.align 2_sys_fork:    call _find_empty_process    testl %eax,%eax    js 1f    push %gs    pushl %esi    pushl %edi    pushl %ebp    pushl %eax    call _copy_process    addl $20,%esp1:    ret

#include <errno.h>#include <linux/sched.h>#include <linux/kernel.h>#include <asm/segment.h>#include <asm/system.h> extern void write_verify(unsigned long address); long last_pid=0; void verify_area(void * addr,int size){    unsigned long start;     start = (unsigned long) addr;    size += start & 0xfff;    start &= 0xfffff000;    start += get_base(current->ldt[2]);    while (size>0) {        size -= 4096;        write_verify(start);        start += 4096;    }} int copy_mem(int nr,struct task_struct * p){    unsigned long old_data_base,new_data_base,data_limit;    unsigned long old_code_base,new_code_base,code_limit;     code_limit=get_limit(0x0f);    data_limit=get_limit(0x17);    old_code_base = get_base(current->ldt[1]);    old_data_base = get_base(current->ldt[2]);    if (old_data_base != old_code_base)        panic("We don't support separate I&D");    if (data_limit < code_limit)        panic("Bad data_limit");    new_data_base = new_code_base = nr * 0x4000000;    p->start_code = new_code_base;    set_base(p->ldt[1],new_code_base);    set_base(p->ldt[2],new_data_base);    if (copy_page_tables(old_data_base,new_data_base,data_limit)) {        free_page_tables(new_data_base,data_limit);        return -ENOMEM;    }    return 0;} /* *  Ok, this is the main fork-routine. It copies the system process * information (task[nr]) and sets up the necessary registers. It * also copies the data segment in it's entirety. */int copy_process(int nr,long ebp,long edi,long esi,long gs,long none,        long ebx,long ecx,long edx,        long fs,long es,long ds,        long eip,long cs,long eflags,long esp,long ss){    struct task_struct *p;   //创建子进程的task_struct结构体    int i;    struct file *f;     p = (struct task_struct *) get_free_page();    if (!p)        return -EAGAIN;    task[nr] = p;   //将子进程存到task链表中    *p = *current;    /* NOTE! this doesn't copy the supervisor stack */    //下面开始设置结构体内容    p->state = TASK_UNINTERRUPTIBLE;    p->pid = last_pid;    p->father = current->pid;    p->counter = p->priority;    p->signal = 0;    p->alarm = 0;    p->leader = 0;        /* process leadership doesn't inherit */    p->utime = p->stime = 0;    p->cutime = p->cstime = 0;    p->start_time = jiffies;    p->tss.back_link = 0;    p->tss.esp0 = PAGE_SIZE + (long) p;    p->tss.ss0 = 0x10;    p->tss.eip = eip;    p->tss.eflags = eflags;    p->tss.eax = 0;    p->tss.ecx = ecx;    p->tss.edx = edx;    p->tss.ebx = ebx;    p->tss.esp = esp;    p->tss.ebp = ebp;    p->tss.esi = esi;    p->tss.edi = edi;    p->tss.es = es & 0xffff;    p->tss.cs = cs & 0xffff;    p->tss.ss = ss & 0xffff;    p->tss.ds = ds & 0xffff;    p->tss.fs = fs & 0xffff;    p->tss.gs = gs & 0xffff;    p->tss.ldt = _LDT(nr);    p->tss.trace_bitmap = 0x80000000;    if (last_task_used_math == current)        __asm__("clts ; fnsave %0"::"m" (p->tss.i387));  //如果父进程用了协处理器，需要在tss段进行设置    if (copy_mem(nr,p)) {  //内存拷贝        task[nr] = NULL;        free_page((long) p);        return -EAGAIN;    }    for (i=0; i<NR_OPEN;i++)        if (f=p->filp[i])            f->f_count++;    if (current->pwd)        current->pwd->i_count++;    if (current->root)        current->root->i_count++;    if (current->executable)        current->executable->i_count++;    set_tss_desc(gdt+(nr<<1)+FIRST_TSS_ENTRY,&(p->tss));    set_ldt_desc(gdt+(nr<<1)+FIRST_LDT_ENTRY,&(p->ldt));    p->state = TASK_RUNNING;    /* do this last, just in case */    return last_pid; } int find_empty_process(void){    int i;     repeat:        if ((++last_pid)<0) last_pid=1;        for(i=0 ; i<NR_TASKS ; i++)            if (task[i] && task[i]->pid == last_pid) goto repeat;    for(i=1 ; i<NR_TASKS ; i++)        if (!task[i])              return i;    return -EAGAIN;}

#include <linux/sched.h>#include <linux/kernel.h>#include <asm/segment.h> #include <signal.h> volatile void do_exit(int error_code); int sys_sgetmask(){    return current->blocked;} int sys_ssetmask(int newmask){    int old=current->blocked;     current->blocked = newmask & ~(1<<(SIGKILL-1));    return old;} static inline void save_old(char * from,char * to){    int i;     verify_area(to, sizeof(struct sigaction));    for (i=0 ; i< sizeof(struct sigaction) ; i++) {        put_fs_byte(*from,to);        from++;        to++;    }} static inline void get_new(char * from,char * to){    int i;     for (i=0 ; i< sizeof(struct sigaction) ; i++)        *(to++) = get_fs_byte(from++);} int sys_signal(int signum, long handler, long restorer){    struct sigaction tmp;     if (signum<1 || signum>32 || signum==SIGKILL) //判断信号值是否合法        return -1;    tmp.sa_handler = (void (*)(int)) handler;    tmp.sa_mask = 0;    tmp.sa_flags = SA_ONESHOT | SA_NOMASK;    tmp.sa_restorer = (void (*)(void)) restorer;   //设置sigaction结构体    handler = (long) current->sigaction[signum-1].sa_handler;    current->sigaction[signum-1] = tmp; //将当前进程对应的信号结构体改为新分配的结构体    return handler; //返回处理函数} int sys_sigaction(int signum, const struct sigaction * action,    struct sigaction * oldaction){    struct sigaction tmp;     if (signum<1 || signum>32 || signum==SIGKILL)        return -1;    tmp = current->sigaction[signum-1];    get_new((char *) action,        (char *) (signum-1+current->sigaction));    if (oldaction)        save_old((char *) &tmp,(char *) oldaction);    if (current->sigaction[signum-1].sa_flags & SA_NOMASK)        current->sigaction[signum-1].sa_mask = 0;    else        current->sigaction[signum-1].sa_mask |= (1<<(signum-1));    return 0;} void do_signal(long signr,long eax, long ebx, long ecx, long edx,    long fs, long es, long ds,    long eip, long cs, long eflags,    unsigned long * esp, long ss){    unsigned long sa_handler;    long old_eip=eip;    struct sigaction * sa = current->sigaction + signr - 1;    int longs;    unsigned long * tmp_esp;     sa_handler = (unsigned long) sa->sa_handler;    if (sa_handler==1)        return;    if (!sa_handler) {        if (signr==SIGCHLD)            return;        else            do_exit(1<<(signr-1));    }    if (sa->sa_flags & SA_ONESHOT)        sa->sa_handler = NULL;    *(&eip) = sa_handler;    longs = (sa->sa_flags & SA_NOMASK)?7:8;    *(&esp) -= longs;    verify_area(esp,longs*4);    tmp_esp=esp;    put_fs_long((long) sa->sa_restorer,tmp_esp++);    put_fs_long(signr,tmp_esp++);    if (!