Adding upstream version 6.0.4-dfsg.upstream/6.0.4-dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 941 insertions, 0 deletions

diff --git a/src/VBox/Devices/PC/BIOS/system.c b/src/VBox/Devices/PC/BIOS/system.c
new file mode 100644
index 00000000..d1cb66af
--- /dev/null
+++ b/src/VBox/Devices/PC/BIOS/system.c
@@ -0,0 +1,941 @@
+/* $Id: system.c $ */
+/** @file
+ * PC BIOS - ???
+ */
+
+/*
+ * Copyright (C) 2006-2019 Oracle Corporation
+ *
+ * This file is part of VirtualBox Open Source Edition (OSE), as
+ * available from http://www.virtualbox.org. This file is free software;
+ * you can redistribute it and/or modify it under the terms of the GNU
+ * General Public License (GPL) as published by the Free Software
+ * Foundation, in version 2 as it comes in the "COPYING" file of the
+ * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+ * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+ * --------------------------------------------------------------------
+ *
+ * This code is based on:
+ *
+ *  ROM BIOS for use with Bochs/Plex86/QEMU emulation environment
+ *
+ *  Copyright (C) 2002  MandrakeSoft S.A.
+ *
+ *    MandrakeSoft S.A.
+ *    43, rue d'Aboukir
+ *    75002 Paris - France
+ *    http://www.linux-mandrake.com/
+ *    http://www.mandrakesoft.com/
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301 USA
+ *
+ */
+
+/*
+ * Oracle LGPL Disclaimer: For the avoidance of doubt, except that if any license choice
+ * other than GPL or LGPL is available it will apply instead, Oracle elects to use only
+ * the Lesser General Public License version 2.1 (LGPLv2) at this time for any software where
+ * a choice of LGPL license versions is made available with the language indicating
+ * that LGPLv2 or any later version may be used, or where a choice of which version
+ * of the LGPL is applied is otherwise unspecified.
+ */
+
+
+#include <stdint.h>
+#include "biosint.h"
+#include "inlines.h"
+
+#if DEBUG_INT15
+#  define BX_DEBUG_INT15(...) BX_DEBUG(__VA_ARGS__)
+#else
+#  define BX_DEBUG_INT15(...)
+#endif
+
+
+#define UNSUPPORTED_FUNCTION    0x86    /* Specific to INT 15h. */
+
+#define BIOS_CONFIG_TABLE       0xe6f5  /** @todo configurable? put elsewhere? */
+
+#define ACPI_DATA_SIZE    0x00010000L   /** @todo configurable? put elsewhere? */
+
+extern  int pmode_IDT;
+extern  int rmode_IDT;
+
+uint16_t read_ss(void);
+#pragma aux read_ss = "mov ax, ss" modify exact [ax] nomemory;
+
+#if VBOX_BIOS_CPU >= 80386
+
+/* The 386+ code uses CR0 to switch to/from protected mode.
+ * Quite straightforward.
+ */
+
+void pm_stack_save(uint16_t cx, uint16_t es, uint16_t si);
+#pragma aux pm_stack_save =     \
+    ".386"                      \
+    "push   ds"                 \
+    "push   eax"                \
+    "xor    ax, ax"             \
+    "mov    ds, ax"             \
+    "mov    ds:[467h], sp"      \
+    "mov    ds:[469h], ss"      \
+    parm [cx] [es] [si] modify nomemory;
+
+/* Uses position independent code to build a far return... because it was
+ * too hard to figure out how to code the far call in inline assembler.
+ *
+ * NB: It would be lovely to do 'add [sp],N' instead of 'pop ax; add ax,M;
+ * push ax'. Unfortunately the former cannot be encoded, though 'add [esp],N'
+ * can be on 386 and later -- but it may be unwise to assume that the high
+ * bits of ESP are all zero.
+ */
+void pm_enter(void);
+#pragma aux pm_enter =              \
+    ".386p"                         \
+    "lgdt   fword ptr es:[si+8]"    \
+    "lidt   fword ptr cs:pmode_IDT" \
+    "push   20h"                    \
+    "call   pentry"                 \
+    "pentry:"                       \
+    "pop    ax"                     \
+    "add    ax, 0Eh"                \
+    "push   ax"                     \
+    "mov    eax, cr0"               \
+    "or     al, 1"                  \
+    "mov    cr0, eax"               \
+    "retf"                          \
+    "pm_pm:"                        \
+    "mov    ax, 10h"                \
+    "mov    ds, ax"                 \
+    "add    al, 08h"                \
+    "mov    es, ax"                 \
+    "add    al, 10h"                \
+    "mov    ss, ax"                 \
+    modify nomemory;
+
+/* Restore segment limits to real mode compatible values and
+ * return to real mode.
