236
|
1 #include <string.h>
|
|
2 #include <stdlib.h>
|
|
3 #include <errno.h>
|
|
4 #include <fcntl.h>
|
|
5 #include <sys/mman.h>
|
|
6 #include <sys/types.h>
|
|
7 #include <stdio.h>
|
|
8 #include <unistd.h>
|
|
9
|
|
10 #ifdef __linux__
|
|
11 #include <asm/unistd.h>
|
|
12 #include <asm/ldt.h>
|
|
13 #else
|
|
14
|
|
15 #if defined(__NetBSD__) || defined(__FreeBSD__) || defined(__OpenBSD__)
|
|
16 #include <machine/sysarch.h>
|
|
17 #endif
|
|
18
|
|
19 #ifdef __svr4__
|
|
20 #include <sys/segment.h>
|
|
21 #include <sys/sysi86.h>
|
|
22 /* solaris x86: add missing prototype for sysi86() */
|
|
23 extern int sysi86(int, void*);
|
|
24 #define TEB_SEL_IDX NUMSYSLDTS
|
|
25 #endif
|
|
26
|
|
27 #define LDT_ENTRIES 8192
|
|
28 #define LDT_ENTRY_SIZE 8
|
|
29 #pragma pack(4)
|
|
30 struct modify_ldt_ldt_s {
|
|
31 unsigned int entry_number;
|
|
32 unsigned long base_addr;
|
|
33 unsigned int limit;
|
|
34 unsigned int seg_32bit:1;
|
|
35 unsigned int contents:2;
|
|
36 unsigned int read_exec_only:1;
|
|
37 unsigned int limit_in_pages:1;
|
|
38 unsigned int seg_not_present:1;
|
|
39 unsigned int useable:1;
|
|
40 };
|
|
41
|
|
42 #define MODIFY_LDT_CONTENTS_DATA 0
|
|
43 #define MODIFY_LDT_CONTENTS_STACK 1
|
|
44 #define MODIFY_LDT_CONTENTS_CODE 2
|
|
45 #endif
|
|
46
|
|
47
|
|
48 /* user level (privilege level: 3) ldt (1<<2) segment selector */
|
|
49 #define LDT_SEL(idx) ((idx) << 3 | 1 << 2 | 3)
|
|
50
|
|
51 #ifndef TEB_SEL_IDX
|
|
52 #define TEB_SEL_IDX 1
|
|
53 #endif
|
|
54
|
|
55 #define TEB_SEL LDT_SEL(TEB_SEL_IDX)
|
|
56
|
|
57 void setup_FS_Segment()
|
|
58 {
|
340
|
59 #ifdef DETAILED_OUT
|
236
|
60 printf("Setup FS...");fflush(stdout);
|
340
|
61 #endif
|
236
|
62 __asm__ __volatile__(
|
|
63 "movl %0,%%eax; movw %%ax, %%fs" : : "i" (TEB_SEL)
|
|
64 );
|
340
|
65 #ifdef DETAILED_OUT
|
236
|
66 printf("OK!\n");
|
340
|
67 #endif
|
236
|
68 }
|
|
69
|
|
70
|
|
71 /**
|
|
72 *
|
|
73 * This should be performed before we create first thread. See remarks
|
|
74 * for write_ldt(), linux/kernel/ldt.c.
|
|
75 *
|
|
76 */
|
|
77
|
|
78 static void* fs_seg=NULL;
|
|
79
|
|
80 #ifdef __linux__
|
|
81 /* XXX: why is this routine from libc redefined here? */
|
|
82 /* NOTE: the redefined version ignores the count param, count is hardcoded as 16 */
|
|
83 static int modify_ldt( int func, struct modify_ldt_ldt_s *ptr,
|
|
84 unsigned long count )
|
|
85 {
|
|
86 int res;
|
|
87 #ifdef __PIC__
|
|
88 __asm__ __volatile__( "pushl %%ebx\n\t"
|
|
89 "movl %2,%%ebx\n\t"
|
|
90 "int $0x80\n\t"
|
|
91 "popl %%ebx"
|
|
92 : "=a" (res)
|
|
93 : "0" (__NR_modify_ldt),
|
|
94 "r" (func),
|
|
95 "c" (ptr),
|
|
96 "d"(16)//sizeof(*ptr) from kernel point of view
|
|
97 :"esi" );
|
|
98 #else
|
|
99 __asm__ __volatile__("int $0x80"
|
|
100 : "=a" (res)
|
|
101 : "0" (__NR_modify_ldt),
|
|
102 "b" (func),
|
|
103 "c" (ptr),
|
|
104 "d"(16)
|
|
105 :"esi");
|
|
106 #endif /* __PIC__ */
|
|
107 if (res >= 0) return res;
|
|
108 errno = -res;
|
|
109 return -1;
|
|
110 }
|
|
111 #endif
|
|
112
|
|
113 #if defined(__NetBSD__) || defined(__FreeBSD__) || defined(__OpenBSD__)
|
|
114 static void LDT_EntryToBytes( unsigned long *buffer, const struct modify_ldt_ldt_s *content )
|
|
115 {
|
|
116 *buffer++ = ((content->base_addr & 0x0000ffff) << 16) |
|
|
117 (content->limit & 0x0ffff);
|
|
118 *buffer = (content->base_addr & 0xff000000) |
|
|
119 ((content->base_addr & 0x00ff0000)>>16) |
|
|
120 (content->limit & 0xf0000) |
|
|
121 (content->contents << 10) |
|
|
122 ((content->read_exec_only == 0) << 9) |
|
|
123 ((content->seg_32bit != 0) << 22) |
|
|
124 ((content->limit_in_pages != 0) << 23) |
|
|
125 0xf000;
|
|
126 }
|
|
127 #endif
|
|
128
|
|
129 void Setup_LDT_Keeper(){
|
|
130 struct modify_ldt_ldt_s array;
|
|
131 int fd;
|
|
132 int ret;
|
|
133 void* prev_struct;
|
|
134
|
|
135 if(fs_seg) return; // already set!
|
|
136
|
|
137 fd=open("/dev/zero", O_RDWR);
|
|
138 fs_seg=mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE, MAP_PRIVATE,
|
|
139 fd, 0);
|
|
140 if(fs_seg==(void*)-1)
|
|
141 {
|
|
142 perror("ERROR: Couldn't allocate memory for fs segment");
|
|
143 return;
|
|
144 }
|
|
145 array.base_addr=(int)fs_seg;
|
|
146 array.entry_number=TEB_SEL_IDX;
|
|
147 array.limit=array.base_addr+getpagesize()-1;
|
|
148 array.seg_32bit=1;
|
|
149 array.read_exec_only=0;
|
|
150 array.seg_not_present=0;
|
|
151 array.contents=MODIFY_LDT_CONTENTS_DATA;
|
|
152 array.limit_in_pages=0;
|
|
153 #ifdef __linux__
|
|
154 ret=modify_ldt(0x1, &array, sizeof(struct modify_ldt_ldt_s));
|
|
155 if(ret<0)
|
|
156 {
|
|
157 perror("install_fs");
|
|
158 printf("Couldn't install fs segment, expect segfault\n");
|
|
159 }
|
|
160 #endif /*linux*/
|
|
161
|
|
162 #if defined(__NetBSD__) || defined(__FreeBSD__) || defined(__OpenBSD__)
|
|
163 {
|
|
164 unsigned long d[2];
|
|
165
|
|
166 LDT_EntryToBytes( d, &array );
|
|
167 ret = i386_set_ldt(array.entry_number, (union descriptor *)d, 1);
|
|
168 if (ret < 0)
|
|
169 {
|
|
170 perror("install_fs");
|
|
171 printf("Couldn't install fs segment, expect segfault\n");
|
|
172 printf("Did you reconfigure the kernel with \"options USER_LDT\"?\n");
|
|
173 }
|
|
174 printf("Set_LDT\n");
|
|
175 }
|
|
176 #endif /* __NetBSD__ || __FreeBSD__ || __OpenBSD__ */
|
|
177
|
|
178 #if defined(__svr4__)
|
|
179 struct ssd ssd;
|
|
180 ssd.sel = TEB_SEL;
|
|
181 ssd.bo = array.base_addr;
|
|
182 ssd.ls = array.limit - array.base_addr;
|
|
183 ssd.acc1 = ((array.read_exec_only == 0) << 1) |
|
|
184 (array.contents << 2) |
|
|
185 0xf0; /* P(resent) | DPL3 | S */
|
|
186 ssd.acc2 = 0x4; /* byte limit, 32-bit segment */
|
|
187 if (sysi86(SI86DSCR, &ssd) < 0) {
|
|
188 perror("sysi86(SI86DSCR)");
|
|
189 printf("Couldn't install fs segment, expect segfault\n");
|
|
190 }
|
|
191 #endif
|
|
192
|
|
193 setup_FS_Segment();
|
|
194
|
|
195 prev_struct=malloc(8);
|
|
196 *(void**)array.base_addr=prev_struct;
|
|
197 close(fd);
|
|
198 }
|
|
199
|
|
200 void Restore_LDT_Keeper()
|
|
201 {
|
|
202 if(fs_seg==0) return;
|
|
203 munmap((char*)fs_seg, getpagesize());
|
|
204 }
|
|
205
|