20.7.3 Using the 8042 Microcontroller to Simulate Keystrokes

Although the trace flag based "keyboard stuffer" routine works with most software that talks to the hardware directly it still has a few problems. Specifically it doesn't work at all with programs that operate in protected mode via a "DOS Extender" library (programming libraries that let programmers access more than one megabyte of memory while running under DOS). The last technique we will look at is to program the on-board 8042 keyboard microcontroller to transmit a keystroke for us. There are two ways to do this: the PS/2 way and the hard way.

The PS/2's microcontroller includes a command specifically designed to return user programmable scan codes to the system. By writing a 0D2h byte to the controller command port (64h) and a scan code byte to port 60h you can force the controller to return that scan code as though the user pressed a key on the keyboard. See "The Keyboard Hardware Interface" for more details.

Using this technique provides the most compatible (with existing software) way to return scan codes to an application. Unfortunately this trick only works on machines that have keyboard controllers that are compatible with the PS/2's; this is not the majority of machines out there. However if you are writing code for PS/2s or compatibles this is the best way to go.

The keyboard controller on the PC/AT and most other PC compatible machines does not support the 0D2h command. Nevertheless there is a sneaky way to force the keyboard controller to transmit a scan code if you're willing to break a few rules. This trick may not work on all machines (indeed there are many machines on which this trick is known to fail) but it does provide a workaround on a large number of PC compatible machines.

The trick is simple. Although the PC's keyboard controller doesn't have a command to return a byte you send it it does provide a command to return the keyboard controller command byte (KCCB). It also provides another command to write a value to the KCCB. So by writing a value to the KCCB and then issuing the read KCCB command we can trick the system into returning a user programmable code. Unfortunately the KCCB contains some undefined reserved bits that have different meanings on different brands of keyboard microcontroller chips. That is the main reason this technique doesn't work with all machines. The following assembly code demonstrates how to use the PS/2 and PC keyboard controller stuffing methods:

.xlist
include         stdlib.a
includelib      stdlib.lib
.list

cseg            segment para public 'code'
assume  ds:nothing

;****************************************************************************
;
; PutInATBuffer-
;
; The following code sticks the scan code into the AT-class keyboard
; microcontroller chip and asks it to send the scan code back to us
; (through the hardware port).
;
; The AT keyboard controller:
;
; Data port is at I/O address 60h
; Status port is at I/O address 64h (read only)
; Command port is at I/O address 64h (write only)
;
; The controller responds to the following values sent to the command port:
;
; 20h - Read Keyboard Controller's Command Byte (KCCB) and send the data to
; the data port (I/O address 60h).
;
; 60h - Write KCCB. The next byte written to I/O address 60h is placed in
; the KCCB. The bits of the KCCB are defined as follows:
;
;       bit 7- Reserved
should be a zero
;       bit 6- IBM industrial computer mode.
;       bit 5- IBM industrial computer mode.
;       bit 4- Disable keyboard.
;       bit 3- Inhibit override.
;       bit 2- System flag
;       bit 1- Reserved
should be a zero.
;       bit 0- Enable output buffer full interrupt.
;
;       AAh - Self test
;       ABh - Interface test
;       ACh - Diagnostic dump
;       ADh - Disable keyboard
;       AEh - Enable keyboard
;       C0h - Read Keyboard Controller input port (equip installed)
;       D0h - Read Keyboard Controller output port
;       D1h - Write Keyboard Controller output port
;       E0h - Read test inputs
;       F0h - FFh - Pulse Output port.
;
; The keyboard controller output port is defined as follows:
;
;       bit 7 - Keyboard data (output)
;       bit 6 - Keyboard clock (output)
;       bit 5 - Input buffer empty
;       bit 4 - Output buffer full
;       bit 3 - undefined
;       bit 2 - undefined
;       bit 1 - Gate A20
;       bit 0 - System reset (0=reset)
;
; The keyboard controller input port is defined as follows:
;
;       bit 7 - Keyboard inhibit switch (0=inhibited)
;       bit 6 - Display switch (0=color
1= mono)
;       bit 5 - Manufacturing jumper
;       bit 4 - System board RAM (0=disable 2nd 256K RAM on system board).
;       bits 0-3 - undefined.
;
; The keyboard controller status port (64h) is defined as follows:
;
;       bit 1 - Set if input data (60h) not available.
;       bit 0 - Set if output port (60h) cannot accept data.



PutInATBuffer   proc    near
assume  ds:nothing
pushf
push    ax
push    bx
push    cx
push    dx


mov     dl
al          ;Save char to output.

; Wait until the keyboard controller does not contain data before
; proceeding with shoving stuff down its throat.

xor     cx
cx
WaitWhlFull:    in      al
64h
test    al
1
loopnz  WaitWhlFull


; First things first
let's mask the interrupt controller chip (8259) to
; tell it to ignore interrupts coming from the keyboard. However
turn the
; interrupts on so we properly process interrupts from other sources (this
; is especially important because we're going to wind up sending a false
; EOI to the interrupt controller inside the INT 9 BIOS routine).

cli
in      al
21h         ;Get current mask
push    ax              ;Save intr mask
or      al
2           ;Mask keyboard interrupt
out     21h
al

; Transmit the desired scan code to the keyboard controller. Call this
; byte the new keyboard controller command (we've turned off the keyboard

; so this won't affect anything).
;
; The following code tells the keyboard controller to take the next byte
; sent to it and use this byte as the KCCB:


call    WaitToXmit
mov     al
60h         ;Write new KCCB command.
out     64h
al

; Send the scan code as the new KCCB:

call    WaitToXmit
mov     al
dl
out     60h
al

; The following code instructs the system to transmit the KCCB (i.e.
the
; scan code) to the system:

call    WaitToXmit
mov     al
20h         ;"Send KCCB" command.
out     64h
al

xor     cx
cx
Wait4OutFull:   in      al
64h
test    al
1
loopz   Wait4OutFull

; Okay
Send a 45h back as the new KCCB to allow the normal keyboard to work
; properly.

call    WaitToXmit
mov     al
60h
out     64h
al

call    WaitToXmit
mov     al
45h
out     60h
al

; Okay
execute an INT 9 routine so the BIOS (or whoever) can read the key
; we just stuffed into the keyboard controller. Since we've masked INT 9
; at the interrupt controller
there will be no interrupt coming along from
; the key we shoved in the buffer.

DoInt9:         in      al
60h         ;Prevents ints from some codes.
int     9               ;Simulate hardware kbd int.


; Just to be safe
reenable the keyboard:

call    WaitToXmit
mov     al
0aeh
out     64h
al

; Okay
restore the interrupt mask for the keyboard in the 8259a.

pop     ax
out     21h
al

pop     dx
pop     cx
pop     bx
pop     ax
popf
ret
PutInATBuffer   endp



; WaitToXmit-   Wait until it's okay to send a command byte to the keyboard
;               controller port.

WaitToXmit      proc    near
push    cx
push    ax
xor     cx
cx
TstCmdPortLp:   in      al
64h
test    al
2           ;Check cntrlr input buffer full flag.
loopnz  TstCmdPortLp
pop     ax
pop     cx
ret
WaitToXmit      endp



;****************************************************************************
;
; PutInPS2Buffer- Like PutInATBuffer
it uses the keyboard controller chip
;                to return the keycode. However
PS/2 compatible controllers
;                have an actual command to return keycodes.

PutInPS2Buffer  proc    near
pushf
push    ax
push    bx
push    cx
push    dx

mov     dl
al          ;Save char to output.

; Wait until the keyboard controller does not contain data before
; proceeding with shoving stuff down its throat.

xor     cx
cx
WaitWhlFull:            in      al
64h
test    al
1
loopnz  WaitWhlFull


; The following code tells the keyboard controller to take the next byte
; sent to it and return it as a scan code.


call    WaitToXmit
mov     al
0d2h        ;Return scan code command.
out     64h
al

; Send the scan code:

call    WaitToXmit
mov     al
dl
out     60h
al

pop     dx
pop     cx
pop     bx
pop     ax
popf
ret
PutInPS2Buffer  endp


; Main program - Simulates some keystrokes to demo the above code.

Main            proc

mov     ax
cseg
mov     ds
ax

print
byte    "Simulating keystrokes via Trace Flag"
cr
lf
byte    "This program places 'DIR' in the keyboard buffer"
byte    cr
lf
0

mov     al
20h         ;"D" down scan code
call    PutInATBuffer
mov     al
0a0h        ;"D" up scan code
call    PutInATBuffer

mov     al
17h         ;"I" down scan code
call    PutInATBuffer
mov     al
97h         ;"I" up scan code
call    PutInATBuffer

mov     al
13h         ;"R" down scan code
call    PutInATBuffer
mov     al
93h         ;"R" up scan code
call    PutInATBuffer

mov     al
1Ch         ;Enter down scan code
call    PutInATBuffer
mov     al
9Ch         ;Enter up scan code
call    PutInATBuffer

ExitPgm
Main            endp


cseg            ends

sseg            segment para stack 'stack'
stk             byte    1024 dup ("stack ")
sseg            ends

zzzzzzseg       segment para public 'zzzzzz'
LastBytes       db      16 dup (?)
zzzzzzseg       ends
end     Main

Chapter Twenty: The PC Keyboard (Part 7)
29 SEP 1996