472 lines
9.9 KiB
PHP
472 lines
9.9 KiB
PHP
;; -----------------------------------------------------------------------
|
|
;;
|
|
;; Copyright 1994-2009 H. Peter Anvin - All Rights Reserved
|
|
;; Copyright 2009 Intel Corporation; author: H. Peter Anvin
|
|
;;
|
|
;; This program is free software; you can redistribute it and/or modify
|
|
;; it under the terms of the GNU General Public License as published by
|
|
;; the Free Software Foundation, Inc., 53 Temple Place Ste 330,
|
|
;; Boston MA 02111-1307, USA; either version 2 of the License, or
|
|
;; (at your option) any later version; incorporated herein by reference.
|
|
;;
|
|
;; -----------------------------------------------------------------------
|
|
|
|
;;
|
|
;; pm.inc
|
|
;;
|
|
;; Functions to enter and exit 32-bit protected mode, handle interrupts
|
|
;; and cross-mode calls.
|
|
;;
|
|
;; PM refers to 32-bit flat protected mode; RM to 16-bit real mode.
|
|
;;
|
|
|
|
bits 16
|
|
section .text16
|
|
;
|
|
; _pm_call: call PM routine in low memory from RM
|
|
;
|
|
; on stack = PM routine to call (a 32-bit address)
|
|
;
|
|
; ECX, ESI, EDI passed to the called function;
|
|
; EAX = EBP in the called function points to the stack frame
|
|
; which includes all registers (which can be changed if desired.)
|
|
;
|
|
; All registers and the flags saved/restored
|
|
;
|
|
; This routine is invoked by the pm_call macro.
|
|
;
|
|
_pm_call:
|
|
pushfd
|
|
pushad
|
|
push ds
|
|
push es
|
|
push fs
|
|
push gs
|
|
mov bp,sp
|
|
mov ax,cs
|
|
mov ebx,.pm
|
|
mov ds,ax
|
|
jmp enter_pm
|
|
|
|
bits 32
|
|
section .textnr
|
|
.pm:
|
|
; EAX points to the top of the RM stack, which is EFLAGS
|
|
test RM_FLAGSH,02h ; RM EFLAGS.IF
|
|
jz .no_sti
|
|
sti
|
|
.no_sti:
|
|
call [ebp+4*2+9*4+2] ; Entrypoint on RM stack
|
|
mov bx,.rm
|
|
jmp enter_rm
|
|
|
|
bits 16
|
|
section .text16
|
|
.rm:
|
|
pop gs
|
|
pop fs
|
|
pop es
|
|
pop ds
|
|
popad
|
|
popfd
|
|
ret 4 ; Drop entrypoint
|
|
|
|
;
|
|
; enter_pm: Go to PM with interrupt service configured
|
|
; EBX = PM entry point
|
|
; EAX = EBP = on exit, points to the RM stack as a 32-bit value
|
|
; ECX, EDX, ESI, EDI preserved across this routine
|
|
;
|
|
; Assumes CS == DS
|
|
;
|
|
; This routine doesn't enable interrupts, but the target routine
|
|
; can enable interrupts by executing STI.
|
|
;
|
|
bits 16
|
|
section .text16
|
|
enter_pm:
|
|
cli
|
|
xor eax,eax
|
|
mov ds,ax
|
|
mov ax,ss
|
|
mov [RealModeSSSP],sp
|
|
mov [RealModeSSSP+2],ax
|
|
movzx ebp,sp
|
|
shl eax,4
|
|
add ebp,eax ; EBP -> top of real-mode stack
|
|
cld
|
|
call enable_a20
|
|
|
|
.a20ok:
|
|
mov byte [bcopy_gdt.TSS+5],89h ; Mark TSS unbusy
|
|
|
|
lgdt [bcopy_gdt] ; We can use the same GDT just fine
|
|
lidt [PM_IDT_ptr] ; Set up the IDT
|
|
mov eax,cr0
|
|
or al,1
|
|
mov cr0,eax ; Enter protected mode
|
|
jmp PM_CS32:.in_pm
|
|
|
|
bits 32
|
|
section .textnr
|
|
.in_pm:
|
|
xor eax,eax ; Available for future use...
|
|
mov fs,eax
|
|
mov gs,eax
|
|
lldt ax
|
|
|
|
mov al,PM_DS32 ; Set up data segments
|
|
mov es,eax
|
|
mov ds,eax
|
|
mov ss,eax
|
|
|
|
mov al,PM_TSS ; Be nice to Intel's VT by
|
|
ltr ax ; giving it a valid TR
|
|
|
|
mov esp,[PMESP] ; Load protmode %esp
|
|
mov eax,ebp ; EAX -> top of real-mode stack
|
|
jmp ebx ; Go to where we need to go
|
|
|
|
;
|
|
; enter_rm: Return to RM from PM
|
|
;
|
|
; BX = RM entry point (CS = 0)
|
|
; ECX, EDX, ESI, EDI preserved across this routine
|
|
; EAX clobbered
|
|
; EBP reserved
|
|
;
|
|
; This routine doesn't enable interrupts, but the target routine
|
|
; can enable interrupts by executing STI.
|
|
;
|
|
bits 32
|
|
section .textnr
|
|
enter_rm:
|
|
cli
|
|
cld
|
|
mov [PMESP],esp ; Save exit %esp
|
|
jmp PM_CS16:.in_pm16 ; Return to 16-bit mode first
|
|
|
|
bits 16
|
|
section .text16
|
|
.in_pm16:
|
|
mov ax,PM_DS16 ; Real-mode-like segment
|
|
mov es,ax
|
|
mov ds,ax
|
|
mov ss,ax
|
|
mov fs,ax
|
|
mov gs,ax
|
|
|
|
lidt [RM_IDT_ptr] ; Real-mode IDT (rm needs no GDT)
|
|
xor dx,dx
|
|
mov eax,cr0
|
|
and al,~1
|
|
mov cr0,eax
|
|
jmp 0:.in_rm
|
|
|
|
.in_rm: ; Back in real mode
|
|
lss sp,[cs:RealModeSSSP] ; Restore stack
|
|
movzx esp,sp ; Make sure the high bits are zero
|
|
mov ds,dx ; Set up sane segments
|
|
mov es,dx
|
|
mov fs,dx
|
|
mov gs,dx
|
|
jmp bx ; Go to whereever we need to go...
|
|
|
|
section .data16
|
|
alignz 4
|
|
|
|
extern __stack_end
|
|
PMESP dd __stack_end ; Protected-mode ESP
|
|
|
|
PM_IDT_ptr: dw 8*256-1 ; Length
|
|
dd IDT ; Offset
|
|
|
|
;
|
|
; This is invoked on getting an interrupt in protected mode. At
|
|
; this point, we need to context-switch to real mode and invoke
|
|
; the interrupt routine.
|
|
;
|
|
; When this gets invoked, the registers are saved on the stack and
|
|
; AL contains the register number.
|
|
;
|
|
bits 32
|
|
section .textnr
|
|
pm_irq:
|
|
pushad
|
|
movzx esi,byte [esp+8*4] ; Interrupt number
|
|
inc dword [CallbackCtr]
|
|
mov ebx,.rm
|
|
jmp enter_rm ; Go to real mode
|
|
|
|
bits 16
|
|
section .text16
|
|
.rm:
|
|
pushf ; Flags on stack
|
|
call far [cs:esi*4] ; Call IVT entry
|
|
mov ebx,.pm
|
|
jmp enter_pm ; Go back to PM
|
|
|
|
bits 32
|
|
section .textnr
|
|
.pm:
|
|
dec dword [CallbackCtr]
|
|
jnz .skip
|
|
call [core_pm_hook]
|
|
.skip:
|
|
popad
|
|
add esp,4 ; Drop interrupt number
|
|
iretd
|
|
|
|
;
|
|
; Initially, the core_pm_hook does nothing; it is available for the
|
|
; threaded derivatives to run the scheduler, or examine the result from
|
|
; interrupt routines.
|
|
;
|
|
global core_pm_null_hook
|
|
core_pm_null_hook:
|
|
ret
|
|
|
|
section .data16
|
|
alignz 4
|
|
global core_pm_hook
|
|
core_pm_hook: dd core_pm_null_hook
|
|
|
|
bits 16
|
|
section .text16
|
|
;
|
|
; Routines to enable and disable (yuck) A20. These routines are gathered
|
|
; from tips from a couple of sources, including the Linux kernel and
|
|
; http://www.x86.org/. The need for the delay to be as large as given here
|
|
; is indicated by Donnie Barnes of RedHat, the problematic system being an
|
|
; IBM ThinkPad 760EL.
|
|
;
|
|
|
|
section .data16
|
|
alignz 2
|
|
A20Ptr dw a20_dunno
|
|
|
|
section .bss16
|
|
alignb 4
|
|
A20Test resd 1 ; Counter for testing A20 status
|
|
A20Tries resb 1 ; Times until giving up on A20
|
|
|
|
section .text16
|
|
enable_a20:
|
|
pushad
|
|
mov byte [cs:A20Tries],255 ; Times to try to make this work
|
|
|
|
try_enable_a20:
|
|
|
|
;
|
|
; First, see if we are on a system with no A20 gate, or the A20 gate
|
|
; is already enabled for us...
|
|
;
|
|
a20_none:
|
|
call a20_test
|
|
jnz a20_done
|
|
; Otherwise, see if we had something memorized...
|
|
jmp word [cs:A20Ptr]
|
|
|
|
;
|
|
; Next, try the BIOS (INT 15h AX=2401h)
|
|
;
|
|
a20_dunno:
|
|
a20_bios:
|
|
mov word [cs:A20Ptr], a20_bios
|
|
mov ax,2401h
|
|
pushf ; Some BIOSes muck with IF
|
|
int 15h
|
|
popf
|
|
|
|
call a20_test
|
|
jnz a20_done
|
|
|
|
;
|
|
; Enable the keyboard controller A20 gate
|
|
;
|
|
a20_kbc:
|
|
mov dl, 1 ; Allow early exit
|
|
call empty_8042
|
|
jnz a20_done ; A20 live, no need to use KBC
|
|
|
|
mov word [cs:A20Ptr], a20_kbc ; Starting KBC command sequence
|
|
|
|
mov al,0D1h ; Write output port
|
|
out 064h, al
|
|
call empty_8042_uncond
|
|
|
|
mov al,0DFh ; A20 on
|
|
out 060h, al
|
|
call empty_8042_uncond
|
|
|
|
; Apparently the UHCI spec assumes that A20 toggle
|
|
; ends with a null command (assumed to be for sychronization?)
|
|
; Put it here to see if it helps anything...
|
|
mov al,0FFh ; Null command
|
|
out 064h, al
|
|
call empty_8042_uncond
|
|
|
|
; Verify that A20 actually is enabled. Do that by
|
|
; observing a word in low memory and the same word in
|
|
; the HMA until they are no longer coherent. Note that
|
|
; we don't do the same check in the disable case, because
|
|
; we don't want to *require* A20 masking (SYSLINUX should
|
|
; work fine without it, if the BIOS does.)
|
|
.kbc_wait: push cx
|
|
xor cx,cx
|
|
.kbc_wait_loop:
|
|
call a20_test
|
|
jnz a20_done_pop
|
|
loop .kbc_wait_loop
|
|
|
|
pop cx
|
|
;
|
|
; Running out of options here. Final attempt: enable the "fast A20 gate"
|
|
;
|
|
a20_fast:
|
|
mov word [cs:A20Ptr], a20_fast
|
|
in al, 092h
|
|
or al,02h
|
|
and al,~01h ; Don't accidentally reset the machine!
|
|
out 092h, al
|
|
|
|
.fast_wait: push cx
|
|
xor cx,cx
|
|
.fast_wait_loop:
|
|
call a20_test
|
|
jnz a20_done_pop
|
|
loop .fast_wait_loop
|
|
|
|
pop cx
|
|
|
|
;
|
|
; Oh bugger. A20 is not responding. Try frobbing it again; eventually give up
|
|
; and report failure to the user.
|
|
;
|
|
dec byte [cs:A20Tries]
|
|
jnz a20_dunno ; Did we get the wrong type?
