

                 How It Works -- CHS Translation

            Plus BIOS Types, LBA and Other Good Stuff

                            Version 4a

             by Hale Landis (landis@sugs.tware.com)

THE "HOW IT WORKS" SERIES

This is one of several How It Works documents.  The series
currently includes the following:

* How It Works -- CHS Translation
* How It Works -- Master Boot Record
* How It Works -- DOS Floppy Boot Sector
* How It Works -- OS2 Boot Sector
* How It Works -- Partition Tables


Introduction (READ THIS!)
-------------------------

This is very technical.  Please read carefully.  There is lots of
information here that can sound confusing the first time you read
it.

Why is an understanding of how a BIOS works so important?  The
basic reason is that the information returned by INT 13H AH=08H
is used by FDISK, it is used in the partition table entries
within a partition record (like the Master Boot Record) that are
created by FDISK, and it is used by the small boot program that
FDISK places into the Master Boot Record.  The information
returned by INT 13H AH=08H is in cylinder/head/sector (CHS)
format -- it is not in LBA format.  The boot processing done by
your computer's BIOS (INT 19H and INT 13H) is all CHS based.

Read this so that you are not confused by all the false
information going around that says "LBA solves the >528MB
problem".

Read this so that you understand the possible data integrity
problem that a WD EIDE type BIOS creates.  Any BIOS that has a
"LBA mode" in the BIOS setup could be a WD EIDE BIOS.  Be very
careful and NEVER chage the "LBA mode" setting after you have
partitioned and installed your software.

History
-------

Changes between this version and the preceeding version are
marked by "!" at left margin of the first line of a changed
or new paragraph.

Version 4 --  BIOS Types 8 and 10 updated.

Version 3 -- New BIOS types found and added to this list.  More
   detailed information is listed for each BIOS type.  A section
   describing CHS translation was added.

Version 2 -- A rewrite of version 1 adding BIOS types not
   included in version 1.

Version 1 -- First attempt to classify the BIOS types and
   describe what each does or does not do.

Definitions
-----------

* 528MB - The maximun drive capacity that is supported by 1024
   cylinders, 16 heads and 63 sectors (1024x16x63x512).  This
   is the limit for CHS addressing in the original IBM PC/XT
   and IBM PC/AT INT 13H BIOS.

* 8GB - The maximum drive capacity that can be supported by 1024
   cylinders, 256 heads and 63 sectors (1024x256x63x512).  This
   is the limit for the BIOS INT 13H AH=0xH calls.

* ATA - AT Attachment -- The real name of what is widely known
   as IDE.

* CE Cylinder - Customer Engineering cylinder.  This is the
   last cylinder in P-CHS mode.  IBM has always reserved this
   cylinder for use of disk diagnostic programs.  Many BIOS do
   not account for it correctly.  It is of questionable value
   these days and probably should be considered obsolete.
   However, since there is no industry wide agreement, beware.
   There is no CE Cylinder reserved in the L-CHS address.  Also
   beware of diagnostic programs that don't realize they are
   operating in L-CHS mode and think that the last L-CHS cylinder
   is the CE Cylinder.

* CHS - Cylinder/Head/Sector.  This is the traditional way to
   address sectors on a disk.  There are at least two types
   of CHS addressing:  the CHS that is used at the INT 13H
   interface and the CHS that is used at the ATA device
   interface.  In the MFM/RLL/ESDI and early ATA days the CHS
   used at the INT 13H interface was the same as the CHS used at
   the device interface.

   Today we have CHS translating BIOS types that can use one CHS
   at the INT 13H interface and a different CHS at the device
   interface.  These two types of CHS will be called the logical
   CHS or L-CHS and the physical CHS or P-CHS in this document.
   L-CHS is the CHS used at the INT 13H interface and P-CHS is
   the CHS used at the device interface.

   The L-CHS used at the INT 13 interface allows up to 256 heads,
   up to 1024 cylinders and up to 63 sectors.  This allows
   support of up to 8GB drives.  This scheme started with either
   ESDI or SCSI adapters many years ago.

   The P-CHS used at the device interface allows up to 16 heads
   up to 65535 cylinders, and up to 63 sectors.  This allows
   access to 2^28 sectors (136GB) on an ATA device.  When a P-CHS
   is used at the INT 13H interface it is limited to 1024
   cylinders, 16 heads and 63 sectors.  This is where the old
   528MB limit originated.

   ATA devices may also support LBA at the device interface.  LBA
   allows access to approximately 2^28 sectors (137GB) on an ATA
   device.

   A SCSI host adapter can convert a L-CHS directly to an LBA
   used in the SCSI read/write commands.  On a PC today, SCSI is
   also limited to 8GB when CHS addressing is used at the INT 13H
   interface.

* EDPT - Enhanced fixed Disk Parameter Table -- This table
   returns additional information for BIOS drive numbers 80H and
   81H.  The EDPT for BIOS drive 80H is pointed to by INT 41H.
   The EDPT for BIOS drive 81H is pointed to by INT 46H.  The
   EDPT is a fixed disk parameter table with an AxH signature
   byte.  This table format returns two sets of CHS information.
   One set is the L-CHS and is probably the same as returned by
   INT 13H AH=08H.  The other set is the P-CHS used at the drive
   interface.  This type of table allows drives with >1024
   cylinders or drives >528MB to be supported.  The translated
   CHS will have <=1024 cylinders and (probably) >16 heads.  The
   CHS used at the drive interface will have >1024 cylinders and
   <=16 heads.  It is unclear how the IBM defined CE cylinder is
   accounted for in such a table.  Compaq probably gets the
   credit for the original definition of this type of table.

* FDPT - Fixed Disk Parameter Table - This table returns
   additional information for BIOS drive numbers 80H and 81H.
   The FDPT for BIOS drive 80H is pointed to by INT 41H.  The
   FDPT for BIOS drive 81H is pointed to by INT 46H.  A FDPT does
   not have a AxH signature byte.  This table format returns a
   single set of CHS information.  The L-CHS information returned
   by this table is probably the same as the P-CHS and is also
   probably the same as the L-CHS returned by INT 13H AH=08H.
   However, not all BIOS properly account for the IBM defined CE
   cylinder and this can cause a one or two cylinder difference
   between the number of cylinders returned in the AH=08H data
   and the FDPT data.  IBM gets the credit for the original
   definition of this type of table.

* LBA - Logical Block Address.  Another way of addressing
   sectors that uses a simple numbering scheme starting with zero
   as the address of the first sector on a device.  The ATA
   standard requires that cylinder 0, head 0, sector 1 address
   the same sector as addressed by LBA 0. LBA addressing can be
   used at the ATA interface if the ATA device supports it.  LBA
   addressing is also used at the INT 13H interface by the AH=4xH
   read/write calls.

* L-CHS -- Logical CHS.  The CHS used at the INT 13H interface by
     the AH=0xH calls.  See CHS above.

* MBR - Master Boot Record (also known as a partition table) -
   The sector located at cylinder 0 head 0 sector 1 (or LBA 0).
   This sector is created by an "FDISK" utility program.  The MBR
   may be the only partition table sector or the MBR can be the
   first of multiple partition table sectors that form a linked
   list.  A partition table entry can describe the starting and
   ending sector addresses of a partition (also known as a
   logical volume or a logical drive) in both L-CHS and LBA form.
   Partition table entries use the L-CHS returned by INT 13H
   AH=08H.  Older FDISK programs may not compute valid LBA
   values.

* OS - Operating System.

* P-CHS -- Physical CHS.  The CHS used at the ATA device
   interface.  This CHS is also used at the INT 13H interface by
   older BIOS's that do not support >1024 cylinders or >528MB.
   See CHS above.

Background and Assumptions
--------------------------

First, please note that this is written with the OS implementor
in mind and that I am talking about the possible BIOS types as
seen by an OS during its hardware configuration search.

It is very important that you not be confused by all the
misinformation going around these days.  All OS's that want to be
co-resident with another OS (and that is all of the PC based OS's
that I know of) MUST use INT 13H to determine the capacity of a
hard disk.  And that capacity information MUST be determined in
L-CHS mode.  Why is this?  Because:  1) FDISK and the partition
tables are really L-CHS based, and 2) MS/PC DOS uses INT 13H
AH=02H and AH=03H to read and write the disk and these BIOS calls
are L-CHS based.  The boot processing done by the BIOS is all
L-CHS based.  During the boot processing, all of the disk read
accesses are done in L-CHS mode via INT 13H and this includes
loading the first of the OS's kernel code or boot manager's code.

Second, because there can be multiple BIOS types in any one
system, each drive may be under the control of a different type
of BIOS.  For example, drive 80H (the first hard drive) could be
controlled by the original system BIOS, drive 81H (the second
drive) could be controlled by a option ROM BIOS and drive 82H
(the third drive) could be controlled by a software driver.
Also, be aware that each drive could be a different type, for
example, drive 80H could be an MFM drive, drive 81H could be an
ATA drive, drive 82H could be a SCSI drive.

Third, not all OS's understand or use BIOS drive numbers greater
than 81H.  Even if there is INT 13H support for drives 82H or
greater, the OS may not use that support.

Fourth, the BIOS INT 13H configuration calls are:

* AH=08H, Get Drive Parameters -- This call is restricted to
   drives up to 528MB without CHS translation and to drives up to
   8GB with CHS translation.  For older BIOS with no support for
   >1024 cylinders or >528MB, this call returns the same CHS as
   is used at the ATA interface (the P-CHS).  For newer BIOS's
   that do support >1024 cylinders or >528MB, this call returns a
   translated CHS (the L-CHS).  The CHS returned by this call is
   used by FDISK to build partition records.

* AH=41H, Get BIOS Extensions Support -- This call is used to
   determine if the IBM/Microsoft Extensions or if the Phoenix
   Enhanced INT 13H calls are supported for the BIOS drive
   number.

* AH=48H, Extended Get Drive Parameters -- This call is used to
   determine the CHS geometries, LBA information and other data
   about the BIOS drive number.

* the FDPT or EDPT -- While not actually a call, but instead a
   data area, the FDPT or EDPT can return additional information
   about a drive.

* other tables -- The IBM/Microsoft extensions provide a pointer
   to a drive parameter table via INT 13H AH=48H.  The Phoenix
   enhancement provides a pointer to a drive parameter table
   extension via INT 13H AH=48H.  These tables are NOT the same
   as the FDPT or EDPT.

Note:  The INT 13H AH=4xH calls duplicate the older AH=0xH calls
but use a different parameter passing structure.  This new
structure allows support of drives with up to 2^64 sectors
(really BIG drives).  While at the INT 13H interface the AH=4xH
calls are LBA based, these calls do NOT require that the drive
support LBA addressing.

CHS Translation Algorithms
--------------------------

NOTE:  Before you send me email about this, read this entire
  section.  Thanks!

As you read this, don't forget that all of the boot processing
done by the system BIOS via INT 19H and INT 13H use only the INT
13H AH=0xH calls and that all of this processing is done in CHS
mode.

First, lets review all the different ways a BIOS can be called
to perform read/write operations and the conversions that a BIOS
must support.

! * An old BIOS (like BIOS type 1 below) does no CHS translation
   and does not use LBA.  It only supports the AH=0xH calls:

      INT 13H      (L-CHS == P-CHS)             ATA
      AH=0xH  --------------------------------> device
      (L-CHS)                                   (P-CHS)

* A newer BIOS may support CHS translation and it may support
   LBA at the ATA interface:

      INT 13H        L-CHS                      ATA
      AH=0xH  --+--> to    --+----------------> device
      (L-CHS)   |    P-CHS   |                  (P-CHS)
                |            |
                |            |    P-CHS
                |            +--> to    --+
                |                 LBA     |
                |                         |
                |    L-CHS                |     ATA
                +--> to  -----------------+---> device
                     LBA                        (LBA)

* A really new BIOS may also support the AH=4xH in addtion to
   the older AH\0xH calls.  This BIOS must support all possible
   combinations of CHS and LBA at both the INT 13H and ATA
   interfaces:

      INT 13H                                   ATA
      AH=4xH  --+-----------------------------> device
      (LBA)     |                               (LBA)
                |
                |    LBA
                +--> to    ---------------+
                     P-CHS                |
                                          |
      INT 13H        L-CHS                |     ATA
      AH=0xH  --+--> to    --+------------+---> device
      (L-CHS)   |    P-CHS   |                  (P-CHS)
                |            |
                |            |    P-CHS
                |            +--> to    --+
                |                 LBA     |
                |                         |
                |    L-CHS                |     ATA
                +--> to  -----------------+---> device
                     LBA                        (LBA)

You would think there is only one L-CHS to P-CHS translation
algorithm, only one L-CHS to LBA translation algorithm and only
one P-CHS to LBA translation algorithm.  But this is not so.
Why?  Because there is no document that standardizes such an
algorithm.  You can not rely on all BIOS's and OS's to do these
translations the same way.

The following explains what is widely accepted as the
"correct" algorithms.

An ATA disk must implement both CHS and LBA addressing and
must at any given time support only one P-CHS at the device
interface.  And, the drive must maintain a strick relationship
between the sector addressing in CHS mode and LBA mode.  Quoting
the ATA-2 document:

     LBA = ( (cylinder * heads_per_cylinder + heads )
             * sectors_per_track ) + sector - 1

     where heads_per_cylinder and sectors_per_track are the current
     translation mode values.

This algorithm can also be used by a BIOS or an OS to convert
a L-CHS to an LBA as we'll see below.

This algorithm can be reversed such that an LBA can be
converted to a CHS:

    cylinder = LBA / (heads_per_cylinder * sectors_per_track)
        temp = LBA % (heads_per_cylinder * sectors_per_track)
        head = temp / sectors_per_track
      sector = temp % sectors_per_track + 1

While most OS's compute disk addresses in an LBA scheme, an OS
like DOS must convert that LBA to a CHS in order to call INT 13H.

Technically an INT 13H should follow this process when
converting an L-CHS to a P-CHS:

     1) convert the L-CHS to an LBA,
     2) convert the LBA to a P-CHS,

If an LBA is required at the ATA interface, then this third
step is needed:

     3) convert the P-CHS to an LBA.

All of these conversions are done by normal arithmetic.

However, while this is the technically correct way to do
things, certain short cuts can be taken.  It is possible to
convert an L-CHS directly to a P-CHS using bit a bit shifting
algorithm.  This combines steps 1 and 2. And, if the ATA device
being used supports LBA, steps 2 and 3 are not needed.  The LBA
value produced in step 1 is the same as the LBA value produced in
step 3.

AN EXAMPLE

Lets look at an example.  Lets say that the L-CHS is 1000
cylinders 10 heads and 50 sectors, the P-CHS is 2000 cylinders, 5
heads and 50 sectors.  Lets say we want to access the sector at
L-CHS 2,4,3.

* step 1 converts the L-CHS to an LBA,

     lba = 1202 = ( ( 2 * 10 + 4 ) * 50 ) + 3 - 1

* step 2 converts the LBA to the P-CHS,

     cylinder =   4 = ( 1202 / ( 5 * 50 )
         temp = 202 = ( 1202 % ( 5 * 50 ) )
         head =   4 = ( 202 / 50 )
       sector =   3 = ( 202 % 50 ) + 1

* step 3 converts the P-CHS to an LBA,

     lba = 1202 = ( ( 4 * 5 + 4 ) * 50 ) + 3 - 1

Most BIOS (or OS) software is not going to do all of this to
convert an address.  Most will use some other algorithm.  There
are many such algorithms.

BIT SHIFTING INSTEAD

If the L-CHS is produced from the P-CHS by 1) dividing the
P-CHS cylinders by N, and 2) multiplying the P-CHS heads by N,
where N is 2, 4, 8, ..., then this bit shifting algorithm can be
used and N becomes a bit shift value.  This is the most common
way to make the P-CHS geometry of a >528MB drive fit the INT 13H
L-CHS rules.  Plus this algorithm maintains the same sector
ordering as the more complex algorithm above.  Note the
following:

     Lcylinder = L-CHS cylinder being accessed
         Lhead = L-CHS head being accessed
       Lsector = L-CHS sector being accessed

     Pcylinder = the P-CHS cylinder being accessed
         Phead = the P-CHS head being accessed
       Psector = P-CHS sector being accessed

           NPH = is the number of heads in the P-CHS
             N = 2, 4, 8, ..., the bit shift value

The algorithm, which can be implemented using bit shifting
instead of multiply and divide operations is:

     Pcylinder = ( Lcylinder * N ) + ( Lhead / NPH );
         Phead = ( Lhead % NPH );
       Psector = Lsector;

A BIT SHIFTING EXAMPLE

Lets apply this to our example above (L-CHS = 1000,10,50 and
P-CHS = 2000, 5, 50) and access the same sector at at L-CHS
2,4,3.

     Pcylinder = 4 = ( 2 * 2 ) + ( 4 / 5 )
         Phead = 4 = ( 4 % 5 )
       Psector = 3 = 3

As you can see, this produces the same P-CHS as the more
complex method above.

SO WHAT IS THE PROBLEM?

The basic problem is that there is no requirement that a CHS
translating BIOS followed these rules.  There are many other
algorithms that can be implemented to perform a similar function.
Today, there are at least two popular implementions:  the Phoenix
implementation (described above) and the non-Phoenix
implementations.

SO WHY IS THIS A PROBLEM IF IT IS HIDDEN INSIDE THE BIOS?

Because a protected mode OS that does not want to use INT 13H
must implement the same CHS translation algorithm.  If it
doesn't, your data gets scrambled.

WHY USE CHS AT ALL?

In the perfect world of tomorrow, maybe only LBA will be used.
But today we are faced with the following problems:

* Some drives >528MB don't implement LBA.

* Some drives are optimized for CHS and may have lower
   performance when given commands in LBA mode.  Don't forget
   that LBA is something new for the ATA disk designers who have
   worked very hard for many years to optimize CHS address
   handling.  And not all drive designs require the use of LBA
   internally.

* The L-CHS to LBA conversion is more complex and slower than
   the bit shifting L-CHS to P-CHS conversion.

* DOS, FDISK and the MBR are still CHS based -- they use the
   CHS returned by INT 13H AH=08H.  Any OS that can be installed
   on the same disk with DOS must understand CHS addressing.

* The BIOS boot processing and loading of the first OS kernel
   code is done in CHS mode -- the CHS returned by INT 13H AH=08H
   is used.

* Microsoft has said that their OS's will not use any disk
   capacity that can not also be accessed by INT 13H AH=0xH.

These are difficult problems to overcome in today's industry
environment.  The result:  chaos.

DANGER TO YOUR DATA!

See the description of BIOS Type 7 below to understand why a
WD EIDE BIOS is so dangerous to your data.

The BIOS Types
--------------

I assume the following:

a) All BIOS INT 13H support has been installed by the time the OS
   starts its boot processing.  I'm don't plan to cover what
   could happen to INT 13H once the OS starts loading its own
   device drivers.

b) Drives supported by INT 13H are numbered sequentially starting
   with drive number 80H (80H-FFH are hard drives, 00-7FH are
   floppy drives).

And remember, any time a P-CHS exists it may or may not account
  for the CE Cylinder properly.

I have identified the following types of BIOS INT 13H support as
seen by an OS during its boot time hardware configuration
determination:

BIOS Type 1

   Origin:  Original IBM PC/XT.

   BIOS call support:  INT 13H AH=0xH and FDPT for BIOS drives
   80H and 81H.  There is no CHS translation.  INT 13H AH=08H
   returns the P-CHS.  The FDPT should contain the same P-CHS.

   Description:  Supports up to 528MB from a table of drive
   descriptions in BIOS ROM.  No support for >1024 cylinders or
   drives >528MB or LBA.

   Support issues:  For >1024 cylinders or >528MB support, either
   an option ROM with an INT 13H replacement (see BIOS types 4-7)
   -or- a software driver (see BIOS type 8) must be added to the
   system.

BIOS Type 2

   Origin:  Unknown, but first appeared on systems having BIOS
   drive type table entries defining >1024 cylinders.  Rumored to
   have originated at the request of Novell or SCO.

   BIOS call support:  INT 13H AH=0xH and FDPT for BIOS drives
   80H and 81H.  INT 13H AH=08H should return a L-CHS with the
   cylinder value limited to 1024.  Beware, many BIOS perform
   a logical AND on the cylinder value.  A correct BIOS will
   limit the cylinder value as follows:

      cylinder = cylinder > 1024 ? 1024 : cylinder;

   An incorrect BIOS will limit the cylinder value as follows
   (this implementation turns a 540MB drive into a 12MB drive!):

      cylinder = cylinder & 0x03ff;

   The FDPT will return a P-CHS that has the full cylinder
   value.

   Description:  For BIOS drive numbers 80H and 81H, this BIOS
   type supports >1024 cylinders or >528MB without using a
   translated CHS in the FDPT.  INT 13H AH=08H truncates
   cylinders to 1024 (beware of buggy implementations).  The FDPT
   can show >1024 cylinders thereby allowing an OS to support
   drives >528MB.  May convert the L-CHS or P-CHS directly to an
   LBA if the ATA device supports LBA.

   Support issues:  Actual support of >1024 cylinders is OS
   specific -- some OS's may be able to place OS specific
   partitions spanning or beyond cylinder 1024.  Usually all OS
   boot code must be within first 1024 cylinders.  The FDISK
   program of an OS that supports such partitions uses an OS
   specific partition table entry format to identify these
   paritions.  There does not appear to be a standard (de facto
   or otherwise) for this unusual partition table entry.
   Apparently one method is to place -1 into the CHS fields and
   use the LBA fields to describe the location of the partition.
   This DOES NOT require the drive to support LBA addressing.
   Using an LBA in the partition table entry is just a trick to
   get around the CHS limits in the partition table entry.  It is
   unclear if such a partition table entry will be ignored by an
   OS that does not understand what it is.  For an OS that does
   not support such partitions, either an option ROM with an INT
   13H replacement (see BIOS types 4-7) -or- a software driver
   (see BIOS type 8) must be added to the system.

   Note:  OS/2 can place HPFS partitions and Linux can place
   Linux partitions beyond or spanning cylinder 1024.  (Anyone
   know of other systems that can do the same?)

BIOS Type 3

   Origin:  Unknown, but first appeared on systems having BIOS
   drive type table entires defining >1024 cylinders.  Rumored to
   have originated at the request of Novell or SCO.

   BIOS call support:  INT 13H AH=0xH and FDPT for BIOS drives
   80H and 81H.  INT 13H AH=08H can return an L-CHS with more
   than 1024 cylinders.

   Description:  This BIOS is like type 2 above but it allows up
   to 4096 cylinders (12 cylinder bits).  It does this in the INT
   13H AH=0xH calls by placing two most significant cylinder bits
   (bits 11 and 10) into the upper two bits of the head number
   (bits 7 and 6).

   Support issues:  Identification of such a BIOS is difficult.
   As long as the drive(s) supported by this type of BIOS have
   <1024 cylinders this BIOS looks like a type 2 BIOS because INT
   13H AH=08H should return zero data in bits 7 and 6 of the head
   information.  If INT 13H AH=08H returns non zero data in bits
   7 and 6 of the head information, perhaps it can be assumed
   that this is a type 3 BIOS.  For more normal support of >1024
   cylinders or >528MB, either an option ROM with an INT 13H
   replacement (see BIOS types 4-7) -or- a software driver (see
   BIOS type 8) must be added to the system.

   Note:  Apparently this BIOS type is no longer produced by any
   BIOS vendor.

BIOS Type 4

   Origin:  Compaq.  Probably first appeared in systems with ESDI
   drives having >1024 cylinders.

   BIOS call support:  INT 13H AH=0xH and EDPT for BIOS drives
   80H and 81H.  If the drive has <1024 cylinders, INT 13H AH=08H
   returns the P-CHS and a FDPT is built.  If the drive has >1024
   cylinders, INT 13H AH=08H returns an L-CHS and an EDPT is
   built.

   Description:  Looks like a type 2 BIOS when an FDPT is built.
   Uses CHS translation when an EDPT is used.  May convert the
   L-CHS directly to an LBA if the ATA device supports LBA.

   Support issues:  This BIOS type may support up to four drives
   with a EDPT (or FDPT) for BIOS drive numbers 82H and 83H
   located in memory following the EDPT (or FDPT) for drive 80H.
   Different CHS translation algorithms may be used by the BIOS
   and an OS.

BIOS Type 5

   Origin:  The IBM/Microsoft BIOS Extensions document.  For many
   years this document was marked "confidential" so it did not
   get wide spread distribution.

   BIOS call support:  INT 13H AH=0xH, AH=4xH and EDPT for BIOS
   drives 80H and 81H.  INT 13H AH=08H returns an L-CHS.  INT 13H
   AH=41H and AH=48H should be used to get P-CHS configuration.
   The FDPT/EDPT should not be used.  In some implementations the
   FDPT/EDPT may not exist.

   Description:  A BIOS that supports very large drives (>1024
   cylinders, >528MB, actually >8GB), and supports the INT 13H
   AH=4xH read/write functions.  The AH=4xH calls use LBA
   addressing and support drives with up to 2^64 sectors.  These
   calls do NOT require that a drive support LBA at the drive
   interface.  INT 13H AH=48H describes the L-CHS used at the INT
   13 interface and the P-CHS or LBA used at the drive interface.
   This BIOS supports the INT 13 AH=0xH calls the same as a BIOS
   type 4.

   Support issues:  While the INT 13H AH=4xH calls are well
   defined, they are not implemented in many systems shipping
   today.  Currently undefined is how such a BIOS should respond
   to INT 13H AH=08H calls for a drive that is >8GB.  Different
   CHS translation algorithms may be used by the BIOS and an OS.

   Note:  Support of LBA at the drive interface may be automatic
   or may be under user control via a BIOS setup option.  Use of
   LBA at the drive interface does not change the operation of
   the INT 13 interface.

BIOS Type 6

   Origin:  The Phoenix Enhanced Disk Drive Specification.

