libinstaller: Use SOURCE_DATE_EPOCH for synthesized modification time stamps
[syslinux.git] / memdisk / memdisk16.asm
blob6bafae7f2da4e33eb9db22067753224533dacc0c
1 ;; -*- fundamental -*-
2 ;; -----------------------------------------------------------------------
3 ;;
4 ;; Copyright 1994-2008 H. Peter Anvin - All Rights Reserved
5 ;; Copyright 2009 Intel Corporation; author: H. Peter Anvin
6 ;;
7 ;; This program is free software; you can redistribute it and/or modify
8 ;; it under the terms of the GNU General Public License as published by
9 ;; the Free Software Foundation, Inc., 53 Temple Place Ste 330,
10 ;; Boston MA 02111-1307, USA; either version 2 of the License, or
11 ;; (at your option) any later version; incorporated herein by reference.
13 ;; -----------------------------------------------------------------------
16 ;; init16.asm
18 ;; Routine to initialize and to trampoline into 32-bit
19 ;; protected memory. This code is derived from bcopy32.inc and
20 ;; com32.inc in the main SYSLINUX distribution.
23 %include '../version.gen'
25 MY_CS equ 0x0800 ; Segment address to use
26 CS_BASE equ (MY_CS << 4) ; Corresponding address
28 ; Low memory bounce buffer
29 BOUNCE_SEG equ (MY_CS+0x1000)
31 %define DO_WBINVD 0
33 section .rodata align=16
34 section .data align=16
35 section .bss align=16
36 section .stack align=16 nobits
37 stack resb 512
38 stack_end equ $
40 ;; -----------------------------------------------------------------------
41 ;; Kernel image header
42 ;; -----------------------------------------------------------------------
44 section .text ; Must be first in image
45 bits 16
47 cmdline times 497 db 0 ; We put the command line here
48 setup_sects db 0
49 root_flags dw 0
50 syssize dw 0
51 swap_dev dw 0
52 ram_size dw 0
53 vid_mode dw 0
54 root_dev dw 0
55 boot_flag dw 0xAA55
57 _start: jmp short start
59 db "HdrS" ; Header signature
60 dw 0x0203 ; Header version number
62 realmode_swtch dw 0, 0 ; default_switch, SETUPSEG
63 start_sys_seg dw 0x1000 ; obsolete
64 version_ptr dw memdisk_version-0x200 ; version string ptr
65 type_of_loader db 0 ; Filled in by boot loader
66 loadflags db 1 ; Please load high
67 setup_move_size dw 0 ; Unused
68 code32_start dd 0x100000 ; 32-bit start address
69 ramdisk_image dd 0 ; Loaded ramdisk image address
70 ramdisk_size dd 0 ; Size of loaded ramdisk
71 bootsect_kludge dw 0, 0
72 heap_end_ptr dw 0
73 pad1 dw 0
74 cmd_line_ptr dd 0 ; Command line
75 ramdisk_max dd 0xffffffff ; Highest allowed ramdisk address
78 ; These fields aren't real setup fields, they're poked in by the
79 ; 32-bit code.
81 b_esdi dd 0 ; ES:DI for boot sector invocation
82 b_edx dd 0 ; EDX for boot sector invocation
83 b_sssp dd 0 ; SS:SP on boot sector invocation
84 b_csip dd 0 ; CS:IP on boot sector invocation
86 section .rodata
87 memdisk_version:
88 db "MEMDISK ", VERSION_STR, " ", DATE, 0
90 ;; -----------------------------------------------------------------------
91 ;; End kernel image header
92 ;; -----------------------------------------------------------------------
95 ; Move ourselves down into memory to reduce the risk of conflicts;
96 ; then canonicalize CS to match the other segments.
