1/*
2 * Copyright (c) 2000 John Baldwin
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms are freely
6 * permitted provided that the above copyright notice and this
7 * paragraph and the following disclaimer are duplicated in all
8 * such forms.
9 *
10 * This software is provided "AS IS" and without any express or
11 * implied warranties, including, without limitation, the implied
12 * warranties of merchantability and fitness for a particular
13 * purpose.
14 *
15 * $FreeBSD: head/sys/boot/i386/pxeldr/pxeldr.S 129240 2004-05-14 20:29:30Z ru $
16 */
17
18/*
19 * This simple program is a preloader for the normal boot3 loader. It is simply
20 * prepended to the beginning of a fully built and btxld'd loader. It then
21 * copies the loader to the address boot2 normally loads it, emulates the
22 * boot[12] environment (protected mode, a bootinfo struct, etc.), and then jumps
23 * to the start of btxldr to start the boot process. This method allows a stock
24 * /boot/loader to be booted over the network via PXE w/o having to write a
25 * separate PXE-aware client just to load the loader.
26 */
27
28/*
29 * Memory locations.
30 */
31 .set MEM_PAGE_SIZE,0x1000 # memory page size, 4k
32 .set MEM_ARG,0x900 # Arguments at start
33 .set MEM_ARG_BTX,0xa100 # Where we move them to so the
34 # BTX client can see them
35 .set MEM_ARG_SIZE,0x18 # Size of the arguments
36 .set MEM_BTX_ADDRESS,0x9000 # where BTX lives
37 .set MEM_BTX_ENTRY,0x9010 # where BTX starts to execute
38 .set MEM_BTX_OFFSET,MEM_PAGE_SIZE # offset of BTX in the loader
39 .set MEM_BTX_CLIENT,0xa000 # where BTX clients live
40 .set MEM_BIOS_KEYBOARD,0x496 # BDA byte with keyboard bit
41/*
42 * a.out header fields
43 */
44 .set AOUT_TEXT,0x04 # text segment size
45 .set AOUT_DATA,0x08 # data segment size
46 .set AOUT_BSS,0x0c # zero'd BSS size
47 .set AOUT_SYMBOLS,0x10 # symbol table
48 .set AOUT_ENTRY,0x14 # entry point
49 .set AOUT_HEADER,MEM_PAGE_SIZE # size of the a.out header
50/*
51 * Flags for kargs->bootflags
52 */
53 .set KARGS_FLAGS_PXE,0x2 # flag to indicate booting from
54 # PXE loader
55/*
56 * Boot howto bits
57 */
58 .set RB_SERIAL,0x1000 # serial console
59/*
60 * Segment selectors.
61 */
62 .set SEL_SDATA,0x8 # Supervisor data
63 .set SEL_RDATA,0x10 # Real mode data
64 .set SEL_SCODE,0x18 # PM-32 code
65 .set SEL_SCODE16,0x20 # PM-16 code
66/*
67 * BTX constants
68 */
69 .set INT_SYS,0x30 # BTX syscall interrupt
70/*
71 * Bit in MEM_BIOS_KEYBOARD that is set if an enhanced keyboard is present
72 */
73 .set KEYBOARD_BIT,0x10
74/*
75 * We expect to be loaded by the BIOS at 0x7c00 (standard boot loader entry
76 * point)
77 */
78 .code16
79 .globl start
80 .org 0x0, 0x0
81/*
82 * BTX program loader for PXE network booting
83 */
84start: cld # string ops inc
85 xorw %ax, %ax # zero %ax
86 movw %ax, %ss # setup the
87 movw $start, %sp # stack
88 movw %es, %cx # save PXENV+ segment
89 movw %ax, %ds # setup the
90 movw %ax, %es # data segments
91 andl $0xffff, %ecx # clear upper words
92 andl $0xffff, %ebx # of %ebx and %ecx
93 shll $4, %ecx # calculate the offset of
94 addl %ebx, %ecx # the PXENV+ struct and
95 pushl %ecx # save it on the stack
96 movw $welcome_msg, %si # %ds:(%si) -> welcome message
97 callw putstr # display the welcome message
98/*
99 * Setup the arguments that the loader is expecting from boot[12]
100 */
101 movw $bootinfo_msg, %si # %ds:(%si) -> boot args message
102 callw putstr # display the message
103 movw $MEM_ARG, %bx # %ds:(%bx) -> boot args
104 movw %bx, %di # %es:(%di) -> boot args
105 xorl %eax, %eax # zero %eax
106 movw $(MEM_ARG_SIZE/4), %cx # Size of arguments in 32-bit
107 # dwords
108 rep # Clear the arguments
109 stosl # to zero
110 orb $KARGS_FLAGS_PXE, 0x8(%bx) # kargs->bootflags |=
111 # KARGS_FLAGS_PXE
112 popl 0xc(%bx) # kargs->pxeinfo = *PXENV+
113#ifdef ALWAYS_SERIAL
114/*
115 * set the RBX_SERIAL bit in the howto byte.
