1 <?xml version="1.0" encoding="utf-8" ?>
2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
3 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
4 <!--http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd-->
5 <html xmlns="http://www.w3.org/1999/xhtml"
8 Generic boot loader for Linux
10 Technical overview</title>
11 <meta http-equiv="content-type" content="text/html; charset=UTF-8" />
12 <meta name="generator" content="Bluefish 2.2.3" />
13 <meta name="originator" content="TeX4ht (http://www.cse.ohio-state.edu/~gurari/TeX4ht/)" />
14 <!-- xhtml,charset=utf-8,html -->
15 <meta name="src" content="tech_21-5.tex" />
16 <meta name="date" content="2013-06-07T14:17:05+0200" />
17 <link rel="stylesheet" type="text/css" href="tech_21-5.css" />
20 <div class="maketitle">
24 <h2 class="titleHead">LILO<br />
25 Generic boot loader for Linux<br />
28 Technical overview</h2>
29 <div class="author" ><span
30 class="cmr-12">Werner Almesberger</span>
32 class="cmr-12">John R. Coffman</span>
34 class="cmti-12">(reconstructed by Joachim Wiedorn)</span></div>
36 <div class="date" ><span
37 class="cmr-12">July 17, 2000</span></div>
39 <h3 class="likesectionHead"><a
40 id="x1-1000"></a>Contents</h3>
41 <div class="tableofcontents">
42 <span class="sectionToc" >1 <a
43 href="#x1-20001" id="QQ2-1-2">Load sequence</a></span>
44 <br /><span class="sectionToc" >2 <a
45 href="#x1-30002" id="QQ2-1-3">File references</a></span>
46 <br /><span class="sectionToc" >3 <a
47 href="#x1-40003" id="QQ2-1-4">Configuration parameters</a></span>
48 <br /><span class="sectionToc" >4 <a
49 href="#x1-50004" id="QQ2-1-5">Parameter line interface</a></span>
50 <br /><span class="sectionToc" >5 <a
51 href="#x1-60005" id="QQ2-1-6">External interface</a></span>
52 <br /><span class="sectionToc" >6 <a
53 href="#x1-70006" id="QQ2-1-7">Default command line in map file</a></span>
55 <!--l. 72--><p class="noindent" >This document describes internals of LILO and related parts of its environment (kernel, etc.). It is not
56 necessary to read or understand this document in order to install or use LILO. A general introduction and
57 installation instructions can be found in the user’s guide.
58 </p><!--l. 77--><p class="noindent" ><span
59 class="cmbx-10x-x-109">This document has only been partially updated and does reflect the status of Linux (until</span>
61 class="cmbx-10x-x-109">2.2.16) and of LILO</span><span
62 class="cmbx-10x-x-109"> (until 21.5) in the year 2000.</span>
63 </p><!--l. 80--><p class="noindent" >
66 <h3 class="sectionHead"><span class="titlemark">1 </span> <a
67 id="x1-20001"></a>Load sequence</h3>
68 <!--l. 87--><p class="noindent" >The boot sector is loaded by the ROM-BIOS at address 0x07C00. It moves itself to address 0x96A00, sets
69 up the stack (growing downwards from 0x96A00 to 0x96800), loads the secondary boot loader at address
70 0x96C00 and transfers control to it. It displays an “L” after moving itself and an “I” before starting the
71 secondary boot loader. If a read error occurs when loading the secondary boot loader, a two-digit hex
72 code is displayed after the “L”. This results in an endless stream of error codes if the problem
73 is permanent. Displaying these error codes is disabled if the build-time option <span
74 class="cmtt-10x-x-109">NO1STDIAG </span>is
76 </p><!--l. 97--><p class="noindent" >The secondary boot loader loads the descriptor table at 0x98800 and the sector containing the
77 default command line at 0x98C00. If the default command line is enabled, its magic number is
78 invalidated and the sector is written back to disk. This potentially dangerous operation can be
79 disabled by defining <span
80 class="cmtt-10x-x-109">LCF</span><span
81 class="cmtt-10x-x-109">_READONLY </span>when passing <span
82 class="cmtt-10x-x-109">second.S </span>through <span
83 class="cmss-10x-x-109">cpp</span>. Next, the secondary
84 boot loader checks for user input. If either the default is used or if the user has specified an
85 alternate image, the options sector is loaded at 0x98C00 and the parameter line is constructed at
86 0x99000. If the resulting line contains the option <span class="obeylines-h"><span class="verb"><span
87 class="cmtt-10x-x-109">lock</span></span></span>, the command line as entered by the
88 user (it is saved before the final line is constructed) is written to the disk as the new default
89 command line. Also, if a fallback command line is set, it is copied to the default command line
91 </p><!--l. 111--><p class="noindent" >If the user has supplied an initial RAM disk image, this file is loaded below the end of physical memory or
92 16 MB, whichever is lower. The start address is lowered to the next page boundary so that the memory area
93 occupied by the initial RAM disk can later be easily returned to the system’s free memory pool. The 16 MB
94 limit exists because the BIOS functions used to transfer data in memory are only specified for an 24 bit
96 </p><!--l. 119--><p class="noindent" >Next, the floppy boot sector of that image is loaded at
97 0x90000<span class="footnote-mark"><a
98 href="tech_21-52.html#fn1x0"><sup class="textsuperscript">1</sup></a></span><a
100 the setup part is loaded at 0x90200 and the kernel part is loaded at 0x10000, or, if the kernel has been
101 compiled for being loaded “high” (i.e. with <span
102 class="cmtt-10x-x-109">make bzImage</span>), it is loaded at 0x100000 instead. During the
103 load operations, the sectors of the map file are loaded at 0x98600.
