1. 1. Stage-1 Bootloader
ENGI 3655 Lab Sessions
Richard Khoury

2. Textbook Readings System Boot Boot Block Magnetic Disks Disk Structure
Section 2.10
Boot Block
Section
Magnetic Disks
Section
Disk Structure
Section 10.2
Richard Khoury

3. Typical User View Press power button Wait Log on to Windows
Richard Khoury

4. What Actually Happens Press power button BIOS executes
Bootloader executes
Kernel executes
Log on to Windows
Richard Khoury

5. BIOS First OS that runs when the computer starts
But programs can only be run in memory
And the BIOS has to run at start-up!
Nothing in memory
No other programs to load it in memory
How?
Richard Khoury

6. BIOS The BIOS is in a special hardware ROM
At the beginning of the boot sequence, the CPU automatically runs the first ROM instruction
Fixed, so the CPU always knows where it is
The first instruction is to start executing the BIOS
Richard Khoury

7. BIOS In charge of the next steps of the boot sequence
Step 1: Power-On Self-Test (POST)
Check that the BIOS is ok
Check main memory for corruption (memory test)
Detect, initialize each device, and make sure they have the right supply of power
Setup the interrupt vector
Beep: once for ok, other combinations for errors
Richard Khoury

8. BIOS Step 2: Look for bootable device
After POST, BIOS has a list of non-volatile storage devices
The Boot Device Sequence
Check each one until it finds a bootable one
The BIOS checks the first sector of each device (the “boot sector”)
Looking for a valid one
The first one found is executed
If none is found, an error message is returned
Richard Khoury

9. BIOS Step 3: Load and Execute
Once a device with a valid boot sector is found
BIOS loads the entire sector into memory at address 0000:7C00
Then instructs the CPU to start executing it
Richard Khoury

10. Boot Sector The first sector of a storage device
Head 0, Cylinder 0, Sector 1, because no sector 0
Exactly 512 bytes long
Ends with the boot sector signature
Two-byte hex word 0xAA55
That’s what the BIOS looks for to check if it’s valid
Name
If the device is partitioned, this sector is the Master Boot Record (MBR)
If the device is not partitioned, this sector is the Volume Boot Record (VBR)
The BIOS does not distinguish between the two
Richard Khoury

11. Boot Sector The program it contains is the bootloader
Sometimes called bootstrap loader
Written in Assembly
Its purpose is to load the operating system’s kernel into memory
The kernel will continue the boot sequence from there
Richard Khoury

12. Boot Sequence Summary Power On CPU starts executing BIOS from ROM
BIOS executes POST
BIOS looks through the bootable device sequence for one with a valid boot sector
BIOS loads the first bootloader found into memory and CPU starts executing it
Bootloader loads the kernel into memory and CPU starts executing it
Kernel loads the rest of the OS, as needed
Richard Khoury

13. Today’s Lab We can’t do anything about the BIOS
Nor would we want to – it’s standard on every computer and works quite well
So we will start with the bootloader
For this lab, we will need
A text editor
Notepad works, some people also like Programmer’s Notepad or Notepad++
NASM
Netwide Assembler, the most popular 80x86 assembler DD
Unix utility that copies raw data from one place to another directly
The command prompt
We’re going old-school!
Richard Khoury

14. Bootloader Fundamentals
The first thing our bootloader will need is an infinite loop
JMP $
JMP is an unconditional jump
$ represents the current address
So this command makes the program jump in place
This will be part of all our operating systems
Richard Khoury

15. Bootloader Fundamentals
The bootloader must also finish with the boot sector signature
DW 0xAA55
DW: Define Word
We have some constraints to respect!
The signature has to be the last two bytes of the block
The block has to be exactly 512 bytes in size
So this word must start at bytes 510
But our bootloader will be too small
Richard Khoury

16. Bootloader Fundamentals
Solution: fill it up with zeros
TIMES ($ - $$) db 0
DB: Define Byte
$$ is the starting address of the program
($ - $$) is the size of the program
510 – (size of program) is what is missing to for our program to be exactly 510 bytes
So this command will define zeros for the number of times needed to fill up the block
Richard Khoury

17. Bootloader Char Display
Say we want to display will display a single character on screen
The letter A, ASCII character 65 in decimal
To do this, we will need to access the video card
The BIOS already set up the interrupt vector for us
Interrupt 10h is the BIOS video interrupt
INT 0x10
It defines a set of video functions
Richard Khoury

18. Interrupt 10h How does it work? Read the documentation
Ralf Brown’s Interrupt List, revision 61, HTML version:
Documents every interrupt from 1981 to 2000, including otherwise undocumented features and bugs
Richard Khoury

19. Interrupt 10h In a nutshell (so we can go on with the lab)
BIOS interrupts cover a large set of functions
Int 10h is for “video services”
Programmers specify which function and pass parameters in CPU registers
Function to perform is always in AH register for basic BIOS functions
Sometimes in AX register for proprietary functions of specific hardware
The other registers vary depending on the function
Some functions also return values in registers and CPU flags
Richard Khoury

20. Interrupt 10h AH=0Eh Write to screen in teletype mode Input: Returns:
AL = ASCII value of character to write
BH = Page Number (zero is the standard)
BL = Text Attribute (in graphics mode only, which is not our case)
Returns:
Nothing
Richard Khoury

21. Bootloader Char Display
Let’s set up the registers then call the interrupt
MOV AH, 0x0E
MOV AL, 65
MOV BH, 0x00
INT 0x10
Richard Khoury

