drivers/nvme: third review - LBA format, MSE, doorbells, timeouts

- use the LBA format FLBAS selects, reject formats with metadata
- enable memory space before the first MMIO read
- write doorbells as dwords
- reset the controller on an I/O timeout, stop the NSID scan on one
- DiskDel and release PCIDEV.owner on DRV_EXIT
- NVMe prog IF only, decimal disk names, Delay while waiting on I/O

.gitea/ansible/playbooks/deploy.yml

@@ -54,3 +54,27 @@
         src: "{{ stable_artifact_path }}/"
         dest: "{{ storage_path }}/../"
         mode: preserve
+
+    # older builds shrink to compressed images and lose their unpacked tree; the newest few keep both
+    - name: Looking for zstd on the storage server
+      ansible.builtin.shell: command -v zstd
+      register: zstd_present
+      changed_when: false
+      failed_when: false
+
+    - name: Requiring zstd for compaction
+      ansible.builtin.assert:
+        that: zstd_present.rc == 0
+        fail_msg: >-
+          zstd is not installed on the storage server, so older builds cannot
+          be compacted. Install it and re-run this build.
+
+    - name: Compacting older builds
+      ansible.builtin.script:
+        cmd: >-
+          ../../utils/compact-builds.sh
+          {{ storage_path | quote }}
+          {{ compact_keep | default(5) | int }}
+          {{ compact_max | default(10) | int }}
+      register: compaction
+      changed_when: "'compacted 0 of' not in compaction.stdout"

.gitea/utils/compact-builds.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0-only
+# SPDX-FileCopyrightText: 2026 KolibriOS team
+
+# Shrink older builds on the storage server: compress their images and drop
+# their unpacked tree, which is rebuildable from the commit. sha256sums.txt
+# keeps naming the bare images, so a compacted build has to be decompressed
+# before it can be verified.
+#
+# Layout:  <root>/<version>/<lang>/kolibrios-<descr>-<lang>.{img,iso,raw} -> .zst
+#          <root>/<version>/<lang>/data/                                  -> removed
+#
+# Usage: compact-builds.sh <storage-root> [keep] [max-per-run]
+#        DRY_RUN=1 walks the same selection and changes nothing
+
+set -euo pipefail
+
+root=${1:?storage root required}
+# the build just published is always among these, so an upload in flight is safe
+keep=${2:-5}
+# a build is hundreds of MiB to re-compress: cap the first pass over the backlog
+max=${3:-10}
+dry=${DRY_RUN:-0}
+verb=compacted
+[ "$dry" = 1 ] && verb="would compact"
+
+# --rm drops the source only once the archive is written; the box serves the
+# site over NFS, so compaction yields to it
+compress_image() {
+    nice -n 10 ionice -c3 zstd -12 -T1 -q --rm "$1"
+}
+export -f compress_image
+
+leftovers() {
+    local build=$1
+    find "$build" -mindepth 2 -maxdepth 2 \
+        \( -type d -name data \
+           -o -type f \( -name '*.img' -o -name '*.iso' -o -name '*.raw' \) \) \
+        -print -quit
+}
+
+compacted=0
+pending=0
+
+while IFS= read -r version; do
+    dir="$root/$version"
+    [ -n "$(leftovers "$dir")" ] || continue
+
+    pending=$((pending + 1))
+    [ "$compacted" -lt "$max" ] || continue
+
+    if [ "$dry" = 1 ]; then
+        compacted=$((compacted + 1))
+        echo "$verb $version"
+        continue
+    fi
+
+    # a build holds nine images: one per core, each zstd kept to one thread so
+    # the two levels of parallelism do not fight. Archive before dropping the
+    # tree, so a failure here leaves the build merely uncompacted and the next
+    # run picks it up again
+    find "$dir" -mindepth 2 -maxdepth 2 -type f \
+         \( -name '*.img' -o -name '*.iso' -o -name '*.raw' \) -print0 \
+        | xargs -0 -r -P "$(nproc)" -I{} bash -c 'compress_image "$@"' _ {}
+
+    find "$dir" -mindepth 2 -maxdepth 2 -type d -name data -exec rm -rf {} +
+
+    compacted=$((compacted + 1))
+    echo "$verb $version"
+# <tag>-<commit count>-g<sha>: order by the count, never by mtime
+done < <(find "$root" -mindepth 1 -maxdepth 1 -type d -name '*-*-g*' -printf '%f\n' \
+             | sort -t- -k2,2n | head -n "-$keep")
+
+echo "$verb $compacted of $pending older build(s), $((pending - compacted)) left for the next run"

.gitea/workflows/submodule-bump.yaml

@@ -34,10 +34,11 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: true
+          token: ${{ secrets.BOT_TOKEN }}
 
       - name: Bump ${{ matrix.name }} and open PR
         env:
-          TOKEN: ${{ secrets.GITEA_TOKEN }}
+          TOKEN: ${{ secrets.BOT_TOKEN }}
           API: ${{ github.api_url }}
           REPO: ${{ github.repository }}
           NAME: ${{ matrix.name }}

data/Tupfile.lua

@@ -427,6 +427,7 @@ tup.append_table(img_files, {
  {"DEFAULT.SKN", VAR_SKINS .. "/../skins/Leency/Shkvorka/Shkvorka.skn"},
  {"DISPTEST", VAR_PROGS .. "/testing/disptest/disptest"},
  {"END", VAR_PROGS .. "/system/end/light/end"},
+ {"ESKIN", VAR_PROGS .. "/system/eskin/eskin"},
  {"GMON", VAR_PROGS .. "/system/gmon/gmon"},
  {"HDD_INFO", VAR_PROGS .. "/system/hdd_info/hdd_info"},
  {"KBD", VAR_PROGS .. "/testing/kbd/kbd"},
@@ -592,6 +593,7 @@ tup.append_table(img_files, {
  {"DRIVERS/SIS.SYS", VAR_DRVS .. "/audio/sis.sys"},
  {"DRIVERS/SDHCI.SYS", "../drivers/sdhci/sdhci.sys"},
  {"DRIVERS/I2CHID.SYS", VAR_DRVS .. "/i2chid/i2chid.sys"},
+ {"DRIVERS/NVME.SYS", VAR_DRVS .. "/nvme/nvme.sys"},
 })
 tup.append_table(extra_files, {
  {"HD_Load/9x2klbr/", VAR_PROGS .. "/hd_load/9x2klbr/9x2klbr.exe"},

data/common/settings/AUTORUN.DAT

@@ -10,10 +10,12 @@
 /SYS/SETUP              BOOT 0	# Load device settings
 /SYS/LOADDRV            I2CHID 0	# Start I2C touchpad driver
 /SYS/@TASKBAR           ""   0	# Start taskbar
+/SYS/ESKIN              ""   0	# Set style
 /SYS/@ICON              ""   0	# Multithread desktop icons
 /SYS/TMPDISK            A0   0	# Add virtual RAM disk /tmp0/1
 /SYS/@RESHARE           ""   0	# Shared resources
 /SYS/LOADDRV            SDHCI 0	# Start SDHCI driver
+/SYS/LOADDRV            NVME 0	# Start NVMe driver
 /SYS/@DOCKY             ""   0	# Start docky
 /SYS/NETWORK/NETCFG     A    0	# Init network driver
 /SYS/NETWORK/@ZEROCONF  ""   0	# Network configuration

data/common/settings/system.ini

@@ -3,6 +3,7 @@ language=en
 font file=/sys/Fonts/Tahoma.kf
 font smoothing=sbp
 font height=9
+speaker mute=off
 
 [touchpad]
 speed=100
@@ -28,7 +29,6 @@ double_click_delay=64
 [low-level]
 LBA=off
 PCI=on
-speaker=on
 
 ;timeout in minutes
 ;program needs a full path

data/common/templates/table_apps(rus).csv

@@ -20,6 +20,7 @@ disptest;
 docpack;Документация / Блок документов;asm;http://git.kolibrios.org/KolibriOS/kolibrios/src/branch/main/programs/system/docpack;;http://wiki.kolibrios.org/wiki/Docpack/ru
 easyshot;Простой скриншотер;c--;http://git.kolibrios.org/KolibriOS/kolibrios/src/branch/main/programs/cmm/misc/easyshot.c;http://board.kolibrios.org/viewtopic.php?t=3695;
 end;Программа завершения работы;asm;http://git.kolibrios.org/KolibriOS/kolibrios/src/branch/main/programs/system/end;http://board.kolibrios.org/viewtopic.php?t=2442;http://wiki.kolibrios.org/wiki/End/ru
+eskin;Установщик фона и скина при старте системы;asm;http://git.kolibrios.org/KolibriOS/kolibrios/src/branch/main/programs/system/eskin;http://board.kolibrios.org/viewtopic.php?t=2424;
 fb2read;Читалка FB2;oberon07;http://git.kolibrios.org/KolibriOS/kolibrios/src/branch/main/programs/other/fb2reader;http://board.kolibrios.org/viewtopic.php?t=3128;
 fspeed;Тестирование скорости диска;asm;http://git.kolibrios.org/KolibriOS/kolibrios/src/branch/main/programs/testing/fspeed;http://board.kolibrios.org/viewtopic.php?t=2660;
 gmon;Информация о загрузке системы;asm;http://git.kolibrios.org/KolibriOS/kolibrios/src/branch/main/programs/system/gmon;http://board.kolibrios.org/viewtopic.php?t=470;http://wiki.kolibrios.org/wiki/Gmon/ru

drivers/ethernet/i8255x.asm

@@ -130,6 +130,8 @@ RU_STATUS_IDLE          = 0000b shl 2
 RU_STATUS_SUSPENDED     = 0001b shl 2
 RU_STATUS_NO_RESOURCES  = 0010b shl 2
 RU_STATUS_READY         = 0100b shl 2
+SCB_STATUS_CUS          = 11000000b     ; CU Status
+CU_STATUS_ACTIVE        = 10b shl 6
 SCB_STATUS_FCP          = 1 shl 8       ; Flow Control Pause
 SCB_STATUS_SWI          = 1 shl 10      ; Software Interrupt
 SCB_STATUS_MDI          = 1 shl 11      ; MDI read/write complete
@@ -183,6 +185,8 @@ struct  txfd
 
 ends
 
+TXFD_STATUS_C           = 1 shl 15
+
 TXFD_CMD_IA             = 1 shl 0
 TXFD_CMD_CFG            = 1 shl 1
 TXFD_CMD_TX             = 1 shl 2
@@ -628,6 +632,9 @@ reset:
         mov     ax, CU_START or INT_MASK
         out     dx, ax
         call    cmd_wait
+; cmd_wait only means the SCB accepted the command. The Configure below
+; reuses confcmd, so a slow chip would read it instead of our MAC.
+        call    confcmd_wait
 
 ;-------------
 ; Configure CU
@@ -652,6 +659,7 @@ reset:
         mov     ax, CU_START                            ; expect Interrupts from now on
         out     dx, ax
         call    cmd_wait
+        call    confcmd_wait
 
 ; Start media check timer
         mov     [ebx + device.state], ETH_LINK_DOWN
@@ -678,6 +686,11 @@ init_rx_ring:
 ;---------------------
 ; build rxfd structure
 
+        cmp     [ebx + device.rx_desc], 0       ; the RFD of an earlier reset
+        je      @f
+        invoke  NetFree, [ebx + device.rx_desc]
+        mov     [ebx + device.rx_desc], 0
+  @@:
         invoke  NetAlloc, 2000
         test    eax, eax
         jz      .out_of_mem
@@ -689,6 +702,7 @@ init_rx_ring:
         mov     [esi + sizeof.NET_BUFF + rxfd.command], RXFD_CMD_EL or RXFD_CMD_SUSPEND
         mov     [esi + sizeof.NET_BUFF + rxfd.link], eax
         mov     [esi + sizeof.NET_BUFF + rxfd.count], 0
+        mov     [esi + sizeof.NET_BUFF + rxfd.rx_buf_addr], 0xffffffff  ; simplified mode, no RBD
         mov     [esi + sizeof.NET_BUFF + rxfd.size], 1528
 
         ret
@@ -709,6 +723,15 @@ init_tx_ring:
         invoke  GetPhysAddr
         mov     ecx, TX_RING_SIZE
   .next_desc:
+; after a reset with frames still unreclaimed: free them, or transmit sees the
+; descriptor busy (virt_addr) and reports TX overrun forever
+        cmp     [esi + txfd.virt_addr], 0
+        je      @f
+        push    eax ecx
+        invoke  NetFree, [esi + txfd.virt_addr]
+        pop     ecx eax
+        mov     [esi + txfd.virt_addr], 0
+  @@:
         mov     [esi + txfd.status], 0
         mov     [esi + txfd.command], 0
         lea     edx, [eax + txfd.buf_addr]
@@ -763,7 +786,7 @@ proc transmit stdcall bufferptr
         lea     edi, [ebx + device.tx_ring + eax]
 
         ; Check if current descriptor is free or still in use
-        cmp     [edi + txfd.status], 0
+        cmp     [edi + txfd.virt_addr], 0               ; buffer not reclaimed yet
         jne     .overrun
 
         ; Fill in status and command values
@@ -786,6 +809,22 @@ proc transmit stdcall bufferptr
         mov     eax, edi
         invoke  GetPhysAddr
         set_io  [ebx + device.io_addr], 0
+
+        ; CU_START is only valid while the CU is idle or suspended:
+        ; wait for the previous frame to leave (1.2 ms at 10 Mbit)
+        push    eax ecx
+        set_io  [ebx + device.io_addr], REG_SCB_STATUS
+        mov     ecx, 100000
+  .cu_busy:
+        in      al, dx
+        and     al, SCB_STATUS_CUS
+        cmp     al, CU_STATUS_ACTIVE
+        jne     .cu_free
+        dec     ecx
+        jnz     .cu_busy
+        DEBUGF  2, "CU still active, starting anyway\n"
+  .cu_free:
+        pop     ecx eax
         set_io  [ebx + device.io_addr], REG_SCB_PTR
         out     dx, eax
 
@@ -854,7 +893,7 @@ int_handler:
 
         DEBUGF  1,"Status: %x\n", ax
 
-        test    ax, SCB_STATUS_FR               ; did we receive a frame?
+        test    ax, SCB_STATUS_FR or SCB_STATUS_RNR     ; frame received or receiver stopped?
         jz      .no_rx
 
         push    ax
@@ -901,6 +940,7 @@ int_handler:
         mov     [esi + sizeof.NET_BUFF + rxfd.command], RXFD_CMD_EL or RXFD_CMD_SUSPEND
         mov     [esi + sizeof.NET_BUFF + rxfd.link], eax
         mov     [esi + sizeof.NET_BUFF + rxfd.count], 0
+        mov     [esi + sizeof.NET_BUFF + rxfd.rx_buf_addr], 0xffffffff  ; simplified mode, no RBD
         mov     [esi + sizeof.NET_BUFF + rxfd.size], 1528
 
 ; restart RX
@@ -916,11 +956,22 @@ int_handler:
         mov     ax, RX_START
         out     dx, ax
         call    cmd_wait
-  .out_of_mem:
 
 ; Hand the frame over to the kernel
         jmp     [EthInput]
 
+  .out_of_mem:
+; The buffer is still our only RFD: drop the frame and reuse it
+        mov     esi, [esp]                      ; the buffer
+        mov     ecx, [esi + NET_BUFF.length]
+        dec     [ebx + device.packets_rx]       ; counted above, before the allocation
+        sub     dword [ebx + device.bytes_rx], ecx
+        sbb     dword [ebx + device.bytes_rx + 4], 0
+        inc     [ebx + device.packets_rx_drop]
+        add     esp, 12                         ; buffer, .rx_loop, ebx
+        mov     esi, [ebx + device.rx_desc]
+        jmp     .not_ok
+
   .not_ok:
 ; Reset the FD
         mov     [esi + sizeof.NET_BUFF + rxfd.status], 0
@@ -945,6 +996,27 @@ int_handler:
 
   .no_rx_:
         DEBUGF  1, "no more data\n"
+
+; With a single RFD the receiver sits in No Resources/Suspended whenever a
+; frame arrived before we re-armed it. Nothing restarts it but us.
+        set_io  [ebx + device.io_addr], 0
+        set_io  [ebx + device.io_addr], REG_SCB_STATUS
+        in      al, dx
+        and     al, SCB_STATUS_RUS
+        cmp     al, RU_STATUS_READY
+        je      .ru_ready
+        test    byte[esp], 1                    ; bit 0 of the saved status is reserved,
+        jnz     .ru_ready                       ; we mark it: one restart per IRQ
+        or      byte[esp], 1
+        movzx   eax, al
+        DEBUGF  1, "Restarting receiver, RU status %x\n", eax:2
+        mov     esi, [ebx + device.rx_desc]
+        push    ebx
+        test    [esi + sizeof.NET_BUFF + rxfd.status], RXFD_STATUS_C
+        jnz     .rx_loop                        ; a frame completed meanwhile
+        add     esp, 4
+        jmp     .not_ok                         ; re-arm the empty RFD
+  .ru_ready:
         pop     ax
 
   .no_rx:
@@ -955,13 +1027,13 @@ int_handler:
 
         push    eax
   .loop_tx:
-        mov     edi, [ebx + device.last_tx]
-        mov     eax, sizeof.txfd
-        mul     eax
+        mov     eax, [ebx + device.last_tx]
+        mov     edx, sizeof.txfd
+        mul     edx
         lea     edi, [ebx + device.tx_ring + eax]
 
-        cmp     [edi + txfd.status], 0
-        je      .tx_done
+        test    [edi + txfd.status], TXFD_STATUS_C      ; sent by the device?
+        jz      .tx_done
 
         cmp     [edi + txfd.virt_addr], 0
         je      .tx_done
@@ -970,6 +1042,7 @@ int_handler:
 
         push    [edi + txfd.virt_addr]
         mov     [edi + txfd.virt_addr], 0
+        mov     [edi + txfd.status], 0                  ; free for transmit again
         invoke  NetFree
 
         inc     [ebx + device.last_tx]
@@ -980,12 +1053,6 @@ int_handler:
         pop     eax
   .no_tx:
 
-        test    ax, RU_STATUS_NO_RESOURCES
-        jz      .not_out_of_resources
-
-        DEBUGF  2, "Out of resources!\n"
-
-  .not_out_of_resources:
         pop     edi esi ebx
         xor     eax, eax
         inc     eax
@@ -1079,6 +1146,25 @@ proc check_media_mii stdcall dev:dword
 endp
 
 
+; Wait (up to 1 s) until the device has executed the command in confcmd.
+align 4
+confcmd_wait:
+        mov     ecx, 1000                       ; udelay = Sleep(1), 1 ms
+  .loop:
+        test    [ebx + device.confcmd.status], TXFD_STATUS_C
+        jnz     .done
+        call    udelay
+        dec     ecx
+        jnz     .loop
+        movzx   eax, [ebx + device.confcmd.command]
+        DEBUGF  2, "Command 0x%x not completed\n", eax:4
+        ret
+  .done:
+        movzx   eax, [ebx + device.confcmd.command]
+        movzx   ecx, [ebx + device.confcmd.status]
+        DEBUGF  1, "Command 0x%x done, status 0x%x\n", eax:4, ecx:4
+        ret
+
 align 4
 cmd_wait:
 

drivers/nvme/README.md

@@ -0,0 +1,95 @@
+# NVMe driver
+
+Driver for NVM Express controllers. Registers the first active namespace of every
+NVMe controller it finds as a KolibriOS disk named `nvme<controller>n<namespace>`, so
+that of the first controller usually shows up as `/nvme0n1/`.
+
+## Origin
+
+Written by Abdur-Rahman Mansoor for Google Summer of Code 2024, developed at
+<https://git.kolibrios.org/GSoC/kolibrios-nvme-driver> and proposed for the main tree
+as <https://git.kolibrios.org/KolibriOS/kolibrios/pulls/91>. Imported here from that
+repository's last commit (53c04b9, September 2024), which is newer than the pull
+request itself.
+
+Licensed under the GNU General Public License, version 2.
+
+## State
+
+| Feature                            | Implemented | Notes                                                              |
+|------------------------------------|-------------|--------------------------------------------------------------------|
+| Mandatory administrator commands   | Yes         |                                                                     |
+| Mandatory I/O commands             | Yes         | Reading and writing; requests are split to respect IDENTC.MDTS.     |
+| Namespace identification           | Yes         | Across all controller versions.                                     |
+| Multiple NVMe controllers          | Yes         | Up to `TOTAL_PCIDEVS`.                                              |
+| Multiple namespaces per controller | No          | Only the first active namespace is registered.                      |
+| Flush                              | Yes         | Issued once the kernel has written out its own cache.               |
+| Interrupts                         | No          | Completions are polled; INTx, MSI and MSI-X are all disabled.       |
+| Asynchronous API                   | No          | Every command blocks the calling thread until it completes.         |
+| SMART/health reporting             | No          |                                                                     |
+
+Sector sizes other than 512 bytes are rejected, because that is what KolibriOS
+supports, and so are LBA formats with metadata. The format checked is the one in use
+(FLBAS), not the first in the table.
+
+## Interrupts
+
+The driver does not use one. A thread that submits a command spins briefly on its
+completion and then reads the completion queues itself, using the phase tag; the
+controller's interrupt vectors are masked and INTx is disabled in the PCI command
+register, so the controller never signals anything. Since every command blocks its
+caller anyway, an interrupt would not make a completion arrive any sooner, while
+asking for one has real costs: many machines give an NVMe controller no usable INTx
+at all (MSI-X only, or firmware leaving the interrupt line at 0xFF), and the kernel's
+shared-IRQ heuristic can relink a handler onto the wrong line the first time an
+unrelated IRQ fires while a completion is pending - after which a level-triggered
+interrupt nobody services storms and freezes the machine. That last case was seen
+under QEMU while the driver still registered a handler.
+
+Once the completion path becomes asynchronous, an MSI-X vector is the interrupt to
+add; there is nothing to gain from INTx before then.
+
+Every wait on the controller (reset, enable, shutdown, command completion) is bounded,
+so a controller that never answers makes the driver give up rather than hang the boot.
+An I/O command that times out gets the controller reset and taken out of service, so
+that it cannot DMA into freed memory or complete a stale command later.
+Calls into the driver are serialised per controller, since the kernel may issue disk
+requests from several threads at once and the driver keeps one command in flight.
+
+## Testing
+
+Verified under QEMU (`-device nvme`) against controller version 1.4.0: driver load,
+partition detection, small and multi-megabyte file round trips, transfers from
+unaligned buffers checked against what actually landed on the disk image, and a boot
+of the same image with no NVMe controller present, where the driver has to back off
+without disturbing anything else.
+Also verified on VMware Workstation 17.6 (its controller reports firmware 1.3 and
+MDTS 8): the disk tests pass and the machine powers off cleanly, where the last
+upstream build faults during the 2 MB transfer and then hangs on shutdown. And on
+VirtualBox 7.2 (controller version 1.2.0, MDTS 0, i.e. no limit of its own): the same
+tests pass, the image is correct on the host, and the machine powers off. Real
+hardware is still untested.
+
+Watch out when writing tests for this: a round trip done from inside KolibriOS can pass
+over corrupt data, because the kernel buffer the file was read back into may still hold
+the correct bytes from the write. What a transfer really left on the medium has to be
+checked from outside.
+
+Two problems reported upstream are addressed here, both reproduced first and then
+confirmed fixed by running the last upstream build and this one against the same
+machine. The file corruption of
+[issue #7](https://git.kolibrios.org/GSoC/kolibrios-nvme-driver/issues/7) was PRP2
+being built as a list for transfers that fit in two memory pages, which the controller
+reads as a plain data pointer. The shutdown hang of
+[issue #5](https://git.kolibrios.org/GSoC/kolibrios-nvme-driver/issues/5) is visible on
+VMware Workstation, where the upstream build also faults inside the driver during a
+multi-megabyte transfer - VMware reports MDTS 8, so a 2 MB request is more than one
+command may carry, and the request was not being split.
+
+## Building
+
+The driver builds with the tree (`drivers/nvme/Tupfile.lua`) and is copied into the
+image as `DRIVERS/NVME.SYS`. To build it by hand:
+
+    fasm nvme.asm nvme.sys
+    kpack nvme.sys

drivers/nvme/Tupfile.lua

@@ -0,0 +1,3 @@
+if tup.getconfig("NO_FASM") ~= "" then return end
+ROOT = "../.."
+tup.rule("nvme.asm", "fasm %f %o " .. tup.getconfig("PESTRIP_CMD") .. tup.getconfig("KPACK_CMD"), "%B.sys")

drivers/nvme/command.inc

@@ -0,0 +1,243 @@
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;                                                                 ;;
+;; Copyright (C) KolibriOS team 2004-2024. All rights reserved.    ;;
+;; Distributed under terms of the GNU General Public License       ;;
+;;                                                                 ;;
+;;          GNU GENERAL PUBLIC LICENSE                             ;;
+;;             Version 2, June 1991                                ;;
+;;                                                                 ;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+proc set_cdw0 stdcall, pci:dword, y:dword, opcode:byte
+
+	stdcall get_new_cid, [pci], [y]
+	shl 	eax, 16
+	or 	al, [opcode]
+	ret
+
+endp
+
+; See pages 161-205 of the NVMe 1.4 specification for reference
+proc nvme_identify stdcall, pci:dword, nsid:dword, prp1:dword, cns:byte
+
+	push 	esi
+	mov 	esi, [pci]
+	mov 	dword [esi + pcidev.spinlock], 1
+	sub 	esp, sizeof.SQ_ENTRY
+	mov 	eax, esp
+	stdcall memsetdz, eax, sizeof.SQ_ENTRY / 4
+
+	mov     eax, [nsid]
+	mov     dword [esp + SQ_ENTRY.nsid], eax
+	mov     eax, [prp1]
+	mov     dword [esp + SQ_ENTRY.prp1], eax
+	stdcall set_cdw0, esi, ADMIN_QUEUE, ADM_CMD_IDENTIFY
+	mov 	dword [esp + SQ_ENTRY.cdw0], eax
+	mov     al, [cns]
+	mov     byte [esp + SQ_ENTRY.cdw10], al
+	stdcall sqytdbl_write, esi, ADMIN_QUEUE, esp
+
+	add 	esp, sizeof.SQ_ENTRY
+	stdcall nvme_poll, esi
+	pop 	esi
+	ret
+
+endp
+
+; See page 101 of the NVMe 1.4 specification for reference
+proc create_io_completion_queue stdcall, pci:dword, prp1:dword, qid:dword, ien:byte
+	
+	push 	esi
+	mov 	esi, [pci]
+	mov 	dword [esi + pcidev.spinlock], 1
+	sub 	esp, sizeof.SQ_ENTRY
+	mov 	eax, esp
+	stdcall memsetdz, eax, sizeof.SQ_ENTRY / 4
+	stdcall set_cdw0, esi, ADMIN_QUEUE, ADM_CMD_CRE_IO_COMPLETION_QUEUE
+	mov 	dword [esp + SQ_ENTRY.cdw0], eax
+	mov 	eax, [prp1]
+	mov 	dword [esp + SQ_ENTRY.prp1], eax
+	mov 	eax, (CQ_ENTRIES - 1) shl 16 ; CDW10.QSIZE (0's based)
+	or 	eax, [qid] ; CDW10.QID
+	mov 	dword [esp + SQ_ENTRY.cdw10], eax
+	movzx 	eax, [ien] ; CDW11.IEN 
+	or 	eax, 0x1 ; CDW11.PC
+	; Don't set CDW11.IV since we're not using MSI-X or MSI vector
+	mov 	dword [esp + SQ_ENTRY.cdw11], eax
+	stdcall sqytdbl_write, esi, ADMIN_QUEUE, esp
+	add 	esp, sizeof.SQ_ENTRY
+	stdcall nvme_poll, esi
+	pop 	esi
+	ret
+
+endp
+
+; See page 103-104 of the NVMe 1.4 specification for reference
+proc create_io_submission_queue stdcall, pci:dword, prp1:dword, qid:dword, cqid:word
+
+	push 	esi
+	mov 	esi, [pci]
+	mov 	dword [esi + pcidev.spinlock], 1
+	sub 	esp, sizeof.SQ_ENTRY
+	mov 	eax, esp
+	stdcall memsetdz, eax, sizeof.SQ_ENTRY / 4
+	stdcall set_cdw0, esi, ADMIN_QUEUE, ADM_CMD_CRE_IO_SUBMISSION_QUEUE
+	mov 	dword [esp + SQ_ENTRY.cdw0], eax
+	mov 	eax, [prp1]
+	mov 	dword [esp + SQ_ENTRY.prp1], eax
+	mov 	eax, (SQ_ENTRIES - 1) shl 16 ; CDW10.QSIZE (0's based)
+	or 	eax, [qid]
+	mov 	dword [esp + SQ_ENTRY.cdw10], eax
+	movzx 	eax, [cqid]
+	shl 	eax, 16 ; CDW11.CQID
+	or 	eax, 0x1 ; CDW11.PC (always set this to 1 as some devices may not support non-contiguous pages)
+	; TODO: Set CDW10.QPRIO 
+	mov 	dword [esp + SQ_ENTRY.cdw11], eax
+	stdcall sqytdbl_write, esi, ADMIN_QUEUE, esp
+	add 	esp, sizeof.SQ_ENTRY
+	stdcall nvme_poll, esi
+	pop 	esi
+	ret
+
+endp
+
+; See page 95-96 of the NVMe 1.4 specification for reference
+proc abort stdcall, pci:dword, cid:word, sqid:word
+
+	push 	esi
+	mov 	esi, [pci]
+	mov 	dword [esi + pcidev.spinlock], 1
+	sub 	esp, sizeof.SQ_ENTRY
+	mov 	eax, esp
+	stdcall memsetdz, eax, sizeof.SQ_ENTRY / 4
+	stdcall set_cdw0, esi, ADMIN_QUEUE, ADM_CMD_ABORT
+	mov 	dword [esp + SQ_ENTRY.cdw0], eax
+	movzx 	eax, [cid]
+	shl 	eax, 16
+	mov 	ax, [sqid]
+	mov 	dword [esp + SQ_ENTRY.cdw10], eax
+	stdcall sqytdbl_write, esi, ADMIN_QUEUE, esp
+	add 	esp, sizeof.SQ_ENTRY
+	stdcall nvme_poll, esi
+	pop 	esi
+	ret
+
+endp
+
+
+; See page 205 of the NVMe 1.4 specification for reference
+proc set_features stdcall, pci:dword, prp1:dword, fid:byte, cdw11:dword
+	
+	sub 	esp, sizeof.SQ_ENTRY
+	mov 	eax, esp
+	stdcall memsetdz, eax, sizeof.SQ_ENTRY / 4
+	stdcall set_cdw0, [pci], ADMIN_QUEUE, ADM_CMD_SET_FEATURES
+	mov 	dword [esp + SQ_ENTRY.cdw0], eax
+	mov 	eax, [prp1]
+	mov 	dword [esp + SQ_ENTRY.prp1], eax
+	movzx 	eax, [fid]
+	mov 	dword [esp + SQ_ENTRY.cdw10], eax
+	mov 	eax, [cdw11]
+	mov 	dword [esp + SQ_ENTRY.cdw11], eax
+	stdcall sqytdbl_write, [pci], ADMIN_QUEUE, esp
+	add 	esp, sizeof.SQ_ENTRY
+	ret
+
+endp
+
+; See page 105 of the NVMe 1.4 specification for reference
+proc delete_io_completion_queue stdcall, pci:dword, qid:word
+
+	push 	esi
+	mov 	esi, [pci]
+	mov 	dword [esi + pcidev.spinlock], 1
+	sub 	esp, sizeof.SQ_ENTRY
+	mov 	eax, esp
+	stdcall memsetdz, eax, sizeof.SQ_ENTRY / 4
+	stdcall set_cdw0, esi, ADMIN_QUEUE, ADM_CMD_DEL_IO_COMPLETION_QUEUE
+	mov 	dword [esp + SQ_ENTRY.cdw0], eax
+	mov 	ax, [qid]
+	mov 	word [esp + SQ_ENTRY.cdw10], ax
+	stdcall sqytdbl_write, esi, ADMIN_QUEUE, esp
+	add 	esp, sizeof.SQ_ENTRY
+	stdcall nvme_poll, esi
+	pop 	esi
+	ret
+
+endp
+
+; See page 114-116 of the NVMe 1.4 specification for reference
+proc get_features stdcall, pci:dword, prp1:dword, sel:byte, fid:byte
+	
+	sub 	esp, sizeof.SQ_ENTRY
+	mov 	eax, esp
+	stdcall memsetdz, eax, sizeof.SQ_ENTRY / 4
+	stdcall set_cdw0, [pci], ADMIN_QUEUE, ADM_CMD_GET_FEATURES
+	mov 	dword [esp + SQ_ENTRY.cdw0], eax
+	movzx 	eax, [sel]
+	and 	eax, 111b
+	shl 	eax, 8 ; CDW10.SEL
+	mov 	al, [fid] ; CDW10.FID
+	mov 	dword [esp + SQ_ENTRY.cdw10], eax
+	mov 	eax, [prp1]
+	mov 	dword [esp + SQ_ENTRY.prp1], eax
+	; TODO: Implement CDW14.UUID?
+	stdcall sqytdbl_write, [pci], ADMIN_QUEUE, esp
+	add 	esp, sizeof.SQ_ENTRY
+	ret
+
+endp
+
+; See page 105-106 of the NVMe 1.4 specification for reference
+proc delete_io_submission_queue stdcall, pci:dword, qid:word
+
+	push 	esi
+	mov 	esi, [pci]
+	mov 	dword [esi + pcidev.spinlock], 1
+	sub 	esp, sizeof.SQ_ENTRY
+	mov 	eax, esp
+	stdcall memsetdz, eax, sizeof.SQ_ENTRY / 4
+	stdcall set_cdw0, esi, ADMIN_QUEUE, ADM_CMD_DEL_IO_SUBMISSION_QUEUE
+	mov 	dword [esp + SQ_ENTRY.cdw0], eax
+	mov 	ax, [qid]
+	mov 	word [esp + SQ_ENTRY.cdw10], ax
+	stdcall sqytdbl_write, esi, ADMIN_QUEUE, esp
+	add 	esp, sizeof.SQ_ENTRY
+	stdcall nvme_poll, esi
+	pop 	esi
+	ret
+
+endp
+
+; See page 258-261 (read) and 269-271 (write) of the NVMe 1.4 specification for reference
+proc nvme_io_rw stdcall, pci:dword, qid:word, nsid:dword, prps:qword, slba:qword, nlb:dword, opcode:dword
+	
+	; TODO: Use IDENTC.NOIOB to construct read/write commands that don't
+	; cross the I/O boundary to achieve optimal performance
+	; 
+	; TODO: Read AWUN/NAWUN
+	sub 	esp, sizeof.SQ_ENTRY
+	mov 	eax, esp
+	stdcall memsetdz, eax, sizeof.SQ_ENTRY / 4
+	movzx 	ecx, [qid]
+	stdcall set_cdw0, [pci], ecx, [opcode]
+	mov 	dword [esp + SQ_ENTRY.cdw0], eax ; CDW0
+	mov 	eax, dword [prps]
+	mov 	dword [esp + SQ_ENTRY.prp1], eax
+	mov 	eax, dword [prps + 4]
+	mov 	dword [esp + SQ_ENTRY.prp2], eax
+	mov 	eax, [nsid]
+	mov 	dword [esp + SQ_ENTRY.nsid], eax
+	mov 	eax, dword [slba] ; slba_lo
+	mov 	dword [esp + SQ_ENTRY.cdw10], eax
+	mov 	eax, dword [slba + 4] ; slba_hi
+	mov 	dword [esp + SQ_ENTRY.cdw11], eax
+	mov 	eax, [nlb]
+	mov 	word [esp + SQ_ENTRY.cdw12], ax
+	movzx 	ecx, [qid]
+	stdcall sqytdbl_write, [pci], ecx, esp
+	add 	esp, sizeof.SQ_ENTRY
+	ret
+	
+endp
+

drivers/nvme/lib.inc

@@ -0,0 +1,34 @@
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;                                                                 ;;
+;; Copyright (C) KolibriOS team 2004-2024. All rights reserved.    ;;
+;; Distributed under terms of the GNU General Public License       ;;
+;;                                                                 ;;
+;;          GNU GENERAL PUBLIC LICENSE                             ;;
+;;             Version 2, June 1991                                ;;
+;;                                                                 ;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+proc memsetdz stdcall, dest:dword, sz:dword
+
+		push 	edi
+		mov 	edi, [dest]
+		mov 	ecx, [sz]
+		xor 	eax, eax
+		rep 	stosd
+		pop 	edi
+		ret
+
+endp
+
+proc memcpyd stdcall, dest:dword, src:dword, sz:dword
+
+		push 	esi edi
+		mov 	esi, [src]
+		mov 	edi, [dest]
+		mov 	ecx, [sz]
+		rep 	movsd
+		pop 	edi esi
+		ret
+
+endp
+

drivers/nvme/nvme.inc

@@ -0,0 +1,602 @@
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;                                                                 ;;
+;; Copyright (C) KolibriOS team 2004-2024. All rights reserved.    ;;
+;; Distributed under terms of the GNU General Public License       ;;
+;;                                                                 ;;
+;;          GNU GENERAL PUBLIC LICENSE                             ;;
+;;             Version 2, June 1991                                ;;
+;;                                                                 ;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+define LOG2 bsr
+
+; NVMe Controller Versions
+VS100 = 0x00010000 ; (v1.0.0)
+VS110 = 0x00010100 ; (v1.1.0)
+VS120 = 0x00010200 ; (V1.2.0)
+VS121 = 0x00010201 ; (v1.2.1)
+VS130 = 0x00010300 ; (v1.3.0)
+VS140 = 0x00010400 ; (v1.4.0)
+
+NVM_MPS = 0                   ; Memory Page Size (2 ^ (12 + MPS))
+NVM_ASQS = 64                 ; Admin Submission Queue Size
+NVM_ACQS = NVM_ASQS           ; Admin Completion Queue Size
+LAST_QUEUE_ID = 1             ; Index of the last queue
+SQ_ENTRIES = NVM_ASQS         ; I/O and Admin Submission Queue Size
+CQ_ENTRIES = NVM_ACQS         ; I/O and Admin Completion Queue Size
+PAGE_SIZE = 4096 shl NVM_MPS  ; Use 4KiB pages
+SUPPORTED_LBADS = 9           ; KolibriOS only supports LBADS of 512, later on we may remove this restriction
+SQ_ALLOC_SIZE = 0x1000
+CQ_ALLOC_SIZE = 0x1000
+QUEUE_ALLOC_SIZE = SQ_ALLOC_SIZE + CQ_ALLOC_SIZE
+
+; Upper bound on the number of memory pages a single I/O command may span. A PRP
+; list holds PAGE_SIZE/8 entries, so staying well below that keeps every transfer
+; describable by one non-chained PRP list.
+MAX_PRP_PAGES = 256
+
+PCI_MAX_CAPS = 48 ; a config space holds at most 48 capabilities
+
+; Registers take the first page of the BAR, the doorbells start at 0x1000 with a
+; stride of 4 << CAP.DSTRD bytes; this much is mapped before CAP.DSTRD is known.
+MMIO_MIN_MAP_SIZE = 0x2000
+
+; How long to wait on the controller, in milliseconds.
+CTRL_POLL_MS = 10
+SHUTDOWN_WAIT_MS = 5000
+IO_TIMEOUT_MS = 30000 ; how long a single I/O command may take
+POLL_SPINS = 64 ; lock checks between two looks at the completion queue
+IO_BUSY_ROUNDS = 20000 ; rounds to spend spinning before falling back to sleeping
+
+MSIXCAP_CID = 0x11
+MSIXCAP_MXE = 1 shl 15 ; MSI-X Enable bit
+MSICAP_CID = 0x05
+MSICAP_MSIE = 1 ; MSI Enable bit
+
+ADMIN_QUEUE = 0 ; Admin Queue ID
+
+IEN_ON = 2
+IEN_OFF = 0
+
+; Opcodes for NVM commands
+NVM_CMD_FLUSH = 0x00 
+NVM_CMD_WRITE = 0x01
+NVM_CMD_READ = 0x02
+NVM_CMD_WRITE_UNCORRECTABLE = 0x04
+NVM_CMD_COMPARE = 0x05
+NVM_CMD_WRITE_ZEROES = 0x08
+NVM_CMD_DATASET_MANAGEMENT = 0x09
+NVM_CMD_VERIFY = 0x0C
+NVM_CMD_RESERVATION_REG = 0x0D
+NVM_CMD_RESERVATION_REPORT = 0x0E
+NVM_CMD_RESERVATION_ACQUIRE = 0x11
+NVM_CMD_RESERVATION_RELEASE = 0x15
+NVM_CMD_COPY = 0x19
+
+; Opcodes for admin commands (Page 94 of NVMe 1.4 spec)
+ADM_CMD_DEL_IO_SUBMISSION_QUEUE = 0x00
+ADM_CMD_CRE_IO_SUBMISSION_QUEUE = 0x01
+ADM_CMD_GET_LOG_PAGE = 0x02
+ADM_CMD_DEL_IO_COMPLETION_QUEUE = 0x04
+ADM_CMD_CRE_IO_COMPLETION_QUEUE = 0x05
+ADM_CMD_IDENTIFY = 0x06
+ADM_CMD_ABORT = 0x08
+ADM_CMD_SET_FEATURES = 0x09
+ADM_CMD_GET_FEATURES = 0x0A
+
+; fuse (fused operation): In a fused operation, a complex command is created by 'fusing' together
+;                         two simpler commands. This field specifies whether this command is part
+;                         of a fused operation, and if so, which command it is in the sequence:
+;                         00b -> Normal operation
+;                         01b -> Fused operation, first command
+;                         10b -> Fused operation, second command
+;                         11b -> Reserved
+NO_FUSE = 0
+FUSE_OP_FIRST_CMD = 1 shl 8
+FUSE_OP_SECOND_CMD = 2 shl 8
+
+; sel (PRP or SGL for data transfer): This field specifies whether PRPs or SGLs are used for any
+;                                     data transfer associated with the command. PRPs shall be
+;                                     used for all Admin commands for NVMe over PCIe implementations.
+;                                     SGLs shall be used for all Admin and I/O commands for NVMe over
+;                                     Fabrics implementations (i.e., field set to 01b):
+;                                     00b -> PRPs are used for this transfer
+;                                     01b -> SGLs are used for this transfer, MPTR will contain address of 
+;                                            a single contiguous physical buffer that is byte aligned
+;                                     10b -> SGLs are used for this transfer. MPTR will contain address of
+;                                            an SGL segment containing exactly one SGL descriptor that is
+;                                            QWORD aligned
+;                                     11b -> Reserved
+SEL_PRP = 0
+SEL_SGL = 1 shl 14
+
+; Controller or Namespace Structure (CNS) specifies the information to be returned to the host.
+CNS_IDNS   = 0x0  ; Namespace data structure (NSID)
+CNS_IDCS   = 0x1  ; Controller data structure
+CNS_ANIDL  = 0x2  ; Active namespace ID list (NSID)
+CNS_NIDL   = 0x3  ; Namespace identification descriptor list (NSID)
+CNS_NVM_SL = 0x4  ; NVM Set List 
+
+; Optional Admin Command Support (OACS) values
+OACS_SEC_SEN_RECV_SUPPORTED = 1 shl 0
+OACS_FMT_NVM_SUPPORTED = 1 shl 1
+OACS_FIRM_COMDL_SUPPORTED = 1 shl 2
+OACS_NSMAN_SUPPORTED = 1 shl 3
+
+; scope is all attached namespaces or all namespaces in NVM subsystem
+NSID_BROADCAST = 0xFFFFFFFF
+
+NSSRC_RESET = 0x4E564D65 ; "NVMe" (initiates a NVMe subsystem reset)
+
+; NVMe Capabilities
+CAP_MQES = 0xffff
+CAP_CQR = 1 shl 16
+CAP_AMS = (1 shl 17) or (1 shl 18)
+CAP_TO = 0xff000000
+CAP_DSTRD = 1 or (1 shl 1) or (1 shl 2) or (1 shl 3)
+CAP_NSSRS = 1 shl 4
+CAP_CSS_NVM_CMDSET = 1 shl 5
+CAP_CSS_NOIO = 1 shl 12
+CAP_BPS = 1 shl 13
+CAP_CPS_COSCOP = 1 shl 15
+CAP_CPS_DOSCOP = 1 shl 16
+CAP_CPS_NVMSCOP = CAP_CPS_COSCOP or CAP_CPS_DOSCOP
+CAP_MPSMIN = 0xf shl 16 ; CAP bits 51:48
+CAP_MPSMAX = 0xf shl 20 ; CAP bits 55:52
+CAP_PMRS = 1 shl 24
+CAP_CMBS = 1 shl 25
+CAP_NSSS = 1 shl 27
+CAP_CRMS_CRWMS = 1 shl 28
+CAP_CRMS_CRIMS = 1 shl 29
+
+; Controller Configuration Bits
+CC_EN = 1
+CC_CSS = (1 shl 4) or (1 shl 5) or (1 shl 6)
+CC_MPS = (1 shl 7) or (1 shl 8) or (1 shl 9) or (1 shl 10)
+CC_AMS = (1 shl 11) or (1 shl 12) or (1 shl 13)
+CC_SHN = (1 shl 14) or (1 shl 15)
+CC_IOSQES = (1 shl 16) or (1 shl 17) or (1 shl 18) or (1 shl 19)
+CC_IOCQES = (1 shl 20) or (1 shl 21) or (1 shl 22) or (1 shl 23)
+CC_CRIME = 1 shl 24
+
+CC_SHN_NORMAL_SHUTDOWN = 1 shl 14
+CC_SHN_ABRUPT_SHUTDOWN = 1 shl 15
+
+CC_DEFAULT_IOSQES = LOG2 sizeof.SQ_ENTRY shl 16
+CC_DEFAULT_IOCQES = LOG2 sizeof.CQ_ENTRY shl 20
+
+; Completion Queue Entry Status Field Values
+CQ_PHASE_TAG = 1 shl 0
+CQ_STATUS_SC = 0xfe
+CQ_STATUS_SCT = (1 shl 9) or (1 shl 10) or (1 shl 11)
+CQ_STATUS_CRD = (1 shl 12) or (1 shl 13)
+CQ_STATUS_M = 1 shl 14
+CQ_STATUS_DNR = 1 shl 15
+
+; Completion Queue Entry Status Field - Status Code Type Values
+CQ_STATUS_SCT_GCS   = 0x0 ; Generic Command Status
+CQ_STATUS_SCT_CSS   = 0x1 ; Command Specific Status
+CQ_STATUS_SCT_MADIE = 0x2 ; Media and Data Integrity Errors
+CQ_STATUS_SCT_PRS   = 0x3 ; Path Related Status
+
+; Completion Queue Entry Status Field - Status Code Generic Command Values
+CQ_STATUS_SC_GCS_SUCCESS = 0x00 ; Successful Completion
+CQ_STATUS_SC_GCS_ICOP    = 0x01 ; Invalid Command Opcode
+CQ_STATUS_SC_GCS_IFIC    = 0x02 ; Invalid Field in Command
+CQ_STATUS_SC_GCS_CIDC    = 0x03 ; Command ID Conflict
+CQ_STATUS_SC_GCS_DTE     = 0x04 ; Data Transfer Error
+CQ_STATUS_SC_GCS_CAPLN   = 0x05 ; Commands Aborted due to Power Loss Notification
+CQ_STATUS_SC_GCS_INERR   = 0x06 ; Internal Error
+CQ_STATUS_SC_GCS_CAR     = 0x07 ; Command Abort Requested
+CQ_STATUS_SC_GCS_CASQD   = 0x08 ; Command Aborted due to SQ Deletion
+CQ_STATUS_SC_GCS_CAFFC   = 0x09 ; Command Aborted due to Failed Fused Command
+CQ_STATUS_SC_GCS_CAMFC   = 0x0A ; Command Aborted due to Missing Fused Command
+CQ_STATUS_SC_GCS_INNOF   = 0x0B ; Invalid Namespace or Format
+CQ_STATUS_SC_GCS_CSE	 = 0x0C ; Command Sequence Error
+CQ_STATUS_SC_GCS_INSGL   = 0x0D ; Invalid SGL Segment Descriptor
+CQ_STATUS_SC_GCS_INNSGL  = 0x0E ; Invalid Number of SGL Descriptors
+CQ_STATUS_SC_GCS_OPDEN   = 0x15 ; Operation Denied
+CQ_STATUS_SC_GCS_NSIWP   = 0x20 ; Namespace is Write Protected
+CQ_STATUS_SC_GCS_CINT    = 0x21 ; Command Interrupted
+CQ_STATUS_SC_GCS_TTE     = 0x22 ; Transient Transport Error
+
+; Completion Queue Entry Status Field - Status Code Media and Data Integrity Errors
+CQ_STATUS_SC_MADIE_WF    = 0x80 ; Write Fault
+CQ_STATUS_SC_MADIE_URE   = 0x81 ; Unrecovered Read Error
+CQ_STATUS_SC_MADIE_ACDEN = 0x86 ; Access Denied
+CQ_STATUS_SC_MADIE_DOULB = 0x87 ; Deallocated or Unwritten Logical Block
+
+; Controller Status (CSTS) Values
+CSTS_RDY = 1
+CSTS_CFS = 1 shl 1
+CSTS_SHST = (1 shl 2) or (1 shl 3)
+CSTS_NSSRO = 1 shl 4
+CSTS_PP = 1 shl 5
+CSTS_SHST_SHUTDOWN_OCCURRING = 1 shl 2
+CSTS_SHST_SHUTDOWN_COMPLETE = 1 shl 3
+
+; Admin Queue Attributes (AQA) Values
+AQA_ASQS = 0xfff
+AQA_ACQS = 0xfff shl 16
+
+; CDW10.SEL Values (Page 115 of NVMe 1.4 specification)
+CDW10_SEL_CURRENT = 000b
+CDW10_SEL_DEFAULT = 001b
+CDW10_SEL_SAVED = 010b
+CDW10_SEL_SUPPORTED_CAPABILITIES = 011b
+
+; Feature Identifiers (FID) Values (Page 206 of NVMe 1.4 specification)
+; Used in Get/Set Features Commands
+FID_ARBITRATION = 0x01
+FID_POWER_MANAGEMENT = 0x02
+FID_LBA_RANGE_TYPE = 0x03
+FID_TEMPERATURE_THRESHOLD = 0x04
+FID_ERROR_RECOVERY = 0x05
+FID_VOLATILE_WRITE_CACHE = 0x06
+FID_NUMBER_OF_QUEUES = 0x07
+FID_INTERRUPT_COALESCING = 0x08
+FID_INTERRUPT_VECTOR_CONFIGURATION = 0x09
+FID_WRITE_ATOMICITY_NORMAL = 0x0A
+FID_ASYNCHRONOUS_EVENT_CONFIGURATION = 0x0B
+FID_AUTONOMOUS_POWER_STATE_TRANSITION = 0x0C
+FID_HOST_MEMORY_BUFFER = 0x0D
+FID_TIMESTAMP = 0x0E
+FID_KEEP_ALIVE_TIMER = 0x0F
+FID_HOST_CONTROLLED_THERMAL_MANAGEMENT = 0x10
+FID_NON_OPERATIONAL_POWER_STATE_CONFIG = 0x11
+FID_READ_RECOVERY_LEVEL_CONFIG = 0x12
+FID_PREDICTABLE_LATENCY_MODE_CONFIG = 0x13
+FID_PREDICTABLE_LATENCY_MODE_WINDOW = 0x14
+FID_LBA_STATUS_INFORMATION_REPORT_INTERVAL = 0x15
+FID_HOST_BEHAVIOR_SUPPORT = 0x16
+FID_SANITIZE_CONFIG = 0x17
+FID_ENDURANCE_GROUP_EVENT_CONFIGURATION = 0x18
+; NVM Command Set Specific - FID
+FID_SOFTWARE_PROGRESS_MARKER = 0x80
+FID_HOST_IDENTIFIER = 0x81
+FID_RESERVATION_NOTIFICATION_MASK = 0x82
+FID_RESERVATION_PERSISTENCE = 0x83
+FID_NAMESPACE_WRITE_PROTECTION_CONFIG = 0x84
+
+; Get Log Page - Log Page Identifiers (Page 118-119 of NVMe 1.4 specification)
+LID_ERROR_INFORMATION = 0x01
+LID_SMARTHEALTH_INFORMATION = 0x02
+LID_FIRMWARE_SLOT_INFORMATION = 0x03
+LID_CHANGED_NAMESPACE_LIST = 0x04
+LID_COMMANDS_SUPPORTED_AND_EFFECTS = 0x05
+LID_DEVICE_SELF_TEST = 0x06
+LID_TELEMETRY_HOST_INITIATED = 0x07
+LID_TELEMETRY_CONTROLLER_INITIATED = 0x08
+LID_ENDURANCE_GROUP_INFORMATION = 0x09
+LID_PREDICTABLE_LATENCY_PER_NVM_SET = 0x0A
+LID_PREDICTABLE_LATENCY_EVENT_AGGREGATE = 0x0B
+LID_ASYMMETRIC_NAMESPACE_ACCESS = 0x0C
+LID_PERSISTENT_EVENT_LOG = 0x0D
+LID_LBA_STATUS_INFORMATION = 0x0E
+LID_ENDURANCE_GROUP_EVENT_AGGREGATE = 0x0F
+; I/O Command Set Specific - Log Page Identifiers
+LID_RESERVATION_NOTIFICATION = 0x80
+LID_SANITIZE_STATUS = 0x81
+
+; Controller Type Values
+CNTRLTYPE_IO_CONTROLLER = 0x1
+CNTRLTYPE_DISCOVERY_CONTROLLER = 0x2
+CNTRLTYPE_ADMIN_CONTROLLER = 0x3
+
+struct NVME_MMIO 
+	CAP      dq ? ; Controller Capabilities
+	VS       dd ? ; Version
+	INTMS    dd ? ; Interrupt Mask Set
+	INTMC    dd ? ; Interrupt Mask Clear
+	CC       dd ? ; Controller Configuration
+	         rd 1 ; Reserved
+	CSTS     dd ? ; Controller Status
+	NSSR     dd ? ; NVM Subsystem Reset
+	AQA      dd ? ; Admin Queue Attributes
+	ASQ      dq ? ; Admin Submission Queue Base Address
+	ACQ      dq ? ; Admin Completion Queue Base Address
+	CMBLOC   dd ? ; Controller Memory Buffer Location
+	CMBSZ    dd ? ; Controller Memory Buffer Size
+	BPINFO   dd ? ; Boot Partition Information
+	BPRSEL   dd ? ; Boot Partition Read Select
+	BPMBL    dq ? ; Boot Partition Memory Buffer Location
+	CMBMSC   dd ? ; Controller Memory Buffer Memory Space
+	CMBSTS   dd ? ; Controller Memory Buffer Status
+	    	 rb 3492 ; Reserved
+	PMRCAP   dd ? ; Persistent Memory Capabilities
+	PMRCTL   dd ? ; Persistent Memory Region Control
+	PMRSTS   dd ? ; Persistent Memory Region Status
+	PMREBS   dd ? ; Persistent Memory Region Elasticity Buffer Size
+	PMRSWTP  dd ? ; Persistent Memory Region Sustained Write Throughput
+	PMRMSC   dq ? ; Persistent Memory Region Controller Memory Space Control
+	    	 rb 484 ; Reserved
+	SQ0TDBL  dd ? ; Submission Queue 0 Tail Doorbell (Admin)
+ends
+
+
+; Submission Queue Entry (64 bytes)
+struct SQ_ENTRY
+	cdw0 	    	dd ?
+	nsid 	    	dd ?
+	cdw2            dd ?
+	cdw3            dd ?
+	mptr	    	dq ?
+	prp1	    	dq ?
+	prp2            dq ?
+	cdw10	    	dd ?
+	cdw11	    	dd ?
+	cdw12	    	dd ?
+	cdw13	    	dd ?
+	cdw14	    	dd ?
+	cdw15	    	dd ?
+ends
+
+; Completion Queue Entry (16 bytes) - See page 77 of the NVMe 1.4 spec
+struct CQ_ENTRY 
+	cdw0 	    	dd ?
+	    		rd 1 ; reserved
+	sqhd            dw ?
+	sqid            dw ?
+	cid             dw ?
+	status 	    	dw ?
+ends
+
+struct NSINFO
+	capacity 	dq ?
+	size 	    	dq ?
+	nsid 	    	dd ?
+	pci 	    	dd ?
+	lbads 	    	db ?
+	features 	db ?
+ends
+
+struct pcidev 
+	bus 	    	db ?
+	devfn 	    	db ?
+	    		rb 2 ; align
+	num 	    	dd ?
+	io_addr 	dd ?
+	queue_entries 	dd ?
+	version 	dd ?
+	nsid 	    	dd ?
+	spinlock 	dd ?
+	nsinfo 	    	dd ?
+	last_status 	dd ? ; status field of the last completion, 0 when all went well
+	nn 	    	dd ?
+	last_cdw0 	dd ? ; command specific result of the last completion
+	max_sectors 	dd ? ; biggest transfer a single I/O command may carry
+	disk 	    	dd ? ; handle from DiskAdd, 0 if none
+	pcidev 	    	dd ? ; the kernel's PCIDEV, claimed through its owner field
+	iolock 	    	MUTEX ; taken by whoever is using the I/O queue
+	dstrd 	    	db ?
+	mdts 	    	db ? ; Maximum Data Transfer Size, in 2^(12+MPSMIN) byte units
+	ready 	    	db ? ; 1 while the controller serves I/O; 0 before, after cleanup or once it hung
+	stuck 	    	db ? ; 1 if it hung and would not even go idle, so it may still DMA
+	hung 	    	db ? ; 1 once any command timed out, init and cleanup included
+	    		rb 3 ; align
+ends
+TOTAL_PCIDEVS = 4
+TOTAL_PCIDEVS_MALLOC_SZ = TOTAL_PCIDEVS * sizeof.pcidev
+
+struct NVM_QUEUE_ENTRY
+	tail 	    	dw ?
+	head 	    	dw ?
+	sq_ptr 	    	dd ?
+	cq_ptr 	    	dd ?
+	phase 	    	db ? ; phase tag the next completion of this queue will carry
+	    		rb 19 ; pad to a power of two, the queue index is shifted by LOG2 of it
+ends
+
+; Identify Controller Data Structure
+struct IDENTC
+
+	vid	   dw ?
+	ssvid      dw ?
+	sn         dt ?, ?
+	mn         rt 4
+	fr         dq ?
+	rab        db ?
+	ieee       db ?, ?, ?
+	cmic       db ?
+	mdts       db ?
+	cntlid     dw ?
+	ver        dd ?
+	rtd3r      dd ?
+	rtd3e      dd ?
+	oaes 	   dd ?
+	ctratt     dd ?
+	rrls       dw ?
+	           rb 9       ; reserved
+	cntrltype  db ?
+	fguid      dq ?, ?
+	crdt1      dw ?
+	crdt2      dw ?
+	crdt3      dw ?
+	           rb 106     ; reserved
+	           rb 16      ; reserved (NVMMI)
+	oacs 	   dw ?
+	acl 	   db ?
+	aerl 	   db ?
+	frmw 	   db ?
+	lpa 	   db ?
+	elpe 	   db ?
+	npss 	   db ?
+	avscc 	   db ?
+	apsta 	   db ?
+	wctemp 	   dw ?
+	cctemp 	   dw ?
+	mtfa 	   dw ?
+	hmpre 	   dd ?
+	hmmin 	   dd ?
+	tnvmcap    dq ?, ?
+	unvmcap    dq ?, ?
+	rpmbs 	   dd ?
+	edstt 	   dw ?
+	dsto 	   db ?
+	fwug 	   db ?
+	kas 	   dw ?
+	hctma 	   dw ?
+	mntmt 	   dw ?
+	mxtmt 	   dw ?
+	sanicap    dd ?
+	hmminds    dd ?
+	hmmaxd     dw ?
+	nsetidmax  dw ?
+	endgidmax  dw ?
+	anatt      db ?
+	anacap 	   db ?
+	anagrpmax  dd ?
+	nanagrpid  dd ?
+	pels 	   dd ?
+	    	   rb 156
+	sqes  	   db ?
+	cqes 	   db ?
+	maxcmd 	   dw ?
+	nn         dd ?
+	oncs 	   dw ?
+	fuses  	   dw ?
+	fna 	   db ?
+	vwc 	   db ?
+	awun 	   dw ?
+	awupf 	   dw ?
+	nvscc  	   db ?
+	nwpc 	   db ?
+	acwu 	   dw ?
+	    	   rb 2
+	sgls 	   dd ?
+	mnan 	   dd ?
+	    	   rb 224
+	subnqn 	   rq 32
+	    	   rb 768
+	    	   rb 256
+	psd0 	   rq 4
+	psd1	   rq 4
+	psd2  	   rq 4
+	psd3  	   rq 4
+	psd4 	   rq 4
+	psd5 	   rq 4
+	psd6       rq 4
+	psd7  	   rq 4
+	psd8  	   rq 4
+	psd9 	   rq 4
+	psd10 	   rq 4
+	psd11 	   rq 4
+	psd12 	   rq 4
+	psd13      rq 4
+	psd14 	   rq 4
+	psd15  	   rq 4
+	psd16 	   rq 4
+	psd17  	   rq 4
+	psd18  	   rq 4
+	psd19  	   rq 4
+	psd20  	   rq 4
+	psd21 	   rq 4
+	psd22 	   rq 4
+	psd23 	   rq 4
+	psd24  	   rq 4
+	psd25 	   rq 4
+	psd26 	   rq 4
+	psd27 	   rq 4
+	psd28 	   rq 4
+	psd29 	   rq 4
+	psd30 	   rq 4
+	psd31 	   rq 4
+	    	   rb 1024
+ends
+
+; Identify Namespace Data Structure
+struct IDENTN
+	nsze 	   dq ?
+	ncap 	   dq ?
+	nuse  	   dq ?
+	nsfeat     db ?
+	nlbaf 	   db ?
+	flbas 	   db ?
+	mc 	   db ?
+	dpc 	   db ?
+	dps 	   db ?
+	nmic 	   db ?
+	rescap 	   db ?
+	fpi 	   db ?
+	dlfeat 	   db ?
+	nawun 	   dw ?
+	nawupf 	   dw ?
+	nacwu 	   dw ?
+	nabsn      dw ?
+	nabo 	   dw ?
+	nabspf 	   dw ?
+	noiob 	   dw ?
+	nvmcap 	   dq ?
+	           dq ?
+	npwg 	   dw ?
+	npwa 	   dw ?
+	npdg 	   dw ?
+	npda 	   dw ?
+	nows 	   dw ?
+	           rb 18
+	anagrpid   dd ?
+	           rb 3
+	nsattr 	   db ?
+	nvmsetid   dw ?
+	endgid 	   dw ?
+	nguid 	   dq ?
+	           dq ?
+	eui64 	   dq ?
+	lbaf0	   dd ?
+	lbaf1 	   dd ? 
+	lbaf2 	   dd ?
+	lbaf3	   dd ?
+	lbaf4	   dd ?
+	lbaf5	   dd ?
+	lbaf6	   dd ?
+	lbaf7	   dd ?
+	lbaf8	   dd ?
+	lbaf9	   dd ?
+	lbaf10	   dd ?
+	lbaf11	   dd ?
+	lbaf12	   dd ?
+	lbaf13	   dd ?
+	lbaf14	   dd ?
+	lbaf15	   dd ?
+	           rb 3904
+ends
+
+; Namespace Granularity List (CNS 16h - Page 199 of NVMe specification 1.4)
+struct NSGRANLS 
+	
+	nga 	   dd ?
+	nod 	   db ?
+	    	   rb 27 ; reserved
+	ngd0 	   dq ?, ?
+	ngd1       dq ?, ?
+	ngd2       dq ?, ?
+	ngd3       dq ?, ?
+	ngd4       dq ?, ?
+	ngd5       dq ?, ?
+	ngd6       dq ?, ?
+	ngd7       dq ?, ?
+	ngd8       dq ?, ?
+	ngd9       dq ?, ?
+	ngd10      dq ?, ?
+	ngd11      dq ?, ?
+	ngd12      dq ?, ?
+	ngd13      dq ?, ?
+	ngd14      dq ?, ?
+	ngd15      dq ?, ?
+
+ends
+
+assert NVM_ASQS = NVM_ACQS
+assert SQ_ENTRIES = NVM_ASQS
+assert CQ_ENTRIES = NVM_ACQS
+assert NVM_MPS = 0
+assert CTRL_POLL_MS mod 10 = 0 ; nvme_poll waits it out in 1/100 s ticks
+assert PAGE_SIZE = 0x1000
+assert sizeof.NVME_MMIO = 4096
+assert sizeof.SQ_ENTRY = 64
+assert sizeof.CQ_ENTRY = 16
+assert sizeof.IDENTC = 4096
+assert sizeof.IDENTN = 4096
+assert sizeof.NSGRANLS = 288
+assert sizeof.NVM_QUEUE_ENTRY = 32
+

kernel/trunk/network/ARP.inc

@@ -83,6 +83,31 @@ macro arp_init {
 
 }
 
+;-----------------------------------------------------------------;
+;                                                                 ;
+; arp_clear_device: Empty the ARP table and counters of a removed ;
+;                   device.                                       ;
+;                                                                 ;
+;  IN:  edi = device number * 4                                   ;
+;                                                                 ;
+;-----------------------------------------------------------------;
+macro arp_clear_device {
+
+        xor     eax, eax
+        mov     [ARP_entries + edi], eax
+        mov     [ARP_packets_tx + edi], eax
+        mov     [ARP_packets_rx + edi], eax
+        mov     [ARP_conflicts + edi], eax
+
+        push    edi
+        imul    edi, (ARP_TABLE_SIZE * sizeof.ARP_entry)/4
+        add     edi, ARP_table
+        mov     ecx, (ARP_TABLE_SIZE * sizeof.ARP_entry)/2
+        rep stosw
+        pop     edi
+
+}
+
 ;-----------------------------------------------------------------;
 ;                                                                 ;
 ; arp_decrease_entry_ttls                                         ;
@@ -313,6 +338,9 @@ arp_output_request:
         DEBUGF  DEBUG_NETWORK_VERBOSE, "ARP_output_request: ip=%u.%u.%u.%u device=0x%x\n",\
         [esp]:1, [esp + 1]:1, [esp + 2]:1, [esp + 3]:1, ebx
 
+        test    ebx, ebx                        ; device is gone
+        jz      .exit
+
         mov     ax, ETHER_PROTO_ARP
         mov     ecx, sizeof.ARP_header
         mov     edx, ETH_BROADCAST              ; broadcast mac

kernel/trunk/network/IPv4.inc

@@ -105,6 +105,29 @@ macro   ipv4_init {
 }
 
 
+;-----------------------------------------------------------------;
+;                                                                 ;
+; ipv4_clear_device: Reset the IPv4 settings of a removed device, ;
+;                    so no route points to it anymore.            ;
+;                                                                 ;
+;  IN:  edi = device number * 4                                   ;
+;                                                                 ;
+;-----------------------------------------------------------------;
+macro   ipv4_clear_device {
+
+        xor     eax, eax
+        mov     [IPv4_address + edi], eax
+        mov     [IPv4_subnet + edi], eax
+        mov     [IPv4_nameserver + edi], eax
+        mov     [IPv4_gateway + edi], eax
+        mov     [IPv4_broadcast + edi], eax
+        mov     [IPv4_packets_tx + edi], eax
+        mov     [IPv4_packets_rx + edi], eax
+        mov     [IPv4_packets_dumped + edi], eax
+
+}
+
+
 ;-----------------------------------------------------------------;
 ;                                                                 ;
 ; Decrease TimeToLive of all fragment slots                       ;
@@ -757,6 +780,8 @@ ipv4_output_raw:
         push    esi eax
 
         call    ipv4_route
+        test    eax, eax
+        jz      .arp_error
         call    arp_ip_to_mac
 
         test    eax, 0xffff0000         ; error bits
@@ -967,6 +992,8 @@ ipv4_route:
 ; Check for on-link
         xor     edi, edi
   .loop:
+        cmp     [net_device_list + edi], 0      ; skip slots without a device
+        je      .next
         mov     ebx, [IPv4_address + edi]
         and     ebx, [IPv4_subnet + edi]
         jz      .next
@@ -983,7 +1010,10 @@ ipv4_route:
         mov     edi, 4                  ; skip loopback device
   .loop_gw:
         cmp     [IPv4_gateway + edi], 0
+        je      .next_gw
+        cmp     [net_device_list + edi], 0
         jne     .found_gw
+  .next_gw:
         add     edi, 4
         cmp     edi, 4*NET_DEVICES_MAX
         jb      .loop_gw
@@ -1049,14 +1079,23 @@ ipv4_route:
         cmp     eax, 0xffffffff
         je      @f
 
+; An interface without an address (DHCP not done yet, or the lease
+; dropped when the link went down) can send nothing but broadcasts: with
+; address and mask both zero every destination compared as on-link, and
+; the stack went asking ARP for internet addresses on behalf of 0.0.0.0.
+        test    edx, edx
+        jz      .fail
+
 ; Check if we should route to gateway or not
-        mov     ebx, [IPv4_address + edi]
+        mov     ebx, edx
         and     ebx, [IPv4_subnet + edi]
         mov     ecx, eax
         and     ecx, [IPv4_subnet + edi]
         cmp     ecx, ebx
         je      @f
         mov     eax, [IPv4_gateway + edi]
+        test    eax, eax
+        jz      .fail                                ; off-link and no gateway
   @@:
         DEBUGF  DEBUG_NETWORK_VERBOSE, "IPv4_route: %u\n", edi
         ret

kernel/trunk/network/ethernet.inc

@@ -61,6 +61,41 @@ macro   eth_init {
 
 }
 
+;-----------------------------------------------------------------;
+;                                                                 ;
+; eth_clear_device: Drop the frames of a removed device that are  ;
+;                   still waiting in the input queue, their       ;
+;                   NET_BUFF.device will not be valid anymore.    ;
+;                                                                 ;
+;  IN:  ebx = device ptr                                          ;
+;                                                                 ;
+;-----------------------------------------------------------------;
+macro   eth_clear_device {
+
+local   .loop, .done
+
+        spin_lock_irqsave
+        mov     esi, [ETH_frame_head]
+  .loop:
+        cmp     esi, ETH_frame_head
+        je      .done
+        mov     eax, esi
+        mov     esi, [esi + NET_BUFF.NextPtr]
+        cmp     [eax + NET_BUFF.device], ebx
+        jne     .loop
+
+; unlink it, ETH_frame_head/tail double as the NextPtr/PrevPtr of the list head
+        mov     ecx, [eax + NET_BUFF.PrevPtr]
+        mov     [ecx + NET_BUFF.NextPtr], esi
+        mov     [esi + NET_BUFF.PrevPtr], ecx
+        dec     [ETH_frame_queued]
+        stdcall net_buff_free, eax
+        jmp     .loop
+  .done:
+        spin_unlock_irqrestore
+
+}
+
 align 4
 ; This function is called by ethernet drivers.
 ; Push the received ethernet packet onto the ethernet input queue.
@@ -245,6 +280,9 @@ eth_output:
 
         DEBUGF  DEBUG_NETWORK_VERBOSE, "ETH_output: size=%u device=%x\n", ecx, ebx
 
+        test    ebx, ebx
+        jz      .no_device
+
         cmp     ecx, [ebx + ETH_DEVICE.mtu]
         ja      .too_large
 
@@ -295,11 +333,16 @@ eth_output:
         ret
 
   .too_large:
-        inc     [eax + NET_DEVICE.packets_tx_err]
+        inc     [ebx + NET_DEVICE.packets_tx_err]
         DEBUGF  DEBUG_NETWORK_VERBOSE, "ETH_output: Packet too large!\n"
         xor     eax, eax
         ret
 
+  .no_device:
+        DEBUGF  DEBUG_NETWORK_ERROR, "ETH_output: no device!\n"
+        xor     eax, eax
+        ret
+
 
 
 ;-----------------------------------------------------------------;

kernel/trunk/network/stack.inc

@@ -597,6 +597,16 @@ net_remove_device:
         mov     dword [edi-4], eax
         dec     [net_device_count]
 
+;-----------------------------------------------------------------
+; Forget everything the protocols still know about this interface.
+; Otherwise its IP address keeps matching in ipv4_route, and output
+; ends up calling through the now empty net_device_list slot.
+
+        sub     edi, net_device_list + 4        ; device number * 4
+        ipv4_clear_device
+        arp_clear_device
+        eth_clear_device
+
         call    net_send_event
 
         xor     eax, eax

kernel/trunk/network/tcp_input.inc

@@ -1422,10 +1422,14 @@ endl
         test    [edx + TCP_header.Flags], TH_ACK
         jz      .drop
 
-        mov     eax, ebx
+        push    ebx
+        lea     ecx, [ebx + SOCKET.mutex]
+        call    mutex_unlock
+        pop     eax
+
         mov     ebx, ECONNREFUSED
         call    tcp_drop
-        jmp     .drop
+        jmp     .drop_no_socket
        @@:
 
 ;-----------------------------------------------------------------------------------

kernel/trunk/network/tcp_output.inc

@@ -234,23 +234,25 @@ endl
         mov     ebx, TCP_max_win
         shl     ebx, cl
         pop     ecx
-        sub     ebx, [eax + TCP_SOCKET.RCV_ADV]
-        add     ebx, [eax + TCP_SOCKET.RCV_NXT]
+
+; Clamp to available window first, then subtract what the peer already knows (as in BSD)
 
         cmp     ebx, ecx
-        jl      @f
+        jbe     @f
         mov     ebx, ecx
        @@:
+        sub     ebx, [eax + TCP_SOCKET.RCV_ADV]
+        add     ebx, [eax + TCP_SOCKET.RCV_NXT]
 
         DEBUGF  DEBUG_NETWORK_VERBOSE, "TCP_output: we can increase window by %d bytes\n", ebx
 
         mov     edi, [eax + TCP_SOCKET.t_maxseg]
         shl     edi, 1
-        cmp     ebx, edi
-        jae     .send
+        cmp     ebx, edi                                ; signed: may be negative if window shrank
+        jge     .send
 
         cmp     ebx, SOCKET_BUFFER_SIZE/2
-        jae     .send
+        jge     .send
 
   .no_window:
 

kernel/trunk/network/tcp_usreq.inc

@@ -180,6 +180,8 @@ tcp_connect:
 
   .nomem:
         pop     edx eax
+        lea     ecx, [eax + SOCKET.mutex]
+        call    mutex_unlock
         xor     eax, eax
         dec     eax
         mov     ebx, ENOMEM
@@ -194,6 +196,8 @@ tcp_connect:
   .enoroute:
         pop     eax
         popa
+        lea     ecx, [eax + SOCKET.mutex]
+        call    mutex_unlock
         xor     eax, eax
         dec     eax
         mov     ebx, EADDRNOTAVAIL

programs/develop/libraries/http/http.asm

@@ -1618,21 +1618,23 @@ endl
 
 ; Open a new TCP socket
         mcall   socket, AF_INET4, SOCK_STREAM, 0
-        test    eax, eax
-        jz      .error3
+        cmp     eax, -1
+        je      .error3
         mov     [socketnum], eax
         DEBUGF  1, "Socket: 0x%x\n", eax
 
 ; Connect to the server
         mcall   connect, [socketnum], [sockaddr], 18
         test    eax, eax
-        jnz     .error3
+        jnz     .error4
         DEBUGF  1, "Socket is now connected.\n"
 
         invoke  freeaddrinfo            ; Free allocated memory
         mov     eax, [socketnum]
         ret
 
+  .error4:
+        mcall   close, [socketnum]
   .error3:
         DEBUGF  2, "Could not connect to the remote server\n"
         invoke  freeaddrinfo            ; Free allocated memory

programs/develop/libraries/libs-dev/libimg/jpeg/jpeg.asm

@@ -501,7 +501,8 @@ img.decode.jpg:
 	jnz	.no_create_palette
 	push	ecx edi
 	mov	edi, [eax + Image.Palette]
-	xor	eax, eax
+	mov	eax, 0xFF000000	; opaque, like the palettes of the other decoders:
+				; converted to 32 bpp, alpha 0 made the picture invisible
 	mov	ecx, 256
 @@:
 	stosd

programs/system/setup/settings.inc

@@ -1,256 +0,0 @@
-; SPDX-License-Identifier: NOASSERTION
-;
-; System settings: read them from the kernel or from system.ini,
-; apply them to the kernel and save them to system.ini.
-
-;---------------------------------------------------------------
-; Take the current values from the kernel, the mouse ones at system start only
-settings_read_boot:
-	mcall	18,19,0
-	mov	[mouseSpeed],eax
-	mcall	18,,2
-	mov	[mouseAccel],eax
-	mcall	18,,6
-	mov	[mouseDelay],eax
-settings_read_system:
-	mcall	26,5
-	dec	eax		; the kernel counts languages from 1
-	cmp	eax,LANGUAGES
-	jb	@f
-	xor	eax,eax
-@@:
-	mov	[language],eax
-	mcall	26,11
-	mov	[lba],eax
-	mcall	26,12
-	mov	[pci],eax
-	mcall	18,8,1
-	mov	[speakerMute],eax
-	mcall	48,9
-	mov	[fontSmoothing],eax
-	mcall	48,11
-	mov	[fontHeight],eax
-; keep the font height within what the window shows and steps through
-font_height_limits:
-	mov	eax,[fontHeight]
-	cmp	eax,FONT_H_MIN
-	jge	@f
-	mov	eax,FONT_H_MIN
-@@:
-	cmp	eax,FONT_H_MAX
-	jle	@f
-	mov	eax,FONT_H_MAX
-@@:
-	mov	[fontHeight],eax
-	ret
-
-;---------------------------------------------------------------
-; Override the values with the ones stored in system.ini.
-; A missing or unknown value keeps the current one.
-settings_read_ini:
-	mov	esi,iniSettings
-.next:
-	mov	edi,[esi+12]
-	test	edi,edi
-	jnz	.word
-	mov	eax,[esi+8]
-	invoke	ini.get_int, sz_ini, [esi], [esi+4], [eax]
-	jmp	.store
-.word:
-	and	[iniWord],0
-	invoke	ini.get_str, sz_ini, [esi], [esi+4], iniWord, 4, 0
-	mov	eax,[iniWord]
-	or	eax,0x20202020	; lowercase, zeroes become spaces
-	xor	edx,edx
-@@:
-	cmp	eax,[edi+4+edx*4]
-	jz	.found
-	inc	edx
-	cmp	edx,[edi]
-	jb	@b
-	jmp	.skip
-.found:
-	mov	eax,edx
-.store:
-	mov	edx,[esi+8]
-	mov	[edx],eax
-.skip:
-	add	esi,16
-	cmp	esi,iniSettings.end
-	jb	.next
-	jmp	font_height_limits
-
-;---------------------------------------------------------------
-; Store the values to system.ini (all but the mouse ones).
-; Not ebx for the loop: ini_set_str returns with ebx = 13.
-settings_save_ini:
-	mov	esi,iniSettings
-.next:
-	mov	eax,[esi+8]
-	mov	eax,[eax]
-	mov	edi,[esi+12]
-	test	edi,edi
-	jnz	.word
-	invoke	ini.set_int, sz_ini, [esi], [esi+4], eax
-	jmp	.done
-.word:
-	mov	eax,[edi+4+eax*4]
-	mov	[iniWord],eax
-	xor	ecx,ecx		; length of the word
-@@:
-	cmp	byte[iniWord+ecx],' '
-	jz	@f
-	inc	ecx
-	cmp	ecx,4
-	jb	@b
-@@:
-	invoke	ini.set_str, sz_ini, [esi], [esi+4], iniWord, ecx
-.done:
-	add	esi,16
-	cmp	esi,iniSettings.saved
-	jb	.next
-	ret
-
-;---------------------------------------------------------------
-; Pass the values to the kernel, the mouse ones at system start only
-settings_apply_boot:
-	mcall	18,19,1,[mouseSpeed]
-	mcall	18,,3,[mouseAccel]
-	mcall	18,,7,[mouseDelay]
-settings_apply:
-	mov	ecx,[language]
-	inc	ecx
-	mcall	21,5
-	mcall	21,11,[lba]
-	mcall	21,12,[pci]
-	mcall	48,10,[fontSmoothing]
-	mcall	48,12,[fontHeight]
-; the speaker can only be toggled
-	mcall	18,8,1
-	cmp	eax,[speakerMute]
-	jz	@f
-	mcall	18,,2
-@@:
-	ret
-
-;---------------------------------------------------------------
-; Button style, desktop background and skin from the [style] section.
-; Used at system start only.
-style_apply:
-	invoke	ini.get_int, sz_ini, sz_style, sz_buttonStyle, 0
-	mcall	48,1,eax
-
-; the background is set by a program: bg_program with bg_param
-	invoke	ini.get_str, sz_ini, sz_style, sz_bgProgram, bgProgram, PATH_MAX, 0
-	cmp	byte[bgProgram],0
-	jz	.skin
-	invoke	ini.get_str, sz_ini, sz_style, sz_bgParam, bgParam, PATH_MAX, 0
-	cmp	byte[bgParam],'\'	; KIV param like '\S__/path/to/img'
-	jnz	@f
-	mov	[fileInfo.path],bgParam+4
-	call	wait_for_file
-@@:
-	mcall	70,runBgProgram
-
-.skin:
-	invoke	ini.get_str, sz_ini, sz_style, sz_skin, skinPath, PATH_MAX, 0
-	cmp	byte[skinPath],0
-	jz	@f
-	mov	[fileInfo.path],skinPath
-	call	wait_for_file
-	mcall	48,8,skinPath
-@@:
-	ret
-
-; Files on /kolibrios and /usbhd may appear a few seconds after boot:
-; try to read the file for up to 5 seconds
-wait_for_file:
-	mov	edi,5
-@@:
-	mcall	70,fileInfo
-	test	eax,eax
-	jz	@f
-	mcall	5,100
-	dec	edi
-	jnz	@b
-@@:
-	ret
-
-;---------------------------------------------------------------
-; DATA
-; The languages of the kernel
-LANGUAGES = 8
-FONT_H_MIN = 9
-FONT_H_MAX = 99		; two digits in the window
-PATH_MAX = 256
-
-; Every value stored in system.ini: section, key, variable, words.
-; Words = 0 for a number, otherwise the list of words for 0, 1, 2...
-align 4
-iniSettings:
-	dd	sz_system,   sz_language,   language,      wordsLanguage
-	dd	sz_system,   sz_fontHeight, fontHeight,    0
-	dd	sz_system,   sz_fontSmooth, fontSmoothing, wordsSmoothing
-	dd	sz_lowLevel, sz_lba,        lba,           wordsOnOff
-	dd	sz_lowLevel, sz_pci,        pci,           wordsOnOff
-	dd	sz_lowLevel, sz_speaker,    speakerMute,   wordsSpeaker
-.saved:	; the mouse is configured by its own application
-	dd	sz_mouse,    sz_speed,      mouseSpeed,    0
-	dd	sz_mouse,    sz_accel,      mouseAccel,    0
-	dd	sz_mouse,    sz_dblClick,   mouseDelay,    0
-.end:
-
-wordsOnOff	dd 2, 'off ','on  '
-wordsSpeaker	dd 2, 'on  ','off '	; the ini keeps 'speaker on', not 'mute'
-wordsSmoothing	dd 3, 'off ','on  ','sbp '
-wordsLanguage	dd LANGUAGES, 'en  ','fi  ','de  ','ru  ','fr  ','et  ','es  ','it  '
-
-runBgProgram:
-	dd	7, 0, bgParam, 0, 0
-	db	0
-	dd	bgProgram
-
-fileInfo:
-	dd	0, 0, 0, 4, fileBuf
-	db	0
-.path	dd	?
-
-sz_ini		db "/sys/settings/system.ini",0
-
-sz_system	db "system",0
-sz_language	db "language",0
-sz_fontHeight	db "font height",0
-sz_fontSmooth	db "font smoothing",0
-sz_speaker	db "speaker",0
-
-sz_lowLevel	db "low-level",0
-sz_lba		db "LBA",0
-sz_pci		db "PCI",0
-
-sz_mouse	db "mouse",0
-sz_speed	db "speed",0
-sz_accel	db "acceleration",0
-sz_dblClick	db "double_click_delay",0
-
-sz_style	db "style",0
-sz_buttonStyle	db "buttons_gradient",0
-sz_bgProgram	db "bg_program",0
-sz_bgParam	db "bg_param",0
-sz_skin		db "skin",0
-
-; not stored in the program file
-language	dd ?
-lba		dd ?
-pci		dd ?
-speakerMute	dd ?
-fontSmoothing	dd ?
-fontHeight	dd ?
-mouseSpeed	dd ?
-mouseAccel	dd ?
-mouseDelay	dd ?
-
-iniWord		dd ?	; a word of system.ini
-fileBuf		dd ?
-bgProgram	rb PATH_MAX
-bgParam		rb PATH_MAX
-skinPath	rb PATH_MAX

programs/system/setup/setup.asm

@@ -1,316 +1,462 @@
 ; SPDX-License-Identifier: NOASSERTION
 ;
-; System settings.
-;   SETUP BOOT - apply the settings from system.ini (run from AUTORUN.DAT)
-;   SETUP      - window to change and save them
-;
-; Texts are UTF-8
 
-include '../../macros.inc'
-format meos 01
-entry START
-stack 4096
+; Text encoded with Code Page 866 - Cyrillic
+
+;;;;;;;;;;;;;;;;;;;;;;;
+;;  SYSTEM SETTINGS  ;;
+;;;;;;;;;;;;;;;;;;;;;;;
+
+format binary as ""
+use32
+org 0
+
+db 'MENUET01'
+dd 1
+dd START
+dd IM_END
+dd I_END
+dd I_END
+dd param
+dd 0
 
 include '../../proc32.inc'
+include '../../macros.inc'
 include '../../dll.inc'
+;---------------------------------------------------------------
+BootSettings:
+; Set system language
+	mov	word[param],0
+	invoke	ini.get_str, sz_ini, sz_system, sz_language, param, 2, 0
+	mov	ax, [param]
+	or	ax, 0x2020	; convert to lowercase
+	mov	ecx,langMarks.size/2
+	mov	edi,langMarks
+	repnz scasw
+	jnz	@f
+	neg	ecx
+	add	ecx,langMarks.size/2
+	mcall	21,5
+@@:
 
+; Set font smoothing
+	mov	dword[param],0
+	invoke	ini.get_str, sz_ini, sz_system, sz_fontSmooth, param, 4, 0
+	xor	ecx,ecx
+	mov	eax,[param]
+	or	eax,0x20202020
+	cmp	eax,'off '
+	jz	@f
+	inc	ecx
+	cmp	eax,'on  '
+	jz	@f
+	cmp	eax,'sbp '
+	jnz	.skipFont
+	inc	ecx
+@@:
+	mcall	48,10
+.skipFont:
+
+; Enable/disable system speaker
+	mov	dword[param],0
+	invoke	ini.get_str, sz_ini, sz_system, sz_speaker, param, 4, 0
+	mov	eax,[param]
+	or	eax,0x20202020
+	cmp	eax,'off '
+	jz	@f
+	cmp	eax,'on  '
+	jnz	.skipSpeaker
+	inc	[speaker_mute]
+@@:
+	call	_speaker_mute
+.skipSpeaker:
+
+; Set font size
+	invoke	ini.get_int, sz_ini, sz_system, sz_fontSize, 9
+	mov	ecx,eax
+	mcall	48,12
+
+; Set mouse speed
+	invoke	ini.get_int, sz_ini, sz_mouse, sz_speed, 1
+	mov	edx,eax
+	mcall	18,19,1
+
+; Set mouse acceleration
+	invoke	ini.get_int, sz_ini, sz_mouse, sz_acceleration, 1
+	mov	edx,eax
+	mcall	18,19,3
+
+; Set mouse double click delay
+	invoke	ini.get_int, sz_ini, sz_mouse, sz_double_click_delay, 1
+	mov	edx,eax
+	mcall	18,19,7
+
+; Enable/disable LBA access for applications
+	mov	dword[param],0
+	invoke	ini.get_str, sz_ini, sz_low_level, sz_lba, param, 4, 0
+	xor	ecx,ecx
+	mov	eax,[param]
+	or	eax,0x20202020
+	cmp	eax,'off '
+	jz	@f
+	cmp	eax,'on  '
+	jnz	.skipLBA
+	inc	ecx
+@@:
+	mcall	21,11
+.skipLBA:
+
+; Enable/disable PCI access for applications
+	mov	dword[param],0
+	invoke	ini.get_str, sz_ini, sz_low_level, sz_pci, param, 4, 0
+	xor	ecx,ecx
+	mov	eax,[param]
+	or	eax,0x20202020
+	cmp	eax,'off '
+	jz	@f
+	cmp	eax,'on  '
+	jnz	close
+	inc	ecx
+@@:
+	mcall	21,12
+	jmp	close
 ;---------------------------------------------------------------
 START:
 	mcall	68,11
 	stdcall dll.Load, @IMPORT
+	push	eax
 	test	eax,eax
-	jnz	quit
+	jnz	close
 
-	GetCommandLine eax
-	cmp	dword[eax],'BOOT'
-	jnz	@f
+	cmp	[param],dword 'BOOT'
+	jz	BootSettings
+	pop	eax
 
-	call	settings_read_boot
-	call	settings_read_ini
-	call	settings_apply_boot
-	call	style_apply
-quit:
-	mcall	-1
+; get current settings
+	mcall	26,5
+	dec	eax
+	mov	[syslang],eax
 
-@@:
-	call	settings_read_system
-; the checkbox image is shared by @RESHARE, 0 if it is not running
-	mcall	68,22,sz_checkbox,0,0
-	mov	[checkboxImage],eax
+	mcall	26,11
+	mov	[lba_read],eax
+
+	mcall	26,12
+	mov	[pci_acc],eax
+
+	mcall	18,8,1
+	mov	[speaker_mute],eax
+
+	mcall	48,9
+	mov	[fontSmoothing],eax
+
+	mcall	48,11
+	mov	[fontSize],eax
+
+loadtxt:
+	cmp	[syslang],3
+	jz	.ru
+	cmp	[syslang],5
+	jz	.et
+	mov	[text],texteng
+	jmp	draw_window
+.et:
+	mov	[text],textet
+	jmp	draw_window
+.ru:
+	mov	[text],textrus
 
-;---------------------------------------------------------------
 draw_window:
-	mov	eax,[language]
-	mov	eax,[texts+eax*4]
-	mov	[text],eax
-
 	mcall	12,1
-	mcall	48,3,sc,sizeof.system_colors
-	mov	byte[sc.work_text+3],FONT
-	mov	byte[sc.work_button_text+3],FONT
-	mcall	48,4
-	lea	ecx,[eax+(50 shl 16)+CLIENT_H+4]
-	mov	edx,[sc.work]
-	or	edx,0x34000000
-	mcall	0,<50,CLIENT_W+9>,,,0,title
-
-; a row: label, value (drawn by draw_values), '-' and '+' buttons
-	xor	ebp,ebp
-.row:
-	imul	edi,ebp,ROW_STEP
-	add	edi,TOP		; y of the row
-	mov	ecx,edi
-	shl	ecx,16
-	add	ecx,ROW_H-1	; the button is 1 pixel bigger than given
-	lea	edx,[FIRST_ROW_BUTTON+ebp*2]
-	mcall	8,<BUTTON1_X,ROW_H-1>,,,[sc.work_button]
-	lea	edx,[FIRST_ROW_BUTTON+1+ebp*2]
-	mcall	8,<BUTTON2_X,ROW_H-1>
-; the kernel leaves the corners of a button out: one frame for both,
-; its right corners stay out
-	mov	edx,[sc.work_button]
-	shr	edx,1
-	and	edx,0x7F7F7F	; the border colour of a button
-	mov	cx,1
-	mcall	13,<BUTTON1_X,BUTTON2_X+ROW_H-1-BUTTON1_X>
-	add	ecx,(ROW_H-1) shl 16
-	mcall	13
-
-	lea	ebx,[edi+TEXT_DY+(LABEL_X shl 16)]
-	mov	ecx,ebp
-	call	get_text
-	mcall	4,,[sc.work_text]
-
-	lea	ebx,[edi+TEXT_DY+((BUTTON1_X+8) shl 16)]
-	lea	edx,[glyphs+ebp*4]
-	mcall	4,,[sc.work_button_text]
-	lea	ebx,[edi+TEXT_DY+((BUTTON2_X+8) shl 16)]
-	lea	edx,[glyphs+2+ebp*4]
-	mcall	4
-
-	inc	ebp
-	cmp	ebp,ROWS
-	jb	.row
-
-; group box of the checkboxes: a frame, its title over it on the work colour
-	mcall	13,<GROUP_X,GROUP_W>,<GROUP_Y,GROUP_H>,[sc.work_graph]
-	mcall	13,<GROUP_X+1,GROUP_W-2>,<GROUP_Y+1,GROUP_H-2>,[sc.work]
-	mov	ecx,T_GROUP
-	call	get_text
-	mov	ecx,[sc.work_text]
-	or	ecx,0x40000000
-	mcall	4,<GROUP_TITLE_X,GROUP_TITLE_Y>,,,,[sc.work]
-
-; The checkboxes are spread over the group, the last one ends at its end.
-; LBA and PCI are fixed, so the step only depends on the speaker label.
-	mov	ecx,T_SPEAKER
-	call	get_text
-	mov	eax,ITEM_END-ITEM_X-CHECK_SIZE-8
-.length:
-	mov	cl,[edx]
+	mov	ecx,50*65536+32*(4+stringsAmount)
+	mcall	0,<50,700>,,0xB4111199,0,title
+; Main buttons
+	mov	eax,8
+	mov	ecx,6*65536+26
+	mov	edx,4
+	mov	esi,0x5580c0
+	mov	ebp,stringsAmount
+@@:
+	mcall	,<490,24>
 	inc	edx
-	test	cl,cl
-	jz	.step
-	and	cl,0xC0
-	cmp	cl,0x80		; UTF-8 continuation byte
-	jz	.length
-	sub	eax,8
-	jmp	.length
-.step:
-	shr	eax,1
-	mov	[checkStep],eax
-
-; a checkbox: the box (drawn by draw_values), then the label, both under
-; one button up to the end of the group. The next button covers the rest.
-	xor	ebp,ebp
-.check:
-	mov	edi,[checkStep]
-	imul	edi,ebp
-	add	edi,ITEM_X	; x of the box
-	lea	ebx,[edi+CHECK_SIZE+8]
-	shl	ebx,16
-	add	ebx,CHECK_Y+TEXT_DY
-	call	check_label
-	mcall	4,,[sc.work_text]
-	mov	ebx,edi
-	shl	ebx,16
-	add	ebx,ITEM_END
-	sub	ebx,edi
-	lea	edx,[FIRST_CHECK_BUTTON+BT_HIDE+BT_NOFRAME+ebp]
-	mcall	8,,<CHECK_Y,ROW_H-1>
-	inc	ebp
-	cmp	ebp,CHECKS
-	jb	.check
-
+	mcall	,<526,24>
+	inc	edx
+	mcall	,<562,120>
+	inc	edx
+	add	ecx,32*65536
+	dec	ebp
+	jnz	@b
+; APPLY ALL
+	add	ecx,32*65536
+	mcall	,<514,168>,,3,0x005588dd
+; SAVE ALL
+	add	ecx,32*65536
+	dec	edx
+	mcall
 	mcall	12,2
 
-;---------------------------------------------------------------
-draw_values:
-	mov	edx,languageNames
-	mov	ecx,[language]
-	call	nth_string
-	mov	[valueText],edx
+draw_infotext:
+	mov	eax,[syslang]
+	mov	edi,[text]
+	lea	esi,[eax*8+langs]
+	add	edi,28
+	movsd
+	movsd
+	add	edi,LLL-8
 
-	mov	edx,sz_subpixel
-	mov	ecx,[fontSmoothing]
-	cmp	ecx,2
-	jae	@f
-	add	ecx,T_OFF
-	call	get_text
+	mov	eax,[lba_read]
+	call	onoff
+	mov	[edi],ebx
+
+	mov	eax,[pci_acc]
+	call	onoff
+	mov	[edi+LLL],ebx
+
+	mov	eax,[speaker_mute]
+	call	onoff
+	mov	[edi+LLL*2],ebx
+
+	mov	ebx,'SUBP'
+	mov	ecx,'IXEL'
+	cmp	[fontSmoothing],2
+	jz	@f
+	mov	eax,[fontSmoothing]
+	call	onoff
+	mov	ecx,'    '
 @@:
-	mov	[valueText+4],edx
+	mov	[edi+LLL*3],ebx
+	mov	[edi+LLL*3+4],ecx
 
-	mov	eax,[fontHeight]
-	mov	bl,10
+	mov	eax,[fontSize]
+	mov	bl, 10
 	div	bl
-	add	ax,'00'
-	mov	word[heightText],ax
-	mov	[valueText+8],heightText
+	add	ax, '00'
+	mov	[edi+LLL*4],ax
+; draw text
+	mcall	13,<342,96>,32*stringsAmount,80111199h
+	mov	eax,4
+	mov	ebx,6*65536+11
+	mov	ecx,1ffffffh
+	mov	edx,[text]
+	mov	esi,LLL
+	mov	ebp,stringsAmount
+newline:
+	mcall
+	add	ebx,32
+	add	edx,esi
+	dec	ebp
+	jnz	newline
 
-; each value in a light box framed on three sides, the button is the fourth,
-; the left corners are cut off
-	xor	ebp,ebp
-.row:
-	imul	edi,ebp,ROW_STEP
-	add	edi,TOP
-	mov	ecx,edi
-	shl	ecx,16
-	add	ecx,ROW_H
-	mcall	13,<VALUE_X+1,VALUE_W-1>,,[sc.work_graph]
-	add	ecx,(1 shl 16)-2
-	mcall	13,<VALUE_X,VALUE_W>
-; sunken, the inner lines of a button reversed: three boxes, each 1 pixel
-; smaller, leave darker lines left and top and lighter right and bottom
-	mov	edx,[sc.work_light]
-	mov	eax,edx
-	shr	eax,3
-	and	eax,0x1F1F1F
-	sub	edx,eax		; 1/8 darker
-	mcall	13,<VALUE_X+1,VALUE_W-1>
-	mov	edx,[sc.work_light]
-	or	edx,0x1F1F1F	; lighter
-	add	ecx,(1 shl 16)-1
-	mcall	13,<VALUE_X+2,VALUE_W-2>
-	dec	ecx
-	mcall	13,<VALUE_X+2,VALUE_W-3>,,[sc.work_light]
-	lea	ebx,[edi+TEXT_DY+((VALUE_X+VALUE_PAD) shl 16)]
-	mov	edx,[valueText+ebp*4]
-	mcall	4,,[sc.work_text]
-	inc	ebp
-	cmp	ebp,ROWS
-	jb	.row
+	mov	ebp,2
+	add	ebx,32
+@@:
+	mcall
+	add	ebx,32
+	add	edx,esi
+	dec	ebp
+	jnz	@b
 
-; checkboxes: a frame, light inside, the @RESHARE image when set
-	xor	ebp,ebp
-.check:
-	mov	ebx,[checkStep]
-	imul	ebx,ebp
-	add	ebx,ITEM_X
-	shl	ebx,16
-	add	ebx,CHECK_SIZE
-	mcall	13,,<CHECK_BOX_Y,CHECK_SIZE>,[sc.work_graph]
-	add	ebx,(1 shl 16)-2
-	mcall	13,,<CHECK_BOX_Y+1,CHECK_SIZE-2>,[sc.work_light]
-	mov	eax,[checks+ebp*8]
-	mov	eax,[eax]
-	xor	eax,[checks+ebp*8+4]
-	jz	.next
-	mov	edx,ebx
-	mov	dx,CHECK_BOX_Y+1
-	mov	ebx,[checkboxImage]
-	test	ebx,ebx		; no @RESHARE: the box stays empty
-	jz	.next
-	mcall	7,,<CHECK_SIZE-2,CHECK_SIZE-2>
-.next:
-	inc	ebp
-	cmp	ebp,CHECKS
-	jb	.check
-
-;---------------------------------------------------------------
 still:
 	mcall	10
 	cmp	eax,1
 	jz	draw_window
+
 	cmp	eax,2
-	jz	.key
+	jz	key
+
 	cmp	eax,3
-	jnz	still
+	jz	button
 
-	mcall	17
-	shr	eax,8
-	cmp	eax,1
-	jz	quit
-	sub	eax,FIRST_ROW_BUTTON
-	jb	still		; 0: no button after all
-	cmp	eax,FIRST_CHECK_BUTTON-FIRST_ROW_BUTTON
-	jae	.check
-
-; '-' or '+' of a row: step the value within the limits of the row
-	shr	eax,1		; eax = row, CF = '+'
-	lea	esi,[eax*3]
-	lea	esi,[rows+esi*4]
-	mov	edi,[esi]
-	mov	ecx,[edi]
-	jc	.plus
-	cmp	ecx,[esi+4]
-	jbe	still
-	dec	ecx
-	jmp	.set
-.plus:
-	cmp	ecx,[esi+8]
-	jae	still
-	inc	ecx
-.set:
-	mov	[edi],ecx
-	push	eax
-	call	apply_and_save
-	pop	eax
-	cmp	eax,1		; the language and the font smoothing
-	jbe	draw_window	; change all the texts: repaint the window
-	jmp	draw_values
-
-.check:
-	mov	eax,[checks-(FIRST_CHECK_BUTTON-FIRST_ROW_BUTTON)*8+eax*8]
-	xor	dword[eax],1
-	call	apply_and_save
-	jmp	draw_values
-
-.key:
+	jmp	still
+;---------------------------------------------------------------
+key:
 	mcall	2
 	jmp	still
-
 ;---------------------------------------------------------------
-; every change takes effect at once and is kept in system.ini
-apply_and_save:
-	call	settings_apply
-	jmp	settings_save_ini
-
-; edx = label of the checkbox ebp
-check_label:
-	mov	edx,[checkLabels+ebp*4]
-	test	edx,edx
-	jnz	@f
-	mov	ecx,T_SPEAKER
-	call	get_text
+button:
+	mcall	17
+	shr	eax,8
+	call	dword[eax*4+buttonTab-4]
+	jmp	draw_infotext
+close:
+	pop	eax
+	mcall	-1
+language1:
+	dec	[syslang]
+	jns	@f
+	mov	[syslang],7
+	jmp	@f
+language2:
+	inc	[syslang]
+	cmp	[syslang],8
+	jc	@f
+	mov	[syslang],0
+@@:
+	pop	eax
+	jmp	loadtxt
+LBA1:
+	btr	[lba_read],0
+	ret
+LBA2:
+	bts	[lba_read],0
+	ret
+PCI1:
+	btr	[pci_acc],0
+	ret
+PCI2:
+	bts	[pci_acc],0
+	ret
+SPEAKER1:
+	btr	[speaker_mute],0
+	ret
+SPEAKER2:
+	bts	[speaker_mute],0
+	ret
+font1:
+	cmp	[fontSmoothing],0
+	jz	@f
+	dec	[fontSmoothing]
+	ret
+font2:
+	cmp	[fontSmoothing],2
+	jz	@f
+	inc	[fontSmoothing]
+	ret
+fontSize1:
+	cmp	[fontSize],10
+	jc	@f
+	dec	[fontSize]
 @@:
 	ret
-
-; edx = string number ecx of the window language
-get_text:
-	mov	edx,[text]
-; edx = string number ecx of the zero separated list at edx
-nth_string:
-	jecxz	.done
-@@:
-	inc	edx
-	cmp	byte[edx-1],0
-	jnz	@b
-	loop	@b
-.done:
+fontSize2:
+	inc	[fontSize]
 	ret
+apply_all:
+	call	_lba_read
+	call	_pci_acc
+	call	_speaker_mute
+	call	fontApply
+	call	fontSizeApply
+_syslang:
+	mov	ecx,[syslang]
+	inc	ecx
+	mcall	21,5
+	ret
+_lba_read:
+	mcall	21,11,[lba_read]
+	ret
+_pci_acc:
+	mcall	21,12,[pci_acc]
+	ret
+fontApply:
+	mcall	48,10,[fontSmoothing]
+	ret
+fontSizeApply:
+	mcall	48,12,[fontSize]
+	ret
+_speaker_mute:
+	mcall	18,8,1
+	cmp	[speaker_mute],eax
+	jz	@f
+	inc	ecx
+	mcall	18
+@@:
+	ret
+;---------------------------------------------------------------
+onoff:
+	cmp	[syslang],3
+	jz	.ru
+	cmp	[syslang],5
+	jz	.et
+	mov	ebx,'OFF '
+	test	eax,eax
+	jz	@f
+	mov	ebx,'ON  '
+	ret
+.ru:
+	mov	ebx,'НЕТ '
+	test	eax,eax
+	jz	@f
+	mov	ebx,'ДА  '
+	ret
+.et:
+	mov	ebx,'V─L.'
+	test	eax,eax
+	jz	@f
+	mov	ebx,'SEES'
+@@:
+	ret
+;---------------------------------------------------------------
+saveAll:
+; system language
+	mov	eax,[syslang]
+	mov	ax, word[eax*2+langMarks]
+	mov	[param],eax
+	invoke	ini.set_str, sz_ini, sz_system, sz_language, param, 2
 
+; font size
+	invoke	ini.set_int, sz_ini, sz_system, sz_fontSize, [fontSize]
+
+; font smoothing
+	mov	dword[param],'off'
+	cmp	[fontSmoothing],0
+	jz	@f
+	mov	dword[param],'on '
+	cmp	[fontSmoothing],1
+	jz	@f
+	mov	dword[param],'sbp'
+@@:
+	invoke	ini.set_str, sz_ini, sz_system, sz_fontSmooth, param, 3
+
+; system speaker
+	mov	dword[param],'off'
+	cmp	[speaker_mute],0
+	jz	@f
+	mov	dword[param],'on '
+@@:
+	invoke	ini.set_str, sz_ini, sz_system, sz_speaker, param, 3
+
+; LBA access for applications
+	mov	dword[param],'off'
+	cmp	[lba_read],0
+	jz	@f
+	mov	dword[param],'on '
+@@:
+	invoke	ini.set_str, sz_ini, sz_low_level, sz_lba, param, 3
+
+; PCI access for applications
+	mov	dword[param],'off'
+	cmp	[pci_acc],0
+	jz	@f
+	mov	dword[param],'on '
+@@:
+	invoke	ini.set_str, sz_ini, sz_low_level, sz_pci, param, 3
+	ret
 ;---------------------------------------------------------------
 ; DATA
+align 4
+buttonTab:	; button handler pointers: -,+,apply
+	dd close
+	dd saveAll
+	dd apply_all
+	dd language1
+	dd language2
+	dd _syslang
+	dd LBA1
+	dd LBA2
+	dd _lba_read
+	dd PCI1
+	dd PCI2
+	dd _pci_acc
+	dd SPEAKER1
+	dd SPEAKER2
+	dd _speaker_mute
+	dd font1
+	dd font2
+	dd fontApply
+	dd fontSize1
+	dd fontSize2
+	dd fontSizeApply
+
 @IMPORT:
 library libini, 'libini.obj'
 import	libini, \
@@ -319,88 +465,76 @@ import	libini, \
 	ini.set_str, 'ini_set_str',\
 	ini.set_int, 'ini_set_int'
 
-ROWS	= 3
-CHECKS	= 3
-FIRST_ROW_BUTTON = 10	; row N has '-' = 10+N*2 and '+' = 11+N*2
-FIRST_CHECK_BUTTON = 20
-FONT	= 0xB0		; text flags: zero terminated, 8x16 UTF-8
-
-; layout of the client area: controls ROW_H high, GAP empty pixels apart,
-; EDGE to the window border, GAP at the top
-LABEL_CHARS = 20	; the longest label, Spanish
-GAP	= 12
-EDGE	= 8
-TOP	= GAP
-ROW_H	= 24
-ROW_STEP = ROW_H + GAP
-TEXT_DY	= 5		; the capitals, rows 2..11 of the font, centred in ROW_H
-LABEL_X	= EDGE - 1	; column 0 of a letter is empty: aligned with the group frame
-VALUE_X	= LABEL_X + LABEL_CHARS*8 + GAP
-VALUE_PAD = GAP
-VALUE_W	= 8*8 + VALUE_PAD*2
-BUTTON1_X = VALUE_X + VALUE_W	; right after the value box
-BUTTON2_X = BUTTON1_X + ROW_H - 1	; the buttons share a border
-CLIENT_W = BUTTON2_X + ROW_H + EDGE
-GROUP_X	= EDGE
-GROUP_W	= CLIENT_W - EDGE*2
-GROUP_Y	= TOP + ROWS*ROW_STEP + 5	; GAP to the capitals of the title
-GROUP_TITLE_Y = GROUP_Y - 7		; the frame crosses the capitals
-CHECK_Y	= GROUP_Y + 1 + GAP		; the row of the checkboxes
-GROUP_H	= 1 + GAP + ROW_H + GAP + 1
-CHECK_SIZE = 15
-CHECK_BOX_Y = CHECK_Y + (ROW_H-CHECK_SIZE)/2
-ITEM_X	= GROUP_X + 1 + GAP
-ITEM_END = GROUP_X + GROUP_W - GAP	; the last column of a letter is empty
-GROUP_TITLE_X = ITEM_X - 8 - 1	; a space, then a letter from its column 1
-CLIENT_H = GROUP_Y + GROUP_H + EDGE
-
-; variable, min, max of every row
-align 4
-rows:
-	dd	language,      0, LANGUAGES-1
-	dd	fontSmoothing, 0, 2
-	dd	fontHeight,    FONT_H_MIN, FONT_H_MAX
-
-; variable and the value of it that means 'not checked'
-checks	dd lba,0, pci,0, speakerMute,1
-checkLabels dd sz_lba, sz_pci, 0	; 0: the speaker label of the language
-
-glyphs	db '<',0,'>',0,'<',0,'>',0,'-',0,'+',0
-sz_subpixel db 'Subpixel',0
-languageNames db 'English',0,'Finnish',0,'German',0,'Russian',0
-	db 'French',0,'Estonian',0,'Spanish',0,'Italian',0
-
 title	db "System settings",0
-sz_checkbox db "CHECKBOX",0
+sz_ini	db "/sys/settings/system.ini",0
 
-; Texts of the window languages: zero terminated strings in this order
-; (row labels, group title, speaker label, 'off', 'on')
-T_GROUP	= ROWS
-T_SPEAKER = ROWS + 1
-T_OFF	= ROWS + 2
+sz_system	db "system",0
+sz_language	db "language",0
+sz_fontSize	db "font height",0
+sz_fontSmooth	db "font smoothing",0
+sz_speaker	db "speaker mute",0
 
-; the texts of every kernel language, English where there is no translation
-texts	dd texteng, texteng, texteng, textrus, texteng, texteng, textspa, texteng
+sz_mouse	db "mouse",0
+sz_speed	db "speed",0
+sz_acceleration	db "acceleration",0
+sz_double_click_delay	db "double_click_delay",0
 
-texteng	db 'System language',0, 'Font smoothing',0, 'Font height',0
-	db ' Access settings ',0, 'Speaker',0
-	db 'Off',0, 'On',0
+sz_low_level	db "low-level",0
+sz_lba		db "LBA",0
+sz_pci		db "PCI",0
 
-textspa	db 'Idioma del sistema',0, 'Suavizado de fuentes',0, 'Altura de fuente',0
-	db ' Ajustes de acceso ',0, 'Altavoz',0
-	db 'No',0, 'Sí',0
+LLL = 56
+stringsAmount = 6
 
-textrus	db 'Язык системы',0, 'Сглаживание шрифтов',0, 'Высота шрифтов',0
-	db ' Настройки доступа ',0, 'Динамик',0
-	db 'Нет',0, 'Да',0
+align 4
+langs:
+db 'ENGLISH FINNISH GERMAN  RUSSIAN FRENCH  ESTONIANSPANISH ITALIAN '
+sz langMarks, 'en','fi','de','ru','fr','et','es','it'
 
-;---------------------------------------------------------------
-include 'settings.inc'
+textrus:
+db 'Язык системы              :              <  >  Применить'
+db 'Включить LBA              :              -  +  Применить'
+db 'Доступ к шине PCI         :              -  +  Применить'
+db 'Выключить SPEAKER         :              -  +  Применить'
+db 'Сглаживание шрифтов       :              -  +  Применить'
+db 'Высота шрифтов            :              -  +  Применить'
 
+db 'ВНИМАНИЕ:                                  Применить все'
+db 'НЕ ЗАБУДЬТЕ СОХРАНИТЬ НАСТРОЙКИ            Сохранить все'
 
-text	dd ?		; texts of the window language
-checkboxImage dd ?
-checkStep dd ?		; x distance of two checkboxes
-sc	system_colors
-valueText rd ROWS	; the strings shown in the value boxes
-heightText rb 4
+texteng:
+db 'System language           :              <  >    Apply  '
+db 'Allow LBA access          :              -  +    Apply  '
+db 'Allow PCI access          :              -  +    Apply  '
+db 'Disable SPEAKER           :              -  +    Apply  '
+db 'Font smoothing            :              -  +    Apply  '
+db 'Font height               :              -  +    Apply  '
+
+db 'NOTE:                                        Apply all  '
+db 'SAVE YOUR SETTINGS BEFORE QUITING KOLIBRI    Save all   '
+
+textet:
+db 'S№steemi keel             :              <  >   Kinnita '
+db 'LBA lugemine lubatud      :              -  +   Kinnita '
+db 'PCI juurdepффs programm.  :              -  +   Kinnita '
+db 'Disable SPEAKER           :              -  +   Kinnita '
+db 'Font smoothing            :              -  +   Kinnita '
+db 'Font height               :              -  +   Kinnita '
+
+db 'M─RKUS:                                    Kinnita kїik '
+db 'SALVESTA SEADED ENNE KOLIBRIST V─LJUMIST   Salvesta kїik'
+
+IM_END:
+
+text	dd  ?
+
+syslang 	dd  ?
+lba_read	dd  ?
+pci_acc 	dd  ?
+speaker_mute	dd  ?
+fontSmoothing	dd  ?
+fontSize	dd  ?
+
+param:
+	rb 1024
+I_END: