OSDev.org

Posted: **Tue Nov 16, 2004 12:00 am**

I have almost finished transfering my OS from real mode to 32-bit protected mode. Well.. I ran into a problem when trying to reboot, by jumping to FFFF:0000. Does anybody know how to quickly reboot in Protected Mode? (Not transfer back into real mode, and reboot).

Posted: **Wed Nov 17, 2004 12:00 am**

My recommendation is to use debug or GRDB and follow the jump to determine how the BIOS is doing it. My BIOS:

Code: Select all

->u ffff:0000
FFFF:0000 EA 5B E0 00 F0 jmp          F000:E05B

->u f000:e05b
F000:E05B E9 80 51       jmp          31DE

->u f000:31de
F000:31DE FA             cli
F000:31DF 0F 20 C1       mov          ecx,CR0
F000:31E2 66 81 E1 D1 FF and          ecx,7FFAFFD1
          FA 7F
F000:31E9 0F 22 C1       mov          CR0,ecx
F000:31EC 66 33 C9       xor          ecx,ecx
F000:31EF 0F 22 D9       mov          CR3,ecx
F000:31F2 E9 E9 D3       jmp          05DE

->u f000:05de
F000:05DE 66 0F CA       bswap        edx
F000:05E1 66 0F CE       bswap        esi
F000:05E4 8B CB          mov          cx,bx
F000:05E6 66 C1 E1 10    shl          ecx,10
F000:05EA B0 E6          mov          al,00E6
F000:05EC BB F2 05       mov          bx,05F2
F000:05EF E9 F4 46       jmp          4CE6

->u f000:4ce6
F000:4CE6 E9 C7 01       jmp          4EB0

->u f000:4eb0
F000:4EB0 66 8B F8       mov          edi,eax
F000:4EB3 32 E4          xor          ah,ah
F000:4EB5 66 C1 C8 0B    ror          eax,0B
F000:4EB9 2E A0 2C 6E    mov          al,cs:[6E2C]
F000:4EBD 66 C1 C8 05    ror          eax,05
F000:4EC1 B8 00 80       mov          ax,8000
F000:4EC4 66 C1 C8 10    ror          eax,10
F000:4EC8 24 FC          and          al,00FC
F000:4ECA BA F8 0C       mov          dx,0CF8
F000:4ECD 66 EF          out          dx,eax
F000:4ECF 66 8B C7       mov          eax,edi
F000:4ED2 8A D0          mov          dl,al
F000:4ED4 80 CA FC       or           dl,00FC
F000:4ED7 ED             in           ax,dx
F000:4ED8 8B D7          mov          dx,di
F000:4EDA FF E3          jmp          bx
F000:4EDC 53             push         bx
F000:4EDD 56             push         si
F000:4EDE 66 57          push         edi
F000:4EE0 BB E5 4E       mov          bx,4EE5
F000:4EE3 EB 05          jmp          4EEA

->u f000:4eea
F000:4EEA 66 8B F8       mov          edi,eax
F000:4EED 8B F2          mov          si,dx
F000:4EEF 8B C2          mov          ax,dx
F000:4EF1 32 E4          xor          ah,ah
F000:4EF3 66 C1 C8 0B    ror          eax,0B
F000:4EF7 2E A0 2C 6E    mov          al,cs:[6E2C]
F000:4EFB 66 C1 C8 05    ror          eax,05
F000:4EFF B8 00 80       mov          ax,8000
F000:4F02 66 C1 C8 10    ror          eax,10
F000:4F06 24 FC          and          al,00FC
F000:4F08 BA F8 0C       mov          dx,0CF8
F000:4F0B 66 EF          out          dx,eax
F000:4F0D 8B C6          mov          ax,si
F000:4F0F 8A D0          mov          dl,al
F000:4F11 66 8B C7       mov          eax,edi
F000:4F14 80 CA FC       or           dl,00FC
F000:4F17 EF             out          dx,ax
F000:4F18 8B D6          mov          dx,si
F000:4F1A FF E3          jmp          bx

BX = 4EE5

Code: Select all

F000:4EE5 66 5F          pop          edi
F000:4EE7 5E             pop          si
F000:4EE8 5B             pop          bx
F000:4EE9 C3             ret

So without knowing those ports I'm lost. And it appears to want to return somewhere...but I'm new to this so again I'm lost. I'll assemble this code and see what it does

[Edited] PCI port???

Posted: **Thu Nov 18, 2004 12:00 am**

ComputerPsi wrote:I have almost finished transfering my OS from real mode to 32-bit protected mode. Well.. I ran into a problem when trying to reboot, by jumping to FFFF:0000. Does anybody know how to quickly reboot in Protected Mode? (Not transfer back into real mode, and reboot).

Try tripple falt. For an example, remove idt table and then call some interrupt. You are garanteed a triple falt and a reboot.

Posted: **Thu Nov 18, 2004 12:00 am**

hm.. well... (I'm a bit new to pmode).. how do you remove the IDT? Just load a false IDT, or is there some way of removing it?

Posted: **Thu Nov 18, 2004 12:00 am**

set the IDT limit to 0 and leave the IRQs enabled
this will tripple-fault but not all systems will reboot on tripple-fault

better way is to hit the internal reset switch tied to the
keyboard controller (it should still work anyway)
I dont remember how to do this -- unless they removed it on newer boards?

or you can switch to rm and JMP F000:FFF0
by the way: disassembling this will NOT tell you how
to reboot since this is where the computer STARTS
and if the code at this location rebooted the computer
it could never start -- it would be an infinite loop

Posted: **Fri Nov 19, 2004 12:00 am**

The code I have is:

asm("cli"); //not sure if this is necessary
outportb(0x64, 0xFE); //restarts computer

Posted: **Fri Nov 19, 2004 12:00 am**

if u look at linux code u can find an interesting trick that work most of the time

Code: Select all

;Forcing reboot with keyb controller ;)
_reboot:
WKC:
    XOR         AL, AL
    IN          AL, 0x64
    TEST        AL, 0x02
    JNZ         WKC

    MOV         AL, 0xFC
    OUT         0x64, AL

i think its cleaner than generating a triple fault or deleting IDT ;D

Posted: **Fri Nov 19, 2004 12:00 am**

agread since the keyboard controller is tied directly to
the system reset line it can truely reset it
the tripple-fault doesnt actually reset (afaik)

both the last 2 codes do the same thing (except bit 1 is set in the linux example)

and the "cli" is not needed since this actually pulls the
reset line forcing the CPU to completely restart (as if the power
had just been turned on)

this was first implemented for the 286 since it was the
only way to exit back to real mode and there was no vm
they also created a memory location in the bios data
area to store a magic which would tell the system that
it was restarting and should resume rather than reload
the OS but I can't remember how this works now but
its prob what win9x uses for "forced real mode"
which requires a true clean real mode rather than the dos
emulator it normaly uses and then reboots straight to get back

OSDev.org

Reboot in Protected Mode

Reboot in Protected Mode

Re: Reboot in Protected Mode

Re: Reboot in Protected Mode

Re: Reboot in Protected Mode

Re: Reboot in Protected Mode

Re: Reboot in Protected Mode

Re: Reboot in Protected Mode

Re: Reboot in Protected Mode