The term ‘Bootstrap’, which originally refers to a person who tries to stand up by pulling his own boots, refers to a subroutine used to establish the full routine(its own left part, i think) or another routine in computer science. Today modern computers act as a vital role in our daily life and many of you may wonder what happens to the computer when you have it powered on. The ‘Bootstrap’, which is also called ‘boot’ for short, is the first step to be done by the computer. The process of ‘Bootstrap’, which starts on when the computer is powered on and usu ends off when the kernel of the operating system begins to run, is just what we are gonna describe.

As a matter of convenience, we are gonna try to understand the ‘Bootstrap’ process of linux operating system on platforms compatible with ‘i386′, since linux is source-opened and its source is absolutely free. We can boot linux from any bootable devices, such as hard disk, floopy, or cd-rom. We choose to boot from a hard disk which is more complex than the other two. Now we suppose a linux-installed computer is in front of us. Press the power button and we will go to the ‘Bootstrap’ process.

The normal ‘Bootstrap’ flow can be described as following:
[Hardware initialization] -> [BIOS routine] -> [Bootloader run] -> End (Kernel startup)

1. Hardware initialization
Immediately after the power-up or an assertion of the RESET# pin, the processor performs a hardware initialization and an optional built-in self-test(BIST for short). The hardware initialization sets the processor’s registers to a known state and places the processor in real-address operating mode which we have mentioned in "Inside the ‘i386′". The process state after power-up or reset is vatal, since it decides the address of the code from which the processor is going to execute. Here lists the initial states of some registers:

(1) R[EAX] = R[EBX] = R[ECX] = R[ESI] = R[EDI] = R[ESP] = R[EBP] = 0×00000000 (Note: If the value in the EAX register does not equal to 0H after the BIST, it indicates that a processor fault was detected.)
(2) the EDX register contains component identification and revision information and different values indicate the various members of these Intel Architecture families.
(3) R[CS] = 0xF000 (Note: In its hidden part, ‘Base’ = 0xFFFF0000, Limit = 0xFFFF, AR = Present, R/W, Accessed.)
(4) R[DS] = R[ES] = R[FS] = R[GS] = R[SS] = 0×0000 (Note: In their hidden parts, ‘Base’ = 0×00000000, Limit = 0xFFFF, AR = Present, R/W, Accessed.)
(5) R[EFLAGS] = 0×00000002 (Note: The 10 most-significant bits of this register are undefined following a reset. Software should not depend on the states of any of these bits.)
(6) R[EIP] = 0x0000FFF0

After the hardware initialization, The first instruction that is fetched and executed is located at physical address 0xFFFFFFF0. The BIOS EPROM containing the software initialization code must be located at this address, otherwise the processor can not locate and fetch its first instruction. Here we know that the processor is using ‘Read-Address mode model’, since it is in ‘real-address’ operating mode. but the address 0xFFFFFFF0 is beyond the 1-MByte addressable range of the processor while in real-address mode. How is the processor initialized to this starting address? As mentioned in "Inside the ‘i386′", the CS register has two parts: the visible segment selector part and the hidden base address part. In real-address mode, the base address is normally formed by shifting the 16-bit segment selector value 4 bits to the left to produce a 20-bit base address according to the normal rule. However, during the hardware initialization, the normal rule doesn’t be followd. the segment selector in the CS register is loaded with 0xF000 and the base address is loaded with 0xFFFF0000. The starting address is thus formed by adding the base address to the value in the EIP register (that is, 0xFFFF0000 + 0xFFF0 = 0xFFFFFFF0). The first time the CS register is loaded with a new value after the hardware initialization, the processor will follow the normal rule for address translation in real-address mode (that is, [CS base address = CS segment selector * 16]). To insure that the base address in the CS register remains unchanged until the EPROM based software initialization code is completed, the code must not contain a far jump or far call or allow an interrupt to occur (which would cause the CS selector value to be changed).

2. BIOS routine (software initialization)
Here, the hardware initialization of the processor is over and the first instruction, which is also the first one of BIOS routine, is executed. From now on, the BIOS routine, which is the very first program run by the processor takes control and begins to run. ‘BIOS’(Basic Input/Output System) is the software embedded on a chip (usu EPROM) located on the computer’s main board and it is also called ‘firmware’.

The BIOS routine also uses ‘Real-Address’ mode model and performs the following operations:
[Power-on self-test] -> [Hardware devices initialization] -> [Load boot sector] -> End (the loaded sector takes control)

(1) Power-on self-test (POST)
The BIOS routine executes a series of tests to establish which devices are present and whether they are working properly. It also initializes the standard devices, such as the memory controller, video controller, IDE controller and floppy controller. Using stored parameters, it initializes the motherboard chipset, and sets timing parameters. It also creates an interrupt vector table and provides a set of services, accessible through interrupts, that allow access to the standard I/O devices. During this phase we may get some messages displayed on the screen, such as the BIOS version banner or etc.

