;; -*- fundamental -*-
;; -----------------------------------------------------------------------
;;
;;   Copyright 1994-2008 H. Peter Anvin - All Rights Reserved
;;   Copyright 2009 Intel Corporation; author: H. Peter Anvin
;;
;;   This program is free software; you can redistribute it and/or modify
;;   it under the terms of the GNU General Public License as published by
;;   the Free Software Foundation, Inc., 53 Temple Place Ste 330,
;;   Boston MA 02111-1307, USA; either version 2 of the License, or
;;   (at your option) any later version; incorporated herein by reference.
;;
;; -----------------------------------------------------------------------

;;
;; init16.asm
;;
;; Routine to initialize and to trampoline into 32-bit
;; protected memory.  This code is derived from bcopy32.inc and
;; com32.inc in the main SYSLINUX distribution.
;;

%include '../version.gen'

MY_CS		equ 0x0800		; Segment address to use
CS_BASE		equ (MY_CS << 4)	; Corresponding address

; Low memory bounce buffer
BOUNCE_SEG	equ (MY_CS+0x1000)

%define DO_WBINVD 0

		section .rodata align=16
		section .data   align=16
		section .bss    align=16
		section .stack	align=16 nobits
stack		resb 512
stack_end	equ $

;; -----------------------------------------------------------------------
;;  Kernel image header
;; -----------------------------------------------------------------------

		section .text		; Must be first in image
		bits 16

cmdline		times 497 db 0		; We put the command line here
setup_sects	db 0
root_flags	dw 0
syssize		dw 0
swap_dev	dw 0
ram_size	dw 0
vid_mode	dw 0
root_dev	dw 0
boot_flag	dw 0xAA55

_start:		jmp short start

		db "HdrS"		; Header signature
		dw 0x0203		; Header version number

realmode_swtch	dw 0, 0			; default_switch, SETUPSEG
start_sys_seg	dw 0x1000		; obsolete
version_ptr	dw memdisk_version-0x200	; version string ptr
type_of_loader	db 0			; Filled in by boot loader
loadflags	db 1			; Please load high
setup_move_size	dw 0			; Unused
code32_start	dd 0x100000		; 32-bit start address
ramdisk_image	dd 0			; Loaded ramdisk image address
ramdisk_size	dd 0			; Size of loaded ramdisk
bootsect_kludge	dw 0, 0
heap_end_ptr	dw 0
pad1		dw 0
cmd_line_ptr	dd 0			; Command line
ramdisk_max	dd 0xffffffff		; Highest allowed ramdisk address

;
; These fields aren't real setup fields, they're poked in by the
; 32-bit code.
;
b_esdi		dd 0			; ES:DI for boot sector invocation
b_edx		dd 0			; EDX for boot sector invocation
b_sssp		dd 0			; SS:SP on boot sector invocation
b_csip		dd 0			; CS:IP on boot sector invocation

		section .rodata
memdisk_version:
		db "MEMDISK ", VERSION_STR, " ", DATE, 0

;; -----------------------------------------------------------------------
;;  End kernel image header
;; -----------------------------------------------------------------------

;
; Move ourselves down into memory to reduce the risk of conflicts;
; then canonicalize CS to match the other segments.
;
		section .text
		bits 16
start:
		mov ax,MY_CS
		mov es,ax
		movzx cx,byte [setup_sects]
		inc cx			; Add one for the boot sector
		shl cx,7		; Convert to dwords
		xor si,si
		xor di,di
		mov fs,si		; fs <- 0
		cld
		rep movsd
		mov ds,ax
		mov ss,ax
		mov esp,stack_end
		jmp MY_CS:.next
.next:

;
; Copy the command line, if there is one
;
copy_cmdline:
		xor di,di		; Bottom of our own segment (= "boot sector")
		mov eax,[cmd_line_ptr]
		and eax,eax
		jz .endcmd		; No command line
		mov si,ax
		shr eax,4		; Convert to segment
		and si,0x000F		; Starting offset only
		mov gs,ax
		mov cx,496		; Max number of bytes
.copycmd:
		gs lodsb
		and al,al
		jz .endcmd
		stosb
		loop .copycmd
.endcmd:
		xor al,al
		stosb

;
; Now jump to 32-bit code
;
		sti
		call init32
;
; When init32 returns, we have been set up, the new boot sector loaded,
; and we should go and and run the newly loaded boot sector.
;
; The setup function will have poked values into the setup area.
;
		movzx edi,word [cs:b_esdi]
		mov es,word [cs:b_esdi+2]
		mov edx,[cs:b_edx]

		cli
		xor esi,esi		; No partition table involved
		mov ds,si		; Make all the segments consistent
		mov fs,si
		mov gs,si
		lss sp,[cs:b_sssp]
		movzx esp,sp
		jmp far [cs:b_csip]

;
; We enter protected mode, set up a flat 32-bit environment, run rep movsd
; and then exit.  IMPORTANT: This code assumes cs == MY_CS.
;
; This code is probably excessively anal-retentive in its handling of
; segments, but this stuff is painful enough as it is without having to rely
; on everything happening "as it ought to."
;
DummyTSS	equ  0x580		; Hopefully safe place in low mmoery

		section .data

	; desc base, limit, flags
%macro	desc 3
	dd (%2 & 0xffff) | ((%1 & 0xffff) << 16)
	dd (%1 & 0xff000000) | (%2 & 0xf0000) | ((%3 & 0xf0ff) << 8) | ((%1 & 0x00ff0000) >> 16)
%endmacro

		align 8, db 0
call32_gdt:	dw call32_gdt_size-1	; Null descriptor - contains GDT
.adj1:		dd call32_gdt+CS_BASE	; pointer for LGDT instruction
		dw 0

		; 0008: Dummy TSS to make Intel VT happy
		; Should never be actually accessed...
		desc DummyTSS, 103, 0x8089

		; 0010: Code segment, use16, readable, dpl 0, base CS_BASE, 64K
		desc CS_BASE, 0xffff, 0x009b

		; 0018: Data segment, use16, read/write, dpl 0, base CS_BASE, 64K
		desc CS_BASE, 0xffff, 0x0093

		; 0020: Code segment, use32, read/write, dpl 0, base 0, 4G
		desc 0, 0xfffff, 0xc09b

		; 0028: Data segment, use32, read/write, dpl 0, base 0, 4G
		desc 0, 0xfffff, 0xc093

call32_gdt_size:	equ $-call32_gdt

err_a20:	db 'ERROR: A20 gate not responding!',13,10,0

		section .bss
		alignb 4
Return		resd 1			; Return value
SavedSP		resw 1			; Place to save SP
A20Tries	resb 1

		section .data
		align 4, db 0
Target		dd 0			; Target address
Target_Seg	dw 20h			; Target CS

A20Type		dw 0			; Default = unknown

		section .text
		bits 16
;
; Routines to enable and disable (yuck) A20.  These routines are gathered
; from tips from a couple of sources, including the Linux kernel and
; http://www.x86.org/.  The need for the delay to be as large as given here
; is indicated by Donnie Barnes of RedHat, the problematic system being an
; IBM ThinkPad 760EL.
;
; We typically toggle A20 twice for every 64K transferred.
;
%define	io_delay	call _io_delay
%define IO_DELAY_PORT	80h		; Invalid port (we hope!)
%define disable_wait	32		; How long to wait for a disable

%define A20_DUNNO	0		; A20 type unknown
%define A20_NONE	1		; A20 always on?
%define A20_BIOS	2		; A20 BIOS enable
%define A20_KBC		3		; A20 through KBC
%define A20_FAST	4		; A20 through port 92h

		align 2, db 0
A20List		dw a20_dunno, a20_none, a20_bios, a20_kbc, a20_fast
A20DList	dw a20d_dunno, a20d_none, a20d_bios, a20d_kbc, a20d_fast
a20_adjust_cnt	equ ($-A20List)/2

slow_out:	out dx, al		; Fall through

_io_delay:	out IO_DELAY_PORT,al
		out IO_DELAY_PORT,al
		ret

enable_a20:
		pushad
		mov byte [A20Tries],255 ; Times to try to make this work

try_enable_a20:

;
; Flush the caches
;
%if DO_WBINVD
		call try_wbinvd
%endif

;
; If the A20 type is known, jump straight to type
;
		mov bp,[A20Type]
		add bp,bp			; Convert to word offset
.adj4:		jmp word [bp+A20List]

;
; First, see if we are on a system with no A20 gate
;
a20_dunno:
a20_none:
		mov byte [A20Type], A20_NONE
		call a20_test
		jnz a20_done

;
; Next, try the BIOS (INT 15h AX=2401h)
;
a20_bios:
		mov byte [A20Type], A20_BIOS
		mov ax,2401h
		pushf				; Some BIOSes muck with IF
		int 15h
		popf

		call a20_test
		jnz a20_done

;
; Enable the keyboard controller A20 gate
;
a20_kbc:
		mov dl, 1			; Allow early exit
		call empty_8042
		jnz a20_done			; A20 live, no need to use KBC

		mov byte [A20Type], A20_KBC	; Starting KBC command sequence

		mov al,0D1h			; Write output port
		out 064h, al
		call empty_8042_uncond

		mov al,0DFh			; A20 on
		out 060h, al
		call empty_8042_uncond

		; Apparently the UHCI spec assumes that A20 toggle
		; ends with a null command (assumed to be for sychronization?)
		; Put it here to see if it helps anything...
		mov al,0FFh			; Null command
		out 064h, al
		call empty_8042_uncond

		; Verify that A20 actually is enabled.  Do that by
		; observing a word in low memory and the same word in
		; the HMA until they are no longer coherent.  Note that
		; we don't do the same check in the disable case, because
		; we don't want to *require* A20 masking (SYSLINUX should
		; work fine without it, if the BIOS does.)
.kbc_wait:	push cx
		xor cx,cx
.kbc_wait_loop:
		call a20_test
		jnz a20_done_pop
		loop .kbc_wait_loop

		pop cx
;
; Running out of options here.  Final attempt: enable the "fast A20 gate"
;
a20_fast:
		mov byte [A20Type], A20_FAST	; Haven't used the KBC yet
		in al, 092h
		or al,02h
		and al,~01h			; Don't accidentally reset the machine!
		out 092h, al

.fast_wait:	push cx
		xor cx,cx
.fast_wait_loop:
		call a20_test
		jnz a20_done_pop
		loop .fast_wait_loop

		pop cx

;
; Oh bugger.  A20 is not responding.  Try frobbing it again; eventually give up
; and report failure to the user.
;

		dec byte [A20Tries]
		jnz try_enable_a20


		; Error message time
		mov si,err_a20
print_err:
		lodsb
		and al,al
		jz die
		mov bx,7
		mov ah,0xe
		int 10h
		jmp print_err


die:
		sti
.hlt:		hlt
		jmp short .hlt

;
; A20 unmasked, proceed...
;
a20_done_pop:	pop cx
a20_done:	popad
		ret

;
; This routine tests if A20 is enabled (ZF = 0).  This routine
; must not destroy any register contents.
;

; This is the INT 1Fh vector, which is standard PCs is used by the
; BIOS when the screen is in graphics mode.  Even if it is, it points to
; data, not code, so it should be safe enough to fiddle with.
A20Test		equ (1Fh*4)

a20_test:
		push ds
		push es
		push cx
		push eax
		xor ax,ax
		mov ds,ax		; DS == 0
		dec ax
		mov es,ax		; ES == 0FFFFh
		mov cx,32		; Loop count
		mov eax,[A20Test]
		cmp eax,[es:A20Test+10h]
		jne .a20_done
		push eax
.a20_wait:
		inc eax
		mov [A20Test],eax
		io_delay
		cmp eax,[es:A20Test+10h]
		loopz .a20_wait
		pop dword [A20Test]	; Restore original value
.a20_done:
		pop eax
		pop cx
		pop es
		pop ds
		ret

disable_a20:
		pushad
;
; Flush the caches
;
%if DO_WBINVD
		call try_wbinvd
%endif

		mov bp,[A20Type]
		add bp,bp			; Convert to word offset
.adj5:		jmp word [bp+A20DList]

a20d_bios:
		mov ax,2400h
		pushf				; Some BIOSes muck with IF
		int 15h
		popf
		jmp short a20d_snooze

;
; Disable the "fast A20 gate"
;
a20d_fast:
		in al, 092h
		and al,~03h
		out 092h, al
		jmp short a20d_snooze

;
; Disable the keyboard controller A20 gate
;
a20d_kbc:
		call empty_8042_uncond

		mov al,0D1h
		out 064h, al		; Write output port
		call empty_8042_uncond

		mov al,0DDh		; A20 off
		out 060h, al
		call empty_8042_uncond

		mov al,0FFh		; Null command/synchronization
		out 064h, al
		call empty_8042_uncond

		; Wait a bit for it to take effect
a20d_snooze:
		push cx
		mov cx, disable_wait
.delayloop:	call a20_test
		jz .disabled
		loop .delayloop
.disabled:	pop cx
a20d_dunno:
a20d_none:
		popad
		ret

;
; Routine to empty the 8042 KBC controller.  If dl != 0
; then we will test A20 in the loop and exit if A20 is
; suddenly enabled.
;
empty_8042_uncond:
		xor dl,dl
empty_8042:
		call a20_test
		jz .a20_on
		and dl,dl
		jnz .done
.a20_on:	io_delay
		in al, 064h		; Status port
		test al,1
		jz .no_output
		io_delay
		in al, 060h		; Read input
		jmp short empty_8042
.no_output:
		test al,2
		jnz empty_8042
		io_delay
.done:		ret

;
; Execute a WBINVD instruction if possible on this CPU
;
%if DO_WBINVD
try_wbinvd:
		wbinvd
		ret
%endif

		section .bss
		alignb 4
PMESP		resd 1			; Protected mode %esp

		section .idt nobits align=4096
		alignb 4096
pm_idt		resb 4096		; Protected-mode IDT, followed by interrupt stubs


pm_entry:	equ 0x100000

		section .rodata
		align 2, db 0
call32_rmidt:
		dw 0ffffh		; Limit
		dd 0			; Address

		section .data
		alignb 2
call32_pmidt:
		dw 8*256		; Limit
		dd 0			; Address (entered later)

		section .text
;
; This is the main entrypoint in this function
;
init32:
		mov bx,call32_call_start	; Where to go in PM

;
; Enter protected mode.  BX contains the entry point relative to the
; real-mode CS.
;
call32_enter_pm:
		mov ax,cs
		mov ds,ax
		movzx ebp,ax
		shl ebp,4		; EBP <- CS_BASE
		movzx ebx,bx
		add ebx,ebp		; entry point += CS_BASE
		cli
		mov [SavedSP],sp
		cld
		call enable_a20
		mov byte [call32_gdt+8+5],89h	; Mark TSS unbusy
		o32 lgdt [call32_gdt]	; Set up GDT
		o32 lidt [call32_pmidt]	; Set up IDT
		mov eax,cr0
		or al,1
		mov cr0,eax		; Enter protected mode
		jmp 20h:strict dword .in_pm+CS_BASE
.pm_jmp		equ $-6


		bits 32
.in_pm:
		xor eax,eax		; Available for future use...
		mov fs,eax
		mov gs,eax
		lldt ax

		mov al,28h		; Set up data segments
		mov es,eax
		mov ds,eax
		mov ss,eax

		mov al,08h
		ltr ax

		mov esp,[ebp+PMESP]	; Load protmode %esp if available
		jmp ebx			; Go to where we need to go

;
; This is invoked before first dispatch of the 32-bit code, in 32-bit mode
;
call32_call_start:
		;
		; Set up a temporary stack in the bounce buffer;
		; start32.S will override this to point us to the real
		; high-memory stack.
		;
		mov esp, (BOUNCE_SEG << 4) + 0x10000

		push dword call32_enter_rm.rm_jmp+CS_BASE
		push dword call32_enter_pm.pm_jmp+CS_BASE
		push dword stack_end		; RM size
		push dword call32_gdt+CS_BASE
		push dword call32_handle_interrupt+CS_BASE
		push dword CS_BASE		; Segment base
		push dword (BOUNCE_SEG << 4)	; Bounce buffer address
		push dword call32_syscall+CS_BASE ; Syscall entry point

		call pm_entry-CS_BASE		; Run the program...

		; ... fall through to call32_exit ...

call32_exit:
		mov bx,call32_done	; Return to command loop

call32_enter_rm:
		; Careful here... the PM code may have relocated the
		; entire RM code, so we need to figure out exactly
		; where we are executing from.  If the PM code has
		; relocated us, it *will* have adjusted the GDT to
		; match, though.
		call .here
.here:		pop ebp
		sub ebp,.here
		o32 sidt [ebp+call32_pmidt]
		cli
		cld
		mov [ebp+PMESP],esp	; Save exit %esp
		xor esp,esp		; Make sure the high bits are zero
		jmp 10h:.in_pm16	; Return to 16-bit mode first

		bits 16
.in_pm16:
		mov ax,18h		; Real-mode-like segment
		mov es,ax
		mov ds,ax
		mov ss,ax
		mov fs,ax
		mov gs,ax

		lidt [call32_rmidt]	; Real-mode IDT (rm needs no GDT)
		mov eax,cr0
		and al,~1
		mov cr0,eax
		jmp MY_CS:.in_rm
.rm_jmp		equ $-2

.in_rm:					; Back in real mode
		mov ax,cs
		mov ds,ax
		mov es,ax
		mov fs,ax
		mov gs,ax
		mov ss,ax
		mov sp,[SavedSP]	; Restore stack
		jmp bx			; Go to whereever we need to go...

call32_done:
		call disable_a20
		sti
		ret

;
; 16-bit support code
;
		bits 16

;
; 16-bit interrupt-handling code
;
call32_int_rm:
		pushf				; Flags on stack
		push cs				; Return segment
		push word .cont			; Return address
		push dword edx			; Segment:offset of IVT entry
		retf				; Invoke IVT routine
.cont:		; ... on resume ...
		mov bx,call32_int_resume
		jmp call32_enter_pm		; Go back to PM

;
; 16-bit system call handling code
;
call32_sys_rm:
		pop gs
		pop fs
		pop es
		pop ds
		popad
		popfd
		retf				; Invoke routine
.return:
		pushfd
		pushad
		push ds
		push es
		push fs
		push gs
		mov bx,call32_sys_resume
		jmp call32_enter_pm

;
; 32-bit support code
;
		bits 32

;
; This is invoked on getting an interrupt in protected mode.  At
; this point, we need to context-switch to real mode and invoke
; the interrupt routine.
;
; When this gets invoked, the registers are saved on the stack and
; AL contains the register number.
;
call32_handle_interrupt:
		movzx eax,al
		xor ebx,ebx		; Actually makes the code smaller
		mov edx,[ebx+eax*4]	; Get the segment:offset of the routine
		mov bx,call32_int_rm
		jmp call32_enter_rm	; Go to real mode

call32_int_resume:
		popad
		iret

;
; Syscall invocation.  We manifest a structure on the real-mode stack,
; containing the call32sys_t structure from <call32.h> as well as
; the following entries (from low to high address):
; - Target offset
; - Target segment
; - Return offset
; - Return segment (== real mode cs)
; - Return flags
;
call32_syscall:
		pushfd			; Save IF among other things...
		pushad			; We only need to save some, but...
		cld
		call .here
.here:		pop ebp
		sub ebp,.here

		movzx edi,word [ebp+SavedSP]
		sub edi,54		; Allocate 54 bytes
		mov [ebp+SavedSP],di
		add edi,ebp		; Create linear address

		mov esi,[esp+11*4]	; Source regs
		xor ecx,ecx
		mov cl,11		; 44 bytes to copy
		rep movsd

		movzx eax,byte [esp+10*4] ; Interrupt number
		; ecx == 0 here; adding it to the EA makes the
		; encoding smaller
		mov eax,[ecx+eax*4]	; Get IVT entry
		stosd			; Save in stack frame
		mov ax,call32_sys_rm.return	; Return offset
		stosw				; Save in stack frame
		mov eax,ebp
		shr eax,4			; Return segment
		stosw				; Save in stack frame
		mov eax,[edi-12]	; Return flags
		and eax,0x200cd7	; Mask (potentially) unsafe flags
		mov [edi-12],eax	; Primary flags entry
		stosw			; Return flags

		mov bx,call32_sys_rm
		jmp call32_enter_rm	; Go to real mode

		; On return, the 44-byte return structure is on the
		; real-mode stack.  call32_enter_pm will leave ebp
		; pointing to the real-mode base.
call32_sys_resume:
		movzx esi,word [ebp+SavedSP]
		mov edi,[esp+12*4]	; Dest regs
		add esi,ebp		; Create linear address
		and edi,edi		; NULL pointer?
		jnz .do_copy
.no_copy:	mov edi,esi		; Do a dummy copy-to-self
.do_copy:	xor ecx,ecx
		mov cl,11		; 44 bytes
		rep movsd		; Copy register block

		add word [ebp+SavedSP],44	; Remove from stack

		popad
		popfd
		ret			; Return to 32-bit program