X-Authentication-Warning:	delorie.com: mail set sender to djgpp-bounces using -f
From:	RayeR <glaux AT centrum DOT cz>
Newsgroups:	comp.os.msdos.djgpp
Subject:	Re: running ring0 code under DJGPP
Date:	Sun, 02 Sep 2007 10:19:58 -0700
Organization:	http://groups.google.com
Lines:	28
Message-ID:	<1188753598.507918.144880@k79g2000hse.googlegroups.com>
References:	<1188419914 DOT 751897 DOT 124870 AT k79g2000hse DOT googlegroups DOT com>
	<46dadebd$0$7704$9b4e6d93 AT newsspool2 DOT arcor-online DOT net>
NNTP-Posting-Host:	89.176.103.156
Mime-Version:	1.0
X-Trace:	posting.google.com 1188753598 6939 127.0.0.1 (2 Sep 2007 17:19:58 GMT)
X-Complaints-To:	groups-abuse AT google DOT com
NNTP-Posting-Date:	Sun, 2 Sep 2007 17:19:58 +0000 (UTC)
In-Reply-To:	<46dadebd$0$7704$9b4e6d93@newsspool2.arcor-online.net>
User-Agent:	G2/1.0
X-HTTP-UserAgent:	Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.1.6) Gecko/20070802 SeaMonkey/1.1.4,gzip(gfe),gzip(gfe)
Complaints-To:	groups-abuse AT google DOT com
Injection-Info:	k79g2000hse.googlegroups.com; posting-host=89.176.103.156;
	posting-account=ps2QrAMAAAA6_jCuRt2JEIpn5Otqf_w0
To:	djgpp AT delorie DOT com
DJ-Gateway:	from newsgroup comp.os.msdos.djgpp
Reply-To:	djgpp AT delorie DOT com
Errors-To:	nobody AT delorie DOT com
X-Mailing-List:	djgpp AT delorie DOT com
X-Unsubscribes-To:	listserv AT delorie DOT com

BTW I found that
__dpmi_set_descriptor(ldt_cgsel,&ldt_callgate_descriptor);
DJGPP function works wrong way! I allocated LDT descriptor with
ldt_cgsel=__dpmi_allocate_ldt_descriptors(1)
and prepared descriptor structure with all needed attributes like
pl=3, system=0, sel:offset etc.
call __dpmi_set_descriptor() to transfer local structure to LDT but
when I read LDT entry back
it was not exact as I set. System bit was set 1 and could be 0.
So then I used movedata(_my_ds(),
(DWord)p_ldt_callgate_descriptor,ldt_ldtsel,ldt_callgate_selector.index*8,8);
to copy structure into LDT entry;

So now I can create and set various segments/callgates in LDT
my idea is:
1) crate CS alias segment but with DPL=0, execute-read to hold my
ring0 code (part of my whole program)
2) create CS alias selector pointing CS alias descriptor. Then
CS_alias:offset would be regular pointer to ring0 code
3) create callgate in LDT, PL=3, execute-only-conforming pointing the
CS_alias:offset where offset is pointer to inline
assembly ring0 code rdmsr ending with retf
4) create callgate selector pointing LDT callgate descriptor with PL=3
5) make far PM pointer consist of callgate selector:zero offset
6) call this PM pointer

result: crashed with GPF :(

- Raw text -