Tcp tunnel

RUNNING.md

@@ -26,6 +26,7 @@ cd build
 # On Intel Macs
 ../configure --target-list=arm-softmmu --extra-cflags=-I/usr/local/opt/openssl@3/include --extra-ldflags='-L/usr/local/opt/openssl@3/lib -lcrypto'
 
+
 # On Apple Silicon Macs
 ../configure --enable-sdl --disable-cocoa --target-list=arm-softmmu --disable-capstone --disable-pie --disable-slirp --extra-cflags=-I/opt/homebrew/opt/openssl@3/include --extra-ldflags='-L/opt/homebrew/opt/openssl@3/lib -lcrypto'
 

configs/devices/arm-softmmu/default.mak

@@ -4,7 +4,6 @@
 # CONFIG_TEST_DEVICES=n
 
 CONFIG_ARM_VIRT=y
-
 # These are selected by default when TCG is enabled, uncomment them to
 # keep out of the build.
 # CONFIG_CUBIEBOARD=n
@@ -45,3 +44,4 @@ CONFIG_ARM_VIRT=y
 # CONFIG_FSL_IMX6UL=n
 # CONFIG_ALLWINNER_H3=n
 CONFIG_IPOD_TOUCH_2G=y
+

hw/arm/guest-fds.c

@@ -0,0 +1,72 @@
+/*
+ * QEMU TCP Tunnelling
+ *
+ * Copyright (c) 2019 Lev Aronsky <[email protected]>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without retvaltriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPretvalS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include <stdarg.h>
+
+#include "hw/arm/guest-services/fds.h"
+#include "cpu.h"
+
+int32_t guest_svcs_fds[MAX_FD_COUNT] = { [0 ... MAX_FD_COUNT-1] = -1 };
+
+int32_t qc_handle_close(CPUState *cpu, int32_t fd)
+{
+    VERIFY_FD(fd);
+
+    int retval = -1;
+
+    if ((retval = close(guest_svcs_fds[fd])) < 0) {
+        guest_svcs_errno = errno;
+    } else {
+        // TODO: should this be in the "else" clause, or performed regardless?
+        guest_svcs_fds[fd] = -1;
+    }
+
+    return retval;
+}
+
+int32_t qc_handle_fcntl_getfl(CPUState *cpu, int32_t fd)
+{
+    VERIFY_FD(fd);
+
+    int retval = -1;
+
+    if ((retval = fcntl(guest_svcs_fds[fd], F_GETFL)) < 0) {
+        guest_svcs_errno = errno;
+    }
+
+    return retval;
+}
+
+int32_t qc_handle_fcntl_setfl(CPUState *cpu, int32_t fd, int32_t flags)
+{
+    VERIFY_FD(fd);
+
+    int retval = -1;
+
+    if ((retval = fcntl(guest_svcs_fds[fd], F_SETFL, flags)) < 0) {
+        guest_svcs_errno = errno;
+    }
+
+    return retval;
+}

