The design of a simple bootloader

The very first thing that the bootloader does is setting up the Data Segment (DS), Extra Segment (ES) and Stack Segment (SS) registers to 0x0000. Since the MOV instruction doesn’t support assigning immediate values to segment registers, the AX register is first cleared and then used to set those segment registers.

Next, the Stack Pointer (SP) is set to 0x7C00, the physical address where the BIOS loaded the Stage 1 binary; since the stack grows downwards, the memory region right below this address can be used for the stack³. At first glance, this address might seem incorrect, since the first PUSH would overwrite the first 2 bytes of our Stage 1 binary; this is incorrect, because the PUSH instruction decreases the Stack Pointer before writing the pushed value to the address at SS:SP (see Intel SDM, Vol. 1, p. 1235).

Next, a far jump is performed to ensure that the Code Segment (CS) and Instruction Pointer (IP) are set to 0000:7C00⁴, rather than 07C0:0000, which is used by some BIOSes.

Although the EBPB is defined in that same Stage 1 binary with some basic information, it’s better to ask the BIOS for the actual disk information. This can be done by using the disk BIOS interrupt (0x13) with the AH register set to 0x08.

    ; Set Carry Flag (CF), set AH to "Read Drive Parameters", and
    ; call the "Disk" BIOS interrupt.
    stc
    mov     ah, 0x8
    int     0x13

    ; Jump if the Carry Flag was cleared by the BIOS.
    jnc     .success

.error:
    ; ...

.success:
    ; Read relevant values, mainly from DH and CX.

Specifically, the bootloader writes the Sectors per track and Head count values returned by the BIOS into the EBPB.

In order for the Stage 1 to load the Stage 2 binary, it needs to find it first. Specifically, it needs to find the directory entry of the Stage 2 binary by traversing the FAT12 root directory, and then obtain the first cluster index where the actual contents of the Stage 2 file are stored.

Then, after knowing that first cluster number, it traverses the linked list of cluster indexes that is stored in the File Allocation Table (FAT), reading each cluster into memory.

If the reader is interested in more information about the FAT file system, and how this part should be implemented, see my Understanding the FAT file system article. However, it’s worth noting that the actual operation for reading from the disk is performed using the disk BIOS interrupt (0x13) with the AH register set to 0x02.

Once all the clusters of the Stage 2 binary have been read, the Stage 1 binary jumps to the address where it was loaded, using a far jump. Since the Stage 2 binary was loaded into the address at ES:BX, the bootloader should be able to just jump there.

; NOTE: Invalid.
jmp     es:bx

However, there isn’t a JMP instruction that allows the programmer to do a far jump to a segment and offset contained in registers. However, it allows the programmer to specify a pointer to a 32-bit memory location where the segment and offset are specified.

my_addr: resw 2

mov     word [my_addr + 0], bx
mov     word [my_addr + 2], es
jmp     far [my_addr]

However, this is not the best method, since the opcodes for these instructions take up many bytes, and 4 extra bytes are needed for the buffer. Alternatively, one can use two PUSH instructions and a far RET to accomplish the same thing, without using an intermediate buffer, and with shorter instructions.

push    es
push    bx
retf            ; Alternatively: RET FAR

The far jump method used a total of 16 bytes, while the far return method used only 3. This wouldn’t make much difference in a normal binary, but these extra 13 bytes can become really useful as the Stage 1 binary grows.

Note that, as mentioned, the jump is made to the first byte of the Stage 2 binary, not to the entry point of an ELF file, so the Stage 2 binary must be built with this in mind.

The A20 line, which is disabled by default, limits the addressable memory to 1 MiB, and should be enabled by the bootloader before transferring control to the kernel, or simply for switching to protected mode. In order to understand what the A20 line is, and how it can be enabled, it’s important to know a bit of processor history, starting with how segmentation works in 16-bit real mode.

The Intel 8086 processor had 20 address lines, numbered A0 to A19; with these, the processor could access 2²⁰ bytes, or 1 MiB. Internal address registers of this processor were 16 bits wide. To access a 20-bit address space, an external memory reference was made up of a 16-bit offset address added to a 16-bit segment number⁵, shifted 4 bits to the left so as to produce a 20-bit physical address.

The following code shows how the real address would be calculated from a segment and an offset.

; Set data segment (DS) through intermediate register (AX).
mov     ax, 0x13A5
mov     ds, ax

; Write offset to the source index (SI), since not all registers can
; be used for addressing.
mov     si, 0x3327

;   13A5   (Segment: DS)
; +  3327  (Offset: SI)
; -------
;   16D77  (Address)
mov     ax, [ds:si]

Another important detail about this old processors is that, since they only had 20 address lines, addresses over 1 MiB caused the actual address to wrap around. For example, F800:8000, which should translate physical address 0x00100000, actually translates to address 0x00000000, since the 21st bit is discarded.

As processors evolved, starting from the Intel 80286, they were able to address more than 1 MiB of memory. However, for backwards compatibility, they were still supposed to emulate the behavior of a 8086 processor when booting up, which meant that they had to force this wrap-around behavior, since some programs depended on this. To control this wrap-around behavior, a logic gate was inserted in the A20 line between the processor and system bus, which got named Gate-A20.

This logic gate was supposed to be controlled from software, originally through the Intel 8042 keyboard controller. Since then, other more efficient methods are available, but they might not all work, so it’s best to try as many of them as possible. Without getting into much detail, these are the methods used in the bootloader, starting with the most likely to work:

1. Check if the A20 line was already enabled. This is done by comparing a known value at some address with the value located 1 MiB higher; if they match, it’s safe to assume that it wrapped around, so the A20 line is disabled.
2. Try to enable it through the BIOS. This is done through BIOS interrupt 0x15.
3. Try to enable it through the original keyboard method.

If the bootloader can’t enable the A20 line, it shows an error message and stops.

Before switching to protected mode, the Global Descriptor Table (GDT) has to be loaded.

Before transferring access to the kernel, the bootloader has to switch to protected mode.