Re: address of int80 idt

Re: address of int80 idt

[Petr Vandrovec]

On 15 Jul 04 at 18:27, bugghy wrote:
> 
> The problem is that on some kernels 2.4.22 (and I think on 2.6.7, 2.2.26
> and 2.4.26 too) on vmware sidt returns a bogus address for idtr.base:
> idtr.base=0xffc6a370 (2.4.22) 
> 
> If I try to read from /dev/kmem from this address it doesn't work.

It is feature, not a bug... Well, it is bug, but not easily fixable.
Either check 'Disable acceleration' checkbox in VM configuration, or,
if you want portable solution (if your program has root privileges), call 
iopl(3) before issuing sidt. Or issue sidt in the kernel, not in userspace.
                                                        Best regards,
                                                            Petr Vandrovec
                                                            

address of int80 idt

[bugghy]

[-- Attachment #1: Type: text/plain, Size: 1301 bytes --]


	Hy, I'm working on an improved rk detector and I've got some problems.
I use this code to get the address of int80's idt (interrupt description
table)

struct idtr
{
  unsigned short limit;
  unsigned int base;
} __attribute__ ((packed));


void find_int80()
{
  struct idtr idtr;
  memset(&idtr, 0, sizeof(struct idtr));
  asm ("sidt %0" : "=m" (idtr));
  printf("idtr.base=0x%08x\n", idtr.base);
  kmem_read(fd, &idt, sizeof(idt), idtr.base + 0x80 * sizeof(struct
idt));
  ...
}

The problem is that on some kernels 2.4.22 (and I think on 2.6.7, 2.2.26
and 2.4.26 too) on vmware sidt returns a bogus address for idtr.base:
idtr.base=0xffc6a370 (2.4.22) 


If I try to read from /dev/kmem from this address it doesn't work.

I printed the contents of struct idtr after the sidt call, here it is:
ff 07 70 a3 c6 ff

What could be the problem? Is there any solution for this? Most of the
time works but not on my (2.4.22) vmware. And if this is not a bug, what
would be another method of doing this ?

PS: Please cc me the answer as I'm not on this mailling list.

	Thanks in advance,
		Bugghy


-- 
------------------------
- Software is like sex -
-     it's better when -
-          it's free   -
-     Linus Torvalds   -
------------------------

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 187 bytes --]