reactos操作系统实现(47)

当光盘变成记录数据以后，就开始使用光盘来分发操作系统了。毕竟光盘有着储存数据量大，成本便宜的优势。下面就来分析Reactos是怎么样通过光盘的格式来引导操作系统的。

现今的计算机BIOS，会在开机时根据El Torito规格，查找光盘上的开机代码。若该光盘具有开机代码，则BIOS会指配一个磁盘驱动器代号给该光驱。磁盘驱动器代号通常为80（模拟硬盘）或是00（模拟软盘）等。借由模拟成硬盘或软盘，可让旧式的操作系统由光盘开机。

现今新式的操作系统则不需做模拟，只要有如ISOLINUX之类的开机引导程序（boot loader），即可由光盘开机。

#001 ;
****************************************************************************

#002 ;

#003 ;
isolinux.asm

#004 ;

#005 ; A
program to boot Linux kernels off a CD-ROM using the El Torito

#006 ; boot
standard in "no emulation" mode, making the entire filesystem

#007 ;
available. It is based on the
SYSLINUX boot loader for MS-DOS

#008 ;
floppies.

#009 ;

#010 ;
Copyright (C) 1994-2001 H. Peter
Anvin

#011 ;

#012 ; This
program is free software; you can redistribute it and/or modify

#013 ; it
under the terms of the GNU General Public License as published by

#014 ; the
Free Software Foundation, Inc., 675 Mass Ave, Cambridge MA 02139,

#015 ; USA;
either version 2 of the License, or (at your option) any later

#016 ;
version; incorporated herein by reference.

#017 ;

#018 ;
****************************************************************************

#019 ;

#020 ; THIS FILE IS A MODIFIED VERSION OF
ISOLINUX.ASM

#021 ; MODIFICATION DONE BY MICHAEL K TER LOUW

#022 ; LAST UPDATED 3-9-2002

#023 ; SEE "COPYING" FOR INFORMATION
ABOUT THE LICENSE THAT APPLIES TO THIS RELEASE

#024 ;

#025 ;
****************************************************************************

#026 ;

#027 ; This file is a modified version of
ISOLINUX.ASM.

#028 ; Modification done by Eric Kohl

#029 ; Last update 04-25-2002

#030 ;

#031 ;
****************************************************************************

#032

#033 ; Note: The Makefile builds one version with
DEBUG_MESSAGES automatically.

#034 ;%define DEBUG_MESSAGES ; Uncomment to get debugging
messages

#035

#036 %define WAIT_FOR_KEY

#037

#038

下面BIOS的数据区保留内存空间。

#039 ;
---------------------------------------------------------------------------

#040 ;
BEGIN THE BIOS/CODE/DATA SEGMENT

#041 ;
---------------------------------------------------------------------------

#042

#043 absolute
0400h

#044 serial_base resw
4 ; Base addresses for 4
serial ports

#045 absolute
0413h

#046 BIOS_fbm resw
1 ; Free Base Memory
(kilobytes)

#047 absolute
046Ch

#048 BIOS_timer resw
1 ; Timer ticks

#049 absolute
0472h

#050 BIOS_magic resw
1 ; BIOS reset magic

#051 absolute
0484h

#052 BIOS_vidrows resb
1 ; Number of screen rows

#053

#054 ;

#055 ; Memory below this point is reserved for the
BIOS and the MBR

#056 ;

1000h以前都是BIOS的数据区，不能放置代码。

#057 absolute
1000h

#058 trackbuf resb
8192 ; Track buffer goes here

#059 trackbufsize equ
$-trackbuf

#060 ; trackbuf
ends at 3000h

#061

#062 struc
open_file_t

#063 file_sector resd
1 ; Sector pointer (0 =
structure free)

#064 file_left resd
1 ; Number of sectors
left

#065 endstruc

#066

#067 struc
dir_t

#068 dir_lba resd
1 ; Directory start (LBA)

#069 dir_len resd
1 ; Length in bytes

#070 dir_clust resd
1 ; Length in clusters

#071 endstruc

#072

#073

#074 MAX_OPEN_LG2 equ
2 ; log2(Max number of
open files)

#075 MAX_OPEN equ
(1 << MAX_OPEN_LG2)

#076 SECTORSIZE_LG2 equ 11 ; 2048
bytes/sector (El Torito requirement)

#077 SECTORSIZE equ
(1 << SECTORSIZE_LG2)

#078 CR equ
13 ; Carriage Return

#079 LF equ
10 ; Line Feed

#080 retry_count equ
6 ; How patient are we
with the BIOS?

#081

#082

#083

BSS段数据。

#084 absolute
5000h ; Here we
keep our BSS stuff

#085

#086 DriveNo resb
1 ; CD-ROM BIOS drive
number

#087 DiskError resb
1 ; Error code for disk
I/O

#088 RetryCount resb
1 ; Used for disk access
retries

#089 TimeoutCount resb
1 ; Timeout counter

#090 ISOFlags resb
1 ; Flags for ISO
directory search

#091 RootDir resb
dir_t_size ; Root directory

#092 CurDir resb
dir_t_size ; Current directory

#093 ISOFileName resb
64 ; ISO filename
canonicalization buffer

#094 ISOFileNameEnd equ $

#095

#096

#097 alignb
open_file_t_size

#098 Files resb
MAX_OPEN*open_file_t_size

#099

#100

#101

这里ISOBOOT有代码段开始，由于BIOS会读取光盘的引导区到内存 7000开始位置，跟硬盘和磁盘是一样的。

#102 section
.text

#103 org
7000h

#104

#105 start:

#106 cli ; Disable
interrupts

#107 xor ax, ax ;
ax = segment zero

#108 mov ss, ax ;
Initialize stack segment

#109 mov sp, start ;
Set up stack

#110 mov ds, ax ;
Initialize other segment registers

#111 mov es, ax

#112 mov fs, ax

#113 mov gs, ax

#114 sti ; Enable interrupts

#115 cld ; Increment
pointers

#116

把引导代码从0000:7C00位置拷贝到0000:7000位置，然后再运行。

#117 mov cx, 2048 >> 2 ; Copy the bootsector

#118 mov si, 0x7C00 ; from 0000:7C00

#119 mov di, 0x7000 ;
to 0000:7000

#120 rep movsd ;
copy the program

通过一个跳转，实现重定位代码位置。

#121 jmp 0:relocate ;
jump into relocated code

#122

#123 relocate:

如果显示调度信息。

#124 ;
Display the banner and copyright

#125 %ifdef DEBUG_MESSAGES

#126 mov si, isolinux_banner ; si points to hello message

#127 call writestr ;
display the message

#128 mov si,copyright_str

#129 call writestr

#130 %endif

#131

#132

下面通过检查键盘输入来决定是否从光盘引导系统。

先清空键盘输入。

#133 ;
Make sure the keyboard buffer is empty

#134 %ifdef WAIT_FOR_KEY

#135 .kbd_buffer_test:

#136 call pollchar

#137 jz .kbd_buffer_empty

#138 call getchar

#139 jmp .kbd_buffer_test

#140 .kbd_buffer_empty:

到这里已经把键盘缓冲区清空了。

检查硬盘的MBR是否可以引导。

#141

#142 ;
Check for MBR on harddisk

#143 pusha

#144 mov ax, 0201h

#145 mov dx, 0080h

#146 mov cx, 0001h

#147 mov bx, trackbuf

#148 int 13h

#149 popa

如果硬盘不是可引导的，就立即跳到光盘引导，不需要用户选择。

#150 jc .boot_cdrom ; could not read hdd

#151

判断硬盘是否有引导扇区。

#152 push
ax

#153 mov
ax, word [trackbuf]

#154 cmp
ax, 0

如果没有引导扇区，就立即跳到光盘引导。

#155 je .boot_cdrom ; no boot sector found
(hopefully there are no weird bootsectors which begin with 0)

#156 pop
ax

#157

开始显示用户选择光盘引导，还是磁盘引导，同时进行5秒钟计时，如果用户不按下任何按键，就会自动选择硬盘引导。

#158 ;
Display the 'Press key' message and wait for a maximum of 5 seconds

输出换行回车。

#159 call crlf

输出按下任何键的提示字符串。

#160 mov si, presskey_msg ; si points to 'Press key' message

#161 call writestr ;
display the message

#162

5秒钟倒计时。

#163 mov byte [TimeoutCount], 5

#164 .next_second:

获取当前时钟计数到eax，并且相加19个计数。

#165 mov eax, [BIOS_timer] ; load current tick counter

#166 add eax, 19 ;

#167

测试是否有键盘输入任何按键。

#168 .poll_again:

#169 call pollchar

如果有任何按键输入，就跳到光盘引导。

#170 jnz .boot_cdrom

#171

每次比较BIOS里的计数是否与EAX计数相同。

#172 mov ebx, [BIOS_timer]

#173 cmp eax, ebx

#174 jnz .poll_again

#175

如果经历过19个计数，说明已经过了1秒钟。接着开始在屏幕上打印一个点。

#176 mov si, dot_msg ;
print '.'

#177 call writestr

如果超过5秒钟，就跳到硬盘引导。

#178 dec byte [TimeoutCount] ; decrement timeout counter

#179 jz .boot_harddisk

跳到下一秒计时。

#180 jmp .next_second

#181

硬盘引导的代码。

#182 .boot_harddisk:

#183 call crlf

#184

从第一个硬盘引导。

#185 ;
Boot first harddisk (drive 0x80)

#186 mov ax, 0201h

#187 mov dx, 0080h

#188 mov cx, 0001h

#189 mov bx, 7C00h

#190 int 13h

#191 jnc .go_hd

#192 jmp kaboom

#193 .go_hd:

#194 mov ax, cs

#195 mov ds, ax

#196 mov es, ax

#197 mov fs, ax

#198 mov gs, ax

#199 mov dx, 0080h

#200

#201 jmp 0:0x7C00

#202 %endif

#203

从光盘引导。

#204 .boot_cdrom:

#205 %ifdef WAIT_FOR_KEY

#206 call crlf

#207 call crlf

#208 %endif

#209

#210 ;
Save and display the boot drive number

#211 mov [DriveNo], dl

#212 %ifdef DEBUG_MESSAGES

#213 mov si, startup_msg

#214 call writemsg

#215 mov al, dl

#216 call writehex2

#217 call crlf

#218 %endif

#219

获取光驱的模拟状态。

#220 ;
Now figure out what we're actually doing

#221 ;
Note: use passed-in DL value rather than 7Fh because

#222 ;
at least some BIOSes will get the wrong value otherwise

#223 mov ax, 4B01h ;
Get disk emulation status

#224 mov dl, [DriveNo]

#225 mov si, spec_packet

#226 int 13h

#227 jc near spec_query_failed ; Shouldn't happen (BIOS bug)

#228 mov dl, [DriveNo]

#229 cmp [sp_drive], dl ;
Should contain the drive number

#230 jne near spec_query_failed

#231

#232 %ifdef DEBUG_MESSAGES

#233 mov si, spec_ok_msg

#234 call writemsg

#235 mov al, byte [sp_drive]

#236 call writehex2

#237 call crlf

#238 %endif

#239

发现有驱动器可以使用。

#240 found_drive:

通过中断13 的48H号功能读取驱动器信息。

#241 ;
Get drive information

#242 mov ah, 48h

#243 mov dl, [DriveNo]

#244 mov si, drive_params

#245 int 13h

#246 jnc params_ok

#247

#248 ;
mov si, nosecsize_msg No use in reporting this

#249 ;
call writemsg

#250

#251 params_ok:

#252 ;
Check for the sector size (should be 2048, but

#253 ;
some BIOSes apparently think we're 512-byte media)

#254 ;

#255 ;
FIX: We need to check what the proper behaviour

#256 ;
is for getlinsec when the BIOS thinks the sector

#257 ;
size is 512!!! For that, we need such a
BIOS, though...

#258 %ifdef DEBUG_MESSAGES

#259 mov si, secsize_msg

#260 call writemsg

#261 mov ax, [dp_secsize]

#262 call writehex4

#263 call crlf

#264 %endif

#265

#266

清空文件结构。

#267 ;

#268 ;
Clear Files structures

#269 ;

#270 mov di, Files

#271 mov cx, (MAX_OPEN*open_file_t_size)/4

#272 xor eax, eax

#273 rep stosd

#274

#275 ;

#276 ;
Now, we need to sniff out the actual filesystem data structures.

#277 ;
mkisofs gave us a pointer to the primary volume descriptor

#278 ;
(which will be at 16 only for a single-session disk!); from the PVD

#279 ;
we should be able to find the rest of what we need to know.

#280 ;

获取一个扇区数据。

#281 get_fs_structures:

#282 mov eax, 16 ;
Primary Volume Descriptor (sector 16)

#283 mov bx, trackbuf

#284 call getonesec

#285

#286 mov eax, [trackbuf+156+2]

#287 mov [RootDir+dir_lba],eax

#288 mov [CurDir+dir_lba],eax

#289 %ifdef DEBUG_MESSAGES

#290 mov si, rootloc_msg

#291 call writemsg

#292 call writehex8

#293 call crlf

#294 %endif

#295

#296 mov eax,[trackbuf+156+10]

#297 mov [RootDir+dir_len],eax

#298 mov [CurDir+dir_len],eax

#299 %ifdef DEBUG_MESSAGES

#300 mov si, rootlen_msg

#301 call writemsg

#302 call writehex8

#303 call crlf

#304 %endif

#305 add eax,SECTORSIZE-1

#306 shr eax,SECTORSIZE_LG2

#307 mov [RootDir+dir_clust],eax

#308 mov [CurDir+dir_clust],eax

#309 %ifdef DEBUG_MESSAGES

#310 mov si, rootsect_msg

#311 call writemsg

#312 call writehex8

#313 call crlf

#314 %endif

#315

这里查找根目录里的目录名称“/LOADER”。

#316 ;
Look for the "REACTOS" directory, and if found,

#317 ;
make it the current directory instead of the root

#318 ;
directory.

#319 mov di,isolinux_dir

#320 mov al,02h ;
Search for a directory

#321 call searchdir_iso

#322 jnz .dir_found

#323 mov si,no_dir_msg

#324 call writemsg

#325 jmp kaboom

#326

#327 .dir_found:

#328 mov [CurDir+dir_len],eax

#329 mov eax,[si+file_left]

#330 mov [CurDir+dir_clust],eax

#331 xor eax,eax ;
Free this file pointer entry

#332 xchg eax,[si+file_sector]

#333 mov [CurDir+dir_lba],eax

#334

#335

这里查找二级引导程序“SETUPLDR.SYS”文件。

#336 mov di, isolinux_bin ; di points to Isolinux filename

#337 call searchdir ;
look for the file

#338 jnz .isolinux_opened ; got the file

#339 mov si, no_isolinux_msg ; si points to error message

#340 call writemsg ;
display the message

#341 jmp kaboom ;
fail boot

#342

#343 .isolinux_opened:

#344 mov di, si ;
save file pointer

#345

#346 %ifdef DEBUG_MESSAGES

#347 mov si, filelen_msg

#348 call writemsg

#349 call writehex8

#350 call crlf

#351 %endif

#352

计算扇区的大小。

#353
mov
ecx, eax ; calculate sector
count

#354 shr
ecx, 11

#355 test
eax, 0x7FF

#356 jz
.full_sector

#357 inc
ecx

#358 .full_sector:

#359

#360 %ifdef DEBUG_MESSAGES

#361 mov
eax, ecx

#362 mov si, filesect_msg

#363 call writemsg

#364 call writehex8

#365 call crlf

#366 %endif

#367

这里把二级引导程序加载到0x8000位置。

#368 mov bx, 0x8000 ;
bx = load address

#369 mov si, di ;
restore file pointer

#370 mov cx, 0xFFFF ;
load the whole file

#371 call getfssec ;
get the whole file

#372

#373 %ifdef DEBUG_MESSAGES

#374 mov si, startldr_msg

#375 call writemsg

#376 call crlf

#377 %endif

#378

#379 mov dl, [DriveNo] ;
dl = boot drive

#380 mov
dh, 0 ;
dh = boot partition

最后跳转到0x8000的位置运行二级引导程序，也就是运行SETUPLDR.SYS文件。

#381 jmp 0:0x8000 ;
jump into OSLoader

#382

#383

#384

#385 ;

#386 ; searchdir:

#387 ;

#388 ; Open a file

#389 ;

#390 ; On
entry:

#391 ; DS:DI = filename

#392 ; If
successful:

#393 ; ZF
clear

#394 ; SI = file pointer

#395 ; DX:AX
or EAX = file length in bytes

#396 ; If
unsuccessful

#397 ; ZF
set

#398 ;

#399

#400 ;

#401 ; searchdir_iso is a special entry point for
ISOLINUX only. In addition

#402 ; to the above, searchdir_iso passes a file
flag mask in AL. This is useful

#403 ; for searching for directories.

#404 ;

#405 alloc_failure:

#406 xor ax,ax ;
ZF <- 1

#407 ret

#408

#409 searchdir:

#410 xor al,al

#411 searchdir_iso:

#412 mov [ISOFlags],al

#413 call allocate_file ;
Temporary file structure for directory

#414 jnz alloc_failure

#415 push es

#416 push ds

#417 pop es ; ES = DS

#418 mov si,CurDir

#419 cmp byte [di],'/' ;
If filename begins with slash

#420 jne .not_rooted

#421 inc di ;
Skip leading slash

#422 mov si,RootDir ;
Reference root directory instead

#423 .not_rooted:

#424 mov eax,[si+dir_clust]

#425 mov [bx+file_left],eax

#426 mov eax,[si+dir_lba]

#427 mov [bx+file_sector],eax

#428 mov edx,[si+dir_len]

#429

#430 .look_for_slash:

#431 mov ax,di

#432 .scan:

#433 mov cl,[di]

#434 inc di

#435 and cl,cl

#436 jz .isfile

#437 cmp cl,'/'

#438 jne .scan

#439 mov [di-1],byte 0 ;
Terminate at directory name

#440 mov cl,02h ;
Search for directory

#441 xchg cl,[ISOFlags]

#442 push di

#443 push cx

#444 push word .resume ; Where to "return" to

#445 push es

#446 .isfile:

#447 xchg ax,di

#448

#449 .getsome:

#450 ;
Get a chunk of the directory

#451 mov si,trackbuf

#452 pushad

#453 xchg bx,si

#454 mov cx,1 ;
load one sector

#455 call getfssec

#456 popad

#457

#458 .compare:

#459 movzx eax, byte [si] ; Length of directory entry

#460 cmp al, 33

#461 jb .next_sector

#462 mov cl, [si+25]

#463 xor cl, [ISOFlags]

#464 test cl, byte 8Eh ;
Unwanted file attributes!

#465 jnz .not_file

#466 pusha

#467 movzx cx, byte [si+32] ; File identifier length

#468 add si, byte 33 ;
File identifier offset

#469 call iso_compare_names

#470 popa

#471 je .success

#472 .not_file:

#473 sub edx, eax ;
Decrease bytes left

#474 jbe .failure

#475 add si, ax ;
Advance pointer

#476

#477 .check_overrun:

#478 ;
Did we finish the buffer?

#479 cmp si, trackbuf+trackbufsize

#480 jb .compare ;
No, keep going

#481

#482 jmp short .getsome ;
Get some more directory

#483

#484 .next_sector:

#485 ;
Advance to the beginning of next sector

#486 lea ax, [si+SECTORSIZE-1]

#487 and ax, ~(SECTORSIZE-1)

#488 sub ax, si

#489 jmp short .not_file ; We still need to do length checks

#490

#491 .failure:

#492 %ifdef DEBUG_MESSAGES

#493 mov si, findfail_msg

#494 call writemsg

#495 call crlf

#496 %endif

#497 xor eax, eax ;
ZF = 1

#498 mov [bx+file_sector], eax

#499 pop es

#500 ret

#501

#502 .success:

#503 mov eax, [si+2] ;
Location of extent

#504 mov [bx+file_sector], eax

#505 mov eax, [si+10] ;
Data length

#506 push eax

#507 add eax, SECTORSIZE-1

#508 shr eax, SECTORSIZE_LG2

#509 mov [bx+file_left], eax

#510 pop eax

#511 mov edx, eax

#512 shr edx, 16

#513 and bx, bx ;
ZF = 0

#514 mov si, bx

#515 pop es

#516 ret

#517

#518
.resume:

#519 ;
We get here if we were only doing part of a lookup

#520 ;
This relies on the fact that .success returns bx == si

#521 xchg edx, eax ;
Directory length in edx

#522 pop cx ;
Old ISOFlags

#523 pop di ;
Next filename pointer

#524

#525 mov byte [di-1], '/' ; restore the backslash in the filename

#526

#527 mov [ISOFlags], cl ;
Restore the flags

#528 jz .failure ;
Did we fail? If so fail for real!

#529 jmp .look_for_slash ; Otherwise, next level

#530

#531 ;

#532 ; allocate_file: Allocate a file structure

#533 ;

#534 ; If
successful:

#535 ; ZF set

#536 ; BX = file pointer

#537 ; In
unsuccessful:

#538 ; ZF clear

#539 ;

#540 allocate_file:

#541 push cx

#542 mov bx, Files

#543 mov cx, MAX_OPEN

#544 .check:

#545 cmp dword [bx], byte 0

#546 je .found

#547 add bx, open_file_t_size ; ZF = 0

#548 loop .check

#549 ;
ZF = 0 if we fell out of the loop

#550 .found:

#551 pop cx

#552 ret

#553

#554 ;

#555 ; iso_compare_names:

#556 ; Compare
the names DS:SI and DS:DI and report if they are

#557 ; equal
from an ISO 9660 perspective. SI is the
name from

#558 ; the
filesystem; CX indicates its length, and ';' terminates.

#559 ; DI
is expected to end with a null.

#560 ;

#561 ; Note:
clobbers AX, CX, SI, DI; assumes DS == ES == base segment

#562 ;

#563 iso_compare_names:

#564 ;
First, terminate and canonicalize input filename

#565 push di

#566 mov di, ISOFileName

#567 .canon_loop:

#568 jcxz .canon_end

#569 lodsb

#570 dec cx

#571 cmp al, ';'

#572 je .canon_end

#573 and al, al

#574 je .canon_end

#575 stosb

#576 cmp di, ISOFileNameEnd-1 ; Guard against buffer overrun

#577 jb .canon_loop

#578 .canon_end:

#579 cmp di, ISOFileName

#580 jbe .canon_done

#581 cmp byte [di-1], '.' ; Remove terminal dots

#582 jne .canon_done

#583 dec di

#584 jmp short .canon_end

#585 .canon_done:

#586 mov [di], byte 0 ;
Null-terminate string

#587 pop di

#588 mov si, ISOFileName

#589 .compare:

#590 lodsb

#591 mov ah, [di]

#592 inc di

#593 and ax, ax

#594 jz .success ;
End of string for both

#595 and al, al ;
Is either one end of string?

#596 jz .failure ;
If so, failure

#597 and ah, ah

#598 jz .failure

#599 or ax, 2020h ;
Convert to lower case

#600 cmp al, ah

#601 je .compare

#602 .failure:

#603 and ax, ax ;
ZF = 0 (at least one will be nonzero)

#604 .success:

#605 ret

#606

#607

#608

#609

#610

#611

#612

#613 ;

#614 ; getfssec: Get multiple clusters from a
file, given the file pointer.

#615 ;

#616 ; On
entry:

#617 ; ES:BX -> Buffer

#618 ; SI -> File pointer

#619 ; CX -> Cluster count; 0FFFFh = until end of
file

#620 ; On
exit:

#621 ; SI -> File pointer (or 0 on EOF)

#622 ; CF
= 1 -> Hit EOF

#623 ;

#624 getfssec:

#625 cmp cx, [si+file_left]

#626 jna .ok_size

#627 mov cx, [si+file_left]

#628

#629 .ok_size:

#630 mov bp, cx

#631 push cx

#632 push si

#633 mov eax, [si+file_sector]

#634 call getlinsec

#635 xor ecx, ecx

#636 pop si

#637 pop cx

#638

#639 add [si+file_sector], ecx

#640 sub [si+file_left], ecx

#641 ja .not_eof ;
CF = 0

#642

#643 xor ecx, ecx

#644 mov [si+file_sector], ecx ; Mark as unused

#645 xor si,si

#646 stc

#647

#648 .not_eof:

#649 ret

#650

#651

#652

#653 ; INT 13h, AX=4B01h, DL=<passed in
value> failed.

#654 ; Try to scan the entire 80h-FFh from the
end.

#655 spec_query_failed:

#656 mov si,spec_err_msg

#657 call writemsg

#658

#659 mov dl, 0FFh

#660 .test_loop:

#661 pusha

#662 mov ax, 4B01h

#663 mov si, spec_packet

#664 mov byte [si], 13 ;
Size of buffer

#665 int 13h

#666 popa

#667 jc .still_broken

#668

#669 mov si, maybe_msg

#670 call writemsg

#671 mov al, dl

#672 call writehex2

#673 call crlf

#674

#675 cmp byte [sp_drive], dl

#676 jne .maybe_broken

#677

#678 ;
Okay, good enough...

#679 mov si, alright_msg

#680 call writemsg

#681 mov [DriveNo], dl

#682 .found_drive:

#683 jmp found_drive

#684

#685 ;
Award BIOS 4.51 apparently passes garbage in sp_drive,

#686 ;
but if this was the drive number originally passed in

#687 ;
DL then consider it "good enough"

#688 .maybe_broken:

#689 cmp byte [DriveNo], dl

#690 je .found_drive

#691

#692 .still_broken:

#693 dec
dx

#694 cmp dl, 80h

#695 jnb .test_loop

#696

#697 fatal_error:

#698 mov si, nothing_msg

#699 call writemsg

#700

#701 .norge:

#702 jmp short .norge

#703

#704

#705

#706 ;
Information message (DS:SI) output

#707 ;
Prefix with "isolinux: "

#708 ;

#709 writemsg:

#710 push ax

#711 push si

#712 mov si, isolinux_str

#713 call writestr

#714 pop si

#715 call writestr

#716 pop ax

#717 ret

#718

#719 ;

#720 ; crlf: Print a newline

#721 ;

#722 crlf:

#723 mov si, crlf_msg

#724 ;
Fall through

#725

#726 ;

#727 ; writestr: write a null-terminated string to
the console, saving

#728 ;
registers on entry.

#729 ;

#730 writestr:

#731 pushfd

#732 pushad

#733 .top:

#734 lodsb

#735 and al, al

#736 jz .end

#737 call writechr

#738 jmp short .top

#739 .end:

#740 popad

#741 popfd

#742 ret

#743

#744

#745 ;

#746 ; writehex[248]: Write a hex number in (AL,
AX, EAX) to the console

#747 ;

#748 writehex2:

#749 pushfd

#750 pushad

#751 shl eax, 24

#752 mov cx, 2

#753 jmp short writehex_common

#754 writehex4:

#755 pushfd

#756 pushad

#757 shl eax, 16

#758 mov cx, 4

#759 jmp short writehex_common

#760 writehex8:

#761 pushfd

#762 pushad

#763 mov cx, 8

#764 writehex_common:

#765 .loop:

#766 rol eax, 4

#767 push eax

#768 and al, 0Fh

#769 cmp al, 10

#770 jae .high

#771 .low:

#772 add al, '0'

#773 jmp short .ischar

#774 .high:

#775 add al, 'A'-10

#776 .ischar:

#777 call writechr

#778 pop eax

#779 loop .loop

#780 popad

#781 popfd

#782 ret

#783

#784 ;

#785 ; Write a character to the screen. There is a more "sophisticated"

#786 ; version of this in the subsequent code, so
we patch the pointer

#787 ; when appropriate.

#788 ;

#789

#790 writechr:

#791 pushfd

#792 pushad

#793 mov ah, 0Eh

#794 xor bx, bx

#795 int 10h

#796 popad

#797 popfd

#798 ret

#799

#800 ;

#801 ; Get one sector. Convenience entry point.

#802 ;

#803 getonesec:

#804 mov bp, 1

#805 ;
Fall through to getlinsec

#806

#807 ;

#808 ; Get linear sectors - EBIOS LBA addressing,
2048-byte sectors.

#809 ;

#810 ; Note that we can't always do this as a
single request, because at least

#811 ; Phoenix BIOSes has a 127-sector limit. To be on the safe side, stick

#812 ; to 32 sectors (64K) per request.

#813 ;

#814 ; Input:

#815 ; EAX - Linear sector number

#816 ; ES:BX - Target buffer

#817 ; BP - Sector count

#818 ;

#819 getlinsec:

#820 mov
si,dapa ; Load up the DAPA

#821 mov
[si+4],bx

#822 mov
bx,es

#823 mov
[si+6],bx

#824 mov
[si+8],eax

#825 .loop2:

#826 push
bp ; Sectors left

#827 cmp
bp,[MaxTransfer]

#828 jbe
.bp_ok

#829 mov
bp,[MaxTransfer]

#830 .bp_ok:

#831 mov
[si+2],bp

#832 push
si

#833 mov
dl,[DriveNo]

#834 mov
ah,42h ; Extended Read

#835 call
xint13

#836 pop
si

#837 pop
bp

#838 movzx
eax,word [si+2] ; Sectors we read

#839 add
[si+8],eax ; Advance
sector pointer

#840 sub
bp,ax ; Sectors left

#841 shl
ax,SECTORSIZE_LG2-4 ; 2048-byte
sectors -> segment

#842 add
[si+6],ax ; Advance buffer
pointer

#843 and
bp,bp

#844 jnz
.loop2

#845 mov
eax,[si+8] ; Next
sector

#846 ret

#847

#848 ;
INT 13h with retry

#849 xint13:

#850 mov byte [RetryCount], retry_count

#851 .try:

#852 pushad

#853 int 13h

#854 jc .error

#855 add sp, byte 8*4 ;
Clean up stack

#856 ret

#857 .error:

#858 mov [DiskError], ah ;
Save error code

#859 popad

#860 dec
byte [RetryCount]

#861 jz
.real_error

#862 push
ax

#863 mov
al,[RetryCount]

#864 mov
ah,[dapa+2] ; Sector
transfer count

#865 cmp
al,2 ; Only 2 attempts left

#866 ja
.nodanger

#867 mov
ah,1 ; Drop transfer
size to 1

#868 jmp
short .setsize

#869 .nodanger:

#870 cmp
al,retry_count-2

#871 ja
.again ; First time, just
try again

#872 shr
ah,1 ; Otherwise, try to
reduce

#873 adc
ah,0 ; the max
transfer size, but not to 0

#874 .setsize:

#875 mov
[MaxTransfer],ah

#876 mov
[dapa+2],ah

#877 .again:

#878 pop
ax

#879 jmp
.try

#880

#881 .real_error:

#882 mov si, diskerr_msg

#883 call writemsg

#884 mov al, [DiskError]

#885 call writehex2

#886 mov si, ondrive_str

#887 call writestr

#888 mov al, dl

#889 call writehex2

#890 call crlf

#891 ;
Fall through to kaboom

#892

#893 ;

#894 ; kaboom: write a message and bail out. Wait for a user keypress,

#895 ; then do a hard reboot.

#896 ;

#897 kaboom:

#898 mov ax, cs

#899 mov ds, ax

#900 mov es, ax

#901 mov fs, ax

#902 mov gs, ax

#903 sti

#904 mov si, err_bootfailed

#905 call writestr

#906 call getchar

#907 cli

#908 mov word [BIOS_magic], 0 ; Cold reboot

#909 jmp 0F000h:0FFF0h ; Reset vector address

#910

#911 getchar:

#912 .again:

#913 mov ah, 1 ;
Poll keyboard

#914 int 16h

#915 jz .again

#916 .kbd:

#917 xor ax, ax ;
Get keyboard input

#918 int 16h

#919 .func_key:

#920 ret

#921

#922

#923 ;

#924 ; pollchar: check if we have an input
character pending (ZF = 0)

#925 ;

#926 pollchar:

#927 pushad

#928 mov
ah,1 ; Poll keyboard

#929 int
16h

#930 popad

#931 ret

#932

#933

#934

#935 isolinux_banner db CR, LF, 'Loading IsoBoot...', CR, LF, 0

#936 copyright_str db
' Copyright (C) 1994-2002 H. Peter Anvin', CR, LF, 0

#937 presskey_msg db
'Press any key to boot from CD', 0

#938 dot_msg db
'.',0

#939

#940 %ifdef DEBUG_MESSAGES

#941 startup_msg: db
'Starting up, DL = ', 0

#942 spec_ok_msg: db
'Loaded spec packet OK, drive = ', 0

#943 secsize_msg: db
'Sector size appears to be ', 0

#944 rootloc_msg: db
'Root directory location: ', 0

#945 rootlen_msg: db
'Root directory length: ', 0

#946 rootsect_msg: db
'Root directory length(sectors): ', 0

#947 fileloc_msg: db
'SETUPLDR.SYS location: ', 0

#948 filelen_msg: db
'SETUPLDR.SYS length: ', 0

#949 filesect_msg: db
'SETUPLDR.SYS length(sectors): ', 0

#950 findfail_msg: db
'Failed to find file!', 0

#951 startldr_msg: db
'Starting SETUPLDR.SYS', 0

#952 %endif

#953

#954 nosecsize_msg: db 'Failed to get sector size, assuming 0800', CR, LF, 0

#955 spec_err_msg: db
'Loading spec packet failed, trying to wing it...', CR, LF, 0

#956 maybe_msg: db
'Found something at drive = ', 0

#957 alright_msg: db
'Looks like it might be right, continuing...', CR, LF, 0

#958 nothing_msg: db
'Failed to locate CD-ROM device; boot failed.', CR, LF, 0

#959 isolinux_str db
'IsoBoot: ', 0

#960 crlf_msg db
CR, LF, 0

#961 diskerr_msg: db 'Disk error ', 0

#962 ondrive_str: db
', drive ', 0

#963 err_bootfailed db CR, LF, 'Boot failed: press a key to retry...'

#964 isolinux_dir db
'/LOADER', 0

#965 no_dir_msg db
'Could not find the LOADER directory.', CR, LF, 0

#966 isolinux_bin db
'SETUPLDR.SYS', 0

#967 no_isolinux_msg db 'Could not find SETUPLDR.SYS.', CR, LF, 0

#968

#969 ;

#970 ; El Torito spec packet

#971 ;

#972 align
8, db 0

#973 spec_packet: db
13h ; Size of
packet

#974 sp_media: db
0 ; Media type

#975 sp_drive: db
0 ; Drive
number

#976 sp_controller: db 0 ;
Controller index

#977 sp_lba: dd
0 ; LBA for
emulated disk image

#978 sp_devspec: dw
0 ; IDE/SCSI
information

#979 sp_buffer: dw
0 ;
User-provided buffer

#980 sp_loadseg: dw
0 ; Load
segment

#981 sp_sectors: dw
0 ; Sector
count

#982 sp_chs: db
0,0,0 ; Simulated CHS
geometry

#983 sp_dummy: db
0 ; Scratch,
safe to overwrite

#984

#985 ;

#986 ; EBIOS drive parameter packet

#987 ;

#988 align
8, db 0

#989 drive_params: dw
30 ; Buffer size

#990 dp_flags: dw
0 ; Information
flags

#991 dp_cyl: dd
0 ; Physical
cylinders

#992 dp_head: dd
0 ; Physical
heads

#993 dp_sec: dd
0 ; Physical sectors/track

#994 dp_totalsec: dd
0,0 ; Total
sectors

#995 dp_secsize: dw
0 ; Bytes per
sector

#996 dp_dpte: dd
0 ; Device
Parameter Table

#997 dp_dpi_key: dw
0 ; 0BEDDh if
rest valid

#998 dp_dpi_len: db 0 ;
DPI len

#999 db
0

#1000 dw
0

#1001 dp_bus: times
4 db 0 ; Host bus type

#1002 dp_interface: times
8 db 0 ; Interface type

#1003 db_i_path: dd
0,0 ; Interface
path

#1004 db_d_path: dd
0,0 ; Device path

#1005 db
0

#1006 db_dpi_csum: db
0 ; Checksum
for DPI info

#1007

#1008 ;

#1009 ; EBIOS disk address packet

#1010 ;

#1011 align
8, db 0

#1012 dapa: dw
16 ; Packet size

#1013 .count: dw
0 ; Block count

#1014 .off: dw
0 ; Offset of
buffer

#1015 .seg: dw
0 ; Segment of
buffer

#1016 .lba: dd
0 ; LBA (LSW)

#1017 dd
0 ; LBA (MSW)

#1018

#1019 alignb
4, db 0

#1020 MaxTransfer dw
2 ;32 ; Max sectors
per transfer

#1021

#1022 times
2046-($-$$) db 0 ; Pad to file
offset 2046

#1023 dw
0aa55h ; BootSector
signature

#1024

上面分析了光盘引导程序，知道怎么跳转到二级引导程序工作。也就是加载SETUPLDR.SYS文件到内存，然后跳到相应位置运行。最后加载内核ntoskrnl.exe运行。