--- qemu/roms/seabios/src/system.c	2018/04/24 17:36:46	1.1
+++ qemu/roms/seabios/src/system.c	2018/04/24 18:27:11	1.1.1.3
@@ -111,8 +111,8 @@ handle_1587(struct bregs *regs)
     SET_FARVAR(gdt_seg, gdt_far[1], GDT_DATA | GDT_LIMIT((6*sizeof(u64))-1)
                | GDT_BASE(loc));
     // Initialize CS descriptor
-    SET_FARVAR(gdt_seg, gdt_far[4], GDT_CODE | GDT_LIMIT(0x0ffff)
-               | GDT_BASE(0xf0000));
+    SET_FARVAR(gdt_seg, gdt_far[4], GDT_CODE | GDT_LIMIT(BUILD_BIOS_SIZE-1)
+               | GDT_BASE(BUILD_BIOS_ADDR));
     // Initialize SS descriptor
     loc = (u32)MAKE_FLATPTR(GET_SEG(SS), 0);
     SET_FARVAR(gdt_seg, gdt_far[5], GDT_DATA | GDT_LIMIT(0x0ffff)
@@ -121,44 +121,47 @@ handle_1587(struct bregs *regs)
     u16 count = regs->cx;
     asm volatile(
         // Load new descriptor tables
-        "lgdtw %%es:(1<<3)(%%si)\n"
-        "lidtw %%cs:pmode_IDT_info\n"
+        "  lgdtw %%es:(1<<3)(%%si)\n"
+        "  lidtw %%cs:pmode_IDT_info\n"
 
         // Enable protected mode
-        "movl %%cr0, %%eax\n"
-        "orl $" __stringify(CR0_PE) ", %%eax\n"
-        "movl %%eax, %%cr0\n"
+        "  movl %%cr0, %%eax\n"
+        "  orl $" __stringify(CR0_PE) ", %%eax\n"
+        "  movl %%eax, %%cr0\n"
 
         // far jump to flush CPU queue after transition to protected mode
-        "ljmpw $(4<<3), $1f\n"
-        "1:\n"
+        "  ljmpw $(4<<3), $1f\n"
 
         // GDT points to valid descriptor table, now load DS, ES
-        "movw $(2<<3), %%ax\n" // 2nd descriptor in table, TI=GDT, RPL=00
-        "movw %%ax, %%ds\n"
-        "movw $(3<<3), %%ax\n" // 3rd descriptor in table, TI=GDT, RPL=00
-        "movw %%ax, %%es\n"
+        "1:movw $(2<<3), %%ax\n" // 2nd descriptor in table, TI=GDT, RPL=00
+        "  movw %%ax, %%ds\n"
+        "  movw $(3<<3), %%ax\n" // 3rd descriptor in table, TI=GDT, RPL=00
+        "  movw %%ax, %%es\n"
 
         // move CX words from DS:SI to ES:DI
-        "xorw %%si, %%si\n"
-        "xorw %%di, %%di\n"
-        "rep movsw\n"
+        "  xorw %%si, %%si\n"
+        "  xorw %%di, %%di\n"
+        "  rep movsw\n"
+
+        // Restore DS and ES segment limits to 0xffff
+        "  movw $(5<<3), %%ax\n" // 5th descriptor in table (SS)
+        "  movw %%ax, %%ds\n"
+        "  movw %%ax, %%es\n"
 
         // Disable protected mode
-        "movl %%cr0, %%eax\n"
-        "andl $~" __stringify(CR0_PE) ", %%eax\n"
-        "movl %%eax, %%cr0\n"
+        "  movl %%cr0, %%eax\n"
+        "  andl $~" __stringify(CR0_PE) ", %%eax\n"
+        "  movl %%eax, %%cr0\n"
 
         // far jump to flush CPU queue after transition to real mode
-        "ljmpw $" __stringify(SEG_BIOS) ", $2f\n"
-        "2:\n"
+        "  ljmpw $" __stringify(SEG_BIOS) ", $2f\n"
 
         // restore IDT to normal real-mode defaults
-        "lidtw %%cs:rmode_IDT_info\n"
+        "2:lidtw %%cs:rmode_IDT_info\n"
 
         // Restore %ds (from %ss)
-        "movw %%ss, %%ax\n"
-        "movw %%ax, %%ds\n"
+        "  movw %%ss, %%ax\n"
+        "  movw %%ax, %%ds\n"
         : "+c"(count), "+S"(si)
         : : "eax", "di", "cc"); // XXX - also clobbers %es
 
@@ -182,6 +185,47 @@ handle_1588(struct bregs *regs)
     set_success(regs);
 }
 
+// Switch to protected mode
+static void
+handle_1589(struct bregs *regs)
+{
+    set_a20(1);
+
+    set_pics(regs->bl, regs->bh);
+
+    u64 *gdt_far = (void*)(regs->si + 0);
+    u16 gdt_seg = regs->es;
+    SET_FARVAR(gdt_seg, gdt_far[7], GDT_CODE | GDT_LIMIT(BUILD_BIOS_SIZE-1)
+               | GDT_BASE(BUILD_BIOS_ADDR));
+
+    regs->ds = 3<<3; // 3rd gdt descriptor is %ds
+    regs->es = 4<<3; // 4th gdt descriptor is %es
+    regs->code.seg = 6<<3; // 6th gdt descriptor is %cs
+
+    set_code_success(regs);
+
+    asm volatile(
+        // Load new descriptor tables
+        "  lgdtw %%es:(1<<3)(%%si)\n"
+        "  lidtw %%es:(2<<3)(%%si)\n"
+
+        // Enable protected mode
+        "  movl %%cr0, %%eax\n"
+        "  orl $" __stringify(CR0_PE) ", %%eax\n"
+        "  movl %%eax, %%cr0\n"
+
+        // far jump to flush CPU queue after transition to protected mode
+        "  ljmpw $(7<<3), $1f\n"
+
+        // GDT points to valid descriptor table, now load SS
+        "1:movw $(5<<3), %%ax\n"
+        "  movw %%ax, %%ds\n"
+        "  movw %%ax, %%ss\n"
+        :
+        : "S"(gdt_far)
+        : "eax", "cc");
+}
+
 // Device busy interrupt.  Called by Int 16h when no key available
 static void
 handle_1590(struct bregs *regs)
@@ -309,6 +353,7 @@ handle_15(struct bregs *regs)
     case 0x86: handle_1586(regs); break;
     case 0x87: handle_1587(regs); break;
     case 0x88: handle_1588(regs); break;
+    case 0x89: handle_1589(regs); break;
     case 0x90: handle_1590(regs); break;
     case 0x91: handle_1591(regs); break;
     case 0xc0: handle_15c0(regs); break;