| Current Path : /sys/amd64/compile/hs32/modules/usr/src/sys/modules/usb/uipaq/@/boot/i386/cdboot/ |
FreeBSD hs32.drive.ne.jp 9.1-RELEASE FreeBSD 9.1-RELEASE #1: Wed Jan 14 12:18:08 JST 2015 root@hs32.drive.ne.jp:/sys/amd64/compile/hs32 amd64 |
| Current File : //sys/amd64/compile/hs32/modules/usr/src/sys/modules/usb/uipaq/@/boot/i386/cdboot/cdboot.S |
# # Copyright (c) 2001 John Baldwin <jhb@FreeBSD.org> # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # 3. Neither the name of the author nor the names of any co-contributors # may be used to endorse or promote products derived from this software # without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # # $FreeBSD: release/9.1.0/sys/boot/i386/cdboot/cdboot.S 237761 2012-06-29 10:10:16Z avg $ # # This program is a freestanding boot program to load an a.out binary # from a CD-ROM booted with no emulation mode as described by the El # Torito standard. Due to broken BIOSen that do not load the desired # number of sectors, we try to fit this in as small a space as possible. # # Basically, we first create a set of boot arguments to pass to the loaded # binary. Then we attempt to load /boot/loader from the CD we were booted # off of. # #include <bootargs.h> # # Memory locations. # .set MEM_PAGE_SIZE,0x1000 # memory page size, 4k .set MEM_ARG,0x900 # Arguments at start .set MEM_ARG_BTX,0xa100 # Where we move them to so the # BTX client can see them .set MEM_ARG_SIZE,0x18 # Size of the arguments .set MEM_BTX_ADDRESS,0x9000 # where BTX lives .set MEM_BTX_ENTRY,0x9010 # where BTX starts to execute .set MEM_BTX_OFFSET,MEM_PAGE_SIZE # offset of BTX in the loader .set MEM_BTX_CLIENT,0xa000 # where BTX clients live # # a.out header fields # .set AOUT_TEXT,0x04 # text segment size .set AOUT_DATA,0x08 # data segment size .set AOUT_BSS,0x0c # zero'd BSS size .set AOUT_SYMBOLS,0x10 # symbol table .set AOUT_ENTRY,0x14 # entry point .set AOUT_HEADER,MEM_PAGE_SIZE # size of the a.out header # # Segment selectors. # .set SEL_SDATA,0x8 # Supervisor data .set SEL_RDATA,0x10 # Real mode data .set SEL_SCODE,0x18 # PM-32 code .set SEL_SCODE16,0x20 # PM-16 code # # BTX constants # .set INT_SYS,0x30 # BTX syscall interrupt # # Constants for reading from the CD. # .set ERROR_TIMEOUT,0x80 # BIOS timeout on read .set NUM_RETRIES,3 # Num times to retry .set SECTOR_SIZE,0x800 # size of a sector .set SECTOR_SHIFT,11 # number of place to shift .set BUFFER_LEN,0x100 # number of sectors in buffer .set MAX_READ,0x10000 # max we can read at a time .set MAX_READ_SEC,MAX_READ >> SECTOR_SHIFT .set MEM_READ_BUFFER,0x9000 # buffer to read from CD .set MEM_VOLDESC,MEM_READ_BUFFER # volume descriptor .set MEM_DIR,MEM_VOLDESC+SECTOR_SIZE # Lookup buffer .set VOLDESC_LBA,0x10 # LBA of vol descriptor .set VD_PRIMARY,1 # Primary VD .set VD_END,255 # VD Terminator .set VD_ROOTDIR,156 # Offset of Root Dir Record .set DIR_LEN,0 # Offset of Dir Record length .set DIR_EA_LEN,1 # Offset of EA length .set DIR_EXTENT,2 # Offset of 64-bit LBA .set DIR_SIZE,10 # Offset of 64-bit length .set DIR_NAMELEN,32 # Offset of 8-bit name len .set DIR_NAME,33 # Offset of dir name # # We expect to be loaded by the BIOS at 0x7c00 (standard boot loader entry # point) # .code16 .globl start .org 0x0, 0x0 # # Program start. # start: cld # string ops inc xor %ax,%ax # zero %ax mov %ax,%ss # setup the mov $start,%sp # stack mov %ax,%ds # setup the mov %ax,%es # data segments mov %dl,drive # Save BIOS boot device mov $msg_welcome,%si # %ds:(%si) -> welcome message call putstr # display the welcome message # # Setup the arguments that the loader is expecting from boot[12] # mov $msg_bootinfo,%si # %ds:(%si) -> boot args message call putstr # display the message mov $MEM_ARG,%bx # %ds:(%bx) -> boot args mov %bx,%di # %es:(%di) -> boot args xor %eax,%eax # zero %eax mov $(MEM_ARG_SIZE/4),%cx # Size of arguments in 32-bit # dwords rep # Clear the arguments stosl # to zero mov drive,%dl # Store BIOS boot device mov %dl,0x4(%bx) # in kargs->bootdev or $KARGS_FLAGS_CD,0x8(%bx) # kargs->bootflags |= # KARGS_FLAGS_CD # # Load Volume Descriptor # mov $VOLDESC_LBA,%eax # Set LBA of first VD load_vd: push %eax # Save %eax mov $1,%dh # One sector mov $MEM_VOLDESC,%ebx # Destination call read # Read it in cmpb $VD_PRIMARY,(%bx) # Primary VD? je have_vd # Yes pop %eax # Prepare to inc %eax # try next cmpb $VD_END,(%bx) # Last VD? jne load_vd # No, read next mov $msg_novd,%si # No VD jmp error # Halt have_vd: # Have Primary VD # # Try to look up the loader binary using the paths in the loader_paths # array. # mov $loader_paths,%si # Point to start of array lookup_path: push %si # Save file name pointer call lookup # Try to find file pop %di # Restore file name pointer jnc lookup_found # Found this file xor %al,%al # Look for next mov $0xffff,%cx # path name by repnz # scanning for scasb # nul char mov %di,%si # Point %si at next path mov (%si),%al # Get first char of next path or %al,%al # Is it double nul? jnz lookup_path # No, try it. mov $msg_failed,%si # Failed message jmp error # Halt lookup_found: # Found a loader file # # Load the binary into the buffer. Due to real mode addressing limitations # we have to read it in 64k chunks. # mov DIR_SIZE(%bx),%eax # Read file length add $SECTOR_SIZE-1,%eax # Convert length to sectors shr $SECTOR_SHIFT,%eax cmp $BUFFER_LEN,%eax jbe load_sizeok mov $msg_load2big,%si # Error message call error load_sizeok: movzbw %al,%cx # Num sectors to read mov DIR_EXTENT(%bx),%eax # Load extent xor %edx,%edx mov DIR_EA_LEN(%bx),%dl add %edx,%eax # Skip extended mov $MEM_READ_BUFFER,%ebx # Read into the buffer load_loop: mov %cl,%dh cmp $MAX_READ_SEC,%cl # Truncate to max read size jbe load_notrunc mov $MAX_READ_SEC,%dh load_notrunc: sub %dh,%cl # Update count push %eax # Save call read # Read it in pop %eax # Restore add $MAX_READ_SEC,%eax # Update LBA add $MAX_READ,%ebx # Update dest addr jcxz load_done # Done? jmp load_loop # Keep going load_done: # # Turn on the A20 address line # call seta20 # Turn A20 on # # Relocate the loader and BTX using a very lazy protected mode # mov $msg_relocate,%si # Display the call putstr # relocation message mov MEM_READ_BUFFER+AOUT_ENTRY,%edi # %edi is the destination mov $(MEM_READ_BUFFER+AOUT_HEADER),%esi # %esi is # the start of the text # segment mov MEM_READ_BUFFER+AOUT_TEXT,%ecx # %ecx = length of the text # segment push %edi # Save entry point for later lgdt gdtdesc # setup our own gdt cli # turn off interrupts mov %cr0,%eax # Turn on or $0x1,%al # protected mov %eax,%cr0 # mode ljmp $SEL_SCODE,$pm_start # long jump to clear the # instruction pre-fetch queue .code32 pm_start: mov $SEL_SDATA,%ax # Initialize mov %ax,%ds # %ds and mov %ax,%es # %es to a flat selector rep # Relocate the movsb # text segment add $(MEM_PAGE_SIZE - 1),%edi # pad %edi out to a new page and $~(MEM_PAGE_SIZE - 1),%edi # for the data segment mov MEM_READ_BUFFER+AOUT_DATA,%ecx # size of the data segment rep # Relocate the movsb # data segment mov MEM_READ_BUFFER+AOUT_BSS,%ecx # size of the bss xor %eax,%eax # zero %eax add $3,%cl # round %ecx up to shr $2,%ecx # a multiple of 4 rep # zero the stosl # bss mov MEM_READ_BUFFER+AOUT_ENTRY,%esi # %esi -> relocated loader add $MEM_BTX_OFFSET,%esi # %esi -> BTX in the loader mov $MEM_BTX_ADDRESS,%edi # %edi -> where BTX needs to go movzwl 0xa(%esi),%ecx # %ecx -> length of BTX rep # Relocate movsb # BTX ljmp $SEL_SCODE16,$pm_16 # Jump to 16-bit PM .code16 pm_16: mov $SEL_RDATA,%ax # Initialize mov %ax,%ds # %ds and mov %ax,%es # %es to a real mode selector mov %cr0,%eax # Turn off and $~0x1,%al # protected mov %eax,%cr0 # mode ljmp $0,$pm_end # Long jump to clear the # instruction pre-fetch queue pm_end: sti # Turn interrupts back on now # # Copy the BTX client to MEM_BTX_CLIENT # xor %ax,%ax # zero %ax and set mov %ax,%ds # %ds and %es mov %ax,%es # to segment 0 mov $MEM_BTX_CLIENT,%di # Prepare to relocate mov $btx_client,%si # the simple btx client mov $(btx_client_end-btx_client),%cx # length of btx client rep # Relocate the movsb # simple BTX client # # Copy the boot[12] args to where the BTX client can see them # mov $MEM_ARG,%si # where the args are at now mov $MEM_ARG_BTX,%di # where the args are moving to mov $(MEM_ARG_SIZE/4),%cx # size of the arguments in longs rep # Relocate movsl # the words # # Save the entry point so the client can get to it later on # pop %eax # Restore saved entry point stosl # and add it to the end of # the arguments # # Now we just start up BTX and let it do the rest # mov $msg_jump,%si # Display the call putstr # jump message ljmp $0,$MEM_BTX_ENTRY # Jump to the BTX entry point # # Lookup the file in the path at [SI] from the root directory. # # Trashes: All but BX # Returns: CF = 0 (success), BX = pointer to record # CF = 1 (not found) # lookup: mov $VD_ROOTDIR+MEM_VOLDESC,%bx # Root directory record push %si mov $msg_lookup,%si # Display lookup message call putstr pop %si push %si call putstr mov $msg_lookup2,%si call putstr pop %si lookup_dir: lodsb # Get first char of path cmp $0,%al # Are we done? je lookup_done # Yes cmp $'/',%al # Skip path separator. je lookup_dir dec %si # Undo lodsb side effect call find_file # Lookup first path item jnc lookup_dir # Try next component mov $msg_lookupfail,%si # Not found message call putstr stc # Set carry ret jmp error lookup_done: mov $msg_lookupok,%si # Success message call putstr clc # Clear carry ret # # Lookup file at [SI] in directory whose record is at [BX]. # # Trashes: All but returns # Returns: CF = 0 (success), BX = pointer to record, SI = next path item # CF = 1 (not found), SI = preserved # find_file: mov DIR_EXTENT(%bx),%eax # Load extent xor %edx,%edx mov DIR_EA_LEN(%bx),%dl add %edx,%eax # Skip extended attributes mov %eax,rec_lba # Save LBA mov DIR_SIZE(%bx),%eax # Save size mov %eax,rec_size xor %cl,%cl # Zero length push %si # Save ff.namelen: inc %cl # Update length lodsb # Read char cmp $0,%al # Nul? je ff.namedone # Yes cmp $'/',%al # Path separator? jnz ff.namelen # No, keep going ff.namedone: dec %cl # Adjust length and save mov %cl,name_len pop %si # Restore ff.load: mov rec_lba,%eax # Load LBA mov $MEM_DIR,%ebx # Address buffer mov $1,%dh # One sector call read # Read directory block incl rec_lba # Update LBA to next block ff.scan: mov %ebx,%edx # Check for EOF sub $MEM_DIR,%edx cmp %edx,rec_size ja ff.scan.1 stc # EOF reached ret ff.scan.1: cmpb $0,DIR_LEN(%bx) # Last record in block? je ff.nextblock push %si # Save movzbw DIR_NAMELEN(%bx),%si # Find end of string ff.checkver: cmpb $'0',DIR_NAME-1(%bx,%si) # Less than '0'? jb ff.checkver.1 cmpb $'9',DIR_NAME-1(%bx,%si) # Greater than '9'? ja ff.checkver.1 dec %si # Next char jnz ff.checkver jmp ff.checklen # All numbers in name, so # no version ff.checkver.1: movzbw DIR_NAMELEN(%bx),%cx cmp %cx,%si # Did we find any digits? je ff.checkdot # No cmpb $';',DIR_NAME-1(%bx,%si) # Check for semicolon jne ff.checkver.2 dec %si # Skip semicolon mov %si,%cx mov %cl,DIR_NAMELEN(%bx) # Adjust length jmp ff.checkdot ff.checkver.2: mov %cx,%si # Restore %si to end of string ff.checkdot: cmpb $'.',DIR_NAME-1(%bx,%si) # Trailing dot? jne ff.checklen # No decb DIR_NAMELEN(%bx) # Adjust length ff.checklen: pop %si # Restore movzbw name_len,%cx # Load length of name cmp %cl,DIR_NAMELEN(%bx) # Does length match? je ff.checkname # Yes, check name ff.nextrec: add DIR_LEN(%bx),%bl # Next record adc $0,%bh jmp ff.scan ff.nextblock: subl $SECTOR_SIZE,rec_size # Adjust size jnc ff.load # If subtract ok, keep going ret # End of file, so not found ff.checkname: lea DIR_NAME(%bx),%di # Address name in record push %si # Save repe cmpsb # Compare name je ff.match # We have a winner! pop %si # Restore jmp ff.nextrec # Keep looking. ff.match: add $2,%sp # Discard saved %si clc # Clear carry ret # # Load DH sectors starting at LBA EAX into [EBX]. # # Trashes: EAX # read: push %si # Save push %cx # Save since some BIOSs trash mov %eax,edd_lba # LBA to read from mov %ebx,%eax # Convert address shr $4,%eax # to segment mov %ax,edd_addr+0x2 # and store read.retry: call twiddle # Entertain the user push %dx # Save mov $edd_packet,%si # Address Packet mov %dh,edd_len # Set length mov drive,%dl # BIOS Device mov $0x42,%ah # BIOS: Extended Read int $0x13 # Call BIOS pop %dx # Restore jc read.fail # Worked? pop %cx # Restore pop %si ret # Return read.fail: cmp $ERROR_TIMEOUT,%ah # Timeout? je read.retry # Yes, Retry. read.error: mov %ah,%al # Save error mov $hex_error,%di # Format it call hex8 # as hex mov $msg_badread,%si # Display Read error message # # Display error message at [SI] and halt. # error: call putstr # Display message halt: hlt jmp halt # Spin # # Display a null-terminated string. # # Trashes: AX, SI # putstr: push %bx # Save putstr.load: lodsb # load %al from %ds:(%si) test %al,%al # stop at null jnz putstr.putc # if the char != null, output it pop %bx # Restore ret # return when null is hit putstr.putc: call putc # output char jmp putstr.load # next char # # Display a single char. # putc: mov $0x7,%bx # attribute for output mov $0xe,%ah # BIOS: put_char int $0x10 # call BIOS, print char in %al ret # Return to caller # # Output the "twiddle" # twiddle: push %ax # Save push %bx # Save mov twiddle_index,%al # Load index mov $twiddle_chars,%bx # Address table inc %al # Next and $3,%al # char mov %al,twiddle_index # Save index for next call xlat # Get char call putc # Output it mov $8,%al # Backspace call putc # Output it pop %bx # Restore pop %ax # Restore ret # # Enable A20. Put an upper limit on the amount of time we wait for the # keyboard controller to get ready (65K x ISA access time). If # we wait more than that amount, the hardware is probably # legacy-free and simply doesn't have a keyboard controller. # Thus, the A20 line is already enabled. # seta20: cli # Disable interrupts xor %cx,%cx # Clear seta20.1: inc %cx # Increment, overflow? jz seta20.3 # Yes in $0x64,%al # Get status test $0x2,%al # Busy? jnz seta20.1 # Yes mov $0xd1,%al # Command: Write out %al,$0x64 # output port seta20.2: in $0x64,%al # Get status test $0x2,%al # Busy? jnz seta20.2 # Yes mov $0xdf,%al # Enable out %al,$0x60 # A20 seta20.3: sti # Enable interrupts ret # To caller # # Convert AL to hex, saving the result to [EDI]. # hex8: pushl %eax # Save shrb $0x4,%al # Do upper call hex8.1 # 4 popl %eax # Restore hex8.1: andb $0xf,%al # Get lower 4 cmpb $0xa,%al # Convert sbbb $0x69,%al # to hex das # digit orb $0x20,%al # To lower case stosb # Save char ret # (Recursive) # # BTX client to start btxldr # .code32 btx_client: mov $(MEM_ARG_BTX-MEM_BTX_CLIENT+MEM_ARG_SIZE-4), %esi # %ds:(%esi) -> end # of boot[12] args mov $(MEM_ARG_SIZE/4),%ecx # Number of words to push std # Go backwards push_arg: lodsl # Read argument push %eax # Push it onto the stack loop push_arg # Push all of the arguments cld # In case anyone depends on this pushl MEM_ARG_BTX-MEM_BTX_CLIENT+MEM_ARG_SIZE # Entry point of # the loader push %eax # Emulate a near call mov $0x1,%eax # 'exec' system call int $INT_SYS # BTX system call btx_client_end: .code16 .p2align 4 # # Global descriptor table. # gdt: .word 0x0,0x0,0x0,0x0 # Null entry .word 0xffff,0x0,0x9200,0xcf # SEL_SDATA .word 0xffff,0x0,0x9200,0x0 # SEL_RDATA .word 0xffff,0x0,0x9a00,0xcf # SEL_SCODE (32-bit) .word 0xffff,0x0,0x9a00,0x8f # SEL_SCODE16 (16-bit) gdt.1: # # Pseudo-descriptors. # gdtdesc: .word gdt.1-gdt-1 # Limit .long gdt # Base # # EDD Packet # edd_packet: .byte 0x10 # Length .byte 0 # Reserved edd_len: .byte 0x0 # Num to read .byte 0 # Reserved edd_addr: .word 0x0,0x0 # Seg:Off edd_lba: .quad 0x0 # LBA drive: .byte 0 # # State for searching dir # rec_lba: .long 0x0 # LBA (adjusted for EA) rec_size: .long 0x0 # File size name_len: .byte 0x0 # Length of current name twiddle_index: .byte 0x0 msg_welcome: .asciz "CD Loader 1.2\r\n\n" msg_bootinfo: .asciz "Building the boot loader arguments\r\n" msg_relocate: .asciz "Relocating the loader and the BTX\r\n" msg_jump: .asciz "Starting the BTX loader\r\n" msg_badread: .ascii "Read Error: 0x" hex_error: .asciz "00\r\n" msg_novd: .asciz "Could not find Primary Volume Descriptor\r\n" msg_lookup: .asciz "Looking up " msg_lookup2: .asciz "... " msg_lookupok: .asciz "Found\r\n" msg_lookupfail: .asciz "File not found\r\n" msg_load2big: .asciz "File too big\r\n" msg_failed: .asciz "Boot failed\r\n" twiddle_chars: .ascii "|/-\\" loader_paths: .asciz "/BOOT/LOADER" .asciz "/boot/loader" .byte 0