VESA编程示例

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; Simulated Linear Frame Buffer
; Christopher Giese <geezer@execpc.com>
; http://www.execpc.com/~geezer/os/
;
; Updated March 6, 2001: can now return to V86 mode when done
;
; Some stuff (actually, pmode VESA BIOS bank switching) fixed by
; Alexei A. Frounze <alexfru@chat.ru>
; http://alexfru.chat.ru
;
; You can do anything with this code but blame us for it.
;
; To run this code, you need a PC with a 32-bit processor (386SX or better)
; and DOS. This code has been tested with the following SVGA video boards:
;
;      bank-switch function
; buss  chipset   used by this code
; ----  -------   --------------------
; 16-bit ISA Cirrus 5422  Cirrus
; 32-bit PCI S3 86c765 (Trio 64V+) S3
; 32-bit PCI (?) STB Nitro (?)  S3
;
; To assemble this code, you need NASM (http://www.web-sites.co.uk/nasm/)
; nasm -f bin -o slfb.com slfb.asm
;
; bugs/to do:
; - test with other systems
;
; Here is an interesting link:
; http://marc.theaimsgroup.com/?m=88102879813311&w=2
; Also, look at the "vflat" files in the source code to the
; SciTech MGL graphics library
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

LFB_BASE equ 0C0000000h

%if 1
VESA_MODE equ 101h ; 640x480x256
WIDTH  equ 640
HEIGHT  equ 480
%else
VESA_MODE equ 103h ; 800x600x256
WIDTH  equ 800
HEIGHT  equ 600
%endif

SEQN_INDX       equ     3C4h
SEQN_DATA       equ     3C5h
CRTC_INDX       equ     3D4h
CRTC_DATA       equ     3D5h
GRFX_INDX       equ     3CEh
GRFX_DATA       equ     3CFh

 BITS 16
 ORG 100h

; save CS value for return to real mode
 mov [real_mode_cs],cs

; there is no foolproof way to ID an Intel CPU, but we'll try.
; If we are in V86 mode, the VMM may interfere with our attempts
; to change the IOPL and NT bits
 pushf
  pushf
  pop ax
  xor ah,07h ; try changing b14 (NT) and b13:b12
  push ax  ; (IOPL) of FLAGS
  popf
  pushf
  pop bx
 popf   ; restore old FLAGS value
 cmp ah,bh
 je is_32bit
 mov si,not_32bit_msg
 jmp msg_and_exit

not_32bit_msg:
 db "Sorry; this code requires a 32-bit CPU (386SX or better)."
 db 13, 10, 0

is_32bit:
; check for supported video card. First, look for VESA 2.x BIOS
 call probe_vesa
 je vid_ok

; no VESA 2.x BIOS; try direct hardware probing for Cirrus 5422
 call probe_cirrus
 je vid_ok

; not Cirrus; try probing for S3
 call probe_s3
 je vid_ok
 mov si,sorry_msg
 jmp msg_and_exit

sorry_msg:
 db 13, 10, "Sorry, no supported video card was found.", 13, 10, 0

ok_msg:
 db "DETECTED", 13, 10, 0

vid_ok:
 mov si,ok_msg
 call wrstr

; our pmode code will use the stack DOS gave us, but we have
; to zero the top 16 bits of the stack pointer (ESP)
 xor eax,eax
 mov ax,sp
 mov esp,eax

; get the virtual-to-physical conversion value. Though we turn on paging,
; this code runs in memory that is identity-mapped (i.e. no page-based
; address translation). We do, however, use segment-based address
; translation, to give things the same addresses in both real and pmode.
 xor ebx,ebx
 mov bx,cs
 shl ebx,4

; set base addresses of the 16- and 32-bit code segment descriptors
 mov eax,ebx
 mov [gdt2 + 2],ax
 mov [gdt4 + 2],ax
 shr eax,16
 mov [gdt2 + 4],al
 mov [gdt4 + 4],al
 mov [gdt2 + 7],ah
 ; mov [gdt4 + 7],ah ; no; this one is 16-bit

; now do the same with the data/stack segment descriptors
 mov eax,ebx
 mov [gdt3 + 2],ax
 mov [gdt5 + 2],ax
 shr eax,16
 mov [gdt3 + 4],al
 mov [gdt5 + 4],al
 mov [gdt3 + 7],ah
 ; mov [gdt5 + 7],ah ; no; this one is 16-bit

