advanced-microcode-patching
diff --git a/‎Makefile‎
Lines changed: 7 additions & 3 deletions b/‎Makefile‎
Lines changed: 7 additions & 3 deletions
diff --git a/‎SHIVA_MODULE.specs‎
Lines changed: 37 additions & 0 deletions b/‎SHIVA_MODULE.specs‎
Lines changed: 37 additions & 0 deletions
diff --git a/‎modules/aarch64_patches/Makefile‎
Lines changed: 1 addition & 1 deletion b/‎modules/aarch64_patches/Makefile‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎modules/aarch64_patches/amp_challenge10/Makefile‎
Lines changed: 9 additions & 0 deletions b/‎modules/aarch64_patches/amp_challenge10/Makefile‎
Lines changed: 9 additions & 0 deletions
diff --git a/‎modules/aarch64_patches/amp_challenge10/patch10.c‎
Lines changed: 5 additions & 6 deletions b/‎modules/aarch64_patches/amp_challenge10/patch10.c‎
Lines changed: 5 additions & 6 deletions
diff --git a/‎modules/aarch64_patches/amp_challenge10/patch_notes.txt‎
Lines changed: 26 additions & 0 deletions b/‎modules/aarch64_patches/amp_challenge10/patch_notes.txt‎
Lines changed: 26 additions & 0 deletions
diff --git a/‎modules/aarch64_patches/amp_challenge10/program_c‎
1.08 MB b/‎modules/aarch64_patches/amp_challenge10/program_c‎
1.08 MB
diff --git a/‎modules/aarch64_patches/amp_challenge10/test.c‎
Lines changed: 6 additions & 0 deletions b/‎modules/aarch64_patches/amp_challenge10/test.c‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎modules/aarch64_patches/bss_interposing/Makefile‎
Lines changed: 5 additions & 1 deletion b/‎modules/aarch64_patches/bss_interposing/Makefile‎
Lines changed: 5 additions & 1 deletion
diff --git a/‎modules/aarch64_patches/bss_overflow/Makefile‎
Lines changed: 9 additions & 0 deletions b/‎modules/aarch64_patches/bss_overflow/Makefile‎
Lines changed: 9 additions & 0 deletions
@@ -1,9 +1,10 @@
 BUILD_DIR = './build'
 INTERP_PATH = $(PWD)/build/shiva
+PATCH_PATH = "modules/aarch64_patches"
 GCC_OPTS= -fPIC -ggdb -c
 OBJ_LIST=shiva.o shiva_util.o shiva_signal.o shiva_ulexec.o shiva_auxv.o	\
     shiva_module.o shiva_trace.o shiva_trace_thread.o shiva_error.o shiva_maps.o shiva_analyze.o \
-    shiva_callsite.o shiva_target.o shiva_xref.o
+    shiva_callsite.o shiva_target.o shiva_xref.o shiva_transform.o
 STATIC_LIBS=/opt/elfmaster/lib/libelfmaster.a libcapstone.a
 CC=gcc
 MUSL=musl-gcc
@@ -25,6 +26,7 @@ interp:
 	$(CC) $(GCC_OPTS) shiva_callsite.c -o	shiva_callsite.o
 	$(CC) $(GCC_OPTS) shiva_target.c -o	shiva_target.o
 	$(CC) $(GCC_OPTS) shiva_xref.c -o		shiva_xref.o
+	$(CC) $(GCC_OPTS) shiva_transform.c -o	shiva_transform.o
 	$(MUSL) -static -Wl,-undefined=system -Wl,-undefined=prctl -Wl,-undefined=pause -Wl,-undefined=puts -Wl,-undefined=putchar $(OBJ_LIST) $(STATIC_LIBS) -o $(BUILD_DIR)/shiva
 
 shiva-ld:
@@ -36,11 +38,13 @@ patches:
 install:
 	cp build/shiva /lib/shiva
 	ln -sf build/shiva shiva
+	ln -sf /lib/shiva /usr/bin/shiva
 	cp build/shiva /usr/bin
 	cp tools/shiva-ld/shiva-ld /usr/bin
 	mkdir -p /opt/shiva/modules
-	cp modules/aarch64_patches/*interposing*/*.o /opt/shiva/modules
-	cp modules/aarch64_patches/cfs_patch1/*.o /opt/shiva/modules
+	cp $(PATCH_PATH)/*interposing*/*.o /opt/shiva/modules
+	cp $(PATCH_PATH)/cfs_patch1/*.o /opt/shiva/modules
+	cp $(PATCH_PATH)/amp_challenge10/*.o /opt/shiva/modules
 	cat shiva.ansi
 clean:
 	rm -f *.o shiva
@@ -0,0 +1,37 @@
+
+## Shiva modules
+
+The microcode patching process of building an additional runtime image
+for the Shiva module is explained in this document along with the details
+on symbol resolution, relocations, transformations, and external re-linking.
+
+Shiva modules are ELF relocatable objects that define patch code and data.
+At runtime, Shiva parses the ELF object, and builds a process image by mapping
+all of the modules code and data into corresponding ELF sections in memory.
+For example, the .text and .rodata sections are allocatable readonly sections
+and are therefore copied into the modules text segment. Shiva creates an internal
+entry that represents where each section lives within memory.
+
+- From shiva.h
+```
+typedef enum shiva_module_section_map_attr {
+        LP_SECTION_TEXTSEGMENT = 0,
+        LP_SECTION_DATASEGMENT,
+        LP_SECTION_BSS_SEGMENT,
+        LP_SECTION_UNKNOWN
+} shiva_module_section_map_attr_t;
+
+struct shiva_module_section_mapping {
+        struct elf_section section;
+        shiva_module_section_map_attr_t map_attribute;
+        uint64_t vaddr; /* Which memory address the section contents is placed in */
+        uint64_t offset;
+        uint64_t size;
+        char *name;
+        TAILQ_ENTRY(shiva_module_section_mapping) _linkage;
+};
+```
+
+## Symbol resolution, interposition, ordering
+
+
@@ -1,4 +1,4 @@
-SUBDIRS = dataonly_interposing data_interposing rodata_interposing bss_interposing cfs_patch1
+SUBDIRS = dataonly_interposing data_interposing rodata_interposing bss_interposing cfs_patch1 amp_challenge10 fsplice
 subdirs:
 		for dir in $(SUBDIRS); do \
 			$(MAKE) -C $$dir; \
 
@@ -0,0 +1,9 @@
+INTERP_PATH="/lib/shiva"
+SHIVA_LD_PATH="../../../tools/shiva-ld/shiva-ld"
+all:
+	gcc -fomit-frame-pointer -mcmodel=large -fno-pic -I ../ -I ../../include -fno-stack-protector -c patch10.c
+	$(SHIVA_LD_PATH) -e program_c -p patch10.o -i /lib/shiva -s /opt/shiva/modules -o program_c.patched
+
+clean:
+	rm *.o
+
@@ -1,5 +1,6 @@
 #include <stdint.h>
 #include <stdio.h>
+#include "shiva_module.h"
 
 /*
  * These are external .bss variables.
@@ -8,13 +9,11 @@ extern uint16_t size;
 extern uint8_t num_packets;
 
 /*
- * In the future a gcc plugin will offer 
- * __attribute__((shiva_patch(start_vaddr, len))
+ * Example of using a "Shiva Transformation". The
+ * Splice transformation allows us to splice C code
+ * into an existing function.
  */
-uint64_t shiva_insert_patch1_start_0x9b74 = 0;
-uint64_t shiva_insert_patch1_end_0x9b8c = 0;
-
-void * __attribute__((naked)) shiva_insert_patch1(void)
+SHIVA_T_SPLICE_FUNCTION(transport_handler, 0x9b6c, 0x9b94)
 {
 	if ((num_packets * 7) != size) {
 		printf("RTS mismatch detected\n");
 
@@ -0,0 +1,26 @@
+0000000000000000 <shiva_insert_0xc490>:
+   0:   a9bf7bfd        stp     x29, x30, [sp, #-16]!
+   4:   910003fd        mov     x29, sp
+  
+
+/*
+ NOTE: This is relocatable code that hasn't been fixed up yet.
+ */
+
+   8:   90000000        adrp    x0, 0 <shiva_insert_0xc490>
+   c:   91000000        add     x0, x0, #0x0 
+  10:   f9400000        ldr     x0, [x0] ; x0 = num_packets
+  14:   39400000        ldrb    w0, [x0] ; w0 = (uint8_t)num_packets;
+  18:   2a0003e1        mov     w1, w0   ; w1 = (uint8_t)num_packets;
+  1c:   2a0103e0        mov     w0, w1
+  20:   531d7000        lsl     w0, w0, #3 ; w0 = num_packets * 8
+  24:   4b010000        sub     w0, w0, w1 ; w0 = num_packets * 7
+  28:   90000001        adrp    x1, 0 <shiva_insert_0xc490>
+  2c:   91000021        add     x1, x1, #0x0
+  30:   f9400021        ldr     x1, [x1] ; x1 = size
+  34:   79400021        ldrh    w1, [x1] ; w1 = (uin16_t)size;
+  38:   6b01001f        cmp     w0, w1 ; if ((num_packets * 7) == size)
+  3c:   540000e0        b.eq    58 <shiva_insert_0xc490+0x58>  // b.none
+...
+...
+
@@ -0,0 +1,6 @@
+#include <stdio.h>
+
+int main(void)
+{
+	printf("Hello World\n");
+}
@@ -1,8 +1,12 @@
 INTERP_PATH="/lib/shiva"
+SHIVA-LD_PATH="../../../tools/shiva-ld/shiva-ld"
+
 all:
 	gcc -mcmodel=large -fno-pic -I ../ -fno-stack-protector -c bss_patch.c
 	gcc -O0 test_bss.c -o test_bss
-	shiva-ld -e test_bss -p bss_patch.o -i /lib/shiva -s /opt/shiva/modules -o test_bss.patched
+	$(SHIVA-LD_PATH) -e test_bss -p bss_patch.o -i /lib/shiva -s /opt/shiva/modules -o test_bss.patched
+install:
+	cp bss_patch.o /opt/shiva/modules/
 clean:
 	rm -f test_bss test_bss.patched bss_patch.o
 
@@ -0,0 +1,9 @@
+INTERP_PATH="/lib/shiva"
+SHIVA-LD_PATH="../../../tools/shiva-ld/shiva-ld"
+
+all:
+	gcc -mcmodel=large -fno-pic -I ../ -fno-stack-protector -c bss_patch2.c
+	gcc -O0 -g bss_vuln.c -o bss_vuln
+	$(SHIVA-LD_PATH) -e bss_vuln -p bss_patch2.o -i /lib/shiva -s /opt/shiva/modules -o bss_vuln.patched
+	chown root:root bss_vuln
+	chmod u+s bss_vuln
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-SUBDIRS = dataonly_interposing data_interposing rodata_interposing bss_interposing cfs_patch1`
	`1`	`+SUBDIRS = dataonly_interposing data_interposing rodata_interposing bss_interposing cfs_patch1 amp_challenge10 fsplice`
`2`	`2`	`subdirs:`
`3`	`3`	`for dir in $(SUBDIRS); do \`
`4`	`4`	`$(MAKE) -C $$dir; \`