116 */
117 orl $RB_SERIAL, (%bx) # enable serial console
118#endif
119#ifdef PROBE_KEYBOARD
120/*
121 * Look at the BIOS data area to see if we have an enhanced keyboard. If not,
122 * set the RBX_SERIAL bit in the howto byte.
123 */
124 testb $KEYBOARD_BIT, MEM_BIOS_KEYBOARD # keyboard present?
125 jnz keyb # yes, so skip
126 orl $RB_SERIAL, (%bx) # enable serial console
127keyb:
128#endif
129/*
130 * Turn on the A20 address line
131 */
132 callw seta20 # Turn A20 on
133/*
134 * Relocate the loader and BTX using a very lazy protected mode
135 */
136 movw $relocate_msg, %si # Display the
137 callw putstr # relocation message
138 movl end+AOUT_ENTRY, %edi # %edi is the destination
139 movl $(end+AOUT_HEADER), %esi # %esi is
140 # the start of the text
141 # segment
142 movl end+AOUT_TEXT, %ecx # %ecx = length of the text
143 # segment
144 lgdt gdtdesc # setup our own gdt
145 cli # turn off interrupts
146 movl %cr0, %eax # Turn on
147 orb $0x1, %al # protected
148 movl %eax, %cr0 # mode
149 ljmp $SEL_SCODE,$pm_start # long jump to clear the
150 # instruction pre-fetch queue
151 .code32
152pm_start: movw $SEL_SDATA, %ax # Initialize
153 movw %ax, %ds # %ds and
154 movw %ax, %es # %es to a flat selector
155 rep # Relocate the
156 movsb # text segment
157 addl $(MEM_PAGE_SIZE - 1), %edi # pad %edi out to a new page
158 andl $~(MEM_PAGE_SIZE - 1), %edi # for the data segment
159 movl end+AOUT_DATA, %ecx # size of the data segment
160 rep # Relocate the
161 movsb # data segment
162 movl end+AOUT_BSS, %ecx # size of the bss
163 xorl %eax, %eax # zero %eax
164 addb $3, %cl # round %ecx up to
165 shrl $2, %ecx # a multiple of 4
166 rep # zero the
167 stosl # bss
168 movl end+AOUT_ENTRY, %esi # %esi -> relocated loader
169 addl $MEM_BTX_OFFSET, %esi # %esi -> BTX in the loader
170 movl $MEM_BTX_ADDRESS, %edi # %edi -> where BTX needs to go
171 movzwl 0xa(%esi), %ecx # %ecx -> length of BTX
172 rep # Relocate
173 movsb # BTX
174 ljmp $SEL_SCODE16,$pm_16 # Jump to 16-bit PM
175 .code16
176pm_16: movw $SEL_RDATA, %ax # Initialize
177 movw %ax, %ds # %ds and
178 movw %ax, %es # %es to a real mode selector
179 movl %cr0, %eax # Turn off
180 andb $~0x1, %al # protected
181 movl %eax, %cr0 # mode
182 ljmp $0,$pm_end # Long jump to clear the
183 # instruction pre-fetch queue
184pm_end: sti # Turn interrupts back on now
185/*
186 * Copy the BTX client to MEM_BTX_CLIENT
187 */
188 xorw %ax, %ax # zero %ax and set
189 movw %ax, %ds # %ds and %es
190 movw %ax, %es # to segment 0
191 movw $MEM_BTX_CLIENT, %di # Prepare to relocate
192 movw $btx_client, %si # the simple btx client
193 movw $(btx_client_end-btx_client), %cx # length of btx client
194 rep # Relocate the
195 movsb # simple BTX client
196/*
197 * Copy the boot[12] args to where the BTX client can see them
198 */
199 movw $MEM_ARG, %si # where the args are at now
200 movw $MEM_ARG_BTX, %di # where the args are moving to
201 movw $(MEM_ARG_SIZE/4), %cx # size of the arguments in longs
202 rep # Relocate
203 movsl # the words
204/*
205 * Save the entry point so the client can get to it later on
206 */
207 movl end+AOUT_ENTRY, %eax # load the entry point
208 stosl # add it to the end of the
209 # arguments
210/*
211 * Now we just start up BTX and let it do the rest
212 */
213 movw $jump_message, %si # Display the
214 callw putstr # jump message
215 ljmp $0,$MEM_BTX_ENTRY # Jump to the BTX entry point
216
217/*
218 * Display a null-terminated string
219 */
220putstr: lodsb # load %al from %ds:(%si)
221 testb %al,%al # stop at null
222 jnz putc # if the char != null, output it
223 retw # return when null is hit
224putc: movw $0x7,%bx # attribute for output
225 movb $0xe,%ah # BIOS: put_char
226 int $0x10 # call BIOS, print char in %al
227 jmp putstr # keep looping
228
229/*
230 * Enable A20
231 */
232seta20: cli # Disable interrupts
233seta20.1: inb $0x64,%al # Get status
234 testb $0x2,%al # Busy?
235 jnz seta20.1 # Yes
236 movb $0xd1,%al # Command: Write
237 outb %al,$0x64 # output port
238seta20.2: inb $0x64,%al # Get status
239 testb $0x2,%al # Busy?
240 jnz seta20.2 # Yes
241 movb $0xdf,%al # Enable
242 outb %al,$0x60 # A20
243 sti # Enable interrupts
244 retw # To caller
245
246/*
247 * BTX client to start btxldr
248 */
249 .code32
250btx_client: movl $(MEM_ARG_BTX-MEM_BTX_CLIENT+MEM_ARG_SIZE-4), %esi
251 # %ds:(%esi) -> end
252 # of boot[12] args
253 movl $(MEM_ARG_SIZE/4), %ecx # Number of words to push
254 std # Go backwards
255push_arg: lodsl # Read argument
256 pushl %eax # Push it onto the stack
257 loop push_arg # Push all of the arguments
258 cld # In case anyone depends on this
259 pushl MEM_ARG_BTX-MEM_BTX_CLIENT+MEM_ARG_SIZE # Entry point of
260 # the loader
261 pushl %eax # Emulate a near call
262 movl $0x1, %eax # 'exec' system call
263 int $INT_SYS # BTX system call
264btx_client_end:
265 .code16
266
267 .p2align 4
268/*
269 * Global descriptor table.
270 */
271gdt: .word 0x0,0x0,0x0,0x0 # Null entry
272 .word 0xffff,0x0,0x9200,0xcf # SEL_SDATA
273 .word 0xffff,0x0,0x9200,0x0 # SEL_RDATA
274 .word 0xffff,0x0,0x9a00,0xcf # SEL_SCODE (32-bit)
275 .word 0xffff,0x0,0x9a00,0x8f # SEL_SCODE16 (16-bit)
276gdt.1:
277/*
278 * Pseudo-descriptors.
279 */
280gdtdesc: .word gdt.1-gdt-1 # Limit
281 .long gdt # Base
282
283welcome_msg: .asciz "PXE Loader 1.00\r\n\n"
284bootinfo_msg: .asciz "Building the boot loader arguments\r\n"
285relocate_msg: .asciz "Relocating the loader and the BTX\r\n"
286jump_message: .asciz "Starting the BTX loader\r\n"
287
288 .p2align 4
289end:
2 * Copyright (c) 2000 John Baldwin
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms are freely
6 * permitted provided that the above copyright notice and this
7 * paragraph and the following disclaimer are duplicated in all
8 * such forms.
9 *
10 * This software is provided "AS IS" and without any express or
11 * implied warranties, including, without limitation, the implied
12 * warranties of merchantability and fitness for a particular
13 * purpose.
14 *
15 * $FreeBSD: head/sys/boot/i386/pxeldr/pxeldr.S 129240 2004-05-14 20:29:30Z ru $
16 */
17
18/*
19 * This simple program is a preloader for the normal boot3 loader. It is simply
20 * prepended to the beginning of a fully built and btxld'd loader. It then
21 * copies the loader to the address boot2 normally loads it, emulates the
22 * boot[12] environment (protected mode, a bootinfo struct, etc.), and then jumps
23 * to the start of btxldr to start the boot process. This method allows a stock
24 * /boot/loader to be booted over the network via PXE w/o having to write a
25 * separate PXE-aware client just to load the loader.
26 */
27
28/*
29 * Memory locations.
30 */
31 .set MEM_PAGE_SIZE,0x1000 # memory page size, 4k
32 .set MEM_ARG,0x900 # Arguments at start
33 .set MEM_ARG_BTX,0xa100 # Where we move them to so the
34 # BTX client can see them
35 .set MEM_ARG_SIZE,0x18 # Size of the arguments
36 .set MEM_BTX_ADDRESS,0x9000 # where BTX lives
37 .set MEM_BTX_ENTRY,0x9010 # where BTX starts to execute
38 .set MEM_BTX_OFFSET,MEM_PAGE_SIZE # offset of BTX in the loader
39 .set MEM_BTX_CLIENT,0xa000 # where BTX clients live
40 .set MEM_BIOS_KEYBOARD,0x496 # BDA byte with keyboard bit
41/*
42 * a.out header fields
43 */
44 .set AOUT_TEXT,0x04 # text segment size
45 .set AOUT_DATA,0x08 # data segment size
46 .set AOUT_BSS,0x0c # zero'd BSS size
47 .set AOUT_SYMBOLS,0x10 # symbol table
48 .set AOUT_ENTRY,0x14 # entry point
49 .set AOUT_HEADER,MEM_PAGE_SIZE # size of the a.out header
50/*
51 * Flags for kargs->bootflags
52 */
53 .set KARGS_FLAGS_PXE,0x2 # flag to indicate booting from
54 # PXE loader
55/*
56 * Boot howto bits
57 */
58 .set RB_SERIAL,0x1000 # serial console
59/*
60 * Segment selectors.
61 */
62 .set SEL_SDATA,0x8 # Supervisor data
63 .set SEL_RDATA,0x10 # Real mode data
64 .set SEL_SCODE,0x18 # PM-32 code
65 .set SEL_SCODE16,0x20 # PM-16 code
66/*
67 * BTX constants
68 */
69 .set INT_SYS,0x30 # BTX syscall interrupt
70/*
71 * Bit in MEM_BIOS_KEYBOARD that is set if an enhanced keyboard is present
72 */
73 .set KEYBOARD_BIT,0x10
74/*
75 * We expect to be loaded by the BIOS at 0x7c00 (standard boot loader entry
76 * point)
77 */
78 .code16
79 .globl start
80 .org 0x0, 0x0
81/*
82 * BTX program loader for PXE network booting
83 */
84start: cld # string ops inc
85 xorw %ax, %ax # zero %ax
86 movw %ax, %ss # setup the
87 movw $start, %sp # stack
88 movw %es, %cx # save PXENV+ segment
89 movw %ax, %ds # setup the
90 movw %ax, %es # data segments
91 andl $0xffff, %ecx # clear upper words
92 andl $0xffff, %ebx # of %ebx and %ecx
93 shll $4, %ecx # calculate the offset of
94 addl %ebx, %ecx # the PXENV+ struct and
95 pushl %ecx # save it on the stack
96 movw $welcome_msg, %si # %ds:(%si) -> welcome message
97 callw putstr # display the welcome message
98/*
99 * Setup the arguments that the loader is expecting from boot[12]
100 */
101 movw $bootinfo_msg, %si # %ds:(%si) -> boot args message
102 callw putstr # display the message
103 movw $MEM_ARG, %bx # %ds:(%bx) -> boot args
104 movw %bx, %di # %es:(%di) -> boot args
105 xorl %eax, %eax # zero %eax
106 movw $(MEM_ARG_SIZE/4), %cx # Size of arguments in 32-bit
107 # dwords
108 rep # Clear the arguments
109 stosl # to zero
110 orb $KARGS_FLAGS_PXE, 0x8(%bx) # kargs->bootflags |=
111 # KARGS_FLAGS_PXE
112 popl 0xc(%bx) # kargs->pxeinfo = *PXENV+
113#ifdef ALWAYS_SERIAL
114/*
115 * set the RBX_SERIAL bit in the howto byte.
116 */
117 orl $RB_SERIAL, (%bx) # enable serial console
118#endif
119#ifdef PROBE_KEYBOARD
120/*
121 * Look at the BIOS data area to see if we have an enhanced keyboard. If not,
122 * set the RBX_SERIAL bit in the howto byte.
123 */
124 testb $KEYBOARD_BIT, MEM_BIOS_KEYBOARD # keyboard present?
125 jnz keyb # yes, so skip
126 orl $RB_SERIAL, (%bx) # enable serial console
127keyb:
128#endif
129/*
130 * Turn on the A20 address line
131 */
132 callw seta20 # Turn A20 on
133/*
134 * Relocate the loader and BTX using a very lazy protected mode
135 */
136 movw $relocate_msg, %si # Display the
137 callw putstr # relocation message
138 movl end+AOUT_ENTRY, %edi # %edi is the destination
139 movl $(end+AOUT_HEADER), %esi # %esi is
140 # the start of the text
141 # segment
142 movl end+AOUT_TEXT, %ecx # %ecx = length of the text
143 # segment
144 lgdt gdtdesc # setup our own gdt
145 cli # turn off interrupts
146 movl %cr0, %eax # Turn on
147 orb $0x1, %al # protected
148 movl %eax, %cr0 # mode
149 ljmp $SEL_SCODE,$pm_start # long jump to clear the
150 # instruction pre-fetch queue
151 .code32
152pm_start: movw $SEL_SDATA, %ax # Initialize
153 movw %ax, %ds # %ds and
154 movw %ax, %es # %es to a flat selector
155 rep # Relocate the
156 movsb # text segment
157 addl $(MEM_PAGE_SIZE - 1), %edi # pad %edi out to a new page
158 andl $~(MEM_PAGE_SIZE - 1), %edi # for the data segment
159 movl end+AOUT_DATA, %ecx # size of the data segment
160 rep # Relocate the
161 movsb # data segment
162 movl end+AOUT_BSS, %ecx # size of the bss
163 xorl %eax, %eax # zero %eax
164 addb $3, %cl # round %ecx up to
165 shrl $2, %ecx # a multiple of 4
166 rep # zero the
167 stosl # bss
168 movl end+AOUT_ENTRY, %esi # %esi -> relocated loader
169 addl $MEM_BTX_OFFSET, %esi # %esi -> BTX in the loader
170 movl $MEM_BTX_ADDRESS, %edi # %edi -> where BTX needs to go
171 movzwl 0xa(%esi), %ecx # %ecx -> length of BTX
172 rep # Relocate
173 movsb # BTX
174 ljmp $SEL_SCODE16,$pm_16 # Jump to 16-bit PM
175 .code16
176pm_16: movw $SEL_RDATA, %ax # Initialize
177 movw %ax, %ds # %ds and
178 movw %ax, %es # %es to a real mode selector
179 movl %cr0, %eax # Turn off
180 andb $~0x1, %al # protected
181 movl %eax, %cr0 # mode
182 ljmp $0,$pm_end # Long jump to clear the
183 # instruction pre-fetch queue
184pm_end: sti # Turn interrupts back on now
185/*
186 * Copy the BTX client to MEM_BTX_CLIENT
187 */
188 xorw %ax, %ax # zero %ax and set
189 movw %ax, %ds # %ds and %es
190 movw %ax, %es # to segment 0
191 movw $MEM_BTX_CLIENT, %di # Prepare to relocate
192 movw $btx_client, %si # the simple btx client
193 movw $(btx_client_end-btx_client), %cx # length of btx client
194 rep # Relocate the
195 movsb # simple BTX client
196/*