(2) Hardware devices initialization
In this phase, the BIOS routine guarantees that all hardware devices operate without conflicts on the IRQ lines and I/O ports and a table of installed PCI devices will be displayed on the screen.

(3) Load boot sector
After the ‘POST’ and the initialization of hardware devices, the BIOS routine call ‘Int19H’ service routine to search for the valid boot sector, which has the signature ’0x55AA’ in its last two bytes. As soon as a valid sector is found, the BIOS routine continues to call ‘Int13H’ service routine to load the valid sector to the address ’0x00007C00′, and then jumps into this address and executes the code just loaded.

3. Bootloader run
The valid sector loaded from hard disk by BIOS routine is usu called ‘Master Boot Sector’, which consists of ‘Master Boot Record(MBR)’, ‘Disk Partition Table(DPT)’ and ‘Boot Record ID(0x55AA)’. Usu the MBR stores a small program which used to load the first sector of the partition containing the operating system to be started. Today a two-stage boot loader such as LILO, GRUB is required to boot a Linux kernel from disk. These bootloaders may be installed either on the MBR (replacing that small program that loads the boot sector of the active partition) or in the boot sector of every disk partition. Whatever, the final result is the same. These bootloaders usu are broken into two parts, since they are too large to fit into one single sector, which size is 512 bytes. The MBR or the p
artition boot sector contains the first part of one of these bootloaders, which is loaded into memory from address 0x00007C00 by the BIOS routine. Then the first part program moves itself to another special address (it is 0x0009A000 for LILO), loads the second part of the bootloader into memory and jumps to execute the just loaded code. the second part of bootloader offers user a chance to choose from a list of bootable operating systems from disk. After the user has chosen the kernel to be loaded, the boot loader may either copy the boot sector of the corresponding partition into memory (the user has chosen the kernel in other partition) and execute it or directly copy the kernel image into memory (the user has chosen linux kernel in current partition). If the linux kernel is gonna loaded, the bootloader calls a BIOS routine to load the first 512 bytes of the kernel image to the address 0×00090000 , load the code of ‘setup.S’ to the address 0×00090200 and load the rest of the kernel image to either low address 0×00010000 (for small kernel images compiled with make zImage) or high address 0×00100000 (for big kernel images compiled with make bzImage). At last the bootloader jumps to execute the ‘setup.S’ code.

Here, the ‘Bootstrap’ process has come to a conclusion.

The term ‘i386′ in the title does not refer to the real Intel 80386 processor but the representative of Intel 32-bit architecture(IA32). I prefer ‘i386′ rather than ‘IA32′ just like what the linux kernel does, since you can find ‘i386′ folder in $(linux-2.6.x_dir)/arch directory. This artical describes some basic knowledge of ‘i386′, which may be kinda useful to those guys who wanna do research on or develop operating system.

We know that the ‘i386′ processors are the most widely used and supported today, And even the linux was born on it. As a researcher or a developer, we wonder what the ‘i386′ processor offers to us. In brief ‘i386′ offers us an execution environment which consists of a set of registers and several mechanisms of accessing memory. Today the Intel mainstream processors, such as Pentium series, are almost based on 80386 processor which first introduced 32-bit registers and paging into ‘i386′. let us have a look at the resources supplied by the ‘i386′ processor. A part of the contents below are quoted from the book "Intel Architecture Software Developer’s Manual, Volume 1, Basic Architecture".

1. Memory accessing
Any operating system or executive designed to work with an ‘i386′ processor will use the processor’s memory management facilities to access memory. So far ‘i386′ processors support three memory-accessing model. Once using the processor’s memory management facilities, programs do not directly address physical memory. Instead, they access memory using any of these three memory models: flat, segmented, or real-address mode. With the flat memory model, memory appears to a program as a single, continuous address space, which is byte addressable and is called ‘linear address space’. it covers contiguously from 0 to (4G -1). When using this model, code (a program’s instructions), data, and the procedure stacks are all contained in this address space. With the segmented memory model, memory appears to a program as a group of independent address spaces called segments. When using this model, code, data, and stacks are typically contained in separate segments. To address a byte in a segment, a program must issue a logical address, which consists of a segment selector and an offset. Internally, the processor translates each logical address into a linear address to access a memory location and this translation is transparent to the application program. With either the flat or segmented model, the ‘i386′ processor provides facilities for dividing the linear address space into pages and mapping the pages into virtual memory. If an operating system/executive uses the ‘i386′ processor’s paging mechanism, the existence of the pages is transparent to an application program. we can also do a summary with an image as follows:
Logical Address(segmented mode) –> [Segmentation Unit] –> Liner Address(flat mode) –> [Paging Unit] –> Physical Address

The left real-address mode model uses the memory model for the Intel 8086 processor, the first ‘i386′ processor. The real-address mode uses a specific implementation of segmented memory in which the linear address space for the program and the operating system/executive consists of an array of segments, each of which is up to 64K bytes in size. The maximum size of the linear address space in real-address mode is 1M bytes.

Here, we have to say something about the ‘operatiing mode’. the ‘i386′ processor supports three operating mode which determines which instructions and architectural features are accessible.

(1) Protected mode
It is the native state of the processor. In this mode all instructions and architectural features are available, providing the highest performance and capability. This is the recommended mode for all new applications and operating systems. When in this mode, the processor can use any of the memory models described above. (The real-addressing mode memory model is ordinarily used only when the processor is in the virtual-8086 mode.)

(2) Real-address mode
This mode provides the programming environment of the Intel 8086 processor with a few extensions (such as the ability to switch to protected or system management mode). The processor is placed in real-address mode following power-up or a reset. When in this mode, the processor only supports the real-address mode memory model. As we know the process of booting from disk is in this mode.

(3) System management mode
It is unfamiliar to most of us. we have nothing to say.

2. Registers
The registers in ‘i386′ processors can be grouped into three type: ‘general-purpose data registers’, ‘segment registers’ and ‘status and control registers’. Details as follows:

(1) General-Purpose data registers
There are eight 32-bit registers available for general purpose, such as storing operands and pointers. In theory you can select any of them to do what you wanna do, but many instructions assign specific registers to hold operands. The following is a summary of these special uses:
EAX – Accumulator for operands and results data.
EBX – Pointer to data in the DS segment.
ECX – Counter for string and loop operations.
EDX – I/O pointer.
ESI – Pointer to data in the segment pointed to by the DS register; source pointer for string operations.
EDI – Pointer to data (or destination) in the segment pointed to by the ES register; destination pointer for string operations.
ESP – Stack pointer (in the SS segment).
EBP – Pointer to data on the stack (in the SS segment).

(2) Segment registers
There are six registers for holding segment selector which are a special pointer that identifies a segment in memory and all of these segment registers are 16-bit. To access a particular segment in memory, the segment selector for that segment must be present in the appropriate one of the segment registers. So, although a system can define thousands of segments, only 6 can be available for immediate use. Other segments can be made available by loading their segment selectors into these registers during program execution. Every segment register has a ‘visible’ part(16 bits in 32-bit platform) and a ‘hidden’ part. (The hidden part is sometimes referred to as a ‘descriptor cache’ or a ‘shadow register’.) When a segment selector is loaded into the visible part of a segment register, the processor also loads the hidden part of the segment register with the base address, segment limit, and access control information from the segment descriptor pointed to by the segment selector. Some load instructions such as ‘mov’, ‘pop’, etc explicitly reference the segment registers and other instructions such as ‘call’, ‘jmp’, or ‘ret’ change the contents of the CS register (and sometimes other segment registers) as an incidental part of their operation. How these segment registers are used depends on the type of memory accessing model that the operating system or executive is using.

We just mentioned ‘segment descripters’. A segment descriptor is a data structure in a GDT or LDT that provides the processor with the size and location of a segment, as well as access control and status information. Segment descriptors are typically created by compilers
, linkers, loaders, or the operating system or executive, but not application programs.

(3) Status and control registers
These registers report and allow modification of the state of the processor and of the program being executed. E.g. the 32-bit EFLAGS register contains a group of status flags, a control flag, and a group of system flags. Details as follows:
CF – Carry Flag
PF – Parity Flag
AF – Auxiliary Carry Flag
ZF – Zero Flag
SF – Sign Flag
TF – Trap Flag
IF – Interrupt Enable Flag
DF – Direction Flag
OF – Overflow Flag
IOPL – I/O Privilege Level
NT – Nested Task
RF – Resume Flag
VM – Virtual-8086 Mode
AC – alignment Check(AC)
VIF – Virtual Interrupt Flag
VIP – Virtual Interrupt Pending
ID – ID Flag
Some of the flags in the EFLAGS register can be modified directly using special-purpose instructions. 

The ‘i386′ processor is so complex that we can not list all of its features here. If you are interested in it, you may read the thick enough ‘i386′ manuals to make all clear.