2 * setup.S Copyright (C) 1991, 1992 Linus Torvalds
4 * setup.s is responsible for getting the system data from the BIOS,
5 * and putting them into the appropriate places in system memory.
6 * both setup.s and system has been loaded by the bootblock.
8 * This code asks the bios for memory/disk/other parameters, and
9 * puts them in a "safe" place: 0x90000-0x901FF, ie where the
10 * boot-block used to be. It is then up to the protected mode
11 * system to read them from there before the area is overwritten
14 * Move PS/2 aux init code to psaux.c
15 * (troyer@saifr00.cfsat.Honeywell.COM) 03Oct92
17 * some changes and additional features by Christoph Niemann,
18 * March 1993/June 1994 (Christoph.Niemann@linux.org)
20 * add APM BIOS checking by Stephen Rothwell, May 1994
21 * (sfr@canb.auug.org.au)
23 * High load stuff, initrd support and position independency
24 * by Hans Lermen & Werner Almesberger, February 1996
25 * <lermen@elserv.ffm.fgan.de>, <almesber@lrc.epfl.ch>
27 * Video handling moved to video.S by Martin Mares, March 1996
28 * <mj@k332.feld.cvut.cz>
30 * Extended memory detection scheme retwiddled by orc@pell.chi.il.us (david
31 * parsons) to avoid loadlin confusion, July 1997
33 * Transcribed from Intel (as86) -> AT&T (gas) by Chris Noe, May 1999.
34 * <stiker@northlink.com>
36 * Fix to work around buggy BIOSes which dont use carry bit correctly
37 * and/or report extended memory in CX/DX for e801h memory size detection
38 * call. As a result the kernel got wrong figures. The int15/e801h docs
39 * from Ralf Brown interrupt list seem to indicate AX/BX should be used
40 * anyway. So to avoid breaking many machines (presumably there was a reason
41 * to orginally use CX/DX instead of AX/BX), we do a kludge to see
42 * if CX/DX have been changed in the e801 call and if so use AX/BX .
43 * Michael Miller, April 2001 <michaelm@mjmm.org>
45 * New A20 code ported from SYSLINUX by H. Peter Anvin. AMD Elan bugfixes
46 * by Robert Schwebel, December 2001 <robert@schwebel.de>
49 #include <linux/config.h>
50 #include <asm/segment.h>
51 #include <linux/version.h>
52 #include <linux/compile.h>
57 /* Signature words to ensure LILO loaded us right */
61 INITSEG = DEF_INITSEG # 0x9000, we move boot here, out of the way
62 SYSSEG = DEF_SYSSEG # 0x1000, system loaded at 0x10000 (65536).
63 SETUPSEG = DEF_SETUPSEG # 0x9020, this is the current segment
64 # ... and the former contents of CS
66 DELTA_INITSEG = SETUPSEG - INITSEG # 0x0020
69 .globl begtext, begdata, begbss, endtext, enddata, endbss
82 # This is the setup header, and it must start at %cs:2 (old 0x9020:2)
84 .ascii "HdrS" # header signature
85 .word 0x0203 # header version number (>= 0x0105)
86 # or else old loadlin-1.5 will fail)
87 realmode_swtch: .word 0, 0 # default_switch, SETUPSEG
88 start_sys_seg: .word SYSSEG
89 .word kernel_version # pointing to kernel version string
90 # above section of header is compatible
91 # with loadlin-1.5 (header v1.5). Don't
94 type_of_loader: .byte 0 # = 0, old one (LILO, Loadlin,
95 # Bootlin, SYSLX, bootsect...)
96 # See Documentation/i386/boot.txt for
99 # flags, unused bits must be zero (RFU) bit within loadflags
101 LOADED_HIGH = 1 # If set, the kernel is loaded high
102 CAN_USE_HEAP = 0x80 # If set, the loader also has set
103 # heap_end_ptr to tell how much
104 # space behind setup.S can be used for
106 # Only the loader knows what is free
107 #ifndef __BIG_KERNEL__
113 setup_move_size: .word 0x8000 # size to move, when setup is not
114 # loaded at 0x90000. We will move setup
115 # to 0x90000 then just before jumping
116 # into the kernel. However, only the
117 # loader knows how much data behind
118 # us also needs to be loaded.
120 code32_start: # here loaders can put a different
121 # start address for 32-bit code.
122 #ifndef __BIG_KERNEL__
123 .long 0x1000 # 0x1000 = default for zImage
125 .long 0x100000 # 0x100000 = default for big kernel
128 ramdisk_image: .long 0 # address of loaded ramdisk image
129 # Here the loader puts the 32-bit
130 # address where it loaded the image.
131 # This only will be read by the kernel.
133 ramdisk_size: .long 0 # its size in bytes
138 heap_end_ptr: .word modelist+1024 # (Header version 0x0201 or later)
139 # space from here (exclusive) down to
140 # end of setup code can be used by setup
141 # for local heap purposes.
144 cmd_line_ptr: .long 0 # (Header version 0x0202 or later)
145 # If nonzero, a 32-bit pointer
146 # to the kernel command line.
147 # The command line should be
148 # located between the start of
149 # setup and the end of low
150 # memory (0xa0000), or it may
151 # get overwritten before it
152 # gets read. If this field is
153 # used, there is no longer
154 # anything magical about the
155 # 0x90000 segment; the setup
156 # can be located anywhere in
157 # low memory 0x10000 or higher.
159 ramdisk_max: .long (-__PAGE_OFFSET-(512 << 20)-1) & 0x7fffffff
160 # (Header version 0x0203 or later)
161 # The highest safe address for
162 # the contents of an initrd
164 trampoline: call start_of_setup
166 # End of setup header #####################################################
169 # Bootlin depends on this being done early
174 #ifdef SAFE_RESET_DISK_CONTROLLER
175 # Reset the disk controller.
181 # Set %ds = %cs, we know that SETUPSEG = %cs at this point
182 movw %cs, %ax # aka SETUPSEG
184 # Check signature at end of setup
185 cmpw $SIG1, setup_sig1
188 cmpw $SIG2, setup_sig2
193 # Routine to print asciiz string at ds:si
205 prtsp2: call prtspc # Print double space
206 prtspc: movb $0x20, %al # Print single space (note: fall-thru)
208 # Part of above routine, this one just prints ascii al
219 beep: movb $0x07, %al
222 no_sig_mess: .string "No setup signature found ..."
227 # We now have to find the rest of the setup code/data
229 movw %cs, %ax # SETUPSEG
230 subw $DELTA_INITSEG, %ax # INITSEG
233 movb (497), %bl # get setup sect from bootsect
234 subw $4, %bx # LILO loads 4 sectors of setup
235 shlw $8, %bx # convert to words (1sect=2^8 words)
237 shrw $3, %bx # convert to segment
239 movw %bx, %cs:start_sys_seg
240 # Move rest of setup code/data to here
241 movw $2048, %di # four sectors loaded by LILO
249 movw %cs, %ax # aka SETUPSEG
251 cmpw $SIG1, setup_sig1
254 cmpw $SIG2, setup_sig2
268 movw %cs, %ax # aka SETUPSEG
269 subw $DELTA_INITSEG, %ax # aka INITSEG
271 # Check if an old loader tries to load a big-kernel
272 testb $LOADED_HIGH, %cs:loadflags # Do we have a big kernel?
273 jz loader_ok # No, no danger for old loaders.
275 cmpb $0, %cs:type_of_loader # Do we have a loader that
277 jnz loader_ok # Yes, continue.
279 pushw %cs # No, we have an old loader,
281 lea loader_panic_mess, %si
286 loader_panic_mess: .string "Wrong loader, giving up..."
289 # Get memory size (extended mem, kB)
293 #ifndef STANDARD_MEMORY_BIOS_CALL
295 # Try three different memory detection schemes. First, try
296 # e820h, which lets us assemble a memory map, then try e801h,
297 # which returns a 32-bit memory size, and finally 88h, which
301 # the memory map from hell. e820h returns memory classified into
302 # a whole bunch of different types, and allows memory holes and
303 # everything. We scan through this memory map and build a list
304 # of the first 32 memory areas, which we return at [E820MAP].