+ */
+void pm_exit(void);
+#pragma aux pm_exit =               \
+    ".386p"                         \
+    "mov    ax, 28h"                \
+    "mov    ds, ax"                 \
+    "mov    es, ax"                 \
+    "push   0F000h"                 \
+    "call   pexit"                  \
+    "pexit:"                        \
+    "pop    ax"                     \
+    "add    ax, 0Eh"                \
+    "push   ax"                     \
+    "mov    eax, cr0"               \
+    "and    al, 0FEh"               \
+    "mov    cr0, eax"               \
+    "retf"                          \
+    "real_mode:"                    \
+    "lidt   fword ptr cs:rmode_IDT" \
+    modify nomemory;
+
+/* Restore stack and reload segment registers in real mode to ensure
+ * real mode compatible selector+base.
+ */
+void pm_stack_restore(void);
+#pragma aux pm_stack_restore =  \
+    ".386"                      \
+    "xor    ax, ax"             \
+    "mov    ds, ax"             \
+    "mov    es, ax"             \
+    "lss    sp, ds:[467h]"      \
+    "pop    eax"                \
+    "pop    ds"                 \
+    modify nomemory;
+
+#elif VBOX_BIOS_CPU >= 80286
+
+/* The 286 code uses LMSW to switch to protected mode but it has to reset
+ * the CPU to get back to real mode. Ugly! See return_blkmove in orgs.asm
+ * for the other matching half.
+ */
+void pm_stack_save(uint16_t cx, uint16_t es, uint16_t si, uint16_t frame);
+#pragma aux pm_stack_save =     \
+    "xor    ax, ax"             \
+    "mov    ds, ax"             \
+    "mov    ds:[467h], bx"      \
+    "mov    ds:[469h], ss"      \
+    parm [cx] [es] [si] [bx] modify nomemory;
+
+/* Uses position independent code... because it was too hard to figure
+ * out how to code the far call in inline assembler.
+ */
+void pm_enter(void);
+#pragma aux pm_enter =              \
+    ".286p"                         \
+    "lgdt   fword ptr es:[si+8]"    \
+    "lidt   fword ptr cs:pmode_IDT" \
+    "push   20h"                    \
+    "call   pentry"                 \
+    "pentry:"                       \
+    "pop    ax"                     \
+    "add    ax, 0Eh"                \
+    "push   ax"                     \
+    "smsw   ax"                     \
+    "or     al, 1"                  \
+    "lmsw   ax"                     \
+    "retf"                          \
+    "pm_pm:"                        \
+    "mov    ax, 10h"                \
+    "mov    ds, ax"                 \
+    "add    al, 08h"                \
+    "mov    es, ax"                 \
+    "add    al, 10h"                \
+    "mov    ss, ax"                 \
+    modify nomemory;
+
+/* Set up shutdown status and reset the CPU. The POST code
+ * will regain control. Port 80h is written with status.
+ * Code 9 is written to CMOS shutdown status byte (0Fh).
+ * CPU is triple faulted.                                                    .
+ */
+void pm_exit(void);
+#pragma aux pm_exit =               \
+    "xor    ax, ax"                 \
+    "out    80h, al"                \
+    "mov    al, 0Fh"                \
+    "out    70h, al"                \
+    "mov    al, 09h"                \
+    "out    71h, al"                \
+    ".286p"                         \
+    "lidt   fword ptr cs:pmode_IDT" \
+    "int    3"                      \
+    modify nomemory;
+
+/* Dummy. Actually done in return_blkmove. */
+void pm_stack_restore(void);
+#pragma aux pm_stack_restore =  \
+    "rm_return:"                \
+    modify nomemory;
+
+#endif
+
+/* NB: CX is set earlier in pm_stack_save */
+void pm_copy(void);
+#pragma aux pm_copy =               \
+    "xor    si, si"                 \
+    "xor    di, di"                 \
+    "cld"                           \
+    "rep    movsw"                  \
+    modify [si di cx] nomemory;
+
+/* The pm_switch has a few crucial differences from pm_enter, hence
+ * it is replicated here. Uses LMSW to avoid trashing high word of eax.
