锘??xml version="1.0" encoding="utf-8" standalone="yes"?>
聽聽聽聽聽聽 ----------------------------
聽聽聽聽聽 H. Peter Anvin <hpa@zytor.com>
聽聽聽Last update 2005-09-02
On the i386 platform, the Linux kernel uses a rather complicated boot
convention.聽 This has evolved partially due to historical aspects, as
well as the desire in the early days to have the kernel itself be a
bootable image, the complicated PC memory model and due to changed
expectations in the PC industry caused by the effective demise of
real-mode DOS as a mainstream operating system.
Currently, four versions of the Linux/i386 boot protocol exist.
Old kernels:聽zImage/Image support only.聽 Some very early kernels
聽聽may not even support a command line.
Protocol 2.00:聽(Kernel 1.3.73) Added bzImage and initrd support, as
聽聽well as a formalized way to communicate between the
聽聽boot loader and the kernel.聽 setup.S made relocatable,
聽聽although the traditional setup area still assumed
聽聽writable.
Protocol 2.01:聽(Kernel 1.3.76) Added a heap overrun warning.
Protocol 2.02:聽(Kernel 2.4.0-test3-pre3) New command line protocol.
聽聽Lower the conventional memory ceiling.聽No overwrite
聽聽of the traditional setup area, thus making booting
聽聽safe for systems which use the EBDA from SMM or 32-bit
聽聽BIOS entry points.聽 zImage deprecated but still
聽聽supported.
Protocol 2.03:聽(Kernel 2.4.18-pre1) Explicitly makes the highest possible
聽聽initrd address available to the bootloader.
Protocol 2.04:聽(Kernel 2.6.14) Extend the syssize field to four bytes.
**** MEMORY LAYOUT
The traditional memory map for the kernel loader, used for Image or
zImage kernels, typically looks like:
聽|聽聽聽 |
0A0000聽+------------------------+
聽|聽 Reserved for BIOS聽 |聽Do not use.聽 Reserved for BIOS EBDA.
09A000聽+------------------------+
聽|聽 Stack/heap/cmdline聽 |聽For use by the kernel real-mode code.
098000聽+------------------------+聽
聽|聽 Kernel setup聽聽 |聽The kernel real-mode code.
090200聽+------------------------+
聽|聽 Kernel boot sector聽 |聽The kernel legacy boot sector.
090000聽+------------------------+
聽|聽 Protected-mode kernel |聽The bulk of the kernel image.
010000聽+------------------------+
聽|聽 Boot loader聽聽 |聽<- Boot sector entry point 0000:7C00
001000聽+------------------------+
聽|聽 Reserved for MBR/BIOS |
000800聽+------------------------+
聽|聽 Typically used by MBR |
000600聽+------------------------+
聽|聽 BIOS use only聽 |
000000聽+------------------------+
When using bzImage, the protected-mode kernel was relocated to
0x100000 ("high memory"), and the kernel real-mode block (boot sector,
setup, and stack/heap) was made relocatable to any address between
0x10000 and end of low memory.聽Unfortunately, in protocols 2.00 and
2.01 the command line is still required to live in the 0x9XXXX memory
range, and that memory range is still overwritten by the early kernel.
The 2.02 protocol resolves that problem.
It is desirable to keep the "memory ceiling" -- the highest point in
low memory touched by the boot loader -- as low as possible, since
some newer BIOSes have begun to allocate some rather large amounts of
memory, called the Extended BIOS Data Area, near the top of low
memory.聽 The boot loader should use the "INT 12h" BIOS call to verify
how much low memory is available.
Unfortunately, if INT 12h reports that the amount of memory is too
low, there is usually nothing the boot loader can do but to report an
error to the user.聽 The boot loader should therefore be designed to
take up as little space in low memory as it reasonably can.聽 For
zImage or old bzImage kernels, which need data written into the
0x90000 segment, the boot loader should make sure not to use memory
above the 0x9A000 point; too many BIOSes will break above that point.
**** THE REAL-MODE KERNEL HEADER
In the following text, and anywhere in the kernel boot sequence, "a
sector" refers to 512 bytes.聽 It is independent of the actual sector
size of the underlying medium.
The first step in loading a Linux kernel should be to load the
real-mode code (boot sector and setup code) and then examine the
following header at offset 0x01f1.聽 The real-mode code can total up to
32K, although the boot loader may choose to load only the first two
sectors (1K) and then examine the bootup sector size.
The header looks like:
Offset聽Proto聽Name聽聽Meaning
/Size
01F1/1聽ALL(1聽setup_sects聽The size of the setup in sectors
01F2/2聽ALL聽root_flags聽I(yíng)f set, the root is mounted readonly
01F4/4聽2.04+(2聽syssize聽聽The size of the 32-bit code in 16-byte paras
01F8/2聽ALL聽ram_size聽DO NOT USE - for bootsect.S use only
01FA/2聽ALL聽vid_mode聽Video mode control
01FC/2聽ALL聽root_dev聽Default root device number
01FE/2聽ALL聽boot_flag聽0xAA55 magic number
0200/2聽2.00+聽jump聽聽Jump instruction
0202/4聽2.00+聽header聽聽Magic signature "HdrS"
0206/2聽2.00+聽version聽聽Boot protocol version supported
0208/4聽2.00+聽realmode_swtch聽Boot loader hook (see below)
020C/2聽2.00+聽start_sys聽The load-low segment (0x1000) (obsolete)
020E/2聽2.00+聽kernel_version聽Pointer to kernel version string
0210/1聽2.00+聽type_of_loader聽Boot loader identifier
0211/1聽2.00+聽loadflags聽Boot protocol option flags
0212/2聽2.00+聽setup_move_size聽Move to high memory size (used with hooks)
0214/4聽2.00+聽code32_start聽Boot loader hook (see below)
0218/4聽2.00+聽ramdisk_image聽initrd load address (set by boot loader)
021C/4聽2.00+聽ramdisk_size聽initrd size (set by boot loader)
0220/4聽2.00+聽bootsect_kludge聽DO NOT USE - for bootsect.S use only
0224/2聽2.01+聽heap_end_ptr聽Free memory after setup end
0226/2聽N/A聽pad1聽聽Unused
0228/4聽2.02+聽cmd_line_ptr聽32-bit pointer to the kernel command line
022C/4聽2.03+聽initrd_addr_max聽Highest legal initrd address
(1) For backwards compatibility, if the setup_sects field contains 0, the
聽聽聽 real value is 4.
(2) For boot protocol prior to 2.04, the upper two bytes of the syssize
聽聽聽 field are unusable, which means the size of a bzImage kernel
聽聽聽 cannot be determined.
If the "HdrS" (0x53726448) magic number is not found at offset 0x202,
the boot protocol version is "old".聽 Loading an old kernel, the
following parameters should be assumed:
聽I(yíng)mage type = zImage
聽initrd not supported
聽Real-mode kernel must be located at 0x90000.
Otherwise, the "version" field contains the protocol version,
e.g. protocol version 2.01 will contain 0x0201 in this field.聽 When
setting fields in the header, you must make sure only to set fields
supported by the protocol version in use.
The "kernel_version" field, if set to a nonzero value, contains a
pointer to a null-terminated human-readable kernel version number
string, less 0x200.聽 This can be used to display the kernel version to
the user.聽 This value should be less than (0x200*setup_sects).聽 For
example, if this value is set to 0x1c00, the kernel version number
string can be found at offset 0x1e00 in the kernel file.聽 This is a
valid value if and only if the "setup_sects" field contains the value
14 or higher.
Most boot loaders will simply load the kernel at its target address
directly.聽 Such boot loaders do not need to worry about filling in
most of the fields in the header.聽 The following fields should be
filled out, however:
聽 vid_mode:
聽Please see the section on SPECIAL COMMAND LINE OPTIONS.
聽 type_of_loader:
聽I(yíng)f your boot loader has an assigned id (see table below), enter
聽0xTV here, where T is an identifier for the boot loader and V is
聽a version number.聽 Otherwise, enter 0xFF here.
聽Assigned boot loader ids:
聽0聽 LILO
聽1聽 Loadlin
聽2聽 bootsect-loader
聽3聽 SYSLINUX
聽4聽 EtherBoot
聽5聽 ELILO
聽7聽 GRuB
聽8聽 U-BOOT
聽Please contact <hpa@zytor.com> if you need a bootloader ID
聽value assigned.
聽 loadflags, heap_end_ptr:
聽I(yíng)f the protocol version is 2.01 or higher, enter the
聽offset limit of the setup heap into heap_end_ptr and set the
聽0x80 bit (CAN_USE_HEAP) of loadflags.聽 heap_end_ptr appears to
聽be relative to the start of setup (offset 0x0200).
聽 setup_move_size:
聽When using protocol 2.00 or 2.01, if the real mode
聽kernel is not loaded at 0x90000, it gets moved there later in
聽the loading sequence.聽 Fill in this field if you want
聽additional data (such as the kernel command line) moved in
聽addition to the real-mode kernel itself.
聽 ramdisk_image, ramdisk_size:
聽I(yíng)f your boot loader has loaded an initial ramdisk (initrd),
聽set ramdisk_image to the 32-bit pointer to the ramdisk data
聽and the ramdisk_size to the size of the ramdisk data.