   BIOS call support:  INT 13H AH=0xH, AH=4xH and EDPT for BIOS
   drives 80H and 81H.  INT 13H AH=08H returns an L-CHS.  INT 13H
   AH=41H and AH=48H should be used to get P-CHS configuration.
   INT 13H AH=48H returns the address of the Phoenix defined
   "FDPT Extension" table.

   Description:  A BIOS that supports very large drives (>1024
   cylinders, >528MB, actually >8GB), and supports the INT 13H
   AH=4xH read/write functions.  The AH=4xH calls use LBA
   addressing and support drives with up to 2^64 sectors.  These
   calls do NOT require that a drive support LBA at the drive
   interface.  INT 13H AH=48H describes the L-CHS used at the INT
   13 interface and the P-CHS or LBA used at the drive interface.
   This BIOS supports the INT 13 AH=0xH calls the same as a BIOS
   type 4. The INT 13H AH=48H call returns additional information
   such as host adapter addresses, DMA support, LBA support, etc,
   in the Phoenix defined "FDPT Extension" table.

   Phoenix says this this BIOS need not support the INT 13H
   AH=4xH read/write calls but this BIOS is really an
   extension/enhancement of the original IBM/MS BIOS so most
   implementations will probably support the full set of INT 13H
   AH=4xH calls.

   Support issues:  Currently undefined is how such a BIOS should
   respond to INT 13H AH=08H calls for a drive that is >8GB.
   Different CHS translation algorithms may be used by the BIOS
   and an OS.

   Note:  Support of LBA at the drive interface may be automatic
   or may be under user control via a BIOS setup option.  Use of
   LBA at the drive interface does not change the operation of
   the INT 13 interface.

BIOS Type 7

   Origin:  Described in the Western Digital Enhanced IDE
   Implementation Guide.

   BIOS call support:  INT 13H AH=0xH and FDPT or EDPT for BIOS
   drives 80H and 81H.  An EDPT with a L-CHS of 16 heads and 63
   sectors is built when "LBA mode" is enabled.  An FDPT is built
   when "LBA mode" is disabled.

   Description:  Supports >1024 cylinders or >528MB using a EDPT
   with a translated CHS *** BUT ONLY IF *** the user requests
   "LBA mode" in the BIOS setup *** AND *** the drive supports
   LBA.  As long as "LBA mode" is enabled, CHS translation is
   enabled using a L-CHS with <=1024 cylinders, 16, 32, 64, ...,
   heads and 63 sectors.  Disk read/write commands are issued in
   LBA mode at the ATA interface but other commands are issued in
   P-CHS mode.  Because the L-CHS is determined by table lookup
   based on total drive capacity and not by a multiply/divide of
   the P-CHS cylinder and head values, it may not be possible to
   use the simple (and faster) bit shifting L-CHS to P-CHS
   algorithms.

   When "LBA mode" is disabled, this BIOS looks like a BIOS type
   2 with an FDPT.  The L-CHS used is taken either from the BIOS
   drive type table or from the device's Identify Device data.
   This L-CHS can be very different from the L-CHS returned when
   "LBA mode" is enabled.

   This BIOS may support FDPT/EDPT for up to four drives in the
   same manner as described in BIOS type 4.

   The basic problem with this BIOS is that the CHS returned by
   INT 13H AH=08H changes because of a change in the "LBA mode"
   setting in the BIOS setup.  This should not happen.  This use
   or non-use of LBA at the ATA interface should have no effect
   on the CHS returned by INT 13H AH=08H.  This is the only BIOS
   type know to have this problem.

   Support issues:  If the user changes the "LBA mode" setting in
   BIOS setup, INT 13H AH=08H and the FDPT/EDPT change
   which may cause *** DATA CORRUPTION ***.  The user should be
   warned to not change the "LBA mode" setting in BIOS setup once
   the drive has been partitioned and software installed.
   Different CHS translation algorithms may be used by the BIOS
   and an OS.

BIOS Type 8

   Origin:  Unknown.  Perhaps Ontrack's Disk Manager was the
   first of these software drivers.  Another example of such a
   driver is Micro House's EZ Drive.

   BIOS call support:  Unknown (anyone care to help out here?).
   Mostly likely only INT 13H AH=0xH are support.  Probably a
   FDPT or EDPT exists for drives 80H and 81H.

!  Description:  A software driver that "hides" in the MBR such
   that it is loaded into system memory before any OS boot
   processing starts.  These drivers can have up to three parts:
   a part that hides in the MBR, a part that hides in the
   remaining sectors of cylinder 0, head 0, and an OS device
   driver.  The part in the MBR loads the second part of the
   driver from cylinder 0 head 0. The second part provides a
   replacement for INT 13H that enables CHS translation for at
   least the boot drive.  Usually the boot drive is defined in
   CMOS setup as a type 1 or 2 (5MB or 10MB drive).  Once the
   second part of the driver is loaded, this definition is
   changed to describe the true capacity of the drive and INT 13H
   is replaced by the driver's version of INT 13H that does CHS
   translation.  In some cases the third part, an OS specific
   device driver, must be loaded to enable CHS translation for
   devices other than the boot device.

!  I don't know the details of how these drivers respond to INT
   13H AH=08H or how they set up drive parameter tables (anyone
   care to help out here?).  Some of these drivers convert the
   L-CHS to an LBA, then they add a small number to the LBA and
   finally they convert the LBA to a P-CHS.  This in effect skips
   over some sectors at the front of the disk.

   Support issues:  Several identified -- Some OS installation
   programs will remove or overlay these drivers; some of these
   drivers do not perform CHS translation using the same
   algorithms used by the other BIOS types; special OS device
   drivers may be required in order to use these software drivers
   For example, under MS Windows the standard FastDisk driver
   (the 32-bit disk access driver) must be replaced by a driver
   that understands the Ontrack, Micro House, etc, version of INT
   13H.  Different CHS translation algorithms may be used by the
   driver and an OS.

!  The hard disk vendors have been shipping these drivers with
   their drives over 528MB during the last year and they have
   been ignoring the statements of Microsoft and IBM that these
   drivers would not be supported in future OS's.  Now it appears
   that both Microsoft and IBM are in a panic trying to figure
   out how to support some of these drivers in WinNT, Win95 and
   OS/2.  It is unclear what the outcome of this will be at this
   time.

!  NOTE:  THIS IS NOT A PRODUCT ENDORSEMENT!  An alternate
   solution for an older ISA system is one of the BIOS
   replacement cards.  This cards have a BIOS option ROM.  AMI
   makes such a card called the "Disk Extender".  This card
   replaces the motherboard's INT 13H BIOS with a INT 13H BIOS
   that does some form of CHS translation.  Another solution for
   older VL-Bus systems is an ATA-2 (EIDE) type host adapter card
   that provides a option ROM with an INT 13H replacement.

BIOS Type 9

   Origin:  SCSI host adapters.

   BIOS call support:  Probably INT 13H AH=0xH and FDPT for BIOS
   drives 80H and 81H, perhaps INT 13H AH=4xH.

   Description:  Most SCSI host adapters contain an option ROM
   that enables INT 13 support for the attached SCSI hard drives.
   It is possible to have more than one SCSI host adapter, each
   with its own option ROM.  The CHS used at the INT 13H
   interface is converted to the LBA that is used in the SCSI
   commands.  INT 13H AH=08H returns a CHS.  This CHS will have
   <=1024 cylinders, <=256 heads and <=63 sectors.  The FDPT
   probably will exist for SCSI drives with BIOS drive numbers of
   80H and 81H and probably indicates the same CHS as that
   returned by INT 13H AH=08H.  Even though the CHS used at the
   INT 13H interface looks like a translated CHS, there is no
   need to use a EDPT since there is no CHS-to-CHS translation
   used.  Other BIOS calls (most likely host adapter specific)
   must be used to determine other information about the host
   adapter or the drives.

   The INT 13H AH=4xH calls can be used to get beyond 8GB but
   since there is little support for these calls in today's OS's,
   there are probably few SCSI host adapters that support these
   newer INT 13H calls.

   Support issues:  Some SCSI host adapters will not install
   their option ROM if there are two INT 13H devices previously
   installed by another INT 13H BIOS (for example, two
   MFM/RLL/ESDI/ATA drives).  Other SCSI adapters will install
   their option ROM and use BIOS drive numbers greater than 81H.
   Some older OS's don't understand or use BIOS drive numbers
   greater than 81H.  SCSI adapters are currently faced with the
   >8GB drive problem.

BIOS Type 10

   Origin:  A european system vendor.

   BIOS call support:  INT 13H AH=0xH and FDPT for BIOS drives
   80H and 81H.

   Description:  This BIOS supports drives >528MB but it does not
   support CHS translation.  It supports only ATA drives with LBA
   capability.  INT 13H AH=08H returns an L-CHS.  The L-CHS is
   converted directly to an LBA.  The BIOS sets the ATA drive to
   a P-CHS of 16 heads and 63 sectors using the Initialize Drive
   Parameters command but it does not use this P-CHS at the ATA
   interface.

!  Support issues:  OS/2 will probably work with this BIOS as
   long as the drive's power on default P-CHS mode uses 16 heads
   and 63 sectors.  Because there is no EDPT, OS/2 uses the ATA
   Identify Device power on default P-CHS, described in
   Identify Device words 1, 3 and 6 as the current P-CHS for the
   drive.  However, this may not represent the correct P-CHS.  A
   newer drive will have the its current P-CHS information in
   Identify Device words 53-58 but for some reason OS/2 does not
   use this information.

----------------------------------------------------------------------

                How it Works -- Partition Tables

                           Version 1b

             by Hale Landis (landis@sugs.tware.com)


THE "HOW IT WORKS" SERIES

This is one of several How It Works documents.  The series
currently includes the following:

* How It Works -- CHS Translation
* How It Works -- Master Boot Record
* How It Works -- DOS Floppy Boot Sector
* How It Works -- OS2 Boot Sector
* How It Works -- Partition Tables


PARTITION SECTOR/RECORD/TABLE BASICS

FDISK creates all partition records (sectors).  The primary
purpose of a partition record is to hold a partition table.  The
rules for how FDISK works are unwritten but so far most FDISK
programs (DOS, OS/2, WinNT, etc) seem to follow the same basic
idea.

First, all partition table records (sectors) have the same
format.  This includes the partition table record at cylinder 0,
head 0, sector 1 -- what is known as the Master Boot Record
(MBR).  The last 66 bytes of a partition table record contain a
partition table and a 2 byte signature.  The first 446 bytes of
these sectors usually contain a program but only the program in
the MBR is ever executed (so extended partition table records
could contain something other than a program in the first 466
bytes).  See "How It Works -- The Master Boot Record".

Second, extended partitions are "nested" inside one another and
extended partition table records form a "linked list".  I will
attempt to show this in a diagram below.

PARTITION TABLE ENTRY FORMAT

Each partition table entry is 16 bytes and contains things like
the start and end location of a partition in CHS, the start in
LBA, the size in sectors, the partition "type" and the "active"
flag.  Warning:  older versions of FDISK may compute incorrect
LBA or size values.  And note:  When your computer boots itself,
only the CHS fields of the partition table entries are used
(another reason LBA doesn't solve the >528MB problem).  The CHS
fields in the partition tables are in L-CHS format -- see "How It
Works -- CHS Translation".

There is no central clearing house to assign the codes used in
the one byte "type" field.  But codes are assigned (or used) to
define most every type of file system that anyone has ever
implemented on the x86 PC:  12-bit FAT, 16-bit FAT, HPFS, NTFS,
etc.  Plus, an extended partition also has a unique type code.

Note:  I know of no complete list of all the type codes that have
been used to date.  However, I try to include such a list in a
future version of this document.

The 16 bytes of a partition table entry are used as follows:

    +--- Bit 7 is the active partition flag, bits 6-0 are zero.
    |
    |    +--- Starting CHS in INT 13 call format.
    |    |
    |    |      +--- Partition type byte.
    |    |      |
    |    |      |    +--- Ending CHS in INT 13 call format.
    |    |      |    |
    |    |      |    |        +-- Starting LBA.
    |    |      |    |        |
    |    |      |    |        |       +-- Size in sectors.
    |    |      |    |        |       |
    v <--+--->  v <--+-->     v       v

   0  1  2  3  4  5  6  7  8 9 A B  C D E F
   DH DL CH CL TB DL CH CL LBA..... SIZE....

   80 01 01 00 06 0e be 94 3e000000 0c610900  1st entry

   00 00 81 95 05 0e fe 7d 4a610900 724e0300  2nd entry

   00 00 00 00 00 00 00 00 00000000 00000000  3rd entry

   00 00 00 00 00 00 00 00 00000000 00000000  4th entry

Bytes 0-3 are used by the small program in the Master Boot Record
to read the first sector of an active partition into memory.  The
DH, DL, CH and CL above show which x86 register is loaded when
the MBR program calls INT 13H AH=02H to read the active
partition's boot sector.  See "How It Works -- Master Boot
Record".

These entries define the following partitions:

1) The first partition, a primary partition DOS FAT, starts at
   CHS 0H,1H,1H (LBA 3EH) and ends at CHS 294H,EH,3EH with a size
   of 9610CH sectors.

2) The second partition, an extended partition, starts at CHS
   295H,0H,1H (LBA 9614AH) and ends at CHS 37DH,EH,3EH with a
   size of 34E72H sectors.