hw/arm/guest-file.c

@@ -0,0 +1,111 @@
+/*
+ * QEMU Host file guest access
+ *
+ * Copyright (c) 2020 Jonathan Afek <[email protected]>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "hw/arm/guest-services/file.h"
+#include "cpu.h"
+
+static int32_t file_fds[MAX_FILE_FDS] = { [0 ... MAX_FILE_FDS-1] = -1 };
+
+void qc_file_open(uint64_t index, const char *filename)
+{
+    if (index >= MAX_FILE_FDS) {
+        abort();
+    }
+    if (-1 != file_fds[index]) {
+        abort();
+    }
+    file_fds[index] = open(filename, O_RDWR);
+    if (-1 == file_fds[index]) {
+        abort();
+    }
+}
+
+int64_t qc_handle_write_file(CPUState *cpu, uint64_t buffer_guest_ptr,
+                             uint64_t length, uint64_t offset, uint64_t index)
+{
+    uint8_t buf[MAX_FILE_TRANSACTION_LEN];
+
+    if (index >= MAX_FILE_FDS) {
+        abort();
+    }
+    int fd = file_fds[index];
+    if (-1 == fd) {
+        abort();
+    }
+    if (offset != lseek(fd, offset, SEEK_SET)) {
+        abort();
+    }
+    if (length > MAX_FILE_TRANSACTION_LEN) {
+        abort();
+    }
+    cpu_memory_rw_debug(cpu, buffer_guest_ptr, &buf[0], length, 0);
+    if (length != write(fd, &buf[0], length)) {
+        abort();
+    }
+
+    return 0;
+}
+
+int64_t qc_handle_read_file(CPUState *cpu, uint64_t buffer_guest_ptr,
+                            uint64_t length, uint64_t offset, uint64_t index)
+{
+    uint8_t buf[MAX_FILE_TRANSACTION_LEN];
+    if (index >= MAX_FILE_FDS) {
+        abort();
+    }
+    int fd = file_fds[index];
+    if (-1 == fd) {
+        abort();
+    }
+    if (offset != lseek(fd, offset, SEEK_SET)) {
+        abort();
+    }
+    if (length > MAX_FILE_TRANSACTION_LEN) {
+        abort();
+    }
+    if (length != read(fd, &buf[0], length)) {
+        abort();
+    }
+    cpu_memory_rw_debug(cpu, buffer_guest_ptr, &buf[0], length, 1);
+
+    return 0;
+}
+
+int64_t qc_handle_size_file(uint64_t index)
+{
+    struct stat st;
+
+    if (index >= MAX_FILE_FDS) {
+        abort();
+    }
+    int fd = file_fds[index];
+    if (-1 == fd) {
+        abort();
+    }
+    if (-1 == fstat(fd, &st)) {
+        abort();
+    }
+
+    return st.st_size;
+}

