Reviews / articles about OS/2 |
Operating systems: ArcaOS, eComStation, IBM OS/2 Warp |
|
|
|
|
DATE: 2008-03-27 16:52:47 AUTHOR: Pavel Shtemenko
IntroductionIt's not a secret that IBM decided to leave off OS/2 completely, even their excuses "support the customers until xxxx year" are just a way to redirect you in nowhere, for example, to linux. Firstly, they can't support physically, secondly all their support comes to "we advise you migrate to linux". I don't mind linux at all, let it live, but without me. That is why it is obvious that if OS/2 survives, it would be not thanks to IBM. Actually, this article is a step trying to show whether it is difficult to rewrite everything that depends on IBM. So, the first part of Marlezon Ballet - os2ldr as the very first thing that starts working if you load OS/2.
1. Where to beginOf course from the studying of log from the debug os2ldr, it consists of: OS2LdrD This is clear, it is debug here also ComPort 02f8 It's not less clearer where is the output IODel 0113 It's a bit less obvious, but we will be deciphering completely IODelay, it is also known as DosIODelayCnt, in hex of course. Model fc01 Judging by the name, it's a model of a computer, if we look closer in the output CPUID - we will definitely define that it is CGetDHPhysMem The name of the called function by definition PhysMem .... I think there is no copywrite to names? I12 639 This is how much memory int 12h reported I1588 15360 This is how much int 15h fn 88h reported I15E8(AX) 15360 This is how much int 15h fn E8h reported I15E8(BX) 1472 Number of blocks of 64K in extended memory I15E8(CY) 0 I15E8 1472 I15C7Bytes 0 This stuff is history and should not be considered. Let's conclude, we need memory which is up to 1mb and more, less than 1mb one would have to receive at int 12h, nobody tells more about that, and it could be on contemporary 640 or 639 (+ ExtBDA area). It is more cool to receive the current memory at int 15h fn E820h, that is ACPI. But as you understand, it is easier to fill in the fields I15E8, than to redo everything. I was not lazy to check on my test computer int 15h E800h gives a bit more memory than int 15h E820h (acpi), just more enough for a size of the ACPI table. The conclusion is obvious, os2ldr indeed uses int 15h E820h, but the output is shown as simple int 15h 8E00. What can I say, both start with E8h. SysHi 0 SysEx 0 LocHi 0 LocEx 0 CacHi 0 CacEx 0 PadHi 0 PadEx 0 MCA Watchdog supported?: NO=0;YES=non-zero. Rslt=0000 NVRam 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 AoxID 0 AoxQty 0 AoxMem 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 AoxTrans 0 0 0 0 0 0 0 0 0 0 0 0 These are antiques connected with MCA and PS/x computers from IBM, they probably hope that at least one of them is still alive. That's why they are checking. It's clear that there is no sense to support this. Int12 st 00000000 end 0009fbff Int1588 st 00100000 end 00ffffff Int15E8 st 01000000 end 06bfffff This is the concluded output of RAM quantity detector. Finder: st 00000000 end 0009fbff loc 00000001 cac 00000000 st 00100000 end 00ffffff loc 00000000 cac 00000000 st 01000000 end 06bfffff loc 00000000 cac 00000000 This is all the same but in the way meant for writing kernel and miniFSD. CPUUsable = 00000001 CPUWeAre = 00000001 How much is used and how much there is in general, I can say that in my DualCode it anyway shows exactly 1. CPUXlateMem = 00000000 PhysMem: Base 00000000 Sz 0009fc00 Loc 00000001 Cac 00000000 Base 00100000 Sz 06b00000 Loc 00000000 Cac 00000000 SLFrm len e000 Here is in fact the rounded size of a loader. calling getdhgetdp Calling Get Dos Help "Get drive parameters", why DosHelp who knows, it is called only here, but probably as everything disk at IBM is DASD, thus everything called in DosHelp cbResMsg=0bbe, cbDscMsg=15d3 The size of resident messages and non-resident, further we see in os2ldr and understand that a looooong output like "IBM here please insert the next diskette, motherfucker" for sure should not be among resident. Having searched a little in DDK we find, file basemid.inc, where the numbers of messages which can be related to os2ldr.msg are contained. Let's pay attention that resident messages are available later on, after the OS/2 is completely loaded, that is why we just have to pick those that are possible after the loading - the remaining will be non-resident, a couple of tries and a table is ready. cgvi cldr An attempt to define antiques keyboard and video BaseMem1: Base 00000000 sz 0009fc00 Base 00100000 sz 06b00000 The final verdict to the memory detector, we have this much and not bite more HiLoad=00100000 Physical address where we will load the older (senior) part of kernel to ldrseg=1000 ldrlen=e000 &filetbl=c9b0 bootfl=0014 Physical address of the loader = 1000h, its size, address of functions exported microFSD and flag of loading Low/High/Ex Mem = 639/15360/94208 K Here we once again show in a digestive way the memory detect and here we go loading the kernel open Opening the kernel file. Kinda like an attempt. opened Opened. I just "see" the stamp on the screen "IBM Checked" (signature "president xxxx") KLBlock 0001 split BaseMem2: Base = 00000000 Sz = 0009fc00 Base = 00100000 Sz = 00f00000 Base = 01000000 Sz = 05c00000 An output of memory map MFSDF 0001 00100000 00f00000 0000c7bc mini-FSD 00ff3000 Here is copies miniFSD (aka os2boot) to the very tail of physical memory ldr @ 010000 => 090000, len=e000 And here we finally came to the loader itself... DHSeg=0100 DHLen=8b71 Selector 100h size 8b71h, that is selector 100 always, the 8000 resident loader can't take more (see the reasons in the next article "how to write your own os2krnl"). So just to inform God knows who. May be to scare the evil spirits of something, which didn't help OS/2 at all. MLen=0bbe endlopaddr => 0008c000 skipping SMP reserved GDT selectors Skipping of SMP selectors - this is done in order to save loading of kernel exactly from 1800 selector, in the Real Mode the segment will also be 1800. All that is done so that in Real and Prot Mode there was the same cs:ip. It is very conveninent to jump from Prot to Real and back. And finally we start copying the kernel file.
ob flags oi-flags paddr/sel glp laddr/fladdr msz/vsz
laddrnext2=ffd80000
01 rw--sfTLa- 00001063 00b000/0b00 0001 ff800000/ff800000 001000/000fb4
^^^^^^^^^^^^^
physical address where we put it
^^^^^^^^^^^^^^^^^
this is how it would look like in FLAT
^^^
Index of the first page of the object in the kernel file
^^^^^^^^^^^^
RM selector depending on type, look at Flags
^^^^^^^^^
Flags of the segment in binary
^^^^^^^^^^
Flags of the segment in the symbolic way
^^
ordinal number in the file os2krnl
02 rw--sfTLaA 00005063 00c000/0c00 0002 ffd81000/ffd81000 00b000/00afb7 03 r-x-sfTLa- 00001065 018000/1800 000d ffd8d000/ffd8d000 00a000/00941c 04 r-x-sf-LaA 00005025 022000/0120 0017 ffd97000/ffd97000 00f000/00e865 05 rw--sf-LaA 00005023 031000/0128 0026 ffda6000/ffda6000 00c000/00c455 06 rw--sN-LaA 0000d0a3 03e000/0130 0032 ffdb3000/ffdb3000 010000/010000 07 rw--sN-LaA 0000d023 04e000/0138 0042 ffdc3000/ffdc3000 003000/002a88 08 rw--sf-LaA 00005023 051000/0140 0045 ffdc6000/ffdc6000 003000/00580a 09 r-x-sf-haA 00005035 100000/0148 0048 ffe75000/ffe75000 003000/0029bc 0a rw-BPf-h-- 00002213 103000/0000 004b ffe78000/00110000 001000/0001b0 0b rw-BPf-h-- 00002013 104000/0000 004c ffe79000/00120000 003000/0027cc 0c rw-Bsf-h-A 00006033 107000/0000 004f ffe7c000/ffe7c000 02c000/030064 0d r-x-sf-ha- 00001035 138000/0150 007b ffead000/ffead000 010000/00fdf8 0e r-x-sf-ha- 00001035 148000/0158 008b ffebd000/ffebd000 010000/00ff60 0f r-x-sf-ha- 00001035 158000/0160 009b ffecd000/ffecd000 00f000/00ee04 10 r-x-sf-ha- 00001035 167000/0168 00aa ffedc000/ffedc000 00f000/00e31c 11 r-xBsf-h-A 00006035 176000/0000 00b9 ffeeb000/ffeeb000 0d5000/0d4e69 So, now we can see that practically all the segments of os2ldr are loaded until 1mb and only 32 bit segments after, beginning with the first address after 1mb. I would like to note at once, not on all PC this may be 1mb, there may be even a hole in addressation. Please, note, the sizes, attributes and numbers of segments completely coincide with the header LX of kernel file. laddrnext=ffe75000 here comes the last taken address, but already in FLAT R0DS=0170 R0CS=0178 We say that such selectors are appointed on FLAT endlopaddr 08c000 => 057000 endhipaddr 0024b000 pagemap 05f000, fixuppt 05fc74, fixuprecs 060400 k end paddr lo/hi 00057000/0024b000, zpaddr 00057000, zsize 8000 OS2Init=1800:7f4c This is actually the address where we will make JMP after loader has done its job, it is extracted from LX exe and kernel, judging by os2krnl.sym file it is called SYIInitOS2. Then we start rewriting from kernel everything we haven't rewritten, and at the same time we start making fix-up to 32 bit according to the found R0DS and R0CS. We do this for a long time but tasting the moment. wait 0001 lo wait 0002 lo wait 0003 lo wait 0004 lo wait 0005 lo wait 0006 lo wait 0007 lo wait 0008 lo load 0009 hi MoveHigh src=0000b000, dst=00100000, size=3000, remain=00000000 We copy a piece up, as A20 is included below, which means there is only one way - through int 15h, and we go on doing the same - copy and load. load 000a hi MoveHigh src=0000b000, dst=00103000, size=1000, remain=00000000 load 000b hi MoveHigh src=0000b000, dst=00104000, size=3000, remain=00000000 load 000c hi MoveHigh src=0000b000, dst=00107000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=0010f000, size=8000, remain=00000000 IODelayCnt fixup laddr=ffe92c72 Here we found that a fix-up is needed, so we put it MoveHigh src=0000b000, dst=00117000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=0011f000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=00127000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=0012f000, size=4000, remain=00000000 load 000d hi MoveHigh src=0000b000, dst=00138000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=00140000, size=8000, remain=00000000 load 000e hi IODelayCnt fixup laddr=ffec0a81 IODelayCnt fixup laddr=ffec0a8c MoveHigh src=0000b000, dst=00148000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=00150000, size=8000, remain=00000000 load 000f hi MoveHigh src=0000b000, dst=00158000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=00160000, size=7000, remain=00000000 load 0010 hi IODelayCnt fixup laddr=ffee3572 IODelayCnt fixup laddr=ffee357c IODelayCnt fixup laddr=ffee358a IODelayCnt fixup laddr=ffee3591 IODelayCnt fixup laddr=ffee35a7 IODelayCnt fixup laddr=ffee35b6 IODelayCnt fixup laddr=ffee3551 IODelayCnt fixup laddr=ffee3481 IODelayCnt fixup laddr=ffee3545 IODelayCnt fixup laddr=ffee3538 IODelayCnt fixup laddr=ffee34ea IODelayCnt fixup laddr=ffee34dd IODelayCnt fixup laddr=ffee34ad IODelayCnt fixup laddr=ffee349a IODelayCnt fixup laddr=ffee3565 MoveHigh src=0000b000, dst=00167000, size=8000, remain=00000000 IODelayCnt fixup laddr=ffee66c0 MoveHigh src=0000b000, dst=0016f000, size=7000, remain=00000000 load 0011 hi MoveHigh src=0000b000, dst=00176000, size=8000, remain=00000000 IODelayCnt fixup laddr=ffef4350 IODelayCnt fixup laddr=ffef464e IODelayCnt fixup laddr=ffef465c MoveHigh src=0000b000, dst=0017e000, size=8000, remain=00000000 IODelayCnt fixup laddr=ffefc774 IODelayCnt fixup laddr=ffefc76a IODelayCnt fixup laddr=fff018cc IODelayCnt fixup laddr=fff018c0 IODelayCnt fixup laddr=fff0187a IODelayCnt fixup laddr=fff01870 MoveHigh src=0000b000, dst=00186000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=0018e000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=00196000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=0019e000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=001a6000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=001ae000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=001b6000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=001be000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=001c6000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=001ce000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=001d6000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=001de000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=001e6000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=001ee000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=001f6000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=001fe000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=00206000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=0020e000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=00216000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=0021e000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=00226000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=0022e000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=00236000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=0023e000, size=8000, remain=00000000 MoveHigh src=0000b000, dst=00246000, size=5000, remain=00000000 Phew, looks like we copied everything and fixed-up it at the same time, so we can stretch up a bit on something almost needless BIOS Seg 5700 We added BIOS as selector, it is absolutely not used afterwards Dmp seg 5800 Selector for dump procedure DBCS seg 6700 I personally have no place to look up the DBCS, I don't understand hieroglyphs. FNT seg 6a00 The font segment for DBCS rom free lo We freed a part of lower memory for the kernel and off we go to arrange the segments as they come
load 0001 lo
^^^^
the first segment
load 0002 lo
^^^^
the second segment
IODelayCnt fixup laddr=ffd84317
in here we do fix-up 32 bit on this address and so on in all the segments in SMP, total 17 pieces, which can be easily checked if you look at the header of LX file of the kernel load 0003 lo IODelayCnt fixup laddr=ffd8ee80 IODelayCnt fixup laddr=ffd90dea IODelayCnt fixup laddr=ffd90de2 IODelayCnt fixup laddr=ffd90df6 IODelayCnt fixup laddr=ffd907b3 IODelayCnt fixup laddr=ffd90c6e IODelayCnt fixup laddr=ffd907bc IODelayCnt fixup laddr=ffd90c74 IODelayCnt fixup laddr=ffd95603 IODelayCnt fixup laddr=ffd955f3 IODelayCnt fixup laddr=ffd955e6 load 0004 lo load 0005 lo LObj zfil 0003d000 for 00000455 load 0006 lo load 0007 lo load 0008 lo LObj zfil 00054000 for 0000280a done 0009 hi done 000a hi done 000b hi done 000c hi done 000d hi done 000e hi done 000f hi done 0010 hi done 0011 hi close We close the kernel file dmp len 00003a9d xBDA len 0400 Here we picked up ExtBDA area (look previously, it is reported as such that we already have), and also we picked up os2dump sds init 01000949 dmp init 58000006 cfg 0010 no DBCS/FNT term termed -16 nFAT In the current situation microFSD, that is not FAT DPEnd +16 MemT MemX pa=00000000 sz=00001000 va=00000000 sel=0000 fl=2000 of=00000003 ow=0000 It's an output of the list of arenas - all memory blocks, ready before the kernel start. Look DebugHandBook about arenas. Here we have object of the kernel inself and blocks, where os2dump sits, microFSD, os2dbcs and its font, and all free memory, including blocks, which were defined but not used and thus marked as invalid.
pa=00001000 sz=00009740 va=ffe6b000 sel=0100 fl=2014 of=00001004 ow=ff6d
^^^^^^^
Owner
^^^^^^^^^^^
Flags of memory type
^^^^^^^
Flags of arena type
^^^^^^^^
Selector
^^^^^^^^^^^
FLAT address
^^^^^^^^^^^
Size
^^^^^^^^^^^
Physical address
pa=0000b000 sz=00000fb4 va=ff800000 sel=0b00 fl=2144 of=00001063 ow=ffaa pa=0000c000 sz=0000afb7 va=ffd81000 sel=0c00 fl=2244 of=00005063 ow=ffaa pa=00018000 sz=0000941c va=ffd8d000 sel=1800 fl=2344 of=00001065 ow=ffaa pa=00022000 sz=0000e865 va=ffd97000 sel=0120 fl=2444 of=00005025 ow=ffaa pa=00031000 sz=0000c455 va=ffda6000 sel=0128 fl=2544 of=00005023 ow=ffaa pa=0003e000 sz=00010000 va=ffdb3000 sel=0130 fl=2644 of=0000d0a3 ow=ffaa pa=0004e000 sz=00002a88 va=ffdc3000 sel=0138 fl=2744 of=0000d023 ow=ffaa pa=00051000 sz=0000580a va=ffdc6000 sel=0140 fl=2844 of=00005023 ow=ffaa pa=00057000 sz=00000900 va=ffe6a000 sel=5700 fl=2014 of=00000000 ow=ff6d pa=00058000 sz=00003a9d va=00000000 sel=5800 fl=2001 of=00000000 ow=0000 pa=0005c000 sz=0000e000 va=00000000 sel=5c00 fl=2002 of=00000000 ow=0000 pa=0006a000 sz=00009000 va=ffe61000 sel=6a00 fl=2002 of=00000000 ow=ff21 pa=00073000 sz=0001d000 va=00000000 sel=0000 fl=2002 of=00000000 ow=0000 pa=00090000 sz=0000effc va=ffe52000 sel=0000 fl=2054 of=00001003 ow=ffab pa=0009f000 sz=00000c00 va=00000000 sel=0000 fl=2002 of=00000000 ow=0000 pa=0009fc00 sz=00000400 va=ffe51c00 sel=0000 fl=2004 of=00000000 ow=ff37 pa=000a0000 sz=00060000 va=00000000 sel=0000 fl=0001 of=00000000 ow=0000 pa=00100000 sz=000029bc va=ffe75000 sel=0148 fl=0944 of=00005035 ow=ffaa pa=00103000 sz=000001b0 va=ffe78000 sel=0000 fl=0a44 of=00002213 ow=ffaa pa=00104000 sz=000027cc va=ffe79000 sel=0000 fl=0b44 of=00002013 ow=ffaa pa=00107000 sz=00030064 va=ffe7c000 sel=0000 fl=0c44 of=00006033 ow=ffaa pa=00138000 sz=0000fdf8 va=ffead000 sel=0150 fl=0d44 of=00001035 ow=ffaa pa=00148000 sz=0000ff60 va=ffebd000 sel=0158 fl=0e44 of=00001035 ow=ffaa pa=00158000 sz=0000ee04 va=ffecd000 sel=0160 fl=0f44 of=00001035 ow=ffaa pa=00167000 sz=0000e31c va=ffedc000 sel=0168 fl=1044 of=00001035 ow=ffaa pa=00176000 sz=000d4e69 va=ffeeb000 sel=0000 fl=1144 of=00006035 ow=ffaa pa=0024b000 sz=00da8000 va=00000000 sel=0000 fl=0002 of=00000000 ow=0000 pa=00ff3000 sz=0000d000 va=ffe44000 sel=0000 fl=0024 of=00001003 ow=ff9d pa=01000000 sz=00000000 va=00000000 sel=0000 fl=0001 of=00000000 ow=0000 pa=01000000 sz=05c00000 va=00000000 sel=0000 fl=0002 of=00000000 ow=0000 pa=06c00000 sz=00000000 va=00000000 sel=0000 fl=4000 of=00000000 ow=0000 SFence OK This is kinda like a test of overloaded steck. First of all, what for, secondly, it gives nothing, thirdly, even if it gets overloaded, the kernel puts its own at once. Looks like it's some stuff left from the past years, when there existed its own debugger. Personally, I never saw such loader. a20 Finally turned on A20 pDHt rPIC Made init 8259 j syi Went to kernel and then we can see such note, that is if you have a cable to comport and put a debug kernel.
System Debugger 8/8/97 [80786]
MaxProcesses = 1025
Symbols linked (os2krnl)
OS/2 Warp Server for e-business
(C) Copyright IBM Corp. 1987, 1999. All rights reserved.
US Government Users Restricted Rights - Use, duplication or disclosure
restricted by GSA ADP Schedule Contract with IBM Corp.
Internal revision 14.039F_SMP
This is exactly where a part of direct interpretation of os2ldr ends, and start the indirect. So, one has to put DevHlp-ers from a physical address 1000, load all messages from os2ldr.msg, put the interrupt handler, put OEMHLP$ driver and provide some services. And now ask yourself, how difficult it is?
2. What to do nextFirst of all le't slook at .... of loader from the hobbes and read EDM/2, we see that interface to os2ldr from the "loader" is described in ifs.inf. Then we note that part of DevHlp is situated in the loader, so we will go the easiest way - AltF7 in fc and in all headers in DDK searching the DevHlp line. Almost immediately we discover a very interesting structure in doshlp.inc, called DosHlpFunction, then comes not less interesting structure KernelAccess. We look closer to macros in that same file, aha, DefDosHlp and DefDiscDosHlp. We recall that a part of the loader remains residential and another part having donw its work is dumped (???) dropped off as launcher stages. We also recall, that there are messages, but here it's simpler - they are all visible in os2ldr.msg and named in basemid.inc. Considering the standart for OS/2 work with MSG we conclude that they must be saved in the following way: dw number of the message dw Offset to text of message So, we need to make a table to give it to kernel. The table of messages and a table of helpers, which sit in os2ldr. Then we read in English the names of helpers, look at pddref.inf to check call parameters and just write them. Mostly all are described in pddref.inf, but we find some exotic ones, like DosHelpInitInterrupts. So, we scratch the head and here in the debug window we notice - Hello! all the pointers from IDT are looking at os2ldr, it's resident 32bit part!!! Aha! Here is the deal, we understand, all interruption handlers must put os2ldr exactly upon the call of this function. Further, remembering acpi and its tought fight for share IRQ we know that we have to write in airqi table of kernel all pointers to these interruption handlers and the main! put the flag SHARE. So we do, trying to load and understand that something is not right here... the driver OEMHLP$ is missing, ALTF7 on disk, gosh, it's in os2ldr... We look around, we have to find out if there is something not documented in OEMHLP$. Suprirsinly, there is nothing, just defaults, that for example, it's not declared that number ioctl 80h... Knowing, that M$ starting to write it and that is had a very loving relations with high bits, we decide what the hec, let's repeat it that way. Now we do according to DebugHandBook the parameters of kernelt, jmp to the input point and oh, miracle! it's loaded.
3. The result of the working dayIt's possible to write and in bearable terms, there is nothing super secret here besides bugs. It's a half day job for a knowing engineer to write the task for programmers. IBM has given practically all the info. And, I think, it waited that the info will be taken and the mass will be created, but ah-ah, everybody hoped for IBM. May be that's why it turned to Lynux - droped the idea, lemmings start wander around and pervert it the best they can. Judging by JFS there are no boundaries to perversion. The literature used (and recommended):
Comments:
|
|
||||||||||||
(C) OS2.GURU 2001-2021