聽The initrd should typically be located as high in memory as
聽possible, as it may otherwise get overwritten by the early
聽kernel initialization sequence.聽 However, it must never be
聽located above the address specified in the initrd_addr_max
聽field.聽The initrd should be at least 4K page aligned.
聽 cmd_line_ptr:
聽I(yíng)f the protocol version is 2.02 or higher, this is a 32-bit
聽pointer to the kernel command line.聽 The kernel command line
聽can be located anywhere between the end of setup and 0xA0000.
聽Fill in this field even if your boot loader does not support a
聽command line, in which case you can point this to an empty
聽string (or better yet, to the string "auto".)聽 If this field
聽is left at zero, the kernel will assume that your boot loader
聽does not support the 2.02+ protocol.
聽 ramdisk_max:
聽The maximum address that may be occupied by the initrd
聽contents.聽 For boot protocols 2.02 or earlier, this field is
聽not present, and the maximum address is 0x37FFFFFF.聽 (This
聽address is defined as the address of the highest safe byte, so
聽if your ramdisk is exactly 131072 bytes long and this field is
聽0x37FFFFFF, you can start your ramdisk at 0x37FE0000.)
**** THE KERNEL COMMAND LINE
The kernel command line has become an important way for the boot
loader to communicate with the kernel.聽 Some of its options are also
relevant to the boot loader itself, see "special command line options"
below.
The kernel command line is a null-terminated string currently up to
255 characters long, plus the final null.聽 A string that is too long
will be automatically truncated by the kernel, a boot loader may allow
a longer command line to be passed to permit future kernels to extend
this limit.
If the boot protocol version is 2.02 or later, the address of the
kernel command line is given by the header field cmd_line_ptr (see
above.)聽 This address can be anywhere between the end of the setup
heap and 0xA0000.
If the protocol version is *not* 2.02 or higher, the kernel
command line is entered using the following protocol:
聽At offset 0x0020 (word), "cmd_line_magic", enter the magic
聽number 0xA33F.
聽At offset 0x0022 (word), "cmd_line_offset", enter the offset
聽of the kernel command line (relative to the start of the
聽real-mode kernel).
聽
聽The kernel command line *must* be within the memory region
聽covered by setup_move_size, so you may need to adjust this
聽field.
**** SAMPLE BOOT CONFIGURATION
As a sample configuration, assume the following layout of the real
mode segment (this is a typical, and recommended layout):
聽0x0000-0x7FFF聽Real mode kernel
聽0x8000-0x8FFF聽Stack and heap
聽0x9000-0x90FF聽Kernel command line
Such a boot loader should enter the following fields in the header:
聽unsigned long base_ptr;聽/* base address for real-mode segment */
聽if ( setup_sects == 0 ) {
聽聽setup_sects = 4;
聽}
聽if ( protocol >= 0x0200 ) {
聽聽type_of_loader = <type code>;
聽聽if ( loading_initrd ) {
聽聽聽ramdisk_image = <initrd_address>;
聽聽聽ramdisk_size = <initrd_size>;
聽聽}
聽聽if ( protocol >= 0x0201 ) {
聽聽聽heap_end_ptr = 0x9000 - 0x200;
聽聽聽loadflags |= 0x80; /* CAN_USE_HEAP */
聽聽}
聽聽if ( protocol >= 0x0202 ) {
聽聽聽cmd_line_ptr = base_ptr + 0x9000;
聽聽} else {
聽聽聽cmd_line_magic聽= 0xA33F;
聽聽聽cmd_line_offset = 0x9000;
聽聽聽setup_move_size = 0x9100;
聽聽}
聽} else {
聽聽/* Very old kernel */
聽聽cmd_line_magic聽= 0xA33F;
聽聽cmd_line_offset = 0x9000;
聽聽/* A very old kernel MUST have its real-mode code
聽聽聽聽 loaded at 0x90000 */
聽聽if ( base_ptr != 0x90000 ) {
聽聽聽/* Copy the real-mode kernel */
聽聽聽memcpy(0x90000, base_ptr, (setup_sects+1)*512);
聽聽聽/* Copy the command line */
聽聽聽memcpy(0x99000, base_ptr+0x9000, 256);
聽聽聽base_ptr = 0x90000;聽聽 /* Relocated */
聽聽}
聽聽/* It is recommended to clear memory up to the 32K mark */
聽聽memset(0x90000 + (setup_sects+1)*512, 0,
聽聽聽聽聽聽聽聽 (64-(setup_sects+1))*512);
聽}
**** LOADING THE REST OF THE KERNEL
The 32-bit (non-real-mode) kernel starts at offset (setup_sects+1)*512
in the kernel file (again, if setup_sects == 0 the real value is 4.)
It should be loaded at address 0x10000 for Image/zImage kernels and
0x100000 for bzImage kernels.