+ */
+void pm_switch(uint16_t reg_si);
+#pragma aux pm_switch =             \
+    ".286p"                         \
+    "lgdt   fword ptr es:[si+08h]"  \
+    "lidt   fword ptr es:[si+10h]"  \
+    "push   38h"                    \
+    "call   pentry"                 \
+    "pentry:"                       \
+    "pop    ax"                     \
+    "add    ax, 0Eh"                \
+    "push   ax"                     \
+    "smsw   ax"                     \
+    "or     al, 1"                  \
+    "lmsw   ax"                     \
+    "retf"                          \
+    "pm_pm:"                        \
+    "mov    ax, 18h"                \
+    "mov    ds, ax"                 \
+    "add    al, 08h"                \
+    "mov    es, ax"                 \
+    "add    al, 08h"                \
+    "mov    ss, ax"                 \
+    parm [si] modify nomemory;
+
+/* Return to caller - we do not use IRET because we should not enable
+ * interrupts. Note that AH must be zero on exit.
+ * WARNING: Needs to be adapted if calling sequence is modified!
+ */
+void pm_unwind(uint16_t args);
+#pragma aux pm_unwind =     \
+    ".286"                  \
+    "mov    sp, ax"         \
+    "popa"                  \
+    "add    sp, 6"          \
+    "pop    cx"             \
+    "pop    ax"             \
+    "pop    ax"             \
+    "mov    ax, 30h"        \
+    "push   ax"             \
+    "push   cx"             \
+    "retf"                  \
+    parm [ax] modify nomemory aborts;
+
+/// @todo This method is silly. The RTC should be programmed to fire an interrupt
+// instead of hogging the CPU with inaccurate code.
+void timer_wait(uint32_t usec_wait)
+{
+    uint32_t    cycles;
+    uint8_t     old_val;
+    uint8_t     cur_val;
+
+    /* We wait in 15 usec increments. */
+    cycles = usec_wait / 15;
+
+    old_val = inp(0x61) & 0x10;
+    while (cycles--) {
+        /* Wait 15us. */
+        do {
+            cur_val = inp(0x61) & 0x10;
+        } while (cur_val != old_val);
+        old_val = cur_val;
+    }
+}
+
+bx_bool set_enable_a20(bx_bool val)
+{
+    uint8_t     oldval;
+
+    // Use PS/2 System Control port A to set A20 enable
+
+    // get current setting first
+    oldval = inb(0x92);
+
+    // change A20 status
+    if (val)
+        outb(0x92, oldval | 0x02);
+    else
+        outb(0x92, oldval & 0xfd);
+
+    return((oldval & 0x02) != 0);
+}
+
+/// @todo move elsewhere?
+#define AX      r.gr.u.r16.ax
+#define BX      r.gr.u.r16.bx
+#define CX      r.gr.u.r16.cx
+#define DX      r.gr.u.r16.dx
+#define SI      r.gr.u.r16.si
+#define DI      r.gr.u.r16.di
+#define BP      r.gr.u.r16.bp
+#define SP      r.gr.u.r16.sp
+#define FLAGS   r.fl.u.r16.flags
+#define EAX     r.gr.u.r32.eax
+#define EBX     r.gr.u.r32.ebx
+#define ECX     r.gr.u.r32.ecx
+#define EDX     r.gr.u.r32.edx
+#define ESI     r.gr.u.r32.esi
+#define EDI     r.gr.u.r32.edi
+#define ES      r.es
+
+
+void BIOSCALL int15_function(sys_regs_t r)
+{
+    uint16_t    bRegister;
+    uint8_t     irqDisable;
+
+    BX_DEBUG_INT15("int15 AX=%04x\n",AX);
+
+    switch (GET_AH()) {
+    case 0x00: /* assorted functions */
+        if (GET_AL() != 0xc0)
+            goto undecoded;
+        /* GRUB calls int15 with ax=0x00c0 to get the ROM configuration table,
+        * which we don't support, but logging that event is annoying. In fact
+        * it is likely that they just misread some specs, because there is a
+        * int15 BIOS function AH=0xc0 which sounds quite similar to what GRUB
+        * wants to achieve. */
+        SET_CF();
+        SET_AH(UNSUPPORTED_FUNCTION);
+        break;
+    case 0x24: /* A20 Control */
+        switch (GET_AL()) {
+        case 0x00:
+            set_enable_a20(0);
+            CLEAR_CF();
+            SET_AH(0);
+            break;
+        case 0x01:
+            set_enable_a20(1);
+            CLEAR_CF();
+            SET_AH(0);
+            break;
+        case 0x02:
+            SET_AL( (inb(0x92) >> 1) & 0x01 );
+            CLEAR_CF();
+            SET_AH(0);
+            break;
+        case 0x03:
+            CLEAR_CF();
+            SET_AH(0);
+            BX = 3;
+            break;
+        default:
+            BX_INFO("int15: Func 24h, subfunc %02xh, A20 gate control not supported\n", (unsigned) GET_AL());
+            SET_CF();
+            SET_AH(UNSUPPORTED_FUNCTION);
+        }
+        break;
+
+        /* These are here just to avoid warnings being logged. */
+    case 0x22:  /* Locate ROM BASIC (tough when we don't have any.) */
+    case 0x41:  /* PC Convertible, wait for external events. */
+    case 0xC7:  /* PS/2, get memory map. */
+        SET_CF();
+        SET_AH(UNSUPPORTED_FUNCTION);
+        break;
+
+    /// @todo Why does this need special handling? All we need is to set CF
+    //       but not handle this as an unknown function (regardless of CPU type).
+    case 0x4f:
+        /* keyboard intercept */
+#if VBOX_BIOS_CPU >= 80286
+        // nop
+#else
+        SET_AH(UNSUPPORTED_FUNCTION);
+#endif
+        SET_CF();
+        break;
+
+    case 0x52:    // removable media eject
+        CLEAR_CF();
+        SET_AH(0);  // "ok ejection may proceed"
+        break;
+
+    case 0x83: {
+        if( GET_AL() == 0 ) {
+            // Set Interval requested.
+            if( ( read_byte( 0x40, 0xA0 ) & 1 ) == 0 ) {
+                // Interval not already set.
+                write_byte( 0x40, 0xA0, 1 );  // Set status byte.
+                write_word( 0x40, 0x98, ES ); // Byte location, segment
+                write_word( 0x40, 0x9A, BX ); // Byte location, offset
+                write_word( 0x40, 0x9C, DX ); // Low word, delay
+                write_word( 0x40, 0x9E, CX ); // High word, delay.
+                CLEAR_CF( );
+                irqDisable = inb( 0xA1 );
+                outb( 0xA1, irqDisable & 0xFE );
+                bRegister = inb_cmos( 0xB );  // Unmask IRQ8 so INT70 will get through.
+                outb_cmos( 0xB, bRegister | 0x40 ); // Turn on the Periodic Interrupt timer
+            } else {
+                // Interval already set.
+                BX_DEBUG_INT15("int15: Func 83h, failed, already waiting.\n" );
+                SET_CF();
+                SET_AH(UNSUPPORTED_FUNCTION);
+            }
+        } else if( GET_AL() == 1 ) {
+            // Clear Interval requested
+            write_byte( 0x40, 0xA0, 0 );  // Clear status byte
+            CLEAR_CF( );
+            bRegister = inb_cmos( 0xB );
+            outb_cmos( 0xB, bRegister & ~0x40 );  // Turn off the Periodic Interrupt timer
+        } else {
+            BX_DEBUG_INT15("int15: Func 83h, failed.\n" );
+            SET_CF();
+            SET_AH(UNSUPPORTED_FUNCTION);
+            SET_AL(GET_AL() - 1);
+        }
+
+        break;
+        }
+
+    case 0x86:
+        // Wait for CX:DX microseconds. currently using the
+        // refresh request port 0x61 bit4, toggling every 15usec
+        int_enable();
+        timer_wait(((uint32_t)CX << 16) | DX);
+        break;
+
+    case 0x88:
+        // Get the amount of extended memory (above 1M)
+#if VBOX_BIOS_CPU >= 80286
+        AX = (inb_cmos(0x31) << 8) | inb_cmos(0x30);
+
+#if VBOX_BIOS_CPU >= 80386
+        // According to Ralf Brown's interrupt the limit should be 15M,
+        // but real machines mostly return max. 63M.
+        if(AX > 0xffc0)
+            AX = 0xffc0;
+#else
+        // An AT compatible cannot have more than 15M extended memory.
+        // If more is reported, some software (e.g. Windows 3.1) gets
+        // quite upset.
+        if(AX > 0x3c00)
+            AX = 0x3c00;
+#endif
+
+        CLEAR_CF();
+#else
+        SET_AH(UNSUPPORTED_FUNCTION);
+        SET_CF();
+#endif
+        break;
+
+    case 0x89:
+        // Switch to Protected Mode.
+        // ES:DI points to user-supplied GDT
+        // BH/BL contains starting interrupt numbers for PIC0/PIC1
+        // This subfunction does not return!
+
+        // turn off interrupts
+        int_disable();  /// @todo aren't they off already?
+
+        set_enable_a20(1); // enable A20 line; we're supposed to fail if that fails
+
+        // Initialize CS descriptor for BIOS
+        write_word(ES, SI+0x38+0, 0xffff);// limit 15:00 = normal 64K limit
+        write_word(ES, SI+0x38+2, 0x0000);// base 15:00
+        write_byte(ES, SI+0x38+4, 0x000f);// base 23:16 (hardcoded to f000:0000)
+        write_byte(ES, SI+0x38+5, 0x9b);  // access
+        write_word(ES, SI+0x38+6, 0x0000);// base 31:24/reserved/limit 19:16
+
+        /* Reprogram the PICs. */
+        outb(PIC_MASTER, PIC_CMD_INIT);
+        outb(PIC_SLAVE,  PIC_CMD_INIT);
+        outb(PIC_MASTER + 1, GET_BH());
+        outb(PIC_SLAVE + 1,  GET_BL());
+        outb(PIC_MASTER + 1, 4);
+        outb(PIC_SLAVE + 1,  2);
+        outb(PIC_MASTER + 1, 1);
+        outb(PIC_SLAVE + 1,  1);
+        /* Mask all IRQs, user must re-enable. */
+        outb(PIC_MASTER_MASK, 0xff);
+        outb(PIC_SLAVE_MASK, 0xff);
+
+        pm_switch(SI);
+        pm_unwind((uint16_t)&r);
+
+        break;
+
+    case 0x90:
+        /* Device busy interrupt.  Called by Int 16h when no key available */
+        break;
+
+    case 0x91:
+        /* Interrupt complete.  Called by Int 16h when key becomes available */
+        break;
+
+    case 0xbf:
+        BX_INFO("*** int 15h function AH=bf not yet supported!\n");
+        SET_CF();
+        SET_AH(UNSUPPORTED_FUNCTION);
+        break;
+
+    case 0xC0:
+        CLEAR_CF();
+        SET_AH(0);
+        BX = BIOS_CONFIG_TABLE;
+        ES = 0xF000;
+        break;
+
+    case 0xc1:
+        ES = read_word(0x0040, 0x000E);
+        CLEAR_CF();
+        break;
+
+    case 0xd8:
+        bios_printf(BIOS_PRINTF_DEBUG, "EISA BIOS not present\n");
+        SET_CF();
+        SET_AH(UNSUPPORTED_FUNCTION);
+        break;
+
+    /* Make the BIOS warning for pretty much every Linux kernel start
+    * disappear - it calls with ax=0xe980 to figure out SMI info. */
+    case 0xe9: /* SMI functions (SpeedStep and similar things) */
+        SET_CF();
+        SET_AH(UNSUPPORTED_FUNCTION);
+        break;
+    case 0xec: /* AMD64 target operating mode callback */
+        if (GET_AL() != 0)
+            goto undecoded;
+        SET_AH(0);
+        if (GET_BL() >= 1 && GET_BL() <= 3)
+            CLEAR_CF();   /* Accepted value. */
+        else
+            SET_CF();     /* Reserved, error. */
+        break;
+undecoded:
+    default:
+        BX_INFO("*** int 15h function AX=%04x, BX=%04x not yet supported!\n",
+                (unsigned) AX, (unsigned) BX);
+        SET_CF();
+        SET_AH(UNSUPPORTED_FUNCTION);
+        break;
+    }
+}
+
+#if VBOX_BIOS_CPU >= 80386
+
+typedef struct {
+    uint32_t    start;
+    uint32_t    xstart;
+    uint32_t    len;
+    uint32_t    xlen;
+    uint32_t    type;
+} mem_range_t;
+
+void set_e820_range(uint16_t reg_ES, uint16_t reg_DI, uint32_t start, uint32_t end,
+                    uint8_t extra_start, uint8_t extra_end, uint16_t type)
+{
+    mem_range_t __far   *range;
+
+    range = reg_ES :> (mem_range_t *)reg_DI;
+    range->start  = start;
+    range->xstart = extra_start;
+    end -= start;
+    extra_end -= extra_start;
+    range->len    = end;
+    range->xlen   = extra_end;
+    range->type   = type;
+}
+
+void BIOSCALL int15_function32(sys32_regs_t r)
+{
+    uint32_t    extended_memory_size=0; // 64bits long
+    uint32_t    extra_lowbits_memory_size=0;
+    uint8_t     extra_highbits_memory_size=0;
+    uint32_t    mcfgStart, mcfgSize;
+
+    BX_DEBUG_INT15("int15 AX=%04x\n",AX);
+
+    switch (GET_AH()) {
+    case 0xd0:
+        if (GET_AL() != 0x4f)
+            goto int15_unimplemented;
+        if (EBX == 0x50524f43 && ECX == 0x4d4f4445 && ESI == 0 && EDI == 0)
+        {
+            CLEAR_CF();
+            ESI = EBX;
+            EDI = ECX;
+            EAX = 0x49413332;
+        }
+        else
+            goto int15_unimplemented;
+        break;
+
+    case 0xe8:
+        switch(GET_AL()) {
+        case 0x20: // coded by osmaker aka K.J.