(sa->sa_flags & SA_NOMASK))        put_fs_long(current->blocked,tmp_esp++);    put_fs_long(eax,tmp_esp++);    put_fs_long(ecx,tmp_esp++);    put_fs_long(edx,tmp_esp++);    put_fs_long(eflags,tmp_esp++);    put_fs_long(old_eip,tmp_esp++);    current->blocked |= sa->sa_mask;}

// Line 12#define SIGHUP         1        // 挂断控制终端或进程#define SIGINT         2        // 键盘中断#define SIGQUIT         3        // 键盘退出#define SIGILL         4        // 非法指令#define SIGTRAP         5        // 跟踪断点#define SIGABRT         6        // 异常结束#define SIGIOT         6        // 异常结束#define SIGUNUSED     7        // 未使用#define SIGFPE         8        // 协处理器错误#define SIGKILL         9        // 终止进程#define SIGUSR1        10        // 用户信号 1#define SIGSEGV        11        // 无效的内存引用#define SIGUSR2        12        // 用户信号 2#define SIGPIPE        13        // 管道写出错，读端全关闭#define SIGALRM        14        // 定时器警报#define SIGTERM        15        // 进程终止#define SIGSTKFLT    16        // 栈出错#define SIGCHLD        17        // 子进程状态改变#define SIGCONT        18        // 恢复进程继续执行#define SIGSTOP        19        // 暂停进程执行#define SIGTSTP        20        // tty 发出的停止进程信号#define SIGTTIN        21        // 后台进程请求输入#define SIGTTOU        22        // 后台进程请求输出 // Line 37#define SA_NOCLDSTOP    1            // 当子进程处于停止状态，就不对 SIGCHLD 信号做处理#define SA_NOMASK    0x40000000        // 允许在指定信号处理程序中再次收到该信号#define SA_ONESHOT    0x80000000        // 信号句柄一旦被调用过就恢复默认处理函数 // Line 45#define SIG_DFL        ((void (*)(int))0)    // 默认处理程序#define SIG_IGN        ((void (*)(int))1)    // 忽略信号对应的处理程序typedef unsigned int sigset_t; struct sigaction {    void (*sa_handler)(int);    // 信号处理程序指针    sigset_t sa_mask;        // 指出当前信号处理程序执行期间需要被屏蔽的信号    int sa_flags;            // 从 37 行的三个定义中选出    void (*sa_restorer)(void);    // 恢复函数指针，由 libc 提供};

#include <errno.h>#include <signal.h>#include <sys/wait.h> #include <linux/sched.h>#include <linux/kernel.h>#include <linux/tty.h>#include <asm/segment.h> int sys_pause(void);int sys_close(int fd); void release(struct task_struct * p)  //释放进程p{    int i;     if (!p)        return;    for (i=1 ; i<NR_TASKS ; i++)        if (task[i]==p) {            task[i]=NULL;            free_page((long)p);  //释放内存页            schedule();   //之后重新进行进程调度            return;        }    panic("trying to release non-existent task");} static inline int send_sig(long sig,struct task_struct * p,int priv){    if (!p || sig<1 || sig>32)        return -EINVAL;    if (priv || (current->euid==p->euid) || suser())        p->signal |= (1<<(sig-1));   //给p进程发送信号    else        return -EPERM;    return 0;} static void kill_session(void)  //关闭对话函数{    struct task_struct **p = NR_TASKS + task; //获得task数组最后一个任务     while (--p > &FIRST_TASK) {  //从最后一个向前遍历        if (*p && (*p)->session == current->session) //如果遍历到当前的任务            (*p)->signal |= 1<<(SIGHUP-1);     //则将SIGHUP挂断信号发送给当前任务    }} /* * XXX need to check permissions needed to send signals to process * groups, etc. etc.  kill() permissions semantics are tricky! */int sys_kill(int pid,int sig)  //linux命令kill不是杀死的意思，是向某进程发送任何信号{    struct task_struct **p = NR_TASKS + task;  //指向最后    int err, retval = 0; // 注： 每个进程组都有一个组长进程，组长进程的进程号等于进程组ID     if (!pid) while (--p > &FIRST_TASK) {  //如果pid为0，进入循环        if (*p && (*p)->pgrp == current->pid) //向进程组的所有成员发送信号            if (err=send_sig(sig,*p,1))                retval = err;    }    else if (pid>0) while (--p > &FIRST_TASK) { //如果pid大于0        if (*p && (*p)->pid == pid)  //仅向pid进程发送信号            if (err=send_sig(sig,*p,0))                retval = err;    }    else if (pid == -1) while (--p > &FIRST_TASK) //如果pid=-1        if (err = send_sig(sig,*p,0)) //向除0号进程外的进程发送信号            retval = err;    else while (--p > &FIRST_TASK) //如果pid<-1        if (*p && (*p)->pgrp == -pid) //向进程组号为-pid的进程组发送信号            if (err = send_sig(sig,*p,0))                retval = err;    return retval;} static void tell_father(int pid)  //传入参数为父进程的pid{    int i;     if (pid)        for (i=0;i<NR_TASKS;i++) {            if (!task[i])                continue;            if (task[i]->pid != pid)                continue;            task[i]->signal |= (1<<(SIGCHLD-1)); //SIGCHLD=17            return;        }/* if we don't find any fathers, we just release ourselves *//* This is not really OK. Must change it to make father 1 */    printk("BAD BAD - no father foundnr");    release(current);  //释放子进程} int do_exit(long code){    int i;                                                                //#define LDT_NUL 0                                                                //#define LDT_CODE 1                                                                //#define LDT_DATA 2    free_page_tables(get_base(current->ldt[1]),get_limit(0x0f)); //释放当前进程的CODE段所占用的内存页    free_page_tables(get_base(current->ldt[2]),get_limit(0x17));    for (i=0 ; i<NR_TASKS ; i++)  //从前向后遍历        if (task[i] && task[i]->father == current->pid) { //若当前进程就是某个进程的父进程时；            task[i]->father = 1; //就让1号进程作为某个进程的父进程(因为current这个进程将会exit)            if (task[i]->state == TASK_ZOMBIE) //若某进程是僵死状态                /* assumption task[1] is always init */                (void) send_sig(SIGCHLD, task[1], 1); //给1号进程发送信号        }    for (i=0 ; i<NR_OPEN ; i++)        if (current->filp[i]) //关闭当前进程打开的所有文件            sys_close(i);    iput(current->pwd);  //把当前进程的路径放回i节点并置空    current->pwd=NULL;    iput(current->root);    current->root=NULL;    iput(current->executable);    current->executable=NULL;    if (current->leader && current->tty >= 0) //若当前进程是进程组的头头，并且拥有tty终端        tty_table[current->tty].pgrp = 0; //释放该终端    if (last_task_used_math == current)        last_task_used_math = NULL;    if (current->leader)        kill_session(); //关闭session    current->state = TASK_ZOMBIE; //设置成僵死状态    current->exit_code = code;    tell_father(current->father); //向当前进程的父进程发送 SIGCHLD 信号    schedule();    return (-1);    /* just to suppress warnings */} int sys_exit(int error_code){    return do_exit((error_code&0xff)<<8);} int sys_waitpid(pid_t pid,unsigned long * stat_addr, int options){    int flag, code;    struct task_struct ** p;     verify_area(stat_addr,4);repeat:    flag=0;    for(p = &LAST_TASK ; p > &FIRST_TASK ; --p) {        if (!*p || *p == current) //若该项为空或者该项是当前进程，则跳过            continue;        if ((*p)->father != current->pid) //若该项的父进程不是当前进程，则跳过            continue;        if (pid>0) {  //若pid>0            if ((*p)->pid != pid) //若该项的pid不是waitpid传进来的pid参数，则跳过                continue;        } else if (!pid) {    //若pid=0,            if ((*p)->pgrp != current->pgrp) //若当前项不在当前进程组，则跳过                continue;        } else if (pid != -1) { //若pid<-1            if ((*p)->pgrp != -pid) //若当前项不在-pid的进程组，则跳过                continue;        }        switch ((*p)->state) {  //若pid=-1，则直接来到switch；判断所选进程p的状态            case TASK_STOPPED: //若是停止状态                if (!(options & WUNTRACED))   //                    continue;                put_fs_long(0x7f,stat_addr);                return (*p)->pid;            case TASK_ZOMBIE:                current->cutime += (*p)->utime;                current->cstime += (*p)->stime;                flag = (*p)->pid;                code = (*p)->exit_code;                release(*p);                put_fs_long(code,stat_addr);                return flag;            default:   //p是睡眠或运行状态，设置flag为1                flag=1;                continue;        }    }    if (flag) {        if (options & WNOHANG)  //WNOHANG 表示若没有子进程处于退出或终止态就返回            return 0;        current->state=TASK_INTERRUPTIBLE; //否则将当前进程的状态置为可中断睡眠态        schedule();        if (!(current->signal &= ~(1<<(SIGCHLD-1))))            goto repeat;        else            return -EINTR;    }    return -ECHILD;}

struct task_struct {/* these are hardcoded - don't touch */    long state;    /* -1 unrunnable, 0 runnable, >0 stopped */    long counter;     long priority;    long signal;    struct sigaction sigaction[32];    long blocked;    /* bitmap of masked signals *//* various fields */    int exit_code;    unsigned long start_code,end_code,end_data,brk,start_stack;    long pid,father,pgrp,session,leader;    unsigned short uid,euid,suid;    unsigned short gid,egid,sgid;    long alarm;    long utime,stime,cutime,cstime,start_time;    unsigned short used_math;/* file system info */    int tty;        /* -1 if no tty, so it must be signed */    unsigned short umask;    struct m_inode * pwd;    struct m_inode * root;    struct m_inode * executable;    unsigned long close_on_exec;    struct file * filp[NR_OPEN];/* ldt for this task 0 - zero 1 - cs 2 - ds&ss */    struct desc_struct ldt[3];/* tss for this task */    struct tss_struct tss;  //cpu运行一个进程后各个寄存器都保存在tss内};

void main(void)        /* This really IS void, no error here. */{            /* The startup routine assumes (well, ...) this *//* * Interrupts are still disabled. Do necessary setups, then * enable them */     ROOT_DEV = ORIG_ROOT_DEV;     drive_info = DRIVE_INFO;    memory_end = (1<<20) + (EXT_MEM_K<<10);    memory_end &= 0xfffff000;    if (memory_end > 16*1024*1024)        memory_end = 16*1024*1024;    if (memory_end > 12*1024*1024)        buffer_memory_end = 4*1024*1024;    else if (memory_end > 6*1024*1024)        buffer_memory_end = 2*1024*1024;    else        buffer_memory_end = 1*1024*1024;    main_memory_start = buffer_memory_end;#ifdef RAMDISK    main_memory_start += rd_init(main_memory_start, RAMDISK*1024);#endif    mem_init(main_memory_start,memory_end);    trap_init();    blk_dev_init();    chr_dev_init();    tty_init();    time_init();    sched_init();    buffer_init(buffer_memory_end);    hd_init();    floppy_init();    sti();    move_to_user_mode(); //切换到用户态    if (!fork()) {        /* 创建0号进程 */          init();    }    for(;;) pause();}

#define move_to_user_mode() __asm__ ("movl %%esp,%%eaxnt"     "pushl $0x17nt"     "pushl %%eaxnt"     "pushflnt"     "pushl $0x0fnt"     "pushl $1fnt"     "iretn"     "1:tmovl $0x17,%%eaxnt"     "movw %%ax,%%dsnt"     "movw %%ax,%%esnt"     "movw %%ax,%%fsnt"     "movw %%ax,%%gs"     :::"ax")

static char * argv_rc[] = { "/bin/sh", NULL };static char * envp_rc[] = { "HOME=/", NULL }; static char * argv[] = { "-/bin/sh",NULL };static char * envp[] = { "HOME=/usr/root", NULL }; void init(void){    int pid,i;     setup((void *) &drive_info);    (void) open("/dev/tty0",O_RDWR,0); //tty0设备是标准输入控制台，句柄为0    (void) dup(0);    (void) dup(0);    printf("%d buffers = %d bytes buffer spacenr",NR_BUFFERS,        NR_BUFFERS*BLOCK_SIZE);    printf("Free mem: %d bytesnr",memory_end-main_memory_start);    if (!(pid=fork())) {  //对于被创建的子进程，返回值为0，所以if里面的语句是在子进程中执行，并打开rc文件并用获得的shell在/执行rc里的命令        close(0);  //关闭标准输入，所有进程共用文件描述符        if (open("/etc/rc",O_RDONLY,0))            _exit(1);        execve("/bin/sh",argv_rc,envp_rc);        _exit(2);    }    if (pid>0)  //fork后对于父进程来说，返回的是子进程的进程号，即if语句内是父进程要执行的代码        while (pid != wait(&i))  //等待子进程退出               /* nothing */;    while (1) {   //如果执行到了这里，就说明子进程已经创建完成退出或者终止，下面是再创建一个子进程，        if ((pid=fork())<0) {            printf("Fork failed in initrn");            continue;        }        if (!pid) {  //创建成功            close(0);close(1);close(2);            setsid();            (void) open("/dev/tty0",O_RDWR,0);            (void) dup(0);            (void) dup(0);            _exit(execve("/bin/sh",argv,envp));        }        while (1)            if (pid == wait(&i))                break;        printf("nrchild %d died with code %04xnr",pid,i);        sync();    }    _exit(0);    /* NOTE! _exit, not exit() */}

#include <linux/sched.h>#include <linux/kernel.h>#include <linux/sys.h>#include <linux/fdreg.h>#include <asm/system.h>#include <asm/io.h>#include <asm/segment.h> #include <signal.h> #define _S(nr) (1<<((nr)-1))#define _BLOCKABLE (~(_S(SIGKILL) | _S(SIGSTOP))) void show_task(int nr,struct task_struct * p)  //nr就是pid{    int i,j = 4096-sizeof(struct task_struct);     printk("%d: pid=%d, state=%d, ",nr,p->pid,p->state); //打印pid与state    i=0;    while (i<j && !((char *)(p+1))[i])        i++;    printk("%d (of %d) chars free in kernel stacknr",i,j); //打印栈} void show_stat(void){    int i;     for (i=0;i<NR_TASKS;i++)        if (task[i])            show_task(i,task[i]);} #define LATCH (1193180/HZ) extern void mem_use(void); extern int timer_interrupt(void);extern int system_call(void); union task_union {    struct task_struct task;    char stack[PAGE_SIZE];}; static union task_union init_task = {INIT_TASK,}; long volatile jiffies=0;long startup_time=0;struct task_struct *current = &(init_task.task);struct task_struct *last_task_used_math = NULL; struct task_struct * task[NR_TASKS] = {&(init_task.task), }; long user_stack [ PAGE_SIZE>>2 ] ; struct {    long * a;    short b;    } stack_start = { & user_stack [PAGE_SIZE>>2] , 0x10 };/* *  'math_state_restore()' saves the current math information in the * old math state array, and gets the new ones from the current task */void math_state_restore()  //进程切换时完成协处理器中寄存器的切换{    if (last_task_used_math == current)        return;    __asm__("fwait");    if (last_task_used_math) {        __asm__("fnsave %0"::"m" (last_task_used_math->tss.i387));    }    last_task_used_math=current;    if (current->used_math) {        __asm__("frstor %0"::"m" (current->tss.i387));    } else {        __asm__("fninit"::);        current->used_math=1;    }} /* *  'schedule()' is the scheduler function. This is GOOD CODE! There * probably won't be any reason to change this, as it should work well * in all circumstances (ie gives IO-bound processes good response etc). * The one thing you might take a look at is the signal-handler code here. * *   NOTE!!  Task 0 is the 'idle' task, which gets called when no other * tasks can run. It can not be killed, and it cannot sleep. The 'state' * information in task[0] is never used. */void schedule(void) {    int i,next,c;    struct task_struct ** p; /* check alarm, wake up any interruptible tasks that have got a signal */ /*#define TASK_RUNNING        0     只有state是0时，该进程才会被运行，或进入就绪队列#define TASK_INTERRUPTIBLE    1     可中断睡眠状态   可以被信号中断，变成running状态#define TASK_UNINTERRUPTIBLE    2 不可中断睡眠状态 只能被wakeup函数唤醒，变成running状态#define TASK_ZOMBIE        3         僵死状态        进程停止运行，但是其task_struct未被清空#define TASK_STOPPED        4     暂停状态  */    for(p = &LAST_TASK ; p > &FIRST_TASK ; --p) //从后往前遍历        if (*p) { //若进程存在            if ((*p)->alarm && (*p)->alarm < jiffies) { //若alarm不为空且小于jiffies(此处是0)                    (*p)->signal |= (1<<(SIGALRM-1));                    (*p)->alarm = 0;                }            if (((*p)->signal & ~(_BLOCKABLE & (*p)->blocked)) &&  //进程不理会某些信号；并且进程是可中断睡眠状态            (*p)->state==TASK_INTERRUPTIBLE)                (*p)->state=TASK_RUNNING;        } /* this is the scheduler proper: */     while (1) {  //进行counter的比较，来决定进程的调用        c = -1;        next = 0;        i = NR_TASKS;        p = &task[NR_TASKS];        while (--i) {            if (!*--p)                continue;            if ((*p)->state == TASK_RUNNING && (*p)->counter > c)                c = (*p)->counter, next = i;  //遍历之后，会将counter的最大值赋给c，并且next存着最大counter的pid        }        if (c) break;        for(p = &LAST_TASK ; p > &FIRST_TASK ; --p)            if (*p)                (*p)->counter = ((*p)->counter >> 1) +    //counter = counter/2 + priority                        (*p)->priority;    }    switch_to(next); //进程切换}/*这部分代码的目的是在所有就绪状态的任务进程中筛选出counter值最大的进程ID。之后如果counter值不为0则进入调度这个进程执行，如果counter值为0，则说明所有就绪状态的进程的时间片都已用完，需要重新调整所有进程的时间片。*/  /*#define switch_to(n) {struct {long a,b;} __tmp; __asm__("cmpl %%ecx,_currentnt"     "je 1fnt"     "movw %%dx,%1nt"     "xchgl %%ecx,_currentnt"     "ljmp %0nt"     "cmpl %%ecx,_last_task_used_mathnt"     "jne 1fnt"     "cltsn"     "1:"     ::"m" (*&__tmp.a),"m" (*&__tmp.b),     "d" (_TSS(n)),"c" ((long) task[n])); }*/     int sys_pause(void){    current->state = TASK_INTERRUPTIBLE;    schedule();    return 0;} void sleep_on(struct task_struct **p) //当p进程想访问cpu的某个资源，但是该资源被占用；{    struct task_struct *tmp;     if (!p)        return;    if (current == &(init_task.task)) //如果当前进程为0号进程时，就返回，不能sleep        panic("task[0] trying to sleep");    tmp = *p;    *p = current; //将p赋为当前进程    current->state = TASK_UNINTERRUPTIBLE;    schedule();    if (tmp)        tmp->state=0;} void interruptible_sleep_on(struct task_struct **p){    struct task_struct *tmp;     if (!p)        return;    if (current == &(init_task.task))        panic("task[0] trying to sleep");    tmp=*p;    *p=current;repeat:    current->state = TASK_INTERRUPTIBLE;    schedule();    if (*p && *p != current) {        (**p).state=0;        goto repeat;    }    *p=NULL;    if (tmp)        tmp->state=0;} void wake_up(struct task_struct **p){    if (p && *p) {        (**p).state=0;        *p=NULL;    }} /* * OK, here are some floppy things that shouldn't be in the kernel * proper. They are here because the floppy needs a timer, and this * was the easiest way of doing it. */static struct task_struct * wait_motor[4] = {NULL,NULL,NULL,NULL};static int  mon_timer[4]={0,0,0,0};static int moff_timer[4]={0,0,0,0};unsigned char current_DOR = 0x0C; int ticks_to_floppy_on(unsigned int nr){    extern unsigned char selected;    unsigned char mask = 0x10 << nr;     if (nr>3)        panic("floppy_on: nr>3");    moff_timer[nr]=10000;        /* 100 s = very big :-) */    cli();                /* use floppy_off to turn it off */    mask |= current_DOR;    if (!selected) {        mask &= 0xFC;        mask |= nr;    }    if (mask != current_DOR) {        outb(mask,FD_DOR);        if ((mask ^ current_DOR) & 0xf0)            mon_timer[nr] = HZ/2;        else if (mon_timer[nr] < 2)            mon_timer[nr] = 2;        current_DOR = mask;    }    sti();    return mon_timer[nr];} void floppy_on(unsigned int nr){    cli();    while (ticks_to_floppy_on(nr))        sleep_on(nr+wait_motor);    sti();} void floppy_off(unsigned int nr){    moff_timer[nr]=3*HZ;} void do_floppy_timer(void){    int i;    unsigned char mask = 0x10;     for (i=0 ; i<4 ; i++,mask <<= 1) {        if (!(mask & current_DOR))            continue;        if (mon_timer[i]) {            if (!--mon_timer[i])                wake_up(i+wait_motor);        } else if (!moff_timer[i]) {            current_DOR &= ~mask;            outb(current_DOR,FD_DOR);        } else            moff_timer[i]--;    }} #define TIME_REQUESTS 64 static struct timer_list {    long jiffies;    void (*fn)();    struct timer_list * next;} timer_list[TIME_REQUESTS], * next_timer = NULL; void add_timer(long jiffies, void (*fn)(void)){    struct timer_list * p;     if (!fn)        return;    cli();    if (jiffies <= 0)        (fn)();    else {        for (p = timer_list ; p < timer_list + TIME_REQUESTS ; p++)            if (!p->fn)                break;        if (p >= timer_list + TIME_REQUESTS)            panic("No more time requests free");        p->fn = fn;        p->jiffies = jiffies;        p->next = next_timer;        next_timer = p;        while (p->next && p->next->jiffies < p->jiffies) {            p->jiffies -= p->next->jiffies;            fn = p->fn;            p->fn = p->next->fn;            p->next->fn = fn;            jiffies = p->jiffies;            p->jiffies = p->next->jiffies;            p->next->jiffies = jiffies;            p = p->next;        }    }    sti();} void do_timer(long cpl){    extern int beepcount;    extern void sysbeepstop(void);     if (beepcount)        if (!--beepcount)            sysbeepstop();     if (cpl)        current->utime++;    else        current->stime++;     if (next_timer) {        next_timer->jiffies--;        while (next_timer && next_timer->jiffies <= 0) {            void (*fn)(void);             fn = next_timer->fn;            next_timer->fn = NULL;            next_timer = next_timer->next;            (fn)();        }    }    if (current_DOR & 0xf0)        do_floppy_timer();    if ((--current->counter)>0) return;    current->counter=0;    if (!cpl) return;    schedule();} int sys_alarm(long seconds){    int old = current->alarm;     if (old)        old = (old - jiffies) / HZ;    current->alarm = (seconds>0)?(jiffies+HZ*seconds):0;    return (old);} int sys_getpid(void){    return current->pid;} int sys_getppid(void){    return current->father;} int sys_getuid(void){    return current->uid;} int sys_geteuid(void){    return current->euid;} int sys_getgid(void){    return current->gid;} int sys_getegid(void){    return current->egid;} int sys_nice(long increment){    if (current->priority-increment>0)        current->priority -= increment;    return 0;} void sched_init(void){    int i;    struct desc_struct * p;     if (sizeof(struct sigaction) != 16)        panic("Struct sigaction MUST be 16 bytes");    set_tss_desc(gdt+FIRST_TSS_ENTRY,&(init_task.task.tss));    set_ldt_desc(gdt+FIRST_LDT_ENTRY,&(init_task.task.ldt));    p = gdt+2+FIRST_TSS_ENTRY;    for(i=1;i<NR_TASKS;i++) {        task[i] = NULL;        p->a=p->b=0;        p++;        p->a=p->b=0;        p++;    }/* Clear NT, so that we won't have troubles with that later on */    __asm__("pushfl ; andl $0xffffbfff,(%esp) ; popfl");    ltr(0);    lldt(0);    outb_p(0x36,0x43);        /* binary, mode 3, LSB/MSB, ch 0 */    outb_p(LATCH & 0xff , 0x40);    /* LSB */    outb(LATCH >> 8 , 0x40);    /* MSB */    set_intr_gate(0x20,&timer_interrupt);    outb(inb_p(0x21)&~0x01,0x21);    set_system_gate(0x80,&system_call);}

! SYS_SIZE is the number of clicks (16 bytes) to be loaded.! 0x3000 is 0x30000 bytes = 196kB, more than enough for current! versions of linux!SYSSIZE = 0x3000!!    bootsect.s        (C) 1991 Linus Torvalds!! bootsect.s is loaded at 0x7c00 by the bios-startup routines, and moves! iself out of the way to address 0x90000, and jumps there.!! It then loads 'setup' directly after itself (0x90200), and the system! at 0x10000, using BIOS interrupts.!! NOTE! currently system is at most 8*65536 bytes long. This should be no! problem, even in the future. I want to keep it simple. This 512 kB! kernel size should be enough, especially as this doesn't contain the! buffer cache as in minix!! The loader has been made as simple as possible, and continuos! read errors will result in a unbreakable loop. Reboot by hand. It! loads pretty fast by getting whole sectors at a time whenever possible. .globl begtext, begdata, begbss, endtext, enddata, endbss.textbegtext:.databegdata:.bssbegbss:.text SETUPLEN = 4                ! nr of setup-sectorsBOOTSEG  = 0x07c0            ! original address of boot-sectorINITSEG  = 0x9000            ! we move boot here - out of the waySETUPSEG = 0x9020            ! setup starts hereSYSSEG   = 0x1000            ! system loaded at 0x10000 (65536).ENDSEG   = SYSSEG + SYSSIZE        ! where to stop loading ! ROOT_DEV:    0x000 - same type of floppy as boot.!        0x301 - first partition on first drive etcROOT_DEV = 0x306 entry startstart:    mov    ax,#BOOTSEG    mov    ds,ax    mov    ax,#INITSEG    mov    es,ax    mov    cx,#256    sub    si,si    sub    di,di    rep    movw    jmpi    go,INITSEGgo:    mov    ax,cs    mov    ds,ax    mov    es,ax! put stack at 0x9ff00.    mov    ss,ax    mov    sp,#0xFF00        ! arbitrary value >>512 ! load the setup-sectors directly after the bootblock.! Note that 'es' is already set up. load_setup:    mov    dx,#0x0000        ! drive 0, head 0    mov    cx,#0x0002        ! sector 2, track 0    mov    bx,#0x0200        ! address = 512, in INITSEG    mov    ax,#0x0200+SETUPLEN    ! service 2, nr of sectors    int    0x13            ! read it    jnc    ok_load_setup        ! ok - continue    mov    dx,#0x0000    mov    ax,#0x0000        ! reset the diskette    int    0x13    j    load_setup ok_load_setup: ! Get disk drive parameters, specifically nr of sectors/track     mov    dl,#0x00    mov    ax,#0x0800        ! AH=8 is get drive parameters    int    0x13    mov    ch,#0x00    seg cs    mov    sectors,cx    mov    ax,#INITSEG    mov    es,ax ! Print some inane message     mov    ah,#0x03        ! read cursor pos    xor    bh,bh    int    0x10     mov    cx,#24    mov    bx,#0x0007        ! page 0, attribute 7 (normal)    mov    bp,#msg1    mov    ax,#0x1301        ! write string, move cursor    int    0x10 ! ok, we've written the message, now! we want to load the system (at 0x10000)     mov    ax,#SYSSEG    mov    es,ax        ! segment of 0x010000    call    read_it    call    kill_motor ! After that we check which root-device to use. If the device is! defined (!= 0), nothing is done and the given device is used.! Otherwise, either /dev/PS0 (2,28) or /dev/at0 (2,8), depending! on the number of sectors that the BIOS reports currently.     seg cs    mov    ax,root_dev    cmp    ax,#0    jne    root_defined    seg cs    mov    bx,sectors    mov    ax,#0x0208        ! /dev/ps0 - 1.2Mb    cmp    bx,#15    je    root_defined    mov    ax,#0x021c        ! /dev/PS0 - 1.44Mb    cmp    bx,#18    je    root_definedundef_root:    jmp undef_rootroot_defined:    seg cs    mov    root_dev,ax ! after that (everyting loaded), we jump to! the setup-routine loaded directly after! the bootblock:     jmpi    0,SETUPSEG ! This routine loads the system at address 0x10000, making sure! no 64kB boundaries are crossed. We try to load it as fast as! possible, loading whole tracks whenever we can.!! in:    es - starting address segment (normally 0x1000)!sread:    .word 1+SETUPLEN    ! sectors read of current trackhead:    .word 0            ! current headtrack:    .word 0            ! current track read_it:    mov ax,es    test ax,#0x0fffdie:    jne die            ! es must be at 64kB boundary    xor bx,bx        ! bx is starting address within segmentrp_read:    mov ax,es    cmp ax,#ENDSEG        ! have we loaded all yet?    jb ok1_read    retok1_read:    seg cs    mov ax,sectors    sub ax,sread    mov cx,ax    shl cx,#9    add cx,bx    jnc ok2_read    je ok2_read    xor ax,ax    sub ax,bx    shr ax,#9ok2_read:    call read_track    mov cx,ax    add ax,sread    seg cs    cmp ax,sectors    jne ok3_read    mov ax,#1    sub ax,head    jne ok4_read    inc trackok4_read:    mov head,ax    xor ax,axok3_read:    mov sread,ax    shl cx,#9    add bx,cx    jnc rp_read    mov ax,es    add ax,#0x1000    mov es,ax    xor bx,bx    jmp rp_read read_track:    push ax    push bx    push cx    push dx    mov dx,track    mov cx,sread    inc cx    mov ch,dl    mov dx,head    mov dh,dl    mov dl,#0    and dx,#0x0100    mov ah,#2    int 0x13    jc bad_rt    pop dx    pop cx    pop bx    pop ax    retbad_rt:    mov ax,#0    mov dx,#0    int 0x13    pop dx    pop cx    pop bx    pop ax    jmp read_track /* * This procedure turns off the floppy drive motor, so * that we enter the kernel in a known state, and * don't have to worry about it later. */kill_motor:    push dx    mov dx,#0x3f2    mov al,#0    outb    pop dx    ret sectors:    .word 0 msg1:    .byte 13,10    .ascii "Loading system ..."    .byte 13,10,13,10 .org 508root_dev:    .word ROOT_DEVboot_flag:    .word 0xAA55 .textendtext:.dataenddata:.bssendbss:

setup.s        (C) 1991 Linus Torvalds!! setup.s is responsible for getting the system data from the BIOS,! and putting them into the appropriate places in system memory.! both setup.s and system has been loaded by the bootblock.!! This code asks the bios for memory/disk/other parameters, and! puts them in a "safe" place: 0x90000-0x901FF, ie where the! boot-block used to be. It is then up to the protected mode! system to read them from there before the area is overwritten! for buffer-blocks.! ! NOTE! These had better be the same as in bootsect.s! INITSEG  = 0x9000    ! we move boot here - out of the waySYSSEG   = 0x1000    ! system loaded at 0x10000 (65536).SETUPSEG = 0x9020    ! this is the current segment .globl begtext, begdata, begbss, endtext, enddata, endbss.textbegtext:.databegdata:.bssbegbss:.text entry startstart: ! ok, the read went well so we get current cursor position and save it for! posterity.     mov    ax,#INITSEG    ! this is done in bootsect already, but...    mov    ds,ax    mov    ah,#0x03    ! read cursor pos    xor    bh,bh    int    0x10        ! save it in known place, con_init fetches    mov    [0],dx        ! it from 0x90000. ! Get memory size (extended mem, kB)     mov    ah,#0x88    int    0x15    mov    [2],ax ! Get video-card data:     mov    ah,#0x0f    int    0x10    mov    [4],bx        ! bh = display page    mov    [6],ax        ! al = video mode, ah = window width ! check for EGA/VGA and some config parameters     mov    ah,#0x12    mov    bl,#0x10    int    0x10    mov    [8],ax    mov    [10],bx    mov    [12],cx ! Get hd0 data     mov    ax,#0x0000    mov    ds,ax    lds    si,[4*0x41]    mov    ax,#INITSEG    mov    es,ax    mov    di,#0x0080    mov    cx,#0x10    rep    movsb ! Get hd1 data     mov    ax,#0x0000    mov    ds,ax    lds    si,[4*0x46]    mov    ax,#INITSEG    mov    es,ax    mov    di,#0x0090    mov    cx,#0x10    rep    movsb ! Check that there IS a hd1 :-)     mov    ax,#0x01500    mov    dl,#0x81    int    0x13    jc    no_disk1    cmp    ah,#3    je    is_disk1no_disk1:    mov    ax,#INITSEG    mov    es,ax    mov    di,#0x0090    mov    cx,#0x10    mov    ax,#0x00    rep    stosbis_disk1: ! now we want to move to protected mode ...     cli            ! no interrupts allowed ! ! first we move the system to it's rightful place     mov    ax,#0x0000    cld            ! 'direction'=0, movs moves forwarddo_move:    mov    es,ax        ! destination segment    add    ax,#0x1000    cmp    ax,#0x9000    jz    end_move    mov    ds,ax        ! source segment    sub    di,di    sub    si,si    mov     cx,#0x8000    rep    movsw    jmp    do_move ! then we load the segment descriptors end_move:    mov    ax,#SETUPSEG    ! right, forgot this at first. didn't work :-)    mov    ds,ax    lidt    idt_48        ! load idt with 0,0    lgdt    gdt_48        ! load gdt with whatever appropriate ! that was painless, now we enable A20     call    empty_8042    mov    al,#0xD1        ! command write    out    #0x64,al    call    empty_8042    mov    al,#0xDF        ! A20 on    out    #0x60,al    call    empty_8042 ! well, that went ok, I hope. Now we have to reprogram the interrupts :-(! we put them right after the intel-reserved hardware interrupts, at! int 0x20-0x2F. There they won't mess up anything. Sadly IBM really! messed this up with the original PC, and they haven't been able to! rectify it afterwards. Thus the bios puts interrupts at 0x08-0x0f,! which is used for the internal hardware interrupts as well. We just! have to reprogram the 8259's, and it isn't fun.     mov    al,#0x11        ! initialization sequence    out    #0x20,al        ! send it to 8259A-1    .word    0x00eb,0x00eb        ! jmp $+2, jmp $+2    out    #0xA0,al        ! and to 8259A-2    .word    0x00eb,0x00eb    mov    al,#0x20        ! start of hardware int's (0x20)    out    #0x21,al    .word    0x00eb,0x00eb    mov    al,#0x28        ! start of hardware int's 2 (0x28)    out    #0xA1,al    .word    0x00eb,0x00eb    mov    al,#0x04        ! 8259-1 is master    out    #0x21,al    .word    0x00eb,0x00eb    mov    al,#0x02        ! 8259-2 is slave    out    #0xA1,al    .word    0x00eb,0x00eb    mov    al,#0x01        ! 8086 mode for both    out    #0x21,al    .word    0x00eb,0x00eb    out    #0xA1,al    .word    0x00eb,0x00eb    mov    al,#0xFF        ! mask off all interrupts for now    out    #0x21,al    .word    0x00eb,0x00eb    out    #0xA1,al ! well, that certainly wasn't fun :-(. Hopefully it works, and we don't! need no steenking BIOS anyway (except for the initial loading :-).! The BIOS-routine wants lots of unnecessary data, and it's less! "interesting" anyway. This is how REAL programmers do it.!! Well, now's the time to actually move into protected mode. To make! things as simple as possible, we do no register set-up or anything,! we let the gnu-compiled 32-bit programs do that. We just jump to! absolute address 0x00000, in 32-bit protected mode.     mov    ax,#0x0001    ! protected mode (PE) bit    lmsw    ax        ! This is it!    jmpi    0,8        ! jmp offset 0 of segment 8 (cs) ! This routine checks that the keyboard command queue is empty! No timeout is used - if this hangs there is something wrong with! the machine, and we probably couldn't proceed anyway.empty_8042:    .word    0x00eb,0x00eb    in    al,#0x64    ! 8042 status port    test    al,#2        ! is input buffer full?    jnz    empty_8042    ! yes - loop    ret gdt:    .word    0,0,0,0        ! dummy     .word    0x07FF        ! 8Mb - limit=2047 (2048*4096=8Mb)    .word    0x0000        ! base address=0    .word    0x9A00        ! code read/exec    .word    0x00C0        ! granularity=4096, 386     .word    0x07FF        ! 8Mb - limit=2047 (2048*4096=8Mb)    .word    0x0000        ! base address=0    .word    0x9200        ! data read/write    .word    0x00C0        ! granularity=4096, 386 idt_48:    .word    0            ! idt limit=0    .word    0,0            ! idt base=0L gdt_48:    .word    0x800        ! gdt limit=2048, 256 GDT entries    .word    512+gdt,0x9    ! gdt base = 0X9xxxx .textendtext:.dataenddata:.bssendbss:

*  head.s contains the 32-bit startup code. * * NOTE!!! Startup happens at absolute address 0x00000000, which is also where * the page directory will exist. The startup code will be overwritten by * the page directory. */.text.globl _idt,_gdt,_pg_dir,_tmp_floppy_area_pg_dir:startup_32:    movl $0x10,%eax    mov %ax,%ds    mov %ax,%es    mov %ax,%fs    mov %ax,%gs   //上面是重新加载寄存器    lss _stack_start,%esp  //lss _stack_start,%esp是将结构体 stact_start 的值传送到ss:esp，即令 ss=0x10（段选择子）和 esp=& user_stack [PAGE_SIZE>>2]    call setup_idt  //设置idt和gdt    call setup_gdt    movl $0x10,%eax        # reload all the segment registers    mov %ax,%ds        # after changing gdt. CS was already    mov %ax,%es        # reloaded in 'setup_gdt'    mov %ax,%fs    mov %ax,%gs    lss _stack_start,%esp    xorl %eax,%eax1:    incl %eax        # check that A20 really IS enabled    movl %eax,0x000000    # loop forever if it isn't    cmpl %eax,0x100000    je 1b/* * NOTE! 486 should set bit 16, to check for write-protect in supervisor * mode. Then it would be unnecessary with the "verify_area()"-calls. * 486 users probably want to set the NE (#5) bit also, so as to use * int 16 for math errors. */    movl %cr0,%eax        # check math chip    andl $0x80000011,%eax    # Save PG,PE,ET/* "orl $0x10020,%eax" here for 486 might be good */    orl $2,%eax        # set MP    movl %eax,%cr0    call check_x87    jmp after_page_tables /* * We depend on ET to be correct. This checks for 287/387. */check_x87:    fninit    fstsw %ax    cmpb $0,%al    je 1f            /* no coprocessor: have to set bits */    movl %cr0,%eax    xorl $6,%eax        /* reset MP, set EM */    movl %eax,%cr0    ret.align 21:    .byte 0xDB,0xE4        /* fsetpm for 287, ignored by 387 */    ret /* *  setup_idt * *  sets up a idt with 256 entries pointing to *  ignore_int, interrupt gates. It then loads *  idt. Everything that wants to install itself *  in the idt-table may do so themselves. Interrupts *  are enabled elsewhere, when we can be relatively *  sure everything is ok. This routine will be over- *  written by the page tables. */setup_idt:    lea ignore_int,%edx   //将ignore_int的有效地址存到edx    movl $0x00080000,%eax  //将0x8000放入eax的高16位    movw %dx,%ax        /* selector = 0x0008 = cs  将ignore_int有效地址存到eax低16字节 */    movw $0x8E00,%dx    /* interrupt gate - dpl=0, present */     lea _idt,%edi      //    mov $256,%ecxrp_sidt:    movl %eax,(%edi)    movl %edx,4(%edi)    addl $8,%edi    dec %ecx    jne rp_sidt    lidt idt_descr    ret /* *  setup_gdt * *  This routines sets up a new gdt and loads it. *  Only two entries are currently built, the same *  ones that were built in init.s. The routine *  is VERY complicated at two whole lines, so this *  rather long comment is certainly needed :-). *  This routine will beoverwritten by the page tables. */setup_gdt:    lgdt gdt_descr    ret /* * I put the kernel page tables right after the page directory, * using 4 of them to span 16 Mb of physical memory. People with * more than 16MB will have to expand this. */.org 0x1000pg0: .org 0x2000pg1: .org 0x3000pg2: .org 0x4000pg3: .org 0x5000/* * tmp_floppy_area is used by the floppy-driver when DMA cannot * reach to a buffer-block. It needs to be aligned, so that it isn't * on a 64kB border. */_tmp_floppy_area:    .fill 1024,1,0 after_page_tables:    pushl $0        # These are the parameters to main :-)    pushl $0    pushl $0    pushl $L6        # return address for main, if it decides to.    pushl $_main    jmp setup_pagingL6:    jmp L6            # main should never return here, but                # just in case, we know what happens. /* This is the default interrupt "handler" :-) */int_msg:    .asciz "Unknown interruptnr".align 2ignore_int:    pushl %eax    pushl %ecx    pushl %edx    push %ds    push %es    push %fs    movl $0x10,%eax    mov %ax,%ds    mov %ax,%es    mov %ax,%fs    pushl $int_msg    call _printk    popl %eax    pop %fs    pop %es    pop %ds    popl %edx    popl %ecx    popl %eax    iret  /* * Setup_paging * * This routine sets up paging by setting the page bit * in cr0. The page tables are set up, identity-mapping * the first 16MB. The pager assumes that no illegal * addresses are produced (ie >4Mb on a 4Mb machine). * * NOTE! Although all physical memory should be identity * mapped by this routine, only the kernel page functions * use the >1Mb addresses directly. All "normal" functions * use just the lower 1Mb, or the local data space, which * will be mapped to some other place - mm keeps track of * that. * * For those with more memory than 16 Mb - tough luck. I've * not got it, why should you :-) The source is here. Change * it. (Seriously - it shouldn't be too difficult. Mostly * change some constants etc. I left it at 16Mb, as my machine * even cannot be extended past that (ok, but it was cheap :-) * I've tried to show which constants to change by having * some kind of marker at them (search for "16Mb"), but I * won't guarantee that's all :-( ) */.align 2setup_paging:    movl $1024*5,%ecx        /* 5 pages - pg_dir+4 page tables */    xorl %eax,%eax    xorl %edi,%edi            /* pg_dir is at 0x000 */    cld;rep;stosl    movl $pg0+7,_pg_dir        /* set present bit/user r/w */    movl $pg1+7,_pg_dir+4        /*  --------- " " --------- */    movl $pg2+7,_pg_dir+8        /*  --------- " " --------- */    movl $pg3+7,_pg_dir+12        /*  --------- " " --------- */    movl $pg3+4092,%edi    movl $0xfff007,%eax        /*  16Mb - 4096 + 7 (r/w user,p) */    std1:    stosl            /* fill pages backwards - more efficient :-) */    subl $0x1000,%eax    jge 1b    xorl %eax,%eax        /* pg_dir is at 0x0000 */    movl %eax,%cr3        /* cr3 - page directory start */    movl %cr0,%eax    orl $0x80000000,%eax    movl %eax,%cr0        /* set paging (PG) bit */    ret            /* this also flushes prefetch-queue */ .align 2.word 0idt_descr:    .word 256*8-1        # idt contains 256 entries    .long _idt.align 2.word 0gdt_descr:    .word 256*8-1        # so does gdt (not that that's any    .long _gdt        # magic number, but it works for me :^)     .align 3_idt:    .fill 256,8,0        # idt is uninitialized _gdt:    .quad 0x0000000000000000    /* NULL descriptor */    .quad 0x00c09a0000000fff    /* 16Mb */    .quad 0x00c0920000000fff    /* 16Mb */    .quad 0x0000000000000000    /* TEMPORARY - don't use */    .fill 252,8,0