I recently received an email form Bela Lubkin, who pointed out some mistakes I made in my previous hack:

In grub-0.97_macrpro_esb2_ahci_stage1.patch, I happened to randomly notice a bug. (Ran across it while googling information to get my Dell notebook w/Ubuntu 8.10 to use ahci rather than ata_piix driver...)

The bug: you've moved the setup of the stack segment register (%ss) after the setup of the stack pointer (%sp). I don't have full context (didn't bother to find the stage1.S full file you're patching), so I don't know if it's OK that you are pushing %edx onto [%old-ss:$STAGE1_STACKSEG]. But probably not. But even worse is the "sti /* we're safe again */". Ancient 8086 mistake. You can't enable interrupts until the stack is setup correctly. Move the %ss setup code back to where it was.

I assume you moved it because you wanted to preserve the fact that %ax == 0 on exit of this bit of code. Well, I did find the grub 0.97 source to make sure: both %al and %ah are subsequently overwritten before being used. You don't have to preserve it.

You can save the whole push/pop %dx: find the comment "%dl may have been clobbered ...", move your code immediately before its `popw %dx; pushw %dx'. This does mean your hack isn't effective if grub is being booted from a floppy, but ... not a problem.

You can also save a few more code bytes. I assume this is being compiled as 16-bit (8086) code, e.g. with ".code16" GNU `as` directive. Thus, the instructions `push %edx' and `pop %edx' need a code32 prefix; replace with `push %dx; pop %dx'. Replace `mov $0xcfc,%dx' with `mov $0xfc,%dl'. Replace `xorl %eax,%eax' with `xor %ax,%ax'.

And he was even kind enough to send me a fix for these, so many thanks to him.

Here are links for the new patch he sent me, and an updated stage1 binary.

The Mac Pro is a really nice workstation, which comes with the really nice EFI instead of BIOS.

EFI needs an adaptation layer (the Compatibility Support Module, or CSM) that emulates the BIOS, to be able to boot legacy OS, like Microsoft ones, or any GNU/Linux distribution without EFI support (which is nearly all of them, afaik).

Unfortunately, the CSM provided by apple does not contain an AHCI OpRom, and has to put the disk controller into IDE mode, instead of using the (also really nice) AHCI mode (whereas the controller's default mode is AHCI, and MacOSX uses this mode).

So far, Linux driver developers put the hack in the driver: when initialized, it puts back the controller to AHCI mode. But this does not work with other OS, so I had to put it at a lower level.

As Apple's EFI part of BootCamp is quite simple (just "chainloads" to a legacy bootloader), I decided to use the GNU GRUB to load legacy OS, and modified it to put back the controller in AHCI mode before any OS tries to load a driver for it.

Here is the patch, and here is a stage1 binary built from patched Grub 0.97 sources.

Please note that this is extremely ugly! As I didn't want to spend too much time on this, I decided to go the fastest way: adding the hack as x86 assembly in stage1. But as stage1 has a really strict size constraint (must fit in the first block), I had to remove some other hacks from it, to be able to add mine in.

UPDATE: This OnMac.net forum thread contains a bit more detailled information on how to set this up.

IMPORTANT UPDATE: The patch posted here contains a few mistakes (the binary has been updated, and includes fixes). For a fixed version of the patch, please read this blog entry.

Here is a script I wrote about two years ago, that produces a graph (using Graphviz) of branches and calls from a 8051 hex file, disassembled with Dis51. This µC can be found, for instance, in Cypress USB bridges, that load the firmware from USB when the device is plugged in, and are used for many kinds of applications (I have a DSL modem and a TV tuner that use them, for instance).

It can be used like this:

dis51 -l [entrypoints list] < firmware.hex > firmware.a51
python graphviz_generator.py firmware.a51 [entrypoints list] > graph.gv
dot -Tgif graph.gv > firmware_graph.gif

("entrypoints list" being a list of whitespace separated addresses, like "0x0000 0x0010", without the quotes)

The graph will look as follows:

- Red circles are functions (branches that update the stack pointer)
- Grey circles are RET statements (end of functions, also modify the SP)
- Blue circles are entrypoints
- Squares are normal branch instruction
- plain lines mean the branch is always taken (or when the branch condition is false)
- dashed lines mean the branch is taken if the branch condition is true (JZ, JNZ ...)
- red dashed lines mean a function call

As a small picture usually talks more than a long text, so here is a really BIG picture.

And finally, the script.

WaveMixer is a really nice looking and easy to use multitrack wave editor written by friends of mine. It uses really neat technology like GTK+, Gstreamer and LADSPA. I built the first WaveMixer RPM package for them, and I believe they are now handling them by themselves.

Even if you're not into music authoring, you should really give their software a try, as it's so entertaining !

Right after I bought my Nintendo GameCube system, I read every available information about it, and I started to follow the activity of the homebrew community.

Eventually, I also wrote little pieces of code.

As usual, click the following link to get to my collection of homebrew works for the GameCube.

It includes :
- an updated Howto on how to cross-compile demos. It is updated compared to the original version, which was the only one available for a period of time, and which also quickly became outdated.
- a tool that converts any image to a C array or object which can be copied to the framebuffer address for direct display on the TV screen. An example program to display the image is also included.
- a tool that interfaces with the ripping dol that was found someday floating around on the Internet ... It runs on Linux and MacOS X and allows to backup your games to your PC.
- a tool that streams back the game backup to the console, using the ACL dol. This tool is available in two versions :

- the first version has exactly the same features as the Windows version.
- the second version uses zlib. Every backup image is split in packets of 32kB and compressed, before being stored on the disk. When the streaming tool is required a specific file (the request contains the offset and size of the array that needs to be sent), it looks which blocks it needs, decompresses them on the fly, and sends the decompressed response to the console. This technique is really fast (bottleneck here is the network), it saves much diskspace (some backups shrink from 1.4GB to less than 400MB), and more important, it keeps the backup intact, as the compression is indeed non destructive (compared to the "regular" backup shrink tools, which simply rewrite the filesystem table and move the files).

Note : You are the only person responsible for the use you make of this software. Illegal usage is not encouraged by this webpage.