Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | THE LINUX/I386 BOOT PROTOCOL |
| 2 | ---------------------------- |
| 3 | |
| 4 | H. Peter Anvin <hpa@zytor.com> |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 5 | Last update 2007-05-07 |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 6 | |
| 7 | On the i386 platform, the Linux kernel uses a rather complicated boot |
| 8 | convention. This has evolved partially due to historical aspects, as |
| 9 | well as the desire in the early days to have the kernel itself be a |
| 10 | bootable image, the complicated PC memory model and due to changed |
| 11 | expectations in the PC industry caused by the effective demise of |
| 12 | real-mode DOS as a mainstream operating system. |
| 13 | |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 14 | Currently, the following versions of the Linux/i386 boot protocol exist. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 15 | |
| 16 | Old kernels: zImage/Image support only. Some very early kernels |
| 17 | may not even support a command line. |
| 18 | |
| 19 | Protocol 2.00: (Kernel 1.3.73) Added bzImage and initrd support, as |
| 20 | well as a formalized way to communicate between the |
| 21 | boot loader and the kernel. setup.S made relocatable, |
| 22 | although the traditional setup area still assumed |
| 23 | writable. |
| 24 | |
| 25 | Protocol 2.01: (Kernel 1.3.76) Added a heap overrun warning. |
| 26 | |
| 27 | Protocol 2.02: (Kernel 2.4.0-test3-pre3) New command line protocol. |
| 28 | Lower the conventional memory ceiling. No overwrite |
| 29 | of the traditional setup area, thus making booting |
| 30 | safe for systems which use the EBDA from SMM or 32-bit |
| 31 | BIOS entry points. zImage deprecated but still |
| 32 | supported. |
| 33 | |
| 34 | Protocol 2.03: (Kernel 2.4.18-pre1) Explicitly makes the highest possible |
| 35 | initrd address available to the bootloader. |
| 36 | |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 37 | Protocol 2.04: (Kernel 2.6.14) Extend the syssize field to four bytes. |
Bernhard Walle | 8f9aeca | 2007-05-02 19:27:10 +0200 | [diff] [blame] | 38 | |
Vivek Goyal | be274ee | 2006-12-07 02:14:04 +0100 | [diff] [blame] | 39 | Protocol 2.05: (Kernel 2.6.20) Make protected mode kernel relocatable. |
| 40 | Introduce relocatable_kernel and kernel_alignment fields. |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 41 | |
Bernhard Walle | 8f9aeca | 2007-05-02 19:27:10 +0200 | [diff] [blame] | 42 | Protocol 2.06: (Kernel 2.6.22) Added a field that contains the size of |
| 43 | the boot command line |
| 44 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 45 | |
| 46 | **** MEMORY LAYOUT |
| 47 | |
| 48 | The traditional memory map for the kernel loader, used for Image or |
| 49 | zImage kernels, typically looks like: |
| 50 | |
| 51 | | | |
| 52 | 0A0000 +------------------------+ |
| 53 | | Reserved for BIOS | Do not use. Reserved for BIOS EBDA. |
| 54 | 09A000 +------------------------+ |
| 55 | | Stack/heap/cmdline | For use by the kernel real-mode code. |
| 56 | 098000 +------------------------+ |
| 57 | | Kernel setup | The kernel real-mode code. |
| 58 | 090200 +------------------------+ |
| 59 | | Kernel boot sector | The kernel legacy boot sector. |
| 60 | 090000 +------------------------+ |
| 61 | | Protected-mode kernel | The bulk of the kernel image. |
| 62 | 010000 +------------------------+ |
| 63 | | Boot loader | <- Boot sector entry point 0000:7C00 |
| 64 | 001000 +------------------------+ |
| 65 | | Reserved for MBR/BIOS | |
| 66 | 000800 +------------------------+ |
| 67 | | Typically used by MBR | |
| 68 | 000600 +------------------------+ |
| 69 | | BIOS use only | |
| 70 | 000000 +------------------------+ |
| 71 | |
| 72 | |
| 73 | When using bzImage, the protected-mode kernel was relocated to |
| 74 | 0x100000 ("high memory"), and the kernel real-mode block (boot sector, |