+            if(EDX == 0x534D4150) {
+                extended_memory_size = inb_cmos(0x35);
+                extended_memory_size <<= 8;
+                extended_memory_size |= inb_cmos(0x34);
+                extended_memory_size *= 64;
+#ifndef VBOX /* The following excludes 0xf0000000 thru 0xffffffff. Trust DevPcBios.cpp to get this right. */
+                // greater than EFF00000???
+                if(extended_memory_size > 0x3bc000) {
+                    extended_memory_size = 0x3bc000; // everything after this is reserved memory until we get to 0x100000000
+                }
+#endif /* !VBOX */
+                extended_memory_size *= 1024;
+                extended_memory_size += (16L * 1024 * 1024);
+
+                if(extended_memory_size <= (16L * 1024 * 1024)) {
+                    extended_memory_size = inb_cmos(0x31);
+                    extended_memory_size <<= 8;
+                    extended_memory_size |= inb_cmos(0x30);
+                    extended_memory_size *= 1024;
+                    extended_memory_size += (1L * 1024 * 1024);
+                }
+
+#ifdef VBOX     /* We've already used the CMOS entries for SATA.
+                   BTW. This is the amount of memory above 4GB measured in 64KB units. */
+                extra_lowbits_memory_size = inb_cmos(0x62);
+                extra_lowbits_memory_size <<= 8;
+                extra_lowbits_memory_size |= inb_cmos(0x61);
+                extra_lowbits_memory_size <<= 16;
+                extra_highbits_memory_size = inb_cmos(0x63);
+                /* 0x64 and 0x65 can be used if we need to dig 1 TB or more at a later point. */
+#else
+                extra_lowbits_memory_size = inb_cmos(0x5c);
+                extra_lowbits_memory_size <<= 8;
+                extra_lowbits_memory_size |= inb_cmos(0x5b);
+                extra_lowbits_memory_size *= 64;
+                extra_lowbits_memory_size *= 1024;
+                extra_highbits_memory_size = inb_cmos(0x5d);
+#endif /* !VBOX */
+
+                mcfgStart = 0;
+                mcfgSize  = 0;
+
+                switch(BX)
+                {
+                    case 0:
+                        set_e820_range(ES, DI,
+#ifndef VBOX /** @todo Upstream suggests the following, needs checking. (see next as well) */
+                                       0x0000000L, 0x0009f000L, 0, 0, 1);
+#else
+                                       0x0000000L, 0x0009fc00L, 0, 0, 1);
+#endif
+                        EBX = 1;
+                        break;
+                    case 1:
+                        set_e820_range(ES, DI,
+#ifndef VBOX /** @todo Upstream suggests the following, needs checking. (see next as well) */
+                                       0x0009f000L, 0x000a0000L, 0, 0, 2);
+#else
+                                       0x0009fc00L, 0x000a0000L, 0, 0, 2);
+#endif
+                        EBX = 2;
+                        break;
+                    case 2:
+#ifdef VBOX
+                        /* Mark the BIOS as reserved. VBox doesn't currently
+                         * use the 0xe0000-0xeffff area. It does use the
+                         * 0xd0000-0xdffff area for the BIOS logo, but it's
+                         * not worth marking it as reserved. (this is not
+                         * true anymore because the VGA adapter handles the logo stuff)
+                         * The whole 0xe0000-0xfffff can be used for the BIOS.
+                         * Note that various
+                         * Windows versions don't accept (read: in debug builds
+                         * they trigger the "Too many similar traps" assertion)
+                         * a single reserved range from 0xd0000 to 0xffffff.
