X-Git-Url: http://git.mutantstargoat.com/user/nuclear/?p=bootcensus;a=blobdiff_plain;f=src%2Fboot%2Fboot2.s;h=5aeebaa66a0e54dd2c043bbec8620a808d5c8c32;hp=0f2bbf83e235ce5358188b1ab259b37b77e55bd1;hb=6ddbba6fc0185f6aaf64c661c303549eb088010f;hpb=c3e1be53f1269385b7f2b64442b85747e20b2412

diff --git a/src/boot/boot2.s b/src/boot/boot2.s
index 0f2bbf8..5aeebaa 100644
--- a/src/boot/boot2.s
+++ b/src/boot/boot2.s
@@ -15,19 +15,42 @@
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 # this is the second-stage boot loader
+# plus some other code that needs to run below 1mb (int86 implementation).
+
 	.code16
-	.section .boot2,"a"
+	.section .boot2,"ax"
 
-	.set drive_number, 0x7bec
-	# reset floppy drive
-	xor %ax, %ax
-	movb drive_number, %dl
-	int $0x13
+	.set main_load_addr, 0x100000
+
+	# make sure any BIOS call didn't re-enable interrupts
+	cli
+
+	# enter unreal mode
+	call unreal
+
+	movb $10, %al
+	call ser_putchar
+
+	call clearscr
+
+	# enable A20 address line
+	call enable_a20
 
-	# load initial GDT/IDT
+	# detect available memory
+	call detect_memory
+
+	# load the whole program into memory starting at 1MB
+	call load_main
+
+	#mov $0x13, %ax
+	#int $0x10
+
+	# load initial GDT
 	lgdt (gdt_lim)
+	# load initial IDT
 	lidt (idt_lim)
-	# enable protection
+
+	# enter protected mode for the first time
 	mov %cr0, %eax
 	or $1, %eax
 	mov %eax, %cr0
@@ -43,27 +66,16 @@
 	mov %ax, %gs
 	mov %ax, %fs
 
-	mov $0x18, %ax
-	ltr %ax
-
-	#movb $10, %al
-	#call ser_putchar
-
-	call clearscr
-
-	mov $hello, %esi
-	call putstr
-
-	# enable A20 line
-	call enable_a20
+	jmp main_load_addr
 
 	cli
-	hlt
+0:	hlt
+	jmp 0b
+
 
-hello: .asciz "Switched to 32bit\n"
 
 	.align 4
-gdt_lim: .word 31
+gdt_lim: .word 23
 gdt_base:.long gdt
 
 	.align 4
@@ -81,11 +93,6 @@ gdt:	# 0: null segment
 	# 2: data - base:0, lim:4g, G:4k, 32bit, avl, pres|app, dpl:0, type:data/rw
 	.long 0x0000ffff
 	.long 0x00cf9200
-	# 3: dummy TSS - base:tss, lim:103, type avail 32bit TSS, byte-granular
-	.short 103
-	.short tss
-	.short 0x8900
-	.short 0
 
 
 	.align 8
@@ -97,10 +104,7 @@ idt:	.space 104
 	.short 0x8f00
 	.short 0
 
-	.align 4
-tss:	.space 104
-
-gpf_msg: .asciz "GPF "
+gpf_msg: .asciz "GP fault "
 
 prot_fault:
 	mov (%esp), %eax
@@ -114,87 +118,251 @@ prot_fault:
 	call putchar
 	hlt
 
-ena20_msg: .asciz "A20 line enabled\n"
-foo_msg: .asciz "Foo\n"
+	.code16
+unreal:
+	# use the same GDT above, will use data segment: 2
+	lgdt (gdt_lim)
 
-enable_a20:
-	mov $foo_msg, %esi
+	mov %cr0, %eax
+	or $1, %ax
+	mov %eax, %cr0
+	jmp 0f
+
+0:	mov $0x10, %ax
+	mov %ax, %ds
+	mov %ax, %es
+	mov %ax, %fs
+	mov %ax, %gs
+	mov %ax, %ss
+
+	mov %cr0, %eax
+	and $0xfffe, %ax
+	mov %eax, %cr0
+
+	xor %ax, %ax
+	mov %ax, %ds
+	mov %ax, %es
+	mov %ax, %fs
+	mov %ax, %gs
+	mov %ax, %ss
+	ret
+
+mainsz_msg: .asciz "Main program size: "
+mainsz_msg2: .asciz " ("
+mainsz_msg3: .asciz " sectors)\n"
+
+first_sect: .long 0
+sect_left: .long 0
+cur_track: .long 0
+trk_sect: .long 0
+dest_ptr: .long 0
+
+load_main:
+	movl $main_load_addr, dest_ptr
+
+	# calculate first sector
+	mov $_boot2_size, %eax
+	add $511, %eax
+	shr $9, %eax
+	# add 1 to account for the boot sector
+	inc %eax
+	mov %eax, first_sect
+
+	# calculate the first track (first_sect / sect_per_track)
+	movzxw sect_per_track, %ecx
+	xor %edx, %edx
+	div %ecx
+	mov %eax, cur_track
+	# remainder is sector within track
+	mov %edx, trk_sect
+
+	mov $mainsz_msg, %esi
 	call putstr
-	jmp .La20done
+	mov $_main_size, %eax
+	mov %eax, %ecx
+	call print_num
 
-	call test_a20
-	jnc .La20done
-	call enable_a20_kbd
-	call test_a20
-	jnc .La20done
-	call enable_a20_fast
-	call test_a20
-	jnc .La20done
-	# keep trying ... we can't do anything useful without A20 anyway
-	jmp enable_a20
-.La20done:
-	mov $ena20_msg, %esi
+	mov $mainsz_msg2, %esi
 	call putstr
-	ret
 
-	# CF = 1 if A20 test fails (not enabled)
-test_a20:
-	mov $0x07c000, %ebx
-	mov $0x17c000, %edx
-	movl $0xbaadf00d, (%ebx)
-	movl $0xaabbcc42, (%edx)
-	subl $0xbaadf00d, (%ebx)
+	# calculate sector count
+	add $511, %eax
+	shr $9, %eax
+	mov %eax, sect_left
+
+	call print_num
+	mov $mainsz_msg3, %esi
+	call putstr
+
+	# read a whole track into the buffer (or partial first track)
+ldloop:
+	movzxw sect_per_track, %ecx
+	sub trk_sect, %ecx
+	push %ecx
+	call read_track
+
+	# debug: print the first 32bits of the track
+	#mov buffer, %eax
+	#call print_num
+	#mov $10, %al
+	#call putchar
+
+	# copy to high memory
+	mov $buffer, %esi
+	mov dest_ptr, %edi
+	mov (%esp), %ecx
+	shl $9, %ecx
+	add %ecx, dest_ptr
+	shr $2, %ecx
+	addr32 rep movsl
+
+	incl cur_track
+	# other than the first track which might be partial, all the rest start from 0
+	movl $0, trk_sect
+
+	pop %ecx
+	sub %ecx, sect_left
+	ja ldloop
+
+	# the BIOS might have enabled interrupts
+	cli
+
+	# just in case we were loaded from floppy, turn all floppy motors off
+	mov $0x3f2, %dx
+	in %dx, %al
+	and $0xf, %al
+	out %al, %dx
+
+	mov $10, %ax
+	call putchar
+
 	ret
 
-ena20_fast_msg: .asciz "Attempting fast A20 enable\n"
+rdtrk_msg: .asciz "Reading track: "
+rdcyl_msg: .asciz " - cyl: "
+rdhead_msg: .asciz " head: "
+rdsect_msg: .asciz " start sect: "
+rdlast_msg: .asciz " ... "
+rdok_msg: .asciz "OK\n"
+rdfail_msg: .asciz "failed\n"
 
-enable_a20_fast:
-	mov $ena20_fast_msg, %esi
+read_retries: .short 0
+
+	.set drive_number, 0x7bec
+read_track:
+	# set es to the start of the destination buffer to allow reading in
+	# full 64k chunks if necessary
+	mov $buffer, %bx
+	shr $4, %bx
+	mov %bx, %es
+	xor %ebx, %ebx
+
+	movw $3, read_retries
+
+read_try:
+	# print track
+	mov $rdtrk_msg, %esi
+	call putstr
+	mov cur_track, %eax
+	call print_num
+	mov $rdcyl_msg, %esi
 	call putstr
 