| 75 | setup, and stack/heap) was made relocatable to any address between |
| 76 | 0x10000 and end of low memory. Unfortunately, in protocols 2.00 and |
| 77 | 2.01 the command line is still required to live in the 0x9XXXX memory |
| 78 | range, and that memory range is still overwritten by the early kernel. |
| 79 | The 2.02 protocol resolves that problem. |
| 80 | |
| 81 | It is desirable to keep the "memory ceiling" -- the highest point in |
| 82 | low memory touched by the boot loader -- as low as possible, since |
| 83 | some newer BIOSes have begun to allocate some rather large amounts of |
| 84 | memory, called the Extended BIOS Data Area, near the top of low |
| 85 | memory. The boot loader should use the "INT 12h" BIOS call to verify |
| 86 | how much low memory is available. |
| 87 | |
| 88 | Unfortunately, if INT 12h reports that the amount of memory is too |
| 89 | low, there is usually nothing the boot loader can do but to report an |
| 90 | error to the user. The boot loader should therefore be designed to |
| 91 | take up as little space in low memory as it reasonably can. For |
| 92 | zImage or old bzImage kernels, which need data written into the |
| 93 | 0x90000 segment, the boot loader should make sure not to use memory |
| 94 | above the 0x9A000 point; too many BIOSes will break above that point. |
| 95 | |
| 96 | |
| 97 | **** THE REAL-MODE KERNEL HEADER |
| 98 | |
| 99 | In the following text, and anywhere in the kernel boot sequence, "a |
| 100 | sector" refers to 512 bytes. It is independent of the actual sector |
| 101 | size of the underlying medium. |
| 102 | |
| 103 | The first step in loading a Linux kernel should be to load the |
| 104 | real-mode code (boot sector and setup code) and then examine the |
| 105 | following header at offset 0x01f1. The real-mode code can total up to |
| 106 | 32K, although the boot loader may choose to load only the first two |
| 107 | sectors (1K) and then examine the bootup sector size. |
| 108 | |
| 109 | The header looks like: |
| 110 | |
| 111 | Offset Proto Name Meaning |
| 112 | /Size |
| 113 | |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 114 | 01F1/1 ALL(1 setup_sects The size of the setup in sectors |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 115 | 01F2/2 ALL root_flags If set, the root is mounted readonly |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 116 | 01F4/4 2.04+(2 syssize The size of the 32-bit code in 16-byte paras |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 117 | 01F8/2 ALL ram_size DO NOT USE - for bootsect.S use only |
| 118 | 01FA/2 ALL vid_mode Video mode control |
| 119 | 01FC/2 ALL root_dev Default root device number |
| 120 | 01FE/2 ALL boot_flag 0xAA55 magic number |
| 121 | 0200/2 2.00+ jump Jump instruction |
| 122 | 0202/4 2.00+ header Magic signature "HdrS" |
| 123 | 0206/2 2.00+ version Boot protocol version supported |
| 124 | 0208/4 2.00+ realmode_swtch Boot loader hook (see below) |
| 125 | 020C/2 2.00+ start_sys The load-low segment (0x1000) (obsolete) |
| 126 | 020E/2 2.00+ kernel_version Pointer to kernel version string |
| 127 | 0210/1 2.00+ type_of_loader Boot loader identifier |
| 128 | 0211/1 2.00+ loadflags Boot protocol option flags |
| 129 | 0212/2 2.00+ setup_move_size Move to high memory size (used with hooks) |
| 130 | 0214/4 2.00+ code32_start Boot loader hook (see below) |
| 131 | 0218/4 2.00+ ramdisk_image initrd load address (set by boot loader) |
| 132 | 021C/4 2.00+ ramdisk_size initrd size (set by boot loader) |
| 133 | 0220/4 2.00+ bootsect_kludge DO NOT USE - for bootsect.S use only |
| 134 | 0224/2 2.01+ heap_end_ptr Free memory after setup end |
| 135 | 0226/2 N/A pad1 Unused |
| 136 | 0228/4 2.02+ cmd_line_ptr 32-bit pointer to the kernel command line |
| 137 | 022C/4 2.03+ initrd_addr_max Highest legal initrd address |
Vivek Goyal | d263b21 | 2006-12-07 02:14:13 +0100 | [diff] [blame] | 138 | 0230/4 2.05+ kernel_alignment Physical addr alignment required for kernel |
