H. Peter Anvin | 4039feb | 2008-05-30 17:16:20 -0700 | [diff] [blame] | 1 | THE LINUX/x86 BOOT PROTOCOL |
| 2 | --------------------------- |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 3 | |
H. Peter Anvin | 4039feb | 2008-05-30 17:16:20 -0700 | [diff] [blame] | 4 | On the x86 platform, the Linux kernel uses a rather complicated boot |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 5 | convention. This has evolved partially due to historical aspects, as |
| 6 | well as the desire in the early days to have the kernel itself be a |
| 7 | bootable image, the complicated PC memory model and due to changed |
| 8 | expectations in the PC industry caused by the effective demise of |
| 9 | real-mode DOS as a mainstream operating system. |
| 10 | |
H. Peter Anvin | 4039feb | 2008-05-30 17:16:20 -0700 | [diff] [blame] | 11 | Currently, the following versions of the Linux/x86 boot protocol exist. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 12 | |
| 13 | Old kernels: zImage/Image support only. Some very early kernels |
| 14 | may not even support a command line. |
| 15 | |
| 16 | Protocol 2.00: (Kernel 1.3.73) Added bzImage and initrd support, as |
| 17 | well as a formalized way to communicate between the |
| 18 | boot loader and the kernel. setup.S made relocatable, |
| 19 | although the traditional setup area still assumed |
| 20 | writable. |
| 21 | |
| 22 | Protocol 2.01: (Kernel 1.3.76) Added a heap overrun warning. |
| 23 | |
| 24 | Protocol 2.02: (Kernel 2.4.0-test3-pre3) New command line protocol. |
| 25 | Lower the conventional memory ceiling. No overwrite |
| 26 | of the traditional setup area, thus making booting |
| 27 | safe for systems which use the EBDA from SMM or 32-bit |
| 28 | BIOS entry points. zImage deprecated but still |
| 29 | supported. |
| 30 | |
| 31 | Protocol 2.03: (Kernel 2.4.18-pre1) Explicitly makes the highest possible |
| 32 | initrd address available to the bootloader. |
| 33 | |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 34 | Protocol 2.04: (Kernel 2.6.14) Extend the syssize field to four bytes. |
Bernhard Walle | 8f9aeca | 2007-05-02 19:27:10 +0200 | [diff] [blame] | 35 | |
Vivek Goyal | be274ee | 2006-12-07 02:14:04 +0100 | [diff] [blame] | 36 | Protocol 2.05: (Kernel 2.6.20) Make protected mode kernel relocatable. |
| 37 | Introduce relocatable_kernel and kernel_alignment fields. |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 38 | |
Bernhard Walle | 8f9aeca | 2007-05-02 19:27:10 +0200 | [diff] [blame] | 39 | Protocol 2.06: (Kernel 2.6.22) Added a field that contains the size of |
Ian Campbell | 4c0587e | 2008-04-27 12:21:11 +0100 | [diff] [blame] | 40 | the boot command line. |
Bernhard Walle | 8f9aeca | 2007-05-02 19:27:10 +0200 | [diff] [blame] | 41 | |
Ian Campbell | 4c0587e | 2008-04-27 12:21:11 +0100 | [diff] [blame] | 42 | Protocol 2.07: (Kernel 2.6.24) Added paravirtualised boot protocol. |
| 43 | Introduced hardware_subarch and hardware_subarch_data |
| 44 | and KEEP_SEGMENTS flag in load_flags. |
| 45 | |
| 46 | Protocol 2.08: (Kernel 2.6.26) Added crc32 checksum and ELF format |
Baodong Chen | 2f6de3a | 2009-01-03 12:37:06 +0800 | [diff] [blame] | 47 | payload. Introduced payload_offset and payload_length |
Ian Campbell | 4c0587e | 2008-04-27 12:21:11 +0100 | [diff] [blame] | 48 | fields to aid in locating the payload. |
| 49 | |
| 50 | Protocol 2.09: (Kernel 2.6.26) Added a field of 64-bit physical |
Huang, Ying | fb88438 | 2008-03-28 10:49:50 +0800 | [diff] [blame] | 51 | pointer to single linked list of struct setup_data. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 52 | |
H. Peter Anvin | 5031296 | 2009-05-07 16:54:11 -0700 | [diff] [blame] | 53 | Protocol 2.10: (Kernel 2.6.31) Added a protocol for relaxed alignment |
H. Peter Anvin | d297366 | 2009-05-11 16:06:23 -0700 | [diff] [blame] | 54 | beyond the kernel_alignment added, new init_size and |
H. Peter Anvin | 5031296 | 2009-05-07 16:54:11 -0700 | [diff] [blame] | 55 | pref_address fields. Added extended boot loader IDs. |
H. Peter Anvin | d297366 | 2009-05-11 16:06:23 -0700 | [diff] [blame] | 56 | |
Matt Fleming | 9ca8f72 | 2012-07-19 10:23:48 +0100 | [diff] [blame] | 57 | Protocol 2.11: (Kernel 3.6) Added a field for offset of EFI handover |
| 58 | protocol entry point. |
| 59 | |
H. Peter Anvin | 972f7c8 | 2013-01-31 20:23:49 -0800 | [diff] [blame] | 60 | Protocol 2.12: (Kernel 3.8) Added the xloadflags field and extension fields |
Masanari Iida | c9f3f2d | 2013-07-18 01:29:12 +0900 | [diff] [blame] | 61 | to struct boot_params for loading bzImage and ramdisk |
H. Peter Anvin | 09c205a | 2013-01-27 10:43:28 -0800 | [diff] [blame] | 62 | above 4G in 64bit. |
| 63 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 64 | **** MEMORY LAYOUT |
| 65 | |
| 66 | The traditional memory map for the kernel loader, used for Image or |
| 67 | zImage kernels, typically looks like: |
| 68 | |
| 69 | | | |
| 70 | 0A0000 +------------------------+ |
| 71 | | Reserved for BIOS | Do not use. Reserved for BIOS EBDA. |
| 72 | 09A000 +------------------------+ |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 73 | | Command line | |
| 74 | | Stack/heap | For use by the kernel real-mode code. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 75 | 098000 +------------------------+ |
| 76 | | Kernel setup | The kernel real-mode code. |
| 77 | 090200 +------------------------+ |
| 78 | | Kernel boot sector | The kernel legacy boot sector. |
| 79 | 090000 +------------------------+ |
| 80 | | Protected-mode kernel | The bulk of the kernel image. |
| 81 | 010000 +------------------------+ |
| 82 | | Boot loader | <- Boot sector entry point 0000:7C00 |
| 83 | 001000 +------------------------+ |
| 84 | | Reserved for MBR/BIOS | |
| 85 | 000800 +------------------------+ |
| 86 | | Typically used by MBR | |
| 87 | 000600 +------------------------+ |
| 88 | | BIOS use only | |
| 89 | 000000 +------------------------+ |
| 90 | |
| 91 | |
| 92 | When using bzImage, the protected-mode kernel was relocated to |
| 93 | 0x100000 ("high memory"), and the kernel real-mode block (boot sector, |
| 94 | setup, and stack/heap) was made relocatable to any address between |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 95 | 0x10000 and end of low memory. Unfortunately, in protocols 2.00 and |
| 96 | 2.01 the 0x90000+ memory range is still used internally by the kernel; |
| 97 | the 2.02 protocol resolves that problem. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 98 | |
| 99 | It is desirable to keep the "memory ceiling" -- the highest point in |
| 100 | low memory touched by the boot loader -- as low as possible, since |
| 101 | some newer BIOSes have begun to allocate some rather large amounts of |
| 102 | memory, called the Extended BIOS Data Area, near the top of low |
| 103 | memory. The boot loader should use the "INT 12h" BIOS call to verify |
| 104 | how much low memory is available. |
| 105 | |
| 106 | Unfortunately, if INT 12h reports that the amount of memory is too |
| 107 | low, there is usually nothing the boot loader can do but to report an |
| 108 | error to the user. The boot loader should therefore be designed to |
| 109 | take up as little space in low memory as it reasonably can. For |
| 110 | zImage or old bzImage kernels, which need data written into the |
| 111 | 0x90000 segment, the boot loader should make sure not to use memory |
| 112 | above the 0x9A000 point; too many BIOSes will break above that point. |
| 113 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 114 | For a modern bzImage kernel with boot protocol version >= 2.02, a |
| 115 | memory layout like the following is suggested: |
| 116 | |
| 117 | ~ ~ |
| 118 | | Protected-mode kernel | |
| 119 | 100000 +------------------------+ |
| 120 | | I/O memory hole | |
| 121 | 0A0000 +------------------------+ |
| 122 | | Reserved for BIOS | Leave as much as possible unused |
| 123 | ~ ~ |
| 124 | | Command line | (Can also be below the X+10000 mark) |
| 125 | X+10000 +------------------------+ |
| 126 | | Stack/heap | For use by the kernel real-mode code. |
| 127 | X+08000 +------------------------+ |
| 128 | | Kernel setup | The kernel real-mode code. |
| 129 | | Kernel boot sector | The kernel legacy boot sector. |
| 130 | X +------------------------+ |
| 131 | | Boot loader | <- Boot sector entry point 0000:7C00 |
| 132 | 001000 +------------------------+ |
| 133 | | Reserved for MBR/BIOS | |
| 134 | 000800 +------------------------+ |
| 135 | | Typically used by MBR | |
| 136 | 000600 +------------------------+ |
| 137 | | BIOS use only | |
| 138 | 000000 +------------------------+ |
| 139 | |
| 140 | ... where the address X is as low as the design of the boot loader |
| 141 | permits. |
| 142 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 143 | |
| 144 | **** THE REAL-MODE KERNEL HEADER |
| 145 | |
| 146 | In the following text, and anywhere in the kernel boot sequence, "a |
| 147 | sector" refers to 512 bytes. It is independent of the actual sector |
| 148 | size of the underlying medium. |
| 149 | |
| 150 | The first step in loading a Linux kernel should be to load the |
| 151 | real-mode code (boot sector and setup code) and then examine the |
| 152 | following header at offset 0x01f1. The real-mode code can total up to |
| 153 | 32K, although the boot loader may choose to load only the first two |
| 154 | sectors (1K) and then examine the bootup sector size. |
| 155 | |
| 156 | The header looks like: |
| 157 | |
| 158 | Offset Proto Name Meaning |
| 159 | /Size |
| 160 | |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 161 | 01F1/1 ALL(1 setup_sects The size of the setup in sectors |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 162 | 01F2/2 ALL root_flags If set, the root is mounted readonly |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 163 | 01F4/4 2.04+(2 syssize The size of the 32-bit code in 16-byte paras |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 164 | 01F8/2 ALL ram_size DO NOT USE - for bootsect.S use only |
| 165 | 01FA/2 ALL vid_mode Video mode control |
| 166 | 01FC/2 ALL root_dev Default root device number |
| 167 | 01FE/2 ALL boot_flag 0xAA55 magic number |
| 168 | 0200/2 2.00+ jump Jump instruction |
| 169 | 0202/4 2.00+ header Magic signature "HdrS" |
| 170 | 0206/2 2.00+ version Boot protocol version supported |
| 171 | 0208/4 2.00+ realmode_swtch Boot loader hook (see below) |
Baodong Chen | e56d0cf | 2009-01-08 19:24:29 +0800 | [diff] [blame] | 172 | 020C/2 2.00+ start_sys_seg The load-low segment (0x1000) (obsolete) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 173 | 020E/2 2.00+ kernel_version Pointer to kernel version string |
| 174 | 0210/1 2.00+ type_of_loader Boot loader identifier |
| 175 | 0211/1 2.00+ loadflags Boot protocol option flags |
| 176 | 0212/2 2.00+ setup_move_size Move to high memory size (used with hooks) |
| 177 | 0214/4 2.00+ code32_start Boot loader hook (see below) |
| 178 | 0218/4 2.00+ ramdisk_image initrd load address (set by boot loader) |
| 179 | 021C/4 2.00+ ramdisk_size initrd size (set by boot loader) |
| 180 | 0220/4 2.00+ bootsect_kludge DO NOT USE - for bootsect.S use only |
| 181 | 0224/2 2.01+ heap_end_ptr Free memory after setup end |
H. Peter Anvin | 5031296 | 2009-05-07 16:54:11 -0700 | [diff] [blame] | 182 | 0226/1 2.02+(3 ext_loader_ver Extended boot loader version |
| 183 | 0227/1 2.02+(3 ext_loader_type Extended boot loader ID |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 184 | 0228/4 2.02+ cmd_line_ptr 32-bit pointer to the kernel command line |
Baodong Chen | e56d0cf | 2009-01-08 19:24:29 +0800 | [diff] [blame] | 185 | 022C/4 2.03+ ramdisk_max Highest legal initrd address |
Vivek Goyal | d263b21 | 2006-12-07 02:14:13 +0100 | [diff] [blame] | 186 | 0230/4 2.05+ kernel_alignment Physical addr alignment required for kernel |
| 187 | 0234/1 2.05+ relocatable_kernel Whether kernel is relocatable or not |
H. Peter Anvin | d297366 | 2009-05-11 16:06:23 -0700 | [diff] [blame] | 188 | 0235/1 2.10+ min_alignment Minimum alignment, as a power of two |
H. Peter Anvin | 09c205a | 2013-01-27 10:43:28 -0800 | [diff] [blame] | 189 | 0236/2 2.12+ xloadflags Boot protocol option flags |
Bernhard Walle | 8f9aeca | 2007-05-02 19:27:10 +0200 | [diff] [blame] | 190 | 0238/4 2.06+ cmdline_size Maximum size of the kernel command line |
Rusty Russell | e5371ac | 2007-10-21 16:41:33 -0700 | [diff] [blame] | 191 | 023C/4 2.07+ hardware_subarch Hardware subarchitecture |
| 192 | 0240/8 2.07+ hardware_subarch_data Subarchitecture-specific data |
Ian Campbell | 87253d1 | 2008-02-19 11:12:30 +0000 | [diff] [blame] | 193 | 0248/4 2.08+ payload_offset Offset of kernel payload |
| 194 | 024C/4 2.08+ payload_length Length of kernel payload |
Huang, Ying | fb88438 | 2008-03-28 10:49:50 +0800 | [diff] [blame] | 195 | 0250/8 2.09+ setup_data 64-bit physical pointer to linked list |
| 196 | of struct setup_data |
H. Peter Anvin | d297366 | 2009-05-11 16:06:23 -0700 | [diff] [blame] | 197 | 0258/8 2.10+ pref_address Preferred loading address |
| 198 | 0260/4 2.10+ init_size Linear memory required during initialization |
Matt Fleming | 9ca8f72 | 2012-07-19 10:23:48 +0100 | [diff] [blame] | 199 | 0264/4 2.11+ handover_offset Offset of handover entry point |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 200 | |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 201 | (1) For backwards compatibility, if the setup_sects field contains 0, the |
| 202 | real value is 4. |
| 203 | |
| 204 | (2) For boot protocol prior to 2.04, the upper two bytes of the syssize |
| 205 | field are unusable, which means the size of a bzImage kernel |
| 206 | cannot be determined. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 207 | |
H. Peter Anvin | 5031296 | 2009-05-07 16:54:11 -0700 | [diff] [blame] | 208 | (3) Ignored, but safe to set, for boot protocols 2.02-2.09. |
| 209 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 210 | If the "HdrS" (0x53726448) magic number is not found at offset 0x202, |
| 211 | the boot protocol version is "old". Loading an old kernel, the |
| 212 | following parameters should be assumed: |
| 213 | |
| 214 | Image type = zImage |
| 215 | initrd not supported |
| 216 | Real-mode kernel must be located at 0x90000. |
| 217 | |
| 218 | Otherwise, the "version" field contains the protocol version, |
| 219 | e.g. protocol version 2.01 will contain 0x0201 in this field. When |
| 220 | setting fields in the header, you must make sure only to set fields |
| 221 | supported by the protocol version in use. |
| 222 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 223 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 224 | **** DETAILS OF HEADER FIELDS |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 225 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 226 | For each field, some are information from the kernel to the bootloader |
| 227 | ("read"), some are expected to be filled out by the bootloader |
| 228 | ("write"), and some are expected to be read and modified by the |
| 229 | bootloader ("modify"). |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 230 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 231 | All general purpose boot loaders should write the fields marked |
| 232 | (obligatory). Boot loaders who want to load the kernel at a |
| 233 | nonstandard address should fill in the fields marked (reloc); other |
| 234 | boot loaders can ignore those fields. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 235 | |
H. Peter Anvin | db2668f | 2007-05-23 16:59:27 -0700 | [diff] [blame] | 236 | The byte order of all fields is littleendian (this is x86, after all.) |
| 237 | |
Rusty Russell | e5371ac | 2007-10-21 16:41:33 -0700 | [diff] [blame] | 238 | Field name: setup_sects |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 239 | Type: read |
| 240 | Offset/size: 0x1f1/1 |
| 241 | Protocol: ALL |
| 242 | |
| 243 | The size of the setup code in 512-byte sectors. If this field is |
| 244 | 0, the real value is 4. The real-mode code consists of the boot |
| 245 | sector (always one 512-byte sector) plus the setup code. |
| 246 | |
| 247 | Field name: root_flags |
| 248 | Type: modify (optional) |
| 249 | Offset/size: 0x1f2/2 |
| 250 | Protocol: ALL |
| 251 | |
| 252 | If this field is nonzero, the root defaults to readonly. The use of |
| 253 | this field is deprecated; use the "ro" or "rw" options on the |
| 254 | command line instead. |
| 255 | |
| 256 | Field name: syssize |
| 257 | Type: read |
| 258 | Offset/size: 0x1f4/4 (protocol 2.04+) 0x1f4/2 (protocol ALL) |
| 259 | Protocol: 2.04+ |
| 260 | |
| 261 | The size of the protected-mode code in units of 16-byte paragraphs. |
| 262 | For protocol versions older than 2.04 this field is only two bytes |
| 263 | wide, and therefore cannot be trusted for the size of a kernel if |
| 264 | the LOAD_HIGH flag is set. |
| 265 | |
| 266 | Field name: ram_size |
| 267 | Type: kernel internal |
| 268 | Offset/size: 0x1f8/2 |
| 269 | Protocol: ALL |
| 270 | |
| 271 | This field is obsolete. |
| 272 | |
| 273 | Field name: vid_mode |
| 274 | Type: modify (obligatory) |
| 275 | Offset/size: 0x1fa/2 |
| 276 | |
| 277 | Please see the section on SPECIAL COMMAND LINE OPTIONS. |
| 278 | |
| 279 | Field name: root_dev |
| 280 | Type: modify (optional) |
| 281 | Offset/size: 0x1fc/2 |
| 282 | Protocol: ALL |
| 283 | |
| 284 | The default root device device number. The use of this field is |
| 285 | deprecated, use the "root=" option on the command line instead. |
| 286 | |
| 287 | Field name: boot_flag |
| 288 | Type: read |
| 289 | Offset/size: 0x1fe/2 |
| 290 | Protocol: ALL |
| 291 | |
| 292 | Contains 0xAA55. This is the closest thing old Linux kernels have |
| 293 | to a magic number. |
| 294 | |
| 295 | Field name: jump |
| 296 | Type: read |
| 297 | Offset/size: 0x200/2 |
| 298 | Protocol: 2.00+ |
| 299 | |
| 300 | Contains an x86 jump instruction, 0xEB followed by a signed offset |
| 301 | relative to byte 0x202. This can be used to determine the size of |
| 302 | the header. |
| 303 | |
| 304 | Field name: header |
| 305 | Type: read |
| 306 | Offset/size: 0x202/4 |
| 307 | Protocol: 2.00+ |
| 308 | |
| 309 | Contains the magic number "HdrS" (0x53726448). |
| 310 | |
| 311 | Field name: version |
| 312 | Type: read |
| 313 | Offset/size: 0x206/2 |
| 314 | Protocol: 2.00+ |
| 315 | |
H. Peter Anvin | db2668f | 2007-05-23 16:59:27 -0700 | [diff] [blame] | 316 | Contains the boot protocol version, in (major << 8)+minor format, |
| 317 | e.g. 0x0204 for version 2.04, and 0x0a11 for a hypothetical version |
| 318 | 10.17. |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 319 | |
Baodong Chen | e56d0cf | 2009-01-08 19:24:29 +0800 | [diff] [blame] | 320 | Field name: realmode_swtch |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 321 | Type: modify (optional) |
| 322 | Offset/size: 0x208/4 |
| 323 | Protocol: 2.00+ |
| 324 | |
H. Peter Anvin | db2668f | 2007-05-23 16:59:27 -0700 | [diff] [blame] | 325 | Boot loader hook (see ADVANCED BOOT LOADER HOOKS below.) |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 326 | |
Baodong Chen | e56d0cf | 2009-01-08 19:24:29 +0800 | [diff] [blame] | 327 | Field name: start_sys_seg |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 328 | Type: read |
H. Peter Anvin | a021e51 | 2008-07-22 15:33:57 -0400 | [diff] [blame] | 329 | Offset/size: 0x20c/2 |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 330 | Protocol: 2.00+ |
| 331 | |
| 332 | The load low segment (0x1000). Obsolete. |
| 333 | |
| 334 | Field name: kernel_version |
| 335 | Type: read |
| 336 | Offset/size: 0x20e/2 |
| 337 | Protocol: 2.00+ |
| 338 | |
| 339 | If set to a nonzero value, contains a pointer to a NUL-terminated |
| 340 | human-readable kernel version number string, less 0x200. This can |
| 341 | be used to display the kernel version to the user. This value |
H. Peter Anvin | db2668f | 2007-05-23 16:59:27 -0700 | [diff] [blame] | 342 | should be less than (0x200*setup_sects). |
| 343 | |
| 344 | For example, if this value is set to 0x1c00, the kernel version |
| 345 | number string can be found at offset 0x1e00 in the kernel file. |
| 346 | This is a valid value if and only if the "setup_sects" field |
| 347 | contains the value 15 or higher, as: |
| 348 | |
| 349 | 0x1c00 < 15*0x200 (= 0x1e00) but |
| 350 | 0x1c00 >= 14*0x200 (= 0x1c00) |
| 351 | |
| 352 | 0x1c00 >> 9 = 14, so the minimum value for setup_secs is 15. |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 353 | |
| 354 | Field name: type_of_loader |
| 355 | Type: write (obligatory) |
| 356 | Offset/size: 0x210/1 |
| 357 | Protocol: 2.00+ |
| 358 | |
| 359 | If your boot loader has an assigned id (see table below), enter |
| 360 | 0xTV here, where T is an identifier for the boot loader and V is |
| 361 | a version number. Otherwise, enter 0xFF here. |
| 362 | |
H. Peter Anvin | 5031296 | 2009-05-07 16:54:11 -0700 | [diff] [blame] | 363 | For boot loader IDs above T = 0xD, write T = 0xE to this field and |
| 364 | write the extended ID minus 0x10 to the ext_loader_type field. |
| 365 | Similarly, the ext_loader_ver field can be used to provide more than |
| 366 | four bits for the bootloader version. |
| 367 | |
| 368 | For example, for T = 0x15, V = 0x234, write: |
| 369 | |
| 370 | type_of_loader <- 0xE4 |
| 371 | ext_loader_type <- 0x05 |
| 372 | ext_loader_ver <- 0x23 |
| 373 | |
H. Peter Anvin | c5e5c42 | 2012-07-23 16:16:17 -0700 | [diff] [blame] | 374 | Assigned boot loader ids (hexadecimal): |
| 375 | |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 376 | 0 LILO (0x00 reserved for pre-2.00 bootloader) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 377 | 1 Loadlin |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 378 | 2 bootsect-loader (0x20, all other values reserved) |
H. Peter Anvin | 5031296 | 2009-05-07 16:54:11 -0700 | [diff] [blame] | 379 | 3 Syslinux |
H. Peter Anvin | cd34ab8 | 2012-12-12 20:28:39 -0800 | [diff] [blame] | 380 | 4 Etherboot/gPXE/iPXE |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 381 | 5 ELILO |
KOSAKI Motohiro | 9ee670f | 2008-11-11 11:49:01 +0900 | [diff] [blame] | 382 | 7 GRUB |
H. Peter Anvin | 5031296 | 2009-05-07 16:54:11 -0700 | [diff] [blame] | 383 | 8 U-Boot |
Jeremy Fitzhardinge | 354332e | 2006-09-12 20:35:57 -0700 | [diff] [blame] | 384 | 9 Xen |
H. Peter Anvin | c229ec5 | 2007-01-26 09:15:47 -0800 | [diff] [blame] | 385 | A Gujin |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 386 | B Qemu |
H. Peter Anvin | 5031296 | 2009-05-07 16:54:11 -0700 | [diff] [blame] | 387 | C Arcturus Networks uCbootloader |
H. Peter Anvin | 4bfe24a | 2012-12-12 20:24:12 -0800 | [diff] [blame] | 388 | D kexec-tools |
H. Peter Anvin | 5031296 | 2009-05-07 16:54:11 -0700 | [diff] [blame] | 389 | E Extended (see ext_loader_type) |
| 390 | F Special (0xFF = undefined) |
H. Peter Anvin | c5e5c42 | 2012-07-23 16:16:17 -0700 | [diff] [blame] | 391 | 10 Reserved |
| 392 | 11 Minimal Linux Bootloader <http://sebastian-plotz.blogspot.de> |