-	in $0x92, %al
-	or $2, %al
-	out %al, $0x92
-	ret
+	# calc cylinder (cur_track / num_heads) and head (cur_track % num_heads)
+	mov cur_track, %eax
+	movzxw num_heads, %ecx
+	xor %edx, %edx
+	div %ecx
 
-	.set KBC_DATA_PORT, 0x60
-	.set KBC_CMD_PORT, 0x64
-	.set KBC_STATUS_PORT, 0x64
-	.set KBC_CMD_RD_OUTPORT, 0xd0
-	.set KBC_CMD_WR_OUTPORT, 0xd1
+	# print cylinder
+	push %eax
+	call print_num
+	# print head
+	mov $rdhead_msg, %esi
+	call putstr
+	movzx %dx, %eax
+	call print_num
+	pop %eax
 
-	.set KBC_STAT_OUT_RDY, 0x01
-	.set KBC_STAT_IN_FULL, 0x02
+	# head in dh
+	mov %dl, %dh
 
-ena20_kbd_msg: .asciz "Attempting KBD A20 enable\n"
+	# cylinder low byte at ch and high bits at cl[7, 6]
+	mov %al, %ch
+	mov %ah, %cl
+	and $3, %cl
+	ror $2, %cl
 
-	# enable A20 line through the keyboard controller
-enable_a20_kbd:
-	mov $ena20_kbd_msg, %esi
+	# print start sector
+	mov $rdsect_msg, %esi
+	call putstr
+	mov trk_sect, %eax
+	call print_num
+	mov $rdlast_msg, %esi
 	call putstr
 
-	call kbc_wait_write
-	mov $KBC_CMD_WR_OUTPORT, %al
-	out %al, $KBC_CMD_PORT
-	call kbc_wait_write
-	mov $0xdf, %al
-	out %al, $KBC_DATA_PORT
-	ret
+	# start sector (1-based) in cl[0, 5]
+	mov trk_sect, %al
+	inc %al
+	and $0x3f, %al
+	or %al, %cl
+
+	# number of sectors in al
+	mov 2(%esp), %ax
+	# call number (2) in ah
+	mov $2, %ah
+	# drive number in dl
+	movb drive_number, %dl
+	int $0x13
+	jnc read_ok
 
-	# wait until the keyboard controller is ready to accept another byte
-kbc_wait_write:
-	in $KBC_STATUS_PORT, %al
-	and $KBC_STAT_IN_FULL, %al
-	jnz kbc_wait_write
+	# abort after 3 attempts
+	decw read_retries
+	jz read_fail
+
+	# error, reset controller and retry
+	xor %ah, %ah
+	int $0x13
+	jmp read_try
+
+read_fail:
+	mov $rdfail_msg, %esi
+	call putstr
+	jmp abort_read
+
+read_ok:
+	mov $rdok_msg, %esi
+	call putstr
+
+	# reset es to 0 before returning
+	xor %ax, %ax
+	mov %ax, %es
 	ret
 
+str_read_error: .asciz "Read error while reading track: "
+
+abort_read:
+	mov $str_read_error, %esi
+	call putstr
+	mov cur_track, %eax
+	call print_num
+	mov $10, %al
+	call putchar
+
+	cli
+0:	hlt
+	jmp 0b
+
+
 	# better print routines, since we're not constrainted by the 512b of
 	# the boot sector.
+	.global cursor_x
+	.global cursor_y
 cursor_x: .long 0
 cursor_y: .long 0
 
 putchar:
-	pusha
+	pushal
 	call ser_putchar
 
 	cmp $10, %al
@@ -220,7 +388,7 @@ putchar:
 	jnz 1f
 	call video_newline
 
-1:	popa
+1:	popal
 	ret
 	
 	# expects string pointer in esi
@@ -236,24 +404,24 @@ putstr:
 	# expects number in eax
 print_num:
 	# save registers
-	pusha
+	pushal
 
 	mov $numbuf + 16, %esi
 	movb $0, (%esi)
 	mov $10, %ebx
-.Lconvloop:
+convloop:
 	xor %edx, %edx
 	div %ebx
 	add $48, %dl
 	dec %esi
 	mov %dl, (%esi)
 	cmp $0, %eax
-	jnz .Lconvloop
+	jnz convloop
 