hw/arm/guest-services.c

@@ -0,0 +1,178 @@
+/*
+ * QEMU TCP Tunnelling
+ *
+ * Copyright (c) 2019 Lev Aronsky <[email protected]>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/boot.h"
+#include "exec/address-spaces.h"
+#include "hw/misc/unimp.h"
+#include "sysemu/sysemu.h"
+#include "qemu/error-report.h"
+#include "hw/platform-bus.h"
+#include "hw/arm/ipod_touch_2g.h"
+#include "cpu.h"
+
+int32_t guest_svcs_errno = 0;
+
+uint32_t qemu_call_status(CPUARMState *env)
+{
+    // NOT USED FOR NOW
+    return 0;
+}
+
+void qemu_call(CPUARMState *env, uint32_t value)
+{
+    CPUState *cpu = qemu_get_cpu(0);
+    qemu_call_t qcall;
+    uint64_t i = 0;
+
+/*    static uint8_t hooks_installed = false;
+
+    if (!value) {
+        // Special case: not a regular QEMU call. This is used by our
+        // kernel task port patch to notify of the readiness for the
+        // hook installation.
+
+        IPodTouchMachineState *nms = IPOD_TOUCH_MACHINE(qdev_get_machine());
+        KernelTrHookParams *hook = &nms->hook;
+
+        if (0 != hook->va) {
+            //install the hook here because we need the MMU to be already
+            //configured and all the memory mapped before installing the hook
+            xnu_hook_tr_copy_install(hook->va, hook->pa, hook->buf_va,
+                                     hook->buf_pa, hook->code, hook->code_size,
+                                     hook->buf_size, hook->scratch_reg);
+
+        }
+
+        if (!hooks_installed) {
+            for (i = 0; i < nms->hook_funcs_count; i++) {
+                xnu_hook_tr_copy_install(nms->hook_funcs[i].va,
+                                         nms->hook_funcs[i].pa,
+                                         nms->hook_funcs[i].buf_va,
+                                         nms->hook_funcs[i].buf_pa,
+                                         nms->hook_funcs[i].code,
+                                         nms->hook_funcs[i].code_size,
+                                         nms->hook_funcs[i].buf_size,
+                                         nms->hook_funcs[i].scratch_reg);
+            }
+            hooks_installed = true;
+        }
+
+        //emulate original opcode: str x20, [x23]
+        value = env->xregs[20];
+        cpu_memory_rw_debug(cpu, env->xregs[23], (uint8_t*) &value,
+                            sizeof(value), 1);
+
+        return;
+    }
+    */
+    // Read the request
+    cpu_memory_rw_debug(cpu, value, (uint8_t*) &qcall, sizeof(qcall), 0);
+
+    switch (qcall.call_number) {
+        // File Descriptors
+        case QC_CLOSE:
+            qcall.retval = qc_handle_close(cpu, qcall.args.close.fd);
+            break;
+        case QC_FCNTL:
+            switch (qcall.args.fcntl.cmd) {
+                case F_GETFL:
+                    qcall.retval = qc_handle_fcntl_getfl(
+                        cpu, qcall.args.fcntl.fd);
+                    break;
+                case F_SETFL:
+                    qcall.retval = qc_handle_fcntl_setfl(
+                        cpu, qcall.args.fcntl.fd, qcall.args.fcntl.flags);
+                    break;
+                default:
+                    guest_svcs_errno = EINVAL;
+                    qcall.retval = -1;
+            }
+            break;
+
+        // Socket API
+        case QC_SOCKET:
+            qcall.retval = qc_handle_socket(cpu, qcall.args.socket.domain,
+                                            qcall.args.socket.type,
+                                            qcall.args.socket.protocol);
+            break;
+        case QC_ACCEPT:
+            qcall.retval = qc_handle_accept(cpu, qcall.args.accept.socket,
+                                            qcall.args.accept.addr,
+                                            qcall.args.accept.addrlen);
+            break;
+        case QC_BIND:
+            qcall.retval = qc_handle_bind(cpu, qcall.args.bind.socket,
+                                          qcall.args.bind.addr,
+                                          qcall.args.bind.addrlen);
+            break;
+        case QC_CONNECT:
+            qcall.retval = qc_handle_connect(cpu, qcall.args.connect.socket,
+                                             qcall.args.connect.addr,
+                                             qcall.args.connect.addrlen);
+            break;
+        case QC_LISTEN:
+            qcall.retval = qc_handle_listen(cpu, qcall.args.listen.socket,
+                                            qcall.args.listen.backlog);
+            break;
+        case QC_RECV:
+            qcall.retval = qc_handle_recv(cpu, qcall.args.recv.socket,
+                                          qcall.args.recv.buffer,
+                                          qcall.args.recv.length,
+                                          qcall.args.recv.flags);
+            break;
+        case QC_SEND:
+            qcall.retval = qc_handle_send(cpu, qcall.args.send.socket,
+                                          qcall.args.send.buffer,
+                                          qcall.args.send.length,
+                                          qcall.args.send.flags);
+            break;
+        case QC_WRITE_FILE:
+            qcall.retval = qc_handle_write_file(cpu,
+                                       qcall.args.write_file.buffer_guest_ptr,
+                                       qcall.args.write_file.length,
+                                       qcall.args.write_file.offset,
+                                       qcall.args.write_file.index);
+            break;
+        case QC_READ_FILE:
+            qcall.retval = qc_handle_read_file(cpu,
+                                       qcall.args.read_file.buffer_guest_ptr,
+                                       qcall.args.read_file.length,
+                                       qcall.args.read_file.offset,
+                                       qcall.args.read_file.index);
+            break;
+        case QC_SIZE_FILE:
+            qcall.retval = qc_handle_size_file(qcall.args.size_file.index);
+            break;
+        default:
+            // TODO: handle unknown call numbers
+            break;
+    }
+
+    qcall.error = guest_svcs_errno;
+
+    // Write the response
+    cpu_memory_rw_debug(cpu, value, (uint8_t*) &qcall, sizeof(qcall), 1);
+}