+                         * A 128K area starting from 0xd0000 works. */
+                        set_e820_range(ES, DI,
+                                       0x000f0000L, 0x00100000L, 0, 0, 2);
+#else /* !VBOX */
+                        set_e820_range(ES, DI,
+                                       0x000e8000L, 0x00100000L, 0, 0, 2);
+#endif /* !VBOX */
+                        EBX = 3;
+                        break;
+                    case 3:
+#if BX_ROMBIOS32 || defined(VBOX)
+                        set_e820_range(ES, DI,
+                                       0x00100000L,
+                                       extended_memory_size - ACPI_DATA_SIZE, 0, 0, 1);
+                        EBX = 4;
+#else
+                        set_e820_range(ES, DI,
+                                       0x00100000L,
+                                       extended_memory_size, 1);
+                        EBX = 5;
+#endif
+                        break;
+                    case 4:
+                        set_e820_range(ES, DI,
+                                       extended_memory_size - ACPI_DATA_SIZE,
+                                       extended_memory_size, 0, 0, 3); // ACPI RAM
+                        EBX = 5;
+                        break;
+                    case 5:
+                        set_e820_range(ES, DI,
+                                       0xfec00000,
+                                       0xfec00000 + 0x1000, 0, 0, 2); // I/O APIC
+                        EBX = 6;
+                        break;
+                    case 6:
+                        set_e820_range(ES, DI,
+                                       0xfee00000,
+                                       0xfee00000 + 0x1000, 0, 0, 2); // Local APIC
+                        EBX = 7;
+                        break;
+                    case 7:
+                        /* 256KB BIOS area at the end of 4 GB */
+#ifdef VBOX
+                        /* We don't set the end to 1GB here and rely on the 32-bit
+                           unsigned wrap around effect (0-0xfffc0000L). */
+#endif
+                        set_e820_range(ES, DI,
+                                       0xfffc0000L, 0x00000000L, 0, 0, 2);
+                        if (mcfgStart != 0)
+                            EBX = 8;
+                        else
+                        {
+                            if (extra_highbits_memory_size || extra_lowbits_memory_size)
+                                EBX = 9;
+                            else
+                                EBX = 0;
+                        }
+                        break;
+                     case 8:
+                        /* PCI MMIO config space (MCFG) */
+                        set_e820_range(ES, DI,
+                                       mcfgStart, mcfgStart + mcfgSize, 0, 0, 2);
+
+                        if (extra_highbits_memory_size || extra_lowbits_memory_size)
+                            EBX = 9;
+                        else
+                            EBX = 0;
+                        break;
+                    case 9:
+#ifdef VBOX /* Don't succeeded if no memory above 4 GB.  */
+                        /* Mapping of memory above 4 GB if present.
+                           Note1: set_e820_range needs do no borrowing in the
+                                  subtraction because of the nice numbers.
+                           Note2* works only up to 1TB because of uint8_t for
+                                  the upper bits!*/
+                        if (extra_highbits_memory_size || extra_lowbits_memory_size)
+                        {
+                            set_e820_range(ES, DI,
+                                           0x00000000L, extra_lowbits_memory_size,
+                                           1 /*x4GB*/, extra_highbits_memory_size + 1 /*x4GB*/, 1);
+                            EBX = 0;
+                        }
+                        break;
+                        /* fall thru */
+#else  /* !VBOX */
+                        /* Mapping of memory above 4 GB */
+                        set_e820_range(ES, DI, 0x00000000L,
+                        extra_lowbits_memory_size, 1, extra_highbits_memory_size
+                                       + 1, 1);
+                        EBX = 0;
+                        break;
+#endif /* !VBOX */
+                    default:  /* AX=E820, DX=534D4150, BX unrecognized */
+                        goto int15_unimplemented;
+                        break;
+                }
+                EAX = 0x534D4150;
+                ECX = 0x14;
+                CLEAR_CF();
+            } else {
+                // if DX != 0x534D4150)
+                goto int15_unimplemented;
+            }
+            break;
+
+        case 0x01:
+            // do we have any reason to fail here ?
+            CLEAR_CF();
+
+            // my real system sets ax and bx to 0
+            // this is confirmed by Ralph Brown list
+            // but syslinux v1.48 is known to behave
+            // strangely if ax is set to 0
+            // regs.u.r16.ax = 0;
+            // regs.u.r16.bx = 0;
+
+            // Get the amount of extended memory (above 1M)
+            CX = (inb_cmos(0x31) << 8) | inb_cmos(0x30);
+
+            // limit to 15M
+            if(CX > 0x3c00)
+                CX = 0x3c00;
+
+            // Get the amount of extended memory above 16M in 64k blocks
+            DX = (inb_cmos(0x35) << 8) | inb_cmos(0x34);
+
+            // Set configured memory equal to extended memory
+            AX = CX;
+            BX = DX;
+            break;
+        default:  /* AH=0xE8?? but not implemented */
+            goto int15_unimplemented;
+        }
+        break;
+    int15_unimplemented:
+       // fall into the default case
+    default:
+        BX_INFO("*** int 15h function AX=%04x, BX=%04x not yet supported!\n",
+                (unsigned) AX, (unsigned) BX);
+        SET_CF();
+        SET_AL(UNSUPPORTED_FUNCTION);
+        break;
+    }
+}
+#endif  /* VBOX_BIOS_CPU >= 80386 */
+
+#if VBOX_BIOS_CPU >= 80286
+
+#undef  FLAGS
+#define FLAGS   r.ra.flags.u.r16.flags
+
+/* Function 0x87 handled separately due to specific stack layout requirements. */
+void BIOSCALL int15_blkmove(disk_regs_t r)
+{
+    uint16_t    base15_00;
+    uint8_t     base23_16;
+    uint16_t    ss;
+
+    // +++ should probably have descriptor checks
+    // +++ should have exception handlers
+
+    // turn off interrupts
+    int_disable();    /// @todo aren't they disabled already?
+
+    set_enable_a20(1);  // enable A20 line
+
+    // 128K max of transfer on 386+ ???
+    // source == destination ???
+
+    // ES:SI points to descriptor table
+    // offset   use     initially  comments
+    // ==============================================
+    // 00..07   Unused  zeros      Null descriptor
+    // 08..0f   scratch zeros      work area used by BIOS
+    // 10..17   source  ssssssss   source of data
+    // 18..1f   dest    dddddddd   destination of data
+    // 20..27   CS      zeros      filled in by BIOS
+    // 28..2f   SS      zeros      filled in by BIOS
+
+    //es:si
+    //eeee0
+    //0ssss
+    //-----
+
+    // check for access rights of source & dest here
+
+    // Initialize GDT descriptor
+    base15_00 = (ES << 4) + SI;
+    base23_16 = ES >> 12;
+    if (base15_00 < (ES<<4))
+        base23_16++;
+    write_word(ES, SI+0x08+0, 47);       // limit 15:00 = 6 * 8bytes/descriptor
+    write_word(ES, SI+0x08+2, base15_00);// base 15:00
+    write_byte(ES, SI+0x08+4, base23_16);// base 23:16
+    write_byte(ES, SI+0x08+5, 0x93);     // access
+    write_word(ES, SI+0x08+6, 0x0000);   // base 31:24/reserved/limit 19:16
+
+    // Initialize CS descriptor
+    write_word(ES, SI+0x20+0, 0xffff);// limit 15:00 = normal 64K limit
+    write_word(ES, SI+0x20+2, 0x0000);// base 15:00
+    write_byte(ES, SI+0x20+4, 0x000f);// base 23:16
+    write_byte(ES, SI+0x20+5, 0x9b);  // access
+    write_word(ES, SI+0x20+6, 0x0000);// base 31:24/reserved/limit 19:16
+
+    // Initialize SS descriptor
+    ss = read_ss();
+    base15_00 = ss << 4;
+    base23_16 = ss >> 12;
+    write_word(ES, SI+0x28+0, 0xffff);   // limit 15:00 = normal 64K limit
+    write_word(ES, SI+0x28+2, base15_00);// base 15:00
+    write_byte(ES, SI+0x28+4, base23_16);// base 23:16
+    write_byte(ES, SI+0x28+5, 0x93);     // access
+    write_word(ES, SI+0x28+6, 0x0000);   // base 31:24/reserved/limit 19:16
+
+#if VBOX_BIOS_CPU >= 80386
+    /* Not taking the address of the parameter allows the code generator
+     * produce slightly better code for some unknown reason.
+     */
+    pm_stack_save(CX, ES, SI);
+#else
+    pm_stack_save(CX, ES, SI, FP_OFF(&r));
+#endif
+    pm_enter();
+    pm_copy();
+    pm_exit();
+    pm_stack_restore();
+
+    set_enable_a20(0);  // unconditionally disable A20 line
+
+    // turn interrupts back on
+    int_enable();
+
+    SET_AH(0);
+    CLEAR_CF();
+}
+#endif  /* VBOX_BIOS_CPU >= 80286 */