305 # This is documented at http://www.acpi.info/, in the ACPI 2.0 specification.
307 #define SMAP 0x534d4150
310 xorl %ebx, %ebx # continuation counter
311 movw $E820MAP, %di # point into the whitelist
312 # so we can have the bios
313 # directly write into it.
316 movl $0x0000e820, %eax # e820, upper word zeroed
317 movl $SMAP, %edx # ascii 'SMAP'
318 movl $20, %ecx # size of the e820rec
319 pushw %ds # data record.
321 int $0x15 # make the call
322 jc bail820 # fall to e801 if it fails
324 cmpl $SMAP, %eax # check the return is `SMAP'
325 jne bail820 # fall to e801 if it fails
327 # cmpl $1, 16(%di) # is this usable memory?
330 # If this is usable memory, we save it by simply advancing %di by
334 movb (E820NR), %al # up to 32 entries
343 cmpl $0, %ebx # check to see if
344 jne jmpe820 # %ebx is set to EOF
349 # memory size is in 1k chunksizes, to avoid confusing loadlin.
350 # we store the 0xe801 memory size in a completely different place,
351 # because it will most likely be longer than 16 bits.
352 # (use 1e0 because that's what Larry Augustine uses in his
353 # alternative new memory detection scheme, and it's sensible
354 # to write everything into the same place.)
357 stc # fix to work around buggy
358 xorw %cx,%cx # BIOSes which dont clear/set
359 xorw %dx,%dx # carry on pass/error of
360 # e801h memory size call
361 # or merely pass cx,dx though
362 # without changing them.
367 cmpw $0x0, %cx # Kludge to handle BIOSes
368 jne e801usecxdx # which report their extended
369 cmpw $0x0, %dx # memory in AX/BX rather than
370 jne e801usecxdx # CX/DX. The spec I have read
371 movw %ax, %cx # seems to indicate AX/BX
372 movw %bx, %dx # are more reasonable anyway...
375 andl $0xffff, %edx # clear sign extend
376 shll $6, %edx # and go from 64k to 1k chunks
377 movl %edx, (0x1e0) # store extended memory size
378 andl $0xffff, %ecx # clear sign extend
379 addl %ecx, (0x1e0) # and add lower memory into
382 # Ye Olde Traditional Methode. Returns the memory size (up to 16mb or
383 # 64mb, depending on the bios) in ax.
391 # Set the keyboard repeat rate to the max
396 # Check for video adapter and its parameters and allow the
397 # user to browse video modes.
398 call video # NOTE: we need %ds pointing
405 movw %cs, %ax # aka SETUPSEG
406 subw $DELTA_INITSEG, %ax # aka INITSEG
424 # Check that there IS a hd1 :-)
434 movw %cs, %ax # aka SETUPSEG
435 subw $DELTA_INITSEG, %ax # aka INITSEG
444 # check for Micro Channel (MCA) bus
445 movw %cs, %ax # aka SETUPSEG
446 subw $DELTA_INITSEG, %ax # aka INITSEG
449 movw %ax, (0xa0) # set table length to 0
452 int $0x15 # moves feature table to es:bx
458 movw %cs, %ax # aka SETUPSEG
459 subw $DELTA_INITSEG, %ax # aka INITSEG
464 addw $2, %cx # table length is a short
468 movw $0x10, %cx # we keep only first 16 bytes
474 #ifdef CONFIG_X86_VOYAGER
475 movb $0xff, 0x40 # flag on config found
478 int $0x15 # put voyager config info at es:di
480 movw $0x40, %si # place voyager info in apm table
492 # Check for PS/2 pointing device
493 movw %cs, %ax # aka SETUPSEG
494 subw $DELTA_INITSEG, %ax # aka INITSEG
496 movw $0, (0x1ff) # default is no pointing device
497 int $0x11 # int 0x11: equipment list
498 testb $0x04, %al # check if mouse installed
501 movw $0xAA, (0x1ff) # device present
504 #if defined(CONFIG_X86_SPEEDSTEP_SMI) || defined(CONFIG_X86_SPEEDSTEP_SMI_MODULE)
505 movl $0x0000E980, %eax # IST Support
506 movl $0x47534943, %edx # Request value
515 #if defined(CONFIG_APM) || defined(CONFIG_APM_MODULE)
516 # Then check for an APM BIOS...