The kernel is a bzImage kernel if the protocol >= 2.00 and the 0x01
bit (LOAD_HIGH) in the loadflags field is set:
聽is_bzImage = (protocol >= 0x0200) && (loadflags & 0x01);
聽load_address = is_bzImage ? 0x100000 : 0x10000;
Note that Image/zImage kernels can be up to 512K in size, and thus use
the entire 0x10000-0x90000 range of memory.聽 This means it is pretty
much a requirement for these kernels to load the real-mode part at
0x90000.聽 bzImage kernels allow much more flexibility.
**** SPECIAL COMMAND LINE OPTIONS
If the command line provided by the boot loader is entered by the
user, the user may expect the following command line options to work.
They should normally not be deleted from the kernel command line even
though not all of them are actually meaningful to the kernel.聽 Boot
loader authors who need additional command line options for the boot
loader itself should get them registered in
Documentation/kernel-parameters.txt to make sure they will not
conflict with actual kernel options now or in the future.
聽 vga=<mode>
聽<mode> here is either an integer (in C notation, either
聽decimal, octal, or hexadecimal) or one of the strings
聽"normal" (meaning 0xFFFF), "ext" (meaning 0xFFFE) or "ask"
聽(meaning 0xFFFD).聽 This value should be entered into the
聽vid_mode field, as it is used by the kernel before the command
聽line is parsed.
聽 mem=<size>
聽<size> is an integer in C notation optionally followed by K, M
聽or G (meaning << 10, << 20 or << 30).聽 This specifies the end
聽of memory to the kernel. This affects the possible placement
聽of an initrd, since an initrd should be placed near end of
聽memory.聽 Note that this is an option to *both* the kernel and
聽the bootloader!
聽 initrd=<file>
聽An initrd should be loaded.聽 The meaning of <file> is
聽obviously bootloader-dependent, and some boot loaders
聽(e.g. LILO) do not have such a command.
In addition, some boot loaders add the following options to the
user-specified command line:
聽 BOOT_IMAGE=<file>
聽The boot image which was loaded.聽 Again, the meaning of <file>
聽is obviously bootloader-dependent.
聽 auto
聽The kernel was booted without explicit user intervention.
If these options are added by the boot loader, it is highly
recommended that they are located *first*, before the user-specified
or configuration-specified command line.聽 Otherwise, "init=/bin/sh"
gets confused by the "auto" option.
**** RUNNING THE KERNEL
The kernel is started by jumping to the kernel entry point, which is
located at *segment* offset 0x20 from the start of the real mode
kernel.聽 This means that if you loaded your real-mode kernel code at
0x90000, the kernel entry point is 9020:0000.
At entry, ds = es = ss should point to the start of the real-mode
kernel code (0x9000 if the code is loaded at 0x90000), sp should be
set up properly, normally pointing to the top of the heap, and
interrupts should be disabled.聽 Furthermore, to guard against bugs in
the kernel, it is recommended that the boot loader sets fs = gs = ds =
es = ss.
In our example from above, we would do:
聽/* Note: in the case of the "old" kernel protocol, base_ptr must
聽聽聽 be == 0x90000 at this point; see the previous sample code */
聽seg = base_ptr >> 4;
聽cli();聽/* Enter with interrupts disabled! */
聽/* Set up the real-mode kernel stack */
聽_SS = seg;
聽_SP = 0x9000;聽/* Load SP immediately after loading SS! */
聽_DS = _ES = _FS = _GS = seg;
聽jmp_far(seg+0x20, 0);聽/* Run the kernel */
If your boot sector accesses a floppy drive, it is recommended to
switch off the floppy motor before running the kernel, since the
kernel boot leaves interrupts off and thus the motor will not be
switched off, especially if the loaded kernel has the floppy driver as
a demand-loaded module!
**** ADVANCED BOOT TIME HOOKS
If the boot loader runs in a particularly hostile environment (such as
LOADLIN, which runs under DOS) it may be impossible to follow the
standard memory location requirements.聽 Such a boot loader may use the
following hooks that, if set, are invoked by the kernel at the
appropriate time.聽 The use of these hooks should probably be
considered an absolutely last resort!
IMPORTANT: All the hooks are required to preserve %esp, %ebp, %esi and
%edi across invocation.
聽 realmode_swtch:
聽A 16-bit real mode far subroutine invoked immediately before
聽entering protected mode.聽 The default routine disables NMI, so
聽your routine should probably do so, too.
聽 code32_start:
聽A 32-bit flat-mode routine *jumped* to immediately after the
聽transition to protected mode, but before the kernel is
聽uncompressed.聽 No segments, except CS, are set up; you should
聽set them up to KERNEL_DS (0x18) yourself.
聽After completing your hook, you should jump to the address
聽that was in this field before your boot loader overwrote it.
聽