]> CyberLeo.Net >> Repos - FreeBSD/releng/8.1.git/blob - sys/boot/i386/btx/btx/btx.S
Copy stable/8 to releng/8.1 in preparation for 8.1-RC1.
[FreeBSD/releng/8.1.git] / sys / boot / i386 / btx / btx / btx.S
1 /*
2  * Copyright (c) 1998 Robert Nordier
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms are freely
6  * permitted provided that the above copyright notice and this
7  * paragraph and the following disclaimer are duplicated in all
8  * such forms.
9  *
10  * This software is provided "AS IS" and without any express or
11  * implied warranties, including, without limitation, the implied
12  * warranties of merchantability and fitness for a particular
13  * purpose.
14  *
15  * $FreeBSD$
16  */
17
18 /*
19  * Memory layout.
20  */
21                 .set MEM_BTX,0x1000             # Start of BTX memory
22                 .set MEM_ESP0,0x1800            # Supervisor stack
23                 .set MEM_BUF,0x1800             # Scratch buffer
24                 .set MEM_ESPR,0x5e00            # Real mode stack
25                 .set MEM_IDT,0x5e00             # IDT
26                 .set MEM_TSS,0x5f98             # TSS
27                 .set MEM_MAP,0x6000             # I/O bit map
28                 .set MEM_TSS_END,0x7fff         # End of TSS
29                 .set MEM_ORG,0x9000             # BTX code
30                 .set MEM_USR,0xa000             # Start of user memory
31 /*
32  * Paging control.
33  */
34                 .set PAG_SIZ,0x1000             # Page size
35                 .set PAG_CNT,0x1000             # Pages to map
36 /*
37  * Fields in %eflags.
38  */
39                 .set PSL_RESERVED_DEFAULT,0x00000002
40                 .set PSL_T,0x00000100           # Trap flag
41                 .set PSL_I,0x00000200           # Interrupt enable flag
42                 .set PSL_VM,0x00020000          # Virtual 8086 mode flag
43                 .set PSL_AC,0x00040000          # Alignment check flag
44 /*
45  * Segment selectors.
46  */
47                 .set SEL_SCODE,0x8              # Supervisor code
48                 .set SEL_SDATA,0x10             # Supervisor data
49                 .set SEL_RCODE,0x18             # Real mode code
50                 .set SEL_RDATA,0x20             # Real mode data
51                 .set SEL_UCODE,0x28|3           # User code
52                 .set SEL_UDATA,0x30|3           # User data
53                 .set SEL_TSS,0x38               # TSS
54 /*
55  * Task state segment fields.
56  */
57                 .set TSS_ESP0,0x4               # PL 0 ESP
58                 .set TSS_SS0,0x8                # PL 0 SS
59                 .set TSS_MAP,0x66               # I/O bit map base
60 /*
61  * System calls.
62  */
63                 .set SYS_EXIT,0x0               # Exit
64                 .set SYS_EXEC,0x1               # Exec
65 /*
66  * Fields in V86 interface structure.
67  */
68                 .set V86_CTL,0x0                # Control flags
69                 .set V86_ADDR,0x4               # Int number/address
70                 .set V86_ES,0x8                 # V86 ES
71                 .set V86_DS,0xc                 # V86 DS
72                 .set V86_FS,0x10                # V86 FS
73                 .set V86_GS,0x14                # V86 GS
74 /*
75  * V86 control flags.
76  */
77                 .set V86F_ADDR,0x10000          # Segment:offset address
78                 .set V86F_CALLF,0x20000         # Emulate far call
79                 .set V86F_FLAGS,0x40000         # Return flags
80 /*
81  * Dump format control bytes.
82  */
83                 .set DMP_X16,0x1                # Word
84                 .set DMP_X32,0x2                # Long
85                 .set DMP_MEM,0x4                # Memory
86                 .set DMP_EOL,0x8                # End of line
87 /*
88  * Screen defaults and assumptions.
89  */
90                 .set SCR_MAT,0x7                # Mode/attribute
91                 .set SCR_COL,0x50               # Columns per row
92                 .set SCR_ROW,0x19               # Rows per screen
93 /*
94  * BIOS Data Area locations.
95  */
96                 .set BDA_MEM,0x413              # Free memory
97                 .set BDA_SCR,0x449              # Video mode
98                 .set BDA_POS,0x450              # Cursor position
99                 .set BDA_BOOT,0x472             # Boot howto flag
100 /*
101  * Derivations, for brevity.
102  */
103                 .set _ESP0H,MEM_ESP0>>0x8       # Byte 1 of ESP0
104                 .set _TSSIO,MEM_MAP-MEM_TSS     # TSS I/O base
105                 .set _TSSLM,MEM_TSS_END-MEM_TSS # TSS limit
106                 .set _IDTLM,MEM_TSS-MEM_IDT-1   # IDT limit
107 /*
108  * Code segment.
109  */
110                 .globl start
111                 .code16
112 start:                                          # Start of code
113 /*
114  * BTX header.
115  */
116 btx_hdr:        .byte 0xeb                      # Machine ID
117                 .byte 0xe                       # Header size
118                 .ascii "BTX"                    # Magic
119                 .byte 0x1                       # Major version
120                 .byte 0x2                       # Minor version
121                 .byte BTX_FLAGS                 # Flags
122                 .word PAG_CNT-MEM_ORG>>0xc      # Paging control
123                 .word break-start               # Text size
124                 .long 0x0                       # Entry address
125 /*
126  * Initialization routine.
127  */
128 init:           cli                             # Disable interrupts
129                 xor %ax,%ax                     # Zero/segment
130                 mov %ax,%ss                     # Set up
131                 mov $MEM_ESP0,%sp               #  stack
132                 mov %ax,%es                     # Address
133                 mov %ax,%ds                     #  data
134                 pushl $0x2                      # Clear
135                 popfl                           #  flags
136 /*
137  * Initialize memory.
138  */
139                 mov $MEM_IDT,%di                # Memory to initialize
140                 mov $(MEM_ORG-MEM_IDT)/2,%cx    # Words to zero
141                 rep                             # Zero-fill
142                 stosw                           #  memory
143 /*
144  * Update real mode IDT for reflecting hardware interrupts.
145  */
146                 mov $intr20,%bx                 # Address first handler
147                 mov $0x10,%cx                   # Number of handlers
148                 mov $0x20*4,%di                 # First real mode IDT entry
149 init.0:         mov %bx,(%di)                   # Store IP
150                 inc %di                         # Address next
151                 inc %di                         #  entry
152                 stosw                           # Store CS
153                 add $4,%bx                      # Next handler
154                 loop init.0                     # Next IRQ
155 /*
156  * Create IDT.
157  */
158                 mov $MEM_IDT,%di
159                 mov $idtctl,%si                 # Control string
160 init.1:         lodsb                           # Get entry
161                 cbw                             #  count
162                 xchg %ax,%cx                    #  as word
163                 jcxz init.4                     # If done
164                 lodsb                           # Get segment
165                 xchg %ax,%dx                    #  P:DPL:type
166                 lodsw                           # Get control
167                 xchg %ax,%bx                    #  set
168                 lodsw                           # Get handler offset
169                 mov $SEL_SCODE,%dh              # Segment selector
170 init.2:         shr %bx                         # Handle this int?
171                 jnc init.3                      # No
172                 mov %ax,(%di)                   # Set handler offset
173                 mov %dh,0x2(%di)                #  and selector
174                 mov %dl,0x5(%di)                # Set P:DPL:type
175                 add $0x4,%ax                    # Next handler
176 init.3:         lea 0x8(%di),%di                # Next entry
177                 loop init.2                     # Till set done
178                 jmp init.1                      # Continue
179 /*
180  * Initialize TSS.
181  */
182 init.4:         movb $_ESP0H,TSS_ESP0+1(%di)    # Set ESP0
183                 movb $SEL_SDATA,TSS_SS0(%di)    # Set SS0
184                 movb $_TSSIO,TSS_MAP(%di)       # Set I/O bit map base
185 /*
186  * Bring up the system.
187  */
188                 mov $0x2820,%bx                 # Set protected mode
189                 callw setpic                    #  IRQ offsets
190                 lidt idtdesc                    # Set IDT
191                 lgdt gdtdesc                    # Set GDT
192                 mov %cr0,%eax                   # Switch to protected
193                 inc %ax                         #  mode
194                 mov %eax,%cr0                   #
195                 ljmp $SEL_SCODE,$init.8         # To 32-bit code
196                 .code32
197 init.8:         xorl %ecx,%ecx                  # Zero
198                 movb $SEL_SDATA,%cl             # To 32-bit
199                 movw %cx,%ss                    #  stack
200 /*
201  * Launch user task.
202  */
203                 movb $SEL_TSS,%cl               # Set task
204                 ltr %cx                         #  register
205                 movl $MEM_USR,%edx              # User base address
206                 movzwl %ss:BDA_MEM,%eax         # Get free memory
207                 shll $0xa,%eax                  # To bytes
208                 subl $0x1000,%eax               # Less arg space
209                 subl %edx,%eax                  # Less base
210                 movb $SEL_UDATA,%cl             # User data selector
211                 pushl %ecx                      # Set SS
212                 pushl %eax                      # Set ESP
213                 push $0x202                     # Set flags (IF set)
214                 push $SEL_UCODE                 # Set CS
215                 pushl btx_hdr+0xc               # Set EIP
216                 pushl %ecx                      # Set GS
217                 pushl %ecx                      # Set FS
218                 pushl %ecx                      # Set DS
219                 pushl %ecx                      # Set ES
220                 pushl %edx                      # Set EAX
221                 movb $0x7,%cl                   # Set remaining
222 init.9:         push $0x0                       #  general
223                 loop init.9                     #  registers
224 #ifdef BTX_SERIAL
225                 call sio_init                   # setup the serial console
226 #endif
227                 popa                            #  and initialize
228                 popl %es                        # Initialize
229                 popl %ds                        #  user
230                 popl %fs                        #  segment
231                 popl %gs                        #  registers
232                 iret                            # To user mode
233 /*
234  * Exit routine.
235  */
236 exit:           cli                             # Disable interrupts
237                 movl $MEM_ESP0,%esp             # Clear stack
238 /*
239  * Turn off paging.
240  */
241                 movl %cr0,%eax                  # Get CR0
242                 andl $~0x80000000,%eax          # Disable
243                 movl %eax,%cr0                  #  paging
244                 xorl %ecx,%ecx                  # Zero
245                 movl %ecx,%cr3                  # Flush TLB
246 /*
247  * Restore the GDT in case we caught a kernel trap.
248  */
249                 lgdt gdtdesc                    # Set GDT
250 /*
251  * To 16 bits.
252  */
253                 ljmpw $SEL_RCODE,$exit.1        # Reload CS
254                 .code16
255 exit.1:         mov $SEL_RDATA,%cl              # 16-bit selector
256                 mov %cx,%ss                     # Reload SS
257                 mov %cx,%ds                     # Load
258                 mov %cx,%es                     #  remaining
259                 mov %cx,%fs                     #  segment
260                 mov %cx,%gs                     #  registers
261 /*
262  * To real-address mode.
263  */
264                 dec %ax                         # Switch to
265                 mov %eax,%cr0                   #  real mode
266                 ljmp $0x0,$exit.2               # Reload CS
267 exit.2:         xor %ax,%ax                     # Real mode segment
268                 mov %ax,%ss                     # Reload SS
269                 mov %ax,%ds                     # Address data
270                 mov $0x7008,%bx                 # Set real mode
271                 callw setpic                    #  IRQ offsets
272                 lidt ivtdesc                    # Set IVT
273 /*
274  * Reboot or await reset.
275  */
276                 sti                             # Enable interrupts
277                 testb $0x1,btx_hdr+0x7          # Reboot?
278 exit.3:         jz exit.3                       # No
279                 movw $0x1234, BDA_BOOT          # Do a warm boot
280                 ljmp $0xf000,$0xfff0            # reboot the machine
281 /*
282  * Set IRQ offsets by reprogramming 8259A PICs.
283  */
284 setpic:         in $0x21,%al                    # Save master
285                 push %ax                        #  IMR
286                 in $0xa1,%al                    # Save slave
287                 push %ax                        #  IMR
288                 movb $0x11,%al                  # ICW1 to
289                 outb %al,$0x20                  #  master,
290                 outb %al,$0xa0                  #  slave
291                 movb %bl,%al                    # ICW2 to
292                 outb %al,$0x21                  #  master
293                 movb %bh,%al                    # ICW2 to
294                 outb %al,$0xa1                  #  slave
295                 movb $0x4,%al                   # ICW3 to
296                 outb %al,$0x21                  #  master
297                 movb $0x2,%al                   # ICW3 to
298                 outb %al,$0xa1                  #  slave
299                 movb $0x1,%al                   # ICW4 to
300                 outb %al,$0x21                  #  master,
301                 outb %al,$0xa1                  #  slave
302                 pop %ax                         # Restore slave
303                 outb %al,$0xa1                  #  IMR
304                 pop %ax                         # Restore master
305                 outb %al,$0x21                  #  IMR
306                 retw                            # To caller
307                 .code32
308 /*
309  * Exception jump table.
310  */
311 intx00:         push $0x0                       # Int 0x0: #DE
312                 jmp ex_noc                      # Divide error
313                 push $0x1                       # Int 0x1: #DB
314                 jmp ex_noc                      # Debug
315                 push $0x3                       # Int 0x3: #BP
316                 jmp ex_noc                      # Breakpoint
317                 push $0x4                       # Int 0x4: #OF
318                 jmp ex_noc                      # Overflow
319                 push $0x5                       # Int 0x5: #BR
320                 jmp ex_noc                      # BOUND range exceeded
321                 push $0x6                       # Int 0x6: #UD
322                 jmp ex_noc                      # Invalid opcode
323                 push $0x7                       # Int 0x7: #NM
324                 jmp ex_noc                      # Device not available
325                 push $0x8                       # Int 0x8: #DF
326                 jmp except                      # Double fault
327                 push $0xa                       # Int 0xa: #TS
328                 jmp except                      # Invalid TSS
329                 push $0xb                       # Int 0xb: #NP
330                 jmp except                      # Segment not present
331                 push $0xc                       # Int 0xc: #SS
332                 jmp except                      # Stack segment fault
333                 push $0xd                       # Int 0xd: #GP
334                 jmp except                      # General protection
335                 push $0xe                       # Int 0xe: #PF
336                 jmp except                      # Page fault
337 intx10:         push $0x10                      # Int 0x10: #MF
338                 jmp ex_noc                      # Floating-point error
339 /*
340  * Save a zero error code.
341  */
342 ex_noc:         pushl (%esp,1)                  # Duplicate int no
343                 movb $0x0,0x4(%esp,1)           # Fake error code
344 /*
345  * Handle exception.
346  */
347 except:         cld                             # String ops inc
348                 pushl %ds                       # Save
349                 pushl %es                       #  most
350                 pusha                           #  registers
351                 pushl %gs                       # Set GS
352                 pushl %fs                       # Set FS
353                 pushl %ds                       # Set DS
354                 pushl %es                       # Set ES
355                 cmpw $SEL_SCODE,0x44(%esp,1)    # Supervisor mode?
356                 jne except.1                    # No
357                 pushl %ss                       # Set SS
358                 jmp except.2                    # Join common code
359 except.1:       pushl 0x50(%esp,1)              # Set SS
360 except.2:       pushl 0x50(%esp,1)              # Set ESP
361                 push $SEL_SDATA                 # Set up
362                 popl %ds                        #  to
363                 pushl %ds                       #  address
364                 popl %es                        #  data
365                 movl %esp,%ebx                  # Stack frame
366                 movl $dmpfmt,%esi               # Dump format string
367                 movl $MEM_BUF,%edi              # Buffer
368                 pushl %edi                      # Dump to
369                 call dump                       #  buffer
370                 popl %esi                       #  and
371                 call putstr                     #  display
372                 leal 0x18(%esp,1),%esp          # Discard frame
373                 popa                            # Restore
374                 popl %es                        #  registers
375                 popl %ds                        #  saved
376                 cmpb $0x3,(%esp,1)              # Breakpoint?
377                 je except.3                     # Yes
378                 cmpb $0x1,(%esp,1)              # Debug?
379                 jne except.2a                   # No
380                 testl $PSL_T,0x10(%esp,1)       # Trap flag set?
381                 jnz except.3                    # Yes
382 except.2a:      jmp exit                        # Exit
383 except.3:       leal 0x8(%esp,1),%esp           # Discard err, int no
384                 iret                            # From interrupt
385
386 /*
387  * Reboot the machine by setting the reboot flag and exiting
388  */
389 reboot:         orb $0x1,btx_hdr+0x7            # Set the reboot flag
390                 jmp exit                        # Terminate BTX and reboot
391
392 /*
393  * Protected Mode Hardware interrupt jump table.
394  */
395 intx20:         push $0x8                       # Int 0x20: IRQ0
396                 jmp int_hw                      # V86 int 0x8
397                 push $0x9                       # Int 0x21: IRQ1
398                 jmp int_hw                      # V86 int 0x9
399                 push $0xa                       # Int 0x22: IRQ2
400                 jmp int_hw                      # V86 int 0xa
401                 push $0xb                       # Int 0x23: IRQ3
402                 jmp int_hw                      # V86 int 0xb
403                 push $0xc                       # Int 0x24: IRQ4
404                 jmp int_hw                      # V86 int 0xc
405                 push $0xd                       # Int 0x25: IRQ5
406                 jmp int_hw                      # V86 int 0xd
407                 push $0xe                       # Int 0x26: IRQ6
408                 jmp int_hw                      # V86 int 0xe
409                 push $0xf                       # Int 0x27: IRQ7
410                 jmp int_hw                      # V86 int 0xf
411                 push $0x70                      # Int 0x28: IRQ8
412                 jmp int_hw                      # V86 int 0x70
413                 push $0x71                      # Int 0x29: IRQ9
414                 jmp int_hw                      # V86 int 0x71
415                 push $0x72                      # Int 0x2a: IRQ10
416                 jmp int_hw                      # V86 int 0x72
417                 push $0x73                      # Int 0x2b: IRQ11
418                 jmp int_hw                      # V86 int 0x73
419                 push $0x74                      # Int 0x2c: IRQ12
420                 jmp int_hw                      # V86 int 0x74
421                 push $0x75                      # Int 0x2d: IRQ13
422                 jmp int_hw                      # V86 int 0x75
423                 push $0x76                      # Int 0x2e: IRQ14
424                 jmp int_hw                      # V86 int 0x76
425                 push $0x77                      # Int 0x2f: IRQ15
426                 jmp int_hw                      # V86 int 0x77
427
428 /*
429  * Invoke real mode interrupt/function call from user mode with arguments.
430  */
431 intx31:         pushl $-1                       # Dummy int no for btx_v86
432 /*
433  * Invoke real mode interrupt/function call from protected mode.
434  *
435  * We place a trampoline on the user stack that will return to rret_tramp
436  * which will reenter protected mode and then finally return to the user
437  * client.
438  *
439  * Kernel frame %esi points to:         Real mode stack frame at MEM_ESPR:
440  *
441  * -0x00 user %ss                       -0x04 kernel %esp (with full frame)
442  * -0x04 user %esp                      -0x08 btx_v86 pointer
443  * -0x08 user %eflags                   -0x0c flags (only used if interrupt)
444  * -0x0c user %cs                       -0x10 real mode CS:IP return trampoline
445  * -0x10 user %eip                      -0x12 real mode flags
446  * -0x14 int no                         -0x16 real mode CS:IP (target)
447  * -0x18 %eax
448  * -0x1c %ecx
449  * -0x20 %edx
450  * -0x24 %ebx
451  * -0x28 %esp
452  * -0x2c %ebp
453  * -0x30 %esi
454  * -0x34 %edi
455  * -0x38 %gs
456  * -0x3c %fs
457  * -0x40 %ds
458  * -0x44 %es
459  * -0x48 zero %eax (hardware int only)  
460  * -0x4c zero %ecx (hardware int only)
461  * -0x50 zero %edx (hardware int only)
462  * -0x54 zero %ebx (hardware int only)
463  * -0x58 zero %esp (hardware int only)
464  * -0x5c zero %ebp (hardware int only)
465  * -0x60 zero %esi (hardware int only)
466  * -0x64 zero %edi (hardware int only)
467  * -0x68 zero %gs (hardware int only)
468  * -0x6c zero %fs (hardware int only)
469  * -0x70 zero %ds (hardware int only)
470  * -0x74 zero %es (hardware int only)
471  */
472 int_hw:         cld                             # String ops inc
473                 pusha                           # Save gp regs
474                 pushl %gs                       # Save
475                 pushl %fs                       #  seg
476                 pushl %ds                       #  regs
477                 pushl %es
478                 push $SEL_SDATA                 # Set up
479                 popl %ds                        #  to
480                 pushl %ds                       #  address
481                 popl %es                        #  data
482                 leal 0x44(%esp,1),%esi          # Base of frame
483                 movl %esp,MEM_ESPR-0x04         # Save kernel stack pointer
484                 movl -0x14(%esi),%eax           # Get Int no
485                 cmpl $-1,%eax                   # Hardware interrupt?
486                 jne intusr.1                    # Yes
487 /*
488  * v86 calls save the btx_v86 pointer on the real mode stack and read
489  * the address and flags from the btx_v86 structure.  For interrupt
490  * handler invocations (VM86 INTx requests), disable interrupts,
491  * tracing, and alignment checking while the handler runs.
492  */
493                 movl $MEM_USR,%ebx              # User base
494                 movl %ebx,%edx                  #  address
495                 addl -0x4(%esi),%ebx            # User ESP
496                 movl (%ebx),%ebp                # btx_v86 pointer
497                 addl %ebp,%edx                  # Flatten btx_v86 ptr
498                 movl %edx,MEM_ESPR-0x08         # Save btx_v86 ptr
499                 movl V86_ADDR(%edx),%eax        # Get int no/address
500                 movl V86_CTL(%edx),%edx         # Get control flags
501                 movl -0x08(%esi),%ebx           # Save user flags in %ebx
502                 testl $V86F_ADDR,%edx           # Segment:offset?
503                 jnz intusr.4                    # Yes
504                 andl $~(PSL_I|PSL_T|PSL_AC),%ebx # Disable interrupts, tracing,
505                                                 #  and alignment checking for
506                                                 #  interrupt handler
507                 jmp intusr.3                    # Skip hardware interrupt
508 /*
509  * Hardware interrupts store a NULL btx_v86 pointer and use the
510  * address (interrupt number) from the stack with empty flags.  Also,
511  * push a dummy frame of zeros onto the stack for all the general
512  * purpose and segment registers and clear %eflags.  This gives the
513  * hardware interrupt handler a clean slate.
514  */
515 intusr.1:       xorl %edx,%edx                  # Control flags
516                 movl %edx,MEM_ESPR-0x08         # NULL btx_v86 ptr
517                 movl $12,%ecx                   # Frame is 12 dwords
518 intusr.2:       pushl $0x0                      # Fill frame
519                 loop intusr.2                   #  with zeros
520                 movl $PSL_RESERVED_DEFAULT,%ebx # Set clean %eflags
521 /*
522  * Look up real mode IDT entry for hardware interrupts and VM86 INTx
523  * requests.
524  */
525 intusr.3:       shll $0x2,%eax                  # Scale
526                 movl (%eax),%eax                # Load int vector
527                 jmp intusr.5                    # Skip CALLF test
528 /*
529  * Panic if V86F_CALLF isn't set with V86F_ADDR.
530  */
531 intusr.4:       testl $V86F_CALLF,%edx          # Far call?
532                 jnz intusr.5                    # Ok
533                 movl %edx,0x30(%esp,1)          # Place VM86 flags in int no
534                 movl $badvm86,%esi              # Display bad
535                 call putstr                     #  VM86 call
536                 popl %es                        # Restore
537                 popl %ds                        #  seg
538                 popl %fs                        #  regs
539                 popl %gs
540                 popal                           # Restore gp regs
541                 jmp ex_noc                      # Panic
542 /*
543  * %eax now holds the segment:offset of the function.
544  * %ebx now holds the %eflags to pass to real mode.
545  * %edx now holds the V86F_* flags.
546  */
547 intusr.5:       movw %bx,MEM_ESPR-0x12          # Pass user flags to real mode
548                                                 #  target
549 /*
550  * If this is a v86 call, copy the seg regs out of the btx_v86 structure.
551  */
552                 movl MEM_ESPR-0x08,%ecx         # Get btx_v86 ptr
553                 jecxz intusr.6                  # Skip for hardware ints
554                 leal -0x44(%esi),%edi           # %edi => kernel stack seg regs
555                 pushl %esi                      # Save
556                 leal V86_ES(%ecx),%esi          # %esi => btx_v86 seg regs
557                 movl $4,%ecx                    # Copy seg regs
558                 rep                             #  from btx_v86
559                 movsl                           #  to kernel stack
560                 popl %esi                       # Restore
561 intusr.6:       movl -0x08(%esi),%ebx           # Copy user flags to real
562                 movl %ebx,MEM_ESPR-0x0c         #  mode return trampoline
563                 movl $rret_tramp,%ebx           # Set return trampoline
564                 movl %ebx,MEM_ESPR-0x10         #  CS:IP
565                 movl %eax,MEM_ESPR-0x16         # Real mode target CS:IP
566                 ljmpw $SEL_RCODE,$intusr.7      # Change to 16-bit segment
567                 .code16
568 intusr.7:       movl %cr0,%eax                  # Leave
569                 dec %al                         #  protected
570                 movl %eax,%cr0                  #  mode
571                 ljmpw $0x0,$intusr.8
572 intusr.8:       xorw %ax,%ax                    # Reset %ds
573                 movw %ax,%ds                    #  and
574                 movw %ax,%ss                    #  %ss
575                 lidt ivtdesc                    # Set IVT
576                 popl %es                        # Restore
577                 popl %ds                        #  seg
578                 popl %fs                        #  regs
579                 popl %gs
580                 popal                           # Restore gp regs
581                 movw $MEM_ESPR-0x16,%sp         # Switch to real mode stack
582                 iret                            # Call target routine
583 /*
584  * For the return to real mode we setup a stack frame like this on the real
585  * mode stack.  Note that callf calls won't pop off the flags, but we just
586  * ignore that by repositioning %sp to be just above the btx_v86 pointer
587  * so it is aligned.  The stack is relative to MEM_ESPR.
588  *
589  * -0x04        kernel %esp
590  * -0x08        btx_v86
591  * -0x0c        %eax
592  * -0x10        %ecx
593  * -0x14        %edx
594  * -0x18        %ebx
595  * -0x1c        %esp
596  * -0x20        %ebp
597  * -0x24        %esi
598  * -0x28        %edi
599  * -0x2c        %gs
600  * -0x30        %fs
601  * -0x34        %ds
602  * -0x38        %es
603  * -0x3c        %eflags
604  */
605 rret_tramp:     movw $MEM_ESPR-0x08,%sp         # Reset stack pointer
606                 pushal                          # Save gp regs
607                 pushl %gs                       # Save
608                 pushl %fs                       #  seg
609                 pushl %ds                       #  regs
610                 pushl %es
611                 pushfl                          # Save %eflags
612                 cli                             # Disable interrupts
613                 std                             # String ops dec
614                 xorw %ax,%ax                    # Reset seg 
615                 movw %ax,%ds                    #  regs
616                 movw %ax,%es                    #  (%ss is already 0)
617                 lidt idtdesc                    # Set IDT
618                 lgdt gdtdesc                    # Set GDT
619                 mov %cr0,%eax                   # Switch to protected
620                 inc %ax                         #  mode
621                 mov %eax,%cr0                   #
622                 ljmp $SEL_SCODE,$rret_tramp.1   # To 32-bit code
623                 .code32
624 rret_tramp.1:   xorl %ecx,%ecx                  # Zero
625                 movb $SEL_SDATA,%cl             # Setup
626                 movw %cx,%ss                    #  32-bit
627                 movw %cx,%ds                    #  seg
628                 movw %cx,%es                    #  regs
629                 movl MEM_ESPR-0x04,%esp         # Switch to kernel stack
630                 leal 0x44(%esp,1),%esi          # Base of frame
631                 andb $~0x2,tss_desc+0x5         # Clear TSS busy
632                 movb $SEL_TSS,%cl               # Set task
633                 ltr %cx                         #  register
634 /*
635  * Now we are back in protected mode.  The kernel stack frame set up
636  * before entering real mode is still intact. For hardware interrupts,
637  * leave the frame unchanged.
638  */
639                 cmpl $0,MEM_ESPR-0x08           # Leave saved regs unchanged
640                 jz rret_tramp.3                 #  for hardware ints
641 /*
642  * For V86 calls, copy the registers off of the real mode stack onto
643  * the kernel stack as we want their updated values.  Also, initialize
644  * the segment registers on the kernel stack.
645  *
646  * Note that the %esp in the kernel stack after this is garbage, but popa
647  * ignores it, so we don't have to fix it up.
648  */
649                 leal -0x18(%esi),%edi           # Kernel stack GP regs
650                 pushl %esi                      # Save
651                 movl $MEM_ESPR-0x0c,%esi        # Real mode stack GP regs
652                 movl $8,%ecx                    # Copy GP regs from
653                 rep                             #  real mode stack
654                 movsl                           #  to kernel stack
655                 movl $SEL_UDATA,%eax            # Selector for data seg regs
656                 movl $4,%ecx                    # Initialize %ds,
657                 rep                             #  %es, %fs, and
658                 stosl                           #  %gs
659 /*
660  * For V86 calls, copy the saved seg regs on the real mode stack back
661  * over to the btx_v86 structure.  Also, conditionally update the
662  * saved eflags on the kernel stack based on the flags from the user.
663  */
664                 movl MEM_ESPR-0x08,%ecx         # Get btx_v86 ptr
665                 leal V86_GS(%ecx),%edi          # %edi => btx_v86 seg regs
666                 leal MEM_ESPR-0x2c,%esi         # %esi => real mode seg regs
667                 xchgl %ecx,%edx                 # Save btx_v86 ptr
668                 movl $4,%ecx                    # Copy seg regs
669                 rep                             #  from real mode stack
670                 movsl                           #  to btx_v86
671                 popl %esi                       # Restore
672                 movl V86_CTL(%edx),%edx         # Read V86 control flags
673                 testl $V86F_FLAGS,%edx          # User wants flags?
674                 jz rret_tramp.3                 # No
675                 movl MEM_ESPR-0x3c,%eax         # Read real mode flags
676                 movw %ax,-0x08(%esi)            # Update user flags (low 16)
677 /*
678  * Return to the user task
679  */
680 rret_tramp.3:   popl %es                        # Restore
681                 popl %ds                        #  seg
682                 popl %fs                        #  regs
683                 popl %gs
684                 popal                           # Restore gp regs
685                 addl $4,%esp                    # Discard int no
686                 iret                            # Return to user mode
687
688 /*
689  * System Call.
690  */
691 intx30:         cmpl $SYS_EXEC,%eax             # Exec system call?
692                 jne intx30.1                    # No
693                 pushl %ss                       # Set up
694                 popl %es                        #  all
695                 pushl %es                       #  segment
696                 popl %ds                        #  registers
697                 pushl %ds                       #  for the
698                 popl %fs                        #  program
699                 pushl %fs                       #  we're
700                 popl %gs                        #  invoking
701                 movl $MEM_USR,%eax              # User base address
702                 addl 0xc(%esp,1),%eax           # Change to user
703                 leal 0x4(%eax),%esp             #  stack
704                 popl %eax                       # Call
705                 call *%eax                      #  program
706 intx30.1:       orb $0x1,%ss:btx_hdr+0x7        # Flag reboot
707                 jmp exit                        # Exit
708 /*
709  * Dump structure [EBX] to [EDI], using format string [ESI].
710  */
711 dump.0:         stosb                           # Save char
712 dump:           lodsb                           # Load char
713                 testb %al,%al                   # End of string?
714                 jz dump.10                      # Yes
715                 testb $0x80,%al                 # Control?
716                 jz dump.0                       # No
717                 movb %al,%ch                    # Save control
718                 movb $'=',%al                   # Append
719                 stosb                           #  '='
720                 lodsb                           # Get offset
721                 pushl %esi                      # Save
722                 movsbl %al,%esi                 # To
723                 addl %ebx,%esi                  #  pointer
724                 testb $DMP_X16,%ch              # Dump word?
725                 jz dump.1                       # No
726                 lodsw                           # Get and
727                 call hex16                      #  dump it
728 dump.1:         testb $DMP_X32,%ch              # Dump long?
729                 jz dump.2                       # No
730                 lodsl                           # Get and
731                 call hex32                      #  dump it
732 dump.2:         testb $DMP_MEM,%ch              # Dump memory?
733                 jz dump.8                       # No
734                 pushl %ds                       # Save
735                 testl $PSL_VM,0x50(%ebx)        # V86 mode?
736                 jnz dump.3                      # Yes
737                 verr 0x4(%esi)                  # Readable selector?
738                 jnz dump.3                      # No
739                 ldsl (%esi),%esi                # Load pointer
740                 jmp dump.4                      # Join common code
741 dump.3:         lodsl                           # Set offset
742                 xchgl %eax,%edx                 # Save
743                 lodsl                           # Get segment
744                 shll $0x4,%eax                  #  * 0x10
745                 addl %edx,%eax                  #  + offset
746                 xchgl %eax,%esi                 # Set pointer
747 dump.4:         movb $2,%dl                     # Num lines
748 dump.4a:        movb $0x10,%cl                  # Bytes to dump
749 dump.5:         lodsb                           # Get byte and
750                 call hex8                       #  dump it
751                 decb %cl                        # Keep count
752                 jz dump.6a                      # If done
753                 movb $'-',%al                   # Separator
754                 cmpb $0x8,%cl                   # Half way?
755                 je dump.6                       # Yes
756                 movb $' ',%al                   # Use space
757 dump.6:         stosb                           # Save separator
758                 jmp dump.5                      # Continue
759 dump.6a:        decb %dl                        # Keep count
760                 jz dump.7                       # If done
761                 movb $0xa,%al                   # Line feed
762                 stosb                           # Save one
763                 movb $7,%cl                     # Leading
764                 movb $' ',%al                   #  spaces
765 dump.6b:        stosb                           # Dump
766                 decb %cl                        #  spaces
767                 jnz dump.6b
768                 jmp dump.4a                     # Next line
769 dump.7:         popl %ds                        # Restore
770 dump.8:         popl %esi                       # Restore
771                 movb $0xa,%al                   # Line feed
772                 testb $DMP_EOL,%ch              # End of line?
773                 jnz dump.9                      # Yes
774                 movb $' ',%al                   # Use spaces
775                 stosb                           # Save one
776 dump.9:         jmp dump.0                      # Continue
777 dump.10:        stosb                           # Terminate string
778                 ret                             # To caller
779 /*
780  * Convert EAX, AX, or AL to hex, saving the result to [EDI].
781  */
782 hex32:          pushl %eax                      # Save
783                 shrl $0x10,%eax                 # Do upper
784                 call hex16                      #  16
785                 popl %eax                       # Restore
786 hex16:          call hex16.1                    # Do upper 8
787 hex16.1:        xchgb %ah,%al                   # Save/restore
788 hex8:           pushl %eax                      # Save
789                 shrb $0x4,%al                   # Do upper
790                 call hex8.1                     #  4
791                 popl %eax                       # Restore
792 hex8.1:         andb $0xf,%al                   # Get lower 4
793                 cmpb $0xa,%al                   # Convert
794                 sbbb $0x69,%al                  #  to hex
795                 das                             #  digit
796                 orb $0x20,%al                   # To lower case
797                 stosb                           # Save char
798                 ret                             # (Recursive)
799 /*
800  * Output zero-terminated string [ESI] to the console.
801  */
802 putstr.0:       call putchr                     # Output char
803 putstr:         lodsb                           # Load char
804                 testb %al,%al                   # End of string?
805                 jnz putstr.0                    # No
806                 ret                             # To caller
807 #ifdef BTX_SERIAL
808                 .set SIO_PRT,SIOPRT             # Base port
809                 .set SIO_FMT,SIOFMT             # 8N1
810                 .set SIO_DIV,(115200/SIOSPD)    # 115200 / SPD
811
812 /*
813  * void sio_init(void)
814  */
815 sio_init:       movw $SIO_PRT+0x3,%dx           # Data format reg
816                 movb $SIO_FMT|0x80,%al          # Set format
817                 outb %al,(%dx)                  #  and DLAB
818                 pushl %edx                      # Save
819                 subb $0x3,%dl                   # Divisor latch reg
820                 movw $SIO_DIV,%ax               # Set
821                 outw %ax,(%dx)                  #  BPS
822                 popl %edx                       # Restore
823                 movb $SIO_FMT,%al               # Clear
824                 outb %al,(%dx)                  #  DLAB
825                 incl %edx                       # Modem control reg
826                 movb $0x3,%al                   # Set RTS,
827                 outb %al,(%dx)                  #  DTR
828                 incl %edx                       # Line status reg
829
830 /*
831  * void sio_flush(void)
832  */
833 sio_flush.0:    call sio_getc.1                 # Get character
834 sio_flush:      call sio_ischar                 # Check for character
835                 jnz sio_flush.0                 # Till none
836                 ret                             # To caller
837
838 /*
839  * void sio_putc(int c)
840  */
841 sio_putc:       movw $SIO_PRT+0x5,%dx           # Line status reg
842                 xor %ecx,%ecx                   # Timeout
843                 movb $0x40,%ch                  #  counter
844 sio_putc.1:     inb (%dx),%al                   # Transmitter
845                 testb $0x20,%al                 #  buffer empty?
846                 loopz sio_putc.1                # No
847                 jz sio_putc.2                   # If timeout
848                 movb 0x4(%esp,1),%al            # Get character
849                 subb $0x5,%dl                   # Transmitter hold reg
850                 outb %al,(%dx)                  # Write character
851 sio_putc.2:     ret $0x4                        # To caller
852
853 /*
854  * int sio_getc(void)
855  */
856 sio_getc:       call sio_ischar                 # Character available?
857                 jz sio_getc                     # No
858 sio_getc.1:     subb $0x5,%dl                   # Receiver buffer reg
859                 inb (%dx),%al                   # Read character
860                 ret                             # To caller
861
862 /*
863  * int sio_ischar(void)
864  */
865 sio_ischar:     movw $SIO_PRT+0x5,%dx           # Line status register
866                 xorl %eax,%eax                  # Zero
867                 inb (%dx),%al                   # Received data
868                 andb $0x1,%al                   #  ready?
869                 ret                             # To caller
870
871 /*
872  * Output character AL to the serial console.
873  */
874 putchr:         pusha                           # Save
875                 cmpb $10, %al                   # is it a newline?
876                 jne putchr.1                    #  no?, then leave
877                 push $13                        # output a carriage
878                 call sio_putc                   #  return first
879                 movb $10, %al                   # restore %al
880 putchr.1:       pushl %eax                      # Push the character
881                                                 #  onto the stack
882                 call sio_putc                   # Output the character
883                 popa                            # Restore
884                 ret                             # To caller
885 #else
886 /*
887  * Output character AL to the console.
888  */
889 putchr:         pusha                           # Save
890                 xorl %ecx,%ecx                  # Zero for loops
891                 movb $SCR_MAT,%ah               # Mode/attribute
892                 movl $BDA_POS,%ebx              # BDA pointer
893                 movw (%ebx),%dx                 # Cursor position
894                 movl $0xb8000,%edi              # Regen buffer (color)
895                 cmpb %ah,BDA_SCR-BDA_POS(%ebx)  # Mono mode?
896                 jne putchr.1                    # No
897                 xorw %di,%di                    # Regen buffer (mono)
898 putchr.1:       cmpb $0xa,%al                   # New line?
899                 je putchr.2                     # Yes
900                 xchgl %eax,%ecx                 # Save char
901                 movb $SCR_COL,%al               # Columns per row
902                 mulb %dh                        #  * row position
903                 addb %dl,%al                    #  + column
904                 adcb $0x0,%ah                   #  position
905                 shll %eax                       #  * 2
906                 xchgl %eax,%ecx                 # Swap char, offset
907                 movw %ax,(%edi,%ecx,1)          # Write attr:char
908                 incl %edx                       # Bump cursor
909                 cmpb $SCR_COL,%dl               # Beyond row?
910                 jb putchr.3                     # No
911 putchr.2:       xorb %dl,%dl                    # Zero column
912                 incb %dh                        # Bump row
913 putchr.3:       cmpb $SCR_ROW,%dh               # Beyond screen?
914                 jb putchr.4                     # No
915                 leal 2*SCR_COL(%edi),%esi       # New top line
916                 movw $(SCR_ROW-1)*SCR_COL/2,%cx # Words to move
917                 rep                             # Scroll
918                 movsl                           #  screen
919                 movb $0x20,%al                  # Space
920                 movb $SCR_COL,%cl               # Columns to clear
921                 rep                             # Clear
922                 stosw                           #  line
923                 movb $SCR_ROW-1,%dh             # Bottom line
924 putchr.4:       movw %dx,(%ebx)                 # Update position
925                 popa                            # Restore
926                 ret                             # To caller
927 #endif
928
929                 .code16
930 /*
931  * Real Mode Hardware interrupt jump table.
932  */
933 intr20:         push $0x8                       # Int 0x20: IRQ0
934                 jmp int_hwr                     # V86 int 0x8
935                 push $0x9                       # Int 0x21: IRQ1
936                 jmp int_hwr                     # V86 int 0x9
937                 push $0xa                       # Int 0x22: IRQ2
938                 jmp int_hwr                     # V86 int 0xa
939                 push $0xb                       # Int 0x23: IRQ3
940                 jmp int_hwr                     # V86 int 0xb
941                 push $0xc                       # Int 0x24: IRQ4
942                 jmp int_hwr                     # V86 int 0xc
943                 push $0xd                       # Int 0x25: IRQ5
944                 jmp int_hwr                     # V86 int 0xd
945                 push $0xe                       # Int 0x26: IRQ6
946                 jmp int_hwr                     # V86 int 0xe
947                 push $0xf                       # Int 0x27: IRQ7
948                 jmp int_hwr                     # V86 int 0xf
949                 push $0x70                      # Int 0x28: IRQ8
950                 jmp int_hwr                     # V86 int 0x70
951                 push $0x71                      # Int 0x29: IRQ9
952                 jmp int_hwr                     # V86 int 0x71
953                 push $0x72                      # Int 0x2a: IRQ10
954                 jmp int_hwr                     # V86 int 0x72
955                 push $0x73                      # Int 0x2b: IRQ11
956                 jmp int_hwr                     # V86 int 0x73
957                 push $0x74                      # Int 0x2c: IRQ12
958                 jmp int_hwr                     # V86 int 0x74
959                 push $0x75                      # Int 0x2d: IRQ13
960                 jmp int_hwr                     # V86 int 0x75
961                 push $0x76                      # Int 0x2e: IRQ14
962                 jmp int_hwr                     # V86 int 0x76
963                 push $0x77                      # Int 0x2f: IRQ15
964                 jmp int_hwr                     # V86 int 0x77
965 /*
966  * Reflect hardware interrupts in real mode.
967  */
968 int_hwr:        push %ax                        # Save
969                 push %ds                        # Save
970                 push %bp                        # Save
971                 mov %sp,%bp                     # Address stack frame 
972                 xchg %bx,6(%bp)                 # Swap BX, int no
973                 xor %ax,%ax                     # Set %ds:%bx to
974                 shl $2,%bx                      #  point to
975                 mov %ax,%ds                     #  IDT entry
976                 mov (%bx),%ax                   # Load IP
977                 mov 2(%bx),%bx                  # Load CS
978                 xchg %ax,4(%bp)                 # Swap saved %ax,%bx with
979                 xchg %bx,6(%bp)                 #  CS:IP of handler
980                 pop %bp                         # Restore
981                 pop %ds                         # Restore
982                 lret                            # Jump to handler
983
984                 .p2align 4
985 /*
986  * Global descriptor table.
987  */
988 gdt:            .word 0x0,0x0,0x0,0x0           # Null entry
989                 .word 0xffff,0x0,0x9a00,0xcf    # SEL_SCODE
990                 .word 0xffff,0x0,0x9200,0xcf    # SEL_SDATA
991                 .word 0xffff,0x0,0x9a00,0x0     # SEL_RCODE
992                 .word 0xffff,0x0,0x9200,0x0     # SEL_RDATA
993                 .word 0xffff,MEM_USR,0xfa00,0xcf# SEL_UCODE
994                 .word 0xffff,MEM_USR,0xf200,0xcf# SEL_UDATA
995 tss_desc:       .word _TSSLM,MEM_TSS,0x8900,0x0 # SEL_TSS
996 gdt.1:
997 /*
998  * Pseudo-descriptors.
999  */
1000 gdtdesc:        .word gdt.1-gdt-1,gdt,0x0       # GDT
1001 idtdesc:        .word _IDTLM,MEM_IDT,0x0        # IDT
1002 ivtdesc:        .word 0x400-0x0-1,0x0,0x0       # IVT
1003 /*
1004  * IDT construction control string.
1005  */
1006 idtctl:         .byte 0x10,  0x8e               # Int 0x0-0xf
1007                 .word 0x7dfb,intx00             #  (exceptions)
1008                 .byte 0x10,  0x8e               # Int 0x10
1009                 .word 0x1,   intx10             #  (exception)
1010                 .byte 0x10,  0x8e               # Int 0x20-0x2f
1011                 .word 0xffff,intx20             #  (hardware)
1012                 .byte 0x1,   0xee               # int 0x30
1013                 .word 0x1,   intx30             #  (system call)
1014                 .byte 0x2,   0xee               # Int 0x31-0x32
1015                 .word 0x1,   intx31             #  (V86, null)
1016                 .byte 0x0                       # End of string
1017 /*
1018  * Dump format string.
1019  */
1020 dmpfmt:         .byte '\n'                      # "\n"
1021                 .ascii "int"                    # "int="
1022                 .byte 0x80|DMP_X32,        0x40 # "00000000  "
1023                 .ascii "err"                    # "err="
1024                 .byte 0x80|DMP_X32,        0x44 # "00000000  "
1025                 .ascii "efl"                    # "efl="
1026                 .byte 0x80|DMP_X32,        0x50 # "00000000  "
1027                 .ascii "eip"                    # "eip="
1028                 .byte 0x80|DMP_X32|DMP_EOL,0x48 # "00000000\n"
1029                 .ascii "eax"                    # "eax="
1030                 .byte 0x80|DMP_X32,        0x34 # "00000000  "
1031                 .ascii "ebx"                    # "ebx="
1032                 .byte 0x80|DMP_X32,        0x28 # "00000000  "
1033                 .ascii "ecx"                    # "ecx="
1034                 .byte 0x80|DMP_X32,        0x30 # "00000000  "
1035                 .ascii "edx"                    # "edx="
1036                 .byte 0x80|DMP_X32|DMP_EOL,0x2c # "00000000\n"
1037                 .ascii "esi"                    # "esi="
1038                 .byte 0x80|DMP_X32,        0x1c # "00000000  "
1039                 .ascii "edi"                    # "edi="
1040                 .byte 0x80|DMP_X32,        0x18 # "00000000  "
1041                 .ascii "ebp"                    # "ebp="
1042                 .byte 0x80|DMP_X32,        0x20 # "00000000  "
1043                 .ascii "esp"                    # "esp="
1044                 .byte 0x80|DMP_X32|DMP_EOL,0x0  # "00000000\n"
1045                 .ascii "cs"                     # "cs="
1046                 .byte 0x80|DMP_X16,        0x4c # "0000  "
1047                 .ascii "ds"                     # "ds="
1048                 .byte 0x80|DMP_X16,        0xc  # "0000  "
1049                 .ascii "es"                     # "es="
1050                 .byte 0x80|DMP_X16,        0x8  # "0000  "
1051                 .ascii "  "                     # "  "
1052                 .ascii "fs"                     # "fs="
1053                 .byte 0x80|DMP_X16,        0x10 # "0000  "
1054                 .ascii "gs"                     # "gs="
1055                 .byte 0x80|DMP_X16,        0x14 # "0000  "
1056                 .ascii "ss"                     # "ss="
1057                 .byte 0x80|DMP_X16|DMP_EOL,0x4  # "0000\n"
1058                 .ascii "cs:eip"                 # "cs:eip="
1059                 .byte 0x80|DMP_MEM|DMP_EOL,0x48 # "00 00 ... 00 00\n"
1060                 .ascii "ss:esp"                 # "ss:esp="
1061                 .byte 0x80|DMP_MEM|DMP_EOL,0x0  # "00 00 ... 00 00\n"
1062                 .asciz "BTX halted\n"           # End
1063 /*
1064  * Bad VM86 call panic
1065  */
1066 badvm86:        .asciz "Invalid VM86 Request\n"
1067
1068 /*
1069  * End of BTX memory.
1070  */
1071                 .p2align 4
1072 break: