Skip to contentSkip to conversation

i386 Broken bios common

PATCH In review Zachary Amsden 4 participants 8 messages Nov 8, 2005 Pnp support

lore
Share & tools
lore

Zachary Amsden

author
#0 lore raw

PATCH 4/21 i386 Broken bios common

Both the APM BIOS and PnP BIOS code use a segment hack to simulate real mode selector 0x40 (which points to the BIOS data area at 0x00400 in real mode). Several broken BIOSen use selector 0x40 as if they were running in real mode, which we make work by faking up selector 0x40 in the GDT to point to physical memory starting at 0x400. We limit the access to the remainder of this physical page using a byte granular limit. Rather than have this tricky code in multiple places, it makes sense to define it in one place, and the GDT makes a very convenient place for it. Use GDT entry 4 as the BAD_BIOS_CACHE segment.

Signed-off-by Zachary Amsden <[email protected]>
include/asm-i386/segment.h +9 -0
Index: linux-2.6.14-zach-work/include/asm-i386/segment.h
===================================================================
@@ -91,6 +91,15 @@
 #define GDT_ENTRY_BOOT_DS		(GDT_ENTRY_BOOT_CS + 1)
 #define __BOOT_DS	(GDT_ENTRY_BOOT_DS * 8)
 
+/*
+ * Turns out the BIOS data area at 0x400 is commonly accessed from broken
+ * BIOS using real mode selector 0x40.  We cached the bogus BIOS segment
+ * descriptor in a spare entry and fix it up at boot.
+ */
+#define GDT_ENTRY_BAD_BIOS_CACHE       4
+#define GDT_ENTRY_BAD_BIOS             (0x40 >> 3)
+#define BAD_BIOS_AREA                  (0x400)
+
 /* The PnP BIOS entries in the GDT */
 #define GDT_ENTRY_PNPBIOS_CS32		(GDT_ENTRY_PNPBIOS_BASE + 0)
 #define GDT_ENTRY_PNPBIOS_CS16		(GDT_ENTRY_PNPBIOS_BASE + 1)
arch/i386/kernel/head.S +1 -1
Index: linux-2.6.14-zach-work/arch/i386/kernel/head.S
===================================================================
@@ -487,7 +487,7 @@ ENTRY(cpu_gdt_table)
 	.quad 0x0000000000000000	/* 0x0b reserved */
 	.quad 0x0000000000000000	/* 0x13 reserved */
 	.quad 0x0000000000000000	/* 0x1b reserved */
-	.quad 0x0000000000000000	/* 0x20 unused */
+	.quad 0x0040920004000bff        /* 0x20 bad bios 3072 bytes at 0x400 */
 	.quad 0x0000000000000000	/* 0x28 unused */
 	.quad 0x0000000000000000	/* 0x33 TLS entry 1 */
 	.quad 0x0000000000000000	/* 0x3b TLS entry 2 */
arch/i386/kernel/apm.c +2 -12
Index: linux-2.6.14-zach-work/arch/i386/kernel/apm.c
===================================================================
@@ -414,7 +414,6 @@ static DECLARE_WAIT_QUEUE_HEAD(apm_waitq
 static DECLARE_WAIT_QUEUE_HEAD(apm_suspend_waitqueue);
 static struct apm_user *	user_list;
 static DEFINE_SPINLOCK(user_list_lock);
-static struct desc_struct	bad_bios_desc = { 0, 0x00409200 };
 
 static char			driver_version[] = "1.16ac";	/* no spaces */
 

@@ -593,7 +592,7 @@ static u8 apm_bios_call(u32 func, u32 eb
 	cpu = get_cpu();
 	gdt = get_cpu_gdt_table(cpu);
 	save_desc_40 = gdt[0x40 / 8];
-	gdt[0x40 / 8] = bad_bios_desc;
+	gdt[0x40 / 8] = gdt[GDT_ENTRY_BAD_BIOS_CACHE];
 
 	local_save_flags(flags);
 	APM_DO_CLI;

@@ -637,7 +636,7 @@ static u8 apm_bios_call_simple(u32 func,
 	cpu = get_cpu();
 	gdt = get_cpu_gdt_table(cpu);
 	save_desc_40 = gdt[0x40 / 8];
-	gdt[0x40 / 8] = bad_bios_desc;
+	gdt[0x40 / 8] = gdt[GDT_ENTRY_BAD_BIOS_CACHE];
 
 	local_save_flags(flags);
 	APM_DO_CLI;

@@ -2275,15 +2274,6 @@ static int __init apm_init(void)
 	pm_active = 1;
 
 	/*
-	 * Set up a segment that references the real mode segment 0x40
-	 * that extends up to the end of page zero (that we have reserved).
-	 * This is for buggy BIOS's that refer to (real mode) segment 0x40
-	 * even though they are called in protected mode.
-	 */
-	set_base(bad_bios_desc, __va((unsigned long)0x40 << 4));
-	_set_limit((char *)&bad_bios_desc, 4095 - (0x40 << 4));
-
-	/*
 	 * Set up the long jump entry point to the APM BIOS, which is called
 	 * from inline assembly.
 	 */
arch/i386/kernel/cpu/common.c +9 -0
Index: linux-2.6.14-zach-work/arch/i386/kernel/cpu/common.c
===================================================================
@@ -596,6 +596,15 @@ void __devinit cpu_init(void)
 	 * and set up the GDT descriptor:
 	 */
  	memcpy(gdt, cpu_gdt_table, GDT_SIZE);
+ 
+	/*
+	 * Set up a segment that references the real mode segment 0x40
+	 * that extends up to the end of page zero (that we have reserved).
+	 * This is for buggy BIOS's that refer to (real mode) segment 0x40
+	 * even though they are called in protected mode.  The limit is
+	 * preset, we hardwire the base here.
+	 */
+	set_base(gdt[GDT_ENTRY_BAD_BIOS_CACHE], __va(BAD_BIOS_AREA));
 
 	/* Set up GDT entry for 16bit stack */
  	*(__u64 *)(&gdt[GDT_ENTRY_ESPFIX_SS]) |=
drivers/pnp/pnpbios/bioscalls.c +2 -5
Index: linux-2.6.14-zach-work/drivers/pnp/pnpbios/bioscalls.c
===================================================================
@@ -70,8 +70,6 @@ set_base(per_cpu(cpu_gdt_table,cpu)[(sel
 set_limit(per_cpu(cpu_gdt_table,cpu)[(selname) >> 3], size); \
 } while(0)
 
-static struct desc_struct bad_bios_desc = { 0, 0x00409200 };
-
 /*
  * At some point we want to use this stack frame pointer to unwind
  * after PnP BIOS oopses.

@@ -107,7 +105,8 @@ static inline u16 call_pnp_bios(u16 func
 
 	cpu = get_cpu();
 	save_desc_40 = per_cpu(cpu_gdt_table,cpu)[0x40 / 8];
-	per_cpu(cpu_gdt_table,cpu)[0x40 / 8] = bad_bios_desc;
+	per_cpu(cpu_gdt_table,cpu)[0x40 / 8] = 
+		per_cpu(cpu_gdt_table,cpu)[GDT_ENTRY_BAD_BIOS_CACHE];
 
 	/* On some boxes IRQ's during PnP BIOS calls are deadly.  */
 	spin_lock_irqsave(&pnp_bios_lock, flags);

@@ -524,8 +523,6 @@ void pnpbios_calls_init(union pnp_bios_i
 	pnp_bios_callpoint.offset = header->fields.pm16offset;
 	pnp_bios_callpoint.segment = PNP_CS16;
 
-	set_base(bad_bios_desc, __va((unsigned long)0x40 << 4));
-	_set_limit((char *)&bad_bios_desc, 4095 - (0x40 << 4));
 	for(i=0; i < NR_CPUS; i++)
 	{
 		Q2_SET_SEL(i, PNP_CS32, &pnp_bios_callfunc, 64 * 1024);
#1 lore raw

arch/i386/kernel/apm.c static u8 apm_bios_call(u32 func, u32 eb · line 595

Quoted 5 lines · Zachary Amsden
arch/i386/kernel/apm.c +1 -1
 	gdt = get_cpu_gdt_table(cpu);
 	save_desc_40 = gdt[0x40 / 8];
-	gdt[0x40 / 8] = bad_bios_desc;
+	gdt[0x40 / 8] = gdt[GDT_ENTRY_BAD_BIOS_CACHE];

i like the cleanup, but wouldnt it be simpler to dedicate GDT entry #8 to the 0x40 descriptor, and hence be compatible with such broken BIOSes by default? Right now entry #8 is taken up by TLS segment #2, but we could change GDT_ENTRY_TLS_MIN from 6 to 9 and push the TLS segments to entries 9,10,11. [ Could there be any buggy SMM code that relies on having something at 0x40? ]