| 139 | 0234/1 2.05+ relocatable_kernel Whether kernel is relocatable or not |
Bernhard Walle | 8f9aeca | 2007-05-02 19:27:10 +0200 | [diff] [blame] | 140 | 0235/3 N/A pad2 Unused |
| 141 | 0238/4 2.06+ cmdline_size Maximum size of the kernel command line |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 142 | |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 143 | (1) For backwards compatibility, if the setup_sects field contains 0, the |
| 144 | real value is 4. |
| 145 | |
| 146 | (2) For boot protocol prior to 2.04, the upper two bytes of the syssize |
| 147 | field are unusable, which means the size of a bzImage kernel |
| 148 | cannot be determined. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 149 | |
| 150 | If the "HdrS" (0x53726448) magic number is not found at offset 0x202, |
| 151 | the boot protocol version is "old". Loading an old kernel, the |
| 152 | following parameters should be assumed: |
| 153 | |
| 154 | Image type = zImage |
| 155 | initrd not supported |
| 156 | Real-mode kernel must be located at 0x90000. |
| 157 | |
| 158 | Otherwise, the "version" field contains the protocol version, |
| 159 | e.g. protocol version 2.01 will contain 0x0201 in this field. When |
| 160 | setting fields in the header, you must make sure only to set fields |
| 161 | supported by the protocol version in use. |
| 162 | |
| 163 | The "kernel_version" field, if set to a nonzero value, contains a |
| 164 | pointer to a null-terminated human-readable kernel version number |
| 165 | string, less 0x200. This can be used to display the kernel version to |
| 166 | the user. This value should be less than (0x200*setup_sects). For |
| 167 | example, if this value is set to 0x1c00, the kernel version number |
| 168 | string can be found at offset 0x1e00 in the kernel file. This is a |
| 169 | valid value if and only if the "setup_sects" field contains the value |
| 170 | 14 or higher. |
| 171 | |
| 172 | Most boot loaders will simply load the kernel at its target address |
| 173 | directly. Such boot loaders do not need to worry about filling in |
| 174 | most of the fields in the header. The following fields should be |
| 175 | filled out, however: |
| 176 | |
| 177 | vid_mode: |
| 178 | Please see the section on SPECIAL COMMAND LINE OPTIONS. |
| 179 | |
| 180 | type_of_loader: |
| 181 | If your boot loader has an assigned id (see table below), enter |
| 182 | 0xTV here, where T is an identifier for the boot loader and V is |
| 183 | a version number. Otherwise, enter 0xFF here. |
| 184 | |
| 185 | Assigned boot loader ids: |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 186 | 0 LILO (0x00 reserved for pre-2.00 bootloader) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 187 | 1 Loadlin |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 188 | 2 bootsect-loader (0x20, all other values reserved) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 189 | 3 SYSLINUX |
| 190 | 4 EtherBoot |
| 191 | 5 ELILO |
| 192 | 7 GRuB |
| 193 | 8 U-BOOT |
Jeremy Fitzhardinge | 354332e | 2006-09-12 20:35:57 -0700 | [diff] [blame] | 194 | 9 Xen |
H. Peter Anvin | c229ec5 | 2007-01-26 09:15:47 -0800 | [diff] [blame] | 195 | A Gujin |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 196 | |
| 197 | Please contact <hpa@zytor.com> if you need a bootloader ID |
| 198 | value assigned. |
| 199 | |
| 200 | loadflags, heap_end_ptr: |
| 201 | If the protocol version is 2.01 or higher, enter the |
| 202 | offset limit of the setup heap into heap_end_ptr and set the |
| 203 | 0x80 bit (CAN_USE_HEAP) of loadflags. heap_end_ptr appears to |
| 204 | be relative to the start of setup (offset 0x0200). |
| 205 | |
| 206 | setup_move_size: |
| 207 | When using protocol 2.00 or 2.01, if the real mode |
| 208 | kernel is not loaded at 0x90000, it gets moved there later in |
| 209 | the loading sequence. Fill in this field if you want |
| 210 | additional data (such as the kernel command line) moved in |
| 211 | addition to the real-mode kernel itself. |
| 212 | |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 213 | The unit is bytes starting with the beginning of the boot |
| 214 | sector. |
| 215 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 216 | ramdisk_image, ramdisk_size: |
| 217 | If your boot loader has loaded an initial ramdisk (initrd), |
| 218 | set ramdisk_image to the 32-bit pointer to the ramdisk data |
| 219 | and the ramdisk_size to the size of the ramdisk data. |
| 220 | |
| 221 | The initrd should typically be located as high in memory as |
| 222 | possible, as it may otherwise get overwritten by the early |
| 223 | kernel initialization sequence. However, it must never be |
| 224 | located above the address specified in the initrd_addr_max |
| 225 | field. The initrd should be at least 4K page aligned. |
| 226 | |
| 227 | cmd_line_ptr: |
| 228 | If the protocol version is 2.02 or higher, this is a 32-bit |
| 229 | pointer to the kernel command line. The kernel command line |
| 230 | can be located anywhere between the end of setup and 0xA0000. |
| 231 | Fill in this field even if your boot loader does not support a |
| 232 | command line, in which case you can point this to an empty |
| 233 | string (or better yet, to the string "auto".) If this field |
| 234 | is left at zero, the kernel will assume that your boot loader |
| 235 | does not support the 2.02+ protocol. |
| 236 | |
| 237 | ramdisk_max: |
| 238 | The maximum address that may be occupied by the initrd |
| 239 | contents. For boot protocols 2.02 or earlier, this field is |
| 240 | not present, and the maximum address is 0x37FFFFFF. (This |
| 241 | address is defined as the address of the highest safe byte, so |
| 242 | if your ramdisk is exactly 131072 bytes long and this field is |
| 243 | 0x37FFFFFF, you can start your ramdisk at 0x37FE0000.) |
| 244 | |
Bernhard Walle | 8f9aeca | 2007-05-02 19:27:10 +0200 | [diff] [blame] | 245 | cmdline_size: |
| 246 | The maximum size of the command line without the terminating |
| 247 | zero. This means that the command line can contain at most |
| 248 | cmdline_size characters. With protocol version 2.05 and |
| 249 | earlier, the maximum size was 255. |
| 250 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 251 | |
| 252 | **** THE KERNEL COMMAND LINE |
| 253 | |
| 254 | The kernel command line has become an important way for the boot |
| 255 | loader to communicate with the kernel. Some of its options are also |
| 256 | relevant to the boot loader itself, see "special command line options" |
| 257 | below. |
| 258 | |
Bernhard Walle | 8f9aeca | 2007-05-02 19:27:10 +0200 | [diff] [blame] | 259 | The kernel command line is a null-terminated string. The maximum |
| 260 | length can be retrieved from the field cmdline_size. Before protocol |
| 261 | version 2.06, the maximum was 255 characters. A string that is too |
| 262 | long will be automatically truncated by the kernel. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 263 | |
| 264 | If the boot protocol version is 2.02 or later, the address of the |
| 265 | kernel command line is given by the header field cmd_line_ptr (see |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 266 | above.) This address can be anywhere between the end of the setup |
| 267 | heap and 0xA0000. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 268 | |
| 269 | If the protocol version is *not* 2.02 or higher, the kernel |
| 270 | command line is entered using the following protocol: |
| 271 | |
| 272 | At offset 0x0020 (word), "cmd_line_magic", enter the magic |
| 273 | number 0xA33F. |
| 274 | |
| 275 | At offset 0x0022 (word), "cmd_line_offset", enter the offset |
| 276 | of the kernel command line (relative to the start of the |
| 277 | real-mode kernel). |
| 278 | |
| 279 | The kernel command line *must* be within the memory region |
| 280 | covered by setup_move_size, so you may need to adjust this |
| 281 | field. |
| 282 | |
| 283 | |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 284 | **** MEMORY LAYOUT OF THE REAL-MODE CODE |
| 285 | |
| 286 | The real-mode code requires a stack/heap to be set up, as well as |
| 287 | memory allocated for the kernel command line. This needs to be done |
| 288 | in the real-mode accessible memory in bottom megabyte. |
| 289 | |
| 290 | It should be noted that modern machines often have a sizable Extended |
| 291 | BIOS Data Area (EBDA). As a result, it is advisable to use as little |
| 292 | of the low megabyte as possible. |
| 293 | |
| 294 | Unfortunately, under the following circumstances the 0x90000 memory |
| 295 | segment has to be used: |
| 296 | |
| 297 | - When loading a zImage kernel ((loadflags & 0x01) == 0). |
| 298 | - When loading a 2.01 or earlier boot protocol kernel. |
| 299 | |
| 300 | -> For the 2.00 and 2.01 boot protocols, the real-mode code |
| 301 | can be loaded at another address, but it is internally |
| 302 | relocated to 0x90000. For the "old" protocol, the |
| 303 | real-mode code must be loaded at 0x90000. |
| 304 | |
| 305 | When loading at 0x90000, avoid using memory above 0x9a000. |
| 306 | |
| 307 | For boot protocol 2.02 or higher, the command line does not have to be |
| 308 | located in the same 64K segment as the real-mode setup code; it is |
| 309 | thus permitted to give the stack/heap the full 64K segment and locate |
| 310 | the command line above it. |
| 311 | |
| 312 | The kernel command line should not be located below the real-mode |
| 313 | code, nor should it be located in high memory. |
| 314 | |
| 315 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 316 | **** SAMPLE BOOT CONFIGURATION |
| 317 | |
| 318 | As a sample configuration, assume the following layout of the real |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 319 | mode segment: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 320 | |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 321 | When loading below 0x90000, use the entire segment: |
| 322 | |
| 323 | 0x0000-0x7fff Real mode kernel |
| 324 | 0x8000-0xdfff Stack and heap |
| 325 | 0xe000-0xffff Kernel command line |
| 326 | |
| 327 | When loading at 0x90000 OR the protocol version is 2.01 or earlier: |
| 328 | |
| 329 | 0x0000-0x7fff Real mode kernel |
| 330 | 0x8000-0x97ff Stack and heap |
| 331 | 0x9800-0x9fff Kernel command line |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 332 | |
| 333 | Such a boot loader should enter the following fields in the header: |
| 334 | |
| 335 | unsigned long base_ptr; /* base address for real-mode segment */ |
| 336 | |
| 337 | if ( setup_sects == 0 ) { |
| 338 | setup_sects = 4; |
| 339 | } |
| 340 | |
| 341 | if ( protocol >= 0x0200 ) { |
| 342 | type_of_loader = <type code>; |
| 343 | if ( loading_initrd ) { |
| 344 | ramdisk_image = <initrd_address>; |
| 345 | ramdisk_size = <initrd_size>; |
| 346 | } |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 347 | |
| 348 | if ( protocol >= 0x0202 && loadflags & 0x01 ) |
| 349 | heap_end = 0xe000; |
| 350 | else |
| 351 | heap_end = 0x9800; |
| 352 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 353 | if ( protocol >= 0x0201 ) { |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 354 | heap_end_ptr = heap_end - 0x200; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 355 | loadflags |= 0x80; /* CAN_USE_HEAP */ |
| 356 | } |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 357 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 358 | if ( protocol >= 0x0202 ) { |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 359 | cmd_line_ptr = base_ptr + heap_end; |
| 360 | strcpy(cmd_line_ptr, cmdline); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 361 | } else { |
| 362 | cmd_line_magic = 0xA33F; |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 363 | cmd_line_offset = heap_end; |
| 364 | setup_move_size = heap_end + strlen(cmdline)+1; |
| 365 | strcpy(base_ptr+cmd_line_offset, cmdline); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 366 | } |
| 367 | } else { |
| 368 | /* Very old kernel */ |
| 369 | |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 370 | heap_end = 0x9800; |
| 371 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 372 | cmd_line_magic = 0xA33F; |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 373 | cmd_line_offset = heap_end; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 374 | |
| 375 | /* A very old kernel MUST have its real-mode code |
| 376 | loaded at 0x90000 */ |
| 377 | |
| 378 | if ( base_ptr != 0x90000 ) { |
| 379 | /* Copy the real-mode kernel */ |
| 380 | memcpy(0x90000, base_ptr, (setup_sects+1)*512); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 381 | base_ptr = 0x90000; /* Relocated */ |
| 382 | } |
| 383 | |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 384 | strcpy(0x90000+cmd_line_offset, cmdline); |
| 385 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 386 | /* It is recommended to clear memory up to the 32K mark */ |
| 387 | memset(0x90000 + (setup_sects+1)*512, 0, |
| 388 | (64-(setup_sects+1))*512); |
| 389 | } |
| 390 | |
| 391 | |
| 392 | **** LOADING THE REST OF THE KERNEL |
| 393 | |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 394 | The 32-bit (non-real-mode) kernel starts at offset (setup_sects+1)*512 |
| 395 | in the kernel file (again, if setup_sects == 0 the real value is 4.) |
| 396 | It should be loaded at address 0x10000 for Image/zImage kernels and |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 397 | 0x100000 for bzImage kernels. |
| 398 | |
| 399 | The kernel is a bzImage kernel if the protocol >= 2.00 and the 0x01 |
| 400 | bit (LOAD_HIGH) in the loadflags field is set: |
| 401 | |
| 402 | is_bzImage = (protocol >= 0x0200) && (loadflags & 0x01); |
| 403 | load_address = is_bzImage ? 0x100000 : 0x10000; |
| 404 | |
| 405 | Note that Image/zImage kernels can be up to 512K in size, and thus use |
| 406 | the entire 0x10000-0x90000 range of memory. This means it is pretty |
| 407 | much a requirement for these kernels to load the real-mode part at |
| 408 | 0x90000. bzImage kernels allow much more flexibility. |
| 409 | |
| 410 | |
| 411 | **** SPECIAL COMMAND LINE OPTIONS |
| 412 | |
| 413 | If the command line provided by the boot loader is entered by the |
| 414 | user, the user may expect the following command line options to work. |
| 415 | They should normally not be deleted from the kernel command line even |
| 416 | though not all of them are actually meaningful to the kernel. Boot |
| 417 | loader authors who need additional command line options for the boot |
| 418 | loader itself should get them registered in |
| 419 | Documentation/kernel-parameters.txt to make sure they will not |
| 420 | conflict with actual kernel options now or in the future. |
| 421 | |
| 422 | vga=<mode> |
| 423 | <mode> here is either an integer (in C notation, either |
| 424 | decimal, octal, or hexadecimal) or one of the strings |
| 425 | "normal" (meaning 0xFFFF), "ext" (meaning 0xFFFE) or "ask" |
| 426 | (meaning 0xFFFD). This value should be entered into the |
| 427 | vid_mode field, as it is used by the kernel before the command |
| 428 | line is parsed. |
| 429 | |
| 430 | mem=<size> |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 431 | <size> is an integer in C notation optionally followed by |
| 432 | (case insensitive) K, M, G, T, P or E (meaning << 10, << 20, |
| 433 | << 30, << 40, << 50 or << 60). This specifies the end of |
| 434 | memory to the kernel. This affects the possible placement of |
| 435 | an initrd, since an initrd should be placed near end of |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 436 | memory. Note that this is an option to *both* the kernel and |
| 437 | the bootloader! |
| 438 | |
| 439 | initrd=<file> |
| 440 | An initrd should be loaded. The meaning of <file> is |
| 441 | obviously bootloader-dependent, and some boot loaders |
| 442 | (e.g. LILO) do not have such a command. |
| 443 | |
| 444 | In addition, some boot loaders add the following options to the |
| 445 | user-specified command line: |
| 446 | |
| 447 | BOOT_IMAGE=<file> |
| 448 | The boot image which was loaded. Again, the meaning of <file> |
| 449 | is obviously bootloader-dependent. |
| 450 | |
| 451 | auto |
| 452 | The kernel was booted without explicit user intervention. |
| 453 | |
| 454 | If these options are added by the boot loader, it is highly |
| 455 | recommended that they are located *first*, before the user-specified |
| 456 | or configuration-specified command line. Otherwise, "init=/bin/sh" |
| 457 | gets confused by the "auto" option. |
| 458 | |
| 459 | |
| 460 | **** RUNNING THE KERNEL |
| 461 | |
| 462 | The kernel is started by jumping to the kernel entry point, which is |
| 463 | located at *segment* offset 0x20 from the start of the real mode |
| 464 | kernel. This means that if you loaded your real-mode kernel code at |
| 465 | 0x90000, the kernel entry point is 9020:0000. |
| 466 | |
| 467 | At entry, ds = es = ss should point to the start of the real-mode |
| 468 | kernel code (0x9000 if the code is loaded at 0x90000), sp should be |
| 469 | set up properly, normally pointing to the top of the heap, and |
| 470 | interrupts should be disabled. Furthermore, to guard against bugs in |
| 471 | the kernel, it is recommended that the boot loader sets fs = gs = ds = |
| 472 | es = ss. |
| 473 | |
| 474 | In our example from above, we would do: |
| 475 | |
| 476 | /* Note: in the case of the "old" kernel protocol, base_ptr must |
| 477 | be == 0x90000 at this point; see the previous sample code */ |
| 478 | |
| 479 | seg = base_ptr >> 4; |
| 480 | |
| 481 | cli(); /* Enter with interrupts disabled! */ |
| 482 | |
| 483 | /* Set up the real-mode kernel stack */ |
| 484 | _SS = seg; |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 485 | _SP = heap_end; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 486 | |
| 487 | _DS = _ES = _FS = _GS = seg; |
| 488 | jmp_far(seg+0x20, 0); /* Run the kernel */ |
| 489 | |
| 490 | If your boot sector accesses a floppy drive, it is recommended to |
| 491 | switch off the floppy motor before running the kernel, since the |
| 492 | kernel boot leaves interrupts off and thus the motor will not be |
| 493 | switched off, especially if the loaded kernel has the floppy driver as |
| 494 | a demand-loaded module! |
| 495 | |
| 496 | |
| 497 | **** ADVANCED BOOT TIME HOOKS |
| 498 | |
| 499 | If the boot loader runs in a particularly hostile environment (such as |
| 500 | LOADLIN, which runs under DOS) it may be impossible to follow the |
| 501 | standard memory location requirements. Such a boot loader may use the |
| 502 | following hooks that, if set, are invoked by the kernel at the |
| 503 | appropriate time. The use of these hooks should probably be |
| 504 | considered an absolutely last resort! |
| 505 | |
| 506 | IMPORTANT: All the hooks are required to preserve %esp, %ebp, %esi and |
| 507 | %edi across invocation. |
| 508 | |
| 509 | realmode_swtch: |
| 510 | A 16-bit real mode far subroutine invoked immediately before |
| 511 | entering protected mode. The default routine disables NMI, so |
| 512 | your routine should probably do so, too. |
| 513 | |
| 514 | code32_start: |
| 515 | A 32-bit flat-mode routine *jumped* to immediately after the |
| 516 | transition to protected mode, but before the kernel is |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 517 | uncompressed. No segments, except CS, are guaranteed to be |
| 518 | set up (current kernels do, but older ones do not); you should |
| 519 | set them up to BOOT_DS (0x18) yourself. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 520 | |
| 521 | After completing your hook, you should jump to the address |
| 522 | that was in this field before your boot loader overwrote it. |