[256];
18 | 
19 | 	/* Physical 4k page free list */
20 | 	uintptr_t free_list;
21 | 	size_t    free_list_entries;
22 | };
23 | 
24 | void
25 | task_create_init(void);
26 | 
27 | struct _task*
28 | task_create(void);
29 | 
30 | void
31 | task_destroy(struct _task *task);
32 | 
33 | 


--------------------------------------------------------------------------------
/srcs/time/time.c:
--------------------------------------------------------------------------------
  1 | #include <grilled_cheese.h>
  2 | #include <generic/stdlib.h>
  3 | #include <disp/disp.h>
  4 | 
  5 | /* Rate that the rdtsc increments at, in MHz. 2300 would indicate a 2.3GHz
  6 |  * processor. Set by rdtsc_calibrate() early in the boot process.
  7 |  */
  8 | static uint64_t rdtsc_inc_freq = 0;
  9 | 
 10 | /* rdtsc_calibrate()
 11 |  *
 12 |  * Summary:
 13 |  *
 14 |  * Using the PIT, determine the frequency of rdtsc. Round this frequency to
 15 |  * the nearest 100MHz and store it in the rdtsc_inc_freq global. This function
 16 |  * should only be used as part of the system init sequence.
 17 |  */
 18 | void
 19 | rdtsc_calibrate(void)
 20 | {
 21 | 	uint64_t start, rounded_rate;
 22 | 	double   elapsed, computed_rate;
 23 | 
 24 | 	/* Store off the current rdtsc value */
 25 | 	start = __rdtsc();
 26 | 
 27 | 	/* Program the PIT to use mode 0 (interrupt after countdown) to count
 28 | 	 * down from 65535. This causes an interrupt to occur after about
 29 | 	 * 54.92 milliseconds (65535 / 1193182). We mask interrupts from the
 30 | 	 * PIT, thus we poll by sending the read back command to check whether
 31 | 	 * the output pin is set to 1, indicating the countdown completed.
 32 | 	 */
 33 | 	outb(0x43, 0x30);
 34 | 	outb(0x40, 0xff);
 35 | 	outb(0x40, 0xff);
 36 | 
 37 | 	for( ; ; ){
 38 | 		/* Send the read back command to latch status on channel 0 */
 39 | 		outb(0x43, 0xe2);
 40 | 
 41 | 		/* If the output pin is high, then we know the countdown is done.
 42 | 		 * Break from the loop.
 43 | 		 */
 44 | 		if(inb(0x40) & 0x80){
 45 | 			break;
 46 | 		}
 47 | 	}
 48 | 
 49 | 	/* Compute the time, in seconds, that the countdown was supposed to take */
 50 | 	elapsed = 65536.0 / 1193182.0;
 51 | 
 52 | 	/* Compute MHz for the rdtsc */
 53 | 	computed_rate = (double)(__rdtsc() - start) / elapsed / 1000000.0;
 54 | 
 55 | 	/* Round to the nearest 100MHz value */
 56 | 	rounded_rate = (((uint64_t)computed_rate + 50) / 100) * 100;
 57 | 
 58 | 	printf("Calibrated rdtsc at %lu MHz, rounding to %lu MHz",
 59 | 			(uint64_t)computed_rate, rounded_rate);
 60 | 
 61 | 	/* Store the rounded rate in rdtsc_inc_freq */
 62 | 	rdtsc_inc_freq = rounded_rate;
 63 | 	return;
 64 | }
 65 | 
 66 | /* rdtsc_freq()
 67 |  *
 68 |  * Summary:
 69 |  *
 70 |  * This function returns the frequency of rdtsc in MHz. Panics if
 71 |  * rdtsc_inc_freq is not set, this will happen if rdtsc_calibrate() is not
 72 |  * used first.
 73 |  */
 74 | uint64_t
 75 | rdtsc_freq(void)
 76 | {
 77 | 	if(!rdtsc_inc_freq){
 78 | 		panic("rdtsc not calibrated, call rdtsc_calibrate() first");
 79 | 	}
 80 | 
 81 | 	return rdtsc_inc_freq;
 82 | }
 83 | 
 84 | /* rdtsc_future()
 85 |  *
 86 |  * Summary:
 87 |  *
 88 |  * This function returns the value that rdtsc for the current cpu will be
 89 |  * microseconds in the future. This is fairly cheap as it only requires an
 90 |  * imul, versus needing to do a div in rdtsc_uptime().
 91 |  *
 92 |  * Parameters:
 93 |  *
 94 |  * _In_ microseconds - Number of microseconds to add to the current rdtsc count
 95 |  *
 96 |  * Returns:
 97 |  *
 98 |  * Value of rdtsc microseconds in the future.
 99 |  */
100 | uint64_t
101 | rdtsc_future(_In_ uint64_t microseconds)
102 | {
103 | 	return __rdtsc() + (microseconds * rdtsc_freq());
104 | }
105 | 
106 | /* rdtsc_uptime()
107 |  *
108 |  * Summary:
109 |  *
110 |  * This returns the current system uptime in microseconds. This function is
111 |  * fairly expensive as it does a divide. If you are polling for a timeout
112 |  * you should use rdtsc_future() once rather than polling this function.
113 |  */
114 | uint64_t
115 | rdtsc_uptime(void)
116 | {
117 | 	return __rdtsc() / rdtsc_freq();
118 | }
119 | 
120 | /* rdtsc_sleep()
121 |  *
122 |  * Summary:
123 |  *
124 |  * This function sleeps for the specified amount of microseconds. This is a
125 |  * busy sleep.
126 |  *
127 |  * Parameters:
128 |  *
129 |  * _In_ microseconds - Number of microseconds to sleep for.
130 |  */
131 | void
132 | rdtsc_sleep(_In_ uint64_t microseconds)
133 | {
134 | 	uint64_t waitval;
135 | 
136 | 	waitval = rdtsc_future(microseconds);
137 | 	while(__rdtsc() < waitval);
138 | 
139 | 	return;
140 | }
141 | 
142 | 


--------------------------------------------------------------------------------
/srcs/time/time.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | void
 4 | rdtsc_calibrate(void);
 5 | 
 6 | uint64_t
 7 | rdtsc_freq(void);
 8 | 
 9 | uint64_t
10 | rdtsc_future(_In_ uint64_t microseconds);
11 | 
12 | uint64_t
13 | rdtsc_uptime(void);
14 | 
15 | void
16 | rdtsc_sleep(_In_ uint64_t microseconds);
17 | 
18 | 


--------------------------------------------------------------------------------
/srcs/vm/svm.asm:
--------------------------------------------------------------------------------
  1 | [bits 64]
  2 | 
  3 | section .text
  4 | 
  5 | struc vm
  6 | 	.host_vmcb: resq 1
  7 | 	.vmcb:      resq 1
  8 | 
  9 | 	.host_vmcb_pa: resq 1
 10 | 	.vmcb_pa:      resq 1
 11 | 
 12 | 	.host_xsave: resq 1
 13 | 	.xsave:      resq 1
 14 | endstruc
 15 | 
 16 | struc gprs
 17 | 	.rax: resq 1
 18 | 	.rbx: resq 1
 19 | 	.rcx: resq 1
 20 | 	.rdx: resq 1
 21 | 	.rdi: resq 1
 22 | 	.rsi: resq 1
 23 | 	.rbp: resq 1
 24 | 	.rsp: resq 1
 25 | 	.r8:  resq 1
 26 | 	.r9:  resq 1
 27 | 	.r10: resq 1
 28 | 	.r11: resq 1
 29 | 	.r12: resq 1
 30 | 	.r13: resq 1
 31 | 	.r14: resq 1
 32 | 	.r15: resq 1
 33 | 	.rip: resq 1
 34 | 	.rfl: resq 1
 35 | endstruc
 36 | 
 37 | global svm_asm_step
 38 | svm_asm_step:
 39 | 	clgi
 40 | 
 41 | 	; Save all non-volatile registers
 42 | 	push rbx
 43 | 	push rbp
 44 | 	push rsi
 45 | 	push rdi
 46 | 	push r12
 47 | 	push r13
 48 | 	push r14
 49 | 	push r15
 50 | 
 51 | 	; Save the vm pointer and regs