|
|
|
|
mov si, err_a20
|
|
pm_call pm_writestr
|
|
jmp kaboom
|
|
|
|
section .data16
|
|
err_a20 db CR, LF, 'A20 gate not responding!', CR, LF, 0
|
|
section .text16
|
|
|
|
;
|
|
; A20 unmasked, proceed...
|
|
;
|
|
a20_done_pop: pop cx
|
|
a20_done: popad
|
|
ret
|
|
|
|
;
|
|
; This routine tests if A20 is enabled (ZF = 0). This routine
|
|
; must not destroy any register contents.
|
|
;
|
|
; The no-write early out avoids the io_delay in the (presumably common)
|
|
; case of A20 already enabled (e.g. from a previous call.)
|
|
;
|
|
a20_test:
|
|
push es
|
|
push cx
|
|
push eax
|
|
mov cx,0FFFFh ; HMA = segment 0FFFFh
|
|
mov es,cx
|
|
mov eax,[cs:A20Test]
|
|
mov cx,32 ; Loop count
|
|
jmp .test ; First iteration = early out
|
|
.wait: add eax,0x430aea41 ; A large prime number
|
|
mov [cs:A20Test],eax
|
|
io_delay ; Serialize, and fix delay
|
|
.test: cmp eax,[es:A20Test+10h]
|
|
loopz .wait
|
|
.done: pop eax
|
|
pop cx
|
|
pop es
|
|
ret
|
|
|
|
;
|
|
; Routine to empty the 8042 KBC controller. If dl != 0
|
|
; then we will test A20 in the loop and exit if A20 is
|
|
; suddenly enabled.
|
|
;
|
|
empty_8042_uncond:
|
|
xor dl,dl
|
|
empty_8042:
|
|
call a20_test
|
|
jz .a20_on
|
|
and dl,dl
|
|
jnz .done
|
|
.a20_on: io_delay
|
|
in al, 064h ; Status port
|
|
test al,1
|
|
jz .no_output
|
|
io_delay
|
|
in al, 060h ; Read input
|
|
jmp short empty_8042
|
|
.no_output:
|
|
test al,2
|
|
jnz empty_8042
|
|
io_delay
|
|
.done: ret
|
|
|
|
;
|
|
; This initializes the protected-mode interrupt thunk set
|
|
;
|
|
section .text16
|
|
pm_init:
|
|
xor edi,edi
|
|
mov bx,IDT
|
|
mov di,IRQStubs
|
|
|
|
mov eax,7aeb006ah ; push byte .. jmp short ..
|
|
|
|
mov cx,8 ; 8 groups of 32 IRQs
|
|
.gloop:
|
|
push cx
|
|
mov cx,32 ; 32 entries per group
|
|
.eloop:
|
|
mov [bx],di ; IDT offset [15:0]
|
|
mov word [bx+2],PM_CS32 ; IDT segment
|
|
mov dword [bx+4],08e00h ; IDT offset [31:16], 32-bit interrupt
|
|
; gate, CPL 0 (we don't have a TSS
|
|
; set up...)
|
|
add bx,8
|
|
|
|
stosd
|
|
; Increment IRQ, decrement jmp short offset
|
|
add eax,(-4 << 24)+(1 << 8)
|
|
|
|
loop .eloop
|
|
|
|
; At the end of each group, replace the EBxx with
|
|
; the final E9xxxxxxxx
|
|
add di,3
|
|
mov byte [di-5],0E9h ; JMP NEAR
|
|
mov edx,pm_irq
|
|
sub edx,edi
|
|
mov [di-4],edx
|
|
|
|
add eax,(0x80 << 24) ; Proper offset for the next one
|
|
pop cx
|
|
loop .gloop
|
|
|
|
ret
|
|
|
|
; pm_init is called before bss clearing, so put these
|
|
; in .earlybss!
|
|
section .earlybss
|
|
alignb 8
|
|
IDT: resq 256
|
|
global RealModeSSSP
|
|
RealModeSSSP resd 1 ; Real-mode SS:SP
|
|
|
|
section .gentextnr ; Autogenerated 32-bit code
|
|
IRQStubs: resb 4*256+3*8
|
|
|
|
section .text16
|
|
|
|
%include "callback.inc" ; Real-mode callbacks
|