H. Peter Anvin | 686966d | 2013-02-08 09:19:33 -0800 | [diff] [blame] | 393 | 12 OVMF UEFI virtualization stack |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 394 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 395 | Please contact <hpa@zytor.com> if you need a bootloader ID |
| 396 | value assigned. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 397 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 398 | Field name: loadflags |
| 399 | Type: modify (obligatory) |
| 400 | Offset/size: 0x211/1 |
| 401 | Protocol: 2.00+ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 402 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 403 | This field is a bitmask. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 404 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 405 | Bit 0 (read): LOADED_HIGH |
| 406 | - If 0, the protected-mode code is loaded at 0x10000. |
| 407 | - If 1, the protected-mode code is loaded at 0x100000. |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 408 | |
H. Peter Anvin | 4039feb | 2008-05-30 17:16:20 -0700 | [diff] [blame] | 409 | Bit 5 (write): QUIET_FLAG |
| 410 | - If 0, print early messages. |
| 411 | - If 1, suppress early messages. |
| 412 | This requests to the kernel (decompressor and early |
| 413 | kernel) to not write early messages that require |
| 414 | accessing the display hardware directly. |
| 415 | |
Rusty Russell | e5371ac | 2007-10-21 16:41:33 -0700 | [diff] [blame] | 416 | Bit 6 (write): KEEP_SEGMENTS |
| 417 | Protocol: 2.07+ |
H. Peter Anvin | 4039feb | 2008-05-30 17:16:20 -0700 | [diff] [blame] | 418 | - If 0, reload the segment registers in the 32bit entry point. |
| 419 | - If 1, do not reload the segment registers in the 32bit entry point. |
Rusty Russell | e5371ac | 2007-10-21 16:41:33 -0700 | [diff] [blame] | 420 | Assume that %cs %ds %ss %es are all set to flat segments with |
| 421 | a base of 0 (or the equivalent for their environment). |
| 422 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 423 | Bit 7 (write): CAN_USE_HEAP |
| 424 | Set this bit to 1 to indicate that the value entered in the |
| 425 | heap_end_ptr is valid. If this field is clear, some setup code |
| 426 | functionality will be disabled. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 427 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 428 | Field name: setup_move_size |
| 429 | Type: modify (obligatory) |
| 430 | Offset/size: 0x212/2 |
| 431 | Protocol: 2.00-2.01 |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 432 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 433 | When using protocol 2.00 or 2.01, if the real mode kernel is not |
| 434 | loaded at 0x90000, it gets moved there later in the loading |
| 435 | sequence. Fill in this field if you want additional data (such as |
| 436 | the kernel command line) moved in addition to the real-mode kernel |
| 437 | itself. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 438 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 439 | The unit is bytes starting with the beginning of the boot sector. |
| 440 | |
| 441 | This field is can be ignored when the protocol is 2.02 or higher, or |
| 442 | if the real-mode code is loaded at 0x90000. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 443 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 444 | Field name: code32_start |
| 445 | Type: modify (optional, reloc) |
| 446 | Offset/size: 0x214/4 |
| 447 | Protocol: 2.00+ |
| 448 | |
| 449 | The address to jump to in protected mode. This defaults to the load |
| 450 | address of the kernel, and can be used by the boot loader to |
| 451 | determine the proper load address. |
| 452 | |
| 453 | This field can be modified for two purposes: |
| 454 | |
H. Peter Anvin | db2668f | 2007-05-23 16:59:27 -0700 | [diff] [blame] | 455 | 1. as a boot loader hook (see ADVANCED BOOT LOADER HOOKS below.) |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 456 | |
| 457 | 2. if a bootloader which does not install a hook loads a |
| 458 | relocatable kernel at a nonstandard address it will have to modify |
| 459 | this field to point to the load address. |
| 460 | |
| 461 | Field name: ramdisk_image |
| 462 | Type: write (obligatory) |
| 463 | Offset/size: 0x218/4 |
| 464 | Protocol: 2.00+ |
| 465 | |
| 466 | The 32-bit linear address of the initial ramdisk or ramfs. Leave at |
| 467 | zero if there is no initial ramdisk/ramfs. |
| 468 | |
| 469 | Field name: ramdisk_size |
| 470 | Type: write (obligatory) |
| 471 | Offset/size: 0x21c/4 |
| 472 | Protocol: 2.00+ |
| 473 | |
| 474 | Size of the initial ramdisk or ramfs. Leave at zero if there is no |
| 475 | initial ramdisk/ramfs. |
| 476 | |
| 477 | Field name: bootsect_kludge |
| 478 | Type: kernel internal |
| 479 | Offset/size: 0x220/4 |
| 480 | Protocol: 2.00+ |
| 481 | |
| 482 | This field is obsolete. |
| 483 | |
| 484 | Field name: heap_end_ptr |
| 485 | Type: write (obligatory) |
| 486 | Offset/size: 0x224/2 |
| 487 | Protocol: 2.01+ |
| 488 | |
| 489 | Set this field to the offset (from the beginning of the real-mode |
| 490 | code) of the end of the setup stack/heap, minus 0x0200. |
| 491 | |
H. Peter Anvin | 5031296 | 2009-05-07 16:54:11 -0700 | [diff] [blame] | 492 | Field name: ext_loader_ver |
| 493 | Type: write (optional) |
| 494 | Offset/size: 0x226/1 |
| 495 | Protocol: 2.02+ |
| 496 | |
| 497 | This field is used as an extension of the version number in the |
| 498 | type_of_loader field. The total version number is considered to be |
| 499 | (type_of_loader & 0x0f) + (ext_loader_ver << 4). |
| 500 | |
| 501 | The use of this field is boot loader specific. If not written, it |
| 502 | is zero. |
| 503 | |
| 504 | Kernels prior to 2.6.31 did not recognize this field, but it is safe |
| 505 | to write for protocol version 2.02 or higher. |
| 506 | |
| 507 | Field name: ext_loader_type |
| 508 | Type: write (obligatory if (type_of_loader & 0xf0) == 0xe0) |
| 509 | Offset/size: 0x227/1 |
| 510 | Protocol: 2.02+ |
| 511 | |
| 512 | This field is used as an extension of the type number in |
| 513 | type_of_loader field. If the type in type_of_loader is 0xE, then |
| 514 | the actual type is (ext_loader_type + 0x10). |
| 515 | |
| 516 | This field is ignored if the type in type_of_loader is not 0xE. |
| 517 | |
| 518 | Kernels prior to 2.6.31 did not recognize this field, but it is safe |
| 519 | to write for protocol version 2.02 or higher. |
| 520 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 521 | Field name: cmd_line_ptr |
| 522 | Type: write (obligatory) |
| 523 | Offset/size: 0x228/4 |
| 524 | Protocol: 2.02+ |
| 525 | |
| 526 | Set this field to the linear address of the kernel command line. |
| 527 | The kernel command line can be located anywhere between the end of |
| 528 | the setup heap and 0xA0000; it does not have to be located in the |
| 529 | same 64K segment as the real-mode code itself. |
| 530 | |
| 531 | Fill in this field even if your boot loader does not support a |
| 532 | command line, in which case you can point this to an empty string |
| 533 | (or better yet, to the string "auto".) If this field is left at |
| 534 | zero, the kernel will assume that your boot loader does not support |
| 535 | the 2.02+ protocol. |
| 536 | |
Baodong Chen | e56d0cf | 2009-01-08 19:24:29 +0800 | [diff] [blame] | 537 | Field name: ramdisk_max |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 538 | Type: read |
| 539 | Offset/size: 0x22c/4 |
| 540 | Protocol: 2.03+ |
| 541 | |
| 542 | The maximum address that may be occupied by the initial |
| 543 | ramdisk/ramfs contents. For boot protocols 2.02 or earlier, this |
| 544 | field is not present, and the maximum address is 0x37FFFFFF. (This |
| 545 | address is defined as the address of the highest safe byte, so if |
| 546 | your ramdisk is exactly 131072 bytes long and this field is |
| 547 | 0x37FFFFFF, you can start your ramdisk at 0x37FE0000.) |
| 548 | |
| 549 | Field name: kernel_alignment |
H. Peter Anvin | d297366 | 2009-05-11 16:06:23 -0700 | [diff] [blame] | 550 | Type: read/modify (reloc) |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 551 | Offset/size: 0x230/4 |
H. Peter Anvin | d297366 | 2009-05-11 16:06:23 -0700 | [diff] [blame] | 552 | Protocol: 2.05+ (read), 2.10+ (modify) |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 553 | |
H. Peter Anvin | d297366 | 2009-05-11 16:06:23 -0700 | [diff] [blame] | 554 | Alignment unit required by the kernel (if relocatable_kernel is |
| 555 | true.) A relocatable kernel that is loaded at an alignment |
| 556 | incompatible with the value in this field will be realigned during |
| 557 | kernel initialization. |
| 558 | |
| 559 | Starting with protocol version 2.10, this reflects the kernel |
| 560 | alignment preferred for optimal performance; it is possible for the |
| 561 | loader to modify this field to permit a lesser alignment. See the |
| 562 | min_alignment and pref_address field below. |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 563 | |
| 564 | Field name: relocatable_kernel |
| 565 | Type: read (reloc) |
| 566 | Offset/size: 0x234/1 |
| 567 | Protocol: 2.05+ |
| 568 | |
| 569 | If this field is nonzero, the protected-mode part of the kernel can |
| 570 | be loaded at any address that satisfies the kernel_alignment field. |
| 571 | After loading, the boot loader must set the code32_start field to |
| 572 | point to the loaded code, or to a boot loader hook. |
| 573 | |
H. Peter Anvin | d297366 | 2009-05-11 16:06:23 -0700 | [diff] [blame] | 574 | Field name: min_alignment |
| 575 | Type: read (reloc) |
| 576 | Offset/size: 0x235/1 |
| 577 | Protocol: 2.10+ |
| 578 | |
| 579 | This field, if nonzero, indicates as a power of two the minimum |
| 580 | alignment required, as opposed to preferred, by the kernel to boot. |
| 581 | If a boot loader makes use of this field, it should update the |
| 582 | kernel_alignment field with the alignment unit desired; typically: |
| 583 | |
| 584 | kernel_alignment = 1 << min_alignment |
| 585 | |
| 586 | There may be a considerable performance cost with an excessively |
| 587 | misaligned kernel. Therefore, a loader should typically try each |
| 588 | power-of-two alignment from kernel_alignment down to this alignment. |
| 589 | |
H. Peter Anvin | 09c205a | 2013-01-27 10:43:28 -0800 | [diff] [blame] | 590 | Field name: xloadflags |
| 591 | Type: read |
| 592 | Offset/size: 0x236/2 |
| 593 | Protocol: 2.12+ |
| 594 | |
| 595 | This field is a bitmask. |
| 596 | |
| 597 | Bit 0 (read): XLF_KERNEL_64 |
| 598 | - If 1, this kernel has the legacy 64-bit entry point at 0x200. |
| 599 | |
| 600 | Bit 1 (read): XLF_CAN_BE_LOADED_ABOVE_4G |
| 601 | - If 1, kernel/boot_params/cmdline/ramdisk can be above 4G. |
| 602 | |
| 603 | Bit 2 (read): XLF_EFI_HANDOVER_32 |
| 604 | - If 1, the kernel supports the 32-bit EFI handoff entry point |
| 605 | given at handover_offset. |
| 606 | |
| 607 | Bit 3 (read): XLF_EFI_HANDOVER_64 |
| 608 | - If 1, the kernel supports the 64-bit EFI handoff entry point |
| 609 | given at handover_offset + 0x200. |
| 610 | |
Dave Young | 456a29d | 2013-12-20 18:02:20 +0800 | [diff] [blame] | 611 | Bit 4 (read): XLF_EFI_KEXEC |
| 612 | - If 1, the kernel supports kexec EFI boot with EFI runtime support. |
| 613 | |
H. Peter Anvin | dec04cf | 2007-05-17 15:50:47 -0700 | [diff] [blame] | 614 | Field name: cmdline_size |
| 615 | Type: read |
| 616 | Offset/size: 0x238/4 |
| 617 | Protocol: 2.06+ |
| 618 | |
| 619 | The maximum size of the command line without the terminating |
| 620 | zero. This means that the command line can contain at most |
| 621 | cmdline_size characters. With protocol version 2.05 and earlier, the |
| 622 | maximum size was 255. |
Bernhard Walle | 8f9aeca | 2007-05-02 19:27:10 +0200 | [diff] [blame] | 623 | |
Rusty Russell | e5371ac | 2007-10-21 16:41:33 -0700 | [diff] [blame] | 624 | Field name: hardware_subarch |
H. Peter Anvin | 4039feb | 2008-05-30 17:16:20 -0700 | [diff] [blame] | 625 | Type: write (optional, defaults to x86/PC) |
Rusty Russell | e5371ac | 2007-10-21 16:41:33 -0700 | [diff] [blame] | 626 | Offset/size: 0x23c/4 |
| 627 | Protocol: 2.07+ |
| 628 | |
| 629 | In a paravirtualized environment the hardware low level architectural |
| 630 | pieces such as interrupt handling, page table handling, and |
| 631 | accessing process control registers needs to be done differently. |
| 632 | |
| 633 | This field allows the bootloader to inform the kernel we are in one |
| 634 | one of those environments. |
| 635 | |
| 636 | 0x00000000 The default x86/PC environment |
| 637 | 0x00000001 lguest |
| 638 | 0x00000002 Xen |
Pan, Jacob jun | 162bc7a | 2009-08-28 14:52:47 -0700 | [diff] [blame] | 639 | 0x00000003 Moorestown MID |
Thomas Gleixner | c751e17 | 2010-11-09 12:08:04 -0800 | [diff] [blame] | 640 | 0x00000004 CE4100 TV Platform |
Rusty Russell | e5371ac | 2007-10-21 16:41:33 -0700 | [diff] [blame] | 641 | |
| 642 | Field name: hardware_subarch_data |
H. Peter Anvin | 4039feb | 2008-05-30 17:16:20 -0700 | [diff] [blame] | 643 | Type: write (subarch-dependent) |
Rusty Russell | e5371ac | 2007-10-21 16:41:33 -0700 | [diff] [blame] | 644 | Offset/size: 0x240/8 |
| 645 | Protocol: 2.07+ |
| 646 | |
| 647 | A pointer to data that is specific to hardware subarch |
H. Peter Anvin | 4039feb | 2008-05-30 17:16:20 -0700 | [diff] [blame] | 648 | This field is currently unused for the default x86/PC environment, |
| 649 | do not modify. |
Rusty Russell | e5371ac | 2007-10-21 16:41:33 -0700 | [diff] [blame] | 650 | |
Ian Campbell | 87253d1 | 2008-02-19 11:12:30 +0000 | [diff] [blame] | 651 | Field name: payload_offset |
Ian Campbell | 099e137 | 2008-02-13 20:54:58 +0000 | [diff] [blame] | 652 | Type: read |
| 653 | Offset/size: 0x248/4 |
| 654 | Protocol: 2.08+ |
| 655 | |
Philipp Kohlbecher | e1286f2 | 2008-12-14 18:50:01 +0100 | [diff] [blame] | 656 | If non-zero then this field contains the offset from the beginning |
| 657 | of the protected-mode code to the payload. |
Ian Campbell | 87253d1 | 2008-02-19 11:12:30 +0000 | [diff] [blame] | 658 | |
| 659 | The payload may be compressed. The format of both the compressed and |
| 660 | uncompressed data should be determined using the standard magic |
H. Peter Anvin | ee28758 | 2009-01-14 16:07:38 -0800 | [diff] [blame] | 661 | numbers. The currently supported compression formats are gzip |
Lasse Collin | 3031480 | 2011-01-12 17:01:24 -0800 | [diff] [blame] | 662 | (magic numbers 1F 8B or 1F 9E), bzip2 (magic number 42 5A), LZMA |
Kyungsik Lee | f9b493a | 2013-07-08 16:01:48 -0700 | [diff] [blame] | 663 | (magic number 5D 00), XZ (magic number FD 37), and LZ4 (magic number |
| 664 | 02 21). The uncompressed payload is currently always ELF (magic |
| 665 | number 7F 45 4C 46). |
| 666 | |
Ian Campbell | 87253d1 | 2008-02-19 11:12:30 +0000 | [diff] [blame] | 667 | Field name: payload_length |
Ian Campbell | 099e137 | 2008-02-13 20:54:58 +0000 | [diff] [blame] | 668 | Type: read |
| 669 | Offset/size: 0x24c/4 |
| 670 | Protocol: 2.08+ |
| 671 | |
Ian Campbell | 87253d1 | 2008-02-19 11:12:30 +0000 | [diff] [blame] | 672 | The length of the payload. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 673 | |
H. Peter Anvin | 4039feb | 2008-05-30 17:16:20 -0700 | [diff] [blame] | 674 | Field name: setup_data |
| 675 | Type: write (special) |
| 676 | Offset/size: 0x250/8 |
| 677 | Protocol: 2.09+ |
| 678 | |
| 679 | The 64-bit physical pointer to NULL terminated single linked list of |
| 680 | struct setup_data. This is used to define a more extensible boot |
| 681 | parameters passing mechanism. The definition of struct setup_data is |
| 682 | as follow: |
| 683 | |
| 684 | struct setup_data { |
| 685 | u64 next; |
| 686 | u32 type; |
| 687 | u32 len; |
| 688 | u8 data[0]; |
| 689 | }; |
| 690 | |
| 691 | Where, the next is a 64-bit physical pointer to the next node of |
| 692 | linked list, the next field of the last node is 0; the type is used |
| 693 | to identify the contents of data; the len is the length of data |
| 694 | field; the data holds the real payload. |
| 695 | |
| 696 | This list may be modified at a number of points during the bootup |
| 697 | process. Therefore, when modifying this list one should always make |
| 698 | sure to consider the case where the linked list already contains |
| 699 | entries. |
| 700 | |
H. Peter Anvin | d297366 | 2009-05-11 16:06:23 -0700 | [diff] [blame] | 701 | Field name: pref_address |
| 702 | Type: read (reloc) |
| 703 | Offset/size: 0x258/8 |
| 704 | Protocol: 2.10+ |
| 705 | |
| 706 | This field, if nonzero, represents a preferred load address for the |
| 707 | kernel. A relocating bootloader should attempt to load at this |
| 708 | address if possible. |
| 709 | |
| 710 | A non-relocatable kernel will unconditionally move itself and to run |
| 711 | at this address. |
| 712 | |
| 713 | Field name: init_size |
| 714 | Type: read |
Darren Hart | 11e48fe | 2011-07-11 20:27:40 -0700 | [diff] [blame] | 715 | Offset/size: 0x260/4 |
H. Peter Anvin | d297366 | 2009-05-11 16:06:23 -0700 | [diff] [blame] | 716 | |
| 717 | This field indicates the amount of linear contiguous memory starting |
| 718 | at the kernel runtime start address that the kernel needs before it |
| 719 | is capable of examining its memory map. This is not the same thing |
| 720 | as the total amount of memory the kernel needs to boot, but it can |
| 721 | be used by a relocating boot loader to help select a safe load |
| 722 | address for the kernel. |
| 723 | |
| 724 | The kernel runtime start address is determined by the following algorithm: |
| 725 | |
| 726 | if (relocatable_kernel) |
| 727 | runtime_start = align_up(load_address, kernel_alignment) |
| 728 | else |
| 729 | runtime_start = pref_address |
| 730 | |
Matt Fleming | 9ca8f72 | 2012-07-19 10:23:48 +0100 | [diff] [blame] | 731 | Field name: handover_offset |
| 732 | Type: read |
| 733 | Offset/size: 0x264/4 |
| 734 | |
| 735 | This field is the offset from the beginning of the kernel image to |
| 736 | the EFI handover protocol entry point. Boot loaders using the EFI |
| 737 | handover protocol to boot the kernel should jump to this offset. |
| 738 | |
| 739 | See EFI HANDOVER PROTOCOL below for more details. |
| 740 | |
H. Peter Anvin | 4039feb | 2008-05-30 17:16:20 -0700 | [diff] [blame] | 741 | |
Ian Campbell | 7d6e737 | 2008-02-17 20:06:35 +0100 | [diff] [blame] | 742 | **** THE IMAGE CHECKSUM |
| 743 | |
| 744 | From boot protocol version 2.08 onwards the CRC-32 is calculated over |
| 745 | the entire file using the characteristic polynomial 0x04C11DB7 and an |
| 746 | initial remainder of 0xffffffff. The checksum is appended to the |
| 747 | file; therefore the CRC of the file up to the limit specified in the |
| 748 | syssize field of the header is always 0. |
| 749 | |
H. Peter Anvin | 4039feb | 2008-05-30 17:16:20 -0700 | [diff] [blame] | 750 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 751 | **** THE KERNEL COMMAND LINE |
| 752 | |
| 753 | The kernel command line has become an important way for the boot |
| 754 | loader to communicate with the kernel. Some of its options are also |
| 755 | relevant to the boot loader itself, see "special command line options" |
| 756 | below. |
| 757 | |
Bernhard Walle | 8f9aeca | 2007-05-02 19:27:10 +0200 | [diff] [blame] | 758 | The kernel command line is a null-terminated string. The maximum |
| 759 | length can be retrieved from the field cmdline_size. Before protocol |
| 760 | version 2.06, the maximum was 255 characters. A string that is too |
| 761 | long will be automatically truncated by the kernel. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 762 | |
| 763 | If the boot protocol version is 2.02 or later, the address of the |
| 764 | kernel command line is given by the header field cmd_line_ptr (see |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 765 | above.) This address can be anywhere between the end of the setup |
| 766 | heap and 0xA0000. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 767 | |
| 768 | If the protocol version is *not* 2.02 or higher, the kernel |
| 769 | command line is entered using the following protocol: |
| 770 | |
| 771 | At offset 0x0020 (word), "cmd_line_magic", enter the magic |
| 772 | number 0xA33F. |
| 773 | |
| 774 | At offset 0x0022 (word), "cmd_line_offset", enter the offset |
| 775 | of the kernel command line (relative to the start of the |
| 776 | real-mode kernel). |
| 777 | |
| 778 | The kernel command line *must* be within the memory region |
| 779 | covered by setup_move_size, so you may need to adjust this |
| 780 | field. |
| 781 | |
| 782 | |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 783 | **** MEMORY LAYOUT OF THE REAL-MODE CODE |
| 784 | |
| 785 | The real-mode code requires a stack/heap to be set up, as well as |
| 786 | memory allocated for the kernel command line. This needs to be done |
| 787 | in the real-mode accessible memory in bottom megabyte. |
| 788 | |
| 789 | It should be noted that modern machines often have a sizable Extended |
| 790 | BIOS Data Area (EBDA). As a result, it is advisable to use as little |
| 791 | of the low megabyte as possible. |
| 792 | |
| 793 | Unfortunately, under the following circumstances the 0x90000 memory |
| 794 | segment has to be used: |
| 795 | |
| 796 | - When loading a zImage kernel ((loadflags & 0x01) == 0). |
| 797 | - When loading a 2.01 or earlier boot protocol kernel. |
| 798 | |
| 799 | -> For the 2.00 and 2.01 boot protocols, the real-mode code |
| 800 | can be loaded at another address, but it is internally |
| 801 | relocated to 0x90000. For the "old" protocol, the |
| 802 | real-mode code must be loaded at 0x90000. |
| 803 | |
| 804 | When loading at 0x90000, avoid using memory above 0x9a000. |
| 805 | |
| 806 | For boot protocol 2.02 or higher, the command line does not have to be |
| 807 | located in the same 64K segment as the real-mode setup code; it is |
| 808 | thus permitted to give the stack/heap the full 64K segment and locate |
| 809 | the command line above it. |
| 810 | |
| 811 | The kernel command line should not be located below the real-mode |
| 812 | code, nor should it be located in high memory. |
| 813 | |
| 814 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 815 | **** SAMPLE BOOT CONFIGURATION |
| 816 | |
| 817 | As a sample configuration, assume the following layout of the real |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 818 | mode segment: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 819 | |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 820 | When loading below 0x90000, use the entire segment: |
| 821 | |
| 822 | 0x0000-0x7fff Real mode kernel |
| 823 | 0x8000-0xdfff Stack and heap |
| 824 | 0xe000-0xffff Kernel command line |
| 825 | |
| 826 | When loading at 0x90000 OR the protocol version is 2.01 or earlier: |
| 827 | |
| 828 | 0x0000-0x7fff Real mode kernel |
| 829 | 0x8000-0x97ff Stack and heap |
| 830 | 0x9800-0x9fff Kernel command line |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 831 | |
| 832 | Such a boot loader should enter the following fields in the header: |
| 833 | |
| 834 | unsigned long base_ptr; /* base address for real-mode segment */ |
| 835 | |
| 836 | if ( setup_sects == 0 ) { |
| 837 | setup_sects = 4; |
| 838 | } |
| 839 | |
| 840 | if ( protocol >= 0x0200 ) { |
| 841 | type_of_loader = <type code>; |
| 842 | if ( loading_initrd ) { |
| 843 | ramdisk_image = <initrd_address>; |
| 844 | ramdisk_size = <initrd_size>; |
| 845 | } |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 846 | |
| 847 | if ( protocol >= 0x0202 && loadflags & 0x01 ) |
| 848 | heap_end = 0xe000; |
| 849 | else |
| 850 | heap_end = 0x9800; |
| 851 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 852 | if ( protocol >= 0x0201 ) { |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 853 | heap_end_ptr = heap_end - 0x200; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 854 | loadflags |= 0x80; /* CAN_USE_HEAP */ |
| 855 | } |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 856 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 857 | if ( protocol >= 0x0202 ) { |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 858 | cmd_line_ptr = base_ptr + heap_end; |
| 859 | strcpy(cmd_line_ptr, cmdline); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 860 | } else { |
| 861 | cmd_line_magic = 0xA33F; |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 862 | cmd_line_offset = heap_end; |
| 863 | setup_move_size = heap_end + strlen(cmdline)+1; |
| 864 | strcpy(base_ptr+cmd_line_offset, cmdline); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 865 | } |
| 866 | } else { |
| 867 | /* Very old kernel */ |
| 868 | |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 869 | heap_end = 0x9800; |
| 870 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 871 | cmd_line_magic = 0xA33F; |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 872 | cmd_line_offset = heap_end; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 873 | |
| 874 | /* A very old kernel MUST have its real-mode code |
| 875 | loaded at 0x90000 */ |
| 876 | |
| 877 | if ( base_ptr != 0x90000 ) { |
| 878 | /* Copy the real-mode kernel */ |
| 879 | memcpy(0x90000, base_ptr, (setup_sects+1)*512); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 880 | base_ptr = 0x90000; /* Relocated */ |
| 881 | } |
| 882 | |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 883 | strcpy(0x90000+cmd_line_offset, cmdline); |
| 884 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 885 | /* It is recommended to clear memory up to the 32K mark */ |
| 886 | memset(0x90000 + (setup_sects+1)*512, 0, |
| 887 | (64-(setup_sects+1))*512); |
| 888 | } |
| 889 | |
| 890 | |
| 891 | **** LOADING THE REST OF THE KERNEL |
| 892 | |
H. Peter Anvin | f8eeaaf | 2005-09-06 15:17:24 -0700 | [diff] [blame] | 893 | The 32-bit (non-real-mode) kernel starts at offset (setup_sects+1)*512 |
| 894 | in the kernel file (again, if setup_sects == 0 the real value is 4.) |
| 895 | It should be loaded at address 0x10000 for Image/zImage kernels and |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 896 | 0x100000 for bzImage kernels. |
| 897 | |
| 898 | The kernel is a bzImage kernel if the protocol >= 2.00 and the 0x01 |
| 899 | bit (LOAD_HIGH) in the loadflags field is set: |
| 900 | |
| 901 | is_bzImage = (protocol >= 0x0200) && (loadflags & 0x01); |
| 902 | load_address = is_bzImage ? 0x100000 : 0x10000; |
| 903 | |
| 904 | Note that Image/zImage kernels can be up to 512K in size, and thus use |
| 905 | the entire 0x10000-0x90000 range of memory. This means it is pretty |
| 906 | much a requirement for these kernels to load the real-mode part at |
| 907 | 0x90000. bzImage kernels allow much more flexibility. |
| 908 | |
| 909 | |
| 910 | **** SPECIAL COMMAND LINE OPTIONS |
| 911 | |
| 912 | If the command line provided by the boot loader is entered by the |
| 913 | user, the user may expect the following command line options to work. |
| 914 | They should normally not be deleted from the kernel command line even |
| 915 | though not all of them are actually meaningful to the kernel. Boot |
| 916 | loader authors who need additional command line options for the boot |
| 917 | loader itself should get them registered in |
| 918 | Documentation/kernel-parameters.txt to make sure they will not |
| 919 | conflict with actual kernel options now or in the future. |
| 920 | |
| 921 | vga=<mode> |
| 922 | <mode> here is either an integer (in C notation, either |
| 923 | decimal, octal, or hexadecimal) or one of the strings |
| 924 | "normal" (meaning 0xFFFF), "ext" (meaning 0xFFFE) or "ask" |
| 925 | (meaning 0xFFFD). This value should be entered into the |
| 926 | vid_mode field, as it is used by the kernel before the command |
| 927 | line is parsed. |
| 928 | |
| 929 | mem=<size> |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 930 | <size> is an integer in C notation optionally followed by |
| 931 | (case insensitive) K, M, G, T, P or E (meaning << 10, << 20, |
| 932 | << 30, << 40, << 50 or << 60). This specifies the end of |
| 933 | memory to the kernel. This affects the possible placement of |
| 934 | an initrd, since an initrd should be placed near end of |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 935 | memory. Note that this is an option to *both* the kernel and |
| 936 | the bootloader! |
| 937 | |
| 938 | initrd=<file> |
| 939 | An initrd should be loaded. The meaning of <file> is |
| 940 | obviously bootloader-dependent, and some boot loaders |
| 941 | (e.g. LILO) do not have such a command. |
| 942 | |
| 943 | In addition, some boot loaders add the following options to the |
| 944 | user-specified command line: |
| 945 | |
| 946 | BOOT_IMAGE=<file> |
| 947 | The boot image which was loaded. Again, the meaning of <file> |
| 948 | is obviously bootloader-dependent. |
| 949 | |
| 950 | auto |
| 951 | The kernel was booted without explicit user intervention. |
| 952 | |
| 953 | If these options are added by the boot loader, it is highly |
| 954 | recommended that they are located *first*, before the user-specified |
| 955 | or configuration-specified command line. Otherwise, "init=/bin/sh" |
| 956 | gets confused by the "auto" option. |
| 957 | |
| 958 | |
| 959 | **** RUNNING THE KERNEL |
| 960 | |
| 961 | The kernel is started by jumping to the kernel entry point, which is |
| 962 | located at *segment* offset 0x20 from the start of the real mode |
| 963 | kernel. This means that if you loaded your real-mode kernel code at |
| 964 | 0x90000, the kernel entry point is 9020:0000. |
| 965 | |
| 966 | At entry, ds = es = ss should point to the start of the real-mode |
| 967 | kernel code (0x9000 if the code is loaded at 0x90000), sp should be |
| 968 | set up properly, normally pointing to the top of the heap, and |
| 969 | interrupts should be disabled. Furthermore, to guard against bugs in |
| 970 | the kernel, it is recommended that the boot loader sets fs = gs = ds = |
| 971 | es = ss. |
| 972 | |
| 973 | In our example from above, we would do: |
| 974 | |
| 975 | /* Note: in the case of the "old" kernel protocol, base_ptr must |
| 976 | be == 0x90000 at this point; see the previous sample code */ |
| 977 | |
| 978 | seg = base_ptr >> 4; |
| 979 | |
| 980 | cli(); /* Enter with interrupts disabled! */ |
| 981 | |
| 982 | /* Set up the real-mode kernel stack */ |
| 983 | _SS = seg; |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 984 | _SP = heap_end; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 985 | |
| 986 | _DS = _ES = _FS = _GS = seg; |
| 987 | jmp_far(seg+0x20, 0); /* Run the kernel */ |
| 988 | |
| 989 | If your boot sector accesses a floppy drive, it is recommended to |
| 990 | switch off the floppy motor before running the kernel, since the |
| 991 | kernel boot leaves interrupts off and thus the motor will not be |
| 992 | switched off, especially if the loaded kernel has the floppy driver as |
| 993 | a demand-loaded module! |
| 994 | |
| 995 | |
H. Peter Anvin | db2668f | 2007-05-23 16:59:27 -0700 | [diff] [blame] | 996 | **** ADVANCED BOOT LOADER HOOKS |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 997 | |
| 998 | If the boot loader runs in a particularly hostile environment (such as |
| 999 | LOADLIN, which runs under DOS) it may be impossible to follow the |
| 1000 | standard memory location requirements. Such a boot loader may use the |
| 1001 | following hooks that, if set, are invoked by the kernel at the |
| 1002 | appropriate time. The use of these hooks should probably be |
| 1003 | considered an absolutely last resort! |
| 1004 | |
| 1005 | IMPORTANT: All the hooks are required to preserve %esp, %ebp, %esi and |
| 1006 | %edi across invocation. |
| 1007 | |
| 1008 | realmode_swtch: |
| 1009 | A 16-bit real mode far subroutine invoked immediately before |
| 1010 | entering protected mode. The default routine disables NMI, so |
| 1011 | your routine should probably do so, too. |
| 1012 | |
| 1013 | code32_start: |
| 1014 | A 32-bit flat-mode routine *jumped* to immediately after the |
| 1015 | transition to protected mode, but before the kernel is |
H. Peter Anvin | de372ec | 2007-05-08 20:37:02 -0700 | [diff] [blame] | 1016 | uncompressed. No segments, except CS, are guaranteed to be |
| 1017 | set up (current kernels do, but older ones do not); you should |
| 1018 | set them up to BOOT_DS (0x18) yourself. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1019 | |
| 1020 | After completing your hook, you should jump to the address |
H. Peter Anvin | db2668f | 2007-05-23 16:59:27 -0700 | [diff] [blame] | 1021 | that was in this field before your boot loader overwrote it |
| 1022 | (relocated, if appropriate.) |
Huang, Ying | aa69432 | 2007-10-24 10:18:49 +0800 | [diff] [blame] | 1023 | |
| 1024 | |
| 1025 | **** 32-bit BOOT PROTOCOL |
| 1026 | |
| 1027 | For machine with some new BIOS other than legacy BIOS, such as EFI, |
| 1028 | LinuxBIOS, etc, and kexec, the 16-bit real mode setup code in kernel |
| 1029 | based on legacy BIOS can not be used, so a 32-bit boot protocol needs |
| 1030 | to be defined. |
| 1031 | |
| 1032 | In 32-bit boot protocol, the first step in loading a Linux kernel |
| 1033 | should be to setup the boot parameters (struct boot_params, |
| 1034 | traditionally known as "zero page"). The memory for struct boot_params |
| 1035 | should be allocated and initialized to all zero. Then the setup header |
| 1036 | from offset 0x01f1 of kernel image on should be loaded into struct |
| 1037 | boot_params and examined. The end of setup header can be calculated as |
| 1038 | follow: |
| 1039 | |
| 1040 | 0x0202 + byte value at offset 0x0201 |
| 1041 | |
| 1042 | In addition to read/modify/write the setup header of the struct |
| 1043 | boot_params as that of 16-bit boot protocol, the boot loader should |
| 1044 | also fill the additional fields of the struct boot_params as that |
| 1045 | described in zero-page.txt. |
| 1046 | |
Kees Cook | c6039f4 | 2012-10-25 20:17:02 -0700 | [diff] [blame] | 1047 | After setting up the struct boot_params, the boot loader can load the |
Huang, Ying | aa69432 | 2007-10-24 10:18:49 +0800 | [diff] [blame] | 1048 | 32/64-bit kernel in the same way as that of 16-bit boot protocol. |
| 1049 | |
| 1050 | In 32-bit boot protocol, the kernel is started by jumping to the |
| 1051 | 32-bit kernel entry point, which is the start address of loaded |
| 1052 | 32/64-bit kernel. |
| 1053 | |
| 1054 | At entry, the CPU must be in 32-bit protected mode with paging |
| 1055 | disabled; a GDT must be loaded with the descriptors for selectors |
| 1056 | __BOOT_CS(0x10) and __BOOT_DS(0x18); both descriptors must be 4G flat |
Kees Cook | c6039f4 | 2012-10-25 20:17:02 -0700 | [diff] [blame] | 1057 | segment; __BOOT_CS must have execute/read permission, and __BOOT_DS |
Huang, Ying | aa69432 | 2007-10-24 10:18:49 +0800 | [diff] [blame] | 1058 | must have read/write permission; CS must be __BOOT_CS and DS, ES, SS |
| 1059 | must be __BOOT_DS; interrupt must be disabled; %esi must hold the base |
| 1060 | address of the struct boot_params; %ebp, %edi and %ebx must be zero. |
Matt Fleming | 9ca8f72 | 2012-07-19 10:23:48 +0100 | [diff] [blame] | 1061 | |
Yinghai Lu | 8ee2f2d | 2013-01-24 12:20:07 -0800 | [diff] [blame] | 1062 | **** 64-bit BOOT PROTOCOL |
| 1063 | |
| 1064 | For machine with 64bit cpus and 64bit kernel, we could use 64bit bootloader |
| 1065 | and we need a 64-bit boot protocol. |
| 1066 | |
| 1067 | In 64-bit boot protocol, the first step in loading a Linux kernel |
| 1068 | should be to setup the boot parameters (struct boot_params, |
| 1069 | traditionally known as "zero page"). The memory for struct boot_params |
| 1070 | could be allocated anywhere (even above 4G) and initialized to all zero. |
| 1071 | Then, the setup header at offset 0x01f1 of kernel image on should be |
| 1072 | loaded into struct boot_params and examined. The end of setup header |
| 1073 | can be calculated as follows: |
| 1074 | |
| 1075 | 0x0202 + byte value at offset 0x0201 |
| 1076 | |
| 1077 | In addition to read/modify/write the setup header of the struct |
| 1078 | boot_params as that of 16-bit boot protocol, the boot loader should |
| 1079 | also fill the additional fields of the struct boot_params as described |
| 1080 | in zero-page.txt. |
| 1081 | |
| 1082 | After setting up the struct boot_params, the boot loader can load |
| 1083 | 64-bit kernel in the same way as that of 16-bit boot protocol, but |
| 1084 | kernel could be loaded above 4G. |
| 1085 | |
| 1086 | In 64-bit boot protocol, the kernel is started by jumping to the |
| 1087 | 64-bit kernel entry point, which is the start address of loaded |
| 1088 | 64-bit kernel plus 0x200. |
| 1089 | |
| 1090 | At entry, the CPU must be in 64-bit mode with paging enabled. |
| 1091 | The range with setup_header.init_size from start address of loaded |
| 1092 | kernel and zero page and command line buffer get ident mapping; |
| 1093 | a GDT must be loaded with the descriptors for selectors |
| 1094 | __BOOT_CS(0x10) and __BOOT_DS(0x18); both descriptors must be 4G flat |
| 1095 | segment; __BOOT_CS must have execute/read permission, and __BOOT_DS |
| 1096 | must have read/write permission; CS must be __BOOT_CS and DS, ES, SS |
| 1097 | must be __BOOT_DS; interrupt must be disabled; %rsi must hold the base |
| 1098 | address of the struct boot_params. |
| 1099 | |
Matt Fleming | 9ca8f72 | 2012-07-19 10:23:48 +0100 | [diff] [blame] | 1100 | **** EFI HANDOVER PROTOCOL |
| 1101 | |
| 1102 | This protocol allows boot loaders to defer initialisation to the EFI |
| 1103 | boot stub. The boot loader is required to load the kernel/initrd(s) |
| 1104 | from the boot media and jump to the EFI handover protocol entry point |
| 1105 | which is hdr->handover_offset bytes from the beginning of |
| 1106 | startup_{32,64}. |
| 1107 | |
| 1108 | The function prototype for the handover entry point looks like this, |
| 1109 | |
| 1110 | efi_main(void *handle, efi_system_table_t *table, struct boot_params *bp) |
| 1111 | |
| 1112 | 'handle' is the EFI image handle passed to the boot loader by the EFI |
| 1113 | firmware, 'table' is the EFI system table - these are the first two |
| 1114 | arguments of the "handoff state" as described in section 2.3 of the |
| 1115 | UEFI specification. 'bp' is the boot loader-allocated boot params. |
| 1116 | |
| 1117 | The boot loader *must* fill out the following fields in bp, |
| 1118 | |
| 1119 | o hdr.code32_start |
| 1120 | o hdr.cmd_line_ptr |
| 1121 | o hdr.cmdline_size |
| 1122 | o hdr.ramdisk_image (if applicable) |
| 1123 | o hdr.ramdisk_size (if applicable) |
| 1124 | |
| 1125 | All other fields should be zero. |