3) The third and fourth table entries are unused.

PARTITION TABLE RULES

Keep in mind that there are NO written rules and NO industry
standards on how FDISK should work but here are some basic rules
that seem to be followed by most versions of FDISK:

1) In the MBR there can be 0-4 "primary" partitions, OR, 0-3
   primary partitions and 0-1 extended partition entry.

2) In an extended partition there can be 0-1 "secondary"
   partition entries and 0-1 extended partition entries.

3) Only 1 primary partition in the MBR can be marked "active" at
   any given time.

4) In most versions of FDISK, the first sector of a partition
   will be aligned such that it is at head 0, sector 1 of a
   cylinder.  This means that there may be unused sectors on the
   track(s) prior to the first sector of a partition and that
   there may be unused sectors following a partition table
   sector.

   For example, most new versions of FDISK start the first
   partition (primary or extended) at cylinder 0, head 1, sector
   0. This leaves the sectors at cylinder 0, head 0, sectors
   2...n as unused sectors.  This same layout may be seen on the
   first track of an extended partition.  See example 2 below.

   Also note that software drivers like Ontrack's Disk Manager
   depend on these unused sectors because these drivers will
   "hide" their code there (in cylinder 0, head 0, sectors
   2...n).  This is also a good place for boot sector virus
   programs to hang out.

5) The partition table entries (slots) can be used in any order.
   Some versions of FDISK fill the table from the bottom up and
   some versions of FDISK fill the table from the top down.
   Deleting a partition can leave an unused entry (slot) in the
   middle of a table.

6) And then there is the "hack" that some newer OS's (OS/2 and
   Linux) use in order to place a partition spanning or passed
   cylinder 1024 on a system that does not have a CHS translating
   BIOS.  These systems create a partition table entry with the
   partition's starting and ending CHS information set to all
   FFH.  The starting and ending LBA information is used to
   describe the location of the partition.  The LBA can be
   converted back to a CHS -- most likely a CHS with more than
   1024 cylinders.  Since such a CHS can't be used by the system
   BIOS, these partitions can not be booted or accessed until the
   OS's kernel and hard disk device drivers are loaded.  It is
   not known if the systems using this "hack" follow the same
   rules for the creation of these type of partitions.

There are NO written rules as to how an OS scans the partition
table entries so each OS can have a different method.  For DOS,
this means that different versions could assign different drive
letters to the same FAT file system partitions.

PARTITION NESTING

What do I mean when I say the partitions are "nested" within each
other?  Lets look at this example:

     M = Master Boot Record (and any unused sectors
         on the same track)
     E = Extended partition record (and any unused sectors
         on the same track)
   pri = a primary partition (first sector is a "boot" sector)
   sec = a secondary partition (first sector is a "boot" sector)


  |<----------------the entire disk-------------->|
  |                                               |
  |M<pri>                                         |
  |                                               |
  |      E<sec><---rest of 1st ext part---------->|
  |                                               |
  |            E<sec><---rest of 2nd ext part---->|


The first extended partition is described in the MBR and it
occupies the entire disk following the primary partition.  The
second extended partition is described in the first extended
partition record and it occupies the entire disk following the
first secondary partition.

PARTITION TABLE LINKING

What do I mean when I say the partition records (tables) form a
"linked" list?  This means that the MBR has an entry that
describes (points to) the first extended partition, the first
extended partition table has an entry that describes (points to)
the second extended partition table, and so on.  There is, in
theory, no limited to out long this linked list is.  When you ask
FDISK to show the DOS "logical drives" it scans the linked list
looking for all of the DOS FAT type partitions that may exist.
Remember that in an extended partition table, only two entries of
the four can be used (rule 2 above).

And one more thing...  Within a partition, the layout of the file
system data varies greatly.  However, the first sector of a
partition is expected to be a "boot" sector.  A DOS FAT file
system has:  a boot sector, first FAT sectors, second FAT
sectors, root directory sectors and finally the file data area.
See "How It Works -- OS2 Boot Sector".


EXAMPLE 1

A disk containing four DOS FAT partitions (C, D, E and F):


  |<---------------------the entire disk------------------->|
  |                                                         |
  |M<---C:--->                                              |
  |                                                         |
  |           E<---D:---><-rest of 1st ext part------------>|
  |                                                         |
  |                      E<---E:---><-rest of 2nd ext part->|
  |                                                         |
  |                                 E<---------F:---------->|


EXAMPLE 2

So here is an example of a disk with two primary partitions, one
DOS FAT and one OS/2 HPFS, plus an extended partition with
another DOS FAT:


  |<------------------the entire disk------------------>|
  |                                                     |
  |M<pri 1 - DOS FAT>                                   |
  |                                                     |
  |                  <pri 2 - OS/2 HPFS>                |
  |                                                     |
  |                                     E<sec - DOS FAT>|


Or in more detail ('n' is the highest cylinder, head or sector
number number allowed in the indicated field of the CHS)...


            +-------------------------------------+
 CHS=0,0,1  | Master Boot Record containing       |
            | partition table search program and  |
            | a partition table                   |
            | +---------------------------------+ |
            | | DOS FAT partition description   | | points to CHS=0,1,1
            | +---------------------------------+ | points to CHS=a
            | | OS/2 HPFS partition description | |
            | +---------------------------------+ |
            | | unused table entry              | |
            | +---------------------------------+ |
            | | extended partition entry        | | points to CHS=b
            | +---------------------------------+ |
            +-------------------------------------+
CHS=0,0,2   | the rest of "track 0" -- this is    | :
to          | where the software drivers such as  | : normally
CHS=0,0,n   | Ontrack's Disk Manager or Micro     | : unused
            | House's EZ Drive are located.       | :
            +-------------------------------------+
CHS=0,1,1   | Boot sector for the DOS FAT         | :
            | partition                           | : a DOS FAT
            +-------------------------------------+ : file
CHS=0,1,2   | rest of the DOS FAT partition       | : system
to          | (FAT table, root directory and      | :
CHS=x-1,n,n | user data area)                     | :
            +-------------------------------------+
CHS=x,0,1   | Boot sector for the OS/2 HPFS       | :
            | file system partition               | : an OS/2
            +-------------------------------------+ : HPFS file
CHS=x,0,2   | rest of the OS/2 HPFS file system   | : system
to          | partition                           | :
CHS=y-1,n,n |                                     | :
            +-------------------------------------+
CHS=y,0,1   | Partition record for the extended   |
            | partition containing a partition    |
            | record program (never executed) and |
            | a partition table                   |
            | +---------------------------------+ |
            | | DOS FAT partition description   | | points to CHS=b+1
            | +---------------------------------+ |
            | | unused table entry              | |
            | +---------------------------------+ |
            | | unused table entry              | |
            | +---------------------------------+ |
            | | unused table entry              | |
            | +---------------------------------+ |
            +-------------------------------------+
CHS=y,0,2   | the rest of the first track of the  | : normally
to          | extended partition                  | : unused
CHS=y,0,n   |                                     | :
            +-------------------------------------+
CHS=y,1,1   | Boot sector for the DOS FAT         | :
            | partition                           | : a DOS FAT
            +-------------------------------------+ : file
CHS=y,1,2   | rest of the DOS FAT partition       | : system
to          | (FAT table, root directory and      | :
CHS=n,n,n   | user data area)                     | :
            +-------------------------------------+

EXAMPLE 3

Here is a partition record from an extended partition (the first
sector of an extended partition).  Note that it contains no
program code.  It contains only the partition table and the
signature data.

OFFSET 0 1 2 3  4 5 6 7  8 9 A B  C D E F  *0123456789ABCDEF*
000000 00000000 00000000 00000000 00000000 *................*
000010 TO 0001af SAME AS ABOVE
0001b0 00000000 00000000 00000000 00000001 *................*
0001c0 8195060e fe7d3e00 0000344e 03000000 *.....}>...4N....*
0001d0 00000000 00000000 00000000 00000000 *................*
0001e0 00000000 00000000 00000000 00000000 *................*
0001f0 00000000 00000000 00000000 000055aa *..............U.*

NOTES

Thanks to yue@heron.Stanford.EDU (Kenneth C. Yue) for pointing
out that in V0 of this document I did not properly describe the
unused sectors normally found around the partition table sectors.

-----------------------------------------------------------------------

               How It Works -- Master Boot Record

                           Version 1a

             by Hale Landis (landis@sugs.tware.com)


THE "HOW IT WORKS" SERIES

This is one of several How It Works documents.  The series
currently includes the following:

* How It Works -- CHS Translation
* How It Works -- Master Boot Record
* How It Works -- DOS Floppy Boot Sector
* How It Works -- OS2 Boot Sector
* How It Works -- Partition Tables


MASTER BOOT RECORD

This article is a disassembly of a Master Boot Record (MBR).  The
MBR is the sector at cylinder 0, head 0, sector 1 of a hard disk.
An MBR is created by the FDISK program.  The FDISK program of all
operating systems must create a functionally similar MBR. The MBR
is first of what could be many partition sectors, each one
containing a four entry partition table.

At the completion of your system's Power On Self Test (POST), INT
19 is called.  Usually INT 19 tries to read a boot sector from
the first floppy drive.  If a boot sector is found on the floppy
disk, the that boot sector is read into memory at location
0000:7C00 and INT 19 jumps to memory location 0000:7C00.
However, if no boot sector is found on the first floppy drive,
INT 19 tries to read the MBR from the first hard drive.  If an
MBR is found it is read into memory at location 0000:7c00 and INT
19 jumps to memory location 0000:7c00.  The small program in the
MBR will attempt to locate an active (bootable) partition in its
partition table.  If such a partition is found, the boot sector
of that partition is read into memory at location 0000:7C00 and
the MBR program jumps to memory location 0000:7C00.  Each
operating system has its own boot sector format.  The small
program in the boot sector must locate the first part of the
operating system's kernel loader program (or perhaps the kernel
itself or perhaps a "boot manager program") and read that into
memory.

INT 19 is also called when the CTRL-ALT-DEL keys are used.  On
most systems, CTRL-ALT-DEL causes an short version of the POST to
be executed before INT 19 is called.

=====

Where stuff is:

   The MBR program code starts at offset 0000.
   The MBR messages start at offset 008b.
   The partition table starts at offset 00be.
   The signature is at offset 00fe.

Here is a summary of what this thing does:

   If an active partition is found, that partition's boot record
   is read into 0000:7c00 and the MBR code jumps to 0000:7c00
   with SI pointing to the partition table entry that describes
   the partition being booted.  The boot record program uses this
   data to determine the drive being booted from and the location
   of the partition on the disk.

   If no active partition table enty is found, ROM BASIC is
   entered via INT 18.  All other errors cause a system hang, see
   label HANG.

NOTES (VERY IMPORTANT):

   1) The first byte of an active partition table entry is 80.
   This byte is loaded into the DL register before INT 13 is
   called to read the boot sector.  When INT 13 is called, DL is
   the BIOS device number.  Because of this, the boot sector read
   by this MBR program can only be read from BIOS device number
   80 (the first hard disk).  This is one of the reasons why it
   is usually not possible to boot from any other hard disk.

   2) The MBR program uses the CHS based INT 13H AH=02H call to
   read the boot sector of the active partition.  The location of
   the active partition's boot sector is in the partition table
   entry in CHS format.  If the drive is >528MB, this CHS must be
   a translated CHS (or L-CHS, see my BIOS TYPES document).
   No addresses in LBA form are used (another reason why LBA
   doesn't solve the >528MB problem).

=====

Here is the entire MBR record (hex dump and ascii).

OFFSET 0 1 2 3  4 5 6 7  8 9 A B  C D E F  *0123456789ABCDEF*
000000 fa33c08e d0bc007c 8bf45007 501ffbfc *.3.....|..P.P...*
000010 bf0006b9 0001f2a5 ea1d0600 00bebe07 *................*
000020 b304803c 80740e80 3c00751c 83c610fe *...<.t..<.u.....*
000030 cb75efcd 188b148b 4c028bee 83c610fe *.u......L.......*
000040 cb741a80 3c0074f4 be8b06ac 3c00740b *.t..<.t.....<.t.*
000050 56bb0700 b40ecd10 5eebf0eb febf0500 *V.......^.......*
000060 bb007cb8 010257cd 135f730c 33c0cd13 *..|...W.._s.3...*
000070 4f75edbe a306ebd3 bec206bf fe7d813d *Ou...........}.=*
000080 55aa75c7 8bf5ea00 7c000049 6e76616c *U.u.....|..Inval*
000090 69642070 61727469 74696f6e 20746162 *id partition tab*
0000a0 6c650045 72726f72 206c6f61 64696e67 *le.Error loading*
0000b0 206f7065 72617469 6e672073 79737465 * operating syste*
0000c0 6d004d69 7373696e 67206f70 65726174 *m.Missing operat*
0000d0 696e6720 73797374 656d0000 00000000 *ing system......*
0000e0 00000000 00000000 00000000 00000000 *................*
0000f0 TO 0001af SAME AS ABOVE
0001b0 00000000 00000000 00000000 00008001 *................*
0001c0 0100060d fef83e00 00000678 0d000000 *......>....x....*
0001d0 00000000 00000000 00000000 00000000 *................*
0001e0 00000000 00000000 00000000 00000000 *................*
0001f0 00000000 00000000 00000000 000055aa *..............U.*

=====

Here is the disassembly of the MBR...

This sector is initially loaded into memory at 0000:7c00 but
it immediately relocates itself to 0000:0600.

                 BEGIN:                      NOW AT 0000:7C00, RELOCATE

0000:7C00 FA            CLI                     disable int's
0000:7C01 33C0          XOR     AX,AX           set stack seg to 0000
0000:7C03 8ED0          MOV     SS,AX
0000:7C05 BC007C        MOV     SP,7C00         set stack ptr to 7c00
0000:7C08 8BF4          MOV     SI,SP           SI now 7c00
0000:7C0A 50            PUSH    AX
0000:7C0B 07            POP     ES              ES now 0000:7c00
0000:7C0C 50            PUSH    AX
0000:7C0D 1F            POP     DS              DS now 0000:7c00
0000:7C0E FB            STI                     allow int's
0000:7C0F FC            CLD                     clear direction
0000:7C10 BF0006        MOV     DI,0600         DI now 0600
0000:7C13 B90001        MOV     CX,0100         move 256 words (512 bytes)
0000:7C16 F2            REPNZ                   move MBR from 0000:7c00
0000:7C17 A5            MOVSW                      to 0000:0600
0000:7C18 EA1D060000    JMP     0000:061D       jmp to NEW_LOCATION

        NEW_LOCATION:                        NOW AT 0000:0600

0000:061D BEBE07      MOV     SI,07BE           point to first table entry
0000:0620 B304        MOV     BL,04             there are 4 table entries

        SEARCH_LOOP1:                        SEARCH FOR AN ACTIVE ENTRY

0000:0622 803C80      CMP     BYTE PTR [SI],80  is this the active entry?
0000:0625 740E        JZ      FOUND_ACTIVE      yes
0000:0627 803C00      CMP     BYTE PTR [SI],00  is this an inactive entry?
0000:062A 751C        JNZ     NOT_ACTIVE        no
0000:062C 83C610      ADD     SI,+10            incr table ptr by 16
0000:062F FECB        DEC     BL                decr count
0000:0631 75EF        JNZ     SEARCH_LOOP1      jmp if not end of table
0000:0633 CD18        INT     18                GO TO ROM BASIC

        FOUND_ACTIVE:                        FOUND THE ACTIVE ENTRY

0000:0635 8B14        MOV     DX,[SI]           set DH/DL for INT 13 call
0000:0637 8B4C02      MOV     CX,[SI+02]        set CH/CL for INT 13 call
0000:063A 8BEE        MOV     BP,SI             save table ptr

        SEARCH_LOOP2:                        MAKE SURE ONLY ONE ACTIVE ENTRY

0000:063C 83C610      ADD     SI,+10            incr table ptr by 16
0000:063F FECB        DEC     BL                decr count
0000:0641 741A        JZ      READ_BOOT         jmp if end of table
0000:0643 803C00      CMP     BYTE PTR [SI],00  is this an inactive entry?
0000:0646 74F4        JZ      SEARCH_LOOP2      yes

          NOT_ACTIVE:                        MORE THAN ONE ACTIVE ENTRY FOUND

0000:0648 BE8B06      MOV     SI,068B           display "Invld prttn tbl"

         DISPLAY_MSG:                        DISPLAY MESSAGE LOOP

0000:064B AC          LODSB                     get char of message
0000:064C 3C00        CMP     AL,00             end of message
0000:064E 740B        JZ      HANG              yes
0000:0650 56          PUSH    SI                save SI
0000:0651 BB0700      MOV     BX,0007           screen attributes
0000:0654 B40E        MOV     AH,0E             output 1 char of message
0000:0656 CD10        INT     10                   to the display
0000:0658 5E          POP     SI                restore SI
0000:0659 EBF0        JMP     DISPLAY_MSG       do it again

                HANG:                        HANG THE SYSTEM LOOP

0000:065B EBFE        JMP     HANG              sit and stay!

           READ_BOOT:                        READ ACTIVE PARITION BOOT RECORD

0000:065D BF0500      MOV     DI,0005           INT 13 retry count

           INT13RTRY:                        INT 13 RETRY LOOP

0000:0660 BB007C      MOV     BX,7C00
0000:0663 B80102      MOV     AX,0201           read 1 sector
0000:0666 57          PUSH    DI                save DI
0000:0667 CD13        INT     13                read sector into 0000:7c00
0000:0669 5F          POP     DI                restore DI
0000:066A 730C        JNB     INT13OK           jmp if no INT 13
0000:066C 33C0        XOR     AX,AX             call INT 13 and
0000:066E CD13        INT     13                   do disk reset
0000:0670 4F          DEC     DI                decr DI
0000:0671 75ED        JNZ     INT13RTRY         if not zero, try again
0000:0673 BEA306      MOV     SI,06A3           display "Errr ldng systm"
0000:0676 EBD3        JMP     DISPLAY_MSG       jmp to display loop

             INT13OK:                        INT 13 ERROR

0000:0678 BEC206      MOV     SI,06C2              "missing op sys"
0000:067B BFFE7D      MOV     DI,7DFE              point to signature
0000:067E 813D55AA    CMP     WORD PTR [DI],AA55   is signature correct?
0000:0682 75C7        JNZ     DISPLAY_MSG          no
0000:0684 8BF5        MOV     SI,BP                set SI
0000:0686 EA007C0000  JMP     0000:7C00            JUMP TO THE BOOT SECTOR
                                                      WITH SI POINTING TO
                                                      PART TABLE ENTRY

Messages here.

0000:0680 ........ ........ ......49 6e76616c *           Inval*
0000:0690 69642070 61727469 74696f6e 20746162 *id partition tab*
0000:06a0 6c650045 72726f72 206c6f61 64696e67 *le.Error loading*
0000:06b0 206f7065 72617469 6e672073 79737465 * operating syste*
0000:06c0 6d004d69 7373696e 67206f70 65726174 *m.Missing operat*
0000:06d0 696e6720 73797374 656d00.. ........ *ing system.     *

Data not used.

0000:06d0 ........ ........ ......00 00000000 *           .....*
0000:06e0 00000000 00000000 00000000 00000000 *................*
0000:06f0 00000000 00000000 00000000 00000000 *................*
0000:0700 00000000 00000000 00000000 00000000 *................*
0000:0710 00000000 00000000 00000000 00000000 *................*
0000:0720 00000000 00000000 00000000 00000000 *................*
0000:0730 00000000 00000000 00000000 00000000 *................*
0000:0740 00000000 00000000 00000000 00000000 *................*
0000:0750 00000000 00000000 00000000 00000000 *................*
0000:0760 00000000 00000000 00000000 00000000 *................*
0000:0770 00000000 00000000 00000000 00000000 *................*
0000:0780 00000000 00000000 00000000 00000000 *................*
0000:0790 00000000 00000000 00000000 00000000 *................*
0000:07a0 00000000 00000000 00000000 00000000 *................*
0000:07b0 00000000 00000000 00000000 0000.... *............    *

The partition table starts at 0000:07be.  Each partition table
entry is 16 bytes.  This table defines a single primary partition
which is also an active (bootable) partition.

0000:07b0 ........ ........ ........ ....8001 *            ....*
0000:07c0 0100060d fef83e00 00000678 0d000000 *......>....x....*
0000:07d0 00000000 00000000 00000000 00000000 *................*
0000:07e0 00000000 00000000 00000000 00000000 *................*
0000:07f0 00000000 00000000 00000000 0000.... *............    *

The last two bytes contain a 55AAH signature.

0000:07f0 ........ ........ ........ ....55aa *..............U.*

---------------------------------------------------------------------

           How It Works -- DOS Floppy Disk Boot Sector

                           Version 1a

             by Hale Landis (landis@sugs.tware.com)


THE "HOW IT WORKS" SERIES

This is one of several How It Works documents.  The series
currently includes the following:

* How It Works -- CHS Translation
* How It Works -- Master Boot Record
* How It Works -- DOS Floppy Boot Sector
* How It Works -- OS2 Boot Sector
* How It Works -- Partition Tables


DOS FLOPPY DISK BOOT SECTOR

This article is a disassembly of a floppy disk boot sector for a
DOS floppy.  The boot sector of a floppy disk is located at
cylinder 0, head 0, sector 1. This sector is created by a floppy
disk formating program, such as the DOS FORMAT program.  The boot
sector of a FAT hard disk partition has a similar layout and
function.  Basically a bootable FAT hard disk partition looks
like a big floppy during the early stages of the system's boot
processing.

At the completion of your system's Power On Self Test (POST), INT
19 is called.  Usually INT 19 tries to read a boot sector from
the first floppy drive.  If a boot sector is found on the floppy
disk, the that boot sector is read into memory at location
0000:7C00 and INT 19 jumps to memory location 0000:7C00.
However, if no boot sector is found on the first floppy drive,
INT 19 tries to read the MBR from the first hard drive.  If an
MBR is found it is read into memory at location 0000:7c00 and INT
19 jumps to memory location 0000:7c00.  The small program in the
MBR will attempt to locate an active (bootable) partition in its
partition table.  If such a partition is found, the boot sector
of that partition is read into memory at location 0000:7C00 and
the MBR program jumps to memory location 0000:7C00.  Each
operating system has its own boot sector format.  The small
program in the boot sector must locate the first part of the
operating system's kernel loader program (or perhaps the kernel
itself or perhaps a "boot manager program") and read that into
memory.

INT 19 is also called when the CTRL-ALT-DEL keys are used.  On
most systems, CTRL-ALT-DEL causes an short version of the POST to
be executed before INT 19 is called.

=====

Where stuff is:

   The BIOS Parameter Block (BPB) starts at offset 0.
   The boot sector program starts at offset 3e.
   The messages issued by this program start at offset 19e.
   The DOS hidden file names start at offset 1e6.
   The boot sector signature is at offset 1fe.

Here is a summary of what this thing does:

1) Copy Diskette Parameter Table which is pointed to by INT 1E.
2) Alter the copy of the Diskette Parameter Table.
3) Alter INT 1E to point to altered Diskette Parameter Table.
4) Do INT 13 AH=00, disk reset call.
5) Compute sector address of root directory.
6) Read first sector of root directory into 0000:0500.
7) Confirm that first two directory entries are for IO.SYS
   and MSDOS.SYS.
8) Read first 3 sectors of IO.SYS into 0000:0700 (or 0070:0000).
9) Leave some information in the registers and jump to
   IO.SYS at 0070:0000.

NOTE:

   This program uses the CHS based INT 13H AH=02 to read the FAT
   root directory and to read the IO.SYS file.  If the drive is
   >528MB, this CHS must be a translated CHS (or L-CHS, see my
   BIOS TYPES document).  Except for internal computations no
   addresses in LBA form are used, another reason why LBA doesn't
   solve the >528MB problem.

=====

Here is the entire sector in hex and ascii.

OFFSET 0 1 2 3  4 5 6 7  8 9 A B  C D E F  *0123456789ABCDEF*
000000 eb3c904d 53444f53 352e3000 02010100 *.<.MSDOS5.0.....*
000010 02e00040 0bf00900 12000200 00000000 *...@............*
000020 00000000 0000295a 5418264e 4f204e41 *......)ZT.&NO NA*
000030 4d452020 20204641 54313220 2020fa33 *ME    FAT12   .3*
000040 c08ed0bc 007c1607 bb780036 c5371e56 *.....|...x.6.7.V*
000050 1653bf3e 7cb90b00 fcf3a406 1fc645fe *.S.>|.........E.*
000060 0f8b0e18 7c884df9 894702c7 073e7cfb *....|.M..G...>|.*
000070 cd137279 33c03906 137c7408 8b0e137c *..ry3.9..|t....|*
000080 890e207c a0107cf7 26167c03 061c7c13 *.. |..|.&.|...|.*
000090 161e7c03 060e7c83 d200a350 7c891652 *..|...|....P|..R*
0000a0 7ca3497c 89164b7c b82000f7 26117c8b *|.I|..K|. ..&.|.*
0000b0 1e0b7c03 c348f7f3 0106497c 83164b7c *..|..H....I|..K|*
0000c0 00bb0005 8b16527c a1507ce8 9200721d *......R|.P|...r.*
0000d0 b001e8ac 0072168b fbb90b00 bee67df3 *.....r........}.*
0000e0 a6750a8d 7f20b90b 00f3a674 18be9e7d *.u... .....t...}*
0000f0 e85f0033 c0cd165e 1f8f048f 4402cd19 *._.3...^....D...*
000100 585858eb e88b471a 48488a1e 0d7c32ff *XXX...G.HH...|2.*
000110 f7e30306 497c1316 4b7cbb00 07b90300 *....I|..K|......*
000120 505251e8 3a0072d8 b001e854 00595a58 *PRQ.:.r....T.YZX*
000130 72bb0501 0083d200 031e0b7c e2e28a2e *r..........|....*
000140 157c8a16 247c8b1e 497ca14b 7cea0000 *.|..$|..I|.K|...*
000150 7000ac0a c07429b4 0ebb0700 cd10ebf2 *p....t).........*
000160 3b16187c 7319f736 187cfec2 88164f7c *;..|s..6.|....O|*
000170 33d2f736 1a7c8816 257ca34d 7cf8c3f9 *3..6.|..%|.M|...*
000180 c3b4028b 164d7cb1 06d2e60a 364f7c8b *.....M|.....6O|.*
000190 ca86e98a 16247c8a 36257ccd 13c30d0a *.....$|.6%|.....*
0001a0 4e6f6e2d 53797374 656d2064 69736b20 *Non-System disk *
0001b0 6f722064 69736b20 6572726f 720d0a52 *or disk error..R*
0001c0 65706c61 63652061 6e642070 72657373 *eplace and press*
0001d0 20616e79 206b6579 20776865 6e207265 * any key when re*
0001e0 6164790d 0a00494f 20202020 20205359 *ady...IO      SY*
0001f0 534d5344 4f532020 20535953 000055aa *SMSDOS   SYS..U.*

=====

The first 62 bytes of a boot sector are known as the BIOS
Parameter Block (BPB).  Here is the layout of the BPB fields
and the values they are assigned in this boot sector:

   db JMP instruction      at 7c00 size  2 = eb3c
   db NOP instruction         7c02       1   90
   db OEMname                 7c03       8   'MSDOS5.0'
   dw bytesPerSector          7c0b       2   0200
   db sectPerCluster          7c0d       1   01
   dw reservedSectors         7c0e       2   0001
   db numFAT                  7c10       1   02
   dw numRootDirEntries       7c11       2   00e0
   dw numSectors              7c13       2   0b40 (ignore numSectorsHuge)
   db mediaType               7c15       1   f0
   dw numFATsectors           7c16       2   0009
   dw sectorsPerTrack         7c18       2   0012
   dw numHeads                7c1a       2   0002
   dd numHiddenSectors        7c1c       4   00000000
   dd numSectorsHuge          7c20       4   00000000
   db driveNum                7c24       1   00
   db reserved                7c25       1   00
   db signature               7c26       1   29
   dd volumeID                7c27       4   5a541826
   db volumeLabel             7c2b      11   'NO NAME   '
   db fileSysType             7c36       8   'FAT12   '

=====

Here is the boot sector...

The first 3 bytes of the BPB are JMP and NOP instructions.

0000:7C00 EB3C        JMP     START
0000:7C02 90          NOP

Here is the rest of the BPB.

0000:7C00 ......4d 53444f53 352e3000 02010100 *   MSDOS5.0.....*
0000:7C10 02e00040 0bf00900 12000200 00000000 *...@............*
0000:7C20 00000000 0000295a 5418264e 4f204e41 *......)ZT.&NO NA*
0000:7C30 4d452020 20204641 54313220 2020.... *ME    FAT12     *

Now pay attention here...

   The 11 bytes starting at 0000:7c3e are immediately overlaid by
   information copied from another part of memory.  That
   information is the Diskette Parameter Table.  This data is
   pointed to by INT 1E.  This data is:

   7c3e = Step rate and head unload time.
   7c3f = Head load time and DMA mode flag.
   7c40 = Delay for motor turn off.
   7c41 = Bytes per sector.
   7c42 = Sectors per track.
   7c43 = Intersector gap length.
   7c44 = Data length.
   7c45 = Intersector gap length during format.
   7c46 = Format byte value.
   7c47 = Head settling time.
   7c48 = Delay until motor at normal speed.

   The 11 bytes starting at 0000:7c49 are also overlaid by the
   following data:

   7c49 - 7c4c = diskette sector address (as LBA)
                    of the data area.
   7c4d - 7c4e = cylinder number to read from.
   7c4f - 7c4f = sector number to read from.
   7c50 - 7c53 = diskette sector address (as LBA)
                    of the root directory.

               START:                        START OF BOOT SECTOR PROGRAM

0000:7C3E FA          CLI                          interrupts off
0000:7C3F 33C0        XOR     AX,AX                set AX to zero
0000:7C41 8ED0        MOV     SS,AX                SS is now zero
0000:7C43 BC007C      MOV     SP,7C00              SP is now 7c00
0000:7C46 16          PUSH    SS                   also set ES
0000:7C47 07          POP     ES                      to zero

                              The INT 1E vector is at 0000:0078.
                              Get the address that the vector points to
                              into the DS:SI registers.

0000:7C48 BB7800      MOV     BX,0078              BX is now 78
0000:7C4B 36          SS:
0000:7C4C C537        LDS     SI,[BX]              DS:SI is now [0:78]
0000:7C4E 1E          PUSH    DS                   save DS:SI --
0000:7C4F 56          PUSH    SI                      saves param tbl addr
0000:7C50 16          PUSH    SS                   save SS:BX --
0000:7C51 53          PUSH    BX                      saves INT 1E address

                              Move the diskette param table to 0000:7c3e.

0000:7C52 BF3E7C      MOV     DI,7C3E              DI is address of START
0000:7C55 B90B00      MOV     CX,000B              count is 11
0000:7C58 FC          CLD                          clear direction
0000:7C59 F3          REPZ                         move the diskette param
0000:7C5A A4          MOVSB                           table to 0000:7c3e
0000:7C5B 06          PUSH    ES                   also set DS
0000:7C5C 1F          POP     DS                      to zero

                              Alter some of the diskette param table data.

0000:7C5D C645FE0F    MOV     BYTE PTR [DI-02],0F  change head settle time
                                                      at 0000:7c47
0000:7C61 8B0E187C    MOV     CX,[7C18]            sectors per track
0000:7C65 884DF9      MOV     [DI-07],CL              save at 0000:7c42

                              Change INT 1E so that it points to the
                              altered Diskette param table at 0000:7c3e.

0000:7C68 894702      MOV     [BX+02],AX           change INT 1E segment
0000:7C6B C7073E7C    MOV     WORD PTR [BX],7C3E   change INT 1E offset

                              Call INT 13 with AX=0000, disk reset, so
                              that the new diskette param table is used.

0000:7C6F FB          STI                          interrupts on
0000:7C70 CD13        INT     13                   do diskette reset call
0000:7C72 7279        JB      TALK                 jmp if any error

                              Detemine the starting sector address of
                              the root directory as an LBA.

0000:7C74 33C0        XOR     AX,AX                AX is now zero
0000:7C76 3906137C    CMP     [7C13],AX            number sectros zero?
0000:7C7A 7408        JZ      SMALL_DISK           yes
0000:7C7C 8B0E137C    MOV     CX,[7C13]            number of sectors
0000:7C80 890E207C    MOV     [7C20],CX            save in huge num sects

         SMALL_DISK:

0000:7C84 A0107C      MOV     AL,[7C10]            number of FAT tables
0000:7C87 F726167C    MUL     WORD PTR [7C16]      number of fat sectors
0000:7C8B 03061C7C    ADD     AX,[7C1C]            number of hidden sectors
0000:7C8F 13161E7C    ADC     DX,[7C1E]            number of hidden sectors
0000:7C93 03060E7C    ADD     AX,[7C0E]            number of reserved sectors
0000:7C97 83D200      ADC     DX,+00               number of reserved sectors
0000:7C9A A3507C      MOV     [7C50],AX            save start addr
0000:7C9D 8916527C    MOV     [7C52],DX               of root dir (as LBA)
0000:7CA1 A3497C      MOV     [7C49],AX            save start addr
0000:7CA4 89164B7C    MOV     [7C4B],DX               of root dir (as LBA)

                              Determine sector address of first sector
                              in the data area as an LBA.

0000:7CA8 B82000      MOV     AX,0020              size of a dir entry (32)
0000:7CAB F726117C    MUL     WORD PTR [7C11]      number of root dir entries
0000:7CAF 8B1E0B7C    MOV     BX,[7C0B]            bytes per sector
0000:7CB3 03C3        ADD     AX,BX
0000:7CB5 48          DEC     AX
0000:7CB6 F7F3        DIV     BX
0000:7CB8 0106497C    ADD     [7C49],AX            add to start addr
0000:7CBC 83164B7C00  ADC     WORD PTR [7C4B],+00     of root dir (as LBA)

                              Read the first root dir sector into 0000:0500.

0000:7CC1 BB0005      MOV     BX,0500              addr to read into
0000:7CC4 8B16527C    MOV     DX,[7C52]            get start of address
0000:7CC8 A1507C      MOV     AX,[7C50]               of root dir (as LBA)
0000:7CCB E89200      CALL    CONVERT              call conversion routine
0000:7CCE 721D        JB      TALK                 jmp is any error
0000:7CD0 B001        MOV     AL,01                read 1 sector
0000:7CD2 E8AC00      CALL    READ_SECTORS         read 1st root dir sector
0000:7CD5 7216        JB      TALK                 jmp if any error
0000:7CD7 8BFB        MOV     DI,BX                addr of 1st dir entry
0000:7CD9 B90B00      MOV     CX,000B              count is 11
0000:7CDC BEE67D      MOV     SI,7DE6              addr of file names
0000:7CDF F3          REPZ                         is this "IO.SYS"?
0000:7CE0 A6          CMPSB
0000:7CE1 750A        JNZ     TALK                 no
0000:7CE3 8D7F20      LEA     DI,[BX+20]           addr of next dir entry
0000:7CE6 B90B00      MOV     CX,000B              count is 11
0000:7CE9 F3          REPZ                         is this "MSDOS.SYS"?
0000:7CEA A6          CMPSB
0000:7CEB 7418        JZ      FOUND_FILES          they are equal

               TALK:

                              Display "Non-System disk..." message,
                              wait for user to hit a key, restore
                              the INT 1E vector and then
                              call INT 19 to start boot processing
                              all over again.

0000:7CED BE9E7D      MOV     SI,7D9E              "Non-System disk..."
0000:7CF0 E85F00      CALL    MSG_LOOP             display message
0000:7CF3 33C0        XOR     AX,AX                INT 16 function
0000:7CF5 CD16        INT     16                   read keyboard
0000:7CF7 5E          POP     SI                   get INT 1E vector's
0000:7CF8 1F          POP     DS                      address
0000:7CF9 8F04        POP     [SI]                 restore the INT 1E
0000:7CFB 8F4402      POP     [SI+02]                 vector's data
0000:7CFE CD19        INT     19                   CALL INT 19 to try again

         SETUP_TALK:

0000:7D00 58          POP     AX                   pop junk off stack
0000:7D01 58          POP     AX                   pop junk off stack
0000:7D02 58          POP     AX                   pop junk off stack
0000:7D03 EBE8        JMP     TALK                 now talk to the user

        FOUND_FILES:

                              Compute the sector address of the first
                              sector of IO.SYS.

0000:7D05 8B471A      MOV     AX,[BX+1A]           get starting cluster num
0000:7D08 48          DEC     AX                   subtract 1
0000:7D09 48          DEC     AX                   subtract 1
0000:7D0A 8A1E0D7C    MOV     BL,[7C0D]            sectors per cluster
0000:7D0E 32FF        XOR     BH,BH
0000:7D10 F7E3        MUL     BX                   multiply
0000:7D12 0306497C    ADD     AX,[7C49]            add start addr of
0000:7D16 13164B7C    ADC     DX,[7C4B]               root dir (as LBA)

                              Read IO.SYS into memory at 0000:0700.  IO.SYS
                              is 3 sectors long.

0000:7D1A BB0007      MOV     BX,0700              address to read into
0000:7D1D B90300      MOV     CX,0003              read 3 sectors

          READ_LOOP:

                              Read the first 3 sectors of IO.SYS
                              (IO.SYS is much longer than 3 sectors).

0000:7D20 50          PUSH    AX                   save AX
0000:7D21 52          PUSH    DX                   save DX
0000:7D22 51          PUSH    CX                   save CX
0000:7D23 E83A00      CALL    CONVERT              call conversion routine
0000:7D26 72D8        JB      SETUP_TALK           jmp if error
0000:7D28 B001        MOV     AL,01                read one sector
0000:7D2A E85400      CALL    READ_SECTORS         read one sector
0000:7D2D 59          POP     CX                   restore CX
0000:7D2E 5A          POP     DX                   restore DX
0000:7D2F 58          POP     AX                   restore AX
0000:7D30 72BB        JB      TALK                 jmp if any INT 13 error
0000:7D32 050100      ADD     AX,0001              add one to the sector addr
0000:7D35 83D200      ADC     DX,+00               add one to the sector addr
0000:7D38 031E0B7C    ADD     BX,[7C0B]            incr mem addr by sect size
0000:7D3C E2E2        LOOP    READ_LOOP            read next sector

                              Leave information in the AX, BX, CX and DX
                              registers for IO.SYS to use.  Finally,
                              jump to IO.SYS at 0070:0000.

0000:7D3E 8A2E157C    MOV     CH,[7C15]            media type
0000:7D42 8A16247C    MOV     DL,[7C24]            drive number
0000:7D46 8B1E497C    MOV     BX,[7C49]            get start addr of
0000:7D4A A14B7C      MOV     AX,[7C4B]               root dir (as LBA)
0000:7D4D EA00007000  JMP     0070:0000            JUMP TO 0070:0000

               MSG_LOOP:

                              This routine displays a message using
                              INT 10 one character at a time.
                              The message address is in DS:SI.

