Bootloader is not working at real machine but qemu works

Question

As part of my custom kernel, I wrote a bootloader for booting the ELF kernel in BIOS. In the first stage of the kernel, I tried to load my kernel by pio in protected mode. In QEMU, as expected, my bootloader working correctly. But in bare metal, My bootloader stuck at the pio (in my assembly code, the wait_disk part is not working as I intended.). Then I just got a blinking cursor on a black screen.

My question is, is there any problem with my codes? Is there any reason why my bootloader is working at QEMU, but is blocked at the real machine?

This is my bootloader code (the second stage and parsing elf section are omitted. Because I cannot succeed to enter stage two with the real machine.)

.section .bootloader, "awx"
.global _start
.intel_syntax noprefix
.code16

_start:
  cli
  cld

# Setup the ds, es, ss
  xor ax, ax
  mov ds, ax
  mov es, ax
  mov ss, ax

  mov sp, 0x7000

# ENABLE A20
seta20_1:
  in al, 0x64
  test al, 0x2
  jnz seta20_1  # spin until not busy

  mov al, 0xd1
  out 0x64, al

seta20_2:
  in al, 0x64
  test al, 0x2
  jnz seta20_2  # spin until not busy

  mov al, 0xdf
  out 0x60, al

# Get a820 map from bios
get_e820:
  mov eax, 0xe820
  mov edi, 0x7000 + 52 + 4        # E820_map + 4
  xor ebx, ebx
  mov edx, 0x534d4150
  mov ecx, 24
  int 0x15
  jc fail
  cmp edx, eax
  jne fail
  test ebx, ebx
  je fail
  mov ebp, 24

parse_entry:
  mov [edi - 4], ecx
  add edi, 24
  mov eax, 0xe820
  mov ecx, 24
  int 0x15
  jc done
  add ebp, 24
  test ebx, ebx
  jne parse_entry

done:
  mov [edi - 4], ecx
  mov dword ptr [0x7000], 0x40
  mov dword ptr [0x7000 + 44], ebp
  mov dword ptr [0x7000 + 48], 0x7000 + 52  # E820_map
fail:


# Switch to protected mode
  lgdt gdt_desc
  mov eax, cr0
  or  eax, 1           # CR0_PE
  mov cr0, eax

# Jump to the 32bit mode
  lea eax, [_code32]
  push 0x8
  push eax
  retf

.code32
_code32:
  mov ax, 0x10         # PROT_DS
  mov ds, ax
  mov es, ax
  mov fs, ax
  mov gs, ax
  mov ss, ax


  # Load the remaining boot loaders
  mov edi, 0x7c00 # addr
  xor ecx, ecx    # sector
load_boot_loader:
  inc ecx
  add edi, 0x200
  lea esi, [boot_end]
  cmp edi, esi
  jae end
  push ecx
  push edi
  call read_sector
  pop edi
  pop ecx
  jmp load_boot_loader
end:
  jmp _head64
  hlt

boot_fail:
  mov ax, 0x8A00
  mov dx, 0x8A00
  out dx, al
  mov ax, 0x8E00
  mov dx, 0x8A00
  out dx, al
spin:
  jmp spin

read_sector: # edi: dst, ecx: offset
  call wait_disk

  mov al, 1
  mov edx, 0x1F2
  out dx, al

  mov eax, ecx
  mov edx, 0x1F3
  out dx, al

  mov eax, ecx
  shr eax, 0x8
  mov edx, 0x1F4
  out dx, al

  mov eax, ecx
  shr eax, 0x10
  mov edx, 0x1F5
  out dx, al

  mov eax, ecx
  shr eax, 0x18
  or  ax, 0xE0
  mov edx, 0x1F6
  out dx, al

  mov ax, 0x20
  mov edx, 0x1F7
  out dx, al

  call wait_disk

  mov ecx, 0x80
  mov edx, 0x1F0
  cld
  repnz ins DWORD PTR [edi], dx
  ret


wait_disk: <- kernel enter this line as expected
  mov edx, 0x1F7 
  in al, dx <- something is wrong?
  and al, 0xC0
  cmp al, 0x40
  jne wait_disk
  ret <- kernel is not returned from this line

.p2align 2
gdt:
  .quad 0;                    # NULL SEGMENT
  .quad 0xCF9A000000FFFF;     # CODE SEGMENT
  .quad 0xCF92000000FFFF;     # DATA SEGMENT
gdt_end:

gdt_desc:
  .word gdt_end - gdt # sizeof(gdt) - 1
  .word gdt  # addrof(gdt)

.org 510
.word 0xaa55

Answer 1

It turns out that, USB bootable disk is not recognized as an ATA port. I can find out this information (ATA port number) by listing /sys/block in Linux.

lrwxrwxrwx 1 root root 0 Mar 29 13:49 /sys/block/sda -> ../devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda
lrwxrwxrwx 1 root root 0 Mar 29 13:49 /sys/block/sdb -> ../devices/pci0000:00/0000:00:1f.2/ata2/host1/target1:0:0/1:0:0:0/block/sdb
lrwxrwxrwx 1 root root 0 Mar 29 13:49 /sys/block/sdc -> ../devices/pci0000:00/0000:00:1f.2/ata3/host2/target2:0:0/2:0:0:0/block/sdc
lrwxrwxrwx 1 root root 0 Mar 29 13:49 /sys/block/sdd -> ../devices/pci0000:00/0000:00:1f.2/ata4/host3/target3:0:0/3:0:0:0/block/sdd
lrwxrwxrwx 1 root root 0 Mar 29 13:49 /sys/block/sde -> ../devices/pci0000:00/0000:00:14.0/usb3/3-8/3-8:1.0/host6/target6:0:0/6:0:0:0/block/sde

As you can see, there is no assigned ATA port to a USB disk.

Also, ATA supports a disk up to 4, using USB as a bootloader, and tries to access via ATA port is more likely to not work. And there is another problem in my code, that I always try to access ATA bootable disk to ata 0. We have to specify the exact port and driver number to access bootable ATA. So the point is,

1. Do not use ATA if booting disk is USB
2. Have to find exact ATA port forwarding to booting DISK
3. ATA support disk up to 4, if you using more than 4, It probably not working