104 </p><!--l. 126--><p class="noindent" >If the loaded image is a kernel image, control is transferred to its setup code. If a different operating system
105 is booted, things are a bit more difficult: the chain loader is loaded at 0x90200 and the boot sector of the
106 other OS is loaded at 0x90400. The chain loader moves the partition table (loaded at 0x903BE as part of
107 the chain loader) to 0x00600 and the boot sector to 0x07C00. After that, it passes control to the boot
109 </p><!--l. 134--><p class="noindent" >Chain loaders that allow booting from a second drive (either floppy or hard disk) also install a
110 small function to intercept BIOS calls and to swap the drive numbers at the top of available
112 </p><!--l. 138--><p class="noindent" >The secondary boot loader displays an “L” after being started and an “O” after loading the descriptor table
113 and the default command line. Before loading the descriptor table, it checks, whether it has been loaded at
115 the correct location and displays a question mark if it hasn’t. If the descriptor table has an incorrect
116 checksum, a minus sign is displayed.
117 </p><!--l. 144--><p class="noindent" >
119 <center class="math-display" >
121 src="tech_21-50x.png" alt="0x00000 |-------------------------------|1982 bytes
122 |-------------------------------|
123 0x007BE |--------Partition-table---------|64 bytes
124 0x007FE |-------------------------------|29 kB
125 0x07C00 |--------Boot-load-area---------|512 bytes
126 0x07E00 |-------------------------------|32.5 kB
132 |-------------------------------|
133 0x90000 |------Floppy-boot-sector-------|512 bytes
134 0x90200 |---------Setup-(kernel)---------|39.5 kB (2 kB used)
135 0x9A000 |------Primary--boot-loader-------|512 bytes
136 0x9A200 | Stack |3.5 kB
137 0x9B000 |-----Secondary-boot-loader------|8 kB (3.5 kB used)
138 0x9D000 |--------Map--load-area---------|512 bytes
139 |-------------------------------|
140 0x9D200 |--------Descriptor-table---------|1 kB
141 0x9D600 |---Default command--line, etc.--|512 bytes
142 0x9D800 |---Keyboard-translation-table----|512 bytes
143 0x9DA00 |Parameter-line-construction-area-|1 kB
146 |--------Drive-swapper----------|1 kB
147 ---------------------------------
149 " class="math-display" /></center>
150 <!--l. 192--><p class="noindent" >The area 0x90020-0x90023 is overlaid by a command-line descriptor while the secondary boot loader is
152 </p><!--l. 195--><p class="noindent" >If the build-time configuration option <span
153 class="cmtt-10x-x-109">LARGE</span><span
154 class="cmtt-10x-x-109">_EBDA </span>is set, all the addresses in the area 0x90000-0x9FFFF are
155 changed to 0x80000-0x8FFFF, with the exception of the location of the driver swapper, which automatically
156 follows the end of the available memory.
157 </p><!--l. 200--><p class="noindent" >
160 <h3 class="sectionHead"><span class="titlemark">2 </span> <a
161 id="x1-30002"></a>File references</h3>
162 <!--l. 206--><p class="noindent" >This section describes the references among files involved in the boot procedures.
163 </p><!--l. 209--><p class="noindent" >
165 <center class="math-display" >
167 src="tech_21-51x.png" alt=" --------------|
173 / / |-descriptors-- |
176 -------------/-/ | map |
179 -------------\\\\ \ \ \ |-------------|
181 \ \ \ | boot loader |
182 \\\ \ \ ---------------
193 " class="math-display" /></center>
194 <!--l. 213--><p class="noindent" >The boot sector contains the primary boot loader, the address of the default command line sector, the
195 address of both descriptor table sectors and the addresses of the sectors of the secondary boot loader. The
196 generic boot sector is copied from <span
197 class="cmtt-10x-x-109">boot.b</span>.
