SWAMPy

✎ CARVE FLESH

EDITING: supertramp.c

#include "osapi.h"
#include "debug.h"
#include "supertramp.h"

struct supertramp* supertramp;

extern int hook_function_pointer(trampoline_t* tramp);
extern int unhook_function_pointer(trampoline_t* tramp);
extern int hook_function_descriptor(trampoline_t* tramp);
extern int unhook_function_descriptor(trampoline_t* tramp);

/////////////////////////////////////////////////////////////////////
// Supertramp allocation/deallocation
/////////////////////////////////////////////////////////////////////

static supertramp_ext_t* add_supertramp_extension(void) {
	// Walk to the last extension page
	supertramp_ext_t* curr_ext=supertramp->extension;
	while (curr_ext->next != NULL) { curr_ext=curr_ext->next; }

// Request a new page of pinned kernel memory, advance curr
	curr_ext->next = (supertramp_ext_t*)kernel_page_alloc(KPAGE_PERSISTENT|KPAGE_EXECUTABLE);
	curr_ext=curr_ext->next;

// If successful, set up the extension and update the next textblock pointer
	if (curr_ext != NULL) {
		curr_ext->supertramp = supertramp;
		curr_ext->next = NULL;
		curr_ext->magic = SUPERTRAMP_MAGIC;
		supertramp->next_avail_textblock = (char*)curr_ext + sizeof(supertramp_ext_t);
	}
	return curr_ext;
}

supertramp_t* allocate_supertramp(unsigned int version_num) {
	if (sizeof(struct supertramp) > PAGE_SIZE) {
		err_msg("Supertramp is larger than a page. sz=%lu", (unsigned long)sizeof(struct supertramp));
		return NULL;
	}

supertramp = (struct supertramp*)kernel_page_alloc(KPAGE_PERSISTENT);
	if (supertramp == NULL) {
		err_msg("Failed to allocate supertramp page");
		return NULL;
	}

bzero(supertramp, sizeof(struct supertramp));
	supertramp->magic = SUPERTRAMP_MAGIC;
	supertramp->version = version_num;
	supertramp->extension = (supertramp_ext_t*)kernel_page_alloc(KPAGE_PERSISTENT|KPAGE_EXECUTABLE);
	if (supertramp->extension == NULL) {
		err_msg("Failed to allocate trampoline page");
		kernel_page_free(supertramp, KPAGE_PERSISTENT);
		supertramp=NULL;
		return NULL;
	}

// Set up the extension
	supertramp->extension->supertramp = supertramp;
	supertramp->extension->next = NULL;
	supertramp->extension->magic = SUPERTRAMP_MAGIC;

// The first available memory location for our trampolines is after the ext header
	supertramp->next_avail_textblock = (char*)supertramp->extension + sizeof(supertramp_ext_t);
	info_msg("Supertramp allocated at %p", supertramp);
	return supertramp;
}

supertramp_t* init_supertramp(unsigned short ver, long reclaim_address) {
	struct supertramp* rst = (struct supertramp*)reclaim_address;
	unsigned long version_num = (SUPERTRAMP_VERSION | ((unsigned int)ver << 16));
	if ((rst != NULL) && is_valid_kernaddr(rst)) {
		if (rst->magic == SUPERTRAMP_MAGIC) {
			supertramp = rst;
			if (supertramp->version != version_num) {
				info_msg("Supertramp found at %p, mismatched VERSION=%x", rst, rst->version);
				// For now, just uninstall any old installed hooks, and orphan the trampoline pages
				uninstall_trampolines();
				supertramp = NULL;
				// Create the new supertramp
				return allocate_supertramp(version_num);
			}

info_msg("Supertramp recovered at %p", supertramp);
			return supertramp;
		} else {
			info_msg("Failed to recover supertramp at %p", rst);
			return NULL;
		}
	} else {
		return allocate_supertramp(version_num);
	}
}

int release_supertramp(int removal_type) {
	int ret=SUPERTRAMP_OK;
	if ( supertramp != NULL ) {
		int i;
		for (i=0; i < supertramp->tramp_count; i++) {
			supertramp->trampolines[i].entry_cb = NULL;
			supertramp->trampolines[i].return_cb = NULL;
		}

for (i=0; i < supertramp->tramp_count; i++) {
			// Wait for any outstanding callbacks to finish, new ones can't start
			int spin_cnt=0;
			while (ATOMIC_READ(supertramp->trampolines[i].refcnt) != 0) {
				dbg_msg("waiting for callbacks to complete (trampoline[%d] refcnt=%d remtype=%d)", i, ATOMIC_READ(supertramp->trampolines[i].refcnt), removal_type);
				bs_delay(MINIMUM_BS_DELAY);
				if ((++spin_cnt % (2000 / MINIMUM_BS_DELAY)) == 0) {
					err_msg("exceeded expected release spin_cnt (trampoline[%d] refcnt=%d remtype=%d)", i, ATOMIC_READ(supertramp->trampolines[i].refcnt), removal_type);
				}
			}
		}

if (removal_type >= SUPERTRAMP_UNINSTALL_HOOKS) {
			info_msg("release_supertramp: Uninstalling trampolines");
			ret = uninstall_trampolines();
		}

// DEBUG ONLY! Full removal and deallocation of kernel memory.
		if ((ret == SUPERTRAMP_OK) && (removal_type >= SUPERTRAMP_FULL_REMOVAL)) {
			// This can fail and calls can be in-flight. Likely to panic the kernel, if so
			info_msg("Performing DANGEROUS full supertramp removal per debug flag.");
			supertramp->magic = 0xDEADDEAD;

while (supertramp->extension) {
				struct supertramp_ext* ext = supertramp->extension;
				supertramp->extension = ext->next;
				kernel_page_free(ext, KPAGE_PERSISTENT|KPAGE_EXECUTABLE);
			}

kernel_page_free(supertramp, KPAGE_PERSISTENT);
		}
	}

return ret;
}

static int hook_trampoline(trampoline_t* tramp) {
	int ret=SUPERTRAMP_ERR;
	switch (tramp->hook_type) {
		case HOOK_FUNCTION_POINTER:
			ret=hook_function_pointer(tramp);
			break;
		case HOOK_FUNCTION_DESCRIPTOR:
			// Just for the POWER EABI
			ret=hook_function_descriptor(tramp);
			break;
		default:
			// FIXME: check before allocating trampoline space
			err_msg("Requested hook type is not supported. trampoline=%d type=%d", tramp->id, tramp->hook_type);
			break;
	}

return ret;
}
	
/////////////////////////////////////////////////////////////////////
// Trampoline management
//  Copy trampoline code
//  Install/Uninstall 
//  Set/Clear entry/return callbacks
/////////////////////////////////////////////////////////////////////
static void copy_trampoline_code(trampoline_t* tramp, void* code_ptr) {
#if defined(AIX)
		power_func_desc_t* func_desc = (power_func_desc_t*)code_ptr;
		// POWER EABI, we need to copy the code, not the descriptor
		memcpy(tramp->trampoline_vaddr, func_desc->code_ptr, tramp->trampoline_size);
#else
		memcpy(tramp->trampoline_vaddr, code_ptr, tramp->trampoline_size);
#endif
}

int uninstall_trampoline(trampoline_t* tramp) {
	int err=SUPERTRAMP_ERR;
	if (tramp->intercept_addr && tramp->original_funcptr) {
		dbg_msg("Restore (%p) (%p)", tramp->intercept_addr, tramp->original_funcptr);

switch (tramp->hook_type) {
			case HOOK_FUNCTION_POINTER:
				err=unhook_function_pointer(tramp);
				break;
			case HOOK_FUNCTION_DESCRIPTOR:
				// Just for the POWER EABI
				err=unhook_function_descriptor(tramp);
				break;
			default:
				break;
		}

if (err) {
			err_msg("Trampoline %d: Atomic restore funcptr failed. orig=%p bs=%p curr=%p",
					tramp->id, (void*)tramp->original_funcptr, (void*)tramp->trampoline_vaddr,
					*(void**)tramp->intercept_addr);
			return ERR_INTERCEPT_CHANGED;
		}

tramp->intercept_addr=NULL;
	} else {
		err = ERR_UNKNOWN_TRAMPOLINE;
	}
	return err;
}

int install_trampolines(struct trampoline_setupdata *tsetup, int ntramps) {
	int i, bytesReq=0;
	trampoline_t* tramp;
	int bytesAvail = PAGE_SIZE - ((long)supertramp->next_avail_textblock & (PAGE_SIZE-1));

// Validate all trampolines are valid
	for (i=0; i < ntramps; i++) {
		if (!VALID_TRAMP_ID(tsetup[i].id)) {
			err_msg("Invalid trampoline id=%d", tsetup[i].id);
			return ERR_UNKNOWN_TRAMPOLINE;
		}

if (tsetup[i].intercept_addr == NULL) {
			err_msg("Invalid trampoline (%d) intercept addr=%p",
				tsetup[i].id, tsetup[i].intercept_addr);
			return ERR_INTERCEPT_CHANGED;
		}

if ((tsetup[i].trampoline_code == 0) || (tsetup[i].trampoline_size <= 0)
			|| (tsetup[i].trampoline_size >= PAGE_SIZE-sizeof(supertramp_ext_t)-FUNCTION_DESC_OVERHEAD)) {
			err_msg("Invalid trampoline (%d) code=%p size=%d",
				tsetup[i].id, (void*)tsetup[i].trampoline_code, tsetup[i].trampoline_size);
			return ERR_TRAMPOLINE_INVALID;
		}

// Check for matches with already installed trampolines
		tramp = &(supertramp->trampolines[tsetup[i].id]);
		if (tramp->trampoline_vaddr != 0) {
			if ((tramp->id != tsetup[i].id) ||
				(tramp->trampoline_size != tsetup[i].trampoline_size) ||
				(tramp->hook_type != tsetup[i].hook_type)) {
				err_msg("Trampoline %d already registered [failed match]:"
						" trampoline size requested/existing=%d/%d",
						i, tsetup[i].trampoline_size, tramp->trampoline_size);
				return ERR_TRAMPOLINE_MISMATCH;
			}
		} else {
			// This is a new trampoline, make sure we have space
			// TODO: Allocate extension here, instead of the install loop
			bytesReq += tsetup[i].trampoline_size + FUNCTION_DESC_OVERHEAD;
		}
	}

for (i=0; i < ntramps; i++) {
		tramp = &(supertramp->trampolines[tsetup[i].id]);

// Already validated that installed trampolines are a match for the requested
		if (tramp->trampoline_vaddr != 0) {
			dbg_msg("Trampoline %d already registered [matched]", i);
			dbg_msg("Reinserting hook for trampoline %d, intercept_addr=%p", i, tsetup[i].intercept_addr);
			tramp->intercept_addr   = tsetup[i].intercept_addr;
			if (hook_trampoline(tramp) != SUPERTRAMP_OK) {
				return SUPERTRAMP_ERR;
			}
			continue;
		}

// A trampoline has to be on a contiguous page, allocate a new extension as needed
		bytesAvail = PAGE_SIZE - ((long)supertramp->next_avail_textblock & (PAGE_SIZE-1));
		// TODO: Best fit algorithm?
		if (bytesAvail < tsetup[i].trampoline_size) {
			dbg_msg("Allocating new extension page");
			if (add_supertramp_extension() == NULL) {
				err_msg("Unable to allocate a trampoline extension page");
				// Uninstall any trampolines just put in place.
				while (--i >= 0) { uninstall_trampoline(&(supertramp->trampolines[tsetup[i].id])); }
				return ERR_MEMORY;
			}			
		}

// Update the metadata
		tramp->id = tsetup[i].id;
		tramp->intercept_addr   = tsetup[i].intercept_addr;
		tramp->trampoline_size  = tsetup[i].trampoline_size;
		tramp->hook_type        = tsetup[i].hook_type;
		tramp->trampoline_vaddr = supertramp->next_avail_textblock;

tramp->entry_cb  = NULL;
		tramp->return_cb = NULL;
		ATOMIC_SET(tramp->refcnt, 0);

// Advance the supertramp data
		supertramp->next_avail_textblock += tsetup[i].trampoline_size + FUNCTION_DESC_OVERHEAD;
		supertramp->tramp_count++;

copy_trampoline_code(tramp, (void*)tsetup[i].trampoline_code);

// Erase the metadata on failure, uninstall trampolines and bail out
		if (hook_trampoline(tramp) != SUPERTRAMP_OK) {
			tramp->id = 0;
			tramp->intercept_addr=0;
			tramp->trampoline_size=0;
			supertramp->next_avail_textblock = tramp->trampoline_vaddr;
			supertramp->tramp_count--;
			uninstall_trampolines();
			return SUPERTRAMP_ERR;
		}

}
	return SUPERTRAMP_OK;
}

int uninstall_trampolines(void) {
	int i, ret, err=SUPERTRAMP_OK;
	for (i=0; i < supertramp->tramp_count; i++) {
		// Loop over all the registered trampolines, uninstall any active ones
		if (supertramp->trampolines[i].intercept_addr != NULL) {
			ret=uninstall_trampoline(&(supertramp->trampolines[i]));
			if (ret != SUPERTRAMP_OK) err=ret;
			continue; // Next
		}
	}
	return err;
}

int set_tramp_callbacks(int id, void* entry, void* ret) {
	if (!VALID_TRAMP_ID(id)) return ERR_UNKNOWN_TRAMPOLINE;
	supertramp->trampolines[id].entry_cb  = entry;
	supertramp->trampolines[id].return_cb = ret;
	return SUPERTRAMP_OK;
}

int clear_tramp_callbacks(int id) {
	if (!VALID_TRAMP_ID(id)) return ERR_UNKNOWN_TRAMPOLINE;

if ((supertramp->trampolines[id].entry_cb) || (supertramp->trampolines[id].return_cb)) {
		supertramp->trampolines[id].entry_cb = NULL;
		supertramp->trampolines[id].return_cb = NULL;

// Wait for any outstanding callbacks to finish, new ones can't start
		while (ATOMIC_READ(supertramp->trampolines[id].refcnt) != 0) {
			dbg_msg("waiting for trampoline[%d] callbacks to complete", id);
			bs_delay(500);
		}
	}

return SUPERTRAMP_OK;
}

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📁 arch/	DIR	—	2022-12-06 04:06
📁 protocol/	DIR	—	2022-12-06 04:06
📄 bitarray.c	C	1.3 KB	2023-06-26 03:19	EDIT
📄 bitarray.h	H	498 B	2023-06-26 03:19	EDIT
📄 bluechannel.c	C	17.1 KB	2023-06-26 03:19	EDIT
📄 bluechannel.h	H	7.5 KB	2023-06-26 03:19	EDIT
📄 chunkbuf.c	C	24.5 KB	2023-06-26 03:19	EDIT
📄 chunkbuf.h	H	1.8 KB	2023-06-26 03:19	EDIT
📄 compiler.h	H	1.4 KB	2023-06-26 03:19	EDIT
📄 connid.c	C	4.2 KB	2023-06-26 03:19	EDIT
📄 connid.h	H	559 B	2023-06-26 03:19	EDIT
📄 debug.h	H	231 B	2023-06-26 03:19	EDIT
📄 event_names.h	H	432 B	2023-06-26 03:19	EDIT
📄 event_protocol.c	C	11.1 KB	2023-06-26 03:19	EDIT
📄 event_protocol.h	H	18 KB	2023-06-26 03:19	EDIT
📄 hash.c	C	10.9 KB	2023-06-26 03:19	EDIT
📄 hash.h	H	3.1 KB	2023-06-26 03:19	EDIT
📄 osapi.h	H	6 KB	2023-06-26 03:19	EDIT
📄 proto.h	H	228 B	2023-06-26 03:19	EDIT
📄 supertramp.c	C	11.5 KB	2023-06-26 03:19	EDIT
📄 supertramp.h	H	7.6 KB	2023-06-26 03:19	EDIT