stage3. asm [ia-common]

The shared stage 3 / main kernel for My Operating System (MOS)

This module is responsible for managing and enabling the running of user applications

For software programming, check the System calls section

Author

Marcel Sondaar

License

Educational purposes

Summary

stage3. asm [ia-common]	The shared stage 3 / main kernel for My Operating System (MOS)
kernelentry	contains the entry point of the kernel
mpentry	the common entry code for multiprocessor systems
Initializers	These functions constitute to the initialisation of the kernel.
AllocateFromHeap	Allocates several bytes at the end of heap.
ApicBasedDelay	delay x cycles based on bus speed
BootstrapAP586	attempts to boot application processors in the system
BootstrapUserspace	Locates the fourth stage binary, map it into memory and create an initial task for that binary.
BuildKernelPageMap	Creates a default page table used when creating a new virtual address space.
CheckDisabledApic	Checks if a software-disabled APIC is present
CheckpointBSP	Synchronizes progress across CPU’s
CheckpointAP	Synchronizes progress across CPU’s
ComputeApicFrequency	Compares the local APIC with the PIT timer to calculate its operating frequency
ComputeProcessorUnion	calculates <qwProcessorSharedCaps> by takes all processor’s capabilities, and keeping only the bits common to all processors.
CreateInitialTDS	Creates the initial task description state and loads it for the current processor
DetectCoprocessor	Probes the current processor for an math coprocessor and sets dwaProcessorCaps1 accordingly
CR0_NE does not exist on a 386
DetectProcessors	Retrieves the information from the BSP, looks for APs and boots them
Lots of reboots/ lockups on Pentium 1 boxes
HyperThreading
FindMPTable	Locates the Intel multiprocessor table
FindRSDP	Locates the RSDP table, if present.
FixInterrupts	Fix PIC issues: mask all ints at the PIC, then enable interrupts
InitializeAllocator	Initializes the memory allocator tables
allocation of kernel pages	these are the amount of occupied/unoccupied pages they should later be set to the actual pages that are used.
InitializeAPRegisters	loads the AP’s special registers with the values generated by the BSP this also waits for the BSP to present the data
this is detrimental to speed on P4/ HTT processors
InitializeKernelHeap	Loads pointers for all the needed structures
InitializeGDT32	initializes the 32 bit GDT
InitializeIDT32	Initializes the 32-bit IDT
replace with real handlers
InitializePIC	Brings the PIC into a known state
Socket-A Interrupt bug	Copied from the previous kernel generation.
InitializePIT	Configure the PIT to a rate generator
InitializeRTC	Initializes the RTC as an interrupt source
InitializeRTC crashes some computers
InitializeSyscalls	Registers the system call handlers
InitializeTSSAP	Creates an initial TSS for the current processor.
InitializeTSSBSP	Initializes the TSS for the BSP, and all the setup required for the TSSes on other processors.
PrintCPUCaps
PrintAPICLine	Prints the APIC Bus frequency
PrintHex4	Converts a dword value to hex and emit it to a string
PrintInitLine	prints the initalizer line
ProcessorDiagnostic	Gets the CPU, VM and related information
fix MMX and EMMI detection
Extended CPUID
fix cpuid bugs for intel class chips
SetCPUBits	loads CR0/CR4 with the appropriate bits
cyrices (and possibly others) do not support cr4	so do no write it when we don’t need it
set SSE bits in CR4
Runtime components	Common routines during kernel operation.
AddMemoryReference32	Ups the reference count to a memory location.
AllocateGDT32Entry	finds an empty GDT entry and allocates it.
AllocateIDTEntry	Tries to allocate one entry in the IDT
fail stub
AllocateMemory32	Tries to allocate a piece of memory To allow for full userspace control of memory
ClearPageTableEntry32Hole	Clears a page table entry if it is mapped and not used by the kernel.
improve speed here.
improve speed
DumpCRState	prints a crashdump with the CRx registers
DumpIntState	prints a crashdump from an interrupt stackframe
DumpRegState	Prints a crashdump from a PUSHAD image
EnableIRQ	Enables one IRQ at the PIC
FillKernelPageDirectory	Fills a page directory with default values
FillKernelPageTable	Fills a page table with all the kernel pages
FillPage32	Fills a page in physical memory with all ones
FillTaskDescriptor32	Fills a page with a task descriptor and a schedulable stack This descriptor is designed to run 32-bit applications
FillTaskDescriptorRemote32	Fills a task structure in physical memory
FindL3MemoryTable32	Locks onto the memory address controlling this entry
resolve virtual pointers
FindL2MemoryTable32	Increases the reference count on one memory unit
resolve virtual pointers
FindL1MemoryTable32	Increases the reference count on one memory unit
GetTssBitmapStatus32	Checks whether a page in the TSS has been mapped
HardwareDelay	Delays for a short period of time.
InsertLargePage32	adds a given large page to a page directory
InsertPageTable32	adds a given page table to a page directory
InsertPage32	adds an entry to the page table.
InsertTSSBitmapPage	Maps a page into the shared TSS area.
write 486 overlay (cmpxchg)
proper page flushing
IntHandler	Provides the default interrupt handlers.
MapL1Table32	Inserts a new leaf into the memory allocator map
MapL2Table32	Ups the reference count to a memory location.
Oops	Kills the thread and prints a report to port e9
ReadPageTableEntry32Hole	Sets a page table entry if allowed.
improve speed here.
improve speed
ReleaseMemoryLocks	Releases memory locks as given by findmemory and relatives
RemoveMemoryReference32	Decrements the reference count to a memory location.
RequestAddress32	Requests ownership of one location in the physical address space
RequestGDT32Entry	Requests ownership of one specified GDT entry
RequestMemory32	Requests ownership of one memory location
SetIDTEntry32	Points an IDT entry to a given function
SetIDTEntry32Public	Points an IDT entry to a given function, and allow it to be called from userland
SetPageDirEntry32Hole	Sets a page directory entry if allowed.
improve speed here.
SetPageTableEntry32Hole	Sets a page table entry if allowed.
improve speed here.
improve speed
SwitchGDT32	Switches to the 32 bit GDT
SwitchIDT32	Switches to the 32 bit IDT
QueueThread	adds a thread to the execution queue
WritePage32	adds an entry to the page table.
WriteAddressSpace32	Map and fill out a set of address space structures
ZeroPage32	Zeroes a page in physical memory
Scheduler components	These functions change between tasks.
Schedule	Causes execution to be suspended and the next thread to be readied.
Scheduler_Common	this function will browse through the scheduler list and pick a new task to run.
Address space switches
Scheduler_Launchuser	return stub that gets us into userland
System calls	These functions form the interface to all userspace applications
Entrypoint_Int	Contains the handler for system calls when accessed via the syscall interrupt.
Entrypoint_Main	Does the actual decoding of the system call
KernelVersion	Returns the kernel version
BlockAlloc	Allocates memory and maps it to userspace
write address to page table if applicable
release this address	OOPS
BlockAllocEx	Allocates a specific piece memory and maps it to userspace
write address to page table if applicable
release this address
BlockAllocPhys	Allocates an area in the physical range and maps it to userspace
write address to page table if applicable
release this address
EnterV8086	Makes the thread enter v8086 mode
AllocateIoBitmap	Allocates pages for the I/O permission bitmap.
PortAlloc	Allocates pages for the I/O permission bitmap.
add port allocation management and safety stuff
step up from first page to second
AllocatePageTable	Maps a page table into the page directory to allow for small pages to be used
update destroyed regs	check RequestMemory32 AllocateMemory32 InsertPageTable32 ZeroPage32 RemoveMemoryReference32
BlockAllocExL	Allocates an area of memory in the physical range and maps it to userspace
check destroyed regs
release this address
BlockAllocPhysL	Allocates an area in the physical range and maps it to userspace
check destroyed regs
release this address
AllocateIRBitmap	Allocates a page for the Interrupt Redirection Bitmap
SetRedirectBits	Sets redirection bits in the Interrupt Redirection Bitmap
ManageMemoryL1	Insert a node into the memory manager tree at the 1st level The node will describe 2M of memory in 4K units
ManageMemoryL2	Insert a node into the memory manager tree at the 3rd level The node will describe 1G of memory in 2M units
ESI usage?
Yield	Yield the execution resource to another program
CreateAddressSpace	Creates a new set of paging structures
CreateThread	Creates a new thread structure
CreateThreadRemote	Creates a new thread structure in a different address space
Race condition. Read-addref-read pattern needs to be added
TransferPage	Copies a virtual-to-physical mapping from the current address space to a remote address space
Race condition. Read-addref-read pattern needs to be added
AllocatePageTableRemote	Maps a page table into the page directory to allow for small pages to be used
update destroyed regs	check RequestMemory32 AllocateMemory32 InsertPageTable32 ZeroPage32 RemoveMemoryReference32
Race condition. Read-addref-read pattern needs to be added
BlockDealloc	Removes references to a section of memory to allow for small pages to be used
Yank	Run privileged test code
Interrupt Handlers	These functions assure a proper handling of exceptions and standard interrupts
IsrNMHandler	Handles the coprocessor exceptions
segment register breakage
IsrGPFHandler32	handles the GPF exception
Check whether the stored state is consistent.
IsrPFHandler32	handles the pagefault exception
IrqRTCHandler	acknowledges the RTC timer interrupt and updates the time
causes panic on Bochs due to kb overflow
Data storage	Contains all variables, pointers and preallocated datastructures
lpBootloaderData	holds the address of the structure passed by the bootloader
lpRamdisk	holds the base address of the ramdisk.
szaHostName	contains the name of the host (processor or vm) for each processor
baProcessorArch	contains the family, needed for MSRs, APIC, IOAPIC and related stuff values: 0 - Unknown architecture 1 - Intel 386 (external FPU) 2 - Intel 486+ (internal FPU, intel MSRs, L.APIC) 3 - AMD 4 - Cyrix (Cyrix MSRs)
bcdaProcessorVersion	contains an unpacked BCD version number of each processor: family.major.minor.revision
dwaProcessorCaps1	contains a bitmask of host capabilities for each processor the bits generally correspond to cpuid flags, however, the startup code filters the broken/unsupported/disabled features so to make these readings more accurate.
dwaProcessorCaps2	contains a bitmask of host capabilities for each processor.
dwaProcessorSharedCaps	the capabilities shared by all processors
dwaProcessorMaxCaps	all the capabilities that are supported by at least one processor
dwProcessorCount	the number of logical processors in the systems
lpRSDPBase	the location of the RSDP structure
lpMPTablePointer	the location of the MP pointer
lpKernelBasePageTable	contains a pointer to the base kernel page table (386 paging)
lpKernelBasePAETable	contains a pointer to the base kernel page table (PAE/LM paging)
lpAddressSpaceMirror	contains a pointer to the location where the current address space information structure is mapped
lpDirectoryTableMirror	contains a pointer to the location where the current page directory is mapped (if appropriate)
lp32BitGDT	the location of the 32 bit gdt
lp32BitIDT	the location of the 32 bit IDT
lp64BitIDT	the location of the 64 bit IDT
lpL4MemoryTable	the 4th level memory reference structure.
lpL3MemoryTable	the 3rd level memory reference structure.
lpL2MemoryTable	the 2nd level memory reference structure.
lpL1MemoryTable	the 1st level memory reference structure.
lpHeapTop	the current top of the heap
lpPageTableSource	the sample table that contains all the pages required by the kernel
lpPagingLocks	holds the lock bits for the paging hole
lpMMTableHoles	points to four consecutive pages where parts of the paging structures can be mapped into
lpPagingHoles	points to four consecutive pages where parts of the paging structures can be mapped into
lpPagingKernelTables	points to four consecutive pages where the paging structures for the kernel are offset + 0k - page table offset + 4k - page directory offset + 8k - 3rd level offset + 12k - top level
lpZeroHole	points to a page that can be mapped for clearing pages.
lpFPUHole	points to a series of pages that can be mapped for lazily storing FPU state
lpFreePagingOffset	the first address where allocations can be done
lpaCurrentAddressSpace	contains the currently active address space for each processor
lpaCurrentProcess	contains the current task’s descriptor
lpaCurrentScheduleProc	contains the location of the schedule_out function for the current thread
lpaSchedulerBase	contains the base of the scheduling table
lpaSchedulerOffset	contains the offset into the scheduler table of the currently executing task
dwSchedulerLocks	contains access locks to the scheduler queue
lpaTSS	contains the location of the TSSs for each processor.
lpaIoBitmap	contains the location of the I/O permission bitmap
lpaLastFPUState:	Contains the location of the FPU state to store.
baGDT32Bitmap	contains a bitmap of the used GDT entries
bMasterMask	contains the interrupt mask for the Master PIC
bSlaveMask	contains the interrupt mask for the Slave PIC
kernelimagesize	the size of the kernel image in bytes.
kernelbssstart	the page-aligned location where the bss should start.

kernelentry

contains the entry point of the kernel

mpentry

the common entry code for multiprocessor systems

in

ECX	processor number

out

does not return

Initializers

These functions constitute to the initialisation of the kernel. Once the kernel is running, these can be eliminated

AllocateFromHeap

Allocates several bytes at the end of heap. Only multiples of PAGE_SIZE should be used to guarantee page-alignment

in

EAX	bytes required

out

EAX

location

destroyed

none

ApicBasedDelay

delay x cycles based on bus speed

BootstrapAP586

attempts to boot application processors in the system

in

none

out

none

destroyed

EAX EBX ECX EDX ESI EDI

BootstrapUserspace

Locates the fourth stage binary, map it into memory and create an initial task for that binary.

in

none

out

none

destroyed

EAX EBX ECX EDX ESI EDI

Stage4 is loaded in different locations by grub and the custom stage2

BuildKernelPageMap

Creates a default page table used when creating a new virtual address space.

After calling this, AllocateFromHeap will no longer allocate memory that is global.

in

none

out

none

destroyed

EAX ECX EDI ESI

CheckDisabledApic

Checks if a software-disabled APIC is present

in

EDX = CPUID output

out

EDX = corrected CPUID output

destroyed

none

CheckpointBSP

Synchronizes progress across CPU’s

in

none

out

none

destroyed

none

CheckpointAP

Synchronizes progress across CPU’s

in

none

out

none

destroyed

none

ComputeApicFrequency

Compares the local APIC with the PIT timer to calculate its operating frequency

in

none

out

none

destroyed

EAX, EBX, ECX, EDX

ComputeProcessorUnion

calculates <qwProcessorSharedCaps> by takes all processor’s capabilities, and keeping only the bits common to all processors.

in

none

out

none

destroyed

EAX EBX ECX ESI EDI

CreateInitialTDS

Creates the initial task description state and loads it for the current processor

in

EAX	processor number
ECX	entries on the stack to copy

out

none

destroyed

ESI, EDX, ECX, EDI

DetectCoprocessor

Probes the current processor for an math coprocessor and sets dwaProcessorCaps1 accordingly

in

EAX	processor number

out

none

destroyed

none

CR0_NE does not exist on a 386

DetectProcessors

Retrieves the information from the BSP, looks for APs and boots them

in

none

out

none

destroyed

EAX EBX ECX EDX ESI EDI

Lots of reboots/ lockups on Pentium 1 boxes

HyperThreading

FindMPTable

Locates the Intel multiprocessor table

in

none

out

none

destroyed

EAX, ECX, EDI

FindRSDP

Locates the RSDP table, if present. The location is stored for further reference

in

none

out

none

destroyed

ESI

FixInterrupts

Fix PIC issues: mask all ints at the PIC, then enable interrupts

in

none

out

none

destroyed

EAX

InitializeAllocator

Initializes the memory allocator tables

The memory allocator basically is a reference counter with a 4-level tree covering the entire canonical address space. The tree is formatted as follows:

each entry consists of the top 3 levels consists of one Qword, the 4th layer only uses one Dword as it does not need to contain 64-bit pointers. each entry can be either a pointer or a reference count. The two most significant bits indicate the usage. 00 - non-memory area, use count 01 - memory area, use count 10 - reference, mapped into physical space 11 - reference, mapped into linear space For level 4, only the most significant bit is considered. 1 - memory with use count 0 - non-memory with use count References contain the address in the entry, which is aligned to a page boundary, and a count of references/areas that have free memory in the least significant bits. Non-referenced areas simply consist of a reference count.

in

none

out

none

destroyed

all non-stack GPRs

allocation of kernel pages

these are the amount of occupied/unoccupied pages they should later be set to the actual pages that are used.

InitializeAPRegisters

loads the AP’s special registers with the values generated by the BSP this also waits for the BSP to present the data

in

none

out

none

destroyed

none

this is detrimental to speed on P4/ HTT processors

InitializeKernelHeap

Loads pointers for all the needed structures

in

none

out

none

destroyed

EAX

InitializeGDT32

initializes the 32 bit GDT

in

none

out

none

destroyed

EAX ECX EDI

InitializeIDT32

Initializes the 32-bit IDT

in

none

out

none

destroyed

EAX ECX ESI EDI

replace with real handlers

InitializePIC

Brings the PIC into a known state

maps the master PIC’s irq’s 0-7 to the non-intel area maps the slave PIC’s irq’s 8-15 after the masters’

in

none

out

none

destroys

EAX, EBX

Socket-A Interrupt bug

Copied from the previous kernel generation. However there was an issue regarding PIT interrupts not firing. Masking interrupts should instead of disabling interrupts should fix this (according to brendan). PIC/PIT should be tested with Socket-A systems before removal of fixme

InitializePIT

Configure the PIT to a rate generator

in

none

out

none

destroyed

EAX

InitializeRTC

Initializes the RTC as an interrupt source

in

none

out

none

destroyed

none

InitializeRTC crashes some computers

possible cause

NMI’s get enabled,
register renaming

both fixed in current version, needs testing

in all cases, the code is currently not used and can safely be kept disabled

InitializeSyscalls

Registers the system call handlers

InitializeTSSAP

Creates an initial TSS for the current processor. All TSSes will share the IO permission bitmap of the other TSSes. The offset hereto has to be set bits.

in

ECX	the processor number

out

none

destroyed

EAX EDX EDI

InitializeTSSBSP

Initializes the TSS for the BSP, and all the setup required for the TSSes on other processors.

The TSSes are located after one another, and they share an IRB/IOPB. the topmost 256 ports of the address space are not supported to save a page per instance of the bitmap. This method allows that the version of a bitmap in any address space can simply be overridden by paging in different memory. The amount of CPUs that are supported by this method is at 511 (512*128 overflows the 16 bit offset to the bitmap) This is well above the hardcoded limit of 8 CPUs currently in place.

in

none

out

none

destroyed

EAX ECX EDX EDI

PrintCPUCaps

in

EAX	line number
EBX	caps 1
EDX	caps 2

PrintAPICLine

Prints the APIC Bus frequency

in

none

out

none

destroyed

EAX ECX EDX

PrintHex4

Converts a dword value to hex and emit it to a string

in

ESI	location to write
EDX	value to convert

out

none

destroyed

ESI

PrintInitLine

prints the initalizer line

ProcessorDiagnostic

Gets the CPU, VM and related information

in

EAX	index to use

out

none

destroyed

EAX EBX ECX EDX ESI

The procedure is as follows

test eflags for ID and AC bits
run the divtest
use the information to classify the processor as 386, 486+ w/o cpuid or 486+ w/ cpuid
for 386s, check for FPU, and set cpu info accordingly
for 486+ w/o cpuid, check for cyiricies with cpuid disabled and turn it on if passed, then treat it as 486+ with cpuid
for remaining 486+s, check for FPU presence and enable 486 instruction set in info
for 486+s with cpuid, check for original signature, if known branch to that cpu’s subroutine and configure it further
for all unknown processors remaining, blindly load first cpuid capabilities set

fix MMX and EMMI detection

Extended CPUID

fix cpuid bugs for intel class chips

AND EDX, 0xffffffff

(CPUID_APIC | CPUID_SYSENTER)

SetCPUBits

loads CR0/CR4 with the appropriate bits

cyrices (and possibly others) do not support cr4

so do no write it when we don’t need it

in

ECX	processor number

out

none

destroyed

EAX

set SSE bits in CR4

Runtime components

Common routines during kernel operation.

AddMemoryReference32

Ups the reference count to a memory location.

in

EAX	memory address to reference

out

none

destroyed

ECX, EDX

AllocateGDT32Entry

finds an empty GDT entry and allocates it.

in

none

out

EAX	GDT segment selector
CF	clear on success, set if the GDT is fully occupied

destroyed

none

AllocateIDTEntry

Tries to allocate one entry in the IDT

in

EAX	interrupt number

out

CF	clear on success, set if the entry has been taken

destroyed

none

fail stub

AllocateMemory32

Tries to allocate a piece of memory To allow for full userspace control of memory

in

none

out

EAX	physical address of allocated page of memory
CF	set if no memory could be allocated

destroyed

ECX, EDX

ClearPageTableEntry32Hole

Clears a page table entry if it is mapped and not used by the kernel.

This version uses the paging holes to temporarily map in the tables for write access. Other write methods may be faster

This assumes the processor is in 32-bit paged mode

in

EDX	the physical address of the page directory
EDI	the virtual address to unmap

out

EDX	the page table entry
CF	clear if the entry was unmapped, set if the write could not be performed

destroyed

EAX, EDX, EDI

improve speed here.

improve speed

DumpCRState

prints a crashdump with the CRx registers

in

none

out

none

destroyed

none

DumpIntState

prints a crashdump from an interrupt stackframe

in

EBP	pointer to top of interrupt frame
EAX	interrupt/exception number

out

none

destroyed

none

DumpRegState

Prints a crashdump from a PUSHAD image

in

EBP	pointer to PUSHAD image

out

none

destroyed

none

EnableIRQ

Enables one IRQ at the PIC

in

EAX	interrupt number

out

none

destroyed

none

FillKernelPageDirectory

Fills a page directory with default values

in

EDI	virtual address of the first page table
EBX	virtual address of the page directory
ESI	physical address of the first page table
EDX	physical address of the page directory

out

none

destroyed

EDI, ESI, ECX

FillKernelPageTable

Fills a page table with all the kernel pages

in

EDI	virtual address to write to
ESI	physical address of the page table
EDX	physical address of the page directory

out

none

destroyed

EDI ECX

FillPage32

Fills a page in physical memory with all ones

Maps the page into a predefined memory hole, then clears it.

Assumes the processor is in 32-bit paged mode

in

EAX	offset of the page

out

none

destroyed

none

FillTaskDescriptor32

Fills a page with a task descriptor and a schedulable stack This descriptor is designed to run 32-bit applications

in

EDI	location to write
ESI	location of page in target virtual memory
EDX	location of page in physical memory
EBX	starting EIP

out

EBX	pointer to GPR contents

destroyed

EAX

FillTaskDescriptorRemote32

Fills a task structure in physical memory

Maps the page into a predefined memory hole, then clears it.

Assumes the processor is in 32-bit paged mode

in

ESI	location of page in target virtual memory
EAX	location of page in physical memory
EBX	starting EIP
EDX	starting ESP out: none

destroyed

EBX, ESI, EDI

FindL3MemoryTable32

Locks onto the memory address controlling this entry

in

EAX	address to add reference to

out

CL	level of this entry
CH	locks taken
EDX	memory location governing this entry (points to dword containing reference count)

destroyed

ECX

resolve virtual pointers

FindL2MemoryTable32

Increases the reference count on one memory unit

in

EAX	address to add reference to
ESI	address of the corresponding L2 memory table

out

CL	level of this entry
CH	locks taken
EDX	memory location governing this entry

destroyed

ECX

resolve virtual pointers

FindL1MemoryTable32

Increases the reference count on one memory unit

in

EAX	address to add reference to
ESI	address of the corresponding L1 memory table

out

CL	level of this entry
CH	locks taken
EDX	memory location governing this entry

destroyed

ECX(16:31)

GetTssBitmapStatus32

Checks whether a page in the TSS has been mapped

in

EDI	the page’s index

out

CF	set if the page can be written to, clear if unmapped

destroyed

EAX

HardwareDelay

Delays for a short period of time.

in

none

out

none

destroyed

none

InsertLargePage32

adds a given large page to a page directory

in

EAX	4M Page address
EBX	Directory address
EDX	address to map to

out

CF	success if clear, error if set

destroyed

none

InsertPageTable32

adds a given page table to a page directory

in

EAX	table address
EBX	directory address
EDX	address to map to

out

CF	success if clear, error if set

destroyed

none

InsertPage32

adds an entry to the page table.

The entry may not be allocated before writing

in

EDX	location of the page table
ESI	physical address and access bytes of the page to map
EDI	virtual address to map to

out

CF	success if clear, error if set

destroyed

none

InsertTSSBitmapPage

Maps a page into the shared TSS area. Checks if the map can be performed, then sets the map atomically.

in

EAX	address of the page to map
EDI	index of the page to map (0-1)

out

CF	clear on success, set on failure

destroyed

ECX

write 486 overlay (cmpxchg)

proper page flushing

IntHandler

Provides the default interrupt handlers. These functions are called by the processor, and should not be accessed from applications

in

do not call

out

none

destroyed

none

MapL1Table32

Inserts a new leaf into the memory allocator map

in

EAX	memory address to reference
EDI	memory location to point to

out

none

destroyed

ECX, EDX

MapL2Table32

Ups the reference count to a memory location.

in

EAX	memory address to reference
EDI	memory location to point to

out

none

destroyed

ECX, EDX

Oops

Kills the thread and prints a report to port e9

in

eax	line number

out

destroyed

does not return

ReadPageTableEntry32Hole

Sets a page table entry if allowed.

This version uses the paging holes to temporarily map in the tables for write access. Other write methods may be faster

This assumes the processor is in 32-bit legacy paged mode

in

EDX	the physical address of the page directory
EDI	the virtual address to look up

out

CF	clear for bottom level entries, set for higher-level entries
EDX	the entry stored

destroyed

EAX, EDX, EDI

improve speed here.

improve speed

ReleaseMemoryLocks

Releases memory locks as given by findmemory and relatives

in

CH	bitmask of locks in need of releasemment

out

none

destroyed

CH, EDX

RemoveMemoryReference32

Decrements the reference count to a memory location.

in

EAX	memory address to reference

out

none

destroyed

ECX, EDX

RequestAddress32

Requests ownership of one location in the physical address space

in

EAX	memory address contained in the requested page

out

EAX	zero on success, all ones on failure
CL	level of this entry

destroyed

EDX

RequestGDT32Entry

Requests ownership of one specified GDT entry

in

EAX	selector number

out

CF	clear if the entry was allocated, set on failure

destroyed

none

RequestMemory32

Requests ownership of one memory location

This function will fail if the location is in use or not marked as memory

in

EAX	memory address contained in the requested page

out

EAX	zero on success, all ones on failure
CL	level of this entry

destroyed

ECX, EDX

SetIDTEntry32

Points an IDT entry to a given function

in

EAX	Interrupt number
EDX	Address of the function

out

none

destroyed

EAX

SetIDTEntry32Public

Points an IDT entry to a given function, and allow it to be called from userland

in

EAX	Interrupt number
EDX	Address of the function

out

none

destroyed

EAX

SetPageDirEntry32Hole

Sets a page directory entry if allowed.

This version uses the paging holes to temporarily map in the tables for write access. Other write methods may be faster

This assumes the processor is in 32-bit paged mode

in

EDX	the physical address of the page directory
ESI	the physical address and bits of the entry to map
EDI	the virtual address to map to

out

CF	clear on success, set if the write could not be performed

destroyed

EAX, EDX, EDI

improve speed here.

SetPageTableEntry32Hole

Sets a page table entry if allowed.

This version uses the paging holes to temporarily map in the tables for write access. Other write methods may be faster

This assumes the processor is in 32-bit paged mode

in

EDX	the physical address of the page directory
ESI	the physical address and bits of the entry to map
EDI	the virtual address to map to

out

CF	clear on success, set if the write could not be performed

destroyed

EAX, EDX, EDI

improve speed here.

improve speed

SwitchGDT32

Switches to the 32 bit GDT

in

none

out

none

destroyed

none

SwitchIDT32

Switches to the 32 bit IDT

in

none

out

none

destroyed

none

QueueThread

adds a thread to the execution queue

in

ECX	CPU number
EDX	Address space field
ESI	Task Description Structure field

out

CF	set on failure, clear on success

destroyed

none

WritePage32

adds an entry to the page table.

This version does not perform any checking. Use InsertPage32 when necessary

in

EDX	location of the page table
ESI	physical address and access bytes of the page to map
EDI	virtual address to map to

out

none

destroyed

none

WriteAddressSpace32

Map and fill out a set of address space structures

Maps a pagedirectory and pagetable, then load them with the appropriate values.

in

EAX	physical location of pagetable
EBX	physical location of page directory

out

none

destroyed

unknown

ZeroPage32

Zeroes a page in physical memory

Maps the page into a predefined memory hole, then clears it.

Assumes the processor is in 32-bit paged mode

in

EAX	offset of the page

out

none

destroyed

none

Scheduler components

These functions change between tasks.

Schedule

Causes execution to be suspended and the next thread to be readied.

in

none

out

none

destroyed

none	the task is suspended and the state is restored upon return

Scheduler_Common

this function will browse through the scheduler list and pick a new task to run.

in

EBX	processor number * 8

out

none

destroyed

unknown

Address space switches

Scheduler_Launchuser

return stub that gets us into userland

System calls

These functions form the interface to all userspace applications

Entrypoint_Int

Contains the handler for system calls when accessed via the syscall interrupt.

in

EAX	function number
EBX	argument 1
ESI	argument 2
EDI	argument 3

out

EAX	return value if applicable
EBX	return value if applicable
ESI	return value if applicable
EDI	return value if applicable
CF	clear on success

destroyed

ECX, EDX, depending on syscall: EAX, EBX, ESI, EDI

Entrypoint_Main

Does the actual decoding of the system call

in

EAX	function number
EBX	argument
ESI	argument
EDI	argument

out

EAX	return value if applicable
EBX	return value if applicable
ESI	return value if applicable
EDI	return value if applicable
CF	clear on success

destroyed

ECX, EDX, depending on syscall: EAX, EBX, ESI, EDI

KernelVersion

Returns the kernel version

Privilege level

Informational

in

EAX = 0x00000000

out

EAX = version: bits 0-15 = revision, 16-23 = minor, 24-31 = major

destroyed

none

BlockAlloc

Allocates memory and maps it to userspace

Returns the amount of memory actually mapped

Privilege level

User

in

EAX = 0x00000001
EBX = amount of memory to map (pages)
EDI = starting page in current address space

out

EBX = amount of memory actually mapped

destroyed

EAX EDX ESI

write address to page table if applicable

release this address

OOPS

BlockAllocEx

Allocates a specific piece memory and maps it to userspace

Returns the amount of memory actually mapped

Privilege level

User

in

EAX = 0x00000002
EBX = amount of memory to map (pages)
ESI = starting page in physical memory
EDI = starting page in current address space

out

EBX = amount of memory actually mapped

destroyed

EAX EDX ESI EDI ECX

write address to page table if applicable

release this address

BlockAllocPhys

Allocates an area in the physical range and maps it to userspace

Returns the amount of memory actually mapped

Privilege level

Driver

in

EAX = 0x00000003
EBX = amount of memory to map (pages)
ESI = starting page in physical memory
EDI = starting page in current address space

out

EBX = amount of memory actually mapped

destroyed

EAX EDX ESI EDI ECX

write address to page table if applicable

release this address

EnterV8086

Makes the thread enter v8086 mode

in

EAX	0x00000004
ESI	CS:IP
EDI	EFLAGS
EBX	monitor address

AllocateIoBitmap

Allocates pages for the I/O permission bitmap.

Due to the handling of the bitmaps in the TSS, the top 256 ports are inaccessible.

in

EAX	0x00000005
DI	allocate the part of the bitmap starting with this port number
BX	the amount of ports that are requested
ESI	the starting physical page to use. Supply all ones to let the kernel choose free pages

out

CF	set if the area was not fully mapped

destroyed

EAX, EBX, ECX, EDX, ESI, EDI

PortAlloc

Allocates pages for the I/O permission bitmap.

Due to the handling of the bitmaps in the TSS, the top 256 ports are inaccessible.

in

EAX	0x00000006
DI	allocate the part of the bitmap starting with this port number
BX	the amount of ports that are requested

out

CF	set if the area was not fully mapped

destroyed

EAX, EBX, ECX, EDX, ESI, EDI

add port allocation management and safety stuff

step up from first page to second

AllocatePageTable

Maps a page table into the page directory to allow for small pages to be used

in

EAX	0x00000007
EDI	the virtual address that this page table needs to cover
ESI	the starting physical page to use. Supply all ones to let the kernel choose a free page

out

CF	set if the mapping could not be done

destroyed

EAX, EBX, ECX, EDX, ESI, EDI

update destroyed regs

check RequestMemory32 AllocateMemory32 InsertPageTable32 ZeroPage32 RemoveMemoryReference32

BlockAllocExL

Allocates an area of memory in the physical range and maps it to userspace

Returns the amount of memory actually mapped

Privilege level

Driver

in

EAX = 0x00000008
EBX = amount of memory to map (large pages)
ESI = starting page in physical memory
EDI = starting page in current address space

out

EBX = amount of memory actually mapped

destroyed

EAX EDX ESI EDI ECX

check destroyed regs

release this address

BlockAllocPhysL

Allocates an area in the physical range and maps it to userspace

Returns the amount of memory actually mapped

Privilege level

Driver

in

EAX = 0x00000009
EBX = amount of memory to map (large pages)
ESI = starting page in physical memory
EDI = starting page in current address space

out

EBX = amount of memory actually mapped

destroyed

EAX EDX ESI EDI ECX

check destroyed regs

release this address

AllocateIRBitmap

Allocates a page for the Interrupt Redirection Bitmap

in

EAX	0x0000000A
ESI	the starting physical page to use. Supply all ones to let the kernel choose free pages

out

CF	set if the area was not fully mapped

destroyed

EAX, EBX, ECX, EDX, ESI

SetRedirectBits

Sets redirection bits in the Interrupt Redirection Bitmap

in

EAX	0x0000000B
ESI	the starting interrupt number
EDI	the amount of entries to set
EBX	zero to enable redirects, nonzero to disable

out

CF	set if the area was not fully mapped

destroyed

EAX, EBX, ECX, EDX, ESI

ManageMemoryL1

Insert a node into the memory manager tree at the 1st level The node will describe 2M of memory in 4K units

in

EAX	0x0000000C
ESI	the page in physical memory to be used. Supply all ones to let the kernel choose a free page
EDI	the physical address that the node should contain

out

CF	set if the node couldn’t be mapped

destroyed

unknown

ManageMemoryL2

Insert a node into the memory manager tree at the 3rd level The node will describe 1G of memory in 2M units

in

EAX	0x0000000D
ESI	the page in physical memory to be used. Supply all ones to let the kernel choose a free page
EDI	the physical address that the node should contain

out

CF	set if the node couldn’t be mapped

destroyed

unknown

ESI usage?

Yield

Yield the execution resource to another program

in

EAX	0x0000000E

out

none

destroyed

none

CreateAddressSpace

Creates a new set of paging structures

in

EAX	0x0000000F
ESI	the page in physical memory to be used. Supply all ones to let the kernel choose a free page
EDI	the virtual address to map the page table

out

CF	set if the set could not be created

destroyed

unknown

CreateThread

Creates a new thread structure

in

EAX	0x00000010
ESI	the page in physical memory to be used. Supply all ones to let the kernel choose a free page
EDI	the virtual address to map the thread structure
EBX	the entry point of the new thread
EDX	the initial value for the new thread’s stackpointer

out

CF	set if the thread could not be created

destroyed

unknown

CreateThreadRemote

Creates a new thread structure in a different address space

in

EAX	0x00000011
ESI	the page in physical memory to be used. Supply all ones to let the kernel choose a free page
EDI	the virtual address to map the thread structure
EBX	the entry point of the new thread
EDX	the initial value for the new thread’s stackpointer
ECX	the handle of the address space

out

CF	set if the thread could not be created

destroyed

unknown

Race condition. Read-addref-read pattern needs to be added

TransferPage

Copies a virtual-to-physical mapping from the current address space to a remote address space

in

EAX	0x00000012
ESI	location of the page in the current address space
EDI	virtual address to copy the mapping to
EBX	handle of the remote address space

out

CF	clear on success, set on failure

Race condition. Read-addref-read pattern needs to be added

AllocatePageTableRemote

Maps a page table into the page directory to allow for small pages to be used

in

EAX	0x00000013
EDI	the virtual address that this page table needs to cover
ESI	the starting physical page to use. Supply all ones to let the kernel choose a free page
EBX	handle of the remote address space

out

CF	set if the mapping could not be done

destroyed

EAX, EBX, ECX, EDX, ESI, EDI

update destroyed regs

check RequestMemory32 AllocateMemory32 InsertPageTable32 ZeroPage32 RemoveMemoryReference32

Race condition. Read-addref-read pattern needs to be added

BlockDealloc

Removes references to a section of memory to allow for small pages to be used

in

EAX	0x00000014
ESI	The starting virtual address to deallocate
EDI	The ending virtual address to deallocate

out

CF	set if the mapping could not be completed
EAX	the last virtual address unmapped.

destroyed

ECX, EDX, EDI

Yank

Run privileged test code

Will not stay here forever

Currently uses a really ugly hack to change video modes

in

EAX = 0x00000015 EDX = mode number

out

CF = CF value returned by the bios

destroyed

EAX, ECX, EDX

Interrupt Handlers

These functions assure a proper handling of exceptions and standard interrupts

IsrNMHandler

Handles the coprocessor exceptions

in

none

out

none

destroyed

none

segment register breakage

IsrGPFHandler32

handles the GPF exception

in

none

out

none

destroyed

none

Check whether the stored state is consistent.

IsrPFHandler32

handles the pagefault exception

in

none

out

none

destroyed

none

IrqRTCHandler

acknowledges the RTC timer interrupt and updates the time

in

none

out

none

destroyed

none

causes panic on Bochs due to kb overflow

Data storage

Contains all variables, pointers and preallocated datastructures

lpBootloaderData

lpBootloaderData: DD 0

holds the address of the structure passed by the bootloader

lpRamdisk

lpRamdisk: DD 0

holds the base address of the ramdisk. GRUB uses the mb structure

szaHostName

szaHostName: TIMES 8 * 16 DB 0

contains the name of the host (processor or vm) for each processor

baProcessorArch

baProcessorArch: TIMES 8 DB 0

contains the family, needed for MSRs, APIC, IOAPIC and related stuff values: 0 - Unknown architecture 1 - Intel 386 (external FPU) 2 - Intel 486+ (internal FPU, intel MSRs, L.APIC) 3 - AMD 4 - Cyrix (Cyrix MSRs)

bcdaProcessorVersion

bcdaProcessorVersion: TIMES 8 DD 0

contains an unpacked BCD version number of each processor: family.major.minor.revision

dwaProcessorCaps1

dwaProcessorCaps1: TIMES 8 DD 0

contains a bitmask of host capabilities for each processor the bits generally correspond to cpuid flags, however, the startup code filters the broken/unsupported/disabled features so to make these readings more accurate. bit 0 - FPU present

dwaProcessorCaps2

dwaProcessorCaps2: TIMES 8 DD 0

contains a bitmask of host capabilities for each processor. see dwaProcessorCaps1

dwaProcessorSharedCaps

the capabilities shared by all processors

dwaProcessorMaxCaps

all the capabilities that are supported by at least one processor

dwProcessorCount

dwProcessorCount: DD 1

the number of logical processors in the systems

lpRSDPBase

lpRSDPBase: DD 0

the location of the RSDP structure

lpMPTablePointer

lpMPTablePointer: DD 0

the location of the MP pointer

lpKernelBasePageTable

lpKernelBasePageTable: DD 0

contains a pointer to the base kernel page table (386 paging)

lpKernelBasePAETable

lpKernelBasePAETable: DD 0

contains a pointer to the base kernel page table (PAE/LM paging)

lpAddressSpaceMirror

lpAddressSpaceMirror: DD 0

contains a pointer to the location where the current address space information structure is mapped

lpDirectoryTableMirror

lpDirectoryTableMirror: DD 0

contains a pointer to the location where the current page directory is mapped (if appropriate)

lp32BitGDT

lp32BitGDT: DD 0

the location of the 32 bit gdt

lp32BitIDT

lp32BitIDT: DD 0

the location of the 32 bit IDT

lp64BitIDT

lp64BitIDT: DD 0

the location of the 64 bit IDT

lpL4MemoryTable

lpL4MemoryTable: DD 0

the 4th level memory reference structure.

lpL3MemoryTable

lpL3MemoryTable: DD 0

the 3rd level memory reference structure.

lpL2MemoryTable

lpL2MemoryTable: DD 0

the 2nd level memory reference structure. (comparable to PAE page directory)

lpL1MemoryTable

lpL1MemoryTable: DD 0

the 1st level memory reference structure. (comparable to PAE table: covers 0-2M)

lpHeapTop

lpHeapTop: DD 0

the current top of the heap

lpPageTableSource

lpPageTableSource: DD 0

the sample table that contains all the pages required by the kernel

lpPagingLocks

lpPagingLocks: DD 0

holds the lock bits for the paging hole

lpMMTableHoles

lpMMTableHoles: DQ 0

points to four consecutive pages where parts of the paging structures can be mapped into

lpPagingHoles

lpPagingHoles: DQ 0

points to four consecutive pages where parts of the paging structures can be mapped into

lpPagingKernelTables

lpPagingKernelTables: DQ 0

points to four consecutive pages where the paging structures for the kernel are offset + 0k - page table offset + 4k - page directory offset + 8k - 3rd level offset + 12k - top level

lpZeroHole

lpZeroHole: DQ 0

points to a page that can be mapped for clearing pages.

lpFPUHole

lpFPUHole: DQ 0

points to a series of pages that can be mapped for lazily storing FPU state

lpFreePagingOffset

lpFreePagingOffset: DQ 0

the first address where allocations can be done

lpaCurrentAddressSpace

lpaCurrentAddressSpace: TIMES 8 DQ 0

contains the currently active address space for each processor

lpaCurrentProcess

lpaCurrentProcess: TIMES 8 DQ 0

contains the current task’s descriptor

lpaCurrentScheduleProc

lpaCurrentScheduleProc: TIMES 8 DQ 0

contains the location of the schedule_out function for the current thread

lpaSchedulerBase

lpaSchedulerBase: TIMES 8 DQ 0

contains the base of the scheduling table

lpaSchedulerOffset

lpaSchedulerOffset: TIMES 8 DQ 0

contains the offset into the scheduler table of the currently executing task

dwSchedulerLocks

dwSchedulerLocks: DD 0

contains access locks to the scheduler queue

lpaTSS

lpaTSS: TIMES 8 DQ 0

contains the location of the TSSs for each processor.

lpaIoBitmap

lpaIoBitmap: DQ 0

contains the location of the I/O permission bitmap

lpaLastFPUState:

lpaLastFPUState: TIMES 8 DQ 0

Contains the location of the FPU state to store.

baGDT32Bitmap

baGDT32Bitmap: DB 0x7f

contains a bitmap of the used GDT entries

bMasterMask

bMasterMask: DB 0

contains the interrupt mask for the Master PIC

bSlaveMask

bSlaveMask: DB 0

contains the interrupt mask for the Slave PIC

kernelimagesize

the size of the kernel image in bytes.

kernelbssstart

the page-aligned location where the bss should start.