kvm.c

#include <err.h>
#include <errno.h>
#include <sys/mman.h>
#include <stdlib.h>
#include <stddef.h>
#include <linux/kvm.h>
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <stdint.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <time.h>

#include "kvm-structs.h"
#include "kvm-helpers.h"
#include "util.h"

#define VM_MEMORY_SIZE 0x10000

#define MMIO_BASE   0x16000
#define MMIO_SIZE   0x2000
#define VRAM_OFFSET 0x1000       
#define VRAM_BASE   (MMIO_BASE + VRAM_OFFSET)      

/* Display Config */
#define CONSOLE_W   80
#define CONSOLE_H   25
#define VRAM_SIZE   (CONSOLE_W * CONSOLE_H)

/* IO Ports */
#define PORT_DISPLAY_REFRESH 0x16020 
#define PORT_SERIAL_DATA     0x16021 /* Emulated Serial Data Port */
#define PORT_SERIAL_CMD      0x16022 /* Emulated Serial Control Port */

/* Host State */
char console_buffer[CONSOLE_H][CONSOLE_W];
int cursor_x = 0;
int cursor_y = 0;

void init_console() {
    for(int y=0; y<CONSOLE_H; y++) {
        for(int x=0; x<CONSOLE_W; x++) {
            console_buffer[y][x] = ' ';
        }
    }
    cursor_x = 0;
    cursor_y = 0;
}

void draw_console() {
    /* Hide Cursor, Move to Top-Left */
    printf("\033[?25l\033[H"); 
    
    /* Draw Top Border */
    printf("+");
    for(int i=0; i<CONSOLE_W; i++) printf("-");
    printf("+\n");

    /* Draw Content */
    for(int y=0; y<CONSOLE_H; y++) {
        printf("|");
        for(int x=0; x<CONSOLE_W; x++) {
            putchar(console_buffer[y][x]);
        }
        printf("|\n");
    }

    /* Draw Bottom Border */
    printf("+");
    for(int i=0; i<CONSOLE_W; i++) printf("-");
    printf("+\n");
    
    fflush(stdout);
}

void serial_console_write(char c) {
    if (c == '\n') {
        cursor_x = 0;
        cursor_y++;
    } else if (c == '\r') {
        cursor_x = 0;
    } else {
        if (cursor_x < CONSOLE_W && cursor_y < CONSOLE_H) {
            console_buffer[cursor_y][cursor_x] = c;
        }
        cursor_x++;
    }

    if (cursor_x >= CONSOLE_W) {
        cursor_x = 0;
        cursor_y++;
    }
    if (cursor_y >= CONSOLE_H) {
        cursor_y = 0; 
    }
}

int main(int argc, char *argv[]) {
    struct kvm_ctx *ctx;
    struct kvm_run *run;
    char code[0x4000]={0};
    char *mem_ptr;
    char *vram_backing;
    uint64_t next_free_page;
    FILE *code_file;
    size_t bytes_read;

    if (argc < 2) {
        printf("Usage: %s <guest_binary>\n", argv[0]);
        exit(1);
    }

    code_file = fopen(argv[1], "rb");
    if (!code_file) exit(1);
    bytes_read = fread(code, 1, sizeof(code), code_file);
    fclose(code_file);
    if (bytes_read == 0) exit(1);
    
    init_console();

    /* Standard KVM Setup */
    ctx = kvm_context_init();
    if(!ctx)
    {
        exit(-1);
    }
    
    ctx->kvmfd = open("/dev/kvm", O_RDWR | 02000000); 
    ctx->vmfd = kvm_create_vm(ctx);
    mem_ptr = mmap(NULL, VM_MEMORY_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    
    ctx->guest_memory_region.slot = 0;
    ctx->guest_memory_region.flags = 0;
    ctx->guest_memory_region.guest_phys_addr = 0x0;
    ctx->guest_memory_region.memory_size = VM_MEMORY_SIZE;
    ctx->guest_memory_region.userspace_addr = (uint64_t)mem_ptr;
    kvm_set_memory_region(ctx, &ctx->guest_memory_region);

    vram_backing = mmap(NULL, MMIO_SIZE, PROT_READ | PROT_WRITE , MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    ctx->mmio_region_addr = vram_backing;
    ctx->mmio_size = MMIO_SIZE;
    
    struct kvm_userspace_memory_region vram_region =
    {
        .slot = 1,
        .flags = KVM_MEM_READONLY, 
        .guest_phys_addr = MMIO_BASE,
        .memory_size = MMIO_SIZE,
        .userspace_addr = (uint64_t)vram_backing,
    };
    kvm_set_memory_region(ctx, &vram_region);

    next_free_page = 0x7000;
    memset(mem_ptr + 0x6000, 0, 0x1000);
    kvm_map_region(mem_ptr, 0x0, 0x0, 0x6000, &next_free_page);
    kvm_map_region(mem_ptr, MMIO_BASE, MMIO_BASE, MMIO_SIZE, &next_free_page);

    struct kvm_regs regs =
    {
        .rip = 0x0,
        .rflags = 0x2
    };

    kvm_create_vcpu(ctx, &regs);

    struct kvm_segment seg =
    {
        .base = 0,
        .limit = 0xffffffff,
        .selector = 1 << 3,
        .present = 1,
        .type = 0xb,
        .dpl = 0,
        .db = 0,
        .s = 1,
        .l = 1,
        .g = 1
    };

    kvm_set_sregs(ctx, &seg);

    size_t mmap_size = 0;
    kvm_get_vcpu_mmap_size(ctx, &mmap_size);
    run = mmap(NULL, mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED, ctx->cpufd[0], 0);

    printf("\e[0;91m[+] Let The VM RIP !!!!!\n\e[0m");
    memcpy(mem_ptr, code, bytes_read);

    printf("\033[2J"); 

    while(1){
        ioctl(ctx->cpufd[0], KVM_RUN, NULL);

        switch (run->exit_reason) {
            case KVM_EXIT_HLT:
                printf("\033[?25h\n");
                return 0;

            case KVM_EXIT_MMIO:
            {
                uint64_t addr = run->mmio.phys_addr;

                if (addr >= VRAM_BASE && addr < (VRAM_BASE + VRAM_SIZE))
                {
                    if (run->mmio.is_write)
                    {
                        uint64_t offset = addr - VRAM_BASE;
                        char c = run->mmio.data[0];
                        console_buffer[offset / CONSOLE_W][offset % CONSOLE_W] = c;
                        vram_backing[VRAM_OFFSET + offset] = c;
                    }
                } 
                else if (addr == PORT_DISPLAY_REFRESH)
                {
                    draw_console();
                    struct timespec ts = {0, 50000000}; /* 50ms delay */
                    nanosleep(&ts, NULL);
                }
                else if (addr == PORT_SERIAL_DATA)
                {
                    if (run->mmio.is_write)
                    {
                        char c = run->mmio.data[0];
                        serial_console_write(c);
                    }
                }
                else if (addr == PORT_SERIAL_CMD)
                {
                    if (run->mmio.is_write)
                    {
                        uint8_t cmd = (uint8_t)run->mmio.data[0];
                        if (!cmd) 
                        { 
                            cursor_x = 0;
                            cursor_y = 0;
                        }
                        else{
                            init_console();
                        }
                    }
                }
                break;
            }
            default:
                kvm_context_free(ctx);
                exit(0);
        }
    }
}