 52 | 	push rdi
 53 | 	push rsi
 54 | 
 55 | 	; r15 - Pointer to struct _svm_vm
 56 | 	; r14 - Pointer to gprs
 57 | 	mov r15, rdi
 58 | 	mov r14, rsi
 59 | 
 60 | 	; Save host state
 61 | 	mov edx, 0x40000000
 62 | 	mov eax, 0x00000007
 63 | 	xor ecx, ecx
 64 | 	xsetbv
 65 | 	mov rbx, [r15 + vm.host_xsave]
 66 | 	xsave [rbx]
 67 | 	mov rax, [r15 + vm.host_vmcb_pa]
 68 | 	vmsave
 69 | 
 70 | 	; Load guest xsave
 71 | 	mov edx, 0x40000000
 72 | 	mov eax, 0x00000007
 73 | 	mov rbx, [r15 + vm.xsave]
 74 | 	xrstor [rbx]
 75 | 
 76 | 	; Load guest vmsave
 77 | 	mov rax, [r15 + vm.vmcb_pa]
 78 | 	vmload
 79 | 
 80 | 	mov rbx, [r14 + gprs.rbx]
 81 | 	mov rcx, [r14 + gprs.rcx]
 82 | 	mov rdx, [r14 + gprs.rdx]
 83 | 	mov rdi, [r14 + gprs.rdi]
 84 | 	mov rsi, [r14 + gprs.rsi]
 85 | 	mov rbp, [r14 + gprs.rbp]
 86 | 	mov  r8, [r14 + gprs.r8]
 87 | 	mov  r9, [r14 + gprs.r9]
 88 | 	mov r10, [r14 + gprs.r10]
 89 | 	mov r11, [r14 + gprs.r11]
 90 | 	mov r12, [r14 + gprs.r12]
 91 | 	mov r13, [r14 + gprs.r13]
 92 | 	mov r15, [r14 + gprs.r15]
 93 | 	mov r14, [r14 + gprs.r14]
 94 | 
 95 | 	vmrun
 96 | 
 97 | 	; Restore gprs
 98 | 	mov rax, [rsp]
 99 | 
100 | 	mov [rax + gprs.rbx], rbx
101 | 	mov [rax + gprs.rcx], rcx
102 | 	mov [rax + gprs.rdx], rdx
103 | 	mov [rax + gprs.rsi], rsi
104 | 	mov [rax + gprs.rdi], rdi
105 | 	mov [rax + gprs.rbp], rbp
106 | 	mov [rax + gprs.r8],  r8
107 | 	mov [rax + gprs.r9],  r9
108 | 	mov [rax + gprs.r10], r10
109 | 	mov [rax + gprs.r11], r11
110 | 	mov [rax + gprs.r12], r12
111 | 	mov [rax + gprs.r13], r13
112 | 	mov [rax + gprs.r14], r14
113 | 	mov [rax + gprs.r15], r15
114 | 
115 | 	; Get the gprs and vm pointer
116 | 	pop r14
117 | 	pop r15
118 | 
119 | 	; Save guest state
120 | 	mov edx, 0x40000000
121 | 	mov eax, 0x00000007
122 | 	xor ecx, ecx
123 | 	xsetbv
124 | 	mov rbx, [r15 + vm.xsave]
125 | 	xsave [rbx]
126 | 	mov rax, [r15 + vm.vmcb_pa]
127 | 	vmsave
128 | 
129 | 	; Load host xsave
130 | 	mov edx, 0x40000000
131 | 	mov eax, 0x00000007
132 | 	mov rbx, [r15 + vm.host_xsave]
133 | 	xrstor [rbx]
134 | 
135 | 	; Load host vmsave
136 | 	mov rax, [r15 + vm.host_vmcb_pa]
137 | 	vmload
138 | 
139 | 	; Restore all non-volatile registers
140 | 	pop r15
141 | 	pop r14
142 | 	pop r13
143 | 	pop r12
144 | 	pop rdi
145 | 	pop rsi
146 | 	pop rbp
147 | 	pop rbx
148 | 	stgi
149 | 	ret
150 | 
151 | 


--------------------------------------------------------------------------------
/srcs/vm/svm.h:
--------------------------------------------------------------------------------
  1 | #pragma once
  2 | 
  3 | #include <vm/vm.h>
  4 | 
  5 | #pragma pack(push, 1)
  6 | struct _vmcb {
  7 | 	uint32_t CR_icpt;
  8 | 	uint32_t DR_icpt;
  9 | 	uint32_t except_icpt;
 10 | 	uint32_t icpt_set_1;
 11 | 	uint32_t icpt_set_2;
 12 | 	uint32_t reserved_1[10];
 13 | 	uint16_t pause_flt_thr;
 14 | 	uint16_t pause_flt_cnt;
 15 | 	uint64_t iopm;
 16 | 	uint64_t msrpm;
 17 | 	uint64_t tsc_offset;
 18 | 	uint64_t tlb_and_asid;
 19 | 	uint64_t vint;
 20 | 	uint64_t int_shadow;
 21 | 	uint64_t exitcode;
 22 | 	uint64_t exitinfo1;
 23 | 	uint64_t exitinfo2;
 24 | 	uint64_t exitintinfo;
 25 | 	uint64_t np_enabled;
 26 | 	uint64_t apic_bar;
 27 | 	uint64_t reserved_2;
 28 | 	uint64_t eventinj;
 29 | 	uint64_t n_cr3;
 30 | 	uint64_t lbr_virt_en;
 31 | 	uint64_t vmcb_clean;
 32 | 	uint64_t nrip;
 33 | 	uint64_t guest_inst[2];
 34 | 	uint64_t apic_backing;
 35 | 	uint64_t reserved_3;
 36 | 	uint64_t logical_table;
 37 | 	uint64_t avig_phys_tbl;
 38 | 
 39 | 	uint8_t reserved_4[0x300];
 40 | 
 41 | 	uint16_t es_sel;
 42 | 	uint16_t es_attrib;
 43 | 	uint32_t es_limit;
 44 | 	uint64_t es_base;
 45 | 
 46 | 	uint16_t cs_sel;
 47 | 	uint16_t cs_attrib;
 48 | 	uint32_t cs_limit;
 49 | 	uint64_t cs_base;
 50 | 
 51 | 	uint16_t ss_sel;
 52 | 	uint16_t ss_attrib;
 53 | 	uint32_t ss_limit;
 54 | 	uint64_t ss_base;
 55 | 
 56 | 	uint16_t ds_sel;
 57 | 	uint16_t ds_attrib;
 58 | 	uint32_t ds_limit;
 59 | 	uint64_t ds_base;
 60 | 
 61 | 	uint16_t fs_sel;
 62 | 	uint16_t fs_attrib;
 63 | 	uint32_t fs_limit;
 64 | 	uint64_t fs_base;
 65 | 
 66 | 	uint16_t gs_sel;
 67 | 	uint16_t gs_attrib;
 68 | 	uint32_t gs_limit;
 69 | 	uint64_t gs_base;
 70 | 
 71 | 	uint16_t gdtr_sel;
 72 | 	uint16_t gdtr_attrib;
 73 | 	uint32_t gdtr_limit;
 74 | 	uint64_t gdtr_base;
 75 | 
 76 | 	uint16_t ldtr_sel;
 77 | 	uint16_t ldtr_attrib;
 78 | 	uint32_t ldtr_limit;
 79 | 	uint64_t ldtr_base;
 80 | 
 81 | 	uint16_t idtr_sel;
 82 | 	uint16_t idtr_attrib;
 83 | 	uint32_t idtr_limit;
 84 | 	uint64_t idtr_base;
 85 | 
 86 | 	uint16_t tr_sel;
 87 | 	uint16_t tr_attrib;
 88 | 	uint32_t tr_limit;
 89 | 	uint64_t tr_base;
 90 | 
 91 | 	uint8_t reserved_5[0x2b];
 92 | 
 93 | 	uint8_t cpl;
 94 | 
 95 | 	uint32_t reserved_6;
 96 | 
 97 | 	uint64_t efer;
 98 | 
 99 | 	uint8_t reserved_7[0x70];
100 | 
101 | 	uint64_t cr4;
102 | 	uint64_t cr3;
103 | 	uint64_t cr0;
104 | 	uint64_t dr7;
105 | 	uint64_t dr6;
106 | 	uint64_t rfl;
107 | 	uint64_t rip;
108 | 
109 | 	uint8_t reserved_8[0x58];
110 | 
111 | 	uint64_t rsp;
112 | 
113 | 	uint8_t reserved_9[0x18];
114 | 
115 | 	uint64_t rax;
116 | 
117 | 	uint64_t star;
118 | 	uint64_t lstar;
119 | 	uint64_t cstar;
120 | 	uint64_t sfmask;
121 | 	uint64_t kern_gs_base;
122 | 
123 | 	uint64_t sysenter_cs;
124 | 	uint64_t sysenter_esp;
125 | 	uint64_t sysenter_eip;
126 | 
127 | 	uint64_t cr2;
128 | 
129 | 	uint8_t reserved_a[0x20];
130 | 
131 | 	uint64_t g_pat;
132 | 	uint64_t dbgctrl;
133 | 	uint64_t br_from;
134 | 	uint64_t br_to;
135 | 	uint64_t last_except_from;
136 | 	uint64_t last_except_to;
137 | };
138 | 
139 | struct _svm_legacy_snapshot {
140 | 	uint64_t rcx;
141 | 	uint64_t rdx;
142 | 	uint64_t rbx;
143 | 	uint64_t rbp;
144 | 	uint64_t rsi;
145 | 	uint64_t rdi;
146 | 	uint64_t r8;
147 | 	uint64_t r9;
148 | 	uint64_t r10;
149 | 	uint64_t r11;
150 | 	uint64_t r12;
151 | 	uint64_t r13;
152 | 	uint64_t r14;
153 | 	uint64_t r15;
154 | 
155 | 	uint64_t cr8;
156 | 	uint64_t xcr0;
157 | 
158 | 	uint64_t dr0;
159 | 	uint64_t dr1;
160 | 	uint64_t dr2;
161 | 	uint64_t dr3;
162 | 
163 | 	uint64_t pmem_size;
164 | 
165 | 	uint8_t padding_1[0xF58];
166 | 
167 | 	uint8_t xsave[0x1000];
168 | 	uint8_t vmcb[0x1000];
169 | 	uint8_t physical_memory[1];
170 | };
171 | 
172 | struct _svm_vm {
173 | 	struct _vmcb *host_vmcb;
174 | 	struct _vmcb *vmcb;
175 | 
176 | 	uintptr_t host_vmcb_pa;
177 | 	uintptr_t vmcb_pa;
178 | 
179 | 	void *host_xsave;
180 | 	void *xsave;
181 | 
182 | 	uintptr_t iopm;
183 | 	uintptr_t msrpm;
184 | };
185 | #pragma pack(pop)
186 | 
187 | rstate_t
188 | svm_init(void);
189 | 
190 | rstate_t
191 | svm_create(struct _vm *vm);
192 | 
193 | void
194 | svm_enter_regsegs(struct _vm *vm);
195 | 
196 | void
197 | svm_exit_regsegs(struct _vm *vm);
198 | 
199 | rstate_t
200 | svm_step(struct _vm *vm);
201 | 
202 | void
203 | svm_dump_state(struct _vm *vm);
204 | 
205 | rstate_t
206 | svm_map_phys(struct _vm *vm, uint64_t address,
207 | 		int readable, int writable, int executable,
208 | 		uint64_t backing_page);
209 | 
210 | rstate_t
211 | svm_guest_phys_to_host_phys(
212 | 		struct _vm *vm,
213 | 		uint64_t    guest_paddr,
214 | 		int         is_read,
215 | 		int         is_write,
216 | 		int         is_exec,
217 | 		uint64_t   *host_paddr);
218 | 
219 | rstate_t
220 | svm_guest_virt_to_host_phys(
221 | 		struct _vm *vm,
222 | 		uint64_t    guest_vaddr,
223 | 		int         is_read,
224 | 		int         is_write,
225 | 		int         is_exec,
226 | 		uint64_t   *host_paddr);
227 | 
228 | /* Assembly implementation of the SVM step */
229 | void
230 | svm_asm_step(struct _svm_vm *svm_vm, struct _x86_regs *regs);
231 | 
232 | 


--------------------------------------------------------------------------------
/srcs/vm/vm.c:
--------------------------------------------------------------------------------
  1 | #include <grilled_cheese.h>
  2 | #include <generic/stdlib.h>
  3 | #include <mm/mm.h>
  4 | #include <vm/vm.h>
  5 | #include <vm/svm.h>
  6 | #include <net/net.h>
  7 | #include <disp/disp.h>
  8 | 
  9 | enum _elf_bitness {
 10 | 	ELF_32BIT = 1,
 11 | 	ELF_64BIT = 2
 12 | };
 13 | 
 14 | enum _elf_endianness {
 15 | 	ELF_LITTLE_ENDIAN = 1,
 16 | 	ELF_BIG_ENDIAN = 2
 17 | };
 18 | 
 19 | #define ELF_READ_FIELD(name) \
 20 | 	((elf32->endianness == ELF_LITTLE_ENDIAN) ? elf32->name : byteswap(elf32->name))
 21 | 
 22 | #pragma pack(push, 1)
 23 | struct _elf_header32 {
 24 | 	uint8_t  sig[4];
 25 | 	uint8_t  bitness;
 26 | 	uint8_t  endianness;
 27 | 	uint8_t  version;
 28 | 	uint8_t  abi;
 29 | 	uint8_t  abi_version;
 30 | 	uint8_t  padding[7];
 31 | 	uint16_t type;
 32 | };
 33 | 
 34 | struct _elf_header64 {
 35 | 	uint8_t  sig[4];
 36 | 	uint8_t  bitness;
 37 | 	uint8_t  endianness;
 38 | 	uint8_t  version;
 39 | 	uint8_t  abi;
 40 | 	uint8_t  abi_version;
 41 | 	uint8_t  padding[7];
 42 | 	uint16_t type;
 43 | };
 44 | #pragma pack(pop)
 45 | 
 46 | rstate_t
 47 | vm_create(const char *core_fn, struct _vm **out_vm)
 48 | {
 49 | 	uint8_t  *core_file;
 50 | 	uint64_t  core_file_len;
 51 | 
 52 | 	struct _vm *vm;
 53 | 
 54 | 	struct _elf_header32 *elf32 = NULL;
 55 | 
 56 | 	RSTATE_LOCALS;
 57 | 
 58 | 	/* Allocate room for the VM structure */
 59 | 	rstate = phalloc(sizeof(struct _vm), (void**)&vm);
 60 | 	RSCHECK_NESTED("Failed to allocate memory for VM structure");
 61 | 
 62 | 	/* Map in the core file */
 63 | 	rstate = net_map_remote(current_cpu->net_queue, core_fn, 0,
 64 | 			(void**)&core_file, &core_file_len);
 65 | 	RSCHECK_NESTED("Failed to map remote core file");
 66 | 
 67 | 	/* Make sure we have room for the smallest possible header */
 68 | 	RSCHECK(core_file_len >= sizeof(struct _elf_header32),
 69 | 			"Core file too small for 32-bit ELF header");
 70 | 
 71 | 	/* Cast the core file to an ELF header */
 72 | 	elf32 = (struct _elf_header32*)core_file;
 73 | 
 74 | 	/* Validate the ELF signature */
 75 | 	RSCHECK(!memcmp(elf32->sig, "\x7f\x45\x4c\x46", 4),
 76 | 			"Core file did not have ELF signature");
 77 | 
 78 | 	/* Make sure the bitness of the ELF is 32-bit or 64-bit */
 79 | 	RSCHECK(elf32->bitness == ELF_32BIT || elf32->bitness == ELF_64BIT,
 80 | 			"Core file bitness was not 32bit or 64bit");
 81 | 
 82 | 	/* If it's a 64-bit file, it has a larger ELF header, thus do another
 83 | 	 * bounds check for the new size.
 84 | 	 */
 85 | 	if(elf32->bitness == ELF_64BIT){
 86 | 		RSCHECK(core_file_len >= sizeof(struct _elf_header64),
 87 | 				"Core file too small for 64-bit ELF header");
 88 | 	}
 89 | 
 90 | 	/* Make sure the endianness of the ELF is little or big */
 91 | 	RSCHECK(elf32->endianness == ELF_LITTLE_ENDIAN ||
 92 | 			elf32->endianness == ELF_BIG_ENDIAN,
 93 | 			"Core file endianness was neither big or little");
 94 | 
 95 | 	/* Check the ELF version to be 1 */
 96 | 	RSCHECK(elf32->version == 1, "Core file version was not 1");
 97 | 
 98 | 	printf("Core file is %s-bit %s-endian %.4lx",
 99 | 			(elf32->bitness == ELF_64BIT) ? "64" : "32",
100 | 			(elf32->endianness == ELF_LITTLE_ENDIAN) ? "little" : "big",
101 | 			byteswap(elf32->type));
102 | 
103 | 	*out_vm = vm;
104 | 
105 | 	rstate_ret = RSTATE_SUCCESS;
106 | cleanup:
107 | 	RSTATE_RETURN;
108 | }
109 | 
110 | /* vm_read_phys()
111 |  *
112 |  * Summary:
113 |  *
114 |  * Read memory from the guest vm at physical address guest_paddr into the
115 |  * caller allocated buffer specified by buf and len.
116 |  */
117 | rstate_t
118 | vm_read_phys(
119 | 		struct _vm *vm,
120 | 		uint64_t    guest_paddr,
121 | 		void       *buf,
122 | 		uint64_t    len)
123 | {
124 | 	uint8_t  *ubuf = buf, *vaddr, *cur_map = NULL;
125 | 	uint64_t  paddr = 0;
126 | 
127 | 	RSTATE_LOCALS;
128 | 
129 | 	while(len){
130 | 		if(!(paddr & 0xfff)){
131 | 			rstate = vm->guest_phys_to_host_phys(vm, guest_paddr,
132 | 					1, 0, 0, &paddr);
133 | 			RSCHECK_NESTED("Could not get backing for guest address");
134 | 
135 | 			if(cur_map){
136 | 				mm_release_phys_mapping(cur_map);
137 | 			}
138 | 
139 | 			vaddr = cur_map = mm_get_phys_mapping(paddr);
140 | 		}
141 | 
142 | 		*ubuf = *vaddr;
143 | 
144 | 		ubuf++;
145 | 		paddr++;
146 | 		vaddr++;
147 | 		guest_paddr++;
148 | 		len--;
149 | 	}
150 | 
151 | 	rstate_ret = RSTATE_SUCCESS;
152 | cleanup:
153 | 	if(cur_map){
154 | 		mm_release_phys_mapping(cur_map);
155 | 	}
156 | 
157 | 	RSTATE_RETURN;
158 | }
159 | 
160 | /* vm_write_phys()
161 |  *
162 |  * Summary:
163 |  *
164 |  * Write the vm's physical memory at guest_paddr with the contents of buf
165 |  * for len bytes.
166 |  */
167 | rstate_t
168 | vm_write_phys(
169 | 		struct _vm *vm,
170 | 		uint64_t    guest_paddr,
171 | 		const void *buf,
172 | 		uint64_t    len)
173 | {
174 | 	uint8_t  *vaddr, *cur_map = NULL;
175 | 	uint64_t  paddr = 0;
176 | 	const uint8_t *ubuf = buf;
177 | 
178 | 	RSTATE_LOCALS;
179 | 
180 | 	while(len){
181 | 		if(!(paddr & 0xfff)){
182 | 			rstate = vm->guest_phys_to_host_phys(vm, guest_paddr,
183 | 					0, 1, 0, &paddr);
184 | 			RSCHECK_NESTED("Could not get backing for guest address");
185 | 
186 | 			if(cur_map){
187 | 				mm_release_phys_mapping(cur_map);
188 | 			}
189 | 
190 | 			vaddr = cur_map = mm_get_phys_mapping(paddr);
191 | 		}
192 | 
193 | 		*vaddr = *ubuf;
194 | 
195 | 		ubuf++;
196 | 		paddr++;
197 | 		vaddr++;
198 | 		guest_paddr++;
199 | 		len--;
200 | 	}
201 | 
202 | 	rstate_ret = RSTATE_SUCCESS;
203 | cleanup:
204 | 	if(cur_map){
205 | 		mm_release_phys_mapping(cur_map);
206 | 	}
207 | 
208 | 	RSTATE_RETURN;
209 | }
210 | 
211 | rstate_t
212 | vm_read_virt(
213 | 		struct _vm *vm,
214 | 		uint64_t    guest_vaddr,
215 | 		void       *buf,
216 | 		uint64_t    len)
217 | {
218 | 	uint8_t *ubuf = buf, *vaddr, *cur_map = NULL;
219 | 	uint64_t paddr = 0;
220 | 
221 | 	RSTATE_LOCALS;
222 | 
223 | 	while(len){
224 | 		if(!(paddr & 0xfff)){
225 | 			rstate = vm->guest_virt_to_host_phys(vm, guest_vaddr,
226 | 					1, 0, 0, &paddr);
227 | 			RSCHECK_NESTED("Could not get backing for guest address");
228 | 
229 | 			if(cur_map){
230 | 				mm_release_phys_mapping(cur_map);
231 | 			}
232 | 
233 | 			vaddr = cur_map = mm_get_phys_mapping(paddr);
234 | 		}
235 | 
236 | 		*ubuf = *vaddr;
237 | 
238 | 		ubuf++;
239 | 		paddr++;
240 | 		vaddr++;
241 | 		guest_vaddr++;
242 | 		len--;
243 | 	}
244 | 
245 | 	rstate_ret = RSTATE_SUCCESS;
246 | cleanup:
247 | 	if(cur_map){
248 | 		mm_release_phys_mapping(cur_map);
249 | 	}
250 | 
251 | 	RSTATE_RETURN;
252 | }
253 | 
254 | rstate_t
255 | vm_write_virt(
256 | 		struct _vm *vm,
257 | 		uint64_t    guest_vaddr,
258 | 		const void *buf,
259 | 		uint64_t    len)
260 | {
261 | 	uint8_t *vaddr, *cur_map = NULL;
262 | 	uint64_t paddr = 0;
263 | 	const uint8_t *ubuf = buf;
264 | 
265 | 	RSTATE_LOCALS;
266 | 
267 | 	while(len){
268 | 		if(!(paddr & 0xfff)){
269 | 			rstate = vm->guest_virt_to_host_phys(vm, guest_vaddr,
270 | 					0, 1, 0, &paddr);
271 | 			RSCHECK_NESTED("Could not get backing for guest address");
272 | 
273 | 			if(cur_map){
274 | 				mm_release_phys_mapping(cur_map);
275 | 			}
276 | 
277 | 			vaddr = cur_map = mm_get_phys_mapping(paddr);
278 | 		}
279 | 
280 | 		*vaddr = *ubuf;
281 | 
282 | 		ubuf++;
283 | 		paddr++;
284 | 		vaddr++;
285 | 		guest_vaddr++;
286 | 		len--;
287 | 	}
288 | 
289 | 	rstate_ret = RSTATE_SUCCESS;
290 | cleanup:
291 | 	if(cur_map){
292 | 		mm_release_phys_mapping(cur_map);
293 | 	}
294 | 
295 | 	RSTATE_RETURN;
296 | }
297 | 
298 | 


--------------------------------------------------------------------------------
/srcs/vm/vm.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | struct _vm;
 4 | 
 5 | enum _vm_type {
 6 | 	GUEST_X86
 7 | };
 8 | 
 9 | enum _vm_subtype {
10 | 	X86_USER,
11 | 	X86_SVM,
12 | 	X86_VTX
13 | };
14 | 
15 | #include <vm/vm_x86.h>
16 | #include <vm/x86_user.h>
17 | #include <fuzzers/helpers.h>
18 | 
19 | struct _vm {
20 | 	enum _vm_type    type;
21 | 	enum _vm_subtype subtype;
22 | 
23 | 	/* Register state for each arch */
24 | 	union {
25 | 		struct _x86_regs x86_regs;
26 | 	} regs;
27 | 
28 | 	union {
29 | 		/* State for SVM based x86 VMs */
30 | 		struct _svm_vm *svm_state;
31 | 	} state;
32 | 
33 | 	struct _modlist *modlist;
34 | 	uint64_t modlist_ents;
35 | 
36 | 	rstate_t (*step)(struct _vm *vm);
37 | 
38 | 	rstate_t (*map_phys)(struct _vm *vm, uint64_t address,
39 | 			int readable, int writable, int executable,
40 | 			uint64_t backing_page);
41 | 
42 | 	rstate_t (*npf_handler)(struct _vm *vm, uint64_t address,
43 | 			int read_access, int write_access, int exec_access,
44 | 			int *handled);
45 | 
46 | 	rstate_t (*guest_phys_to_host_phys)(
47 | 		struct _vm *vm,
48 | 		uint64_t    guest_paddr,
49 | 		int         is_read,
50 | 		int         is_write,
51 | 		int         is_exec,
52 | 		uint64_t   *host_paddr);
53 | 
54 | 	rstate_t (*guest_virt_to_host_phys)(
55 | 		struct _vm *vm,
56 | 		uint64_t    guest_vaddr,
57 | 		int         is_read,
58 | 		int         is_write,
59 | 		int         is_exec,
60 | 		uint64_t   *host_paddr);
61 | 
62 | 	void (*dump_state)(struct _vm *vm);
63 | };
64 | 
65 | rstate_t
66 | vm_create(const char *core_fn, struct _vm **out_vm);
67 | 
68 | rstate_t
69 | vm_read_phys(
70 | 		struct _vm *vm,
71 | 		uint64_t    guest_paddr,
72 | 		void       *buf,
73 | 		uint64_t    len);
74 | 
75 | rstate_t
76 | vm_write_phys(
77 | 		struct _vm *vm,
78 | 		uint64_t    guest_paddr,
79 | 		const void *buf,
80 | 		uint64_t    len);
81 | 
82 | rstate_t
83 | vm_read_virt(
84 | 		struct _vm *vm,
85 | 		uint64_t    guest_vaddr,
86 | 		void       *buf,
87 | 		uint64_t    len);
88 | 
89 | rstate_t
90 | vm_write_virt(
91 | 		struct _vm *vm,
92 | 		uint64_t    guest_vaddr,
93 | 		const void *buf,
94 | 		uint64_t    len);
95 | 
96 | 


--------------------------------------------------------------------------------
/srcs/vm/vm_x86.c:
--------------------------------------------------------------------------------
  1 | #include <grilled_cheese.h>
  2 | #include <mm/mm.h>
  3 | #include <generic/stdlib.h>
  4 | #include <vm/vm.h>
  5 | #include <vm/svm.h>
  6 | #include <disp/disp.h>
  7 | 
  8 | /* vm_x86_create()
  9 |  *
 10 |  * Summary:
 11 |  *
 12 |  * Create an x86 VM that is initialized to a post-BIOS boot state. RIP
 13 |  * points to 0x7c00 and the VM is in real mode.
 14 |  */
 15 | rstate_t
 16 | vm_x86_create(_Outptr_ struct _vm **out_vm, _In_ enum _vm_subtype type)
 17 | {
 18 | 	struct _vm *vm;
 19 | 
 20 | 	RSTATE_LOCALS;
 21 | 
 22 | 	rstate = phalloc(sizeof(struct _vm), (void**)&vm);
 23 | 	RSCHECK_NESTED("Failed to allocate room for VM");
 24 | 
 25 | 	/* Set that we're an X86 VM */
 26 | 	vm->type    = GUEST_X86;
 27 | 	vm->subtype = type;
 28 | 
 29 | 	/* Initialize segment state */
 30 | 	vm->regs.x86_regs.es_sel    = 0;
 31 | 	vm->regs.x86_regs.es_attrib = 0x93;
 32 | 	vm->regs.x86_regs.es_base   = 0;
 33 | 	vm->regs.x86_regs.es_limit  = 0xffff;
 34 | 
 35 | 	vm->regs.x86_regs.cs_sel    = 0;
 36 | 	vm->regs.x86_regs.cs_attrib = 0x93;
 37 | 	vm->regs.x86_regs.cs_base   = 0;
 38 | 	vm->regs.x86_regs.cs_limit  = 0xffff;
 39 | 
 40 | 	vm->regs.x86_regs.ss_sel    = 0;
 41 | 	vm->regs.x86_regs.ss_attrib = 0x93;
 42 | 	vm->regs.x86_regs.ss_base   = 0;
 43 | 	vm->regs.x86_regs.ss_limit  = 0xffff;
 44 | 
 45 | 	vm->regs.x86_regs.ds_sel    = 0;
 46 | 	vm->regs.x86_regs.ds_attrib = 0x93;
 47 | 	vm->regs.x86_regs.ds_base   = 0;
 48 | 	vm->regs.x86_regs.ds_limit  = 0xffff;
 49 | 
 50 | 	vm->regs.x86_regs.fs_sel    = 0;
 51 | 	vm->regs.x86_regs.fs_attrib = 0x93;
 52 | 	vm->regs.x86_regs.fs_base   = 0;
 53 | 	vm->regs.x86_regs.fs_limit  = 0xffff;
 54 | 
 55 | 	vm->regs.x86_regs.gs_sel    = 0;
 56 | 	vm->regs.x86_regs.gs_attrib = 0x93;
 57 | 	vm->regs.x86_regs.gs_base   = 0;
 58 | 	vm->regs.x86_regs.gs_limit  = 0xffff;
 59 | 
 60 | 	vm->regs.x86_regs.gdtr_sel    = 0;
 61 | 	vm->regs.x86_regs.gdtr_attrib = 0x82;
 62 | 	vm->regs.x86_regs.gdtr_base   = 0;
 63 | 	vm->regs.x86_regs.gdtr_limit  = 0xffff;
 64 | 
 65 | 	vm->regs.x86_regs.ldtr_sel    = 0;
 66 | 	vm->regs.x86_regs.ldtr_attrib = 0x82;
 67 | 	vm->regs.x86_regs.ldtr_base   = 0;
 68 | 	vm->regs.x86_regs.ldtr_limit  = 0xffff;
 69 | 
 70 | 	vm->regs.x86_regs.idtr_sel    = 0;
 71 | 	vm->regs.x86_regs.idtr_attrib = 0x82;
 72 | 	vm->regs.x86_regs.idtr_base   = 0;
 73 | 	vm->regs.x86_regs.idtr_limit  = 0xffff;
 74 | 	
 75 | 	vm->regs.x86_regs.tr_sel    = 0;
 76 | 	vm->regs.x86_regs.tr_attrib = 0x82;
 77 | 	vm->regs.x86_regs.tr_base   = 0;
 78 | 	vm->regs.x86_regs.tr_limit  = 0xffff;
 79 | 
 80 | 	/* Initialize register state */
 81 | 	vm->regs.x86_regs.rfl.rfl = 2;
 82 | 	vm->regs.x86_regs.rip.rip = 0x7c00;
 83 | 	vm->regs.x86_regs.rsp.rsp = 0x7000;
 84 | 	vm->regs.x86_regs.rdx.rdx = 0x80;
 85 | 
 86 | 	/* Initialize the architecture specific VM state */
 87 | 	if(vm->subtype == X86_VTX){
 88 | 		RSCHECK(1 == 0, "Intel CPUs not currently supported");
 89 | 	} else if(vm->subtype == X86_SVM){
 90 | 		rstate = svm_create(vm);
 91 | 		RSCHECK_NESTED("Failed to create SVM state for VM");
 92 | 
 93 | 		vm->step       = svm_step;
 94 | 		vm->map_phys   = svm_map_phys;
 95 | 		vm->dump_state = svm_dump_state;
 96 | 		vm->guest_phys_to_host_phys = svm_guest_phys_to_host_phys;
 97 | 		vm->guest_virt_to_host_phys = svm_guest_virt_to_host_phys;
 98 | 	} else if(vm->subtype == X86_USER){
 99 | 		rstate = x86_user_create(vm);
100 | 		RSCHECK_NESTED("Failed to create x86_user state for VM");
101 | 	} else {
102 | 		RSCHECK(1 == 0, "Unsupported VM type");
103 | 	}
104 | 
105 | 	*out_vm = vm;
106 | 	rstate_ret = RSTATE_SUCCESS;
107 | cleanup:
108 | 	RSTATE_RETURN;
109 | }
110 | 
111 | /* vm_x86_dump_state()
112 |  *
113 |  * Summary:
114 |  *
115 |  * Dump the entire generic x86 state to the screen.
116 |  */
117 | void
118 | vm_x86_dump_state(struct _vm *vm)
119 | {
120 | 	uint64_t stack = 0;
121 | 	struct _x86_regs *r = &vm->regs.x86_regs;
122 | 
123 | 	vm_read_virt(vm, r->rsp.rsp, &stack, 8);
124 | 
125 | 	printf(
126 | 			"rax %.16lx rbx %.16lx rcx %.16lx rdx %.16lx\n"
127 | 			"rsi %.16lx rdi %.16lx rbp %.16lx rsp %.16lx\n"
128 | 			"r8  %.16lx r9  %.16lx r10 %.16lx r11 %.16lx\n"
129 | 			"r12 %.16lx r13 %.16lx r14 %.16lx r15 %.16lx\n"
130 | 			"rfl %.16lx\n"
131 | 			"rsp %.16lx (%.16lx)\n"
132 | 			"rip %.4x:%.16lx (%.16lx)\n",
133 | 			r->rax.rax, r->rbx.rbx, r->rcx.rcx, r->rdx.rdx,
134 | 			r->rsi.rsi, r->rdi.rdi, r->rbp.rbp, r->rsp.rsp,
135 | 			r->r8.r8, r->r9.r9, r->r10.r10, r->r11.r11,
136 | 			r->r12.r12, r->r13.r13, r->r14.r14, r->r15.r15,
137 | 			r->rfl.rfl,
138 | 			r->rsp.rsp, stack,
139 | 			r->cs_sel, r->rip.rip, r->cs_base + r->rip.rip);
140 | 
141 | 	printf(
142 | 			"es  %.4x attrib %.4x base %.16lx limit %.8x\n"
143 | 			"ds  %.4x attrib %.4x base %.16lx limit %.8x\n"
144 | 			"fs  %.4x attrib %.4x base %.16lx limit %.8x\n"
145 | 			"gs  %.4x attrib %.4x base %.16lx limit %.8x\n"
146 | 			"ss  %.4x attrib %.4x base %.16lx limit %.8x\n"
147 | 			"cs  %.4x attrib %.4x base %.16lx limit %.8x\n"
148 | 			"idt %.4x attrib %.4x base %.16lx limit %.8x\n"
149 | 			"gdt %.4x attrib %.4x base %.16lx limit %.8x\n"
150 | 			"ldt %.4x attrib %.4x base %.16lx limit %.8x\n"
151 | 			"tr  %.4x attrib %.4x base %.16lx limit %.8x",
152 | 		r->es_sel, r->es_attrib, r->es_base, r->es_limit,
153 | 		r->ds_sel, r->ds_attrib, r->ds_base, r->ds_limit,
154 | 		r->fs_sel, r->fs_attrib, r->fs_base, r->fs_limit,
155 | 		r->gs_sel, r->gs_attrib, r->gs_base, r->gs_limit,
156 | 		r->ss_sel, r->ss_attrib, r->ss_base, r->ss_limit,
157 | 		r->cs_sel, r->cs_attrib, r->cs_base, r->cs_limit,
158 | 		r->idtr_sel, r->idtr_attrib, r->idtr_base, r->idtr_limit,
159 | 		r->gdtr_sel, r->gdtr_attrib, r->gdtr_base, r->gdtr_limit,
160 | 		r->ldtr_sel, r->ldtr_attrib, r->ldtr_base, r->ldtr_limit,
161 | 		r->tr_sel, r->tr_attrib, r->tr_base, r->tr_limit);
162 | 
163 | 	return;
164 | }
165 | 
166 | 


--------------------------------------------------------------------------------
/srcs/vm/vm_x86.h:
--------------------------------------------------------------------------------
  1 | #pragma once
  2 | 
  3 | #pragma pack(push, 1)
  4 | struct _x86_regs {
  5 | 	/* Do not move these GPR definitions, as we use hardcoded offsets in
  6 | 	 * assembly.
  7 | 	 */
  8 | 	union {
  9 | 		struct {
 10 | 			uint8_t al;
 11 | 			uint8_t ah;
 12 | 		} b;
 13 | 		uint16_t ax;
 14 | 		uint32_t eax;
 15 | 		uint64_t rax;
 16 | 	} rax;
 17 | 	union {
 18 | 		struct {
 19 | 			uint8_t bl;
 20 | 			uint8_t bh;
 21 | 		} b;
 22 | 		uint16_t bx;
 23 | 		uint32_t ebx;
 24 | 		uint64_t rbx;
 25 | 	} rbx;
 26 | 	union {
 27 | 		struct {
 28 | 			uint8_t cl;
 29 | 			uint8_t ch;
 30 | 		} b;
 31 | 		uint16_t cx;
 32 | 		uint32_t ecx;
 33 | 		uint64_t rcx;
 34 | 	} rcx;
 35 | 	union {
 36 | 		struct {
 37 | 			uint8_t dl;
 38 | 			uint8_t dh;
 39 | 		} b;
 40 | 		uint16_t dx;
 41 | 		uint32_t edx;
 42 | 		uint64_t rdx;
 43 | 	} rdx;
 44 | 	union {
 45 | 		uint8_t  dil;
 46 | 		uint16_t di;
 47 | 		uint32_t edi;
 48 | 		uint64_t rdi;
 49 | 	} rdi;
 50 | 	union {
 51 | 		uint8_t  sil;
 52 | 		uint16_t si;
 53 | 		uint32_t esi;
 54 | 		uint64_t rsi;
 55 | 	} rsi;
 56 | 	union {
 57 | 		uint8_t  bpl;
 58 | 		uint16_t bp;
 59 | 		uint32_t ebp;
 60 | 		uint64_t rbp;
 61 | 	} rbp;
 62 | 	union {
 63 | 		uint8_t  spl;
 64 | 		uint16_t sp;
 65 | 		uint32_t esp;
 66 | 		uint64_t rsp;
 67 | 	} rsp;
 68 | 	union {
 69 | 		uint8_t  r8b;
 70 | 		uint16_t r8w;
 71 | 		uint32_t r8d;
 72 | 		uint64_t r8;
 73 | 	} r8;
 74 | 	union {
 75 | 		uint8_t  r9b;
 76 | 		uint16_t r9w;
 77 | 		uint32_t r9d;
 78 | 		uint64_t r9;
 79 | 	} r9;
 80 | 	union {
 81 | 		uint8_t  r10b;
 82 | 		uint16_t r10w;
 83 | 		uint32_t r10d;
 84 | 		uint64_t r10;
 85 | 	} r10;
 86 | 	union {
 87 | 		uint8_t  r11b;
 88 | 		uint16_t r11w;
 89 | 		uint32_t r11d;
 90 | 		uint64_t r11;
 91 | 	} r11;
 92 | 	union {
 93 | 		uint8_t  r12b;
 94 | 		uint16_t r12w;
 95 | 		uint32_t r12d;
 96 | 		uint64_t r12;
 97 | 	} r12;
 98 | 	union {
 99 | 		uint8_t  r13b;
100 | 		uint16_t r13w;
101 | 		uint32_t r13d;
102 | 		uint64_t r13;
103 | 	} r13;
104 | 	union {
105 | 		uint8_t  r14b;
106 | 		uint16_t r14w;
107 | 		uint32_t r14d;
108 | 		uint64_t r14;
109 | 	} r14;
110 | 	union {
111 | 		uint8_t  r15b;
112 | 		uint16_t r15w;
113 | 		uint32_t r15d;
114 | 		uint64_t r15;
115 | 	} r15;
116 | 
117 | 	union {
118 | 		uint16_t ip;
119 | 		uint32_t eip;
120 | 		uint64_t rip;
121 | 	} rip;
122 | 
123 | 	union {
124 | 		struct {
125 | 			uint64_t cf:1;
126 | 			uint64_t resvd1:1;
127 | 			uint64_t pf:1;
128 | 			uint64_t resvd2:1;
129 | 			uint64_t af:1;
130 | 			uint64_t resvd3:1;
131 | 			uint64_t zf:1;
132 | 			uint64_t sf:1;
133 | 			uint64_t tf:1;
134 | 			uint64_t intf:1;
135 | 			uint64_t df:1;
136 | 			uint64_t of:1;
137 | 			uint64_t iopl:2;
138 | 			uint64_t nt:1;
139 | 			uint64_t resvd4:1;
140 | 			uint64_t rf:1;
141 | 			uint64_t vm:1;
142 | 			uint64_t ac:1;
143 | 			uint64_t vif:1;
144 | 			uint64_t vip:1;
145 | 			uint64_t id:1;
146 | 		} u;
147 | 
148 | 		uint64_t rfl;
149 | 	} rfl;
150 | 
151 | 	uint16_t es_sel;
152 | 	uint16_t es_attrib;
153 | 	uint32_t es_limit;
154 | 	uint64_t es_base;
155 | 
156 | 	uint16_t cs_sel;
157 | 	uint16_t cs_attrib;
158 | 	uint32_t cs_limit;
159 | 	uint64_t cs_base;
160 | 
161 | 	uint16_t ss_sel;
162 | 	uint16_t ss_attrib;
163 | 	uint32_t ss_limit;
164 | 	uint64_t ss_base;
165 | 
166 | 	uint16_t ds_sel;
167 | 	uint16_t ds_attrib;
168 | 	uint32_t ds_limit;
169 | 	uint64_t ds_base;
170 | 
171 | 	uint16_t fs_sel;
172 | 	uint16_t fs_attrib;
173 | 	uint32_t fs_limit;
174 | 	uint64_t fs_base;
175 | 
176 | 	uint16_t gs_sel;
177 | 	uint16_t gs_attrib;
178 | 	uint32_t gs_limit;
179 | 	uint64_t gs_base;
180 | 
181 | 	uint16_t gdtr_sel;
182 | 	uint16_t gdtr_attrib;
183 | 	uint32_t gdtr_limit;
184 | 	uint64_t gdtr_base;
185 | 
186 | 	uint16_t ldtr_sel;
187 | 	uint16_t ldtr_attrib;
188 | 	uint32_t ldtr_limit;
189 | 	uint64_t ldtr_base;
190 | 
191 | 	uint16_t idtr_sel;
192 | 	uint16_t idtr_attrib;
193 | 	uint32_t idtr_limit;
194 | 	uint64_t idtr_base;
195 | 
196 | 	uint16_t tr_sel;
197 | 	uint16_t tr_attrib;
198 | 	uint32_t tr_limit;
199 | 	uint64_t tr_base;
200 | };
201 | #pragma pack(pop)
202 | 
203 | rstate_t
204 | vm_x86_create(_Outptr_ struct _vm **out_vm, _In_ enum _vm_subtype type);
205 | 
206 | void
207 | vm_x86_dump_state(struct _vm *vm);
208 | 
209 | 


--------------------------------------------------------------------------------
/srcs/vm/x86_passthrough.c:
--------------------------------------------------------------------------------
  1 | #include <grilled_cheese.h>
  2 | #include <vm/vm.h>
  3 | #include <vm/svm.h>
  4 | #include <disp/disp.h>
  5 | #include <time/time.h>
  6 | #include <mm/mm.h>
  7 | #include <generic/stdlib.h>
  8 | #include <disk/ide.h>
  9 | 
 10 | static uint64_t VM_MEMORY_SIZE = (4UL * 1024 * 1024 * 1024);
 11 | 
 12 | rstate_t
 13 | x86_passthrough_npf_handler(struct _vm *vm, uint64_t address,
 14 | 		int read_access, int write_access, int exec_access,
 15 | 		int *handled)
 16 | {
 17 | 	uintptr_t page;
 18 | 
 19 | 	RSTATE_LOCALS;
 20 | 
 21 | 	if(address >= VM_MEMORY_SIZE){
 22 | 		*handled = 0;
 23 | 		return RSTATE_SUCCESS;
 24 | 	}
 25 | 
 26 | 	rstate = alloc_phys_4k(&page);
 27 | 	RSCHECK_NESTED("Failed to allocate 4k page");
 28 | 
 29 | 	rstate = vm->map_phys(vm, address & ~0xfff, 1, 1, 1, page);
 30 | 	RSCHECK_NESTED("Failed to map in physical memory");
 31 | 
 32 | 	*handled = 1;
 33 | 	rstate_ret = RSTATE_SUCCESS;
 34 | cleanup:
 35 | 	RSTATE_RETURN;
 36 | }
 37 | 
 38 | rstate_t
 39 | iommu_init(struct _vm *vm)
 40 | {
 41 | 	int ii;
 42 | 
 43 | 	uint8_t *dev_table;
 44 | 
 45 | 	uint64_t  iommu_addr, key;
 46 | 	uintptr_t device_table;
 47 | 	uint64_t  device_table_entry = (1UL << 62) | (1UL << 61) | \
 48 | 								   (4 << 9) | (1 << 1) | (1 << 0);
 49 | 
 50 | 	RSTATE_LOCALS;
 51 | 
 52 | 	device_table_entry |= vm->state.svm_state->vmcb->n_cr3;
 53 | 
 54 | 	outd(0xcf8, (0x00 << 16) | (0x00 << 11) | (0x02 << 8) | (1 << 31) | 0x44);
 55 | 	iommu_addr = ind(0xcfc) & ~0x3FFF;
 56 | 	outd(0xcf8, (0x00 << 16) | (0x00 << 11) | (0x02 << 8) | (1 << 31) | 0x48);
 57 | 	iommu_addr |= (uint64_t)ind(0xcfc) << 32;
 58 | 
 59 | 	rstate = alloc_phys(2 * 1024 * 1024, &device_table);
 60 | 	RSCHECK_NESTED("Failed to map in device table");
 61 | 
 62 | 	rstate = mm_reserve_random(readcr3(), 2 * 1024 * 1024,
 63 | 			(void*)&dev_table, 0, &key);
 64 | 	RSCHECK_NESTED("Failed to reserve room to map in IOMMU device table");
 65 | 
 66 | 	rstate = mm_map_contig(readcr3(), (uintptr_t)dev_table,
 67 | 			device_table | 3 | (1UL << 63), 2 * 1024 * 1024, key);
 68 | 	RSCHECK_NESTED("Failed to map in IOMMU device table");
 69 | 
 70 | 	memset(dev_table, 0, 2 * 1024 * 1024);
 71 | 
 72 | 	for(ii = 0; ii < (2 * 1024 * 1024); ii += 32){
 73 | 		*(volatile uint64_t*)(dev_table + ii) = device_table_entry;
 74 | 	}
 75 | 
 76 | 	{
 77 | 		uint8_t *tmp;
 78 | 
 79 | 		tmp = mm_get_phys_mapping(iommu_addr);
 80 | 		*(volatile uint64_t*)(tmp + 0x00)  = device_table | 0x1ff;
 81 | 		*(volatile uint64_t*)(tmp + 0x18) |= 1;
 82 | 		mm_release_phys_mapping(tmp);
 83 | 	}
 84 | 
 85 | 	rstate_ret = RSTATE_SUCCESS;
 86 | cleanup:
 87 | 	RSTATE_RETURN;
 88 | }
 89 | 
 90 | rstate_t
 91 | x86_passthrough_start(void)
 92 | {
 93 | 	struct _vm *vm;
 94 | 	struct _vmcb *vmcb;
 95 | 
 96 | 	RSTATE_LOCALS;
 97 | 
 98 | 	rstate = vm_x86_create(&vm, X86_SVM);
 99 | 	RSCHECK_NESTED("Failed to create x86 VM");
100 | 
101 | 	vm->npf_handler = x86_passthrough_npf_handler;
102 | 
103 | 	vmcb = vm->state.svm_state->vmcb;
104 | 
105 | 	vmcb->CR_icpt = 0xFFE6FFE6;
106 | 	vmcb->DR_icpt = 0xffffffff;
107 | 
108 | 	/* Intercept #DBs */
109 | 	vmcb->except_icpt = (1 << 1);
110 | 
111 | 	/* Intercept software interrupts */
112 | 	vmcb->icpt_set_1 = (1 << 21) | (1 << 27) | (0 << 28) | (1 << 30) |
113 | 		(1 << 31) | 0x1f;
114 | 
115 | 	/* Intercept VMRUN */
116 | 	vmcb->icpt_set_2 = 1;
117 | 
118 | 	{
119 | 		uint8_t buf[512];
120 | 
121 | 		rstate = ide_pio_read_sectors(0, buf, sizeof(buf));
122 | 		RSCHECK_NESTED("Failed to read MBR");
123 | 
124 | 		rstate = vm_write_phys(vm, 0x7c00, buf, sizeof(buf));
125 | 		RSCHECK_NESTED("Failed to write MBR ot 0x7c00");
126 | 	}
127 | 
128 | 	printf("VM created");
129 | 
130 | do_more:
131 | 	rstate = vm->step(vm);
132 | 	RSCHECK_NESTED("Failed to step VM");
133 | 
134 | 	vm_read_phys(vm, vm->regs.x86_regs.cs_base + vm->regs.x86_regs.rip.rip,
135 | 			&vmcb->guest_inst[0], 8);
136 | 
137 | 	if(vmcb->exitcode == 0x75){
138 | 		if(vmcb->exitinfo1 == 0x13){
139 | 			if(vm->regs.x86_regs.rax.b.ah == 0x41){
140 | 				/* BIOS extensions check */
141 | 				vm->regs.x86_regs.rbx.bx   = 0xaa55;
142 | 				vm->regs.x86_regs.rcx.cx   = 3;
143 | 				vm->regs.x86_regs.rfl.u.cf = 0;
144 | 				vm->regs.x86_regs.rax.rax  = 0x100;
145 | 				vm->regs.x86_regs.rip.rip += 2;
146 | 				goto do_more;
147 | 			} else if(vm->regs.x86_regs.rax.b.ah == 0x42){
148 | 				/* Int 13,42 - Extended read
149 | 				 * ah    - 0x42
150 | 				 * dl    - Drive number
151 | 				 * ds:si - Disk packet address
152 | 				 */
153 | 
154 | #pragma pack(push, 1)
155 | 				struct {
156 | 					uint8_t  packet_size;
157 | 					uint8_t  reserved;
158 | 					uint16_t block_count;
159 | 					uint16_t offset;
160 | 					uint16_t segment;
161 | 					uint64_t lba;
162 | 					uint64_t buffer64;
163 | 				} disk_packet;
164 | #pragma pack(pop)
165 | 
166 | 				uint64_t addr;
167 | 				uint64_t packet_addr = vm->regs.x86_regs.ds_base + vm->regs.x86_regs.rsi.si;
168 | 
169 | 				rstate = vm_read_phys(vm, packet_addr, &disk_packet,
170 | 						sizeof(disk_packet));
171 | 				RSCHECK_NESTED("Failed to read disk packet for BIOS 13,42");
172 | 
173 | 				addr = ((uint64_t)disk_packet.segment << 4) +
174 | 					(uint64_t)disk_packet.offset;
175 | 
176 | 				printf("Reading %.16lx to %.16lx %u", disk_packet.lba,
177 | 						addr, disk_packet.block_count);
178 | 
179 | 				while(disk_packet.block_count){
180 | 					uint8_t sector[512];
181 | 
182 | 					rstate = ide_pio_read_sectors(disk_packet.lba,
183 | 							sector, sizeof(sector));
184 | 					RSCHECK_NESTED("Failed to read sector");
185 | 
186 | 					rstate = vm_write_phys(vm, addr, sector, sizeof(sector));
187 | 					RSCHECK_NESTED("Failed to write sector into guest");
188 | 
189 | 					disk_packet.lba++;
190 | 					addr += 512;
191 | 					disk_packet.block_count--;
192 | 				}
193 | 
194 | 				vm->regs.x86_regs.rax.b.ah  = 0;
195 | 				vm->regs.x86_regs.rfl.u.cf  = 0;
196 | 				vm->regs.x86_regs.rip.rip  += 2;
197 | 				goto do_more;
198 | 			} else if(vm->regs.x86_regs.rax.b.ah == 0x48){
199 | 				/* Int 13,48 - Get drive parameters
200 | 				 * ah    - 48
201 | 				 * dl    - Drive
202 | 				 * ds:si - Buffer to get drive parameters.
203 | 				 */
204 | 
205 | #pragma pack(push, 1)
206 | 				struct {
207 | 					uint16_t size;
208 | 					uint16_t info;
209 | 					uint32_t num_cyls;
210 | 					uint32_t num_heads;
211 | 					uint32_t num_sectors_per_track;
212 | 					uint64_t num_sectors;
213 | 					uint16_t bytes_per_sector;
214 | 				} disk_params;
215 | #pragma pack(pop)
216 | 
217 | 				uint64_t params_addr =
218 | 					vm->regs.x86_regs.ds_base + vm->regs.x86_regs.rsi.si;
219 | 
220 | 				disk_params.size                  = sizeof(disk_params);
221 | 				disk_params.info                  = 0;
222 | 				disk_params.num_cyls              = 0;
223 | 				disk_params.num_heads             = 0;
224 | 				disk_params.num_sectors_per_track = 0;
225 | 				disk_params.num_sectors           = (900UL * 1024 * 1024 * 1024) / 512;
226 | 				disk_params.bytes_per_sector      = 512;
227 | 
228 | 				rstate = vm_write_phys(vm, params_addr, &disk_params,
229 | 						sizeof(disk_params));
230 | 				RSCHECK_NESTED("Failed to write drive parameters into guest");
231 | 
232 | 				vm->regs.x86_regs.rax.rax   = 0;
233 | 				vm->regs.x86_regs.rfl.u.cf  = 0;
234 | 				vm->regs.x86_regs.rip.rip  += 2;
235 | 				goto do_more;
236 | 			} else if(vm->regs.x86_regs.rax.b.ah == 0x08){
237 | 				/* Int 13,08 - Get drive parameters */
238 | 
239 | 				vm->regs.x86_regs.rax.b.ah  = 0x00; /* Success */
240 | 				vm->regs.x86_regs.rbx.b.bl  = 0x00; /* Drive type */
241 | 				vm->regs.x86_regs.rcx.b.ch  = 0xff; /* Max cylinder number */
242 | 				vm->regs.x86_regs.rcx.b.cl  = 0xff; /* Max sector number */
243 | 				vm->regs.x86_regs.rdx.b.dh  = 0xff; /* Max head number */
244 | 				vm->regs.x86_regs.rdx.b.dl  = 0x01; /* Number of drives */
245 | 				vm->regs.x86_regs.rfl.u.cf  = 0;
246 | 				vm->regs.x86_regs.rip.rip  += 2;
247 | 				goto do_more;
248 | 			} else if(vm->regs.x86_regs.rax.b.ah == 0x15){
249 | 				/* Int 13,15 - Get disk type */
250 | 
251 | 				vm->regs.x86_regs.rax.b.ah  = 3;
252 | 				vm->regs.x86_regs.rcx.cx    = 0xffff;
253 | 				vm->regs.x86_regs.rdx.dx    = 0xffff;
254 | 				vm->regs.x86_regs.rfl.u.cf  = 0;
255 | 				vm->regs.x86_regs.rip.rip  += 2;
256 | 				goto do_more;
257 | 			}
258 | 
259 | 			goto unhandled_vmexit;
260 | 		} else if(vmcb->exitinfo1 == 0x15){
261 | 			if(vm->regs.x86_regs.rax.ax == 0xe820){
262 | 				struct {
263 | 					uint64_t base;
264 | 					uint64_t size;
265 | 					uint32_t type;
266 | 					uint32_t cont;
267 | 				} e820_table[3] = {
268 | 					{ 0x000000000, 0x000009e000, 1, 1 },
269 | 					{ 0x000100000, 0x0000600000, 1, 2 },
270 | 					{ 0x000e10000, 0x00cf04f000, 1, 0 },
271 | 				};
272 | 
273 | 				uint64_t addr = vm->regs.x86_regs.es_base + vm->regs.x86_regs.rdi.di;
274 | 
275 | 				RSCHECK(vm->regs.x86_regs.rbx.ebx <= 2, "E820 access out of bounds");
276 | 
277 | 				rstate = vm_write_phys(vm, addr,
278 | 						&e820_table[vm->regs.x86_regs.rbx.ebx], 20);
279 | 				RSCHECK_NESTED("Failed to write E820 table to guest");
280 | 
281 | 				vm->regs.x86_regs.rbx.ebx   = e820_table[vm->regs.x86_regs.rbx.ebx].cont;
282 | 				vm->regs.x86_regs.rcx.ecx   = 20;
283 | 				vm->regs.x86_regs.rax.eax   = 0x534d4150;
284 | 				vm->regs.x86_regs.rfl.u.cf  = 0;
285 | 				vm->regs.x86_regs.rip.rip  += 2;
286 | 				goto do_more;
287 | 			} else {
288 | 				vm->regs.x86_regs.rfl.u.cf  = 1; /* Error */
289 | 				vm->regs.x86_regs.rip.rip  += 2;
290 | 				goto do_more;
291 | 			}
292 | 		} else if(vmcb->exitinfo1 == 0x1a){
293 | 			if(vm->regs.x86_regs.rax.b.ah == 0){
294 | 				/* Get system time
295 | 				 * cx:dx - Clock ticks since midnight (18.2 ticks per second)
296 | 				 */
297 | 
298 | 				uint64_t time = rdtsc_uptime() / 54945;
299 | 
300 | 				vm->regs.x86_regs.rcx.cx = (uint16_t)(time >> 16);
301 | 				vm->regs.x86_regs.rdx.dx = (uint16_t)(time >>  0);
302 | 
303 | 				vm->regs.x86_regs.rip.rip += 2;
304 | 				goto do_more;
305 | 			} else if(vm->regs.x86_regs.rax.b.ah == 0xbb){
306 | 				/* Some seemingly undocumented TPM function. Return error */
307 | 				vm->regs.x86_regs.rfl.u.cf  = 1; /* Error */
308 | 				vm->regs.x86_regs.rip.rip  += 2;
309 | 				goto do_more;
310 | 			}
311 | 		} else if(vmcb->exitinfo1 == 0x10){
312 | 			vm->regs.x86_regs.rfl.u.cf  = 1; /* Error */
313 | 			vm->regs.x86_regs.rip.rip  += 2;
314 | 			goto do_more;
315 | 		} else if(vmcb->exitinfo1 == 0x16){
316 | 			if(vm->regs.x86_regs.rax.b.ah == 0x11){
317 | 				/* Check for enhanced keystroke, return no key */
318 | 				vm->regs.x86_regs.rfl.u.zf  = 0;
319 | 				vm->regs.x86_regs.rip.rip  += 2;
320 | 				goto do_more;
321 | 			} else if(vm->regs.x86_regs.rax.b.ah == 0x10){
322 | 				/* Keystroke */
323 | 				vm->regs.x86_regs.rax.b.ah  = 0x0a;
324 | 				vm->regs.x86_regs.rax.b.al  = 0x0a;
325 | 				vm->regs.x86_regs.rip.rip  += 2;
326 | 				goto do_more;
327 | 			}
328 | 		}
329 | 
330 | 		goto unhandled_vmexit;
331 | 	} else if(vmcb->exitcode == 0x7b){
332 | 		uint16_t port = (vmcb->exitinfo1 >> 16) & 0xffff;
333 | 
334 | 		if(port == 0x64 || port == 0x60){
335 | 			vm->regs.x86_regs.rip.rip = vmcb->exitinfo2;
336 | 			goto do_more;
337 | 		}
338 | 	} else if(vmcb->exitcode == 0x60){
339 | 		/* External interrupt, this is our timer interrupt,
340 | 		 * does not affect VM
341 | 		 */
342 | 		goto do_more;
343 | 	}
344 | 
345 | unhandled_vmexit:
346 | 	vm->dump_state(vm);
347 | 	rstate_ret = RSTATE_SUCCESS;
348 | cleanup:
349 | 	RSTATE_RETURN;
350 | }
351 | 
352 | 


--------------------------------------------------------------------------------
/srcs/vm/x86_passthrough.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | 
3 | _Success_(return == RSTATE_SUCCESS)
4 | _Ret_maybenull_
5 | _Must_inspect_result_
6 | rstate_t
7 | x86_passthrough_start(void);
8 | 
9 | 


--------------------------------------------------------------------------------
/srcs/vm/x86_user.c:
--------------------------------------------------------------------------------
 1 | #include <grilled_cheese.h>
 2 | #include <vm/vm.h>
 3 | 
 4 | rstate_t
 5 | x86_user_create(_In_ struct _vm *vm)
 6 | {
 7 | 	vm->step       = x86_user_step;
 8 | 	vm->map_phys   = x86_user_map_phys;
 9 | 	vm->dump_state = x86_user_dump_state;
10 | 	vm->guest_phys_to_host_phys = x86_user_guest_virt_to_host_phys;
11 | 	vm->guest_virt_to_host_phys = x86_user_guest_virt_to_host_phys;
12 | 
13 | 	return RSTATE_SUCCESS;
14 | }
15 | 
16 | rstate_t
17 | x86_user_step(_In_ struct _vm *vm)
18 | {
19 | 	return RSTATE_SUCCESS;
20 | }
21 | 
22 | rstate_t
23 | x86_user_map_phys(
24 | 		_In_ struct _vm *vm,
25 | 		_In_ uint64_t    address,
26 | 		_In_ int         readable,
27 | 		_In_ int         writable,
28 | 		_In_ int         executable,
29 | 		_In_ uint64_t    backing_page)
30 | {
31 | 	return RSTATE_SUCCESS;
32 | }
33 | 
34 | void
35 | x86_user_dump_state(_In_ struct _vm *vm)
36 | {
37 | 	vm_x86_dump_state(vm);
38 | 	return;
39 | }
40 | 
41 | rstate_t
42 | x86_user_guest_virt_to_host_phys(
43 | 		_In_  struct _vm *vm,
44 | 		_In_  uint64_t    guest_vaddr,
45 | 		_In_  int         is_read,
46 | 		_In_  int         is_write,
47 | 		_In_  int         is_exec,
48 | 		_Out_ uintptr_t  *host_paddr)
49 | {
50 | 	return RSTATE_SUCCESS;
51 | }
52 | 
53 | 


--------------------------------------------------------------------------------
/srcs/vm/x86_user.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | struct _x86_user_state {
 4 | 	uintptr_t guest_cr3;
 5 | 
 6 | 	void *pivot_addr;
 7 | };
 8 | 
 9 | rstate_t
10 | x86_user_create(_In_ struct _vm *vm);
11 | 
12 | rstate_t
13 | x86_user_step(_In_ struct _vm *vm);
14 | 
15 | rstate_t
16 | x86_user_map_phys(
17 | 		_In_ struct _vm *vm,
18 | 		_In_ uint64_t    address,
19 | 		_In_ int         readable,
20 | 		_In_ int         writable,
21 | 		_In_ int         executable,
22 | 		_In_ uint64_t    backing_page);
23 | 
24 | void
25 | x86_user_dump_state(_In_ struct _vm *vm);
26 | 
27 | rstate_t
28 | x86_user_guest_virt_to_host_phys(
29 | 		_In_  struct _vm *vm,
30 | 		_In_  uint64_t    guest_vaddr,
31 | 		_In_  int         is_read,
32 | 		_In_  int         is_write,
33 | 		_In_  int         is_exec,
34 | 		_Out_ uintptr_t  *host_paddr);
35 | 
36 | 


--------------------------------------------------------------------------------