517 # %ds points to the bootsector
518 movw $0, 0x40 # version = 0 means no APM BIOS
519 movw $0x05300, %ax # APM BIOS installation check
522 jc done_apm_bios # Nope, no APM BIOS
524 cmpw $0x0504d, %bx # Check for "PM" signature
525 jne done_apm_bios # No signature, no APM BIOS
527 andw $0x02, %cx # Is 32 bit supported?
528 je done_apm_bios # No 32-bit, no (good) APM BIOS
530 movw $0x05304, %ax # Disconnect first just in case
532 int $0x15 # ignore return code
533 movw $0x05303, %ax # 32 bit connect
535 xorw %cx, %cx # paranoia :-)
537 xorl %esi, %esi # ...
540 jc no_32_apm_bios # Ack, error.
542 movw %ax, (66) # BIOS code segment
543 movl %ebx, (68) # BIOS entry point offset
544 movw %cx, (72) # BIOS 16 bit code segment
545 movw %dx, (74) # BIOS data segment
546 movl %esi, (78) # BIOS code segment lengths
547 movw %di, (82) # BIOS data segment length
548 # Redo the installation check as the 32 bit connect
549 # modifies the flags returned on some BIOSs
550 movw $0x05300, %ax # APM BIOS installation check
552 xorw %cx, %cx # paranoia
554 jc apm_disconnect # error -> shouldn't happen
556 cmpw $0x0504d, %bx # check for "PM" signature
557 jne apm_disconnect # no sig -> shouldn't happen
559 movw %ax, (64) # record the APM BIOS version
560 movw %cx, (76) # and flags
563 apm_disconnect: # Tidy up
564 movw $0x05304, %ax # Disconnect
566 int $0x15 # ignore return code
571 andw $0xfffd, (76) # remove 32 bit support bit
577 # Now we want to move to protected mode ...
578 cmpw $0, %cs:realmode_swtch
581 lcall *%cs:realmode_swtch
590 # we get the code32 start address and modify the below 'jmpi'
591 # (loader may have changed it)
592 movl %cs:code32_start, %eax
593 movl %eax, %cs:code32
595 # Now we move the system to its rightful place ... but we check if we have a
596 # big-kernel. In that case we *must* not move it ...
597 testb $LOADED_HIGH, %cs:loadflags
598 jz do_move0 # .. then we have a normal low
600 # .. or else we have a high
602 jmp end_move # ... and we skip moving
605 movw $0x100, %ax # start of destination segment
606 movw %cs, %bp # aka SETUPSEG
607 subw $DELTA_INITSEG, %bp # aka INITSEG
608 movw %cs:start_sys_seg, %bx # start of source segment
611 movw %ax, %es # destination segment
612 incb %ah # instead of add ax,#0x100
613 movw %bx, %ds # source segment
620 cmpw %bp, %bx # assume start_sys_seg > 0x200,
621 # so we will perhaps read one
622 # page more than needed, but
623 # never overwrite INITSEG
624 # because destination is a
625 # minimum one page below source
629 # then we load the segment descriptors
630 movw %cs, %ax # aka SETUPSEG
633 # Check whether we need to be downward compatible with version <=201
634 cmpl $0, cmd_line_ptr
635 jne end_move_self # loader uses version >=202 features
636 cmpb $0x20, type_of_loader
637 je end_move_self # bootsect loader, we know of it
639 # Boot loader doesnt support boot protocol version 2.02.
640 # If we have our code not at 0x90000, we need to move it there now.
641 # We also then need to move the params behind it (commandline)
642 # Because we would overwrite the code on the current IP, we move
643 # it in two steps, jumping high after the first one.
648 cli # make sure we really have
649 # interrupts disabled !
650 # because after this the stack
652 subw $DELTA_INITSEG, %ax # aka INITSEG
658 subw %ax, %dx # this will go into %ss after
662 movw $INITSEG, %ax # real INITSEG
664 movw %cs:setup_move_size, %cx
665 std # we have to move up, so we use
666 # direction down because the
671 subw $move_self_here+0x200, %cx
674 ljmp $SETUPSEG, $move_self_here
677 movw $move_self_here+0x200, %cx
683 end_move_self: # now we are at the right place
686 # Enable A20. This is at the very best an annoying procedure.
687 # A20 code ported from SYSLINUX 1.52-1.63 by H. Peter Anvin.
688 # AMD Elan bug fix by Robert Schwebel.
691 #if defined(CONFIG_X86_ELAN)
692 movb $0x02, %al # alternate A20 gate
693 outb %al, $0x92 # this works on SC410/SC520
701 A20_TEST_LOOPS = 32 # Iterations per wait
702 A20_ENABLE_LOOPS = 255 # Total loops to try
705 #ifndef CONFIG_X86_VOYAGER
708 # First, see if we are on a system with no A20 gate.
713 # Next, try the BIOS (INT 0x15, AX=0x2401)
716 pushfl # Be paranoid about flags
723 # Try enabling A20 through the keyboard controller
724 #endif /* CONFIG_X86_VOYAGER */
728 #ifndef CONFIG_X86_VOYAGER
729 call a20_test # Just in case the BIOS worked
730 jnz a20_done # but had a delayed reaction.
733 movb $0xD1, %al # command write
737 movb $0xDF, %al # A20 on
741 #ifndef CONFIG_X86_VOYAGER
742 # Wait until a20 really *is* enabled; it can take a fair amount of
743 # time on certain systems; Toshiba Tecras are known to have this
750 loop a20_kbc_wait_loop
752 # Final attempt: use "configuration port A"
754 inb $0x92, %al # Configuration Port A
755 orb $0x02, %al # "fast A20" version
756 andb $0xFE, %al # don't accidentally reset
759 # Wait for configuration port A to take effect
765 loop a20_fast_wait_loop
767 # A20 is still not responding. Try frobbing it again.
772 movw $a20_err_msg, %si
780 .byte A20_ENABLE_LOOPS
783 .ascii "linux: fatal error: A20 gate not responding!"
786 # If we get here, all is good
789 #endif /* CONFIG_X86_VOYAGER */
791 lidt idt_48 # load idt with 0,0
792 xorl %eax, %eax # Compute gdt_base
793 movw %ds, %ax # (Convert %ds:gdt to a linear ptr)
796 movl %eax, (gdt_48+2)
797 lgdt gdt_48 # load gdt with whatever is
800 # make sure any possible coprocessor is properly reset..
808 # well, that went ok, I hope. Now we mask all interrupts - the rest
809 # is done in init_IRQ().
810 movb $0xFF, %al # mask all interrupts for now
814 movb $0xFB, %al # mask all irq's but irq2 which
815 outb %al, $0x21 # is cascaded
817 # Well, that certainly wasn't fun :-(. Hopefully it works, and we don't
818 # need no steenking BIOS anyway (except for the initial loading :-).
819 # The BIOS-routine wants lots of unnecessary data, and it's less
820 # "interesting" anyway. This is how REAL programmers do it.
822 # Well, now's the time to actually move into protected mode. To make
823 # things as simple as possible, we do no register set-up or anything,
824 # we let the gnu-compiled 32-bit programs do that. We just jump to
825 # absolute address 0x1000 (or the loader supplied one),
826 # in 32-bit protected mode.
828 # Note that the short jump isn't strictly needed, although there are
829 # reasons why it might be a good idea. It won't hurt in any case.
830 movw $1, %ax # protected mode (PE) bit
831 lmsw %ax # This is it!
835 xorw %bx, %bx # Flag to indicate a boot
836 xorl %esi, %esi # Pointer to real-mode code
838 subw $DELTA_INITSEG, %si
839 shll $4, %esi # Convert to 32-bit pointer
841 # jump to startup_32 in arch/i386/boot/compressed/head.S
843 # NOTE: For high loaded big kernels we need a
844 # jmpi 0x100000,__BOOT_CS
846 # but we yet haven't reloaded the CS register, so the default size
847 # of the target offset still is 16 bit.
848 # However, using an operand prefix (0x66), the CPU will properly
849 # take our 48 bit far pointer. (INTeL 80386 Programmer's Reference
850 # Manual, Mixing 16-bit and 32-bit code, page 16-6)
852 .byte 0x66, 0xea # prefix + jmpi-opcode
853 code32: .long 0x1000 # will be set to 0x100000
857 # Here's a bunch of information about your current kernel..
858 kernel_version: .ascii UTS_RELEASE
860 .ascii LINUX_COMPILE_BY
862 .ascii LINUX_COMPILE_HOST
867 # This is the default real mode switch routine.
868 # to be called just before protected mode transition
870 cli # no interrupts allowed !
871 movb $0x80, %al # disable NMI for bootup
877 #ifndef CONFIG_X86_VOYAGER
878 # This routine tests whether or not A20 is enabled. If so, it
881 # The memory address used, 0x200, is the int $0x80 vector, which
884 A20_TEST_ADDR = 4*0x80
890 movw %cx, %fs # Low memory
892 movw %cx, %gs # High memory area
893 movw $A20_TEST_LOOPS, %cx
894 movw %fs:(A20_TEST_ADDR), %ax
898 movw %ax, %fs:(A20_TEST_ADDR)
899 call delay # Serialize and make delay constant
900 cmpw %gs:(A20_TEST_ADDR+0x10), %ax
903 popw %fs:(A20_TEST_ADDR)
908 #endif /* CONFIG_X86_VOYAGER */
910 # This routine checks that the keyboard command queue is empty
911 # (after emptying the output buffers)
913 # Some machines have delusions that the keyboard buffer is always full
914 # with no keyboard attached...
916 # If there is no keyboard controller, we will usually get 0xff
917 # to all the reads. With each IO taking a microsecond and
918 # a timeout of 100,000 iterations, this can take about half a
919 # second ("delay" == outb to port 0x80). That should be ok,
920 # and should also be plenty of time for a real keyboard controller
930 jz empty_8042_end_loop
934 inb $0x64, %al # 8042 status port
935 testb $1, %al # output buffer?
939 inb $0x60, %al # read it
943 testb $2, %al # is input buffer full?
944 jnz empty_8042_loop # yes - loop
949 # Read the cmos clock. Return the seconds in al
954 movb %dh, %al # %dh contains the seconds
963 # Delay is needed after doing I/O
970 # NOTE: The intel manual says gdt should be sixteen bytes aligned for
971 # efficiency reasons. However, there are machines which are known not
972 # to boot with misaligned GDTs, so alter this at your peril! If you alter
973 # GDT_ENTRY_BOOT_CS (in asm/segment.h) remember to leave at least two
974 # empty GDT entries (one for NULL and one reserved).
976 # NOTE: On some CPUs, the GDT must be 8 byte aligned. This is
977 # true for the Voyager Quad CPU card which will not boot without
978 # This directive. 16 byte aligment is recommended by intel.
982 .fill GDT_ENTRY_BOOT_CS,8,0
984 .word 0xFFFF # 4Gb - (0x100000*0x1000 = 4Gb)
985 .word 0 # base address = 0
986 .word 0x9A00 # code read/exec
987 .word 0x00CF # granularity = 4096, 386
988 # (+5th nibble of limit)
990 .word 0xFFFF # 4Gb - (0x100000*0x1000 = 4Gb)
991 .word 0 # base address = 0
992 .word 0x9200 # data read/write
993 .word 0x00CF # granularity = 4096, 386
994 # (+5th nibble of limit)
998 .word 0 # alignment byte
1000 .word 0 # idt limit = 0
1001 .word 0, 0 # idt base = 0L
1003 .word 0 # alignment byte
1005 .word gdt_end - gdt - 1 # gdt limit
1006 .word 0, 0 # gdt base (filled in later)
1008 # Include video setup & detection code
1012 # Setup signature -- must be last
1013 setup_sig1: .word SIG1
1014 setup_sig2: .word SIG2
1016 # After this point, there is some free space which is used by the video mode
1017 # handling code to store the temporary mode table (not used by the kernel).