Problem running a task in ring 2 on x86

Problem running a task in ring 2 on x86

[Michael Weiss]

Hi,

I'm trying to get a process to ring level 2 on IA-32 architecture.
Therefore I have patched the modify_ldt syscall in ldt.c to generate a
new ldt entry with rpl 2 (patch below).

Now my problem is how to get the code segment with rpl2, located in
the ldt at index 0,
loaded by a syscall, so that the application is running in ring 2
after return of that syscall.

Under kernel 2.0.x the following seemed to do this, if ptr is a
pointer to a userstack allocated with malloc:

asmlinkage int sys_set_rpl(long ptr) {

   struct pt_regs *regs = (struct pt_regs *)&ptr;

   regs->cs = 0x6;  /* first entry of ldt with rpl2 */
   regs->ss = 0xE;  /* 2. entry of ldt with rpl2 */
   current->tss.ss2 = 0xE;
   current->tss.esp2 = ptr;

   return(0);

}

Now there is no tss per task and no hw context switch in the newer
kernels this isn't working in 2.6.

So if any of you have an idea to get a solution for that problem I
were very pleased.
I need this for an memory protection implementation in my bachelor thesis.


Thanks,
Michael

Here's the patch for modify_ldt:

diff -ru /usr/src/linux-2.6.22.5/arch/i386/kernel/ldt.c
arch/i386/kernel/ldt.c
--- /usr/src/linux-2.6.22.5/arch/i386/kernel/ldt.c      2007-08-23
01:23:54.000000000 +0200
+++ arch/i386/kernel/ldt.c      2007-10-21 22:29:12.000000000 +0200
@@ -172,7 +172,7 @@
        return err;
 }

-static int write_ldt(void __user * ptr, unsigned long bytecount, int
oldmode)
+static int write_ldt_mod(void __user * ptr, unsigned long bytecount,
int oldmode, int rpl)
 {
        struct mm_struct * mm = current->mm;
        __u32 entry_1, entry_2;
@@ -214,6 +214,11 @@

        entry_1 = LDT_entry_a(&ldt_info);
        entry_2 = LDT_entry_b(&ldt_info);
+
+       /* modify the rpl from 3 to 2 */
+       if (rpl == 2)
+               entry_2 &= ~(1 << 14);
+
        if (oldmode)
                entry_2 &= ~(1 << 20);

@@ -228,6 +233,10 @@
        return error;
 }

+static int write_ldt(void __user * ptr, unsigned long bytecount, int
oldmode) {
+       return write_ldt_mod(ptr, bytecount, oldmode, 3);
+}
+
 asmlinkage int sys_modify_ldt(int func, void __user *ptr, unsigned
long bytecount)
 {
        int ret = -ENOSYS;
@@ -245,6 +254,10 @@
        case 0x11:
                ret = write_ldt(ptr, bytecount, 0);
                break;
+       /* create new ldt entry with rpl 2 */
+       case 4:
+               ret = write_ldt_mod(ptr, bytecount, 0, 2);
+               break;
        }
        return ret;
 }