diff --git a/Makefile b/Makefile
index 4c8b27a..002227f 100644
--- a/Makefile
+++ b/Makefile
@@ -67,7 +67,10 @@ image.bin: mbr.bin fs.img
 	cat $^ >$@
 
 kernel.bin: kernel.o console.o drivers/vga.o drivers/uart.o
-	$(LD) $(LDFLAGS) -o $@ -Ttext 0x1000 $^
+	$(LD) $(LDFLAGS) -o $@ -Ttext 0x9000 $^
+
+bootmain.o: bootmain.c
+	$(CC) $(CFLAGS) -Os -c $< -o $@
 
 %.o: %.c
 	$(CC) $(CFLAGS) -c $< -o $@
@@ -75,10 +78,14 @@ kernel.bin: kernel.o console.o drivers/vga.o drivers/uart.o
 %.o: %.S
 	$(CC) -m32 -ffreestanding -c -g $^ -o $@
 
-mbr.bin: mbr.o
+mbr.bin: mbr.raw tools/mbrpad
+	cp $< $@
+	tools/mbrpad $@
+
+mbr.raw: mbr.o bootmain.o
 	$(LD) -m elf_i386 -Ttext=0x7c00 --oformat=binary $^ -o $@
 
-mbr.elf: mbr.o
+mbr.elf: mbr.o bootmain.o
 	$(LD) -m elf_i386 -Ttext=0x7c00 $^ -o $@
 
 clean:
diff --git a/bootmain.c b/bootmain.c
new file mode 100644
index 0000000..95a10fd
--- /dev/null
+++ b/bootmain.c
@@ -0,0 +1,110 @@
+// Boot loader.
+//
+// Part of the boot block, along with mbr.S, which calls bootmain().
+// mbr.S has put the processor into protected 32-bit mode.
+// bootmain() loads an ELF kernel image from the disk starting at
+// sector 3 and then jumps to the kernel entry routine.
+
+#include "elf.h"
+#include "drivers/port.h"
+
+#define SECTSIZE  512
+
+typedef unsigned char uchar;
+typedef unsigned int uint;
+
+void readseg(uchar*, uint, uint);
+
+inline void stosb(uchar* addr, uchar byte, uint count) {
+    asm volatile("cld; rep stosb" : "+D"(addr), "+a"(byte) : "c"(count) : "cc");
+}
+
+void
+bootmain(void)
+{
+  Elf32_Ehdr *elf;
+  Elf32_Phdr *ph, *eph;
+  void (*entry)(void);
+  uchar* pa;
+
+  elf = (Elf32_Ehdr*)0x10000;  // scratch space
+
+  // Read 1st page off disk
+  readseg((uchar*)elf, 4096, 0);
+
+  // Is this an ELF executable?
+  if(elf->magic != ELF_MAGIC)
+    return;  // let bootasm.S handle error
+
+  // Load each program segment (ignores ph flags).
+  ph = (Elf32_Phdr*)((uchar*)elf + elf->e_phoff);
+  eph = ph + elf->e_phnum;
+  for(; ph < eph; ph++) {
+    pa = (uchar*)ph->p_paddr;
+    readseg(pa, ph->p_filesz, ph->p_offset);
+    if(ph->p_memsz > ph->p_filesz)
+      stosb(pa + ph->p_filesz, 0, ph->p_memsz - ph->p_filesz);
+  }
+
+  // Call the entry point from the ELF header.
+  // Does not return!
+  entry = (void(*)(void))(elf->e_entry);
+  entry();
+}
+
+void
+waitdisk(void)
+{
+  // Wait for disk ready.
+  while((port_byte_in(0x1F7) & 0xC0) != 0x40)
+    ;
+}
+
+static inline void
+insl(int port, void *addr, int cnt)
+{
+  asm volatile("cld; rep insl" :
+               "=D" (addr), "=c" (cnt) :
+               "d" (port), "0" (addr), "1" (cnt) :
+               "memory", "cc");
+}
+
+// Read a single sector at offset into dst.
+void
+readsect(void *dst, uint offset)
+{
+  // Issue command.
+  waitdisk();
+  port_byte_out(0x1F2, 1);   // count = 1
+  port_byte_out(0x1F3, offset);
+  port_byte_out(0x1F4, offset >> 8);
+  port_byte_out(0x1F5, offset >> 16);
+  port_byte_out(0x1F6, (offset >> 24) | 0xE0);
+  port_byte_out(0x1F7, 0x20);  // cmd 0x20 - read sectors
+
+  // Read data.
+  waitdisk();
+  insl(0x1F0, dst, SECTSIZE/4);
+}
+
+// Read 'count' bytes at 'offset' from kernel into physical address 'pa'.
+// Might copy more than asked.
+void
+readseg(uchar* pa, uint count, uint offset)
+{
+  uchar* epa;
+
+  epa = pa + count;
+
+  // Round down to sector boundary.
+  pa -= offset % SECTSIZE;
+
+  // Translate from bytes to sectors; kernel starts at sector 3.
+  offset = (offset / SECTSIZE) + 2;
+
+  // If this is too slow, we could read lots of sectors at a time.
+  // We'd write more to memory than asked, but it doesn't matter --
+  // we load in increasing order.
+  for(; pa < epa; pa += SECTSIZE, offset++)
+    readsect(pa, offset);
+}
diff --git a/drivers/port.h b/drivers/port.h
index 380272a..5d2174a 100644
--- a/drivers/port.h
+++ b/drivers/port.h
@@ -2,24 +2,24 @@
 
 static inline unsigned char port_byte_in(unsigned short port) {
     unsigned char result;
-    __asm__("in %%dx, %%al" : "=a" (result) : "d" (port));
+    asm volatile("in %%dx, %%al" : "=a" (result) : "d" (port));
     return result;
 }
 
 static inline unsigned short port_word_in(unsigned short port) {
     unsigned short result;
-    __asm__("in %%dx, %%ax" : "=a" (result) : "d" (port));
+    asm volatile("in %%dx, %%ax" : "=a" (result) : "d" (port));
     return result;
 }
 
 static inline void port_byte_out(unsigned short port, unsigned char data) {
-    __asm__("outb %%al, %%dx" : : "a" (data), "d" (port));
+    asm volatile("outb %%al, %%dx" : : "a" (data), "d" (port));
 }
 
 static inline void port_word_out(unsigned short port, unsigned short data) {
-    __asm__("outw %%ax, %%dx" : : "a" (data), "d" (port));
+    asm volatile("outw %%ax, %%dx" : : "a" (data), "d" (port));
 }
 
 static inline void port_long_out(unsigned short port, unsigned int data) {
-    __asm__("outl %%eax, %%dx" : : "a" (data), "d" (port));
+    asm volatile("outl %%eax, %%dx" : : "a" (data), "d" (port));
 }
diff --git a/elf.h b/elf.h
new file mode 100644
index 0000000..efa86a0
--- /dev/null
+++ b/elf.h
@@ -0,0 +1,41 @@
+#pragma once
+
+#include <stdint.h>
+
+enum {
+	EI_NIDENT = 16,
+};
+
+typedef uint32_t Elf32_Addr;
+typedef uint32_t Elf32_Off;
+
+#define ELF_MAGIC 0x464C457FU  // "\x7FELF" in little endian
+
+typedef struct {
+	uint32_t magic;
+	unsigned char e_ident[EI_NIDENT - 4];
+	uint16_t      e_type;
+	uint16_t      e_machine;
+	uint32_t      e_version;
+	Elf32_Addr    e_entry;
+	Elf32_Off     e_phoff;
+	Elf32_Off     e_shoff;
+	uint32_t      e_flags;
+	uint16_t      e_ehsize;
+	uint16_t      e_phentsize;
+	uint16_t      e_phnum;
+	uint16_t      e_shentsize;
+	uint16_t      e_shnum;
+	uint16_t      e_shstrndx;
+} Elf32_Ehdr;
+
+typedef struct {
+	uint32_t   p_type;
+	Elf32_Off  p_offset;
+	Elf32_Addr p_vaddr;
+	Elf32_Addr p_paddr;
+	uint32_t   p_filesz;
+	uint32_t   p_memsz;
+	uint32_t   p_flags;
+	uint32_t   p_align;
+} Elf32_Phdr;
diff --git a/mbr.S b/mbr.S
index 20b5fe3..d05f6ee 100644
--- a/mbr.S
+++ b/mbr.S
@@ -7,101 +7,11 @@ _start:
     mov $banner, %si
     call print_string
 
-    call get_drive_geometry
-    call load_kernel
     call switch_to_32bit
 
     hlt
     jmp . // loop forever
 
-get_drive_geometry:
-    mov $8, %ah
-    mov boot_drive, %dl
-    int $0x13
-    inc %dh  // number of heads
-    mov %dh, disk_heads
-    and 0x3f, %cl
-    mov %cl, sectors_per_track
-    ret
-
-
-.equ ELF32_ENTRY_OFFSET, 0x18
-.equ ELF32_PHDR_OFFSET, 0x1c
-.equ ELF32_PHENTSIZE_OFFSET, ELF32_PHDR_OFFSET + 14
-.equ ELF32_PHNUM_OFFSET, ELF32_PHENTSIZE_OFFSET + 2
-.equ ELF32_PHDR_P_OFFSET, 4
-.equ ELF32_PHDR_PTYPE_OFFSET, 0
-.equ ELF32_PHDR_FILESZ_OFFSET, 4*4
-.equ KERNEL_OFFSET, 0x1000
-
-.equ PT_LOAD, 1
-
-.equ MBR_SECTORS, 2
-.equ SECTOR_BASE, 1
-.equ ELFHDR_SECTORS, 8
-
-.equ SECTOR_SIZE, 512
-.equ SECTOR_SHIFT, 9
-
-load_kernel:
-    mov $1, %al // sectors to read
-    mov $SECTOR_BASE + MBR_SECTORS, %cl // start after MBR
-    call bios_disk_read
-
-    mov KERNEL_OFFSET + ELF32_ENTRY_OFFSET, %si
-    mov %si, entry // store entry point
-
-    mov KERNEL_OFFSET + ELF32_PHNUM_OFFSET, %si
-read_segment:
-    dec %si  // no offset to the first entry
-    mov %si, %ax
-    mulb KERNEL_OFFSET + ELF32_PHENTSIZE_OFFSET
-    mov %ax, %di
-    add KERNEL_OFFSET + ELF32_PHDR_OFFSET, %di
-    // now di holds offset to the phentry
-    mov KERNEL_OFFSET + ELF32_PHDR_PTYPE_OFFSET(%di), %ax
-    cmp $PT_LOAD, %ax
-    jnz read_segment // not a PT_LOAD segment
-    mov KERNEL_OFFSET + ELF32_PHDR_FILESZ_OFFSET(%di), %ax
-    test %ax, %ax
-    jz read_segment // empty segment
-
-    // now di holds offset to the last phentry loaded from file, ax its filesz
-
-    add KERNEL_OFFSET + ELF32_PHDR_P_OFFSET(%di), %ax
-    sub $0x1000, %ax // we won't load the header
-    add $SECTOR_SIZE - 1, %ax
-    shr $SECTOR_SHIFT, %ax // round up to sector count
-
-    mov $SECTOR_BASE + MBR_SECTORS + ELFHDR_SECTORS, %cl //start after ELF header
-    call bios_disk_read
-    ret
-
-bios_disk_read:
-    // expects %al to specify number of sectors, %cl the initial sector
-    xor %ah, %ah
-    mov %ax, %si
-    mov $0, %ch             // cylinder 0
-    mov $0, %dh             // head 0
-    mov $KERNEL_OFFSET, %bx // bx -> destination
-    mov boot_drive, %dl     // dl -> disk
-    mov $1, %al
-
-1:
-    mov $2, %ah             // read mode
-    int $0x13
-    jc fail
-    add $SECTOR_SIZE, %bx
-    inc %cl
-    dec %si
-    jnz 1b
-    ret
-
-fail:
-    mov $read_error, %si
-    call print_string
-    hlt
-    jmp .
 
 switch_to_32bit:
     mov	$2, %al
@@ -127,8 +37,7 @@ init_32bit:
     mov $KERN_STACK_BASE, %ebp      // 6. setup stack
     mov %ebp, %esp
 
-    movzwl entry, %esi
-    call *%esi              // 7. jump to the kernel
+    call bootmain           // 7. load and run kernel
     jmp .                   // 8. loop forever
 
 
@@ -146,7 +55,6 @@ repeat:
 done:
     ret
 
-    . = _start + 256     # pad to 256 bytes
 boot_drive:
     .byte 0
 banner:
@@ -173,6 +81,3 @@ gdt_end:
 gdt_descriptor:
     .word gdt_end - gdt_start - 1 // size (16 bit)
     .int  gdt_start               // address (32 bit)
-
-    . = _start + 510     # pad to 510 bytes
-    .byte 0x55, 0xaa     # boot sector magic value
diff --git a/tools/mbrpad.c b/tools/mbrpad.c
new file mode 100644
index 0000000..267b8a8
--- /dev/null
+++ b/tools/mbrpad.c
@@ -0,0 +1,21 @@
+#include <unistd.h>
+#include <fcntl.h>
+#include <stdio.h>
+
+int main(int argc, char* argv[]) {
+    if (argc != 2) {
+        fprintf(stderr, "Usage: %s mbr.bin\n", argv[0]);
+        return 1;
+    }
+    const char* filename = argv[1];
+    int fd = open(filename, O_RDWR);
+    off_t length = lseek(fd, 0, SEEK_END);
+    if (length > 510) {
+        fprintf(stderr, "file %s is larger than 510 bytes (size: %llu)\n",
+                filename, length);
+        return 1;
+    }
+    lseek(fd, 510, SEEK_SET);
+    write(fd, "\x55\xaa", 2);
+    return 0;
+}