197 * Copy the boot[12] args to where the BTX client can see them
198 */
199 movw $MEM_ARG, %si # where the args are at now
200 movw $MEM_ARG_BTX, %di # where the args are moving to
201 movw $(MEM_ARG_SIZE/4), %cx # size of the arguments in longs
202 rep # Relocate
203 movsl # the words
204/*
205 * Save the entry point so the client can get to it later on
206 */
207 movl end+AOUT_ENTRY, %eax # load the entry point
208 stosl # add it to the end of the
209 # arguments
210/*
211 * Now we just start up BTX and let it do the rest
212 */
213 movw $jump_message, %si # Display the
214 callw putstr # jump message
215 ljmp $0,$MEM_BTX_ENTRY # Jump to the BTX entry point
216
217/*
218 * Display a null-terminated string
219 */
220putstr: lodsb # load %al from %ds:(%si)
221 testb %al,%al # stop at null
222 jnz putc # if the char != null, output it
223 retw # return when null is hit
224putc: movw $0x7,%bx # attribute for output
225 movb $0xe,%ah # BIOS: put_char
226 int $0x10 # call BIOS, print char in %al
227 jmp putstr # keep looping
228
229/*
230 * Enable A20
231 */
232seta20: cli # Disable interrupts
233seta20.1: inb $0x64,%al # Get status
234 testb $0x2,%al # Busy?
235 jnz seta20.1 # Yes
236 movb $0xd1,%al # Command: Write
237 outb %al,$0x64 # output port
238seta20.2: inb $0x64,%al # Get status
239 testb $0x2,%al # Busy?
240 jnz seta20.2 # Yes
241 movb $0xdf,%al # Enable
242 outb %al,$0x60 # A20
243 sti # Enable interrupts
244 retw # To caller
245
246/*
247 * BTX client to start btxldr
248 */
249 .code32
250btx_client: movl $(MEM_ARG_BTX-MEM_BTX_CLIENT+MEM_ARG_SIZE-4), %esi
251 # %ds:(%esi) -> end
252 # of boot[12] args
253 movl $(MEM_ARG_SIZE/4), %ecx # Number of words to push
254 std # Go backwards
255push_arg: lodsl # Read argument
256 pushl %eax # Push it onto the stack
257 loop push_arg # Push all of the arguments
258 cld # In case anyone depends on this
259 pushl MEM_ARG_BTX-MEM_BTX_CLIENT+MEM_ARG_SIZE # Entry point of
260 # the loader
261 pushl %eax # Emulate a near call
262 movl $0x1, %eax # 'exec' system call
263 int $INT_SYS # BTX system call
264btx_client_end:
265 .code16
266
267 .p2align 4
268/*
269 * Global descriptor table.
270 */
271gdt: .word 0x0,0x0,0x0,0x0 # Null entry
272 .word 0xffff,0x0,0x9200,0xcf # SEL_SDATA
273 .word 0xffff,0x0,0x9200,0x0 # SEL_RDATA
274 .word 0xffff,0x0,0x9a00,0xcf # SEL_SCODE (32-bit)
275 .word 0xffff,0x0,0x9a00,0x8f # SEL_SCODE16 (16-bit)
276gdt.1:
277/*
278 * Pseudo-descriptors.
279 */
280gdtdesc: .word gdt.1-gdt-1 # Limit
281 .long gdt # Base
282
283welcome_msg: .asciz "PXE Loader 1.00\r\n\n"
284bootinfo_msg: .asciz "Building the boot loader arguments\r\n"
285relocate_msg: .asciz "Relocating the loader and the BTX\r\n"
286jump_message: .asciz "Starting the BTX loader\r\n"
287
288 .p2align 4
289end: