236
|
1 #include <string.h>
|
|
2 #include <stdlib.h>
|
|
3 #include <errno.h>
|
|
4 #include <fcntl.h>
|
|
5 #include <sys/mman.h>
|
|
6 #include <sys/types.h>
|
|
7 #include <stdio.h>
|
|
8 #include <unistd.h>
|
|
9
|
|
10 #ifdef __linux__
|
|
11 #include <asm/unistd.h>
|
|
12 #include <asm/ldt.h>
|
|
13 #else
|
|
14
|
|
15 #if defined(__NetBSD__) || defined(__FreeBSD__) || defined(__OpenBSD__)
|
|
16 #include <machine/sysarch.h>
|
|
17 #endif
|
|
18
|
|
19 #ifdef __svr4__
|
|
20 #include <sys/segment.h>
|
|
21 #include <sys/sysi86.h>
|
|
22 /* solaris x86: add missing prototype for sysi86() */
|
|
23 extern int sysi86(int, void*);
|
|
24 #define TEB_SEL_IDX NUMSYSLDTS
|
|
25 #endif
|
|
26
|
|
27 #define LDT_ENTRIES 8192
|
|
28 #define LDT_ENTRY_SIZE 8
|
|
29 #pragma pack(4)
|
|
30 struct modify_ldt_ldt_s {
|
|
31 unsigned int entry_number;
|
|
32 unsigned long base_addr;
|
|
33 unsigned int limit;
|
|
34 unsigned int seg_32bit:1;
|
|
35 unsigned int contents:2;
|
|
36 unsigned int read_exec_only:1;
|
|
37 unsigned int limit_in_pages:1;
|
|
38 unsigned int seg_not_present:1;
|
|
39 unsigned int useable:1;
|
|
40 };
|
|
41
|
|
42 #define MODIFY_LDT_CONTENTS_DATA 0
|
|
43 #define MODIFY_LDT_CONTENTS_STACK 1
|
|
44 #define MODIFY_LDT_CONTENTS_CODE 2
|
|
45 #endif
|
|
46
|
|
47
|
|
48 /* user level (privilege level: 3) ldt (1<<2) segment selector */
|
|
49 #define LDT_SEL(idx) ((idx) << 3 | 1 << 2 | 3)
|
|
50
|
|
51 #ifndef TEB_SEL_IDX
|
|
52 #define TEB_SEL_IDX 1
|
|
53 #endif
|
|
54
|
|
55 #define TEB_SEL LDT_SEL(TEB_SEL_IDX)
|
|
56
|
|
57 void setup_FS_Segment()
|
|
58 {
|
|
59 printf("Setup FS...");fflush(stdout);
|
|
60 __asm__ __volatile__(
|
|
61 "movl %0,%%eax; movw %%ax, %%fs" : : "i" (TEB_SEL)
|
|
62 );
|
|
63 printf("OK!\n");
|
|
64 }
|
|
65
|
|
66
|
|
67 /**
|
|
68 *
|
|
69 * This should be performed before we create first thread. See remarks
|
|
70 * for write_ldt(), linux/kernel/ldt.c.
|
|
71 *
|
|
72 */
|
|
73
|
|
74 static void* fs_seg=NULL;
|
|
75
|
|
76 #ifdef __linux__
|
|
77 /* XXX: why is this routine from libc redefined here? */
|
|
78 /* NOTE: the redefined version ignores the count param, count is hardcoded as 16 */
|
|
79 static int modify_ldt( int func, struct modify_ldt_ldt_s *ptr,
|
|
80 unsigned long count )
|
|
81 {
|
|
82 int res;
|
|
83 #ifdef __PIC__
|
|
84 __asm__ __volatile__( "pushl %%ebx\n\t"
|
|
85 "movl %2,%%ebx\n\t"
|
|
86 "int $0x80\n\t"
|
|
87 "popl %%ebx"
|
|
88 : "=a" (res)
|
|
89 : "0" (__NR_modify_ldt),
|
|
90 "r" (func),
|
|
91 "c" (ptr),
|
|
92 "d"(16)//sizeof(*ptr) from kernel point of view
|
|
93 :"esi" );
|
|
94 #else
|
|
95 __asm__ __volatile__("int $0x80"
|
|
96 : "=a" (res)
|
|
97 : "0" (__NR_modify_ldt),
|
|
98 "b" (func),
|
|
99 "c" (ptr),
|
|
100 "d"(16)
|
|
101 :"esi");
|
|
102 #endif /* __PIC__ */
|
|
103 if (res >= 0) return res;
|
|
104 errno = -res;
|
|
105 return -1;
|
|
106 }
|
|
107 #endif
|
|
108
|
|
109 #if defined(__NetBSD__) || defined(__FreeBSD__) || defined(__OpenBSD__)
|
|
110 static void LDT_EntryToBytes( unsigned long *buffer, const struct modify_ldt_ldt_s *content )
|
|
111 {
|
|
112 *buffer++ = ((content->base_addr & 0x0000ffff) << 16) |
|
|
113 (content->limit & 0x0ffff);
|
|
114 *buffer = (content->base_addr & 0xff000000) |
|
|
115 ((content->base_addr & 0x00ff0000)>>16) |
|
|
116 (content->limit & 0xf0000) |
|
|
117 (content->contents << 10) |
|
|
118 ((content->read_exec_only == 0) << 9) |
|
|
119 ((content->seg_32bit != 0) << 22) |
|
|
120 ((content->limit_in_pages != 0) << 23) |
|
|
121 0xf000;
|
|
122 }
|
|
123 #endif
|
|
124
|
|
125 void Setup_LDT_Keeper(){
|
|
126 struct modify_ldt_ldt_s array;
|
|
127 int fd;
|
|
128 int ret;
|
|
129 void* prev_struct;
|
|
130
|
|
131 if(fs_seg) return; // already set!
|
|
132
|
|
133 fd=open("/dev/zero", O_RDWR);
|
|
134 fs_seg=mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE, MAP_PRIVATE,
|
|
135 fd, 0);
|
|
136 if(fs_seg==(void*)-1)
|
|
137 {
|
|
138 perror("ERROR: Couldn't allocate memory for fs segment");
|
|
139 return;
|
|
140 }
|
|
141 array.base_addr=(int)fs_seg;
|
|
142 array.entry_number=TEB_SEL_IDX;
|
|
143 array.limit=array.base_addr+getpagesize()-1;
|
|
144 array.seg_32bit=1;
|
|
145 array.read_exec_only=0;
|
|
146 array.seg_not_present=0;
|
|
147 array.contents=MODIFY_LDT_CONTENTS_DATA;
|
|
148 array.limit_in_pages=0;
|
|
149 #ifdef __linux__
|
|
150 ret=modify_ldt(0x1, &array, sizeof(struct modify_ldt_ldt_s));
|
|
151 if(ret<0)
|
|
152 {
|
|
153 perror("install_fs");
|
|
154 printf("Couldn't install fs segment, expect segfault\n");
|
|
155 }
|
|
156 #endif /*linux*/
|
|
157
|
|
158 #if defined(__NetBSD__) || defined(__FreeBSD__) || defined(__OpenBSD__)
|
|
159 {
|
|
160 unsigned long d[2];
|
|
161
|
|
162 LDT_EntryToBytes( d, &array );
|
|
163 ret = i386_set_ldt(array.entry_number, (union descriptor *)d, 1);
|
|
164 if (ret < 0)
|
|
165 {
|
|
166 perror("install_fs");
|
|
167 printf("Couldn't install fs segment, expect segfault\n");
|
|
168 printf("Did you reconfigure the kernel with \"options USER_LDT\"?\n");
|
|
169 }
|
|
170 printf("Set_LDT\n");
|
|
171 }
|
|
172 #endif /* __NetBSD__ || __FreeBSD__ || __OpenBSD__ */
|
|
173
|
|
174 #if defined(__svr4__)
|
|
175 struct ssd ssd;
|
|
176 ssd.sel = TEB_SEL;
|
|
177 ssd.bo = array.base_addr;
|
|
178 ssd.ls = array.limit - array.base_addr;
|
|
179 ssd.acc1 = ((array.read_exec_only == 0) << 1) |
|
|
180 (array.contents << 2) |
|
|
181 0xf0; /* P(resent) | DPL3 | S */
|
|
182 ssd.acc2 = 0x4; /* byte limit, 32-bit segment */
|
|
183 if (sysi86(SI86DSCR, &ssd) < 0) {
|
|
184 perror("sysi86(SI86DSCR)");
|
|
185 printf("Couldn't install fs segment, expect segfault\n");
|
|
186 }
|
|
187 #endif
|
|
188
|
|
189 setup_FS_Segment();
|
|
190
|
|
191 prev_struct=malloc(8);
|
|
192 *(void**)array.base_addr=prev_struct;
|
|
193 close(fd);
|
|
194 }
|
|
195
|
|
196 void Restore_LDT_Keeper()
|
|
197 {
|
|
198 if(fs_seg==0) return;
|
|
199 munmap((char*)fs_seg, getpagesize());
|
|
200 }
|
|
201
|