2 % Copyright 1992-1998 by Werner Almesberger.
5 % See file COPYING for details.
8 \documentclass[fullpage]{article}
10 \usepackage[bookmarks,%
11 pdftitle={Linux Loader (LILO) technical overview},%
12 pdfsubject={Booting on iA32 architecture},%
13 pdfkeywords={lilo, boot},%
14 pdfauthor={Werner Almesberger <Werner.Almesberger@epfl.ch>}]%
21 \hyphenation{hexa-decimal}
26 \def\SetFigFont#1#2#3{\tt}
33 Generic boot loader for Linux \\
35 \bf Technical overview}
36 \author{Werner Almesberger \\
37 {\tt Werner.Almesberger@epfl.ch}}
38 \date{December 4, 1998}
43 \setcounter{tocdepth}{1}
48 This document describes internals of \LILO\ and related parts of its
49 environment (kernel, etc.). It is not necessary to read or understand
50 this document in order to install or use \LILO. A general introduction
51 and installation instructions can be found in the user's guide.
53 {\bf This document has only been partially updated and does not entirely
54 reflect the current ('98) status of Linux or of \LILO\ (version 21).}
57 \section{Load sequence}
60 The boot sector is loaded by the ROM-BIOS at address 0x07C00. It moves
61 itself to address 0x96A00, sets up the stack (growing downwards from
62 0x96A00 to 0x96800), loads the secondary boot loader at address
63 0x96C00 and transfers control to it. It displays an ``L'' after moving
64 itself and an ``I'' before starting the secondary boot loader. If a read
65 error occurs when loading the secondary boot loader, a two-digit hex code
66 is displayed after the ``L''. This results in an endless stream of error
67 codes if the problem is permanent. Displaying these error codes is disabled
68 if the build-time option {\tt NO1STDIAG} is set.
70 The secondary boot loader loads the descriptor table at 0x98800 and the
71 sector containing the default command line at 0x98C00. If the default command
72 line is enabled, its magic number is invalidated and the sector is written
73 back to disk. This potentially dangerous operation can be disabled by defining
74 {\tt LCF\_READONLY} when passing {\tt second.S} through {\sf cpp}. Next, the
75 secondary boot loader checks
76 for user input. If either the default is used or if the user has specified
77 an alternate image, the options sector is loaded at 0x98C00 and the parameter
78 line is constructed at 0x99000. If the resulting line contains the option
79 \verb"lock", the command line as entered by the user (it is saved before
80 the final line is constructed) is written to the disk as the new default
81 command line. Also, if a fallback command line is set, it is copied to the
82 default command line sector.
84 If the user has supplied an initial RAM disk image, this file is loaded
85 below the end of physical memory or 16 MB, whichever is lower. The start
86 address is lowered to the next page boundary so that the memory area
87 occupied by the initial RAM disk can later be easily returned to the
88 system's free memory pool. The 16 MB limit exists because the BIOS
89 functions used to transfer data in memory are only specified for an 24 bit
92 Next, the floppy boot sector of that image is
93 loaded at 0x90000\footnote{The floppy boot sector is only used as a source of
95 the setup part is loaded at 0x90200 and
96 the kernel part is loaded at 0x10000, or, if the kernel has been compiled
97 for being loaded ``high'' (i.e. with {\tt make bzImage}), it is loaded
98 at 0x100000 instead. During the load operations, the sectors
99 of the map file are loaded at 0x98600.
101 If the loaded image is a kernel image, control is transferred to
103 If a different operating system is booted, things are a bit more difficult:
104 the chain loader is loaded at 0x90200 and the boot sector of the other OS
105 is loaded at 0x90400. The chain loader moves the partition table (loaded at
106 0x903BE as part of the chain loader) to 0x00600 and the boot sector to
107 0x07C00. After that, it passes control to the boot sector.
109 Chain loaders that allow booting from a second drive (either floppy or hard
110 disk) also install a small function to intercept BIOS calls and to swap
111 the drive numbers at the top of available memory.
113 The secondary boot loader displays an ``L'' after being started and an ``O''
114 after loading the descriptor table and the default command line. Before
115 loading the descriptor table, it checks, whether it has been loaded at the
116 correct location and displays a question mark if it hasn't. If the
117 descriptor table has an incorrect checksum, a minus sign is displayed.
120 \begin{tabular}{l|c|l}
122 \tt 0x00000 & & 1982 bytes \\
124 \tt 0x007BE & Partition table & 64 bytes \\
126 \tt 0x007FE & & 29 kB \\
128 \tt 0x07C00 & Boot load area & 512 bytes \\
130 \tt 0x07E00 & & 32.5 kB \\
132 \tt 0x10000 & & 448 kB \\
138 \tt 0x90000 & Floppy boot sector & 512 bytes \\
140 \tt 0x90200 & Setup (kernel) & 39.5 kB (2 kB used) \\
142 \tt 0x9A000 & Primary boot loader & 512 bytes \\
144 \tt 0x9A200 & Stack & 3.5 kB \\
146 \tt 0x9B000 & Secondary boot loader & 8 kB (3.5 kB used) \\
148 \tt 0x9D000 & Map load area & 512 bytes \\
150 \tt 0x9D200 & Descriptor table & 1 kB \\
152 \tt 0x9D600 & Default command line, etc. & 512 bytes \\
154 \tt 0x9D800 & Keyboard translation table & 512 bytes \\
156 \tt 0x9DA00 & Parameter line construction area & 1 kB \\
158 \tt 0x9DC00 & & 7.5 kB \\
161 & Drive swapper & 1 kB \\
163 \multicolumn{3}{l}{\tt 0xA0000} \\
167 The area 0x90020-0x90023 is overlaid by a command-line descriptor while
168 the secondary boot loader is running.
172 \section{File references}
174 This section describes the references among files involved in the boot
181 The boot sector contains the primary boot loader, the address of the default
182 command line sector, the address of both
183 descriptor table sectors and the addresses of the sectors of the secondary
184 boot loader. The generic boot sector is copied from {\tt boot.b}.
186 The primary boot loader can store up to eight sector addresses of the
187 secondary boot loader.
193 The map file consists of so-called sections and of special data sectors.
195 spans an integral number of disk sectors and contains addresses of sectors
198 There are three exceptions: 1. If a ``hole'' is being
199 covered or if the floppy boot sector of an unstripped kernel has been omitted,
200 the address of the zero sector is used. This sector is part of the
201 map file. 2. When booting a different operating system, the first sector is
202 the merged chain loader that has been written to the map file before that
203 section. 3. Each map section describing an image is followed by a sector
204 containing the options line of that image.
206 The last address slot of each map sector is either unused (if the map section
207 ends in this sector) or contains the address of the next map sector in the
210 The ifive sectors at the beginning of the map file are special: the first
211 sector contains the default command line, the next
212 two sectors contain the boot image descriptor table and the fourth sector
213 is filled with zero bytes. This sector is mapped whenever a file contains
214 a ``hole''. The fifth sector contains the keyboard translation table.
220 A kernel image consists simply of a sequence of sectors being
221 loaded. The map section also contains a sector with a fallback command line
222 and a sector with parameter line options. Optionally, a RAM disk image,
223 specified by a second map section, can be loaded.
229 When booting another operating system, the chain loader ({\tt chain.b}) is
230 merged with the patched partition table\footnote{If the partition table is
231 omitted, that area is filled with zero bytes.} and written into the map file.
232 The map section of this boot image starts after that sector and contains only
233 the address of a dummy floppy boot sector (the zero sector, but its
234 contents are irrelevant), the loader
235 sector and the boot sector of the other operating system. Not that the
236 map section also contains the fallback sector and a (useless) sector for
240 \section{Configuration parameters}
242 The boot sector of each kernel contains a set of configuration parameters
243 that have to be available at boot time before the kernel can access
244 file systems. These parameters can be set when the kernel is compiled and
245 later be changed with programs like {\sf rdev}. \LILO\ can supersede
246 the parameters (in memory) at boot time by placing the corresponding
247 items on the parameter line passed to the kernel.
249 The parameters are stored at the following (decimal) offsets:
252 \item[497] the size of the setup code in sectors (512 bytes). Older kernels
253 may put a zero at this place.
254 \item[498-499] is a flag specifying whether the root file system should be
255 mounted read-only (if non-zero) or read-write (if zero).
256 \item[500-501] the size of the kernel, counted in paragraphs (16 bytes).
257 \item[502-503] this parameter is currently unused.
258 \item[504-505] the size of the RAM disk in kilobytes. No RAM disk is
259 created if this parameter is set to zero.
260 \item[506-507] the text mode the VGA is set to.
262 \item[0xFFFD] the user is asked to specify the VGA mode at boot time.
263 \item[0xFFFE] uses 80x50 (``extended'') mode.
264 \item[0xFFFF] uses 80x25 (``normal'') mode.
266 Any other value selects the corresponding mode as displayed in the
267 interactive VGA mode selection menu. This is the only option that is set
268 by LILO by patching the boot sector instead of passing it on the parameter
270 \item[508] the minor number of the device that should be mounted as root.
271 \item[509] the major number of the device that should be mounted as root.
275 \section{Parameter line interface}
277 The kernel supports processing of parameters that are
278 provided by the boot loader. The parameter string is a NUL-terminated
279 ASCII string that contains space-separated words or
280 {\tt {\it variable\/}={\it value\/}} pairs. A description of how they are
281 interpreted can be found in the section of the user's guide labeled
284 The following descriptor has to be set up to pass a parameter string to
288 \item[0x90020] the magic number 0xA33F.
289 \item[0x90022] the offset of the first byte of the parameter line relative
293 The boot loader composes the parameter line from the command line, from
294 the options sector and from some internally generated prefixes (typically
295 \verb"auto" and \verb"BOOT_IMAGE="), as follows:
302 Command line: \verb"vmlinuz root=802"\\
303 Options sector: \verb"root=801 ro"
305 yields \verb"BOOT_IMAGE=vmlinuz root=801 ro root=802"
307 Because parameter line options can typically be overridden, the first
308 \verb"root" option is ignored by the kernel.
311 \section{External interface}
313 \LILO\ is able to receive its command line from a program that is booted
314 before it. This externally provided command line is only used if the
315 user does not use the normal mechanism to invoke the boot prompt.
317 The following register contents are expected:
320 \item[\bf DL] contains the value 0xFE.
321 \item[\bf ES:SI] points to the string ``LILO''. The string must be in
322 upper case and no terminating character is needed. The string must not
323 cross segment boundaries, i.e. {\bf SI} must be below 0xFFFD.
324 \item[\bf ES:BX] points to a NUL-terminated string that is used as the
325 command line. This string has a maximum length of 78 characters (not
326 including the terminating NUL) and must not cross segment boundaries.
329 There are two values of the externally provided command line that have a
333 \item an empty string ({\bf ES:BX} points to a NUL byte) is interpreted
334 as a request to enter the boot prompt and to accept keyboard input.
335 \item a string that consists only of blanks is interpreted as a request
336 to boot the default boot image.
339 \LILO\ can also obtain the default command line from the map file. It
340 is only used if no externally provided command line is available.
343 \section{Default command line in map file}
345 The first sector of the map file is reserved for a default command line.
346 Unless the user invokes the boot prompt by pressing a shift key or unless an
347 externally provided command line is present, the command line in the map
348 file is interpreted as if it had been typed on the keyboard.
350 The first two bytes of the first sector of the map file have to contain
351 the magic number {\tt DC\_MAGIC} (0xF4F2) in little-endian byte order.
352 They are followed by a NUL-terminated string with a maximum length of
353 510 bytes, including the NUL. Note that the boot loader limits command
354 lines to 78 characters after removing duplicate spaces.
356 The command line is disabled by either clobbering the magic number or
357 by using an empty string (i.e. only a NUL byte) as the command line.