198 </p><!--l. 218--><p class="noindent" >The primary boot loader can store up to eight sector addresses of the secondary boot loader.
199 </p><!--l. 221--><p class="noindent" >
202 <center class="math-display" >
204 src="tech_21-52x.png" alt="|-------------|
232 " class="math-display" /></center>
233 <!--l. 225--><p class="noindent" >The map file consists of so-called sections and of special data sectors. Each section spans an integral number
234 of disk sectors and contains addresses of sectors of other files.
235 </p><!--l. 230--><p class="noindent" >There are three exceptions: 1. If a “hole” is being covered or if the floppy boot sector of an unstripped
236 kernel has been omitted, the address of the zero sector is used. This sector is part of the map file. 2. When
237 booting a different operating system, the first sector is the merged chain loader that has been written to the
238 map file before that section. 3. Each map section describing an image is followed by a sector containing the
239 options line of that image.
240 </p><!--l. 238--><p class="noindent" >The last address slot of each map sector is either unused (if the map section ends in this sector) or contains
241 the address of the next map sector in the section.
242 </p><!--l. 242--><p class="noindent" >The ifive sectors at the beginning of the map file are special: the first sector contains the default command
243 line, the next two sectors contain the boot image descriptor table and the fourth sector is filled with zero
244 bytes. This sector is mapped whenever a file contains a “hole”. The fifth sector contains the keyboard
246 </p><!--l. 248--><p class="noindent" >
249 <center class="math-display" >
251 src="tech_21-53x.png" alt="|-----------| --------------|
254 | | \ |-------------| //-- -- --- -- -
256 | | | Fallback | / | |
258 | | -- --- -- --- - / / --- -- --- -- -
259 | | | Options |////// | |
261 | | |- --- -- ---/// --- -- --- --
267 | -------------\-\ --- -- --- -- -
272 optional | Kernel image
275 ||----------------------------------|
278 -- --/ /-/--- - --- -- --- -- -
290 " class="math-display" /></center>
291 <!--l. 252--><p class="noindent" >A kernel image consists simply of a sequence of sectors being loaded. The map section also contains a sector
292 with a fallback command line and a sector with parameter line options. Optionally, a RAM disk image,
293 specified by a second map section, can be loaded.
294 </p><!--l. 257--><p class="noindent" >
297 <center class="math-display" >
299 src="tech_21-54x.png" alt=" |--------------| |-------------|
301 | chain.b | | partition |
302 |-----------| -----/---------| /----table------
306 \\ |--------------| / /
315 | --- -- --- --cccccccccccmmmmmmmmmmmcmcmcmcmcmcmcmccccrmrmrmrmrmrrrrrrrrrrrrrmmmmnnnnnmmmmmmmmmmmmmrmrmrmrm.....n.nnnnnnnnnnnnnnnn................
316 | cccccccmmcmcmcmcccccc/mmmmmcmcmcmcmcmcmcmcrrrrrmmmmmmcmcmcmccccccrrrrrrrrrrrrmmmmmmrmrmrmrrrrrrmmmmmmcmcmcmcmccmmmmmmmmmmmmrmnnnnnnnnmmmmmmrmrmrmrrrrrrrmmnnnnnnnnnnnnn........n.nnnnnnnnmmmmmmmrmrm.....................n.nnnnnnnn........ |-------------|
317 | /-|----------|Boot sector |
321 " class="math-display" /></center>
322 <!--l. 261--><p class="noindent" >When booting another operating system, the chain loader (<span
323 class="cmtt-10x-x-109">chain.b</span>) is merged with the patched partition
324 table<span class="footnote-mark"><a
325 href="tech_21-53.html#fn2x0"><sup class="textsuperscript">2</sup></a></span><a
327 and written into the map file. The map section of this boot image starts after that sector and contains only
328 the address of a dummy floppy boot sector (the zero sector, but its contents are irrelevant), the loader
329 sector and the boot sector of the other operating system. Not that the map section also contains the
330 fallback sector and a (useless) sector for options.
332 <h3 class="sectionHead"><span class="titlemark">3 </span> <a
333 id="x1-40003"></a>Configuration parameters</h3>
334 <!--l. 275--><p class="noindent" >The boot sector of each kernel contains a set of configuration parameters that have to be available at boot
335 time before the kernel can access file systems. These parameters can be set when the kernel is
336 compiled and later be changed with programs like <span
337 class="cmss-10x-x-109">rdev</span>. LILO can supersede the parameters (in
338 memory) at boot time by placing the corresponding items on the parameter line passed to the
341 </p><!--l. 282--><p class="noindent" >The parameters are stored at the following (decimal) offsets:
342 </p><!--l. 284--><p class="noindent" >
343 </p><dl class="description"><dt class="description">
345 class="cmbx-10x-x-109">497</span> </dt><dd
346 class="description">the size of the setup code in sectors (512 bytes). Older kernels may put a zero at this place.
347 </dd><dt class="description">
349 class="cmbx-10x-x-109">498-499</span> </dt><dd
350 class="description">is a flag specifying whether the root file system should be mounted read-only (if non-zero)
351 or read-write (if zero).
352 </dd><dt class="description">
354 class="cmbx-10x-x-109">500-501</span> </dt><dd
355 class="description">the size of the kernel, counted in paragraphs (16 bytes).
356 </dd><dt class="description">
358 class="cmbx-10x-x-109">502-503</span> </dt><dd
359 class="description">this parameter is currently unused.
360 </dd><dt class="description">
362 class="cmbx-10x-x-109">504-505</span> </dt><dd
363 class="description">the size of the RAM disk in kilobytes. No RAM disk is created if this parameter is set to
365 </dd><dt class="description">
367 class="cmbx-10x-x-109">506-507</span> </dt><dd
368 class="description">the text mode the VGA is set to.
369 <dl class="description"><dt class="description">
371 class="cmbx-10x-x-109">0xFFFD</span> </dt><dd
372 class="description">the user is asked to specify the VGA mode at boot time.
373 </dd><dt class="description">
375 class="cmbx-10x-x-109">0xFFFE</span> </dt><dd
376 class="description">uses 80x50 (“extended”) mode.
377 </dd><dt class="description">
379 class="cmbx-10x-x-109">0xFFFF</span> </dt><dd
380 class="description">uses 80x25 (“normal”) mode.</dd></dl>
381 <!--l. 299--><p class="noindent" >Any other value selects the corresponding mode as displayed in the interactive VGA mode selection
382 menu. This is the only option that is set by LILO by patching the boot sector instead of passing it on
384 </p></dd><dt class="description">
386 class="cmbx-10x-x-109">508</span> </dt><dd
387 class="description">the minor number of the device that should be mounted as root.
388 </dd><dt class="description">
390 class="cmbx-10x-x-109">509</span> </dt><dd
391 class="description">the major number of the device that should be mounted as root.</dd></dl>
392 <!--l. 309--><p class="noindent" >
394 <h3 class="sectionHead"><span class="titlemark">4 </span> <a
395 id="x1-50004"></a>Parameter line interface</h3>
396 <!--l. 311--><p class="noindent" >The kernel supports processing of parameters that are provided by the boot loader. The parameter string is
397 a NUL-terminated ASCII string that contains space-separated words or <span
398 class="cmti-10x-x-109">variable</span><span
399 class="cmtt-10x-x-109">=</span><span
400 class="cmti-10x-x-109">value </span>pairs. A description
401 of how they are interpreted can be found in the section of the user’s guide labeled “The boot
403 </p><!--l. 318--><p class="noindent" >The following descriptor has to be set up to pass a parameter string to the kernel:
405 </p><!--l. 321--><p class="noindent" >
406 </p><dl class="description"><dt class="description">
408 class="cmbx-10x-x-109">0x90020</span> </dt><dd
409 class="description">the magic number 0xA33F.
410 </dd><dt class="description">
412 class="cmbx-10x-x-109">0x90022</span> </dt><dd
413 class="description">the offset of the first byte of the parameter line relative to 0x90000.</dd></dl>
414 <!--l. 327--><p class="noindent" >The boot loader composes the parameter line from the command line, from the options sector and from
415 some internally generated prefixes (typically <span class="obeylines-h"><span class="verb"><span
416 class="cmtt-10x-x-109">auto</span></span></span> and <span class="obeylines-h"><span class="verb"><span
417 class="cmtt-10x-x-109">BOOT_IMAGE=</span></span></span>), as follows:
418 </p><!--l. 331--><p class="noindent" >
420 <center class="math-display" >
422 src="tech_21-55x.png" alt=" |---------------------------------------|
424 Command line | name | Command -line options |
425 ---------------------------\------------
430 |-----------|----------------------------------|-------\\-------------------|
432 |fixes | name | Static options | Command -line options |
433 --------------------------------|--------------------------------------------
435 passed to the kernel |
438 |----------------------------|
439 Options sector | Static options |
441 ------------------------------
442 " class="math-display" /></center>
443 <!--l. 335--><p class="noindent" >Example: <br
444 class="newline" />Command line: <span class="obeylines-h"><span class="verb"><span
445 class="cmtt-10x-x-109">vmlinuz</span><span
446 class="cmtt-10x-x-109"> root=802</span></span></span><br
447 class="newline" />Options sector: <span class="obeylines-h"><span class="verb"><span
448 class="cmtt-10x-x-109">root=801</span><span
449 class="cmtt-10x-x-109"> ro</span></span></span>
450 </p><!--l. 339--><p class="noindent" >yields <span class="obeylines-h"><span class="verb"><span
451 class="cmtt-10x-x-109">BOOT_IMAGE=vmlinuz</span><span
452 class="cmtt-10x-x-109"> root=801</span><span
453 class="cmtt-10x-x-109"> ro</span><span
454 class="cmtt-10x-x-109"> root=802</span></span></span>
455 </p><!--l. 341--><p class="noindent" >Because parameter line options can typically be overridden, the first <span class="obeylines-h"><span class="verb"><span
456 class="cmtt-10x-x-109">root</span></span></span> option is ignored by the
459 </p><!--l. 346--><p class="noindent" >
461 <h3 class="sectionHead"><span class="titlemark">5 </span> <a
462 id="x1-60005"></a>External interface</h3>
463 <!--l. 348--><p class="noindent" >LILO is able to receive its command line from a program that is booted before it. This externally provided
464 command line is only used if the user does not use the normal mechanism to invoke the boot
466 </p><!--l. 352--><p class="noindent" >The following register contents are expected:
467 </p><!--l. 354--><p class="noindent" >
468 </p><dl class="description"><dt class="description">
470 class="cmbx-10x-x-109">DL</span> </dt><dd
471 class="description">contains the value 0xFE.
472 </dd><dt class="description">
474 class="cmbx-10x-x-109">ES:SI</span> </dt><dd
475 class="description">points to the string “LILO”. The string must be in upper case and no terminating character
476 is needed. The string must not cross segment boundaries, i.e. <span
477 class="cmbx-10x-x-109">SI </span>must be below 0xFFFD.
478 </dd><dt class="description">
480 class="cmbx-10x-x-109">ES:BX</span> </dt><dd
481 class="description">points to a NUL-terminated string that is used as the command line. This string has a
482 maximum length of 78 characters (not including the terminating NUL) and must not cross
483 segment boundaries.</dd></dl>
484 <!--l. 364--><p class="noindent" >There are two values of the externally provided command line that have a special meaning:
486 <ul class="itemize1">
487 <li class="itemize">an empty string (<span
488 class="cmbx-10x-x-109">ES:BX </span>points to a NUL byte) is interpreted as a request to enter the boot
489 prompt and to accept keyboard input.
491 <li class="itemize">a string that consists only of blanks is interpreted as a request to boot the default boot image.</li></ul>
492 <!--l. 374--><p class="noindent" >LILO can also obtain the default command line from the map file. It is only used if no externally provided
493 command line is available.
494 </p><!--l. 379--><p class="noindent" >
496 <h3 class="sectionHead"><span class="titlemark">6 </span> <a
497 id="x1-70006"></a>Default command line in map file</h3>
498 <!--l. 381--><p class="noindent" >The first sector of the map file is reserved for a default command line. Unless the user invokes the boot
499 prompt by pressing a shift key or unless an externally provided command line is present, the command line
500 in the map file is interpreted as if it had been typed on the keyboard.
501 </p><!--l. 386--><p class="noindent" >The first two bytes of the first sector of the map file have to contain the magic number <span
502 class="cmtt-10x-x-109">DC</span><span
503 class="cmtt-10x-x-109">_MAGIC </span>(0xF4F2)
504 in little-endian byte order. They are followed by a NUL-terminated string with a maximum length of 510
505 bytes, including the NUL. Note that the boot loader limits command lines to 78 characters after removing
508 </p><!--l. 392--><p class="noindent" >The command line is disabled by either clobbering the magic number or by using an empty string (i.e. only
509 a NUL byte) as the command line.
513 <!--l. 397--><p class="noindent" >
514 </p><!--l. 398--><p class="noindent" ><span
515 class="cmti-10x-x-109">Last updated by John R. Coffman on July 17, 2000</span><br />
517 class="cmti-10x-x-109">reconstructed by Joachim Wiedorn on January 29, 2011</span></p></div>