; point the TSS descriptor to the LINEAR/PHYSICAL address of 'tss'
 mov eax,tss
 add eax,ebx
 mov [gdt6 + 2],ax
 shr eax,16
 mov [gdt6 + 4],al
 mov [gdt6 + 7],ah

; point the interrupt gates in the Interrupt Descriptor Table (IDT)
; to the default interrupt handler 'unhand'
 mov di,idt
 mov cx,(idt_end - idt) / 8 ; number of IDT entries (gates)
do_idt:
 mov eax,unhand  ; point all gates to 'unhand'
 mov [di],ax  ; set bits 15:0 of gate offset
 shr eax,16
 mov [di+6],ax  ; set bits 31:16 of gate offset
 add di,8  ; next gate
 loop do_idt

 mov di,idt_0e  ; IDT entry 0Eh -> page fault
 mov eax,page_fault
 mov [di],ax
 shr eax,16
 mov [di+16],ax

; point 'gdt_ptr' to LINEAR/PHYSICAL address of the GDT;
; 'idt_ptr' to LINEAR/PHYSICAL adr of the IDT
 add [gdt_ptr + 2],ebx
 add [idt_ptr + 2],ebx

; DOS doesn't load .COM or .EXE files on a page (4K) boundary, so
; we must now find a page boundary for the page directory/tables.
 xor esi,esi
 mov si,page_info ; SI = offset of page_info
 add esi,ebx  ; ESI = LINEAR/PHYSICAL adr of page_info
 add esi,4095  ; round to 4K boundary

 and esi,0FFFFF000h ; ESI = LINEAR/PHYSICAL adr of page dir
 mov edi,esi
 sub edi,ebx  ; DI = offset of page dir

; save page dir address for later use, by both VCPI and "raw" code
 mov [vcpi_cr3],esi

; EAX = LINEAR/PHYSICAL address of "framebuffer" page table
; (4K above the page directory)
 mov eax,esi
 add eax,4096
; create entry in page dir for "framebuffer" page table
 or al,7   ; Ring 3, writable, present
 mov [di + (((LFB_BASE >> 22) & 3FFh) << 2)],eax

; EAX = LINEAR/PHYSICAL address of "kernel" page table
; (8K above the page directory)
 mov eax,esi
 add eax,8192
; create entry in page dir for "kernel" page table
 or al,7   ; Ring 3, writable, present
 mov [di + 0],eax

; advance DI from page directory to "framebuffer" page table
 add edi,4096

; save the LINEAR/PHYSICAL pointer to the "framebuffer" page table
 mov eax,edi
 add eax,ebx
 mov [fb_page_table],eax

; Map the simulated linear framebuffer from virtual address LFB_BASE
; to the actual banked framebuffer at physical address 000A0000,
; repeating every 64K (16 pages)
;
; 1600x1200x256 display needs 1875K simulated framebuffer
; == 30 banks of 64K each == 469 pages of 4K each
;
; If the simulated framebuffer crosses a 4 meg boundary, or is larger
; than 4 meg, you will need more than one "framebuffer" page table.

 push di
  add di,(((LFB_BASE >> 12) & 3FFh) << 2)
  mov dl,30
map_fb1:
  mov ecx,16
  mov eax,0A0006h ; Ring 3, writable, NOT PRESENT
map_fb2:
  stosd
  add eax,4096 ; next page
  loop map_fb2
  dec dl
  jne map_fb1
 pop di

; advance DI to "kernel" page table
 add di,4096

; using the "kernel" page table, identity-map
; (virtual == physical) the bottom 4M of RAM
; With VCPI, we can skip this step, and simply take over EMM386's
; conventional memory page table using INT 67h AX=DE01h
 mov cx,1024
 mov eax,7  ; Ring 3, writable, present
identity_map:
 stosd
 add eax,4096  ; next page
 loop identity_map

; move DI back to "kernel" page table, in case we want to change it
 sub di,4096

; check for virtual 8086 mode (Windows DOS box or EMM386 loaded)
 smsw ax
 test al,1  ; look at PE bit of MSW (CR0)
 je real0

 mov si,v86_msg
 call wrstr

; if it's EMM386, we can use VCPI to switch to protected mode
; Testing for VCPI like this makes Win95 pop up a dialog suggesting
; "MS-DOS mode". This may or may not be a good thing.
 mov ax,0DE00h
 push bx   ; save EBX; not interested in VCPI version
  int 67h
 pop bx
 cmp ah,0
 je vcpi0

; no VCPI? probably Windows DOS box; check for that
 mov si,err_msg
 mov ax,1600h
 int 2Fh
 cmp al,0
 je msg_and_exit
 cmp al,80h
 je msg_and_exit
 mov si,win_msg  ; yup, it's 'Doze

msg_and_exit:
 call wrstr

; exit to DOS with errorlevel 1
 mov ax,4C01h
 int 21h

vcpi0:
; get "kernel" page table and partial GDT from the VCPI server.
; If we set up our own identity-mapped page table, this step is optional.
; (we still need to do INT 67h AX=DE01h to get the pmode entry
; point to the VCPI server -- so we can return to V86 mode later)
 mov si,gdt7
 mov ax,0DE01h
 push ebx
  int 67h
  mov [vcpi_entry],ebx
 pop ebx
 mov si,vcpi_err_msg
 cmp ah,0
 jne msg_and_exit

; set up the VCPI control block for the switch to pmode
 add [vcpi_gdtr],ebx
 add [vcpi_idtr],ebx

; await keypress; switch to graphics mode; disable interrupts
 mov si,vcpi_msg
 call setup
; OK, let's do it
 mov esi,vcpi_control_block
 add esi,ebx
 mov ax,0DE0Ch
; if all goes well, the interrupt will return at 'from_vcpi'
 int 67h

real0:
; await keypress; switch to graphics mode; disable interrupts
 mov si,real_msg
 call setup

; set vital registers: page directory base register (PDBR = CR3)
 mov eax,[vcpi_cr3]
 mov cr3,eax
; ...GDTR and IDTR
 lgdt [gdt_ptr]
 lidt [idt_ptr]
; ...enable paging and pmode
 mov eax,cr0
 or eax,80000001h
 mov cr0,eax
 jmp CODE_SEL:from_real

; we jump here (in 16-bit pmode) when returning to real mode
; Back-to-real-mode sequence from 14.5 of 386INTEL.TXT:
; 3. load segment registers with values "appropriate to real mode"
real2:
 mov ax,DATA_SEL16
 mov ss,ax
 mov ds,ax
 mov es,ax
 mov fs,ax
 mov gs,ax

; 4. disable interrupts
 ; (already done)
; 5. clear the PE bit
 mov eax,cr0
 and al,0FEh
 mov cr0,eax

; 6. far jump to true real mode
 mov word [real_mode_ip],real3
 jmp far [real_mode_ip]

; 7. load an IDT that is compatible with real-mode IVT
real3:
 lidt [real_idt_ptr]

; 9. restore real-mode segment registers
real4:
 mov ax,cs
 mov ss,ax
 mov ds,ax
 mov es,ax
 mov fs,ax
 mov gs,ax

; 8. enable interrupts
 sti

; go back to text mode
 mov ax,3
 int 10h

 mov si,done_msg
 jmp msg_and_exit

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; REAL MODE SUBROUTINES
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; name:   setup
; action:  1. calls wrstr
;   2. prompts the user to press a key, and waits for it
;   3. sets VESA graphics mode VESA_MODE
;      (terminates if mode-set fails)
;   4. zeroes EFLAGS register (disables interrupts,
;      sets IOPL=0, and clears NT bit)
; in:   0-terminated string at DS:SI
; out:   (nothing)
; modifies:  AX
; minimum CPU:  386SX
; notes:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

press_key_msg:
 db "Press a key to continue", 13, 10, 0

vesa_err_msg:
 db "Error setting VESA graphics mode", 13, 10, 0

setup:
 push bx
; display the message pointed to by SI
  call wrstr
; prompt user to press a key
  mov si,press_key_msg
  call wrstr
; wait for the key
  mov ah,0
  int 16h
; switch to VESA graphics mode
  mov ax,4F02h
  mov bx,VESA_MODE
  int 10h
  cmp ah,0
  je setup1
  cmp al,4Fh
  je setup1
  mov si,vesa_err_msg
  jmp msg_and_exit
setup1:
  push dword 0
  popfd
 pop bx
 ret

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; name:   wrstr
; action:  writes ASCIZ string to text screen
; in:   0-terminated string at DS:SI
; out:   (nothing)
; modifies:  (nothing)
; minimum CPU:  8088
; notes:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

wrstr: push ax
 push bx
 push si
  mov ah,0Eh ; INT 10h: teletype output
  xor bx,bx ; video page 0
  jmp wrstr2
wrstr1:  int 10h
wrstr2:  lodsb
  or al,al
  jne wrstr1
 pop si
 pop bx
 pop ax
 ret

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; name:   probe_vesa
; action:  detects VESA 2.x video BIOS
; in:   (nothing)
; out (success): ZF=1, [bank_switch_fn] set
; out (failure): ZF=0
; modifies:  EAX, BX, DI, SI
; minimum CPU:  386SX
; notes:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

vesa_msg:
 db "Checking for VESA 2.x video BIOS...", 0

probe_vesa:
 mov si,vesa_msg
 call wrstr
 push es
  mov ax,4F00h
  mov di,vesa_info
  int 10h
  cmp ah,0
  jne no_vesa
; locate the pmode bank-switch function in the video BIOS ROM
  mov ax,4F0Ah
  mov bx,1
  int 10h
  cmp ax,004Fh
  jne no_vesa
; Alexei fixed this for me:
; convert address of bank-switch function from seg:off to linear
  add di, [es:di] ; add function offset to table offset
  xor eax,eax
  mov ax,es
  sub ax,[real_mode_cs] ; our 32-bit code base address isn't 0,
     ; gotta adjust this!!!
  shl eax,4
  movzx edi, di ; yep, this is required as well :)
  add eax,edi
; ...and store it
  mov [bank_switch_fn],eax
; return ZF=1 for success
  xor ax,ax
no_vesa:
 pop es
 ret

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; name:   probe_s3
; action:  detects S3 video board
; in:   (nothing)
; out (success): ZF=1, [bank_switch_fn] set
; out (failure): ZF=0
; modifies:  EAX, SI
; minimum CPU:  386SX
; notes:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

s3_msg:
 db 13, 10, "no; checking for S3 video...", 0

probe_s3:
 mov si,s3_msg
 call wrstr
 push dx
; lock the enhanced registers
  mov dx,CRTC_INDX
  mov al,039h
  out dx,al

  inc dx
  mov al,00h
  out dx,al

  dec dx
  mov al,38h
  out dx,al

  inc dx
  mov al,00h
  out dx,al
; see if CRTC reg 35h is read-only
  dec dx
  mov al,35h
  out dx,al

  inc dx
  in al,dx
  mov ah,al

  xor al,0Fh
  out dx,al

  in al,dx
  cmp al,ah
  jne no_s3
; unlock S3 registers
  dec dx
  mov al,38h
  out dx,al

  inc dx
  mov al,48h
  out dx,al

  dec dx
  mov al,39h
  out dx,al

  inc dx
  mov al,0A5h
  out dx,al
; can CRTC reg 35h be changed now?
  dec dx
  mov al,35h
  out dx,al

  inc dx
  in al,dx
  mov ah,al

  xor al,0Fh
  out dx,al

  in al,dx
  cmp al,ah
  je no_s3
; found S3; restore old value of reg 35h
  mov al,ah
  out dx,al
; set [bank_switch_fn] to linear address of set_s3_bank
  mov dword [bank_switch_fn],set_s3_bank
; return ZF=1 for success
  xor ax,ax
no_s3:
 pop dx
 ret

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; name:   probe_cirrus
; action:  detects video board with Cirrus 5422 chipset
; in:   (nothing)
; out (success): ZF=1, [bank_switch_fn] set
; out (failure): ZF=0
; modifies:  EAX, SI
; minimum CPU:  386SX
; notes:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

cirrus_msg:
 db 13, 10, "no; checking for Cirrus 5422 video...", 0

probe_cirrus:
 mov si,cirrus_msg
 call wrstr
 push dx
; unlock Cirrus registers
  mov dx,SEQN_INDX
  mov al,06h
  out dx,al
  inc dx
  mov al,12h
  out dx,al
; lock reg should now read as 12h
  in al,dx
  cmp al,12h
  jne no_cirrus
; check the chip ID
  mov dx,CRTC_INDX
  mov al,27h
  out dx,al
  inc dx
  in al,dx
  shr al,2
  cmp al,22h
  jb no_cirrus
  cmp al,28h
  ja no_cirrus
; found a Cirrus board
; set [bank_switch_fn] to linear address of set_cirrus_bank
  mov dword [bank_switch_fn],set_cirrus_bank
; return ZF=1 for success
  xor ax,ax
no_cirrus:
 pop dx
 ret

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; 32-BIT PROTECTED MODE SUBROUTINES
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

 BITS 32

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; name:   set_cirrus_bank
; action:  sets 64K video bank (Cirrus 5422 video only)
; in:   bank number in DL
; out:   (nothing)
; modifies:  (nothing)
; minimum CPU:  386SX
; notes:  EDX and EAX are used only to make this code
;   smaller. DX and AX could be used instead,
;   if you want code to run on 16-bit CPUs.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

set_cirrus_bank:
 push edx
 push eax
  mov eax,edx

  and al,0Fh
  shl al,4
  mov ah,al

  mov dx,GRFX_INDX
  mov al,09h
  out dx,al

  inc edx
  mov al,ah
  out dx,al
 pop eax
 pop edx
 ret

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; name:   set_s3_bank
; action:  sets 64K video bank (S3 video only)
; in:   bank number in DL
; out:   (nothing)
; modifies:  (nothing)
; minimum CPU:  386SX
; notes:  EDX and EAX are used only to make this code
;   smaller. DX and AX could be used instead,
;   if you want code to run on 16-bit CPUs.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

set_s3_bank:
 push edx
 push eax
  mov eax,edx

  and al,0Fh
  mov ah,al

; grrrr...mode-set locked the S3 registers, so unlock them again
; xxx - do this after mode-set
  mov dx,CRTC_INDX
  mov al,38h
  out dx,al

  inc edx
  mov al,48h
  out dx,al

  dec edx
  mov al,39h
  out dx,al

  inc edx
  mov al,0A5h
  out dx,al

; now: do the bank-switch
  mov dx,CRTC_INDX
  mov al,35h
  out dx,al

  inc edx
  in al,dx
  and al,0F0h

  or al,ah
  out dx,al
 pop eax
 pop edx
 ret

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; name:   unhand
; action:  handler for otherwise unhandled exceptions;
;   draws short red diagonal line on SVGA screen
; in:   (nothing)
; out:   (nothing)
; modifies:  (nothing)
; minimum CPU:  386SX
; notes:  DOES NOT RETURN
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

; write to physical address A0000 instead of virtual address
; LFB_BASE to avoid more page faults
unhand:
 mov ax,LINEAR_SEL
 mov es,ax
 mov byte [es:0A0000h + (WIDTH + 1) * 0],4
 mov byte [es:0A0000h + (WIDTH + 1) * 1],4
 mov byte [es:0A0000h + (WIDTH + 1) * 2],4
 mov byte [es:0A0000h + (WIDTH + 1) * 3],4

 jmp $

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; name:   page_fault
; action:  handler for INT 0Eh (page fault); performs
;   SVGA bank-switching for faults that come
;   from the simulated linear framebuffer
; in:   (nothing)
; out:   (nothing)
; modifies:  (nothing)
; minimum CPU:  386SX
; notes:  This is an interrupt handler, so be careful.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

page_fault:
 pusha

; did it come from the LFB? jump to 'unhand' if not
  mov eax,cr2
  sub eax,LFB_BASE
  jc unhand
  cmp eax, WIDTH*HEIGHT
  jnc unhand  ; some extra checking :)

; set SVGA bank
  mov edx,cr2
  shr edx,16
  mov bh,0  ; bh=0 - set bank no. (VESA only)

  call [bank_switch_fn]

; unmap all pages in the LFB
; xxx - this is slow; need only unmap the pages that are currently mapped
  mov ebx,[fb_page_table]
  mov ecx,1024
unmap:
  and byte [es:ebx],0FEh ; Present=0
  add ebx,4
  loop unmap

; bits 31:22 of faulting adr are page dir index
; bits 21:12 of faulting adr are page table index
  mov ebx,cr2
  shr ebx,12
  and ebx,3FFh
  shl ebx,2
  add ebx,[fb_page_table]

; map in 16 4K pages (one 64K bank)
  mov ecx,16
map_fb:
  or byte [es:ebx],01h ; Present=1
  add ebx,4
  loop map_fb

; we changed the page tables, so reload CR3 to flush the page
; table cache (the TLB). 486+ could use INVLPG instruction instead
  mov eax,cr3
  mov cr3,eax
 popa

; drop error code
 add esp,4
 iret

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; name:   draw_lines
; action:  draw green and blue 'X' on the screen,
;   return after a delay
; in:   (nothing)
; out:   (nothing)
; modifies:  ECX, EBX
; minimum CPU:  386SX
; notes:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

; Note the absence of bank-switching code here. Simple, eh?
; xxx - this code for 256-color screen only

draw_lines:
 mov ecx,HEIGHT
 mov ebx,LFB_BASE + (WIDTH - HEIGHT) / 2
ul_lr:
 mov byte [es:ebx],1 ; blue
 add ebx,WIDTH + 1
 loop ul_lr

 mov ecx,HEIGHT
 mov ebx,LFB_BASE + (WIDTH - HEIGHT) / 2 + HEIGHT
ur_ll:
 mov byte [es:ebx],2 ; green
 add ebx,WIDTH - 1
 loop ur_ll

; xxx - await keypress here -- somehow
 mov ecx,03FFFFFFh
spin:
 loop spin
 ret

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; MAIN 32-BIT PMODE CODE, here from VCPI
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

from_vcpi:
 mov ax,DATA_SEL
 mov ss,ax
 mov ds,ax
 mov ax,LINEAR_SEL
 mov es,ax
 mov fs,ax
 mov gs,ax

 call draw_lines

; return to V86 mode
 mov eax,0000DE0Ch

; from E-67DE0C of Ralf Brown's list:
;   DS = segment selector mapping entire linear
;  address space obtained via AX=DE01h
; I'm not sure what that means, but I peeked inside EMM386.EXE,
; and it sets DS for me, so I don't have to.

 movzx ebx,word [real_mode_cs]
 mov ebp,esp
 push ebx   ; GS
 push ebx   ; FS
 push ebx   ; DS
 push ebx   ; ES

 push ebx   ; SS
 push ebp   ; ESP
 push dword 00023020h  ; EFLAGS
 push ebx   ; CS
 push dword real4  ; EIP

 call far [vcpi_entry]

; should not reach this
 jmp short $

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; MAIN 32-BIT PMODE CODE, here from "raw" mode (real mode)
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

from_real:
 mov ax,DATA_SEL
 mov ss,ax
 mov ds,ax
 mov ax,LINEAR_SEL
 mov es,ax
 mov fs,ax
 mov gs,ax

 call draw_lines

; back-to-real-mode sequence from 14.5 of 386INTEL.TXT
; 1. TURN OFF PAGING
; 1a. jump to code memory which is identity-mapped
 ; (already done)
; 1b. clear the PG bit
 mov eax,cr0
 and eax,7FFFFFFFh
 mov cr0,eax

; 1c. "Move zeros to CR3 to clear out the paging cache."
 xor eax,eax
 mov cr3,eax

; 2. jump to 16-bit code segment (real2 is above, in the BITS 16 section)
 jmp CODE_SEL16:real2

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; DATA
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

v86_msg:
 db "CPU is in virtual 8086 mode...", 13, 10, 0

err_msg:
 db "...and I don't know why (no EMM386, no Windows).", 13, 10
 db "Sorry, can't switch to protected mode.", 13, 10, 0

win_msg:
 db "Sorry, this code won't run in a Windows DOS box.", 13, 10
 db "Re-start your computer in 'MS-DOS mode'.", 13, 10, 0

vcpi_msg:
 db "VCPI server detected (probably EMM386).", 13, 10
 db "I will try to use VCPI to switch to protected mode.", 13, 10, 0

vcpi_err_msg:
 db "Error getting VCPI server entry point.", 13, 10, 0

real_msg:
 db "CPU is in real mode.", 13, 10, 0

done_msg:
 db "Back to DOS, wheee!", 13, 10, 0

; Even if you don't use TSS-based task-switching, you need one
; TSS to hold the user stack pointer.
tss:
 dw 0, 0   ; back link

 dd 0   ; ESP0
 dw DATA_SEL, 0  ; SS0, reserved

 dd 0   ; ESP1
 dw 0, 0   ; SS1, reserved

 dd 0   ; ESP2
 dw 0, 0   ; SS2, reserved

 dd 0   ; CR3
 dd 0, 0   ; EIP, EFLAGS
 dd 0, 0, 0, 0  ; EAX, ECX, EDX, EBX
 dd 0, 0, 0, 0  ; ESP, EBP, ESI, EDI
 dw 0, 0   ; ES, reserved
 dw 0, 0   ; CS, reserved
 dw 0, 0   ; SS, reserved
 dw 0, 0   ; DS, reserved
 dw 0, 0   ; FS, reserved
 dw 0, 0   ; GS, reserved
 dw 0, 0   ; LDT, reserved
 dw 0, 0   ; debug, IO perm. bitmap

; null descriptor
gdt:
 dw 0   ; limit 15:0
 dw 0   ; base 15:0
 db 0   ; base 23:16
 db 0   ; type
 db 0   ; limit 19:16, flags
 db 0   ; base 31:24
LINEAR_SEL      equ     $-gdt
 dw 0FFFFh
 dw 0
 db 0
 db 92h   ; present, ring 0, data, expand-up, writable
 db 0CFh   ; page-granular, 32-bit
 db 0
CODE_SEL equ $-gdt
gdt2:
 dw 0FFFFh
 dw 0
 db 0
 db 9Ah   ; present, ring 0, code, non-conforming, readable
 db 0CFh   ; page-granular, 32-bit
 db 0
DATA_SEL equ $-gdt
gdt3:
 dw 0FFFFh
 dw 0
 db 0
 db 92h   ; present, ring 0, data, expand-up, writable
 db 0CFh   ; page-granular, 32-bit
 db 0
CODE_SEL16 equ $-gdt
gdt4:
 dw 0FFFFh
 dw 0
 db 0
 db 9Ah   ; present, ring 0, code, non-conforming, readable
 db 0   ; byte-granular, 16-bit
 db 0
DATA_SEL16 equ $-gdt
gdt5:
 dw 0FFFFh
 dw 0
 db 0
 db 92h   ; present, ring 0, data, expand-up, writable
 db 0   ; byte-granular, 16-bit
 db 0
TSS_SEL  equ $-gdt
gdt6:
 dw 103
 dw 0
 db 0
 db 089h   ; Ring 0 available 32-bit TSS
 db 0
 db 0
VCPI_SEL equ $-gdt
gdt7:
 dd 0, 0   ; dummy descriptors used by VCPI

 dd 0, 0

 dd 0, 0
gdt_end:

idt:
 %rep 14

 dw 0   ; low 16 bits of ISR address
 dw CODE_SEL  ; selector
 db 0   ; word count
 db 8Eh   ; access byte: Present, Ring 0, '386 intr gate
 dw 0   ; high 16 bits of ISR

 %endrep
idt_0e:
 %rep 18

 dw 0   ; low 16 bits of ISR address
 dw CODE_SEL  ; selector
 db 0   ; word count
 db 8Eh   ; access byte: Present, Ring 0, '386 intr gate
 dw 0   ; high 16 bits of ISR

 %endrep
idt_end:

gdt_ptr:
 dw gdt_end - gdt - 1 ; GDT limit
 dd gdt   ; linear, physical address of GDT

idt_ptr:
 dw idt_end - idt - 1 ; IDT limit
 dd idt   ; linear, physical address of IDT

real_idt_ptr:
 dw 3FFh   ; limit 1023
 dd 0   ; IDT (IVT, actually) at address 0

bank_switch_fn:
 dd 0

krnl_page_table:
 dw 0

fb_page_table:
 dd 0

real_mode_ip:
 dw 0
real_mode_cs:
 dw 0

page_info:
 times 4096 db 0         ; padding to 4K boundary
 times 4096 db 0         ; page dir somewhere in here
 times 4096 db 0         ; "framebuffer" page table for SLFB
 times 4096 db 0         ; "kernel" page table for bottom 4 meg

vcpi_entry:
 dd 0
 dw VCPI_SEL

vcpi_control_block:
vcpi_cr3:
 dd 0
vcpi_gdtr:
 dd gdt_ptr
vcpi_idtr:
 dd idt_ptr
vcpi_ldtr:
 dw 0
vcpi_tr:
 dw TSS_SEL
vcpi_eip:
 dd from_vcpi
vcpi_cs:
 dw CODE_SEL

vesa_info:
 db "VBE2"
vesa_minor:
 db 0
vesa_major:
 db 0
 times 506 db 0