From: Robert Hancock on
On 06/01/2010 03:43 PM, Justin P. Mattock wrote:
> On 06/01/2010 02:29 PM, Matthew Garrett wrote:
>> On Tue, Jun 01, 2010 at 02:26:01PM -0700, Justin P. Mattock wrote:
>>> On 06/01/2010 02:12 PM, Matthew Garrett wrote:
>>>> some level. How about the following (again, run as root):
>>>>
>>>> #include<sys/io.h>
>>>>
>>>> int main() {
>>>> iopl(3);
>>>> outb(0xfe, 0x64);
>>>> return 0;
>>>> }
>>>>
>>
>> So, just to be clear, you run this as root and it immediately returns
>> you to the prompt? This seems unlikely.
>
> yep.. with the above code
> I (save to a file) then
> non-root gcc reboot.c -o reboot
> then su
> ./reboot
> just bake to the command prompt

Can you post the FACP section of the acpidump output from this machine?

>
>>
>>> ahh!! I see now:
>>> grep 0x64 *.dsl
>>
>> No, that's unrelated.
>>
>
> alright!!
>
> Justin P. Mattock

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Justin P. Mattock on
On 06/01/2010 10:11 PM, Robert Hancock wrote:
> On 06/01/2010 03:43 PM, Justin P. Mattock wrote:
>> On 06/01/2010 02:29 PM, Matthew Garrett wrote:
>>> On Tue, Jun 01, 2010 at 02:26:01PM -0700, Justin P. Mattock wrote:
>>>> On 06/01/2010 02:12 PM, Matthew Garrett wrote:
>>>>> some level. How about the following (again, run as root):
>>>>>
>>>>> #include<sys/io.h>
>>>>>
>>>>> int main() {
>>>>> iopl(3);
>>>>> outb(0xfe, 0x64);
>>>>> return 0;
>>>>> }
>>>>>
>>>
>>> So, just to be clear, you run this as root and it immediately returns
>>> you to the prompt? This seems unlikely.
>>
>> yep.. with the above code
>> I (save to a file) then
>> non-root gcc reboot.c -o reboot
>> then su
>> ./reboot
>> just bake to the command prompt
>
> Can you post the FACP section of the acpidump output from this machine?
>

here you go:

/*
* Intel ACPI Component Architecture
* AML Disassembler version 20090123
*
* Disassembly of FACP.dat, Tue Jun 1 22:58:36 2010
*
* ACPI Data Table [FACP]
*
* Format: [HexOffset DecimalOffset ByteLength] FieldName : FieldValue
*/

[000h 000 4] Signature : "FACP" /* Fixed ACPI
Description Table */
[004h 004 4] Table Length : 000000F4
[008h 008 1] Revision : 03
[009h 009 1] Checksum : 0B
[00Ah 010 6] Oem ID : "APPLE "
[010h 016 8] Oem Table ID : "Apple00 "
[018h 024 4] Oem Revision : 0000008D
[01Ch 028 4] Asl Compiler ID : "Loki"
[020h 032 4] Asl Compiler Revision : 0000005F

[024h 036 4] FACS Address : BFECD000
[028h 040 4] DSDT Address : BFEE0000
[02Ch 044 1] Model : 00
[02Dh 045 1] PM Profile : 01
[02Eh 046 2] SCI Interrupt : 0009
[030h 048 4] SMI Command Port : 0000052E
[034h 052 1] ACPI Enable Value : F0
[035h 053 1] ACPI Disable Value : F1
[036h 054 1] S4BIOS Command : F2
[037h 055 1] P-State Control : 80
[038h 056 4] PM1A Event Block Address : 00000400
[03Ch 060 4] PM1B Event Block Address : 00000000
[040h 064 4] PM1A Control Block Address : 00000404
[044h 068 4] PM1B Control Block Address : 00000000
[048h 072 4] PM2 Control Block Address : 0000041C
[04Ch 076 4] PM Timer Block Address : 00000408
[050h 080 4] GPE0 Block Address : 00000420
[054h 084 4] GPE1 Block Address : 000005A0
[058h 088 1] PM1 Event Block Length : 04
[059h 089 1] PM1 Control Block Length : 02
[05Ah 090 1] PM2 Control Block Length : 01
[05Bh 091 1] PM Timer Block Length : 04
[05Ch 092 1] GPE0 Block Length : 08
[05Dh 093 1] GPE1 Block Length : 10
[05Eh 094 1] GPE1 Base Offset : 20
[05Fh 095 1] _CST Support : 00
[060h 096 2] C2 Latency : 0065
[062h 098 2] C3 Latency : 03E9
[064h 100 2] CPU Cache Size : 0000
[066h 102 2] Cache Flush Stride : 0000
[068h 104 1] Duty Cycle Offset : 01
[069h 105 1] Duty Cycle Width : 03
[06Ah 106 1] RTC Day Alarm Index : 7D
[06Bh 107 1] RTC Month Alarm Index : 7E
[06Ch 108 1] RTC Century Index : 32
[06Dh 109 2] Boot Flags (decoded below) : 0001
Legacy Devices Supported (V2) : 1
8042 Present on ports 60/64 (V2) : 0
VGA Not Present (V4) : 0
MSI Not Supported (V4) : 0
PCIe ASPM Not Supported (V4) : 0
[06Fh 111 1] Reserved : 00
[070h 112 4] Flags (decoded below) : 00008425
WBINVD instruction is operational (V1) : 1
WBINVD flushes all caches (V1) : 0
All CPUs support C1 (V1) : 1
C2 works on MP system (V1) : 0
Control Method Power Button (V1) : 0
Control Method Sleep Button (V1) : 1
RTC wakeup reg not in fixed space (V1) : 0
RTC can wake system from S4 (V1) : 0
32-bit PM Timer (V1) : 0
Docking Supported (V1) : 0
Reset Register Supported (V2) : 1
Sealed Case (V3) : 0
Headless - No Video (V3) : 0
Use native instr after SLP_TYPx (V3) : 0
PCIEXP_WAK Bits Supported (V4) : 0
Use Platform Timer (V4) : 1
RTC_STS valid on S4 wake (V4) : 0
Remote Power-on capable (V4) : 0
Use APIC Cluster Model (V4) : 0
Use APIC Physical Destination Mode (V4) : 0

[074h 116 12] Reset Register : <Generic Address Structure>
[074h 116 1] Space ID : 01 (SystemIO)
[075h 117 1] Bit Width : 08
[076h 118 1] Bit Offset : 00
[077h 119 1] Access Width : 00
[078h 120 8] Address : 0000000000000CF9

[080h 128 1] Value to cause reset : 06
[081h 129 3] Reserved : 000000
[084h 132 8] FACS Address : 00000000BFECD000
[08Ch 140 8] DSDT Address : 00000000BFEE0000
[094h 148 12] PM1A Event Block : <Generic Address Structure>
[094h 148 1] Space ID : 01 (SystemIO)
[095h 149 1] Bit Width : 20
[096h 150 1] Bit Offset : 00
[097h 151 1] Access Width : 00
[098h 152 8] Address : 0000000000000400

[0A0h 160 12] PM1B Event Block : <Generic Address Structure>
[0A0h 160 1] Space ID : 01 (SystemIO)
[0A1h 161 1] Bit Width : 00
[0A2h 162 1] Bit Offset : 00
[0A3h 163 1] Access Width : 00
[0A4h 164 8] Address : 0000000000000000

[0ACh 172 12] PM1A Control Block : <Generic Address Structure>
[0ACh 172 1] Space ID : 01 (SystemIO)
[0ADh 173 1] Bit Width : 10
[0AEh 174 1] Bit Offset : 00
[0AFh 175 1] Access Width : 00
[0B0h 176 8] Address : 0000000000000404

[0B8h 184 12] PM1B Control Block : <Generic Address Structure>
[0B8h 184 1] Space ID : 01 (SystemIO)
[0B9h 185 1] Bit Width : 00
[0BAh 186 1] Bit Offset : 00
[0BBh 187 1] Access Width : 00
[0BCh 188 8] Address : 0000000000000000

[0C4h 196 12] PM2 Control Block : <Generic Address Structure>
[0C4h 196 1] Space ID : 01 (SystemIO)
[0C5h 197 1] Bit Width : 08
[0C6h 198 1] Bit Offset : 00
[0C7h 199 1] Access Width : 00
[0C8h 200 8] Address : 000000000000041C

[0D0h 208 12] PM Timer Block : <Generic Address Structure>
[0D0h 208 1] Space ID : 01 (SystemIO)
[0D1h 209 1] Bit Width : 20
[0D2h 210 1] Bit Offset : 00
[0D3h 211 1] Access Width : 00
[0D4h 212 8] Address : 0000000000000408

[0DCh 220 12] GPE0 Block : <Generic Address Structure>
[0DCh 220 1] Space ID : 01 (SystemIO)
[0DDh 221 1] Bit Width : 40
[0DEh 222 1] Bit Offset : 00
[0DFh 223 1] Access Width : 00
[0E0h 224 8] Address : 0000000000000420

[0E8h 232 12] GPE1 Block : <Generic Address Structure>
[0E8h 232 1] Space ID : 01 (SystemIO)
[0E9h 233 1] Bit Width : 80
[0EAh 234 1] Bit Offset : 00
[0EBh 235 1] Access Width : 00
[0ECh 236 8] Address : 00000000000005A0


Raw Table Data

0000: 46 41 43 50 F4 00 00 00 03 0B 41 50 50 4C 45 20 FACP......APPLE
0010: 41 70 70 6C 65 30 30 20 8D 00 00 00 4C 6F 6B 69 Apple00 ....Loki
0020: 5F 00 00 00 00 D0 EC BF 00 00 EE BF 00 01 09 00 _...............
0030: 2E 05 00 00 F0 F1 F2 80 00 04 00 00 00 00 00 00 ................
0040: 04 04 00 00 00 00 00 00 1C 04 00 00 08 04 00 00 ................
0050: 20 04 00 00 A0 05 00 00 04 02 01 04 08 10 20 00 ............. .
0060: 65 00 E9 03 00 00 00 00 01 03 7D 7E 32 01 00 00 e.........}~2...
0070: 25 84 00 00 01 08 00 00 F9 0C 00 00 00 00 00 00 %...............
0080: 06 00 00 00 00 D0 EC BF 00 00 00 00 00 00 EE BF ................
0090: 00 00 00 00 01 20 00 00 00 04 00 00 00 00 00 00 ..... ..........
00A0: 01 00 00 00 00 00 00 00 00 00 00 00 01 10 00 00 ................
00B0: 04 04 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
00C0: 00 00 00 00 01 08 00 00 1C 04 00 00 00 00 00 00 ................
00D0: 01 20 00 00 08 04 00 00 00 00 00 00 01 40 00 00 . ...........@..
00E0: 20 04 00 00 00 00 00 00 01 80 00 00 A0 05 00 00 ...............
00F0: 00 00 00 00 ....


hopefully the table didnt get garbled by the mail client.

Justin P. Mattock
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Justin P. Mattock on
On 06/02/2010 05:08 AM, Alan Cox wrote:
> On Tue, 1 Jun 2010 22:48:20 +0100
> Matthew Garrett<mjg59(a)srcf.ucam.org> wrote:
>
>> On Tue, Jun 01, 2010 at 02:43:12PM -0700, Justin P. Mattock wrote:
>>> On 06/01/2010 02:29 PM, Matthew Garrett wrote:
>>>> So, just to be clear, you run this as root and it immediately returns
>>>> you to the prompt? This seems unlikely.
>>>
>>> yep.. with the above code
>>> I (save to a file) then
>>> non-root gcc reboot.c -o reboot
>>> then su
>>> ./reboot
>>> just bake to the command prompt
>>
>> Are you running some sort of security policy that might block hardware
>> access?
>
> Try
>
> if (iopl(...))
> perror
>
> ... (or strace it running as root)
>


o.k. here's the code with perror, and strace:


#include <sys/io.h>
#include <stdio.h>

int main() {
iopl(3);
outb(0xfe, 0x64);
perror("something broke");
}

output in terminal:
something broke: Success


strace:

execve("./reboot", ["./reboot"], [/* 42 vars */]) = 0
brk(0) = 0x601000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x7f0f50247000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or
directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=80596, ...}) = 0
mmap(NULL, 80596, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f0f50233000
close(3) = 0
open("/lib64/libc.so.6", O_RDONLY) = 3
read(3,
"\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\355\241.;\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1838360, ...}) = 0
mmap(0x3b2ea00000, 3664040, PROT_READ|PROT_EXEC,
MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3b2ea00000
mprotect(0x3b2eb75000, 2097152, PROT_NONE) = 0
mmap(0x3b2ed75000, 20480, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x175000) = 0x3b2ed75000
mmap(0x3b2ed7a000, 18600, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3b2ed7a000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x7f0f50232000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x7f0f50231000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x7f0f50230000
arch_prctl(ARCH_SET_FS, 0x7f0f50231700) = 0
mprotect(0x3b2ed75000, 16384, PROT_READ) = 0
mprotect(0x3b2e61e000, 4096, PROT_READ) = 0
munmap(0x7f0f50233000, 80596) = 0
iopl(0x3) = 0
dup(2) = 3
fcntl(3, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
brk(0) = 0x601000
brk(0x622000) = 0x622000
fstat(3, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x7f0f50246000
lseek(3, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
write(3, "something broke: Success\n", 25something broke: Success
) = 25
close(3) = 0
munmap(0x7f0f50246000, 4096) = 0
exit_group(0) = ?

what/where does one look for this keycode
if I may say?

Justin P. Mattock
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Robert Hancock on
On Wed, Jun 2, 2010 at 12:01 AM, Justin P. Mattock
<justinmattock(a)gmail.com> wrote:
>> Can you post the FACP section of the acpidump output from this machine?
>>
>
> here you go:
>


> � � � � � � Reset Register Supported (V2) : 1

> [074h 116 12] � � � � � � � Reset Register : <Generic Address Structure>
> [074h 116 �1] � � � � � � � � � � Space ID : 01 (SystemIO)
> [075h 117 �1] � � � � � � � � � �Bit Width : 08
> [076h 118 �1] � � � � � � � � � Bit Offset : 00
> [077h 119 �1] � � � � � � � � Access Width : 00
> [078h 120 �8] � � � � � � � � � � �Address : 0000000000000CF9
>
> [080h 128 �1] � � � � Value to cause reset : 06

Hmm, so the FADT says the reset register is listed as supported, and
says writing 0x06 to 0xCF9 is supposed to do it.. That's exactly what
this should do:

#include <sys/io.h>

int main() {
iopl(3);
outb(6, 0xcf9);
return 0;
}

but you said that didn't do anything.. It kind of seems like ACPI
reboot is busted on this machine then, but then I wonder how Windows
manages to work..
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Robert Hancock on
On 06/02/2010 05:43 PM, Justin P. Mattock wrote:
> On 06/02/2010 04:18 PM, Robert Hancock wrote:
>> On Wed, Jun 2, 2010 at 12:01 AM, Justin P. Mattock
>> <justinmattock(a)gmail.com> wrote:
>>>> Can you post the FACP section of the acpidump output from this machine?
>>>>
>>>
>>> here you go:
>>>
>>
>>
>>> Reset Register Supported (V2) : 1
>>
>>> [074h 116 12] Reset Register :<Generic Address Structure>
>>> [074h 116 1] Space ID : 01 (SystemIO)
>>> [075h 117 1] Bit Width : 08
>>> [076h 118 1] Bit Offset : 00
>>> [077h 119 1] Access Width : 00
>>> [078h 120 8] Address : 0000000000000CF9
>>>
>>> [080h 128 1] Value to cause reset : 06
>>
>> Hmm, so the FADT says the reset register is listed as supported, and
>> says writing 0x06 to 0xCF9 is supposed to do it.. That's exactly what
>> this should do:
>>
>> #include<sys/io.h>
>>
>> int main() {
>> iopl(3);
>> outb(6, 0xcf9);
>> return 0;
>> }
>>
>> but you said that didn't do anything.. It kind of seems like ACPI
>> reboot is busted on this machine then, but then I wonder how Windows
>> manages to work..
>>
>
>
> alright!! I have a better idea at what this is now..
> as for the above code, yes this one segfaults,
> the other code posted on the thread just returns
> a command prompt(testing:

You get a segfault on that one? Running as root?

>
> #include <sys/io.h>
>
> int main() {
> iopl(3);
> outb(0xfe, 0xcf9);
> return 0;
> }
> on a dell reboot's as is.)
>
> both my macbook, and imac are
> broken with the above.(but for whatever
> reason the macbook doesnt need an dmi entry
> in reboot.c just iMac9,1 etc..)
>
> so the address for the CF9 is this:
>
> [074h 116 12] Reset Register : <Generic Address Structure>
> [074h 116 1] Space ID : 01 (SystemIO)
> [075h 117 1] Bit Width : 08
> [076h 118 1] Bit Offset : 00
> [077h 119 1] Access Width : 00
> [078h 120 8] Address : 0000000000000CF9
>
> [080h 128 1] Value to cause reset : 06
> [081h 129 3] Reserved : 000000
> [084h 132 8] FACS Address : 00000000BFECD000
> [08Ch 140 8] DSDT Address : 00000000BFEE0000
> [094h 148 12] PM1A Event Block : <Generic Address Structure>
> [094h 148 1] Space ID : 01 (SystemIO)
> [095h 149 1] Bit Width : 20
> [096h 150 1] Bit Offset : 00
> [097h 151 1] Access Width : 00
> [098h 152 8] Address : 0000000000000400
>
> not sure how to read this, but are there
> two devices here i.g.
> is the top a cold boot(reset register) and
> the bottom(value to cause reset) a warm boot?

No, the stuff after "Value to cause reset" is something else entirely.

>
> at the moment I'm trying to figure out what/where
> *((unsigned short *)__va(0x472)) = reboot_mode;
> 0x472 comes from as well as 0x1234 then
> #define KBD_STATUS_REG 0x64
> to see if I can see anything.
>
>
> thanks for the info on this..
>
> Justin P. Mattock
>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/