 	call putstr
 
 	# restore regs
-	popa
+	popal
 	ret
 
 
@@ -267,25 +435,25 @@ video_newline:
 0:	ret
 
 scrollup:
-	pusha
-	# move 80 * 24 lines from b8050 -> b8000
+	pushal
+	# move 80 * 24 lines from b80a0 -> b8000
 	mov $0xb8000, %edi
-	mov $0xb8050, %esi
-	mov $480, %ecx
-	rep movsl
-	# clear last line (b8780)
-	mov $0xb8780, %edi
+	mov $0xb80a0, %esi
+	mov $960, %ecx
+	addr32 rep movsl
+	# clear last line (b8f00)
+	mov $0xb8f00, %edi
 	xor %eax, %eax
-	mov $20, %ecx
-	rep stosl
-	popa
+	mov $40, %ecx
+	addr32 rep stosl
+	popal
 	ret
 
 clearscr:
 	mov $0xb8000, %edi
 	xor %eax, %eax
-	mov $500, %ecx
-	rep stosl
+	mov $1000, %ecx
+	addr32 rep stosl
 	ret
 
 	.set UART_DATA, 0x3f8
@@ -305,9 +473,9 @@ ser_putchar:
 0:	mov %al, %ah
 	# wait until the transmit register is empty
 	mov $UART_LSTAT, %dx
-.Lwait:	in %dx, %al
+wait:	in %dx, %al
 	and $LST_TREG_EMPTY, %al
-	jz .Lwait
+	jz wait
 	mov $UART_DATA, %dx
 	mov %ah, %al
 	out %al, %dx
@@ -316,407 +484,393 @@ ser_putchar:
 	ret
 
 
-	.code16
-logohack:
-	mov $0x13, %ax
-	int $0x10
-
-	# copy palette
-	mov $logo_pal, %si
-	xor %cl, %cl
-
-0:	xor %eax, %eax
-	mov $0x3c8, %dx
-	movb %cl, %al
-	outb %al, %dx
-	inc %dx
-	# red
-	movb (%si), %al
-	inc %si
-	shr $2, %al
-	outb %al, %dx
-	# green
-	movb (%si), %al
-	inc %si
-	shr $2, %al
-	outb %al, %dx
-	# blue
-	movb (%si), %al
-	inc %si
-	shr $2, %al
-	outb %al, %dx
-	add $1, %cl
-	jnc 0b
-
-	# copy pixels
-	pushw $0xa000
-	pop %es
-	mov $logo_pix, %eax
-	shr $4, %eax
-	#mov %ax, %ds
-	mov %ax, %gs
-	#mov $16000, %ecx
-	#rep movsl
 
-	mov $sintab, %eax
-	shr $4, %eax
-	mov %ax, %fs
+ena20_msg: .asciz "A20 line enabled\n"
 
-.Lframeloop:
-	xor %di, %di
-
-	movw $0, yval
-.Lyloop:
-	movw $0, xval
-.Lxloop:
-	# calc src scanline address -> bx
-	mov yval, %bx
-	shl $2, %bx
-	add frameno, %bx
-	xor %bh, %bh
-	mov %fs:(%bx), %cl
-	xor %ch, %ch
-	shr $5, %cx
-
-	mov yval, %ax
-	add %cx, %ax
-	# bounds check
-	cmp $200, %ax
-	jl 0f
-	mov $199, %ax
-
-0:	mov %ax, %bx
-	shl $8, %ax
-	shl $6, %bx
-	add %ax, %bx
-
-	# calc src x offset -> si
-	mov xval, %ax
-	shl $2, %ax
-	add frameno, %ax
-	xor %ah, %ah
-	mov %ax, %si
-	mov %fs:(%si), %cl
-	xor %ch, %ch
-	shr $5, %cx
-
-	mov xval, %ax
-	add %cx, %ax
-	# bounds check
-	cmp $320, %ax
-	jl 0f
-	mov $319, %ax
-
-0:	mov %ax, %si
-
-	mov %gs:(%bx, %si), %al
-
-	mov %al, %es:(%di)
-	inc %di
-
-	incw xval
-	cmpw $320, xval
-	jnz .Lxloop
-
-	incw yval
-	cmpw $200, yval
-	jnz .Lyloop
-
-	incw frameno
-
-	# wait vsync
-	mov $0x3da, %dx
-0:	in %dx, %al
-	and $8, %al
-	jnz 0b
-0:	in %dx, %al
-	and $8, %al
-	jz 0b
-	jmp .Lframeloop
-
-xval: .word 0
-yval: .word 0
-frameno: .word 0
-
-	# expects string pointer in ds:si
-ser_print_str:
-	pusha
-
-0:	mov (%si), %al
-	cmp $0, %al
-	jz .Lend
-	call ser_putchar
-	inc %si
-	jmp 0b
+enable_a20:
+	call test_a20
+	jnc a20done
+	call enable_a20_kbd
+	call test_a20
+	jnc a20done
+	call enable_a20_fast
+	call test_a20
+	jnc a20done
+	# keep trying ... we can't do anything useful without A20 anyway
+	jmp enable_a20
+a20done:
+	mov $ena20_msg, %esi
+	call putstr
+	ret
+
+	# CF = 1 if A20 test fails (not enabled)
+test_a20:
+	mov $0x07c000, %ebx
+	mov $0x17c000, %edx
+	movl $0xbaadf00d, (%ebx)
+	movl $0xaabbcc42, (%edx)
+	subl $0xbaadf00d, (%ebx)
+	ret
+
+	# enable A20 line through port 0x92 (fast A20)
+enable_a20_fast:
+	mov $ena20_fast_msg, %esi
+	call putstr
 
