# Get hd0 data...	xorw	%ax, %ax	movw	%ax, %ds	ldsw	(4 * 0x41), %si	movw	%cs, %ax			# aka SETUPSEG	subw	$DELTA_INITSEG, %ax		# aka INITSEG	pushw	%ax	movw	%ax, %es	movw	$0x0080, %di	movw	$0x10, %cx	pushw	%cx	cld	rep 	movsb# Get hd1 data...	xorw	%ax, %ax	movw	%ax, %ds	ldsw	(4 * 0x46), %si	popw	%cx	popw	%es	movw	$0x0090, %di	rep	movsb# Check that there IS a hd1 :-)	movw	$0x01500, %ax	movb	$0x81, %dl	int	$0x13	jc	no_disk1		cmpb	$3, %ah	je	is_disk1no_disk1:	movw	%cs, %ax			# aka SETUPSEG	subw	$DELTA_INITSEG, %ax 		# aka INITSEG	movw	%ax, %es	movw	$0x0090, %di	movw	$0x10, %cx	xorw	%ax, %ax	cld	rep	stosbis_disk1:# Check for PS/2 pointing device	movw	%cs, %ax			# aka SETUPSEG	subw	$DELTA_INITSEG, %ax		# aka INITSEG	movw	%ax, %ds	movw	$0, (0x1ff)			# default is no pointing device	int	$0x11				# int 0x11: equipment list	testb	$0x04, %al			# check if mouse installed	jz	no_psmouse	movw	$0xAA, (0x1ff)			# device presentno_psmouse:# Now we want to move to protected mode ...	cmpw	$0, %cs:realmode_swtch	jz	rmodeswtch_normal	lcall	*%cs:realmode_swtch	jmp	rmodeswtch_endrmodeswtch_normal:        pushw	%cs	call	default_switchrmodeswtch_end:# we get the code32 start address and modify the below 'jmpi'# (loader may have changed it)	movl	%cs:code32_start, %eax	movl	%eax, %cs:code32# Now we move the system to its rightful place ... but we check if we have a# big-kernel. In that case we *must* not move it ...	testb	$LOADED_HIGH, %cs:loadflags	jz	do_move0			# .. then we have a normal low						# loaded zImage						# .. or else we have a high						# loaded bzImage	jmp	end_move			# ... and we skip movingdo_move0:	movw	$0x100, %ax			# start of destination segment	movw	%cs, %bp			# aka SETUPSEG	subw	$DELTA_INITSEG, %bp		# aka INITSEG	movw	%cs:start_sys_seg, %bx		# start of source segment	clddo_move:	movw	%ax, %es			# destination segment	incb	%ah				# instead of add ax,#0x100	movw	%bx, %ds			# source segment	addw	$0x100, %bx	subw	%di, %di	subw	%si, %si	movw 	$0x800, %cx	rep	movsw	cmpw	%bp, %bx			# assume start_sys_seg > 0x200,						# so we will perhaps read one						# page more than needed, but						# never overwrite INITSEG						# because destination is a						# minimum one page below source	jb	do_moveend_move:# then we load the segment descriptors	movw	%cs, %ax			# aka SETUPSEG	movw	%ax, %ds		# Check whether we need to be downward compatible with version <=201	cmpl	$0, cmd_line_ptr	jne	end_move_self		# loader uses version >=202 features	cmpb	$0x20, type_of_loader	je	end_move_self		# bootsect loader, we know of it# Boot loader doesnt support boot protocol version 2.02.# If we have our code not at 0x90000, we need to move it there now.# We also then need to move the params behind it (commandline)# Because we would overwrite the code on the current IP, we move# it in two steps, jumping high after the first one.	movw	%cs, %ax	cmpw	$SETUPSEG, %ax	je	end_move_self	cli					# make sure we really have						# interrupts disabled !						# because after this the stack						# should not be used	subw	$DELTA_INITSEG, %ax		# aka INITSEG	movw	%ss, %dx	cmpw	%ax, %dx	jb	move_self_1	addw	$INITSEG, %dx	subw	%ax, %dx			# this will go into %ss after						# the movemove_self_1:	movw	%ax, %ds	movw	$INITSEG, %ax			# real INITSEG	movw	%ax, %es	movw	%cs:setup_move_size, %cx	std					# we have to move up, so we use						# direction down because the						# areas may overlap	movw	%cx, %di	decw	%di	movw	%di, %si	subw	$move_self_here+0x200, %cx	rep	movsb	ljmp	$SETUPSEG, $move_self_heremove_self_here:	movw	$move_self_here+0x200, %cx	rep	movsb	movw	$SETUPSEG, %ax	movw	%ax, %ds	movw	%dx, %ssend_move_self:					# now we are at the right place	lidt	idt_48				# load idt with 0,0	xorl	%eax, %eax			# Compute gdt_base	movw	%ds, %ax			# (Convert %ds:gdt to a linear ptr)	shll	$4, %eax	addl	$gdt, %eax	movl	%eax, (gdt_48+2)	lgdt	gdt_48				# load gdt with whatever is						# appropriate# that was painless, now we enable a20	call	empty_8042	movb	$0xD1, %al			# command write	outb	%al, $0x64	call	empty_8042	movb	$0xDF, %al			# A20 on	outb	%al, $0x60	call	empty_8042##	You must preserve the other bits here. Otherwise embarrasing things#	like laptops powering off on boot happen. Corrected version by Kira#	Brown from Linux 2.2#	inb	$0x92, %al			# 	orb	$02, %al			# "fast A20" version	outb	%al, $0x92			# some chips have only this# wait until a20 really *is* enabled; it can take a fair amount of# time on certain systems; Toshiba Tecras are known to have this# problem.  The memory location used here (0x200) is the int 0x80# vector, which should be safe to use.	xorw	%ax, %ax			# segment 0x0000	movw	%ax, %fs	decw	%ax				# segment 0xffff (HMA)	movw	%ax, %gsa20_wait:	incw	%ax				# unused memory location <0xfff0	movw	%ax, %fs:(0x200)		# we use the "int 0x80" vector	cmpw	%gs:(0x210), %ax		# and its corresponding HMA addr	je	a20_wait			# loop until no longer aliased# make sure any possible coprocessor is properly reset..	xorw	%ax, %ax	outb	%al, $0xf0	call	delay	outb	%al, $0xf1	call	delay# well, that went ok, I hope. Now we mask all interrupts - the rest# is done in init_IRQ().	movb	$0xFF, %al			# mask all interrupts for now	outb	%al, $0xA1	call	delay		movb	$0xFB, %al			# mask all irq's but irq2 which	outb	%al, $0x21			# is cascaded# Well, that certainly wasn't fun :-(. Hopefully it works, and we don't# need no steenking BIOS anyway (except for the initial loading :-).# The BIOS-routine wants lots of unnecessary data, and it's less# "interesting" anyway. This is how REAL programmers do it.## Well, now's the time to actually move into protected mode. To make# things as simple as possible, we do no register set-up or anything,# we let the gnu-compiled 32-bit programs do that. We just jump to# absolute address 0x1000 (or the loader supplied one),# in 32-bit protected mode.## Note that the short jump isn't strictly needed, although there are# reasons why it might be a good idea. It won't hurt in any case.	movw	$1, %ax				# protected mode (PE) bit	lmsw	%ax				# This is it!	jmp	flush_instrflush_instr:	xorw	%bx, %bx			# Flag to indicate a boot	xorl	%esi, %esi			# Pointer to real-mode code	movw	%cs, %si	subw	$DELTA_INITSEG, %si	shll	$4, %esi			# Convert to 32-bit pointer# NOTE: For high loaded big kernels we need a#	jmpi    0x100000,__KERNEL_CS##	but we yet haven't reloaded the CS register, so the default size #	of the target offset still is 16 bit.#       However, using an operand prefix (0x66), the CPU will properly#	take our 48 bit far pointer. (INTeL 80386 Programmer's Reference#	Manual, Mixing 16-bit and 32-bit code, page 16-6)	.byte 0x66, 0xea			# prefix + jmpi-opcodecode32:	.long	0x1000				# will be set to 0x100000						# for big kernels	.word	__KERNEL_CS# Here's a bunch of information about your current kernel..kernel_version:	.ascii	UTS_RELEASE		.ascii	" ("		.ascii	LINUX_COMPILE_BY		.ascii	"@"		.ascii	LINUX_COMPILE_HOST		.ascii	") "		.ascii	UTS_VERSION		.byte	0# This is the default real mode switch routine.# to be called just before protected mode transitiondefault_switch:	cli					# no interrupts allowed !	movb	$0x80, %al			# disable NMI for bootup						# sequence	outb	%al, $0x70	lret# This routine only gets called, if we get loaded by the simple# bootsect loader _and_ have a bzImage to load.# Because there is no place left in the 512 bytes of the boot sector,# we must emigrate to code space here.bootsect_helper:	cmpw	$0, %cs:bootsect_es	jnz	bootsect_second	movb	$0x20, %cs:type_of_loader	movw	%es, %ax	shrw	$4, %ax	movb	%ah, %cs:bootsect_src_base+2	movw	%es, %ax	movw	%ax, %cs:bootsect_es	subw	$SYSSEG, %ax	lret					# nothing else to do for nowbootsect_second:	pushw	%cx	pushw	%si	pushw	%bx	testw	%bx, %bx			# 64K full?	jne	bootsect_ex	movw	$0x8000, %cx			# full 64K, INT15 moves words	pushw	%cs	popw	%es	movw	$bootsect_gdt, %si	movw	$0x8700, %ax	int	$0x15	jc	bootsect_panic			# this, if INT15 fails	movw	%cs:bootsect_es, %es		# we reset %es to always point	incb	%cs:bootsect_dst_base+2		# to 0x10000bootsect_ex:	movb	%cs:bootsect_dst_base+2, %ah	shlb	$4, %ah				# we now have the number of						# moved frames in %ax	xorb	%al, %al	popw	%bx	popw	%si	popw	%cx	lretbootsect_gdt:	.word	0, 0, 0, 0	.word	0, 0, 0, 0bootsect_src:	.word	0xffffbootsect_src_base:	.byte	0x00, 0x00, 0x01		# base = 0x010000	.byte	0x93				# typbyte	.word	0				# limit16,base24 =0bootsect_dst:	.word	0xffffbootsect_dst_base:	.byte	0x00, 0x00, 0x10		# base = 0x100000	.byte	0x93				# typbyte	.word	0				# limit16,base24 =0	.word	0, 0, 0, 0			# BIOS CS	.word	0, 0, 0, 0			# BIOS DSbootsect_es:	.word	0bootsect_panic:	pushw	%cs	popw	%ds	cld	leaw	bootsect_panic_mess, %si	call	prtstr	bootsect_panic_loop:	jmp	bootsect_panic_loopbootsect_panic_mess:	.string	"INT15 refuses to access high mem, giving up."# This routine checks that the keyboard command queue is empty# (after emptying the output buffers)## Some machines have delusions that the keyboard buffer is always full# with no keyboard attached...## If there is no keyboard controller, we will usually get 0xff# to all the reads.  With each IO taking a microsecond and# a timeout of 100,000 iterations, this can take about half a# second ("delay" == outb to port 0x80). That should be ok,# and should also be plenty of time for a real keyboard controller# to empty.#empty_8042:	pushl	%ecx	movl	$100000, %ecxempty_8042_loop:	decl	%ecx	jz	empty_8042_end_loop	call	delay	inb	$0x64, %al			# 8042 status port	testb	$1, %al				# output buffer?	jz	no_output	call	delay	inb	$0x60, %al			# read it	jmp	empty_8042_loopno_output:	testb	$2, %al				# is input buffer full?	jnz	empty_8042_loop			# yes - loopempty_8042_end_loop:	popl	%ecx	ret# Read the cmos clock. Return the seconds in algettime:	pushw	%cx	movb	$0x02, %ah	int	$0x1a	movb	%dh, %al			# %dh contains the seconds	andb	$0x0f, %al	movb	%dh, %ah	movb	$0x04, %cl	shrb	%cl, %ah	aad	popw	%cx	ret# Delay is needed after doing I/Odelay:	outb	%al,$0x80	ret# Descriptor tablesgdt:	.word	0, 0, 0, 0			# dummy	.word	0, 0, 0, 0			# unused	.word	0xFFFF				# 4Gb - (0x100000*0x1000 = 4Gb)	.word	0				# base address = 0	.word	0x9A00				# code read/exec	.word	0x00CF				# granularity = 4096, 386						#  (+5th nibble of limit)	.word	0xFFFF				# 4Gb - (0x100000*0x1000 = 4Gb)	.word	0				# base address = 0	.word	0x9200				# data read/write	.word	0x00CF				# granularity = 4096, 386						#  (+5th nibble of limit)# this is 64bit descriptor for code	.word	0xFFFF	.word	0	.word	0x9A00				# code read/exec	.word	0x00AF				# as above, but it is long mode and with D=0						# it does not seem to do the trick.idt_48:	.word	0				# idt limit = 0	.word	0, 0				# idt base = 0Lgdt_48:	.word	0x8000				# gdt limit=2048,						#  256 GDT entries	.word	0, 0				# gdt base (filled in later)# Include video setup & detection code#include "video.S"# Setup signature -- must be lastsetup_sig1:	.word	SIG1setup_sig2:	.word	SIG2# After this point, there is some free space which is used by the video mode# handling code to store the temporary mode table (not used by the kernel).modelist:.textendtext:.dataenddata:.bssendbss: