1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
|
#include <kjarna/syscall.h>
#include "fake_syscall.h"
#include "kjarna.h"
#include <bits/x86_64/descriptor.h>
#include <kjarna/interface.h>
#include <posix/unistd.h>
#include <asm/x86_64/msr.h>
#include <bits/x86_64/msr.h>
#include <posix/sys/mman.h>
#include <posix/fcntl.h>
/*
* Fake syscall mechanism -
*
* We have a GDT with entries for supervisory mode. These serve as the
* entries to satisfy the requirements of the SYSCALL instruction, as
* for some reason (possibly intentionally) the OVMF GDT is not laid out
* in a way to make use of the SYSCALL instruction possible.
*
* This causes us to have to work inside of constraints during loading time
* - All "user" mode execution entirely blocks interrupt processing. That
* means that "user" mode code must not execute "hlt", or the system will
* be locked.
* - When (if?) user input is required, it is always buffered. It is possible
* to simulate unbuffered input, at the cost of one syscall per transfer
* from "kernel" side to "user" side. This will cause high input latency.
* We will not be running Quake in this environment.
*
* These constraints are probably fine, as the loading process only needs to
* open files, map memory, etc.
*/
void *exit_fake_syscall_stack;
SYSV_ABI void fake_syscall_entry(void);
SYSV_ABI int64_t fake_syscall_begin(void *stack, void **return_stack_save);
SYSV_ABI int64_t fake_syscall_end(int status, void *stack);
void *stack_alloc(void **stack_pointer, size_t alloc_size)
{
void *block = *(char **)stack_pointer -= alloc_size;
// maintain alignment
*(char **)stack_pointer -= alloc_size % sizeof(size_t);
return block;
}
struct syscall_context_return_state
{
uint64_t rflags;
struct descriptor_table_register_long gdtr;
uint64_t return_ds;
uintptr_t return_rip;
uint64_t return_cs;
};
struct syscall_context
{
uint64_t pad;
uint64_t syscall_index;
syscall_delegate_parameters parameters;
struct syscall_context_return_state state;
};
static struct
{
uint16_t cs;
uint16_t ds;
uint64_t rflags;
struct descriptor_table_register_long gdtr;
}
system_context;
static void save_system_context()
{
__asm__ volatile (
"movw %%cs, %0\n"
"movw %%ds, %1\n"
"pushfq\n"
"popq %3\n"
"sgdt %2\n"
:
"=m"(system_context.cs),
"=m"(system_context.ds),
"=m"(system_context.gdtr),
"=g"(system_context.rflags)
:
);
}
static void restore_system_context()
{
__asm__ volatile (
"lgdt %0\n"
"mov %w1, %%ds\n"
"mov %w1, %%es\n"
"mov %w1, %%fs\n"
"mov %w1, %%gs\n"
"mov %w1, %%gs\n"
"mov %w1, %%ss\n"
"push %q2\n"
"lea .Lflush(%%rip), %%rax\n"
"push %%rax\n"
"lretq\n"
".Lflush:\n"
"push %q3\n"
"popfq\n"
:
:
"m"(system_context.gdtr),
"m"(system_context.ds),
"m"(system_context.cs),
"g"(system_context.rflags)
:
"rax"
);
}
static struct segment_descriptor const fake_syscall_gdt[] =
{
{ 0 },
{ 0xffff, 0, 0, 0x9a, 0xaf, 0},
{ 0xffff, 0, 0, 0x92, 0xcf, 0}
};
static int64_t syscall_delegate_open(syscall_delegate_parameters params)
{
return open((char *)params[0], (int)params[1], (int)params[2]);
}
static int64_t syscall_delegate_close(syscall_delegate_parameters params)
{
return close((int)params[0]);
}
static int64_t syscall_delegate_lseek(syscall_delegate_parameters params)
{
return lseek((int)params[0], (off_t)params[1], (int)params[2]);
}
static int64_t syscall_delegate_read(syscall_delegate_parameters params)
{
return read((int)params[0], (void *)params[1], (size_t)params[2]);
}
static int64_t syscall_delegate_write(syscall_delegate_parameters params)
{
return write((int)params[0], (void *)params[1], (size_t)params[2]);
}
static int64_t syscall_delegate_mmap(syscall_delegate_parameters params)
{
return (int64_t) mmap((void *)params[0], (size_t)params[1], (int)params[2], (int)params[3], (int)params[4], (off_t)params[5]);
}
static int64_t syscall_delegate_munmap(syscall_delegate_parameters params)
{
return munmap((void *)params[0], (size_t)params[1]);
}
static int64_t syscall_delegate_exit(syscall_delegate_parameters params)
{
fake_syscall_end((int)params[0], exit_fake_syscall_stack);
return -1;
}
static syscall_delegate *syscall_handler_delegates[NR_SYSCALLS] =
{
[SYS_OPEN] = syscall_delegate_open,
[SYS_CLOSE] = syscall_delegate_close,
[SYS_LSEEK] = syscall_delegate_lseek,
[SYS_READ] = syscall_delegate_read,
[SYS_WRITE] = syscall_delegate_write,
[SYS_MMAP] = syscall_delegate_mmap,
[SYS_MUNMAP] = syscall_delegate_munmap,
[SYS_EXIT] = syscall_delegate_exit
};
SYSV_ABI int64_t fake_syscall_handler(struct syscall_context *context)
{
int index = (int)context->syscall_index;
if (index > NR_SYSCALLS)
{
// TODO: ENOSYS
return -1;
}
syscall_delegate *delegate = syscall_handler_delegates[index];
if (delegate == nullptr)
{
// TODO: ENOSYS
return -1;
}
restore_system_context();
int64_t result = delegate(context->parameters);
save_system_context();
return result;
}
static void install_syscall_handler(void)
{
union msr_lstar lstar = { (uintptr_t)fake_syscall_entry };
union msr_star star = { { 0, 1 << 3, 1 << 3 | 3 } };
msr_write(MSR_INDEX_LSTAR, lstar.value);
msr_write(MSR_INDEX_STAR, star.value);
uint64_t efer = msr_read(MSR_INDEX_EFER);
efer |= 1;
msr_write(MSR_INDEX_EFER, efer);
}
static void *create_fake_syscall_stack(void *entry_addr, struct linear_buffer *stack_buffer)
{
stack_buffer->length = KJARNA_BOOT_STACK_SIZE;
stack_buffer->base = mmap(nullptr, stack_buffer->length, 0, 0, -1, 0);
void *stack_pointer_head = stack_buffer->base + stack_buffer->length;
struct syscall_context *context = stack_alloc(&stack_pointer_head, sizeof(*context));
context->state.rflags = 0;
context->state.gdtr.base = (uintptr_t)&fake_syscall_gdt;
context->state.gdtr.limit = sizeof(fake_syscall_gdt) - 1;
context->state.return_ds = 16;
context->state.return_cs = 8;
context->state.return_rip = (uintptr_t)entry_addr;
return stack_pointer_head;
}
int64_t fake_syscall_start(struct kjarna_boot_image *image)
{
install_syscall_handler();
void *fake_stack = create_fake_syscall_stack((void *)image->entry, &image->stack_buffer);
save_system_context();
int64_t result = fake_syscall_begin(fake_stack, &exit_fake_syscall_stack);
return result;
while(true);
}
|