-.Lend:	popa
+	in $0x92, %al
+	or $2, %al
+	out %al, $0x92
 	ret
 
+ena20_fast_msg: .asciz "Attempting fast A20 enable\n"
+
+
+	# enable A20 line through the keyboard controller
+	.set KBC_DATA_PORT, 0x60
+	.set KBC_CMD_PORT, 0x64
+	.set KBC_STATUS_PORT, 0x64
+	.set KBC_CMD_RD_OUTPORT, 0xd0
+	.set KBC_CMD_WR_OUTPORT, 0xd1
+
+	.set KBC_STAT_OUT_RDY, 0x01
+	.set KBC_STAT_IN_FULL, 0x02
+
+enable_a20_kbd:
+	mov $ena20_kbd_msg, %esi
+	call putstr
+
+	call kbc_wait_write
+	mov $KBC_CMD_WR_OUTPORT, %al
+	out %al, $KBC_CMD_PORT
+	call kbc_wait_write
+	mov $0xdf, %al
+	out %al, $KBC_DATA_PORT
+	ret
 
+ena20_kbd_msg: .asciz "Attempting KBD A20 enable\n"
+
+	# wait until the keyboard controller is ready to accept another byte
+kbc_wait_write:
+	in $KBC_STATUS_PORT, %al
+	and $KBC_STAT_IN_FULL, %al
+	jnz kbc_wait_write
+	ret
 
 numbuf: .space 16
 
-logo_pal:
-	.incbin "logo.pal"
 
+detect_memory:
+	mov $memdet_e820_msg, %esi
+	call putstr
+	call detect_mem_e820
+	jnc memdet_done
+	mov $rdfail_msg, %esi
+	call putstr
+
+	mov $memdet_e801_msg, %esi
+	call putstr
+	call detect_mem_e801
+	jnc memdet_done
+	mov $rdfail_msg, %esi
+	call putstr
+
+	mov $memdet_88_msg, %esi
+	call putstr
+	call detect_mem_88
+	jnc memdet_done
+	mov $rdfail_msg, %esi
+	call putstr
+
+	# just panic...
+	mov $memdet_fail_msg, %esi
+	call putstr
+0:	hlt
+	jmp 0b
+
+memdet_done:
+	mov $rdok_msg, %esi
+	call putstr
+	ret
+
+memdet_fail_msg: .ascii "Failed to detect available memory!\n"
+		 .ascii "Please file a bug report: https://github.com/jtsiomb/pcboot/issues\n"
+		 .asciz " or contact me through email: nuclear@member.fsf.org\n"
+memdet_e820_msg: .asciz "Detecting RAM (BIOS 15h/0xe820)... "
+memdet_e801_msg: .asciz "Detecting RAM (BIOS 15h/0xe801)... " 
+memdet_88_msg:	 .asciz "Detecting RAM (BIOS 15h/0x88, max 64mb)... "
+
+	# detect extended memory using BIOS call 15h/e820
+detect_mem_e820:
+	movl $0, boot_mem_map_size
+
+	mov $buffer, %edi
+	xor %ebx, %ebx
+	mov $0x534d4150, %edx
+
+e820_looptop:
+	mov $0xe820, %eax
+	mov $24, %ecx
+	int $0x15
+	jc e820_fail
+	cmp $0x534d4150, %eax
+	jnz e820_fail
+
+	# skip areas starting above 4GB as we won't be able to use them
+	cmpl $0, 4(%edi)
+	jnz e820_skip
+
+	# only care for type 1 (usable ram), otherwise ignore
+	cmpl $1, 16(%edi)
+	jnz e820_skip
+
+	mov buffer, %eax
+	mov $boot_mem_map, %esi
+	mov boot_mem_map_size, %ebp
+	# again, that's [ebp * 8 + esi]
+	mov %eax, (%esi,%ebp,8)
+
+	# skip areas with 0 size (also clamp size to 4gb)
+	# test high 32bits
+	cmpl $0, 12(%edi)
+	jz e820_highzero
+	# high part is non-zero, make low part ffffffff
+	xor %eax, %eax
+	not %eax
+	jmp 0f
+
+e820_highzero:
+	# if both high and low parts are zero, ignore
+	mov 8(%edi), %eax
+	cmpl $0, %eax
+	jz e820_skip
+
+0:	mov %eax, 4(%esi,%ebp,8)
+	incl boot_mem_map_size
+
+e820_skip:
+	# terminate the loop if ebx was reset to 0
+	cmp $0, %ebx
+	jz e820_done
+	jmp e820_looptop
+
+e820_done:
+	clc
+	ret
+
+e820_fail:
+	# if size > 0, then it's not a failure, just the end
+	cmpl $0, boot_mem_map_size
+	jnz e820_done
+
+	stc
+	ret
+
+
+	# detect extended memory using BIOS call 15h/e801
+detect_mem_e801:
+	mov $boot_mem_map, %esi
+	mov boot_mem_map_size, %ebp
+	movl $0, (%ebp)
+
+	xor %cx, %cx
+	xor %dx, %dx
+	mov $0xe801, %ax
+	int $0x15
+	jc e801_fail
+
+	cmp $0, %cx
+	jnz 0f
+	cmp $0, %ax
+	jz e801_fail
+	mov %ax, %cx
+	mov %bx, %dx
+
+0:	movl $0x100000, (%esi)
+	movzx %cx, %eax
+	# first size is in KB, convert to bytes
+	shl $10, %eax
+	jnc 0f
+	# overflow means it's >4GB, clamp to 4GB
+	mov $0xffffffff, %eax
+0:	mov %eax, 4(%esi)
+	incl boot_mem_map_size
+	cmp $0, %dx
+	jz e801_done
+	movl $0x1000000, 8(%esi)
+	movzx %dx, %eax
+	# second size is in 64kb blocks, convert to bytes
+	shl $16, %eax
+	jnc 0f
+	# overflow means it's >4GB, clamp to 4GB
+	mov $0xffffffff, %eax
+0:	mov %eax, 12(%esi)
+	incl boot_mem_map_size
+e801_done:
+	clc
+	ret
+e801_fail:
+	stc
+	ret
+
+detect_mem_88:
+	# reportedly some BIOS implementations fail to clear CF on success
+	clc
+	mov $0x88, %ah
+	int $0x15
+	jc x88_fail
+
+	cmp $0, %ax
+	jz x88_fail
+
+	# ax has size in KB, convert to bytes in eax
+	and $0xffff, %eax
+	shl $10, %eax
+
+	mov $boot_mem_map, %esi
+	movl $0x100000, (%esi)
+	mov %eax, 4(%esi)
+
+	movl $1, boot_mem_map_size
+	clc
+	ret
+
+x88_fail:
+	stc
+	ret
+
+
+	.global boot_mem_map_size
+boot_mem_map_size: .long 0
+	.global boot_mem_map
+boot_mem_map: .space 128
+
+
+# this is not boot loader code. It's called later on by the main kernel
+# code in 32bit protected mode. It's placed here because it needs to be
+# located in base memory as it returns and runs in real mode.
+	.code32
+	.align 4
+	# place to save the protected mode IDTR pseudo-descriptor
+	# with sidt, so that it can be restored before returning
+	.short 0
+saved_idtr:
+idtlim:	.short 0
+idtaddr:.long 0
+	# real mode IDTR pseudo-descriptor pointing to the IVT at addr 0
+	.short 0
+rmidt:	.short 0x3ff
+	.long 0
+
+saved_esp: .long 0
+saved_ebp: .long 0
+saved_eax: .long 0
+saved_es: .word 0
+saved_ds: .word 0
+saved_flags: .word 0
+
+	# drop back to unreal mode to call 16bit interrupt
+	.global int86
+int86:
+	push %ebp
+	mov %esp, %ebp
+	pushal
+	cli
+	# save protected mode IDTR and replace it with the real mode vectors
+	sidt (saved_idtr)
+	lidt (rmidt)
+
+	# modify the int instruction. do this here before the
+	# cs-load jumps, to let them flush the instruction cache
+	mov $int_op, %ebx
+	movb 8(%ebp), %al
+	movb %al, 1(%ebx)
+
+	# long jump to load code selector for 16bit code (6)
+	ljmp $0x30,$0f
+0:
+	.code16
+	# disable protection
+	mov %cr0, %eax
+	and $0xfffe, %ax
+	mov %eax, %cr0
+	# load cs <- 0
+	ljmp $0,$0f
+0:	# zero data segments
+	xor %ax, %ax
+	mov %ax, %ds
+	mov %ax, %es
+	mov %ax, %ss
+	nop
+
+	# load registers from the int86regs struct
+	# point esp to the regs struct to load registers with popa/popf
+	mov %esp, saved_esp
+	mov %ebp, saved_ebp
+	mov 12(%ebp), %esp
+	popal
+	popfw
+	pop %es
+	pop %ds
+	# ignore fs and gs for now, don't think I'm going to need them
+	mov saved_esp, %esp
+
+	# move to the real-mode stack, accessible from ss=0
+	# just in case the BIOS call screws up our unreal mode
+	mov $0x7be0, %esp
+
+	# call 16bit interrupt
+int_op:	int $0
+	# BIOS call might have enabled interrupts, cli for good measure
+	cli
+
+	# save all registers that we'll clobber before having the
+	# chance to populate the int86regs structure
+	mov %eax, saved_eax
+	mov %ds, saved_ds
+	mov %es, saved_es
+	pushfw
+	pop %ax
+	mov %ax, saved_flags
+
+	# re-enable protection
+	mov %cr0, %eax
+	or $1, %ax
+	mov %eax, %cr0
+	# long jump to load code selector for 32bit code (1)
+	ljmp $0x8,$0f
+0:
+	.code32
+	# set data selector (2) to all segment regs
+	mov $0x10, %ax
+	mov %ax, %ds
+	mov %ax, %es
+	mov %ax, %ss
+	nop
+
+	# point the esp to our regs struct, to fill it with pusha/pushf
+	mov saved_ebp, %ebp
+	mov 12(%ebp), %esp
+	add $38, %esp
+	mov saved_ds, %ax
+	pushw %ax
+	mov saved_es, %ax
+	pushw %ax
+	mov saved_flags, %ax
+	pushw %ax
+	mov saved_eax, %eax
+	pushal
+	mov saved_esp, %esp
+
+	# restore 32bit interrupt descriptor table
+	lidt (saved_idtr)
+	sti
+	popal
+	pop %ebp
+	ret
+
+
+	# buffer used by the track loader ... to load tracks.
 	.align 16
-logo_pix:
-	.incbin "logo.raw"
-
-sintab:
-	.byte 127
-	.byte 130
-	.byte 133
-	.byte 136
-	.byte 139
-	.byte 143
-	.byte 146
-	.byte 149
-	.byte 152
-	.byte 155
-	.byte 158
-	.byte 161
-	.byte 164
-	.byte 167
-	.byte 170
-	.byte 173
-	.byte 176
-	.byte 179
-	.byte 182
-	.byte 184
-	.byte 187
-	.byte 190
-	.byte 193
-	.byte 195
-	.byte 198
-	.byte 200
-	.byte 203
-	.byte 205
-	.byte 208
-	.byte 210
-	.byte 213
-	.byte 215
-	.byte 217
-	.byte 219
-	.byte 221
-	.byte 224
-	.byte 226
-	.byte 228
-	.byte 229
-	.byte 231
-	.byte 233
-	.byte 235
-	.byte 236
-	.byte 238
-	.byte 239
-	.byte 241
-	.byte 242
-	.byte 244
-	.byte 245
-	.byte 246
-	.byte 247
-	.byte 248
-	.byte 249
-	.byte 250
-	.byte 251
-	.byte 251
-	.byte 252
-	.byte 253
-	.byte 253
-	.byte 254
-	.byte 254
-	.byte 254
-	.byte 254
-	.byte 254
-	.byte 255
-	.byte 254
-	.byte 254
-	.byte 254
-	.byte 254
-	.byte 254
-	.byte 253
-	.byte 253
-	.byte 252
-	.byte 251
-	.byte 251
-	.byte 250
-	.byte 249
-	.byte 248
-	.byte 247
-	.byte 246
-	.byte 245
-	.byte 244
-	.byte 242
-	.byte 241
-	.byte 239
-	.byte 238
-	.byte 236
-	.byte 235
-	.byte 233
-	.byte 231
-	.byte 229
-	.byte 228
-	.byte 226
-	.byte 224
-	.byte 221
-	.byte 219
-	.byte 217
-	.byte 215
-	.byte 213
-	.byte 210
-	.byte 208
-	.byte 205
-	.byte 203
-	.byte 200
-	.byte 198
-	.byte 195
-	.byte 193
-	.byte 190
-	.byte 187
-	.byte 184
-	.byte 182
-	.byte 179
-	.byte 176
-	.byte 173
-	.byte 170
-	.byte 167
-	.byte 164
-	.byte 161
-	.byte 158
-	.byte 155
-	.byte 152
-	.byte 149
-	.byte 146
-	.byte 143
-	.byte 139
-	.byte 136
-	.byte 133
-	.byte 130
-	.byte 127
-	.byte 124
-	.byte 121
-	.byte 118
-	.byte 115
-	.byte 111
-	.byte 108
-	.byte 105
-	.byte 102
-	.byte 99
-	.byte 96
-	.byte 93
-	.byte 90
-	.byte 87
-	.byte 84
-	.byte 81
-	.byte 78
-	.byte 75
-	.byte 72
-	.byte 70
-	.byte 67
-	.byte 64
-	.byte 61
-	.byte 59
-	.byte 56
-	.byte 54
-	.byte 51
-	.byte 49
-	.byte 46
-	.byte 44
-	.byte 41
-	.byte 39
-	.byte 37
-	.byte 35
-	.byte 33
-	.byte 30
-	.byte 28
-	.byte 26
-	.byte 25
-	.byte 23
-	.byte 21
-	.byte 19
-	.byte 18
-	.byte 16
-	.byte 15
-	.byte 13
-	.byte 12
-	.byte 10
-	.byte 9
-	.byte 8
-	.byte 7
-	.byte 6
-	.byte 5
-	.byte 4
-	.byte 3
-	.byte 3
-	.byte 2
-	.byte 1
-	.byte 1
-	.byte 0
-	.byte 0
-	.byte 0
-	.byte 0
-	.byte 0
-	.byte 0
-	.byte 0
-	.byte 0
-	.byte 0
-	.byte 0
-	.byte 0
-	.byte 1
-	.byte 1
-	.byte 2
-	.byte 3
-	.byte 3
-	.byte 4
-	.byte 5
-	.byte 6
-	.byte 7
-	.byte 8
-	.byte 9
-	.byte 10
-	.byte 12
-	.byte 13
-	.byte 15
-	.byte 16
-	.byte 18
-	.byte 19
-	.byte 21
-	.byte 23
-	.byte 25
-	.byte 26
-	.byte 28
-	.byte 30
-	.byte 33
-	.byte 35
-	.byte 37
-	.byte 39
-	.byte 41
-	.byte 44
-	.byte 46
-	.byte 49
-	.byte 51
-	.byte 54
-	.byte 56
-	.byte 59
-	.byte 61
-	.byte 64
-	.byte 67
-	.byte 70
-	.byte 72
-	.byte 75
-	.byte 78
-	.byte 81
-	.byte 84
-	.byte 87
-	.byte 90
-	.byte 93
-	.byte 96
-	.byte 99
-	.byte 102
-	.byte 105
-	.byte 108
-	.byte 111
-	.byte 115
-	.byte 118
-	.byte 121
-	.byte 124
+buffer:
+	.global low_mem_buffer
+low_mem_buffer: