我需要一些帮助来理解使用BrokenThorn的引导加载程序加载内核的逻辑。引导程序加载图像文件
代码:
LOAD_IMAGE:
mov ax, WORD [cluster] ; cluster to read
pop bx ; buffer to read into
call ClusterLBA ; convert cluster to LBA
;xor cx, cx
;mov cl, BYTE [bpbSectorsPerCluster] ; sectors to read (commenting out has same result?
call ReadSectors ;(ES:BX from above)
push bx
; compute next cluster
mov ax, WORD [cluster] ; identify current cluster
mov cx, ax ; copy current cluster
mov dx, ax ; copy current cluster
shr dx, 0x0001 ; divide by two
add cx, dx ; sum for (3/2)
mov bx, 0x0200 ; location of FAT in memory
add bx, cx ; index into FAT
mov dx, WORD [bx] ; read two bytes from FAT
test ax, 0x0001
jnz .ODD_CLUSTER
.EVEN_CLUSTER:
and dx, 0000111111111111b ; take low twelve bits
jmp .DONE
.ODD_CLUSTER:
shr dx, 0x0004 ; take high twelve bits
.DONE:
mov WORD [cluster], dx ; store new cluster
cmp dx, 0x0FF0 ; test for end of file
jb LOAD_IMAGE
DONE:
mov si, msgCRLF
call Print
push WORD 0x0050
push WORD 0x0000
retf
我为什么要CHS转换为LBA?在函数中,好像LBA存储在AX寄存器中。但它没有在ReadSectors
中使用?之后,当前群集将被复制到AX中。
ClusterLBA:
sub ax, 0x0002 ; zero base cluster number
xor cx, cx
mov cl, BYTE [bpbSectorsPerCluster] ; convert byte to word
mul cx
add ax, WORD [datasector] ; base data sector
ret
此外,引导程序加载内核到内存位置0x0050:0×0000
我为什么不能jmp 0x0050:0x0000
和启动代码的执行?是什么
push WORD 0x0050 push WORD 0x0000
吗?这在教程中没有解释。