Guest User

Untitled

a guest
Jul 22nd, 2018
89
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.80 KB | None | 0 0
  1. volatile int init_module() {
  2. unsigned long priv2_addr, problem_phys, local_store_phys, context_addr, shadow_addr, spe_id, vas;
  3.  
  4. lv1_get_virtual_address_space_id_of_ppe(0, &vas);
  5.  
  6. printk(KERN_ERR "die kernel %d\n", lv1_destruct_logical
  7.  
  8. printk(KERN_ERR "construct SPE: %d\n", lv1_construct_logical_spe(0x10,0x10,0x10,0x10,0x10, vas, 0, &priv2_addr, &problem_phys, &local_store_phys, &context_addr, &shadow_addr, &spe_id));
  9. boom_lpar(shadow_addr);
  10. printk(KERN_ERR "make SPE id: %d\n", spe_id);
  11. printk(KERN_ERR "enable SPE: %d\n", lv1_enable_logical_spe(spe_id, 0));
  12.  
  13.  
  14. unsigned long *problem_mapped, *privileged_mapped, *local_mapped;
  15.  
  16. problem_mapped =__ioremap((unsigned long)problem_phys, 0x20000, PAGE_SHARED_X);
  17. privileged_mapped =__ioremap((unsigned long)priv2_addr, 0x20000, PAGE_SHARED_X);
  18. local_mapped =__ioremap((unsigned long)local_store_phys, 0x40000, PAGE_SHARED_X);
  19.  
  20. printk(KERN_ERR "status: %lx\n", problem_mapped[0x4020/8]);
  21. printk(KERN_ERR "privileged control: %lx\n", privileged_mapped[0x4040/8]);
  22. privileged_mapped[0x4040/8] |= 4;
  23. printk(KERN_ERR "privileged control: %lx\n", privileged_mapped[0x4040/8]);
  24.  
  25. struct file* fd;
  26. mm_segment_t old_fs = get_fs();
  27. set_fs(KERNEL_DS);
  28. fd = filp_open("/work/pwned/metldr", O_RDONLY, 0);
  29. if(!IS_ERR(fd)) {
  30. printk(KERN_ERR "file is open\n");
  31. printk(KERN_ERR "read %d\n", fd->f_op->read(fd, local_mapped, 0x40000, &fd->f_pos));
  32. filp_close(fd, NULL);
  33. } else {
  34. printk(KERN_ERR "file open failed!!!!\n");
  35. }
  36. set_fs(old_fs);
  37. printk(KERN_ERR "read in metldr\n");
  38.  
  39. problem_mapped[0x4018/8] |= 3;
  40.  
  41. int i;
  42. for(i=0;i<0x20;i++) {
  43. printk(KERN_ERR "status: %lx\n", problem_mapped[0x4020/8]);
  44. }
  45. printk(KERN_ERR "destruct SPE: %d\n", lv1_destruct_logical_spe(spe_id));
  46.  
  47. return 0;
  48. }
Add Comment
Please, Sign In to add comment