Brendan wrote:
There are 2 cases:
- There is only one OS and no boot menu is needed in the first place (e.g. firmware starts OS directly)
- There is multiple OSs and the boot menu can not be considered an integral part of any OS
My advice here is to either don't bother providing a boot menu thing with the OS at all (let people use any they like), or to provide a generic/optional one in case the user doesn't already have one installed (which could be any open source boot menu thing).
More practically, you're probably going to want an open source boot menu thing that is digitally signed with Microsoft's key as part of a solution to the "secure boot" mess (so that firmware can start boot menu thing, and boot menu thing can then use your OSs key to check your OS and start your OS securely).
I already have a boot-manager in the BIOS boot solution, and I want to keep that. The idea is that you always have two bootable images, one called "standard" and one called "safe". If you download a non-working "standard" image, you can always boot the "safe" version and retry. Sometimes I use more than two images. These images are self-contained and typically a few MB large, so can easily fit into the EFI partition that is typically a few 100MBs.
Because of this requirement, it might be a good idea to integrate with some boot-manager. In GRUB, for instance, I can create the multiple boots by adding two sections in the config-file. I also like the feature to be able to boot any efi + boot from USB stick without a need to go through the BIOS setup screen.
As for secure boot, I won't bother about that, and instead just turn it off (already did + wiped the keys).
Brendan wrote:
You're going to need (relocatable) 64-bit code, that switches from the firmware's GDT to your GDT, then switches to your 32-bit code segment (in long mode). Your 32-bit code would disable long mode.
Yes, but that is only a few assembly instructions for loading GDT, and a far jump to the legacy code selector. I have this code in my 64-bit extension already.
Brendan wrote:
Do not assume anything about the physical address space. There are no guarantees that the areas at 0x111000 or 0x121000 are usable RAM.
I'd only used fixed virtual addresses (and not use fixed physical addresses). This means using either paging or segmentation for the 2nd stage loader. If your existing 2nd stage requires a fixed virtual address, then write a new 2nd stage for UEFI that doesn't.
They must be, otherwise things will not work.
Because the switcher between long mode and protected mode (and reverse) must turn off paging, it must execute at some known physical addresses. I assigned the above range for that.
The 2nd stage loader could run at any position, but since 64-bit support must have a fixed physical range, it should be no additional problem to reuse that in the boot process.