0000:7D52 AC          LODSB                        get message character
0000:7D53 0AC0        OR      AL,AL                end of message?
0000:7D55 7429        JZ      RETURN               jmp if yes
0000:7D57 B40E        MOV     AH,0E                display one character
0000:7D59 BB0700      MOV     BX,0007              video attrbiutes
0000:7D5C CD10        INT     10                   display one character
0000:7D5E EBF2        JMP     MSG_LOOP             do again

            CONVERT:
                              This routine
                              converts a sector address (an LBA) to
                              a CHS address.  The LBA is in DX:AX.

0000:7D60 3B16187C    CMP     DX,[7C18]            hi part of LBA > sectPerTrk?
0000:7D64 7319        JNB     SET_CARRY            jmp if yes
0000:7D66 F736187C    DIV     WORD PTR [7C18]      div by sectors per track
0000:7D6A FEC2        INC     DL                   add 1 to sector number
0000:7D6C 88164F7C    MOV     [7C4F],DL            save sector number
0000:7D70 33D2        XOR     DX,DX                zero DX
0000:7D72 F7361A7C    DIV     WORD PTR [7C1A]      div number of heads
0000:7D76 8816257C    MOV     [7C25],DL            save head number
0000:7D7A A34D7C      MOV     [7C4D],AX            save cylinder number
0000:7D7D F8          CLC                          clear carry
0000:7D7E C3          RET                          return

          SET_CARRY:

0000:7D7F F9          STC                          set carry

             RETURN:

0000:7D80 C3          RET                          return

       READ_SECTORS:

                              The caller of this routine supplies:
                                 AL = number of sectors to read
                                 ES:BX = memory location to read into
                                 and CHS address to read from in
                                 memory locations 7c25 and 7C4d-7c4f.

0000:7D81 B402        MOV     AH,02                INT 13 read sectors
0000:7D83 8B164D7C    MOV     DX,[7C4D]            get cylinder number
0000:7D87 B106        MOV     CL,06                shift count
0000:7D89 D2E6        SHL     DH,CL                shift upper cyl left 6 bits
0000:7D8B 0A364F7C    OR      DH,[7C4F]            or in sector number
0000:7D8F 8BCA        MOV     CX,DX                move to CX
0000:7D91 86E9        XCHG    CH,CL                CH=cyl lo, CL=cyl hi + sect
0000:7D93 8A16247C    MOV     DL,[7C24]            drive number
0000:7D97 8A36257C    MOV     DH,[7C25]            head number
0000:7D9B CD13        INT     13                   read sectors
0000:7D9D C3          RET                          return

Data not used.

0000:7D90 ca86e98a 16247c8a 36257ccd 13c3.... *.....$|.6%|...  *

Messages here.

0000:7D90 ........ ........ ........ ....0d0a *              ..*
0000:7Da0 4e6f6e2d 53797374 656d2064 69736b20 *Non-System disk *
0000:7Db0 6f722064 69736b20 6572726f 720d0a52 *or disk error..R*
0000:7Dc0 65706c61 63652061 6e642070 72657373 *eplace and press*
0000:7Dd0 20616e79 206b6579 20776865 6e207265 * any key when re*
0000:7De0 6164790d 0a00.... ........ ........ *ady...          *

MS DOS hidden file names (first two root directory entries).

0000:7De0 ........ ....494f 20202020 20205359 *      IO      SY*
0000:7Df0 534d5344 4f532020 20535953 000055aa *SMSDOS   SYS..U.*

The last two bytes contain a 55AAH signature.

0000:7Df0 ........ ........ ........ ....55aa *              U.*

---------------------------------------------------------------------

                How It Works -- OS2 Boot Sector

                           Version 1a

             by Hale Landis (landis@sugs.tware.com)


THE "HOW IT WORKS" SERIES

This is one of several How It Works documents.  The series
currently includes the following:

* How It Works -- CHS Translation
* How It Works -- Master Boot Record
* How It Works -- DOS Floppy Boot Sector
* How It Works -- OS2 Boot Sector
* How It Works -- Partition Tables


OS2 BOOT SECTOR

Note:  I'll leave it to someone else to provide you with a
disassembly of an OS/2 HPFS boot sector, or a Linux boot sector,
or a WinNT boot sector, etc.

This article is a disassembly of a floppy or hard disk boot
sector for OS/2.  Apparently OS/2 uses the same boot sector for
both environments.  Basically a bootable FAT hard disk partition
looks like a big floppy during the early stages of the system's
boot processing.  This sector is at cylinder 0, head 0, sector 1
of a floppy or it is the first sector within a FAT hard disk
partition.  OS/2 floppy disk and hard disk boot sectors are
created by the OS/2 FORMAT program.

At the completion of your system's Power On Self Test (POST), INT
19 is called.  Usually INT 19 tries to read a boot sector from
the first floppy drive.  If a boot sector is found on the floppy
disk, the that boot sector is read into memory at location
0000:7C00 and INT 19 jumps to memory location 0000:7C00.
However, if no boot sector is found on the first floppy drive,
INT 19 tries to read the MBR from the first hard drive.  If an
MBR is found it is read into memory at location 0000:7c00 and INT
19 jumps to memory location 0000:7c00.  The small program in the
MBR will attempt to locate an active (bootable) partition in its
partition table.  If such a partition is found, the boot sector
of that partition is read into memory at location 0000:7C00 and
the MBR program jumps to memory location 0000:7C00.  Each
operating system has its own boot sector format.  The small
program in the boot sector must locate the first part of the
operating system's kernel loader program (or perhaps the kernel
itself or perhaps a "boot manager program") and read that into
memory.

INT 19 is also called when the CTRL-ALT-DEL keys are used.  On
most systems, CTRL-ALT-DEL causes an short version of the POST to
be executed before INT 19 is called.

=====

Where stuff is:

   The BIOS Parameter Block (BPB) starts at offset 0.
   The boot sector program starts at offset 46.
   The messages issued by this program start at offset 198.
   The OS/2 boot loader file name starts at offset 1d5.
   The boot sector signature is at offset 1fe.

Here is a summary of what this thing does:

 1) If booting from a hard disk partition, skip to step 6.
 2) Copy Diskette Parameter Table which is pointed to by INT 1E
    to the top of memory.
 3) Alter the copy of the Diskette Parameter Table.
 4) Alter INT 1E to point to altered Diskette Parameter Table at
    the top of memory.
 5) Do INT 13 AH=00, disk reset call so that the altered
    Diskette Parameter Table is used.
 6) Compute sector address of the root directory.
 7) Read the entire root directory into memory starting at
    location 1000:0000.
 8) Search the root directory entires for the file OS2BOOT.
 9) Read the OS2BOOT file into memory at 0800:0000.
10) Do a far return to enter the OS2BOOT program at 0800:0000.

NOTES:

   This program uses the CHS based INT 13H AH=02 to read the FAT
   root directory and to read the OS2BOOT file.  If the drive is
   >528MB, this CHS must be a translated CHS (or L-CHS, see my
   BIOS TYPES document).  Except for internal computations no
   addresses in LBA form are used, another reason why LBA doesn't
   solve the >528MB problem.

=====

Here is the entire sector in hex and ascii.

OFFSET 0 1 2 3  4 5 6 7  8 9 A B  C D E F  *0123456789ABCDEF*
000000 eb449049 424d2032 302e3000 02100100 *.D.IBM 20.0.....*
000010 02000200 00f8d800 3e000e00 3e000000 *........>...>...*
000020 06780d00 80002900 1c0c234e 4f204e41 *.x....)...#NO NA*
000030 4d452020 20204641 54202020 20200000 *ME    FAT     ..*
000040 00100000 0000fa33 db8ed3bc ff7bfbba *.......3.....{..*
000050 c0078eda 803e2400 00753d1e b840008e *.....>$..u=..@..*
000060 c026ff0e 1300cd12 c1e0068e c033ff33 *.&...........3.3*
000070 c08ed8c5 367800fc b90b00f3 a41fa118 *....6x..........*
000080 0026a204 001e33c0 8ed8a378 008c067a *.&....3....x...z*
000090 001f8a16 2400cd13 a0100098 f7261600 *....$........&..*
0000a0 03060e00 5091b820 00f72611 008b1e0b *....P.. ..&.....*
0000b0 0003c348 f7f35003 c1a33e00 b800108e *...H..P...>.....*
0000c0 c033ff59 890e4400 58a34200 33d2e873 *.3.Y..D.X.B.3..s*
0000d0 0033db8b 0e11008b fb51b90b 00bed501 *.3.......Q......*
0000e0 f3a65974 0583c320 e2ede335 268b471c *..Yt... ...5&.G.*
0000f0 268b571e f7360b00 fec08ac8 268b571a *&.W..6......&.W.*
000100 4a4aa00d 0032e4f7 e203063e 0083d200 *JJ...2.....>....*
000110 bb00088e c333ff06 57e82800 8d360b00 *.....3..W.(..6..*
000120 cbbe9801 eb03bead 01e80900 bec201e8 *................*
000130 0300fbeb feac0ac0 7409b40e bb0700cd *........t.......*
000140 10ebf2c3 50525103 061c0013 161e00f7 *....PRQ.........*
000150 361800fe c28ada33 d2f7361a 008afa8b *6......3..6.....*
000160 d0a11800 2ac34050 b402b106 d2e60af3 *....*.@P........*
000170 8bca86e9 8a162400 8af78bdf cd1372a6 *......$.......r.*
000180 5b598bc3 f7260b00 03f85a58 03c383d2 *[Y...&....ZX....*
000190 002acb7f afc31200 4f532f32 20212120 *.*......OS/2 !! *
0001a0 53595330 31343735 0d0a0012 004f532f *SYS01475.....OS/*
0001b0 32202121 20535953 30323032 350d0a00 *2 !! SYS02025...*
0001c0 12004f53 2f322021 21205359 53303230 *..OS/2 !! SYS020*
0001d0 32370d0a 004f5332 424f4f54 20202020 *27...OS2BOOT    *
0001e0 00000000 00000000 00000000 00000000 *................*
0001f0 00000000 00000000 00000000 000055aa *..............U.*

=====

The first 62 bytes of a boot sector are known as the BIOS
Parameter Block (BPB).  Here is the layout of the BPB fields
and the values they are assigned in this boot sector:

   db JMP instruction      at 7c00 size  2 = eb44
   db NOP instruction         7c02       1   90
   db OEMname                 7c03       8   'IBM 20.0'
   dw bytesPerSector          7c0b       2   0200
   db sectPerCluster          7c0d       1   01
   dw reservedSectors         7c0e       2   0001
   db numFAT                  7c10       1   02
   dw numRootDirEntries       7c11       2   0200
   dw numSectors              7c13       2   0000 (use numSectorsHuge)
   db mediaType               7c15       1   f8
   dw numFATsectors           7c16       2   00d8
   dw sectorsPerTrack         7c18       2   003e
   dw numHeads                7c1a       2   000e
   dd numHiddenSectors        7c1c       4   00000000
   dd numSectorsHuge          7c20       4   000d7806
   db driveNum                7c24       1   80
   db reserved                7c25       1   00
   db signature               7c26       1   29
   dd volumeID                7c27       4   001c0c23
   db volumeLabel             7c2b      11   'NO NAME   '
   db fileSysType             7c36       8   'FAT     '

=====

Here is the boot sector...

The first 3 bytes of the BPB are JMP and NOP instructions.

0000:7C00 EB44        JMP     START
0000:7C02 90          NOP

Here is the rest of the BPB.

0000:7C00 eb449049 424d2032 302e3000 02100100 *.D.IBM 20.0.....*
0000:7C10 02000200 00f8d800 3e000e00 3e000000 *........>...>...*
0000:7C20 06780d00 80002900 1c0c234e 4f204e41 *.x....)...#NO NA*
0000:7C30 4d452020 20204641 54202020 20200000 *ME    FAT     ..*

Additional data areas.

0000:7C30 ........ ........ ........ ....0000 *              ..*
0000:7C40 00100000 0000.... ........ ........ *......          *

   Note:

   0000:7c3e (DS:003e) = number of sectors in the FATs and root dir.
   0000:7c42 (DS:0042) = number of sectors in the FAT.
   0000:7c44 (DS:0044) = number of sectors in the root dir.

               START:                        START OF BOOT SECTOR PROGRAM

0000:7C46 FA          CLI                          interrupts off
0000:7C47 33DB        XOR     BX,BX                zero BX
0000:7C49 8ED3        MOV     SS,BX                SS now zero
0000:7C4B BCFF7B      MOV     SP,7BFF              SP now 7bff
0000:7C4E FB          STI                          interrupts on
0000:7C4F BAC007      MOV     DX,07C0              set DX to
0000:7C52 8EDA        MOV     DS,DX                   07c0

                              Are we booting from a floppy or a
                              hard disk partition?

0000:7C54 803E240000  CMP     BYTE PTR [0024],00   is driveNum in BPB 00?
0000:7C59 753D        JNZ     NOT_FLOPPY           jmp if not zero

                              We are booting from a floppy.  The
                              Diskette Parameter Table must be
                              copied and altered...

   Diskette Parameter Table is pointed to by INT 1E.  This
   program moves this table to high memory, alters the table, and
   changes INT 1E to point to the altered table.

   This table contains the following data:

   ????:0000 = Step rate and head unload time.
   ????:0001 = Head load time and DMA mode flag.
   ????:0002 = Delay for motor turn off.
   ????:0003 = Bytes per sector.
   ????:0004 = Sectors per track.
   ????:0005 = Intersector gap length.
   ????:0006 = Data length.
   ????:0007 = Intersector gap length during format.
   ????:0008 = Format byte value.
   ????:0009 = Head settling time.
   ????:000a = Delay until motor at normal speed.

                              Compute a valid high memory address.

0000:7C5B 1E          PUSH    DS                   save DS
0000:7C5C B84000      MOV     AX,0040              set ES
0000:7C5F 8EC0        MOV     ES,AX                   to 0040 (BIOS data area)
0000:7C61 26          ES:                          reduce system memory
0000:7C62 FF0E1300    DEC     WORD PTR [0013]         size by 1024
0000:7C66 CD12        INT     12                   get system memory size
0000:7C68 C1E06       SHL     AX,06                shift AX (mult by 64)
0000:7C6B 8EC0        MOV     ES,AX                move to ES
0000:7C6D 33FF        XOR     DI,DI                zero DI

                              Move the diskette param table to high memory.

0000:7C6F 33C0        XOR     AX,AX                zero AX
0000:7C71 8ED8        MOV     DS,AX                DS now zero
0000:7C73 C5367800    LDS     SI,[0078]            DS:SI = INT 1E vector
0000:7C77 FC          CLD                          clear direction
0000:7C78 B90B00      MOV     CX,000B              count is 11
0000:7C7B F3          REPZ                         copy diskette param table
0000:7C7C A4          MOVSB                           to top of memory

                              Alter the number of sectors per track
                              in the diskette param table in high memory.

0000:7C7D 1F          POP     DS                   restore DS
0000:7C7E A11800      MOV     AX,[0018]            get sectorsPerTrack from BPB
0000:7C81 26          ES:                          alter sectors per track
0000:7C82 A20400      MOV     [0004],AL               in diskette param table

                              Change INT 1E to point to altered diskette
                              param table and do a INT 13 disk reset call.

0000:7C85 1E          PUSH    DS                   save DS
0000:7C86 33C0        XOR     AX,AX                AX now zero
0000:7C88 8ED8        MOV     DS,AX                DS no zero
0000:7C8A A37800      MOV     [0078],AX            alter INT 1E vector
0000:7C8D 8C067A00    MOV     [007A],ES               to point to altered
                                                      diskette param table
0000:7C91 1F          POP     DS                   restore DS
0000:7C92 8A162400    MOV     DL,[0024]            driveNum from BPB
0000:7C96 CD13        INT     13                   diskette reset

         NOT_FLOPPY:

                              Compute the location and the size of
                              the root directory.  Read the entire
                              root directory into memory.

0000:7C98 A01000      MOV     AL,[0010]            get numFAT
0000:7C9B 98          CBW                          make into a word
0000:7C9C F7261600    MUL     WORD PTR [0016]      mult by numFatSectors
0000:7CA0 03060E00    ADD     AX,[000E]            add reservedSectors
0000:7CA4 50          PUSH    AX                   save
0000:7CA5 91          XCHG    CX,AX                move to CX
0000:7CA6 B82000      MOV     AX,0020              dir entry size
0000:7CA9 F7261100    MUL     WORD PTR [0011]      mult by numRootDirEntries
0000:7CAD 8B1E0B00    MOV     BX,[000B]            get bytesPerSector
0000:7CB1 03C3        ADD     AX,BX                add
0000:7CB3 48          DEC     AX                   subtract 1
0000:7CB4 F7F3        DIV     BX                   div by bytesPerSector
0000:7CB6 50          PUSH    AX                   save number of dir sectors
0000:7CB7 03C1        ADD     AX,CX                add number of fat sectors
0000:7CB9 A33E00      MOV     [003E],AX            save
0000:7CBC B80010      MOV     AX,1000              AX is now 1000
0000:7CBF 8EC0        MOV     ES,AX                ES is now 1000
0000:7CC1 33FF        XOR     DI,DI                DI is now zero
0000:7CC3 59          POP     CX                   get number dir sectors
0000:7CC4 890E4400    MOV     [0044],CX            save
0000:7CC8 58          POP     AX                   get number fat sectors
0000:7CC9 A34200      MOV     [0042],AX            save
0000:7CCC 33D2        XOR     DX,DX                DX now zero
0000:7CCE E87300      CALL    READ_SECTOR          read 1st sect of root dir
0000:7CD1 33DB        XOR     BX,BX                BX is now zero
0000:7CD3 8B0E1100    MOV     CX,[0011]            number of root dir entries

         DIR_SEARCH:                         SEARCH FOR OS2BOOT.

                              Search the root directory for the file
                              name OS2BOOT.

0000:7CD7 8BFB        MOV     DI,BX                DI is dir entry addr
0000:7CD9 51          PUSH    CX                   save CX
0000:7CDA B90B00      MOV     CX,000B              count is 11
0000:7CDD BED501      MOV     SI,01D5              addr of "OS2BOOT"
0000:7CE0 F3          REPZ                         is 1st dir entry
0000:7CE1 A6          CMPSB                           for "OS2BOOT"?
0000:7CE2 59          POP     CX                   restore CX
0000:7CE3 7405        JZ      FOUND_OS2BOOT        jmp if OS2BOOT
0000:7CE5 83C320      ADD     BX,+20               incr to next dir entry
0000:7CE8 E2ED        LOOP    DIR_SEARCH           try again

      FOUND_OS2BOOT:                         FOUND OS2BOOT.

                              OS2BOOT was found.  Get the starting
                              cluster number and convert to a sector
                              address.  Read OS2BOOT into memory and
                              finally do a far return to enter
                              the OS2BOOT program.

0000:7CEA E335        JCXZ    FAILED1              JMP if CX zero.
0000:7CEC 26          ES:                          get the szie of
0000:7CED 8B471C      MOV     AX,[BX+1C]              the OS2BOOT file
0000:7CF0 26          ES:                             from the OS2BOOT
0000:7CF1 8B571E      MOV     DX,[BX+1E]              directory entry
0000:7CF4 F7360B00    DIV     WORD PTR [000B]      div by bytesPerSect
0000:7CF8 FEC0        INC     AL                   add 1
0000:7CFA 8AC8        MOV     CL,AL                num sectors OS2BOOT
0000:7CFC 26          ES:                          get the starting
0000:7CFD 8B571A      MOV     DX,[BX+1A]              cluster number
0000:7D00 4A          DEC     DX                   subtract 1
0000:7D01 4A          DEC     DX                   subtract 1
0000:7D02 A00D00      MOV     AL,[000D]            sectorsPerCluster
0000:7D05 32E4        XOR     AH,AH                mutiply
0000:7D07 F7E2        MUL     DX                      to get LBA
0000:7D09 03063E00    ADD     AX,[003E]            add number of FAT sectors
0000:7D0D 83D200      ADC     DX,+00                  to LBA
0000:7D10 BB0008      MOV     BX,0800              set ES
0000:7D13 8EC3        MOV     ES,BX                   to 0800
0000:7D15 33FF        XOR     DI,DI                set ES:DI to entry point
0000:7D17 06          PUSH    ES                      address of
0000:7D18 57          PUSH    DI                         OS2BOOT
0000:7D19 E82800      CALL    READ_SECTOR          read OS2BOOT into memory
0000:7D1C 8D360B00    LEA     SI,[000B]            set DS:SI
0000:7D20 CB          RETF                         "far return" to OS2BOOT

            FAILED1:                            OS2BOOT WAS NOT FOUND.

0000:7D21 BE9801      MOV     SI,0198              "SYS01475" message
0000:7D24 EB03        JMP     FAILED3

            FAILED2:                            ERROR FROM INT 13.

0000:7D26 BEAD01      MOV     SI,01AD              "SYS02025" message

            FAILED3:                            OUTPUT ERROR MESSAGES.

0000:7D29 E80900      CALL    MSG_LOOP             display message
0000:7D2C BEC201      MOV     SI,01C2              "SYS02027" message
0000:7D2F E80300      CALL    MSG_LOOP             display message
0000:7D32 FB          STI                          interrupts on

               HANG:                            HANG THE SYSTEM!

0000:7D33 EBFE        JMP     HANG                 sit and stay!

           MSG_LOOP:                         DISPLAY AN ERROR MESSAGE.

                              Routine to display the message
                              text pointed to by SI.

0000:7D35 AC          LODSB                        get next char of message
0000:7D36 0AC0        OR      AL,AL                end of message?
0000:7D38 7409        JZ      RETURN               jmp if yes
0000:7D3A B40E        MOV     AH,0E                write 1 char
0000:7D3C BB0700      MOV     BX,0007              video attributes
0000:7D3F CD10        INT     10                   INT 10 to write 1 char
0000:7D41 EBF2        JMP     MSG_LOOP             do again

             RETURN:

0000:7D43 C3          RET                          return

       READ_SECTOR:                          ROUTINE TO READ SECTORS.

                              Read sectors into memory.  Read multiple
                              sectors but don't read across a track
                              boundary.

                              The caller supplies the following:
                                 DX:AX = sector address to read (as LBA)
                                    CX = number of sectors to read
                                 ES:DI = memory address to read into

0000:7D44 50          PUSH    AX                   save lower part of LBA
0000:7D45 52          PUSH    DX                   save upper part of LBA
0000:7D46 51          PUSH    CX                   save number of sect to read
0000:7D47 03061C00    ADD     AX,[001C]            add numHiddenSectors
0000:7D4B 13161E00    ADC     DX,[001E]               to LBA
0000:7D4F F7361800    DIV     WORD PTR [0018]      div by sectorsPerTrack
0000:7D53 FEC2        INC     DL                   add 1 to sector number
0000:7D55 8ADA        MOV     BL,DL                save sector number
0000:7D57 33D2        XOR     DX,DX                zero upper part of LBA
0000:7D59 F7361A00    DIV     WORD PTR [001A]      div by numHeads
0000:7D5D 8AFA        MOV     BH,DL                save head number
0000:7D5F 8BD0        MOV     DX,AX                save cylinder number
0000:7D61 A11800      MOV     AX,[0018]            sectorsPerTrack
0000:7D64 2AC3        SUB     AL,BL                sub sector number
0000:7D66 40          INC     AX                   add 1
0000:7D67 50          PUSH    AX                   save number of sector to rea
d
0000:7D68 B402        MOV     AH,02                INT 13 read sectors
0000:7D6A B106        MOV     CL,06                shift count
0000:7D6C D2E6        SHL     DH,CL                shift high cyl left
0000:7D6E 0AF3        OR      DH,BL                or in sector number
0000:7D70 8BCA        MOV     CX,DX                move cyl/sect to CX
0000:7D72 86E9        XCHG    CH,CL                swap cyl/sect
0000:7D74 8A162400    MOV     DL,[0024]            driveNum
0000:7D78 8AF7        MOV     DH,BH                head number
0000:7D7A 8BDF        MOV     BX,DI                memory addr to read into
0000:7D7C CD13        INT     13                   INT 13 read sectors call
0000:7D7E 72A6        JB      FAILED2              jmp if any error
0000:7D80 5B          POP     BX                   get number of sectors read
0000:7D81 59          POP     CX                   restore CX
0000:7D82 8BC3        MOV     AX,BX                number of sector to AX
0000:7D84 F7260B00    MUL     WORD PTR [000B]      multiply by sector size
0000:7D88 03F8        ADD     DI,AX                add to memory address
0000:7D8A 5A          POP     DX                   restore upper part of LBA
0000:7D8B 58          POP     AX                   resotre lower part of LBA
0000:7D8C 03C3        ADD     AX,BX                add number of sector just
0000:7D8E 83D200      ADC     DX,+00                  read to LBA
0000:7D91 2ACB        SUB     CL,BL                decr requested num of sect
0000:7D93 7FAF        JG      READ_SECTOR          jmp if not zero
0000:7D95 C3          RET                          return

Data not used.

0000:7D90 ........ ....1200 ........ ........ *      ..        *

Messages here.

0000:7D90 ........ ........ 4f532f32 20212120 *        OS/2 !! *
0000:7Da0 53595330 31343735 0d0a0012 004f532f *SYS01475.....OS/*
0000:7Db0 32202121 20535953 30323032 350d0a00 *2 !! SYS02025...*
0000:7Dc0 12004f53 2f322021 21205359 53303230 *..OS/2 !! SYS020*
0000:7Dd0 32370d0a 00...... ........ ........ *27...           *

OS/2 loader file name.

0000:7Dd0 ........ ..4f5332 424f4f54 20202020 *     OS2BOOT    *

Data not used.

0000:7De0 00000000 00000000 00000000 00000000 *................*
0000:7Df0 00000000 00000000 00000000 0000.... *..............  *

The last two bytes contain a 55AAH signature.

0000:7Df0 ........ ........ ........ ....55aa *              U.*