Ingo

author
#2 lore raw
Quoted 4 lines · Ingo Molnar

* Zachary Amsden <[email protected]> wrote:

Quoted 11 lines

Review

Quoted 7 lines
	gdt = get_cpu_gdt_table(cpu);
	save_desc_40 = gdt[0x40 / 8];
(quoted diff) +1 -1
-	gdt[0x40 / 8] = bad_bios_desc;
+	gdt[0x40 / 8] = gdt[GDT_ENTRY_BAD_BIOS_CACHE];

i like the cleanup, but wouldnt it be simpler to dedicate GDT entry #8 to the 0x40 descriptor, and hence be compatible with such broken BIOSes by default? Right now entry #8 is taken up by TLS segment #2, but we could change GDT_ENTRY_TLS_MIN from 6 to 9 and push the TLS segments to entries 9,10,11. [ Could there be any buggy SMM code that relies on having something at 0x40? ]

I worry that there could be buggy userspace code that relies on having selector 0x40 - notably Wine. So although I would like to make 0x40 the default, can't be guaranteed.

SMM code is safe, since it gets SMRAM mapped in on entry and has descriptor saved state so it can mess with tables as it sees fit without worrying about restoring anything.

Zach

#3 lore raw
Quoted 10 lines · Zachary Amsden
Quoted 9 lines

Review

Quoted 2 lines
(quoted diff) +1 -1
-	gdt[0x40 / 8] = bad_bios_desc;
+	gdt[0x40 / 8] = gdt[GDT_ENTRY_BAD_BIOS_CACHE];

i like the cleanup, but wouldnt it be simpler to dedicate GDT entry #8 to the 0x40 descriptor, and hence be compatible with such broken BIOSes by default? Right now entry #8 is taken up by TLS segment #2, but we could change GDT_ENTRY_TLS_MIN from 6 to 9 and push the TLS segments to entries 9,10,11. [ Could there be any buggy SMM code that relies on having something at 0x40? ]

Quoted 3 lines

I worry that there could be buggy userspace code that relies on having selector 0x40 - notably Wine. So although I would like to make 0x40 the default, can't be guaranteed.

why use up a GDT entry then for GDT_ENTRY_BAD_BIOS_CACHE? Just put it into a global variable, into the readmostly section.

Ingo

#4 lore raw
In reply to Zachary Amsden
Quoted 10 lines · Zachary Amsden

Both the APM BIOS and PnP BIOS code use a segment hack to simulate real mode selector 0x40 (which points to the BIOS data area at 0x00400 in real mode). Several broken BIOSen use selector 0x40 as if they were running in real mode, which we make work by faking up selector 0x40 in the GDT to point to physical memory starting at 0x400. We limit the access to the remainder of this physical page using a byte granular limit. Rather than have this tricky code in multiple places, it makes sense to define it in one place, and the GDT makes a very convenient place for it. Use GDT entry 4 as the BAD_BIOS_CACHE segment.

I'd much rather use entry 8 instead, which should just automatically mean that selector 0x40 _always_ points to virtual address 0x400. No switching etc..

Isn't this what Wine already has to work around, or something?

Ingo, can we move the TLS selectors upwards, or does user space perhaps know about the current TLS layout? Wine in particular may well know ;(

Linus

#5 lore raw
Quoted 13 lines · Linus Torvalds
Quoted 9 lines · Zachary Amsden

Both the APM BIOS and PnP BIOS code use a segment hack to simulate real mode selector 0x40 (which points to the BIOS data area at 0x00400 in real mode). Several broken BIOSen use selector 0x40 as if they were running in real mode, which we make work by faking up selector 0x40 in the GDT to point to physical memory starting at 0x400. We limit the access to the remainder of this physical page using a byte granular limit. Rather than have this tricky code in multiple places, it makes sense to define it in one place, and the GDT makes a very convenient place for it. Use GDT entry 4 as the BAD_BIOS_CACHE segment.

Quoted 6 lines

I'd much rather use entry 8 instead, which should just automatically mean that selector 0x40 _always_ points to virtual address 0x400. No switching etc..

Isn't this what Wine already has to work around, or something?

Ingo, can we move the TLS selectors upwards, or does user space perhaps know about the current TLS layout? Wine in particular may well know ;(

I thought the point was that Wine needs to point GDT entry 8 into userspace.

-hpa

author
#6 lore raw
In reply to Linus Torvalds
Quoted 15 lines · Linus Torvalds
Quoted 11 lines · Zachary Amsden

Both the APM BIOS and PnP BIOS code use a segment hack to simulate real mode selector 0x40 (which points to the BIOS data area at 0x00400 in real mode). Several broken BIOSen use selector 0x40 as if they were running in real mode, which we make work by faking up selector 0x40 in the GDT to point to physical memory starting at 0x400. We limit the access to the remainder of this physical page using a byte granular limit. Rather than have this tricky code in multiple places, it makes sense to define it in one place, and the GDT makes a very convenient place for it. Use GDT entry 4 as the BAD_BIOS_CACHE segment.

Quoted 7 lines

I'd much rather use entry 8 instead, which should just automatically mean that selector 0x40 _always_ points to virtual address 0x400. No switching etc..

Isn't this what Wine already has to work around, or something?

Ingo, can we move the TLS selectors upwards, or does user space perhaps know about the current TLS layout? Wine in particular may well know ;(

Looking at the Wine code, it doesn't seem to know. It uses a GDT entry if possible in preference to an LDT entry, and appears to not care which TLS descriptor it gets. So I think it would be safe to reserve selector 0x40 for the BIOS real mode segment and move TLS up. That's kind of a scary change, but I don't see anything wrong with it other than the testing implications. Hopefully DOSEmu is not affected..

/***********************************************************************
* wine_ldt_alloc_fs
*
* Allocate an LDT entry for a %fs selector, reusing a global
* GDT selector if possible. Return the selector value.
*/
unsigned short wine_ldt_alloc_fs(void)
{
if (global_fs_sel == -1)

   {
       struct modify_ldt_s ldt_info;
       int ret;

       ldt_info.entry_number = -1;   <---------  note it doesn't care
       fill_modify_ldt_struct( &ldt_info, &null_entry );
       if ((ret = set_thread_area( &ldt_info ) < 0))
       {
           global_fs_sel = 0;  /* don't try it again */
           if (errno != ENOSYS) perror( "set_thread_area" );
       }
       else global_fs_sel = (ldt_info.entry_number << 3) | 3;

}
if (global_fs_sel > 0) return global_fs_sel;
return wine_ldt_alloc_entries( 1 );

author
#7 lore raw
In reply to Linus Torvalds
Quoted 15 lines · Linus Torvalds
Quoted 11 lines · Zachary Amsden

Both the APM BIOS and PnP BIOS code use a segment hack to simulate real mode selector 0x40 (which points to the BIOS data area at 0x00400 in real mode). Several broken BIOSen use selector 0x40 as if they were running in real mode, which we make work by faking up selector 0x40 in the GDT to point to physical memory starting at 0x400. We limit the access to the remainder of this physical page using a byte granular limit. Rather than have this tricky code in multiple places, it makes sense to define it in one place, and the GDT makes a very convenient place for it. Use GDT entry 4 as the BAD_BIOS_CACHE segment.

Quoted 5 lines

I'd much rather use entry 8 instead, which should just automatically mean that selector 0x40 _always_ points to virtual address 0x400. No switching etc..

Isn't this what Wine already has to work around, or something?

I have answers now to the questions:

Wine has to support allocating thread pointers for NT processes in ntdll, so it needs a way to allocate descriptors. It doesn't seem to care if they are LDT or GDT descriptors.

Quoted 3 lines

Ingo, can we move the TLS selectors upwards, or does user space perhaps know about the current TLS layout? Wine in particular may well know ;(

It does not know. And DOSemu appears to only use LDT. GDT is used to allocate a global thread area for Wine, but it has a fallback mechanism that appears to have been built from the start to deal with varying thread selectors rather than a fixed notion (as GDT TLS segments are not available on 2.4). Rather convenient.

Now the million dollar question is : who uses three TLS segments? Wine appears to use glibc, private, and I have no idea what other software makes use of this. If only two thread selectors were needed, then this does the trick. Or we could rebase the selectors down to 0x20-0x30.

* ------- start of TLS (Thread-Local Storage) segments:
*

*   6 - TLS segment #1                 [ glibc's TLS segment ]
*   7 - TLS segment #2                 [ Wine's %fs Win32 segment ]
*   8 - BIOS real mode segment

Zach