From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1I3UtK-0003YA-Pi
	for qemu-devel@nongnu.org; Wed, 27 Jun 2007 06:36:54 -0400
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1I3UtK-0003Xm-17
	for qemu-devel@nongnu.org; Wed, 27 Jun 2007 06:36:54 -0400
Received: from [199.232.76.173] (helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1I3UtJ-0003Xg-SY
	for qemu-devel@nongnu.org; Wed, 27 Jun 2007 06:36:53 -0400
Received: from mail.gmx.net ([213.165.64.20])
	by monty-python.gnu.org with smtp (Exim 4.60)
	(envelope-from <clemens.kol@gmx.at>) id 1I3UtI-0000qE-SE
	for qemu-devel@nongnu.org; Wed, 27 Jun 2007 06:36:53 -0400
Message-ID: <46823781.50403@gmx.at>
Date: Wed, 27 Jun 2007 12:10:09 +0200
From: Clemens Kolbitsch <clemens.kol@gmx.at>
MIME-Version: 1.0
References: <20070614160402.14245gmx1@mx083.gmx.net> <468036C1.8070901@gmx.at>
In-Reply-To: <468036C1.8070901@gmx.at>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: [Qemu-devel] Re: sidt problem
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org

hi!
just wanted to post that i found out what is really the problem... 
obviously this is one of the restrictions in a virtual machine and thus 
not a "bug" (as most of you probably know already).

it'd still be cool if it could be fixed somehow... though this seems 
more of an academic thing than a programmer's job :-)

greets!

Clemens Kolbitsch wrote:
> hi everyone!
> i have a strange problem:
>
> i use the following code on my linux 2.6.20 (kubuntu debian, i386) to 
> dynamically get the location of the system-call table (as can also be 
> found in /proc/kallsyms --> "sys_call_table") as it is quite 
> interesting for new exploits ( :-)  )
>
> on a real cpu this works fine, however crashes in qemu... obviously 
> there is a bug somewhere. i have not found my way that deep into the 
> qemu source, so i cannot really help to find the bug.
>
> well, here is the code:
>
>    struct
>    {
>        unsigned short limit;
>        unsigned int base;
>    } __attribute__ ((packed)) idtr;
>
>    struct
>    {
>        unsigned short off1;
>        unsigned short sel;
>        unsigned char none, flags;
>        unsigned short off2;
>    } __attribute__ ((packed)) *igd;
>
>    unsigned long *sys_call;
>    unsigned char *pc;
>
>    // find idt_table
>    __asm__("sidt %0" : :"m"(idtr));
>
>    // find system_call
>    igd = idtr.base + 8 * 0x80;
>
>    // !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>    // the next line crashes
>    // !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>    sys_call = (igd->off2 << 16) | igd->off1;
>
>    // find sys_call_table
>    // ff 14 85 XX XX XX XX     call <sys_call_table>(,%eax,4)
>
>    sys_call_table = 0x0;
>    pc = (char*)sys_call;
>
>    // check the first 100 bytes in system_call
>    for (i = 0; i < 100; ++i)
>    {
>        if ((*(long*)++pc << 8) == 0x8514ff00)
>        {
>            sys_call_table = *(long*)(pc+3);
>            break;
>        }
>    }
>
>
> maybe, someone has time to look at this problem (by the way, i use the 
> same system inside qemu as on my laptop)
>
> greets!!
>