PXE entry invalid, so PXE boot hangs

[Stephen Borrill <netbsd%precedence.co.uk@localhost>]

I'm trying to PXE boot an x86 box. The setup works fine on all my other 
kit, but on the problem one I see:

booting netbsd - starting in 0 seconds.
pxe_init: bad cksum (0xbc) for PXENV+ at 0x900d8
PXE BIOS Version 2.1
*hang*

I'm prepared for a flaky BIOS, but it does boot pxelinux and Citrix 
Provisioning Services OK.

Adding a few printfs, I see it found PXENV+ at two locations: 0x900d8 
(rejected as bad checksum) and 0x8bb52. PXE+ was found at 0x8baf2. As it's 
PXE BIOS 2.1, it ignores the PXENV+ info. The hang is because it never 
returns from this call:

pxe_call(PXENV_GET_CACHED_INFO);

http://nxr.netbsd.org/xref/src/sys/arch/i386/stand/pxeboot/pxe.c#380

pxelinux uses 5 methods in priority order to find the pxe structure. 
NetBSD only uses a memory scan which is combination of its final 2 (it 
calls these plans D and E).

pxelinux prints:
!PXE entry point found (we hope) at 8A44:0100 via plan A

http://git.kernel.org/cgit/boot/syslinux/syslinux.git/tree/core/fs/pxe/bios.c?id=a7f5892c4d85f3685708b8efb237c9c73a8b1ddf#n240

These addresses correspond to bangpxe_seg and bangpxe_off:
http://nxr.netbsd.org/xref/src/sys/arch/i386/stand/pxeboot/pxe.c#360

Printing these shows that bangpxe_reg is 0, not 0x8a44. Hardwiring 
bangpxe_reg to 0x8a44 gets the machine booting (well, the kernel panics 
later on, but that's a different story).

Therefore, it looks like the structure found by memory scanning is 
incorrect and perhaps we should implement Linux's plans A and B (C being 
the int 0x1a function 0x5650 that we explicitly choose not to support). 
These involve reading points from offsets relative to InitStack. Where 
does this correspond to in NetBSD?

--
Stephen