98 section .text
99 bits 16
100 start:
101 mov ax,MY_CS
102 mov es,ax
103 movzx cx,byte [setup_sects]
104 inc cx ; Add one for the boot sector
105 shl cx,7 ; Convert to dwords
106 xor si,si
107 xor di,di
108 mov fs,si ; fs <- 0
110 rep movsd
111 mov ds,ax
112 mov ss,ax
113 mov esp,stack_end
114 jmp MY_CS:.next
115 .next:
118 ; Copy the command line, if there is one
120 copy_cmdline:
121 xor di,di ; Bottom of our own segment (= "boot sector")
122 mov eax,[cmd_line_ptr]
123 and eax,eax
124 jz .endcmd ; No command line
125 mov si,ax
126 shr eax,4 ; Convert to segment
127 and si,0x000F ; Starting offset only
128 mov gs,ax
129 mov cx,496 ; Max number of bytes
130 .copycmd:
131 gs lodsb
132 and al,al
133 jz .endcmd
134 stosb
135 loop .copycmd
136 .endcmd:
137 xor al,al
138 stosb
141 ; Now jump to 32-bit code
144 call init32
146 ; When init32 returns, we have been set up, the new boot sector loaded,
147 ; and we should go and and run the newly loaded boot sector.
149 ; The setup function will have poked values into the setup area.
151 movzx edi,word [cs:b_esdi]
152 mov es,word [cs:b_esdi+2]
153 mov edx,[cs:b_edx]
156 xor esi,esi ; No partition table involved
157 mov ds,si ; Make all the segments consistent
158 mov fs,si
159 mov gs,si
160 lss sp,[cs:b_sssp]
161 movzx esp,sp
162 jmp far [cs:b_csip]
165 ; We enter protected mode, set up a flat 32-bit environment, run rep movsd
166 ; and then exit. IMPORTANT: This code assumes cs == MY_CS.
168 ; This code is probably excessively anal-retentive in its handling of
169 ; segments, but this stuff is painful enough as it is without having to rely
170 ; on everything happening "as it ought to."
172 DummyTSS equ 0x580 ; Hopefully safe place in low mmoery
174 section .data
176 ; desc base, limit, flags
177 %macro desc 3
178 dd (%2 & 0xffff) | ((%1 & 0xffff) << 16)
179 dd (%1 & 0xff000000) | (%2 & 0xf0000) | ((%3 & 0xf0ff) << 8) | ((%1 & 0x00ff0000) >> 16)
180 %endmacro
182 align 8, db 0
183 call32_gdt: dw call32_gdt_size-1 ; Null descriptor - contains GDT
184 .adj1: dd call32_gdt+CS_BASE ; pointer for LGDT instruction
185 dw 0
187 ; 0008: Dummy TSS to make Intel VT happy
188 ; Should never be actually accessed...
189 desc DummyTSS, 103, 0x8089
191 ; 0010: Code segment, use16, readable, dpl 0, base CS_BASE, 64K
192 desc CS_BASE, 0xffff, 0x009b
194 ; 0018: Data segment, use16, read/write, dpl 0, base CS_BASE, 64K
195 desc CS_BASE, 0xffff, 0x0093
197 ; 0020: Code segment, use32, read/write, dpl 0, base 0, 4G
198 desc 0, 0xfffff, 0xc09b
200 ; 0028: Data segment, use32, read/write, dpl 0, base 0, 4G
201 desc 0, 0xfffff, 0xc093
203 call32_gdt_size: equ $-call32_gdt
205 err_a20: db 'ERROR: A20 gate not responding!',13,10,0
207 section .bss
208 alignb 4
209 Return resd 1 ; Return value
210 SavedSP resw 1 ; Place to save SP
211 A20Tries resb 1
213 section .data
214 align 4, db 0
215 Target dd 0 ; Target address
216 Target_Seg dw 20h ; Target CS
218 A20Type dw 0 ; Default = unknown
220 section .text
221 bits 16
223 ; Routines to enable and disable (yuck) A20. These routines are gathered
224 ; from tips from a couple of sources, including the Linux kernel and
225 ; http://www.x86.org/. The need for the delay to be as large as given here
226 ; is indicated by Donnie Barnes of RedHat, the problematic system being an
227 ; IBM ThinkPad 760EL.
229 ; We typically toggle A20 twice for every 64K transferred.
231 %define io_delay call _io_delay
232 %define IO_DELAY_PORT 80h ; Invalid port (we hope!)
233 %define disable_wait 32 ; How long to wait for a disable
235 %define A20_DUNNO 0 ; A20 type unknown
236 %define A20_NONE 1 ; A20 always on?
237 %define A20_BIOS 2 ; A20 BIOS enable
238 %define A20_KBC 3 ; A20 through KBC
239 %define A20_FAST 4 ; A20 through port 92h
241 align 2, db 0
242 A20List dw a20_dunno, a20_none, a20_bios, a20_kbc, a20_fast
243 A20DList dw a20d_dunno, a20d_none, a20d_bios, a20d_kbc, a20d_fast
244 a20_adjust_cnt equ ($-A20List)/2
246 slow_out: out dx, al ; Fall through
248 _io_delay: out IO_DELAY_PORT,al
249 out IO_DELAY_PORT,al
252 enable_a20:
253 pushad
254 mov byte [A20Tries],255 ; Times to try to make this work
256 try_enable_a20:
259 ; Flush the caches
261 %if DO_WBINVD
262 call try_wbinvd
263 %endif
266 ; If the A20 type is known, jump straight to type
268 mov bp,[A20Type]
269 add bp,bp ; Convert to word offset
270 .adj4: jmp word [bp+A20List]
273 ; First, see if we are on a system with no A20 gate
275 a20_dunno:
276 a20_none:
277 mov byte [A20Type], A20_NONE
278 call a20_test
279 jnz a20_done
282 ; Next, try the BIOS (INT 15h AX=2401h)
284 a20_bios:
285 mov byte [A20Type], A20_BIOS
286 mov ax,2401h
287 pushf ; Some BIOSes muck with IF
288 int 15h
289 popf
291 call a20_test
292 jnz a20_done
295 ; Enable the keyboard controller A20 gate
297 a20_kbc:
298 mov dl, 1 ; Allow early exit
299 call empty_8042
300 jnz a20_done ; A20 live, no need to use KBC
302 mov byte [A20Type], A20_KBC ; Starting KBC command sequence
304 mov al,0D1h ; Write output port
305 out 064h, al
306 call empty_8042_uncond
308 mov al,0DFh ; A20 on
309 out 060h, al
310 call empty_8042_uncond
312 ; Apparently the UHCI spec assumes that A20 toggle
313 ; ends with a null command (assumed to be for sychronization?)
314 ; Put it here to see if it helps anything...
315 mov al,0FFh ; Null command
316 out 064h, al
317 call empty_8042_uncond
319 ; Verify that A20 actually is enabled. Do that by
320 ; observing a word in low memory and the same word in
321 ; the HMA until they are no longer coherent. Note that
322 ; we don't do the same check in the disable case, because
323 ; we don't want to *require* A20 masking (SYSLINUX should
324 ; work fine without it, if the BIOS does.)
325 .kbc_wait: push cx
326 xor cx,cx
327 .kbc_wait_loop:
328 call a20_test
329 jnz a20_done_pop
330 loop .kbc_wait_loop
332 pop cx
334 ; Running out of options here. Final attempt: enable the "fast A20 gate"
336 a20_fast:
337 mov byte [A20Type], A20_FAST ; Haven't used the KBC yet
338 in al, 092h
339 or al,02h
340 and al,~01h ; Don't accidentally reset the machine!
341 out 092h, al
343 .fast_wait: push cx
344 xor cx,cx
345 .fast_wait_loop:
346 call a20_test
347 jnz a20_done_pop
348 loop .fast_wait_loop
350 pop cx
353 ; Oh bugger. A20 is not responding. Try frobbing it again; eventually give up
354 ; and report failure to the user.
357 dec byte [A20Tries]
358 jnz try_enable_a20
361 ; Error message time
362 mov si,err_a20
363 print_err:
364 lodsb
365 and al,al
366 jz die
367 mov bx,7
368 mov ah,0xe
369 int 10h
370 jmp print_err
373 die:
375 .hlt: hlt
376 jmp short .hlt
379 ; A20 unmasked, proceed...
381 a20_done_pop: pop cx
382 a20_done: popad
386 ; This routine tests if A20 is enabled (ZF = 0). This routine
387 ; must not destroy any register contents.
390 ; This is the INT 1Fh vector, which is standard PCs is used by the
391 ; BIOS when the screen is in graphics mode. Even if it is, it points to
392 ; data, not code, so it should be safe enough to fiddle with.
393 A20Test equ (1Fh*4)
395 a20_test:
396 push ds
397 push es
398 push cx
399 push eax
400 xor ax,ax
401 mov ds,ax ; DS == 0
402 dec ax
403 mov es,ax ; ES == 0FFFFh
404 mov cx,32 ; Loop count
405 mov eax,[A20Test]
406 cmp eax,[es:A20Test+10h]
407 jne .a20_done
408 push eax
409 .a20_wait:
410 inc eax
411 mov [A20Test],eax
412 io_delay
413 cmp eax,[es:A20Test+10h]
414 loopz .a20_wait
415 pop dword [A20Test] ; Restore original value
416 .a20_done:
417 pop eax
418 pop cx
419 pop es
420 pop ds
423 disable_a20:
424 pushad
426 ; Flush the caches
428 %if DO_WBINVD
429 call try_wbinvd
430 %endif
432 mov bp,[A20Type]
433 add bp,bp ; Convert to word offset
434 .adj5: jmp word [bp+A20DList]
436 a20d_bios:
437 mov ax,2400h
438 pushf ; Some BIOSes muck with IF
439 int 15h
440 popf
441 jmp short a20d_snooze
444 ; Disable the "fast A20 gate"
446 a20d_fast:
447 in al, 092h
448 and al,~03h
449 out 092h, al
450 jmp short a20d_snooze
453 ; Disable the keyboard controller A20 gate
455 a20d_kbc:
456 call empty_8042_uncond
458 mov al,0D1h
459 out 064h, al ; Write output port
460 call empty_8042_uncond
462 mov al,0DDh ; A20 off
463 out 060h, al
464 call empty_8042_uncond
466 mov al,0FFh ; Null command/synchronization
467 out 064h, al
468 call empty_8042_uncond
470 ; Wait a bit for it to take effect
471 a20d_snooze:
472 push cx
473 mov cx, disable_wait
474 .delayloop: call a20_test
475 jz .disabled
476 loop .delayloop
477 .disabled: pop cx
478 a20d_dunno:
479 a20d_none:
480 popad
484 ; Routine to empty the 8042 KBC controller. If dl != 0
485 ; then we will test A20 in the loop and exit if A20 is
486 ; suddenly enabled.
488 empty_8042_uncond:
489 xor dl,dl
490 empty_8042:
491 call a20_test
492 jz .a20_on
493 and dl,dl
494 jnz .done
495 .a20_on: io_delay
496 in al, 064h ; Status port
497 test al,1
498 jz .no_output
499 io_delay
500 in al, 060h ; Read input
501 jmp short empty_8042
502 .no_output:
503 test al,2
504 jnz empty_8042
505 io_delay
506 .done: ret
509 ; Execute a WBINVD instruction if possible on this CPU
511 %if DO_WBINVD
512 try_wbinvd:
513 wbinvd
515 %endif
517 section .bss
518 alignb 4
519 PMESP resd 1 ; Protected mode %esp
521 section .idt nobits align=4096
522 alignb 4096
523 pm_idt resb 4096 ; Protected-mode IDT, followed by interrupt stubs
528 pm_entry: equ 0x100000
530 section .rodata
531 align 2, db 0
532 call32_rmidt:
533 dw 0ffffh ; Limit
534 dd 0 ; Address
536 section .data
537 alignb 2
538 call32_pmidt:
539 dw 8*256 ; Limit
540 dd 0 ; Address (entered later)
542 section .text
544 ; This is the main entrypoint in this function
546 init32:
547 mov bx,call32_call_start ; Where to go in PM
550 ; Enter protected mode. BX contains the entry point relative to the
551 ; real-mode CS.
553 call32_enter_pm:
554 mov ax,cs
555 mov ds,ax
556 movzx ebp,ax
557 shl ebp,4 ; EBP <- CS_BASE
558 movzx ebx,bx
559 add ebx,ebp ; entry point += CS_BASE
561 mov [SavedSP],sp
563 call enable_a20
564 mov byte [call32_gdt+8+5],89h ; Mark TSS unbusy
565 o32 lgdt [call32_gdt] ; Set up GDT
566 o32 lidt [call32_pmidt] ; Set up IDT
567 mov eax,cr0
568 or al,1
569 mov cr0,eax ; Enter protected mode
570 jmp 20h:strict dword .in_pm+CS_BASE
571 .pm_jmp equ $-6
574 bits 32
575 .in_pm:
576 xor eax,eax ; Available for future use...
577 mov fs,eax
578 mov gs,eax
579 lldt ax
581 mov al,28h ; Set up data segments
582 mov es,eax
583 mov ds,eax
584 mov ss,eax
586 mov al,08h
587 ltr ax
589 mov esp,[ebp+PMESP] ; Load protmode %esp if available
590 jmp ebx ; Go to where we need to go
593 ; This is invoked before first dispatch of the 32-bit code, in 32-bit mode
595 call32_call_start:
597 ; Set up a temporary stack in the bounce buffer;
598 ; start32.S will override this to point us to the real
599 ; high-memory stack.
601 mov esp, (BOUNCE_SEG << 4) + 0x10000
603 push dword call32_enter_rm.rm_jmp+CS_BASE
604 push dword call32_enter_pm.pm_jmp+CS_BASE
605 push dword stack_end ; RM size
606 push dword call32_gdt+CS_BASE
607 push dword call32_handle_interrupt+CS_BASE
608 push dword CS_BASE ; Segment base
609 push dword (BOUNCE_SEG << 4) ; Bounce buffer address
610 push dword call32_syscall+CS_BASE ; Syscall entry point
612 call pm_entry-CS_BASE ; Run the program...
614 ; ... fall through to call32_exit ...
616 call32_exit:
617 mov bx,call32_done ; Return to command loop
619 call32_enter_rm:
620 ; Careful here... the PM code may have relocated the
621 ; entire RM code, so we need to figure out exactly
622 ; where we are executing from. If the PM code has
623 ; relocated us, it *will* have adjusted the GDT to
624 ; match, though.
625 call .here
626 .here: pop ebp
627 sub ebp,.here
628 o32 sidt [ebp+call32_pmidt]
631 mov [ebp+PMESP],esp ; Save exit %esp
632 xor esp,esp ; Make sure the high bits are zero
633 jmp 10h:.in_pm16 ; Return to 16-bit mode first
635 bits 16
636 .in_pm16:
637 mov ax,18h ; Real-mode-like segment
638 mov es,ax
639 mov ds,ax
640 mov ss,ax
641 mov fs,ax
642 mov gs,ax
644 lidt [call32_rmidt] ; Real-mode IDT (rm needs no GDT)
645 mov eax,cr0
646 and al,~1
647 mov cr0,eax
648 jmp MY_CS:.in_rm
649 .rm_jmp equ $-2
651 .in_rm: ; Back in real mode
652 mov ax,cs
653 mov ds,ax
654 mov es,ax
655 mov fs,ax
656 mov gs,ax
657 mov ss,ax
658 mov sp,[SavedSP] ; Restore stack
659 jmp bx ; Go to whereever we need to go...
661 call32_done:
662 call disable_a20
667 ; 16-bit support code
669 bits 16
672 ; 16-bit interrupt-handling code
674 call32_int_rm:
675 pushf ; Flags on stack
676 push cs ; Return segment
677 push word .cont ; Return address
678 push dword edx ; Segment:offset of IVT entry
679 retf ; Invoke IVT routine
680 .cont: ; ... on resume ...
681 mov bx,call32_int_resume
682 jmp call32_enter_pm ; Go back to PM
685 ; 16-bit system call handling code
687 call32_sys_rm:
688 pop gs
689 pop fs
690 pop es
691 pop ds
692 popad
693 popfd
694 retf ; Invoke routine
695 .return:
696 pushfd
697 pushad
698 push ds
699 push es
700 push fs
701 push gs
702 mov bx,call32_sys_resume
703 jmp call32_enter_pm
706 ; 32-bit support code
708 bits 32
711 ; This is invoked on getting an interrupt in protected mode. At
712 ; this point, we need to context-switch to real mode and invoke
713 ; the interrupt routine.
715 ; When this gets invoked, the registers are saved on the stack and
716 ; AL contains the register number.
718 call32_handle_interrupt:
719 movzx eax,al
720 xor ebx,ebx ; Actually makes the code smaller
721 mov edx,[ebx+eax*4] ; Get the segment:offset of the routine
722 mov bx,call32_int_rm
723 jmp call32_enter_rm ; Go to real mode
725 call32_int_resume:
726 popad
727 iret
730 ; Syscall invocation. We manifest a structure on the real-mode stack,
731 ; containing the call32sys_t structure from <call32.h> as well as
732 ; the following entries (from low to high address):
733 ; - Target offset
734 ; - Target segment
735 ; - Return offset
736 ; - Return segment (== real mode cs)
737 ; - Return flags
739 call32_syscall:
740 pushfd ; Save IF among other things...
741 pushad ; We only need to save some, but...
743 call .here
744 .here: pop ebp
745 sub ebp,.here
747 movzx edi,word [ebp+SavedSP]
748 sub edi,54 ; Allocate 54 bytes
749 mov [ebp+SavedSP],di
750 add edi,ebp ; Create linear address
752 mov esi,[esp+11*4] ; Source regs
753 xor ecx,ecx
754 mov cl,11 ; 44 bytes to copy
755 rep movsd
757 movzx eax,byte [esp+10*4] ; Interrupt number
758 ; ecx == 0 here; adding it to the EA makes the
759 ; encoding smaller
760 mov eax,[ecx+eax*4] ; Get IVT entry
761 stosd ; Save in stack frame
762 mov ax,call32_sys_rm.return ; Return offset
763 stosw ; Save in stack frame
764 mov eax,ebp
765 shr eax,4 ; Return segment
766 stosw ; Save in stack frame
767 mov eax,[edi-12] ; Return flags
768 and eax,0x200cd7 ; Mask (potentially) unsafe flags
769 mov [edi-12],eax ; Primary flags entry
770 stosw ; Return flags
772 mov bx,call32_sys_rm
773 jmp call32_enter_rm ; Go to real mode
775 ; On return, the 44-byte return structure is on the
776 ; real-mode stack. call32_enter_pm will leave ebp
777 ; pointing to the real-mode base.
778 call32_sys_resume:
779 movzx esi,word [ebp+SavedSP]
780 mov edi,[esp+12*4] ; Dest regs
781 add esi,ebp ; Create linear address
782 and edi,edi ; NULL pointer?
783 jnz .do_copy
784 .no_copy: mov edi,esi ; Do a dummy copy-to-self
785 .do_copy: xor ecx,ecx
786 mov cl,11 ; 44 bytes
787 rep movsd ; Copy register block
789 add word [ebp+SavedSP],44 ; Remove from stack
791 popad
792 popfd
793 ret ; Return to 32-bit program