Matthew Garrett: Using qemu to instrument Windows
Part of the problem that we face in providing Linux hardware support is that we're lucky if there's a spec, and even if there's a spec there almost certainly isn't a test suite. Linux still isn't high on the list of things that vendors test with, so as a result hardware and firmware tend to be written to work with Windows rather than some more ideal notion of what a spec actually says.This can lead to all kinds of problems. If the spec says we can do something and Windows never does that, we'll often find that there's at least one piece of hardware out there somewhere that breaks in response. But sometimes there'll be several different workarounds, and picking the wrong one may break some other system instead. It's helpful to know what Windows is actually doing, if only because that's the only configuration most systems have been tested with.
The problem is that doing this at the hardware level is next to impossible. I'm sure there are people out there who salivate at the possibility of working out i8042 initialisation sequences by hooking up oscilloscopes to their mouse, but I'm not one of them. There's a much easier alternative involving qemu.
The qemu source base is reasonably large and complex, but that's ok - we don't need to care about most of it. For our purposes we really only want to trace accesses to given bits of hardware. There's three main types of hardware access we're likely to care about: io ports, memory mapped io and pci configuration space. io ports are easy. Each piece of qemu that performs hardware emulation will call register_ioport_read or register_ioport_write. Just grep for those, find the ports that correspond to your hardware and then edit the functions to dump the information you want. PCI configuration space will be handled via pci_default_read_config or pci_default_write_config unless the driver overrides them. Finally, for PCI devices mmio will be handled via pci_register_bar - the last argument is the function called when the memory region is accessed.
All of which makes it pretty easy to watch register reads and writes performed by Windows when it's starting up. Suspend/resume is also an interesting problem, but sadly one that's harder to work with. First of all, you need at least version 0.6c of vgabios in order to indicate to Windows that it's possible to suspend at all. Secondly, for Vista or later you'll also need a WDDM driver for the graphics. Sadly there isn't one for the Cirrus that qemu emulates, which is unsurprising given how ancient it is. So I've had to perform my testing under XP, which was enough to give me an indication as to what Windows does with the SCI_EN bit on resume (answer: Ignores both the bit of the spec that says it should already be enabled and the bit of the spec that says it should never be written by hand). Nice, but if someone would like to write a WDDM driver for Cirrus it'd make my life easier.
The other thing I've been testing is keyboard controller probing. Some Macs deal badly with you banging on the keyboard controller, which is dumb but on the other hand they don't claim to have one. Linux will look at your ACPI tables and use any keyboard controllers it finds there, but if there isn't one it'll go on to try probing the legacy locations. Adding some debug code to the read and write functions of the keyboard driver in qemu and then editing the DSDT in Seabios to remove the declarations for the keyboard showed that Windows will only probe if there's a device with a recognised keyboard PNP ID. No keyboard for you if that's missing. So we probably need to emulate that behaviour as well.
The main reason to do this work is to try to reduce the number of DMI tables in the kernel. These are cases where we alter the kernel's behaviour based on the identity string of the hardware, allowing us to work around functional differences. The problem with this approach is that Windows generally works fine on these machines without knowing anything special about them, and chances are that the tables aren't exhaustive - there may well be some other piece of hardware that's also broken, but the user just gave up and went back to Windows instead of ever letting us know. Using qemu to work out how Windows actually behaves gives us the opportunity to fix things up in a way that will (with luck) work on all machines.
A scandal has been brewing in Latvia over the last half year and yesterday the activity spiked shocking the media and some IT people in the country. I ll go back and explain what happened first, what is happening now and why this could have a heavy impact on IT and journalists in Latvia.
At the end of last year, there were rumours that the IT system of Latvia s Internal Revenue System was hacked and millions of documents had been downloaded by multiple organizations. Shortly thereafter more details on the glaring security hole became public (after it was closed).
There is a full electronic interface to give all reports to the IRS electronically (at http://eds.vid.gov.lv) and as part of that system you could also view and export monthly report summaries about your organization into XML and PDF files. After the system checked that you are authorized to access the report, you were redirected to the URL to actually download the report by report ID (as a single param in a GET request). Unfortunately, report IDs were predicable and the script that gave the reports for download did not check if you were authorized to get that report. It did not even check if were logged into the system.
There were suspicions that the authorization was disabled on purpose to allow to leak data on purpose, but apparently it was an error of forgetting to disable debug code in production environment.
The error was discovered only because the firewall administrator noticed an unexplained stable increase of traffic, especially during night hours when typically the traffic fully stopped. Apparently a single hacker (who later identified himself as Neo to the press) discovered the flaw and wrote a script to just try all possible report ids and get as much data out as possible. This had been going on for months, before someone noticed.
After the flaw was discovered and a bit of time passed, Neo made his first move he published the list of top salaries in a governmental company, that clearly showed that the top leadership of this company failed to cut their salary by 40%, like everyone elses during harsh budget cuts of 2009. He stripped the names and ids of the specific employees, but named the company which made it pretty easy to figure out who was who.
The society was outraged that the top managers in a government owned company failed to comply with the strict pay cut that everyone else in government had to endure. But after a few weeks the outrage subsided and no action followed from the government or law enforcement.
Neo continued to release documents detailing salaries of top managers in different Latvian government companies. And each time after short outrage, nothing happened. Neo gave an interview where he said that he was disappointed in the passivity of the Latvian people in face of such blatant injustices.
After a few month Neo went silent, promising to return before parliamentary elections this fall.
However, this week a new development shocked everyone in the middle of the night two police SWAT teams went into action: one detained Ilm rs Poik ns, a researcher in artificial intelligence at the University of Latvia s Computer Science department and another raided the home of a Latvian TV journalist Ilze Nagle who interviewed Neo. Poik ns confessed of being Neo the next day and was released (with travel restrictions, pending trial) today.
Politicians reacted immediately opposition demanded the resignation of the Interior Minister over such blatant disregard of freedom of press and another politician (who is also a famous lawyer) Aleksejs Loskutovs volunteered to defend Neo pro-bono (on Twitter, no less). Almost all Latvian online media have the arrest of Neo and the raid on the home of a journalist as main stories of the day.
As a legal titbit, we also know that Neo is being charged with breaking statutes 145 and and 244p2 of the criminal law. Statute 145 is hard to find applicable in this situation as talks about actions done by people authorized (..) to access [private] information . Statute 244p2 will also be hard to pin down as it mentions influencing system resources of (an IT system) and if such action caused severe harm . It looks like the first part talks about at least a DoS attack (which did not happen in this case) and also there was no measurable harm from these leaks.
Also Neo was careful to strip all personally identifying information (such as names, social security numbers and addresses of the employees in question), so it will be hard to pin him on that. Also no actual breaking or other modification of an IT system occurred. And no specialized software was used beyond a trivial script such as :
Weeks ago, I was at a TravelWatchSW meeting in Taunton for 
Zoe's a week old today. As such things tend to do, this feels like both an
eternity and no time at all.
We've been back to the paediatrician twice since I last blogged. Zoe's
weight is now on the increase again. Today she weighed in at 6 lbs 3 oz
(2806 grams) (I think. My brain has gone a bit fuzzy)
We're largely sticking with bottle feeding pumped breast milk for now.
Apparently 7 lbs is the magic size where they've got enough strength to feed
exclusively at the breast.
Sleep-wise, I think we're all doing reasonably well. Zoe just eats, sleeps
and poops. Sometimes we need to wake her up to have a feed. I think the
longest we've let her got is 4.5 hours. She's taking a lot of milk at each
feeding session - up to 90 mL, so I expect that she'll have blasted past her
birth weight by the time she's two weeks old.
It'll be good when she's exclusively breastfeeding. The current regime is a
little bit tiring. Zoe wakes up (or gets woken up). I change her diaper and
give her a bottle. Sarah tries a little bit of breastfeeding. I put Zoe back
in her crib. Sarah pumps some milk for the next feeding session, and I go
and wash and sterilise bottles and pumping paraphernalia.
If Zoe's feeding every three hours, this only really gives us two hours to
get anything else done.
Not that I'm complaining, mind you. At the paediatrician's this morning,
there was another father with the same LPCH diaper bag that we'd received
while we were in the hospital. Turned out he had a two-week old boy. I asked
how the sleep levels were going, and he exclaimed about how they were only
getting 2.5 hours at a time, and his son would raise the roof. I mentioned
the 4.5 hour stint that we'd managed to have, and he was totally gobsmacked.
In other news, it seems like Sarah has a bit of UTI, which has totally wiped
her out this afternoon. She got a 3 day course of antibiotics this
afternoon, so hopefully that'll fix her up.
the usual short overview about my RC bug activities:
I woke up with a loud BZZZT It happens every couple of years. The electric transformer for the circuit where my house is located, at the Northern edge of Ciudad Universitaria, decided to die (or at least, to take a break literally).
About one hour later, I decided it was time to wake up and start being a useful person. I gave breakfast to my cats and had breakfast myself, and called the electrical company to report this mishap. They told me the report was registered, and I hope to have electricity soon (meanwhile, I'm sitting at a nearby restaurant, as there is some job to do Yes, besides writing blog entries). And they told me, as is often told in Mexico, a general anticorruption phrase With a twist: recuerde que usted no debe renumerar ning n servicio que realice el personal de la Comisi n Federal de Electricidad . (You should not renumber any service done by the Federal Electrical Commission personnel). Yes, remunerado (not renumerado).
This shows once again the power of asking people to read things they don't understand.
As I work for Accenture now, I got them to pay for the plane tickets and also spring for the Professional registration, so more people can attend. I am very happy, and very grateful to the company and to the managers here in Riga office for being so very supportive. It is refreshing to see that even a large corporation can be quite nimble.
I hope I can get on a direct Riga New York flight (there actually is one, once a week, by Uzbekistan Airways) which would be a wicked cool way to save travel time and worries. This might even be faster end-to-end than last year going to Spain (via Frankfurt). Now I only need to replace my passport with the new biometric one, to qualify for USA Visa Waiver and I ll be good to go 
Facebook recently launched the "Like" function, which basically can be
embedded into arbitrary web sites. Naively, it does two things:
How does one define one's "national identity"?
One way is to look at where a person is born. By that definion, I
could be called Flemish, Belgian, or European, whatever you think about
it.
Another way to look at it is how one feels about one's own identity.
This, of course, is a much more accurate way to describe a person; and
by that definition, I am either Belgian or European. I do not feel any
affinity with much of the so-called "flemish" identity, nor do I wish to
be associated with it any more than is strictly necessary. Obviously,
some people feel different about that for themselves.
This I can understand.
In fact, the statement to feel more Belgian than Flemish is probably
not one that is very common in this general area. I am not stupid; I
know that Belgium is not a