22. Bootloader Char Display
We’ll put the display in a procedure
PrintCharacter:
MOV AH, 0x0E
MOV AL, 65
MOV BH, 0x00
INT 0x10
RET
And call it from the main bootloader code
CALL PrintCharacter
Richard Khoury

23. Bootloader String Display
Displaying more than just the letter A might be useful
We could create a “PrintCharacter” function for each letter and symbol
But that would be dumb
A better option is to create a function to break a string into characters and call the “PrintCharacter” function for each one
Richard Khoury

24. Bootloader String Display
Assembly’s “load string byte” command
LODSB
So we can define any string as bytes
HelloString db 'Hello World',10,13,0
Characters 0, 10 and 13 are “null”, “new line”, and “carriage return”
Null-terminated string
This gives us an easy comparison test to know when we’re at the end of the string (since null won’t come up otherwise in a regular string)
Richard Khoury

25. Lab Assignment – Part 1 Research the LODSB command
Write the “PrintString” function
Richard Khoury

26. %include "PrintScreen.inc"
We can use include files in our code
We could put our “PrintCharacter” and “PrintString” functions in an included file, so we won’t have to write them again later
%include "PrintScreen.inc"
The “%” directive includes the entire content of the external file as plain ascii directly in your program
Richard Khoury

27. PrintScreen.inc
Much like in C/C++, we want our included file to be included only once
Otherwise, having the lines
%include "PrintScreen.inc"
would include the same functions twice, and that would be bad
We can use the same technique to do this as in C/C++: define a flag and check for it
%ifndef _PRINTSCREEN_INC_
%define _PRINTSCREEN_INC_
(content of file)
%endif ;_PRINTSCREEN_INC_
Richard Khoury

28. Loading Other Programs
The bootloader’s purpose is to load the kernel
However, there is far too much to do to load the kernel for it to be written in 512 bytes
But 512 bytes is the maximum size our bootloader can have
What to do?
Richard Khoury

29. Loading Other Programs
Our bootloader will load another bootloader, which will load the kernel
This makes it a multi-stage bootloader
Stage 1: executing the code in the boot sector, which loads the stage-2 bootloader
Stage 2: executing the code of the second-stage bootloader, which gets everything done and loads the kernel
Richard Khoury

30. Loading Other Programs
Eventually, our second-stage bootloader will perform several functions and load an OS Kernel
But we haven’t learned those yet, and we do not have a Kernel yet
So we will load a simple Hello World program instead
It will also include our infinite loop
Richard Khoury

31. Loading Other Programs
The stage-2 bootloader will not be part of the boot sector
Will not be loaded into memory by the BIOS
Our bootloader will need to read the sector from the drive and put them into memory
BIOS sets up Interrupt 13h for that purpose
Low-level, sector-based disk read-write functions
As with int 10h, this one uses register AH for function selection, and other registers depending on function
Richard Khoury

32. Interrupt 13h Two-step process (two functions in 13h) Resets the drive
Forces recalibration of the read/write head
Read sectors into memory
Read and learn from Ralf Brown’s Interrupt List
Richard Khoury

33. Interrupt 13h
These functions need to know which drive you’re working with
0 or 1 for floppy A: or B:
80h to 84h for hard drives C: to F:
Fortunately, BIOS has put the boot device drive number in DL already
Save it at the start
MOV [bsDriveNumber], DL
Load it when needed
MOV DL, byte [bsDriveNumber]
Richard Khoury

34. Interrupt 13h These functions return information!
Carry Flag CF: Set if error, cleared otherwise
We can test this flag with the JC (jump if carry) command
Use this to add error checks in your code
Richard Khoury

35. Interrupt 13h How to find the stage-2 bootloader?
We haven’t built file management functions yet
We can only find the file if we know exactly where it is physically on the drive
So we will put it in Head 0, Cylinder 0, Sector 2, right after the stage-1 bootloader in Sector 1
Richard Khoury

36. Loading a Program Load stage-2 to 1000h:0000 in memory
Segment 1000h Offset 0
BIOS left that segment as free memory for us to use
Once the program is loaded into memory, the bootloader jumps to the correct memory address
JMP 1000h:0000
And that’s it for the stage-1 bootloader
Richard Khoury

37. Lab Assignment Part 1 Part 2
Research the LODSB command
Write the “PrintString” function and “PrintScreen.inc”
Part 2
Write the int 13h functions to reset the drive and to load the second-stage bootloader
Use a “hello world” program as a second-stage bootloader
stage1.asm and helloworld.asm on the website
Include a few extra code for segment initialization and file system initialization
Richard Khoury

38. Compiling Using NASM from the command prompt
nasm stage1.asm -f bin -o stage1.bin
nasm HelloWorld.asm -f bin -o stage2.bin
Richard Khoury

39. Copying We need to copy files at specific locations DD
Stage-1 on first sector of the drive
Stage-2 on sector immediately after
Not possible with a normal copy operation DD
Unix raw copy utility
CAREFUL! DD is nicknamed the “Disk Destroyer”! Don’t overwrite and ruin your HDD or a useful drive by accident!
Richard Khoury

40. dd if=stage1.bin of=\\.\d: bs=512 count=1
Copying
dd if=stage1.bin of=\\.\d: bs=512 count=1
Where the USB drive is d:
If you get an error 32, shut down explorer in task manager
dd if=stage2.bin of=\\.\d: seek=1 bs=512 count=1
Notice the skip of one sector
Richard Khoury