Syslinux - Nov 2006 - push-pop ordering error found in memdisk

H. Peter Anvin,

The following problem came to my attention with memdisk. I cannot claim the
credit, but wanted to be sure the information made it back into the program
for the benefit of all users...

In file memdisk.asm, in respect of the operation of the raw and bigraw
options, the order of pop instructions does not correspond to the order
registers are pushed;

---------------------------------
;
; Routine to copy in/out of high memory
; esi = linear source address
; edi = linear target address
; ecx = 32-bit word count
;
; Assumes cs = ds = es
;
bcopy:
		push eax
		push ebx
		push edx
		push ebp

		test byte [ConfigFlags],CONFIG_RAW
		jz .anymode

		smsw ax			; Unprivileged!
		test al,01h
		jnz .protmode

.realmode:
		TRACER 'r'
		; We're in real mode, do it outselves

		pushfd	; <- *** push 1 ***
		push ds	; <- *** push 2 ***
		push es	; <- *** push 3 ***

		cli
		cld


---------------------------------
then a little further down;

		or dx,bx
		push dx	; Save A20 status ; <- *** push 4 ***

---------------------------------
but then after the copy, popping is in this order;

		pop es	; <- error pop order, *** pop 3 ***
		pop ds	; <- error pop order, *** pop 2 ***

		pop dx	; A20 status ; <- error pop order, *** pop 4 ***
		and dx,dx
		jnz .skip_a20d
		mov ax,2400h	; Disable A20
		int 15h
.skip_a20d:
		popfd		; <- *** pop 1 ***
		jmp .donev

---------------------------------

Best regards,

Jim


DISCLAIMER: The information contained in this e-mail is confidential and may
be privileged. It is intended for the addressee only. If you are not the
intended recipient, please delete this e-mail immediately. The contents of
this email must not be disclosed or copied without the sender's consent. We
cannot accept any responsibility for viruses, so please scan all
attachments. The statements and opinions expressed in this message are those
of the author and do not necessarily reflect those of the company. The
company does not take any responsibility for the views of the author.

James Ling wrote:
> H. Peter Anvin,
> 
> The following problem came to my attention with memdisk. I cannot claim the
> credit, but wanted to be sure the information made it back into the program
> for the benefit of all users...
> 
> In file memdisk.asm, in respect of the operation of the raw and bigraw
> options, the order of pop instructions does not correspond to the order
> registers are pushed;
> 
Eep.  I guess this basically means that raw mode has been broken for a 
long time.  Do you have a specific test case for this, and what version 
is this against?

	-hpa

James Ling wrote:
> H. Peter Anvin,
> 
> The following problem came to my attention with memdisk. I cannot claim the
> credit, but wanted to be sure the information made it back into the program
> for the benefit of all users...
> 
> In file memdisk.asm, in respect of the operation of the raw and bigraw
> options, the order of pop instructions does not correspond to the order
> registers are pushed;
> 
Thanks for the bug report; I have pushed out a fix as syslinux-3.32-pre7.

This basically has made raw/bigraw/safeint useless, so it would 
definitely be good if people could test it out.

	-hpa