PS2GUI.ASM

; ============================================================================
; PS2GUI.COM  -  Graphical (VGA) system manager for the IBM PalmTop PC110
; A GUI fork of PS2TUI reproducing the IBM *Easy-Setup* as a real ICON GRID
; (VGA mode 12h): the main menu is a grid of 10 tiles, one per PS2TUI category;
; opening a tile shows a new icon-grid page for that category's items; settings
; open a short value picker. The selected tile is inverted (dark-red), just like
; Easy-Setup. Structure is identical to PS2TUI; there is no text-mode menu.
; (The only text step is the confirm/run of the real PS2.EXE / ULTRACHG tool and
; the diagnostic reports, which return to the grid after.)
;
; Version 1.6.17 (c) Ahmad Byagowi -- Keyboard test: Print Screen now lights up. The
;   PC110's PrtSc key emits plain scancode 0x54 (make 54 / break D4), not the standard
;   extended E0 37 - remapped PrS to 0x54 ext 0.
; Version 1.6.16 -- Duck cursor: removed the dithered-streak/shadow
;   white specks (mis-classified transparent gaps -> stray white under belly/beak) by
;   dropping isolated white pixels; and stopped clipping the wing-down frame's forward-
;   folded wing (the previous leak-clean box had cut it). Dramatic wing-up/down flap
;   kept; both frames clean, wings intact, silhouette verified.
; Version 1.6.15 -- Duck cursor flap made clearly visible: the two
;   frames are now the DRAMATIC wing-down (folded, compact) vs wing-up (raised wing)
;   real BIOS poses (v1.6.14 used two near-identical wing-up poses -> looked static).
;   Cleared the flood-fill leak that had left white under the wing-down frame. Flap
;   toggle verified alternating in QEMU.
; Version 1.6.14 -- Duck cursor cleanup + mouse ISR hardening:
;   * frame 0 is now the REAL parked/resting pose (captured over the clean cyan
;     Easy-Setup screen) instead of an awkward mid-flap phase whose flood-fill had
;     trapped a white pocket behind the motion streak ("white space under cursor").
;   * IRQ12 handler now consumes port 0x60 ONLY for a genuine aux byte (0x64 bit0
;     OBF + bit5 aux) - a spurious IRQ or stray keyboard byte no longer misframes a
;     packet (candidate for the intermittent startup-after-move crash).
; Version 1.6.13 -- Duck cursor from the real BIOS sprite (both flap frames), 32x32.
; Version 1.6.12 -- Duck cursor flap (procedural wing-up); superseded by 1.6.13.
; Version 1.6.11 -- Fn key removed from the keyboard test (it emits
;                                    no scancode - resolved in the keyboard MCU, not
;                                    host-visible per KBC+EC probing). Startup-crash fix:
;                                    clamp the cursor fully on-screen (old bound let it
;                                    draw off-screen -> VGA-BIOS fault on a misframed
;                                    first packet) + drain OBF/reset framing before IRQ12.
; Version 1.6.10 -- Keyboard test: the Brk/Pause key now lights up
;                                    whether it sends the E1 Pause sequence OR the
;                                    E0 46 Break sequence (both map to the Brk key).
; Version 1.6.9 -- mouse_init: disable reporting (F5) + drain before
;                                    configuring, so a finger on the trackpad during
;                                    startup can't interleave packet bytes with the
;                                    command ACKs and leave it half-configured (the
;                                    intermittent "crash/quit on first move" at start).
; Version 1.6.8 -- Keyboard test: Brk now maps to the extended Break
;                                    scancode E0 46 (was hijacked by the ScrollLock
;                                    alias, which is now limited to the plain 0x46).
; Version 1.6.7 -- Keyboard test: pressed keys now LATCH (stay lit
;                                    after release) so you can see which keys you've
;                                    tested; ESC still exits (on release).
; Version 1.6.6 -- Keyboard test: show the last 3 raw scancode bytes
;                                    at the bottom (to identify unknown keys), and map
;                                    ScrollLock (0x46) onto the NumLock/ScrLk key so it
;                                    lights.  (Brk/Pause code TBD from the readout.)
; Version 1.6.5 -- Keyboard test: Enter and Backspace shortened so
;                                    every key's right edge lines up flush; keyboard
;                                    stays centred on screen (make_kbd.py computes KB_X).
; Version 1.6.3 -- Keyboard test: exact PC110 bottom-right too - the
;                                    arrows tuck in (bottom row: ...Ctrl Left Down
;                                    Right; Shift row: ...Ro Up RShift with Up above
;                                    Down), and the right edge stacks Backspace over
;                                    Enter over right-Shift.
; Version 1.6.2 -- Keyboard test: exact PC110 top area - a top row
;                                    (Esc / PrtSc NumLk Pause / Ins Home PgUp) sitting
;                                    ABOVE the function row (F1-F12 / Del End PgDn):
;                                    Esc over F1, PrtSc/NumLk/Pause over F9/F10/F11,
;                                    Ins/Home/PgUp over Del/End/PgDn.  Pause (E1) seq
;                                    swallowed so it doesn't false-trigger Ctrl/NumLk.
; Version 1.6.1 -- Keyboard test layout reworked to match the real
;                                    PC110: grouped F-keys, a separated nav block
;                                    (Ins/Home/PgUp over Del/End/PgDn), an inverted-T
;                                    arrow cluster, tall Enter, taller keys.
; Version 1.6.0 -- Keyboard test is now a recreated PC110 keyboard
;                                    (from the real JP layout): it hooks INT 9 and
;                                    lights up each key (red) as it is pressed, incl.
;                                    0xE0-extended keys.  Press ESC to exit.  Layout
;                                    generated by tools/make_kbd.py -> KBD.INC.
; Version 1.5.9 -- Signature pad: press C in the test to run a
;                                    4-corner calibration (touch each pad corner);
;                                    it fits a linear raw->screen map (handles a
;                                    flipped axis) so strokes land accurately.  ESC
;                                    cancels; uncalibrated falls back to the raw map.
; Version 1.5.8 -- All self-contained test/report pages now render
;                                    on the graphical Easy-Setup page (mauve + dark
;                                    text) like the signature test, not the blue text
;                                    screen.  cls_body_full/puts_hint honour [body_gfx];
;                                    the R_CALL wrapper sets mode 12h + dark text.  The
;                                    Video test stays text-mode (it shows text
;                                    attributes + the CP437 set); external PS2.EXE
;                                    confirm/run screens stay text-mode too.
; Version 1.5.7 -- Hardware guard: at startup verify this is a
;                                    genuine PC110 (APM vendor "SLO" identify via
;                                    INT 15h 5380/7F); QEMU is allowed (fw_cfg
;                                    "QEMU"). On anything else, show a text warning
;                                    that PS2GUI is PC110-only and may DAMAGE other
;                                    hardware -- ESC quits, F10 runs at own risk.
; Version 1.5.6 -- Duck cursor now FLAPS its wings as it moves
;                                    (two frames: wings up/glide + wings down),
;                                    like the real Easy-Setup cursor.  (A direct
;                                    VGA-planar cursor blitter was tried to kill the
;                                    flicker but faulted on the real F65535/EMM386;
;                                    reverted to the BIOS pixel path, which is safe.)
; Version 1.5.5 -- New "Signature pad test" (System Test): drives
;                                    the PC110 resistive inking digitizer directly.
;                                    Data is IRQ-driven (the pad reports only via its
;                                    interrupt, not by polling): hook the inking IRQ
;                                    (base+IRQ from INT 15h 5380/8300, as INKDRV does),
;                                    enable (out base+2,0x38), collect 3-byte packets
;                                    [flags,rawX,rawY] in an ISR, and draw your strokes
;                                    in a VGA signing box.  Restores IRQ/PIC/pad on exit.
;                                    Also: flush the keyboard buffer and seed the mouse
;                                    button baseline at startup, so a stale key/button
;                                    left by a prior run can't insta-quit the relaunch.
; Version 1.5.4 -- first (polled) signature-pad test; superseded by the IRQ-driven 1.5.5.
; Version 1.5.3 -- Pointing-device test now reads the trackpad
;                                    directly off the 8042 aux channel (polled),
;                                    so it works with no INT 33h driver installed
;                                    (was: "No pointing-device driver loaded").
; Version 1.5.2 -- fix: after a test/diagnostic you couldn't get back - a stuck
;                  trackpad byte in the 8042 OBF blocked the keyboard; disable
;                  aux + flush during text screens so 'press any key' works
; Build (host):  nasm -f bin PS2GUI.ASM -o PS2GUI.COM
; Target: MS-DOS / PC DOS 7 (real mode), VGA mode 12h. Assemble as a .COM.
; ============================================================================
%define PS2TUI_VER "1.0"        ; shown in the text-menu title bar
HL_COLOR  equ 2                 ; Easy-Setup selection-box colour (dark red)
        cpu     586             ; allow CPUID (the PC110 486SX supports it); 16-bit real mode
        bits    16
        org     0x100

; ---- colour attributes (classic cyan window / yellow border theme) ---------
A_TITLE   equ 0x3F        ; title text: bright white on cyan
A_FOOT    equ 0x3E        ; footer key-hints: yellow on cyan
A_FRAME   equ 0x3E        ; panel frame: yellow on cyan (double-line border)
A_ITEM    equ 0x30        ; menu label: black on cyan
A_DESC    equ 0x31        ; description text: blue on cyan (secondary)
A_SEL     equ 0x70        ; selection bar: black on light-grey
A_KEY     equ 0x3F        ; breadcrumb / accent: bright white on cyan
A_BODY    equ 0x30        ; (legacy) black on cyan
A_HEAD    equ 0x3E        ; (legacy) yellow on cyan
A_BOX     equ 0x1F        ; popup dialogs: white on blue (pop against cyan)
A_WARN    equ 0x4F        ; white on red
A_DESK    equ 0x30        ; window/desktop fill: black on cyan (space = cyan)

; ---- row types -------------------------------------------------------------
R_ITEM    equ 1           ; setting with an option list
R_ACT     equ 2           ; action (no options, just run "PS2 <cmd>")
R_INFO    equ 3           ; runs "PS2 _@REVision"
R_CALL    equ 4           ; calls the internal routine at the record's "cmd" field
R_UITEM   equ 5           ; like R_ITEM but runs C:\ULTRACHG.COM <option> (no cmd word)

; ---- layout : a framed window floating on a grey desktop, with a drop shadow -
UI_L      equ 2           ; window left column  (border)
UI_R      equ 77          ; window right column (border)
UI_TOP    equ 1           ; window top row      (border)
UI_BOT    equ 17          ; window bottom row   (border)
TITLE_ROW equ 2           ; title text row (inside window, below top border)
BC_ROW    equ 3           ; breadcrumb row
ITEM_TOP  equ 5           ; first item screen row
FOOT_ROW  equ 16          ; footer key-hints row (inside window, above bottom border)
ITEM_COL  equ 7           ; item label column
DESC_COL  equ 31          ; description column (main menu)
A_SHADOW  equ 0x08        ; drop-shadow cells: dark on black
A_DESKTOP equ 0x70        ; desktop backdrop: black on light-grey (space = grey)
; CP437 double-line box glyphs
BX_TL     equ 0xC9
BX_TR     equ 0xBB
BX_BL     equ 0xC8
BX_BR     equ 0xBC
BX_H      equ 0xCD
BX_V      equ 0xBA
GLY_ARROW equ 0x10        ; ► selection marker

; ============================================================================
;  Program entry — the graphical IBM Easy-Setup launcher (VGA mode 12h)
; ============================================================================
; layout / palette-index constants for the graphical menu
C_MAUVE   equ 0
C_WHITE   equ 1
C_RED     equ 2
C_NAVY    equ 3
C_BLACK   equ 4
ITEMROW0  equ 4               ; first list row (text rows are 8x16, 80x30)

; ============================================================================
;  Program entry — graphical menu (VGA mode 12h, Easy-Setup style).
;  Main menu = PS2TUI's 10 categories; sub-menus and pickers are graphical.
; ============================================================================
start:
        mov     ax, cs
        mov     ds, ax
        mov     es, ax
        mov     bx, 0x1000
        mov     ah, 0x4A
        int     0x21
        ; --- refuse to run on non-PC110 hardware (QEMU allowed, for testing) ---
        call    is_pc110          ; CF clear = genuine PC110
        jnc     .hwok
        call    is_qemu           ; CF clear = QEMU
        jnc     .hwok
        call    hw_warn           ; CF set = user chose to quit
        jnc     .hwok
        mov     ax, 0x4C01        ; abort, exit code 1
        int     0x21
.hwok:
        mov     ax, 0x0012        ; VGA 640x480x16
        int     0x10
        call    set_palette
        push    es                ; cache the ROM 8x16 font pointer for gtext
        mov     ax, 0x1130
        mov     bh, 6
        int     0x10              ; -> ES:BP = 8x16 font
        mov     [font_seg], es
        mov     [font_off], bp
        pop     es
        call    mouse_init
        mov     word [gcat], 0
.kflush:                              ; drop any stale keystroke (e.g. the ESC that
        mov     ah, 1                 ; quit a previous run) so we don't insta-quit
        int     0x16
        jz      .kdone
        xor     ah, ah
        int     0x16
        jmp     .kflush
.kdone:
        call    g_draw_main
.mloop:
        mov     ax, [gcat]
        mov     [gsel_old], ax       ; remember selection for incremental redraw
        call    wait_event
        cmp     byte [ev], 1
        je      .mclick
        mov     ax, [ev_key]
        cmp     al, 0x1B
        je      .mquit
        cmp     al, 0x0D
        je      .mopen
        cmp     al, 0
        jne     .mloop
        cmp     ah, 0x48
        je      .mup
        cmp     ah, 0x50
        je      .mdown
        cmp     ah, 0x4B
        je      .mleft
        cmp     ah, 0x4D
        je      .mright
        jmp     .mloop
.mup:
        mov     ax, [gcat]
        cmp     ax, GCOLS
        jb      .mred
        sub     ax, GCOLS
        mov     [gcat], ax
        jmp     .mred
.mdown:
        mov     ax, [gcat]
        add     ax, GCOLS
        cmp     ax, NCATS
        jae     .mred
        mov     [gcat], ax
        jmp     .mred
.mleft:
        cmp     word [gcat], 0
        je      .mred
        dec     word [gcat]
        jmp     .mred
.mright:
        mov     ax, [gcat]
        inc     ax
        cmp     ax, NCATS
        jae     .mred
        mov     [gcat], ax
.mred:
        call    cursor_hide          ; repaint only the two affected tiles
        mov     ax, [gsel_old]
        mov     [tile_i], ax
        mov     byte [tile_sel], 0
        call    main_tile
        mov     ax, [gcat]
        mov     [tile_i], ax
        mov     byte [tile_sel], 1
        call    main_tile
        jmp     .mloop
.mclick:
        call    hit_tile
        jc      .mloop
        cmp     ax, NCATS
        jae     .mloop
        mov     [gcat], ax           ; click a category tile -> open it
.mopen:
        mov     word [gitem], 0
        call    g_sub_loop
        call    g_draw_main
        jmp     .mloop
.mquit:
        call    mouse_shutdown       ; release IRQ12 / restore 8042 (direct mode)
        mov     ax, 0x0003
        int     0x10
        mov     ax, 0x4C00
        int     0x21

; ============================================================================
;  Hardware guard: PS2GUI drives PC110-specific hardware directly, so it must
;  only run on a genuine PC110 (QEMU is allowed so it can be developed/tested).
; ============================================================================
; is_pc110 : CF clear if the IBM PC110 APM vendor BIOS answers with its "SLO"
;   identify signature (same check PS2.EXE / ULTRACHG use).  CF set otherwise.
is_pc110:
        push    ax
        push    bx
        push    cx
        mov     ax, 0x5380           ; AH=53h APM, AL=80h IBM vendor extension
        mov     bh, 0x7F             ; function 7F = identify
        int     0x15
        cmp     bh, 0x53             ; 'S'
        jne     .no
        cmp     bl, 0x4C             ; 'L'
        jne     .no
        cmp     cl, 0x4F             ; 'O'
        jne     .no
        clc
        jmp     .done
.no:    stc
.done:  pop     cx
        pop     bx
        pop     ax
        ret

; is_qemu : CF clear if the QEMU fw_cfg port (0x510/0x511) returns "QEMU".
is_qemu:
        push    ax
        push    dx
        mov     dx, 0x510            ; fw_cfg selector
        xor     ax, ax               ; entry 0 = signature
        out     dx, ax
        mov     dx, 0x511            ; fw_cfg data
        in      al, dx
        cmp     al, 'Q'
        jne     .no
        in      al, dx
        cmp     al, 'E'
        jne     .no
        in      al, dx
        cmp     al, 'M'
        jne     .no
        in      al, dx
        cmp     al, 'U'
        jne     .no
        clc
        jmp     .done
.no:    stc
.done:  pop     dx
        pop     ax
        ret

; hw_warn : this is not a PC110 (or QEMU).  Show the warning in text mode and
;   wait: ESC quits (CF set); F10 runs anyway (CF clear).
hw_warn:
        mov     ax, 0x0003           ; 80x25 text mode (clears screen)
        int     0x10
        mov     ah, 0x09
        mov     dx, warn_msg
        int     0x21
.wk:    xor     ah, ah
        int     0x16
        cmp     al, 0x1B             ; ESC -> quit (recommended)
        je      .quit
        cmp     ah, 0x44             ; F10 -> run anyway
        je      .run
        jmp     .wk
.run:   clc
        ret
.quit:  stc
        ret

; ---- sub-menu (items of category [gcat]) ----
g_sub_loop:
        call    g_draw_sub
.sloop:
        mov     ax, [gitem]
        mov     [gsel_old], ax       ; remember selection for incremental redraw
        call    wait_event
        cmp     byte [ev], 1
        je      .sclick
        mov     ax, [ev_key]
        cmp     al, 0x1B
        je      .sback
        cmp     al, 0x0D
        je      .sopen
        cmp     al, 0
        jne     .sloop
        cmp     ah, 0x48
        je      .sup
        cmp     ah, 0x50
        je      .sdown
        cmp     ah, 0x4B
        je      .sleft
        cmp     ah, 0x4D
        je      .sright
        jmp     .sloop
.sclick:
        call    hit_tile
        jc      .sloop
        mov     bx, ax
        mov     al, [cat_count]
        xor     ah, ah
        cmp     bx, ax
        jae     .sloop
        mov     [gitem], bx          ; click an item tile -> activate it
        call    g_activate
        call    g_draw_sub
        jmp     .sloop
.sup:
        mov     ax, [gitem]
        cmp     ax, GCOLS
        jb      .sred
        sub     ax, GCOLS
        mov     [gitem], ax
        jmp     .sred
.sdown:
        mov     ax, [gitem]
        add     ax, GCOLS
        mov     bl, [cat_count]
        xor     bh, bh
        cmp     ax, bx
        jae     .sred
        mov     [gitem], ax
        jmp     .sred
.sleft:
        cmp     word [gitem], 0
        je      .sred
        dec     word [gitem]
        jmp     .sred
.sright:
        mov     ax, [gitem]
        inc     ax
        mov     bl, [cat_count]
        xor     bh, bh
        cmp     ax, bx
        jae     .sred
        mov     [gitem], ax
.sred:
        call    cursor_hide          ; repaint only the two affected tiles
        mov     ax, [gsel_old]
        mov     [tile_i], ax
        mov     byte [tile_sel], 0
        call    sub_tile
        mov     ax, [gitem]
        mov     [tile_i], ax
        mov     byte [tile_sel], 1
        call    sub_tile
        jmp     .sloop
.sopen:
        call    g_activate
        call    g_draw_sub
        jmp     .sloop
.sback:
        ret

; ---- activate the selected item (dispatch by row type) ----
g_activate:
        mov     al, [cat_start]
        xor     ah, ah
        add     ax, [gitem]
        mov     [sel], ax
        mov     bx, ax
        call    row_ptr
        mov     al, [si+6]
        cmp     al, R_ITEM
        je      .item
        cmp     al, R_UITEM
        je      .uitem
        cmp     al, R_ACT
        je      .act
        cmp     al, R_INFO
        je      .info
        mov     ax, [si+2]        ; R_CALL -> self-contained test/report
        push    ax
        call    to_text           ; mouse off + mask IRQ12 (8042/keyboard safety)
        mov     ax, 0x0012        ; run it on a GRAPHICAL mauve page (Easy-Setup look)
        int     0x10
        call    set_palette
        mov     byte [body_gfx], 1
        mov     word [tty_col], 0x0004   ; dark text
        pop     ax
        call    ax
        mov     byte [body_gfx], 0
        mov     word [tty_col], 0x0007
        call    to_gfx
        ret
.info:
        call    to_text
        call    run_revision
        call    to_gfx
        ret
.act:
        mov     si, [si+2]
        call    build_cmd_noopt
        call    to_text
        call    confirm_run
        call    to_gfx
        ret
.item:
        mov     ax, [si+2]
        mov     [cur_cmd], ax
        mov     ax, [si+4]
        mov     [opt_base], ax
        call    g_picker
        jc      .done
        call    opt_ptr
        mov     [cur_opt], si
        mov     si, [cur_cmd]
        call    build_cmd_opt
        call    to_text
        call    confirm_run
        call    to_gfx
.done:
        ret
.uitem:
        mov     word [exec_prog], ultra_prog
        mov     word [show_pfx], pfx_ultra
        mov     byte [ultra_mode], 1
        mov     ax, [si+4]
        mov     [opt_base], ax
        call    g_picker
        jc      .ureset
        call    opt_ptr
        mov     [cur_opt], si
        call    build_cmd_ultraopt
        call    to_text
        call    confirm_run
        call    to_gfx
.ureset:
        mov     word [exec_prog], progname
        mov     word [show_pfx], pfx_ps2
        mov     byte [ultra_mode], 0
        ret

; ---- graphical value picker (options of [opt_base]); CF=0 chosen / CF=1 cancel ----
g_picker:
        mov     word [opt_sel], 0
        call    g_draw_pick
.ploop:
        mov     ax, [opt_sel]
        mov     [gsel_old], ax       ; remember selection for incremental redraw
        call    wait_event
        cmp     byte [ev], 1
        je      .pclick
        mov     ax, [ev_key]
        cmp     al, 0x1B
        je      .pcancel
        cmp     al, 0x0D
        je      .pok
        cmp     al, 0
        jne     .ploop
        cmp     ah, 0x48
        je      .pup
        cmp     ah, 0x50
        je      .pdown
        jmp     .ploop
.pclick:
        call    hit_opt
        jc      .ploop
        mov     [opt_sel], ax        ; click a value -> choose it
        clc
        ret
.pup:
        cmp     word [opt_sel], 0
        je      .pred
        dec     word [opt_sel]
        jmp     .pred
.pdown:
        call    opt_count
        mov     ax, [opt_sel]
        inc     ax
        cmp     ax, cx
        jae     .pred
        mov     [opt_sel], ax
.pred:
        call    cursor_hide          ; repaint only the two affected option rows
        mov     ax, [gsel_old]
        mov     [tile_i], ax
        mov     byte [tile_sel], 0
        call    pick_row
        mov     ax, [opt_sel]
        mov     [tile_i], ax
        mov     byte [tile_sel], 1
        call    pick_row
        jmp     .ploop
.pok:
        clc
        ret
.pcancel:
        stc
        ret

; pick_row : repaint one picker option row [tile_i] with [tile_sel]
pick_row:
        mov     ax, [tile_i]
        mov     [pk_i], ax
        mov     bx, PK_ROW
        mul     bx
        add     ax, [pk_y]
        add     ax, PK_TITLE + 4
        mov     [pk_oy], ax
        mov     word [fr_x], PK_X + 8
        mov     ax, [pk_oy]
        dec     ax
        mov     [fr_y], ax
        mov     word [fr_w], PK_W - 16
        mov     word [fr_h], PK_ROW
        mov     al, C_WHITE
        cmp     byte [tile_sel], 0
        je      .bg
        mov     al, C_RED
.bg:    mov     [fr_col], al
        call    g_fillrect
        mov     byte [g_col], C_NAVY
        cmp     byte [tile_sel], 0
        je      .t
        mov     byte [g_col], C_WHITE
.t:     call    ptr_to_opt
        push    si
        call    gt_strlen
        pop     si
        shl     cx, 2
        mov     ax, PK_X + PK_W/2
        sub     ax, cx
        mov     [gt_x], ax
        mov     ax, [pk_oy]
        add     ax, 2
        mov     [gt_y], ax
        call    gtext
        ret

; ---- graphical draw helpers ----
g_fill_mauve:
        push    es
        mov     dx, 0x3C4
        mov     al, 2
        out     dx, al
        inc     dx
        mov     al, 0x0F
        out     dx, al
        mov     ax, 0xA000
        mov     es, ax
        xor     di, di
        mov     cx, 19200
        xor     ax, ax
        rep     stosw
        pop     es
        ret

; g_fill_page : white screen (like Easy-Setup's border) with the mauve panel
; inset at (32,32)-(607,400); everything else is drawn on the panel.
g_fill_page:
        mov     byte [cur_valid], 0  ; whole screen repainted -> cursor bg is stale
        mov     word [fr_x], 0
        mov     word [fr_y], 0
        mov     word [fr_w], 640
        mov     word [fr_h], 480
        mov     byte [fr_col], C_WHITE
        call    g_fillrect
        mov     word [fr_x], 32
        mov     word [fr_y], 32
        mov     word [fr_w], 576
        mov     word [fr_h], 369
        mov     byte [fr_col], C_MAUVE
        call    g_fillrect
        ret

; g_bg : prepare the background for a menu/dialog draw.  The white border, mauve
; panel, title and copyright are the same on every screen, so on a normal screen
; change we DON'T repaint them (that full white fill is what flashes) - we only
; clear the content region and refresh the breadcrumb.  A full page is drawn only
; the first time and after a video-mode reset ([need_full]=1, set by to_gfx).
g_bg:
        cmp     byte [need_full], 0
        je      .content
        call    g_fill_page
        call    g_chrome
        mov     byte [need_full], 0
        ret
.content:
        mov     byte [cur_valid], 0  ; content repainted -> cursor bg is stale
        mov     word [fr_x], 40      ; clear only the content area to mauve
        mov     word [fr_y], 108
        mov     word [fr_w], 560
        mov     word [fr_h], 286
        mov     byte [fr_col], C_MAUVE
        call    g_fillrect
        mov     word [fr_x], 240     ; clear the breadcrumb slot (keeps the title)
        mov     word [fr_y], 72
        mov     word [fr_w], 360
        mov     word [fr_h], 20
        mov     byte [fr_col], C_MAUVE
        call    g_fillrect
        cmp     word [bc_str], 0
        je      .d
        mov     byte [g_col], C_BLACK
        mov     dh, 5
        mov     dl, 32
        mov     si, [bc_str]
        call    g_puts
.d:     ret

; g_puts : DH=row DL=col SI=asciiz, colour in [g_col]; stops at NUL or '='
g_puts:
        push    ax
        push    bx
        push    dx
        mov     ah, 2
        xor     bh, bh
        int     0x10
.n:     lodsb
        test    al, al
        jz      .d
        cmp     al, '='
        je      .d
        mov     ah, 0x0E
        mov     bl, [g_col]
        xor     bh, bh
        int     0x10
        jmp     .n
.d:     pop     dx
        pop     bx
        pop     ax
        ret

; g_box_draw : red/mauve 2-px outline around text row [box_row], colour [ringcol]
g_box_draw:
        mov     al, [box_row]
        mov     cl, 4
        shl     al, cl
        xor     ah, ah
        mov     dx, ax
        mov     [ry0], dx            ; top of cell (row*16)
        mov     dx, ax
        add     dx, 15
        mov     [ry1], dx            ; bottom of cell (row*16+15)
        mov     word [rx0], 40       ; picker selection box, kept inside the panel
        mov     word [rx1], 575
        mov     dx, [ry0]
        call    hline
        mov     dx, [ry0]
        inc     dx
        call    hline
        mov     dx, [ry1]
        call    hline
        mov     dx, [ry1]
        dec     dx
        call    hline
        mov     cx, [rx0]
        call    vline
        mov     cx, [rx0]
        inc     cx
        call    vline
        mov     cx, [rx1]
        call    vline
        mov     cx, [rx1]
        dec     cx
        call    vline
        ret

; ---- main menu : 10 category tiles in an Easy-Setup icon grid ----
g_draw_main:
        mov     word [bc_str], t_main
        call    g_bg                 ; full page (first time) or content-only repaint
        mov     word [ri], 0
.n:     mov     ax, [ri]
        cmp     ax, NCATS
        jae     .done
        mov     bx, [ri]
        shl     bx, 1
        mov     si, [cat_tile+bx]    ; category icon
        mov     ax, [ri]
        mov     [tile_i], ax
        mov     byte [tile_sel], 0
        cmp     ax, [gcat]
        jne     .ns
        mov     byte [tile_sel], 1
.ns:    call    g_tile               ; SI = icon
        mov     bx, [ri]
        call    cat_ptr
        mov     si, [si]             ; category label
        call    g_tile_label
        inc     word [ri]
        jmp     .n
.done:
        ret

; ---- sub-menu : the category's items as an icon grid ----
g_draw_sub:
        mov     bx, [gcat]
        call    cat_ptr
        mov     ax, [si]
        mov     [bc_str], ax         ; breadcrumb = category name
        mov     al, [si+4]
        mov     [cat_start], al
        mov     al, [si+5]
        mov     [cat_count], al
        call    g_bg                 ; full page (first time) or content-only repaint
        mov     word [ri], 0
.n:     mov     al, [cat_count]
        xor     ah, ah
        mov     bx, [ri]
        cmp     bx, ax
        jae     .done
        mov     al, [cat_start]
        xor     ah, ah
        add     ax, [ri]
        mov     [gidx], ax           ; global row index (rows[] order)
        mov     bx, ax
        call    row_ptr
        mov     ax, [si]
        mov     [lbl_tmp], ax
        mov     bx, [gidx]           ; per-item icon = row_icon[gidx]
        shl     bx, 1
        mov     si, [row_icon+bx]
        mov     ax, [ri]
        mov     [tile_i], ax
        mov     byte [tile_sel], 0
        cmp     ax, [gitem]
        jne     .ns
        mov     byte [tile_sel], 1
.ns:    call    g_tile
        mov     si, [lbl_tmp]
        call    g_tile_label
        inc     word [ri]
        jmp     .n
.done:
        ret

; g_draw_pick : a centred Easy-Setup-style dialog window (drop shadow, white body,
; red title bar, red selection bar with white text) listing the option values.
PK_X      equ 200
PK_W      equ 240
PK_TITLE  equ 26            ; title-bar height
PK_ROW    equ 20            ; option row height
g_draw_pick:
        call    g_bg                 ; keeps the border/title; clears the content area
        call    opt_count            ; CX = number of options
        mov     [pkd_n], cx
        mov     ax, cx               ; H = PK_TITLE + n*PK_ROW + 10
        mov     bx, PK_ROW
        mul     bx
        add     ax, PK_TITLE + 10
        mov     [pk_h], ax
        mov     bx, 216              ; centre vertically in the panel
        shr     ax, 1
        sub     bx, ax
        mov     [pk_y], bx
        ; drop shadow (navy, offset 8)
        mov     word [fr_x], PK_X + 8
        mov     ax, [pk_y]
        add     ax, 8
        mov     [fr_y], ax
        mov     word [fr_w], PK_W
        mov     ax, [pk_h]
        mov     [fr_h], ax
        mov     byte [fr_col], C_NAVY
        call    g_fillrect
        ; body (white)
        mov     word [fr_x], PK_X
        mov     ax, [pk_y]
        mov     [fr_y], ax
        mov     word [fr_w], PK_W
        mov     ax, [pk_h]
        mov     [fr_h], ax
        mov     byte [fr_col], C_WHITE
        call    g_fillrect
        ; title bar (red)
        mov     word [fr_x], PK_X
        mov     ax, [pk_y]
        mov     [fr_y], ax
        mov     word [fr_w], PK_W
        mov     word [fr_h], PK_TITLE
        mov     byte [fr_col], C_RED
        call    g_fillrect
        ; title text (white, centred in the bar)
        mov     si, pk_title
        call    gt_strlen
        shl     cx, 2
        mov     ax, PK_X + PK_W/2
        sub     ax, cx
        mov     [gt_x], ax
        mov     ax, [pk_y]
        add     ax, 5
        mov     [gt_y], ax
        mov     byte [g_col], C_WHITE
        mov     si, pk_title
        call    gtext
        ; option rows
        mov     word [pk_i], 0
.n:     mov     ax, [pk_i]
        cmp     ax, [pkd_n]
        jae     .done
        mov     bx, PK_ROW           ; opt_y = pk_y + PK_TITLE + 4 + i*PK_ROW
        mul     bx
        add     ax, [pk_y]
        add     ax, PK_TITLE + 4
        mov     [pk_oy], ax
        mov     ax, [pk_i]           ; selected?
        cmp     ax, [opt_sel]
        jne     .navy
        mov     word [fr_x], PK_X + 8   ; red selection bar
        mov     ax, [pk_oy]
        dec     ax
        mov     [fr_y], ax
        mov     word [fr_w], PK_W - 16
        mov     word [fr_h], PK_ROW
        mov     byte [fr_col], C_RED
        call    g_fillrect
        mov     byte [g_col], C_WHITE
        jmp     .txt
.navy:  mov     byte [g_col], C_NAVY
.txt:   call    ptr_to_opt           ; SI = option #pk_i
        push    si
        call    gt_strlen
        pop     si
        shl     cx, 2
        mov     ax, PK_X + PK_W/2    ; centre the value
        sub     ax, cx
        mov     [gt_x], ax
        mov     ax, [pk_oy]
        add     ax, 2
        mov     [gt_y], ax
        call    gtext
        inc     word [pk_i]
        jmp     .n
.done:  ret

to_text:
        push    ax
        cmp     byte [mouse_mode], 2 ; suspend the direct mouse during text actions
        jne     .t
        cli
        in      al, 0xA1             ; mask IRQ12
        or      al, 0x10
        out     0xA1, al
        mov     al, 0xA7             ; DISABLE aux device: stop the trackpad clocking
        call    k_cmd                ; (a stuck mouse byte in OBF would block the
        call    k_flush              ;  keyboard, so drain it) -> "press any key" works
        sti
.t:     mov     ax, 0x0003
        int     0x10
        pop     ax
        ret
to_gfx:
        push    ax
        mov     ax, 0x0012
        int     0x10
        call    set_palette
        cmp     byte [mouse_mode], 2 ; resume the direct mouse
        jne     .g
        cli
        mov     al, 0xA8             ; re-enable aux device
        call    k_cmd
        call    k_flush              ; drop bytes queued during the text action
        mov     byte [mpkt_idx], 0   ; resync packet framing
        in      al, 0xA1             ; unmask IRQ12
        and     al, 0xEF
        out     0xA1, al
        sti
.g:     pop     ax
        mov     byte [need_full], 1  ; mode reset cleared the screen -> full repaint next
        ret

; ============================================================================
;  Mouse (INT 33h) + a custom Easy-Setup arrow cursor drawn by hand so it is
;  visible (white body, black outline) on any tile colour.
; ============================================================================
; mouse_init : if an INT 33h driver is present use it (mode 1); otherwise talk to
; the PS/2 trackpad (U75 uPD17137A) directly through the 8042 aux channel (mode 2).
mouse_init:
        push    es
        xor     ax, ax
        mov     es, ax
        mov     bx, [es:0x33*4]      ; INT 33h vector
        mov     dx, [es:0x33*4+2]
        pop     es
        mov     ax, bx
        or      ax, dx
        jz      .direct              ; no driver -> talk to the trackpad ourselves
        xor     ax, ax
        int     0x33                 ; reset; AX=FFFF if installed
        cmp     ax, 0xFFFF
        jne     .direct
        mov     ax, 7                ; x range (leave 16px for the cursor)
        xor     cx, cx
        mov     dx, 609
        int     0x33
        mov     ax, 8                ; y range
        xor     cx, cx
        mov     dx, 449
        int     0x33
        mov     ax, 4                ; start near the centre
        mov     cx, 300
        mov     dx, 216
        int     0x33
        mov     byte [have_mouse], 1
        mov     byte [mouse_mode], 1
        ret
.direct:
        call    mouse_init_direct
        ret

; ---- extra 8042 helpers (aux_wait_ibf / aux_get / aux_write already exist) ----
k_cmd:                               ; AL -> command port 0x64
        push    ax
        call    aux_wait_ibf
        pop     ax
        out     0x64, al
        ret
k_data:                              ; AL -> data port 0x60
        push    ax
        call    aux_wait_ibf
        pop     ax
        out     0x60, al
        ret
k_flush:                             ; drain any pending 8042 output bytes
        push    ax
        push    cx
        mov     cx, 24
.f:     in      al, 0x64
        test    al, 1
        jz      .d
        in      al, 0x60
        loop    .f
.d:     pop     cx
        pop     ax
        ret
aux_drain:                           ; read replies until none arrive (per-byte wait)
        push    ax
        push    cx
.d:     mov     cx, 0x1000           ; short wait for the next byte
.w:     in      al, 0x64
        test    al, 1
        jnz     .g
        loop    .w
        pop     cx
        pop     ax
        ret
.g:     in      al, 0x60
        jmp     .d
aux_get_slow:                        ; aux_get with a much longer timeout -> AL, CF=1
        push    cx
        push    dx
        mov     dx, 32
.o:     xor     cx, cx
.w:     in      al, 0x64
        test    al, 1
        jnz     .g
        loop    .w
        dec     dx
        jnz     .o
        pop     dx
        pop     cx
        stc
        ret
.g:     in      al, 0x60
        pop     dx
        pop     cx
        clc
        ret

; mouse_init_direct : bring up the PS/2 trackpad and take IRQ12.
mouse_init_direct:
        mov     word [ms_x], 300
        mov     word [ms_y], 216
        mov     byte [mpkt_idx], 0
        cli                          ; ints off: the BIOS ISR must not steal our replies
        call    k_flush
        mov     al, 0x20             ; read 8042 command byte
        call    k_cmd
        call    aux_get_slow
        jc      .no                  ; 8042 not responding at all
        mov     [old_kbc], al
        mov     al, 0xA8             ; enable aux clock
        call    k_cmd
        mov     al, 0xF5             ; disable reporting FIRST: stop any active stream
        call    aux_write            ; (a finger on the pad during init would otherwise
        call    aux_get_slow         ;  interleave packet bytes with the command ACKs and
        call    aux_drain            ;  leave the device half-configured -> flaky start)
        call    k_flush
        mov     al, 0xF6             ; set defaults
        call    aux_write
        call    aux_drain
        mov     al, 0xF2             ; get device ID (presence check)
        call    aux_write
        call    aux_get_slow         ; FA
        jc      .no                  ; no aux device present
        call    aux_drain            ; ID byte
        mov     al, 0xF3             ; set sample rate 100/s
        call    aux_write
        call    aux_drain
        mov     al, 0x64
        call    aux_write
        call    aux_drain
        mov     al, 0xF4             ; enable data reporting (stream mode)
        call    aux_write
        call    aux_drain
        call    k_flush              ; OBF empty before enabling IRQ12
        mov     byte [mpkt_idx], 0
        cli                          ; install IRQ12 (INT 0x74) handler
        xor     ax, ax
        mov     es, ax
        mov     ax, [es:0x74*4]
        mov     [old_i12_off], ax
        mov     ax, [es:0x74*4+2]
        mov     [old_i12_seg], ax
        mov     word [es:0x74*4], irq12_handler
        mov     ax, cs
        mov     [es:0x74*4+2], ax
        mov     al, 0x60             ; 8042 command byte: enable kbd+aux + both IRQs
        call    k_cmd
        mov     al, [old_kbc]
        or      al, 0x03             ; kbd int + aux int on
        and     al, 0xCF             ; kbd + aux clocks enabled (clear disable bits)
        call    k_data
        call    k_flush              ; drain any packet byte queued while enabling the aux
        mov     byte [mpkt_idx], 0   ; IRQ so the very first IRQ12 lands on a true byte0
        in      al, 0xA1             ; unmask IRQ12 (slave PIC bit4)
        and     al, 0xEF
        out     0xA1, al
        in      al, 0x21             ; unmask cascade IRQ2 (master bit2)
        and     al, 0xFB
        out     0x21, al
        sti
        ; Seed the button baseline as "pressed" so a phantom button state left in
        ; the trackpad/8042 across an exit->relaunch is NOT read as a fresh click
        ; (a fresh right-click = ESC = instant quit).  A real click still needs a
        ; release first, which always happens naturally.
        mov     byte [ms_pbtn], 1
        mov     byte [ms_prbtn], 1
        mov     byte [have_mouse], 1
        mov     byte [mouse_mode], 2
        ret
.no:    mov     byte [have_mouse], 0
        mov     byte [mouse_mode], 0
        ret

; irq12_handler : one aux byte per interrupt; assemble 3-byte packets.
irq12_handler:
        pusha
        push    ds
        mov     ax, cs
        mov     ds, ax
        in      al, 0x64             ; consume 0x60 ONLY for a real aux byte:
        and     al, 0x21             ; bit0=OBF (data present), bit5=aux (from mouse).
        cmp     al, 0x21             ; a spurious IRQ12 or a stray keyboard byte would
        jne     .eoi                 ; otherwise be misframed into a garbage packet.
        in      al, 0x60
        mov     bl, [mpkt_idx]
        or      bl, bl
        jnz     .b1
        test    al, 0x08             ; byte0 sync bit must be set
        jz      .eoi
        mov     [mpkt0], al
        mov     byte [mpkt_idx], 1
        jmp     .eoi
.b1:    cmp     bl, 1
        jne     .b2
        mov     [mpkt1], al
        mov     byte [mpkt_idx], 2
        jmp     .eoi
.b2:    mov     [mpkt2], al
        mov     byte [mpkt_idx], 0
        call    mpkt_apply
.eoi:   mov     al, 0x20
        out     0xA0, al             ; EOI slave PIC
        out     0x20, al             ; EOI master PIC
        pop     ds
        popa
        iret

; mpkt_apply : decode [mpkt0..2] into ms_x/ms_y/mbtns
mpkt_apply:
        mov     al, [mpkt0]          ; buttons: bit0 left, bit1 right
        and     al, 3
        xor     ah, ah
        mov     [mbtns], ax
        mov     al, [mpkt1]          ; X delta (signed)
        cbw
        add     ax, [ms_x]
        jns     .xhi
        xor     ax, ax
        jmp     .xok
.xhi:   cmp     ax, 608              ; 640 - CUR_W(32): keep the whole cursor on-screen
        jbe     .xok                 ;   (an off-screen cursor -> BIOS pixel I/O past the
        mov     ax, 608              ;    screen -> VGA-BIOS fault -> crash)
.xok:   mov     [ms_x], ax
        mov     al, [mpkt2]          ; Y delta (signed); screen Y grows down
        cbw
        neg     ax
        add     ax, [ms_y]
        jns     .yhi
        xor     ax, ax
        jmp     .yok
.yhi:   cmp     ax, 448              ; 480 - CUR_H(32): keep the whole cursor on-screen
        jbe     .yok
        mov     ax, 448
.yok:   mov     [ms_y], ax
        ret

; mouse_shutdown : undo the direct-mode setup before returning to DOS.
mouse_shutdown:
        cmp     byte [mouse_mode], 2
        jne     .d
        cli
        call    k_flush
        mov     al, 0xF5             ; disable reporting
        call    aux_write
        call    aux_get
        in      al, 0xA1             ; mask IRQ12
        or      al, 0x10
        out     0xA1, al
        xor     ax, ax               ; restore IVT 0x74
        mov     es, ax
        mov     ax, [old_i12_off]
        mov     [es:0x74*4], ax
        mov     ax, [old_i12_seg]
        mov     [es:0x74*4+2], ax
        mov     al, 0x60             ; restore 8042 command byte
        call    k_cmd
        mov     al, [old_kbc]
        call    k_data
        sti
.d:     ret

; wait_event : block until a keystroke, a left click, or a right click, keeping
;   the cursor live.  Returns [ev]=0 (key in [ev_key]) or [ev]=1 (left click at
;   [ms_x],[ms_y]).  Right click is reported as an ESC keystroke.
wait_event:
        cmp     byte [have_mouse], 0
        jne     .spin
        call    getkey
        mov     [ev_key], ax
        mov     byte [ev], 0
        ret
.spin:
        cmp     byte [mouse_mode], 2 ; direct mode: ms_x/ms_y/mbtns updated by IRQ12
        je      .havepos
        mov     ax, 3
        int     0x33                 ; BX=buttons CX=x DX=y
        mov     [ms_x], cx
        mov     [ms_y], dx
        mov     [mbtns], bx
.havepos:
        cmp     byte [cur_valid], 0
        je      .upd
        mov     ax, [ms_x]
        cmp     ax, [cur_lx]
        jne     .upd
        mov     ax, [ms_y]
        cmp     ax, [cur_ly]
        jne     .upd
        jmp     .btn
.upd:
        inc     byte [cur_fctr]      ; advance the wing-flap animation as we move
        mov     al, [cur_fctr]
        shr     al, 1
        shr     al, 1                ; flip frame every 4 move steps (~steady flap)
        and     al, 1
        mov     [cur_frame], al
        cmp     byte [cur_valid], 0
        je      .snap
        call    cursor_restore       ; erase at the OLD cur_lx/cur_ly
.snap:
        cli                          ; snapshot the (volatile) position atomically
        mov     ax, [ms_x]
        mov     [cur_lx], ax
        mov     ax, [ms_y]
        mov     [cur_ly], ax
        sti
        call    cursor_save          ; save/draw use the stable cur_lx/cur_ly so a
        call    cursor_draw          ; mid-save IRQ12 update can't smear the buffer
        mov     byte [cur_valid], 1
.btn:
        mov     ax, [mbtns]
        and     ax, 1
        mov     bl, [ms_pbtn]
        mov     [ms_pbtn], al
        test    al, al
        jz      .rbtn
        test    bl, bl
        jnz     .rbtn
        mov     byte [ev], 1
        ret
.rbtn:
        mov     ax, [mbtns]
        and     ax, 2
        mov     bl, [ms_prbtn]
        mov     [ms_prbtn], al
        test    al, al
        jz      .key
        test    bl, bl
        jnz     .key
        mov     word [ev_key], 0x011B    ; ESC
        mov     byte [ev], 0
        ret
.key:
        mov     ah, 1
        int     0x16
        jz      .spin
        xor     ah, ah
        int     0x16
        mov     [ev_key], ax
        mov     byte [ev], 0
        ret

CUR_BW  equ 5                           ; bytes/row covering the 30px cursor + bit slack

cur_winoff:                          ; [cur_off] = cur_ly*80 + cur_lx/8
        push    ax
        push    bx
        push    dx
        mov     ax, [cur_ly]
        mov     dx, 80
        mul     dx
        mov     bx, [cur_lx]
        shr     bx, 3
        add     ax, bx
        mov     [cur_off], ax
        pop     dx
        pop     bx
        pop     ax
        ret

; cursor_save : copy the cursor's byte-aligned window (all 4 planes) to cur_buf,
;   directly from VRAM (fast — no per-pixel BIOS calls -> almost no flicker).
cursor_save:                         ; save ONLY silhouette pixels via BIOS (INT 10h)
        pusha
        mov     di, cur_buf
        xor     bp, bp               ; row
.rl:    mov     ax, bp               ; si -> this row's silhouette words
        mov     cx, CUR_WW * 2
        mul     cx
        mov     si, cur_silh
        add     si, ax
        xor     bx, bx               ; col
.cl:    mov     ax, bx               ; test silhouette bit for this column
        shr     ax, 4
        shl     ax, 1
        push    si
        add     si, ax
        mov     dx, [si]
        pop     si
        mov     cx, bx
        and     cx, 15
        mov     ax, 0x8000
        shr     ax, cl
        test    dx, ax
        jz      .nxt
        mov     cx, [cur_lx]
        add     cx, bx
        mov     dx, [cur_ly]
        add     dx, bp
        mov     ah, 0x0D
        xor     bh, bh
        push    bp
        push    si
        push    di
        push    bx
        int     0x10                 ; AL = pixel colour
        pop     bx
        pop     di
        pop     si
        pop     bp
        mov     [di], al
        inc     di
.nxt:   inc     bx
        cmp     bx, CUR_W
        jb      .cl
        inc     bp
        cmp     bp, CUR_H
        jb      .rl
        popa
        ret

; cursor_restore : write cur_buf back to VRAM (all 4 planes), directly & fast.
cursor_restore:                      ; restore ONLY silhouette pixels via BIOS
        pusha
        mov     di, cur_buf          ; source index
        xor     bp, bp               ; row
.rl:    mov     ax, bp               ; si -> this row's silhouette words
        mov     cx, CUR_WW * 2
        mul     cx
        mov     si, cur_silh
        add     si, ax
        xor     bx, bx               ; col
.cl:    mov     ax, bx               ; test silhouette bit for this column
        shr     ax, 4
        shl     ax, 1
        push    si
        add     si, ax
        mov     dx, [si]
        pop     si
        mov     cx, bx
        and     cx, 15
        mov     ax, 0x8000
        shr     ax, cl
        test    dx, ax
        jz      .nxt
        mov     al, [di]             ; saved colour
        inc     di
        mov     cx, [cur_lx]
        add     cx, bx
        mov     dx, [cur_ly]
        add     dx, bp
        push    bp
        push    si
        push    di
        push    bx
        call    putpixel
        pop     bx
        pop     di
        pop     si
        pop     bp
.nxt:   inc     bx
        cmp     bx, CUR_W
        jb      .cl
        inc     bp
        cmp     bp, CUR_H
        jb      .rl
        popa
        ret

; cursor_draw : draw the duck at (cur_lx,cur_ly).  Picks the wing frame
;   (0 = up/glide, 1 = down) so it flaps as it moves.  Uses the BIOS bitmap
;   path (no VGA Set/Reset — that faulted on the real F65535 hardware).
cursor_draw:
        mov     si, cur_blk0         ; select frame bitmaps
        mov     di, cur_wht0
        cmp     byte [cur_frame], 0
        je      .have
        mov     si, cur_blk1
        mov     di, cur_wht1
.have:  mov     [cur_bp], si
        mov     [cur_wp], di
        mov     ax, [cur_lx]
        mov     [bm_x], ax
        mov     ax, [cur_ly]
        mov     [bm_y], ax
        mov     word [bm_ww], CUR_WW
        mov     word [bm_h], CUR_H
        mov     si, [cur_bp]         ; dark outline
        mov     byte [g_col], C_BLACK
        call    draw_bmp
        mov     ax, [cur_lx]
        mov     [bm_x], ax
        mov     ax, [cur_ly]
        mov     [bm_y], ax
        mov     word [bm_ww], CUR_WW
        mov     word [bm_h], CUR_H
        mov     si, [cur_wp]         ; white body
        mov     byte [g_col], C_WHITE
        call    draw_bmp
        ret

; cursor_hide : if the cursor is drawn, erase it (restore bg) and mark invalid.
; Call before an incremental (partial) redraw so no ghost is left behind.
cursor_hide:
        cmp     byte [cur_valid], 0
        je      .d
        call    cursor_restore
        mov     byte [cur_valid], 0
.d:     ret

; main_tile / sub_tile : repaint one tile [tile_i] with [tile_sel] (used for the
; incremental selection change, so navigation doesn't repaint the whole screen).
main_tile:
        mov     bx, [tile_i]
        shl     bx, 1
        mov     si, [cat_tile+bx]
        call    g_tile
        ret
sub_tile:
        mov     al, [cat_start]
        xor     ah, ah
        add     ax, [tile_i]
        shl     ax, 1
        mov     bx, ax
        mov     si, [row_icon+bx]
        call    g_tile
        ret

; hit_tile : CF=0 + AX=grid index if (ms_x,ms_y) is on a tile, else CF=1
hit_tile:
        mov     ax, [ms_x]
        sub     ax, 80
        js      .miss
        xor     dx, dx
        mov     bx, 104
        div     bx
        cmp     dx, 64
        jae     .miss
        cmp     ax, GCOLS
        jae     .miss
        mov     [hit_col], ax
        mov     ax, [ms_y]
        sub     ax, 160
        js      .miss
        xor     dx, dx
        mov     bx, 112
        div     bx
        cmp     dx, 64
        jae     .miss
        mov     bx, GCOLS
        mul     bx
        add     ax, [hit_col]
        clc
        ret
.miss:  stc
        ret

; hit_opt : CF=0 + AX=option index if (ms_x,ms_y) is on a picker row, else CF=1
hit_opt:
        mov     ax, [ms_x]
        cmp     ax, PK_X
        jb      .miss
        cmp     ax, PK_X + PK_W
        jae     .miss
        mov     ax, [ms_y]
        sub     ax, [pk_y]
        sub     ax, PK_TITLE + 4
        js      .miss
        xor     dx, dx
        mov     bx, PK_ROW
        div     bx
        cmp     ax, [pkd_n]
        jae     .miss
        clc
        ret
.miss:  stc
        ret

; ---- draw_icon : SI=16-word icon, [ic_x]/[ic_y] = top-left; white tile + red art.
; Rows 0/1/14/15 are blank in every icon, so the row's selection box (cell edges)
; and the 1px inter-row gaps never clip the art. ----
draw_icon:
        pusha
        xor     bp, bp               ; r = 0..15
.rl:    cmp     bp, 16
        jae     .done
        mov     ax, bp
        shl     ax, 1
        mov     bx, si
        add     bx, ax
        mov     dx, [bx]             ; row bit pattern
        xor     di, di               ; c = 0..15
.cl:    cmp     di, 16
        jae     .cnext
        shl     dx, 1                ; MSB -> CF
        mov     al, C_WHITE
        jnc     .plot
        mov     al, C_RED
.plot:
        push    dx                   ; preserve remaining bits
        mov     cx, [ic_x]
        add     cx, di
        mov     dx, [ic_y]
        add     dx, bp
        call    putpixel             ; AL=colour CX=x DX=y
        pop     dx
        inc     di
        jmp     .cl
.cnext:
        inc     bp
        jmp     .rl
.done:
        popa
        ret

; ============================================================================
;  Easy-Setup icon-grid helpers
; ============================================================================
GCOLS     equ 5

; g_chrome : title bitmap + duck + copyright + breadcrumb ([bc_str] or 0)
g_chrome:
        mov     si, tile_title       ; "PS2-GUI" title on the panel (aligned to first tile)
        mov     word [bm_x], 80
        mov     word [bm_y], 72
        mov     word [bm_ww], TITLE_WW
        mov     word [bm_h], TITLE_H
        mov     byte [g_col], C_BLACK
        call    draw_bmp
        mov     si, tile_copy        ; credit line as a bitmap on the white margin
        mov     word [bm_x], (640-COPY_WW*16)/2
        mov     word [bm_y], 450
        mov     word [bm_ww], COPY_WW
        mov     word [bm_h], COPY_H
        mov     byte [g_col], C_NAVY
        call    draw_bmp
        cmp     word [bc_str], 0
        je      .d
        mov     byte [g_col], C_BLACK
        mov     dh, 5
        mov     dl, 32
        mov     si, [bc_str]
        call    g_puts
.d:     ret

; g_tile : draw tile [tile_i] (bg + icon SI), highlighted if [tile_sel]
g_tile:
        mov     ax, [tile_i]
        mov     bl, GCOLS
        div     bl                   ; al=row ah=col
        mov     [t_row], al
        mov     [t_col], ah
        mov     al, [t_col]          ; tx = col*104 + 80  (exact Easy-Setup grid)
        xor     ah, ah
        mov     bx, 104
        mul     bx
        add     ax, 80
        mov     [tx], ax
        mov     al, [t_row]          ; ty = row*112 + 160
        xor     ah, ah
        mov     bx, 112
        mul     bx
        add     ax, 160
        mov     [ty], ax
        mov     ax, [tx]             ; tile background
        mov     [fr_x], ax
        mov     ax, [ty]
        mov     [fr_y], ax
        mov     word [fr_w], 64
        mov     word [fr_h], 64
        mov     al, C_WHITE
        cmp     byte [tile_sel], 0
        je      .bg
        mov     al, C_RED
.bg:    mov     [fr_col], al
        call    g_fillrect
        mov     byte [g_col], C_RED  ; icon colour (inverted when selected)
        cmp     byte [tile_sel], 0
        je      .ic
        mov     byte [g_col], C_WHITE
.ic:    mov     ax, [tx]
        add     ax, 8
        mov     [bm_x], ax
        mov     ax, [ty]
        add     ax, 8
        mov     [bm_y], ax
        mov     word [bm_ww], 3
        mov     word [bm_h], 48
        call    draw_bmp
        ret

; g_tile_label : SI=label, positioned under tile [tile_i]
g_tile_label:
        mov     ax, [tile_i]
        mov     bl, GCOLS
        div     bl                   ; al=row ah=col
        mov     [t_row], al
        mov     [t_col], ah
        mov     al, [t_col]          ; centre col = col*13 + 14  ((tx+32)/8)
        xor     ah, ah
        mov     bx, 13
        mul     bx
        add     ax, 14
        mov     [lbl_cc], ax
        mov     al, [t_row]          ; label row = (row*112 + 226) / 16
        xor     ah, ah
        mov     bx, 112
        mul     bx
        add     ax, 226
        mov     cl, 4
        shr     ax, cl
        mov     [lbl_r0], al
        mov     byte [g_col], C_BLACK
        call    g_label
        ret

; g_fillrect : planar fill [fr_x](byte-aligned),[fr_y],[fr_w](mult 8),[fr_h] = [fr_col]
g_fillrect:
        push    es
        cld
        mov     ax, 0xA000
        mov     es, ax
        xor     bp, bp               ; plane 0..3
.pl:    mov     dx, 0x3C4
        mov     al, 2
        out     dx, al
        inc     dx
        mov     cx, bp
        mov     al, 1
        shl     al, cl
        out     dx, al               ; map mask = 1<<plane
        mov     al, [fr_col]
        mov     cx, bp
        shr     al, cl
        and     al, 1
        neg     al                   ; bit set -> 0xFF else 0x00
        mov     [fr_fill], al
        mov     cx, [fr_h]
        mov     bx, [fr_y]
.row:   push    cx
        mov     ax, bx
        mov     cx, 80
        mul     cx                   ; ax = y*80
        mov     di, ax
        mov     ax, [fr_x]
        shr     ax, 1
        shr     ax, 1
        shr     ax, 1                ; /8
        add     di, ax
        mov     cx, [fr_w]
        shr     cx, 1
        shr     cx, 1
        shr     cx, 1                ; bytes = w/8
        mov     al, [fr_fill]
        rep     stosb
        pop     cx
        inc     bx
        loop    .row
        inc     bp
        cmp     bp, 4
        jb      .pl
        mov     dx, 0x3C4            ; restore map mask = all planes
        mov     al, 2
        out     dx, al
        inc     dx
        mov     al, 0x0F
        out     dx, al
        pop     es
        ret

; draw_bmp : SI=bitmap, [bm_x]/[bm_y], [bm_ww] words/row, [bm_h] rows;
;            plots set bits in [g_col], clear bits untouched.
draw_bmp:
        pusha
        mov     word [bm_r], 0
.rl:    mov     ax, [bm_r]
        cmp     ax, [bm_h]
        jae     .done
        mov     ax, [bm_r]
        mov     bx, [bm_ww]
        mul     bx
        shl     ax, 1                ; r*ww*2 bytes
        mov     di, si
        add     di, ax               ; di -> row words
        mov     word [bm_w], 0
.wl:    mov     ax, [bm_w]
        cmp     ax, [bm_ww]
        jae     .rnext
        mov     bx, [bm_w]
        shl     bx, 1
        mov     dx, [di+bx]          ; 16 bits
        mov     word [bm_c], 0
.bl:    cmp     word [bm_c], 16
        jae     .wnext
        shl     dx, 1                ; MSB -> CF
        jnc     .skip
        push    dx
        mov     cx, [bm_x]
        mov     ax, [bm_w]
        shl     ax, 4                ; w*16
        add     cx, ax
        add     cx, [bm_c]
        mov     dx, [bm_y]
        add     dx, [bm_r]
        mov     al, [g_col]
        call    putpixel
        pop     dx
.skip:  inc     word [bm_c]
        jmp     .bl
.wnext: inc     word [bm_w]
        jmp     .wl
.rnext: inc     word [bm_r]
        jmp     .rl
.done:  popa
        ret

; strlen_si : CX = length of asciiz at SI (SI preserved)
strlen_si:
        push    si
        xor     cx, cx
.s:     cmp     byte [si], 0
        je      .d
        inc     si
        inc     cx
        jmp     .s
.d:     pop     si
        ret

; g_putn : draw CX chars from SI at (DH,DL) in [g_col]
g_putn:
        push    si
        mov     [pn_n], cx
        mov     ah, 2
        xor     bh, bh
        int     0x10
.l:     cmp     word [pn_n], 0
        je      .d
        lodsb
        mov     ah, 0x0E
        mov     bl, [g_col]
        xor     bh, bh
        int     0x10
        dec     word [pn_n]
        jmp     .l
.d:     pop     si
        ret

; gt_strlen : CX = chars at SI until NUL or '=' (SI preserved)
gt_strlen:
        push    si
        xor     cx, cx
.s:     mov     al, [si]
        test    al, al
        je      .d
        cmp     al, '='
        je      .d
        inc     si
        inc     cx
        jmp     .s
.d:     pop     si
        ret

; gtext : draw asciiz SI at pixel [gt_x],[gt_y] in [g_col] using the ROM 8x16
; font, transparent background (only glyph pixels set). Stops at NUL or '='.
gtext:
        pusha
        push    es
        mov     es, [font_seg]
        mov     word [gt_cx], 0
.ch:    lodsb
        test    al, al
        je      .done
        cmp     al, '='
        je      .done
        xor     ah, ah               ; glyph = font_off + al*16
        shl     ax, 1
        shl     ax, 1
        shl     ax, 1
        shl     ax, 1
        add     ax, [font_off]
        mov     di, ax
        xor     bp, bp               ; row 0..15
.row:   mov     bl, [es:di]          ; font byte for this row
        xor     bh, bh               ; bit 0..7
.bit:   mov     al, 0x80
        mov     cl, bh
        shr     al, cl
        test    bl, al
        je      .nb
        mov     cx, [gt_cx]          ; x = gt_x + col*8 + bit
        shl     cx, 3
        add     cx, [gt_x]
        mov     al, bh
        xor     ah, ah
        add     cx, ax
        mov     dx, bp               ; y = gt_y + row
        add     dx, [gt_y]
        mov     al, [g_col]
        call    putpixel
.nb:    inc     bh
        cmp     bh, 8
        jb      .bit
        inc     di
        inc     bp
        cmp     bp, 16
        jb      .row
        inc     word [gt_cx]
        jmp     .ch
.done:  pop     es
        popa
        ret

; g_label : SI=asciiz, centred at column [lbl_cc], starting row [lbl_r0].
;           Greedy word-wrap to up to 3 lines of at most MAXW chars (so labels
;           never spill into the neighbouring 5-column tiles).
MAXW      equ 12
g_label:
        mov     [ls_p], si           ; line start
        mov     [ws_p], si           ; next word start
        mov     word [ll_cur], 0
        mov     al, [lbl_r0]
        mov     [cur_row], al
        mov     byte [nlines], 0
.word:
        mov     si, [ws_p]
        cmp     byte [si], 0
        je      .last
        mov     di, si               ; scan to end of word
.we:    mov     al, [di]
        cmp     al, 0
        je      .weend
        cmp     al, ' '
        je      .weend
        inc     di
        jmp     .we
.weend:
        mov     [we_p], di
        mov     ax, di               ; wl = we - word start
        sub     ax, si
        mov     [wl_cur], ax
        cmp     word [ll_cur], 0
        jne     .extend
        mov     [ll_cur], ax         ; first word on the line
        mov     [ls_p], si
        jmp     .adv
.extend:
        mov     ax, [we_p]           ; cand = we - line start
        sub     ax, [ls_p]
        cmp     ax, MAXW
        ja      .flush
        mov     [ll_cur], ax
        jmp     .adv
.flush:
        call    flush_line
        mov     ax, [ws_p]           ; new line begins at this word
        mov     [ls_p], ax
        mov     ax, [wl_cur]
        mov     [ll_cur], ax
.adv:
        mov     ax, [we_p]
        mov     [ws_p], ax
        mov     si, ax
        cmp     byte [si], ' '
        jne     .word
        inc     word [ws_p]
        jmp     .word
.last:
        cmp     word [ll_cur], 0
        je      .done
        call    flush_line
.done:
        ret

flush_line:                          ; draw [ls_p] (len [ll_cur]) centred at [cur_row]
        cmp     byte [nlines], 3
        jae     .sk
        mov     ax, [lbl_cc]
        mov     bx, [ll_cur]
        shr     bx, 1
        sub     ax, bx
        mov     dl, al
        mov     al, [cur_row]
        mov     dh, al
        mov     cx, [ll_cur]
        mov     si, [ls_p]
        call    g_putn
        inc     byte [cur_row]
.sk:    inc     byte [nlines]
        ret


; ============================================================================
;  activate_sel : act on the currently selected row
; ============================================================================
activate_sel:
        mov     bx, [sel]
        call    row_ptr           ; ES:BX invalid; use DS. returns SI=record
        mov     al, [si+6]        ; type
        cmp     al, R_INFO
        je      run_revision
        cmp     al, R_ACT
        je      .action
        cmp     al, R_CALL
        je      .call
        cmp     al, R_UITEM
        je      .uitem
        ; R_ITEM : open the option picker
        jmp     pick_option
.uitem:
        ; charging item: exec C:\ULTRACHG.COM <option> instead of PS2.EXE
        mov     word [exec_prog], ultra_prog
        mov     word [show_pfx], pfx_ultra
        mov     byte [ultra_mode], 1
        jmp     pick_option
.action:
        ; build "PS2 <cmd>" and confirm
        mov     si, [si+2]        ; cmd ptr
        call    build_cmd_noopt
        call    confirm_run
        ret
.call:
        ; internal routine: cmd field = its offset
        mov     ax, [si+2]
        call    ax
        ret

; ============================================================================
;  pick_option : popup list of options for the selected item, run PS2 <cmd> opt
; ============================================================================
pick_option:
        mov     bx, [sel]
        call    row_ptr           ; SI=record
        mov     ax, [si+2]
        mov     [cur_cmd], ax     ; save cmd ptr
        mov     ax, [si+4]
        mov     [opt_base], ax    ; options list base
        mov     word [opt_sel], 0

.redraw:
        call    draw_picker
.pk:
        call    getkey
        cmp     al, 0x1B
        je      .cancel
        cmp     al, 0
        jne     .pk_ascii
        cmp     ah, 0x48
        je      .pk_up
        cmp     ah, 0x50
        je      .pk_down
        jmp     .pk
.pk_ascii:
        cmp     al, 0x0D
        je      .choose
        jmp     .pk
.pk_up:
        cmp     word [opt_sel], 0
        je      .pk
        dec     word [opt_sel]
        jmp     .redraw
.pk_down:
        mov     ax, [opt_sel]
        inc     ax
        push    ax
        call    opt_count         ; -> CX
        pop     ax
        cmp     ax, cx
        jae     .pk
        mov     [opt_sel], ax
        jmp     .redraw
.cancel:
        jmp     .reset
.choose:
        ; SI -> chosen option string
        call    opt_ptr           ; -> SI = chosen option text
        mov     [cur_opt], si
        cmp     byte [ultra_mode], 0
        jne     .uchoose
        mov     si, [cur_cmd]
        call    build_cmd_opt     ; builds "PS2 <cmd> <opt>"
        jmp     .runit
.uchoose:
        call    build_cmd_ultraopt ; builds "ULTRACHG <opt>"
.runit:
        call    confirm_run
.reset:
        ; restore the default exec target / display prefix
        mov     word [exec_prog], progname
        mov     word [show_pfx], pfx_ps2
        mov     byte [ultra_mode], 0
        ret

; ============================================================================
;  confirm_run : show the command, ask Y/N, run it, pause
; ============================================================================
confirm_run:
        call    draw_confirm
.c:
        call    getkey
        cmp     al, 'y'
        je      .yes
        cmp     al, 'Y'
        je      .yes
        cmp     al, 'n'
        je      .no
        cmp     al, 'N'
        je      .no
        cmp     al, 0x1B
        je      .no
        jmp     .c
.no:
        ret
.yes:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        ; announce
        mov     dx, 0x0000
        call    gotoxy
        mov     si, msg_running
        call    puts_tty
        mov     si, cmdshow
        call    puts_tty
        mov     si, crlf
        call    puts_tty
        mov     si, crlf
        call    puts_tty
        call    do_exec
        mov     si, crlf
        call    puts_tty
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

; ============================================================================
;  run_revision : run PS2 _@REVision full-screen, pause
; ============================================================================
run_revision:
        mov     si, cmd_rev
        call    build_cmd_raw
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        call    do_exec
        mov     si, crlf
        call    puts_tty
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

; ============================================================================
;  show_power : NATIVE live battery / AC status via the APM BIOS (INT 15h).
;  This is code ingested from PS2.EXE: it uses APM 5300 (install check) and
;  530A (get power status) directly, with no call to PS2.EXE.  Read-only.
; ============================================================================
show_power:
        ; APM installation check
        mov     ax, 0x5300
        xor     bx, bx
        int     0x15
        mov     byte [pw_ok], 1
        jnc     .have
        mov     byte [pw_ok], 0
        jmp     .status
.have:
        mov     [pw_ver], ax      ; AH=major AL=minor (APM spec version)
        mov     [pw_flags], cx
.status:
        ; APM get power status (device 1 = all batteries)
        mov     byte [pw_stat], 0
        mov     ax, 0x530A
        mov     bx, 1
        int     0x15
        jc      .draw
        mov     byte [pw_stat], 1
        mov     [pw_ac], bh
        mov     [pw_bat], bl
        mov     [pw_pct], cl
        mov     [pw_time], dx
.draw:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, pw_hdr
        call    puts_tty
        ; APM present?
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        mov     si, pw_l_apm
        call    puts_tty
        cmp     byte [pw_ok], 0
        je      .noapm
        mov     si, pw_yes
        call    puts_tty
        ; version A.B
        mov     si, pw_l_ver
        call    puts_tty
        mov     al, [pw_ver+1]    ; major
        call    print_dec_al
        mov     al, '.'
        call    putc_tty
        mov     al, [pw_ver]      ; minor
        call    print_dec_al
        mov     al, ')'
        call    putc_tty
        jmp     .powerlines
.noapm:
        mov     si, pw_no
        call    puts_tty
        jmp     .wait
.powerlines:
        cmp     byte [pw_stat], 0
        je      .nostat
        ; AC line
        mov     dh, 5
        mov     dl, 2
        call    gotoxy
        mov     si, pw_l_ac
        call    puts_tty
        mov     al, [pw_ac]
        mov     si, pw_ac_off
        cmp     al, 0
        je      .pac
        mov     si, pw_ac_on
        cmp     al, 1
        je      .pac
        mov     si, pw_ac_bak
        cmp     al, 2
        je      .pac
        mov     si, pw_unk
.pac:   call    puts_tty
        ; Battery status
        mov     dh, 6
        mov     dl, 2
        call    gotoxy
        mov     si, pw_l_bat
        call    puts_tty
        mov     al, [pw_bat]
        mov     si, pw_b_high
        cmp     al, 0
        je      .pbat
        mov     si, pw_b_low
        cmp     al, 1
        je      .pbat
        mov     si, pw_b_crit
        cmp     al, 2
        je      .pbat
        mov     si, pw_b_chg
        cmp     al, 3
        je      .pbat
        mov     si, pw_unk
.pbat:  call    puts_tty
        ; Charge %
        mov     dh, 7
        mov     dl, 2
        call    gotoxy
        mov     si, pw_l_pct
        call    puts_tty
        mov     al, [pw_pct]
        cmp     al, 0xFF
        je      .pctunk
        call    print_dec_al
        mov     al, '%'
        call    putc_tty
        jmp     .wait
.pctunk:
        mov     si, pw_unk
        call    puts_tty
        jmp     .wait
.nostat:
        mov     dh, 5
        mov     dl, 2
        call    gotoxy
        mov     si, pw_nostat
        call    puts_tty
.wait:
        mov     dh, 10
        mov     dl, 2
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

; ============================================================================
;  show_config : NATIVE current-settings read, straight from CMOS (ports 70/71).
;  PS2 stores these in extended CMOS; reading is safe & needs no checksum.
;  Verified mappings: CLICK=0x44 bit0x10, _@STATUS=0x70, PMODE/VEXP=0x72.
; ============================================================================
show_config:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, cf_hdr
        call    puts_tty
        ; --- Keyboard click : CMOS 0x44 bit 0x10 ---
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        mov     si, cf_click
        call    puts_tty
        mov     al, 0x44
        call    read_cmos
        test    al, 0x10
        mov     si, cf_on
        jnz     .c1
        mov     si, cf_off
.c1:    call    puts_tty
        ; --- LCD status panel : CMOS 0x70 (0=Auto 4=Time else Battery) ---
        mov     dh, 4
        mov     dl, 2
        call    gotoxy
        mov     si, cf_stat
        call    puts_tty
        mov     al, 0x70
        call    read_cmos
        and     al, 0x0F
        mov     si, cf_auto
        cmp     al, 0
        je      .c2
        mov     si, cf_time
        cmp     al, 4
        je      .c2
        mov     si, cf_batt
.c2:    call    puts_tty
        ; --- Power-saving mode : CMOS 0x72 bit 0x20 (set=High) ---
        mov     dh, 5
        mov     dl, 2
        call    gotoxy
        mov     si, cf_pmode
        call    puts_tty
        mov     al, 0x72
        call    read_cmos
        test    al, 0x20
        mov     si, cf_high
        jnz     .c3
        mov     si, cf_lowmed
.c3:    call    puts_tty
        ; --- Vertical expand : CMOS 0x72 bit 0x04 ---
        mov     dh, 6
        mov     dl, 2
        call    gotoxy
        mov     si, cf_vexp
        call    puts_tty
        mov     al, 0x72
        call    read_cmos
        test    al, 0x04
        mov     si, cf_on
        jnz     .c4
        mov     si, cf_off
.c4:    call    puts_tty
        ; footer note
        mov     dh, 9
        mov     dl, 2
        call    gotoxy
        mov     si, cf_note
        call    puts_tty
        mov     dh, 11
        mov     dl, 2
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

; read_cmos : AL = index (0..0x7F) -> AL = value.  Restores index to 0x0D.
read_cmos:
        push    cx
        cli
        out     0x70, al
        in      al, 0x71
        mov     cl, al
        mov     al, 0x0D
        out     0x70, al
        sti
        mov     al, cl
        pop     cx
        ret

; ============================================================================
;  BACKUP / RESTORE all settings via the CMOS config region (0x10-0x7F).
;  PS2/BIOS settings persist in CMOS, so a byte image of 0x10-0x7F captures
;  them all (incl. both CMOS checksums), self-consistently.  Restore writes it
;  back; the settings take effect on the next boot.
; ============================================================================
backup_settings:
        ; read CMOS 0x10..0x7F into the scratch buffer
        mov     di, MEMBUF
        mov     cl, 0x10
.rd:    mov     al, cl
        call    read_cmos
        mov     [di], al
        inc     di
        inc     cl
        cmp     cl, 0x80
        jb      .rd
        mov     si, msg_backup
        call    dump_header
        mov     dx, fn_set
        call    open_out
        jc      .err
        mov     bx, [fhandle]
        mov     dx, MEMBUF
        mov     cx, 0x70                ; 112 bytes (0x10..0x7F)
        mov     ah, 0x40
        int     0x21
        call    close_out
        mov     si, msg_bdone
        jmp     dump_finish
.err:   mov     si, msg_derr
        jmp     dump_finish

restore_settings:
        mov     si, msg_restore
        call    dump_header
        ; read the backup file into the scratch buffer
        mov     dx, fn_set
        mov     ax, 0x3D00              ; open for read
        int     0x21
        jc      .err
        mov     [fhandle], ax
        mov     bx, ax
        mov     dx, MEMBUF
        mov     cx, 0x70
        mov     ah, 0x3F
        int     0x21                    ; AX = bytes read
        push    ax
        call    close_out
        pop     ax
        cmp     ax, 0x70
        jne     .err                    ; not a valid full backup
        ; confirm before overwriting CMOS
        mov     dh, 3
        mov     dl, 0
        call    gotoxy
        mov     si, msg_rconf
        call    puts_tty
        call    getkey
        push    ax
        call    cls_body_full           ; clear the confirm prompt before the result
        mov     dx, 0x0000
        call    gotoxy
        mov     si, msg_restore
        call    puts_tty
        pop     ax
        cmp     al, 'y'
        je      .go
        cmp     al, 'Y'
        je      .go
        mov     si, msg_rcancel
        jmp     dump_finish
.go:
        mov     si, MEMBUF
        mov     cl, 0x10
.wr:    cli
        mov     al, cl
        out     0x70, al
        lodsb
        out     0x71, al
        sti
        inc     cl
        cmp     cl, 0x80
        jb      .wr
        mov     al, 0x0D
        out     0x70, al
        mov     si, msg_rdone
        jmp     dump_finish
.err:   mov     si, msg_derr
        jmp     dump_finish

; print_dec_al : print AL (0..255) as decimal via BIOS teletype, no leading zeros
print_dec_al:
        push    ax
        push    bx
        push    cx
        push    dx
        xor     ah, ah
        mov     bl, 100
        div     bl                ; AL=hundreds AH=rem
        mov     ch, al
        mov     al, ah
        xor     ah, ah
        mov     bl, 10
        div     bl                ; AL=tens AH=units
        mov     cl, al
        mov     dh, ah
        mov     byte [pd_go], 0
        mov     al, ch
        call    .dig
        mov     al, cl
        call    .dig
        mov     al, dh
        add     al, '0'
        call    putc_tty
        pop     dx
        pop     cx
        pop     bx
        pop     ax
        ret
.dig:   test    al, al
        jnz     .pr
        cmp     byte [pd_go], 0
        je      .skip
.pr:    mov     byte [pd_go], 1
        add     al, '0'
        call    putc_tty
.skip:  ret

; putc_tty : print AL via BIOS teletype
putc_tty:
        push    ax
        push    bx
        mov     ah, 0x0E
        mov     bx, [tty_col]
        int     0x10
        pop     bx
        pop     ax
        ret

; print_dec_ax : print AX (0..65535) decimal
print_dec_ax:
        push    ax
        push    bx
        push    cx
        push    dx
        mov     bx, 10
        xor     cx, cx
.d1:    xor     dx, dx
        div     bx
        push    dx
        inc     cx
        test    ax, ax
        jnz     .d1
.d2:    pop     dx
        mov     al, dl
        add     al, '0'
        call    putc_tty
        loop    .d2
        pop     dx
        pop     cx
        pop     bx
        pop     ax
        ret

; print_hex_al : print AL as two hex digits
print_hex_al:
        push    ax
        push    cx
        mov     ah, al
        mov     cl, 4
        shr     al, cl
        call    .nib
        mov     al, ah
        call    .nib
        pop     cx
        pop     ax
        ret
.nib:   and     al, 0x0F
        cmp     al, 10
        jb      .dig
        add     al, 'A'-10
        jmp     .pc
.dig:   add     al, '0'
.pc:    call    putc_tty
        ret

; ============================================================================
;  DUMPS : write ROM / BIOS / font images to files on the boot drive (DOS I/O).
; ============================================================================
open_out:                          ; DS:DX -> ASCIIZ name ; -> [fhandle], CF=err
        push    cx
        mov     ah, 0x3C
        xor     cx, cx
        int     0x21
        mov     [fhandle], ax
        pop     cx
        ret
close_out:
        mov     bx, [fhandle]
        mov     ah, 0x3E
        int     0x21
        ret
write_seg:                         ; BX=srcseg, CX=count -> file [fhandle]
        push    ds
        mov     ds, bx
        xor     dx, dx
        mov     bx, [cs:fhandle]
        mov     ah, 0x40
        int     0x21
        pop     ds
        ret
dump_region:                       ; [dseg]=start seg, [dchunks]=# of 4 KB chunks
.l:     cmp     word [dchunks], 0
        je      .done
        mov     bx, [dseg]
        mov     cx, 0x1000
        call    write_seg
        add     word [dseg], 0x100
        dec     word [dchunks]
        jmp     .l
.done:  ret

dump_header:                       ; SI = title
        push    si
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        pop     si
        call    puts_tty
        ret
dump_finish:                       ; SI = result msg
        push    si
        mov     dh, 3
        mov     dl, 0
        call    gotoxy
        pop     si
        call    puts_tty
        mov     dh, 5
        mov     dl, 0
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

dump_bios:
        mov     si, msg_dbios
        call    dump_header
        mov     dx, fn_bios
        call    open_out
        jc      .err
        mov     word [dseg], 0xF000
        mov     word [dchunks], 16      ; 64 KB
        call    dump_region
        call    close_out
        mov     si, msg_ddone
        jmp     dump_finish
.err:   mov     si, msg_derr
        jmp     dump_finish

dump_vbios:
        mov     si, msg_dvbios
        call    dump_header
        mov     dx, fn_vbios
        call    open_out
        jc      .err
        mov     word [dseg], 0xC000
        mov     word [dchunks], 8       ; 32 KB
        call    dump_region
        call    close_out
        mov     si, msg_ddone
        jmp     dump_finish
.err:   mov     si, msg_derr
        jmp     dump_finish

dump_font:
        mov     si, msg_dfont
        call    dump_header
        mov     dx, fn_font
        call    open_out
        jc      .err
        push    bp
        xor     bp, bp                  ; bank 0..127
.bl:    mov     ax, bp
        mov     dx, 0x1160
        out     dx, al                  ; bank select
        mov     al, 0xDE
        mov     dx, 0x1162
        out     dx, al                  ; window segment high
        mov     al, 0x01
        mov     dx, 0x1163
        out     dx, al                  ; enable window
        mov     bx, 0xDE00
        mov     cx, 0x2000              ; 8 KB window
        call    write_seg
        inc     bp
        cmp     bp, 128
        jb      .bl
        xor     al, al
        mov     dx, 0x1160
        out     dx, al                  ; restore bank 0
        pop     bp
        call    close_out
        mov     si, msg_ddone
        jmp     dump_finish
.err:   mov     si, msg_derr
        jmp     dump_finish

; dump_cmos : write the 128-byte CMOS/RTC RAM (index 0x00..0x7F) to a file.
dump_cmos:
        mov     si, msg_dcmos
        call    dump_header
        mov     di, MEMBUF               ; read CMOS 0x00..0x7F into scratch
        xor     cl, cl
.rd:    mov     al, cl
        call    read_cmos
        mov     [di], al
        inc     di
        inc     cl
        cmp     cl, 0x80
        jb      .rd
        mov     dx, fn_cmos
        call    open_out
        jc      .err
        mov     bx, [fhandle]
        mov     dx, MEMBUF
        mov     cx, 0x80                 ; 128 bytes
        mov     ah, 0x40
        int     0x21
        call    close_out
        mov     si, msg_ddone
        jmp     dump_finish
.err:   mov     si, msg_derr
        jmp     dump_finish

; ============================================================================
;  SYSTEM TEST : memory / video / keyboard / speaker  (Easy-Setup style)
; ============================================================================
MEMBUF  equ scratch_area           ; scratch just past the program (see end of file);
                                   ; 0x8000 was inside the 48 KB image and got clobbered.

test_mem:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, msg_tmem
        call    puts_tty
        mov     dh, 2
        mov     dl, 2
        call    gotoxy
        mov     si, tm_base
        call    puts_tty
        int     0x12                    ; AX = conventional KB
        call    print_dec_ax
        mov     si, tm_kb
        call    puts_tty
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        mov     si, tm_ext
        call    puts_tty
        mov     al, 0x30                ; CMOS 0x30/0x31 = extended KB above 1 MB
        call    read_cmos               ; (INT 15h/88 is masked by HIMEM; CMOS is physical)
        mov     bl, al
        mov     al, 0x31
        call    read_cmos
        mov     ah, al
        mov     al, bl
        call    print_dec_ax
        mov     si, tm_kb
        call    puts_tty
        mov     dh, 5
        mov     dl, 2
        call    gotoxy
        mov     si, tm_run
        call    puts_tty
        call    memtest_buf             ; AL=0 pass / 1 fail
        mov     si, tm_pass
        test    al, al
        jz      .r
        mov     si, tm_fail
.r:     call    puts_tty
        mov     dh, 8
        mov     dl, 2
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret
memtest_buf:                            ; -> AL=0 pass / 1 fail
        push    si
        push    di
        push    cx
        mov     si, patterns
.pl:    lodsb
        cmp     al, 0xFE
        je      .pass
        mov     ah, al
        mov     di, MEMBUF
        mov     cx, 0x1000
.f:     mov     [di], ah
        inc     di
        loop    .f
        mov     di, MEMBUF
        mov     cx, 0x1000
.v:     mov     al, [di]
        cmp     al, ah
        jne     .fail
        inc     di
        loop    .v
        jmp     .pl
.pass:  xor     al, al
        jmp     .done
.fail:  mov     al, 1
.done:  pop     cx
        pop     di
        pop     si
        ret

test_vid:
        mov     ax, 0x0003        ; this test shows text attributes + the CP437 set,
        int     0x10              ; so it needs a real text mode (not the graphical page)
        mov     byte [body_gfx], 0
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, tv_title
        call    puts_tty
        push    es
        mov     ax, 0xB800
        mov     es, ax
        mov     di, (3*80+2)*2          ; 16 foreground colours
        xor     bx, bx
.fg:    mov     al, 0xDB
        mov     ah, bl
        mov     [es:di], al
        mov     [es:di+1], ah
        mov     [es:di+2], al
        mov     [es:di+3], ah
        add     di, 4
        inc     bx
        cmp     bx, 16
        jb      .fg
        mov     di, (5*80+2)*2          ; 8 background colours
        xor     bx, bx
.bg:    mov     al, ' '
        mov     ah, bl
        mov     cl, 4
        shl     ah, cl
        or      ah, 0x0F
        mov     [es:di], al
        mov     [es:di+1], ah
        mov     [es:di+2], al
        mov     [es:di+3], ah
        mov     [es:di+4], al
        mov     [es:di+5], ah
        add     di, 6
        inc     bx
        cmp     bx, 8
        jb      .bg
        mov     di, (7*80+2)*2          ; full 256-char set
        xor     bl, bl
        mov     cx, 256
.cs:    mov     al, bl
        mov     ah, 0x0F
        mov     [es:di], al
        mov     [es:di+1], ah
        add     di, 2
        inc     bl
        loop    .cs
        pop     es
        mov     dh, 14
        mov     dl, 2
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

; test_kbd : recreated PC110 keyboard; highlights each key as it is pressed.
;   Hooks INT 9 to read raw scancodes (make/break, incl. 0xE0 extended).  Press
;   and release ESC to exit.  (Runs on the graphical page set up by the wrapper.)
test_kbd:
        call    cls_body_full         ; mauve page
        mov     dx, 0x0000
        call    gotoxy
        mov     si, kb_title
        call    puts_tty
        mov     cx, KBD_N             ; clear per-key pressed state
        mov     bx, kbd_state
.z:     mov     byte [bx], 0
        inc     bx
        loop    .z
        mov     byte [kb_ext], 0
        mov     byte [kb_exit], 0
        mov     byte [kbd_wr], 0
        mov     byte [kbd_rd], 0
        call    kbd_draw_all
        ; --- hook INT 9 (keyboard IRQ1) ---
        push    es
        xor     ax, ax
        mov     es, ax
        cli
        mov     ax, [es:9*4]
        mov     [kb_oldo], ax
        mov     ax, [es:9*4+2]
        mov     [kb_olds], ax
        mov     word [es:9*4], kbd_isr
        mov     [es:9*4+2], cs
        sti
        pop     es
.loop:
.dr:    mov     al, [kbd_rd]
        cmp     al, [kbd_wr]
        je      .noev
        mov     bl, al
        xor     bh, bh
        mov     al, [kbd_ring+bx]
        inc     byte [kbd_rd]
        call    kbd_feed
        jmp     .dr
.noev:  cmp     byte [kb_rawdirty], 0    ; update the raw-scancode readout
        je      .chkx
        mov     byte [kb_rawdirty], 0
        call    kbd_showraw
.chkx:  cmp     byte [kb_exit], 0
        je      .loop
        ; --- restore INT 9 ---
        push    es
        xor     ax, ax
        mov     es, ax
        cli
        mov     ax, [kb_oldo]
        mov     [es:9*4], ax
        mov     ax, [kb_olds]
        mov     [es:9*4+2], ax
        sti
        pop     es
        ret

; kbd_isr : IRQ1 -> queue the raw scancode, EOI.  Decoding happens in the loop.
kbd_isr:
        push    ax
        push    bx
        push    ds
        mov     ax, cs
        mov     ds, ax
        in      al, 0x60
        mov     bl, [kbd_wr]
        xor     bh, bh
        mov     [kbd_ring+bx], al
        inc     byte [kbd_wr]
        mov     al, 0x20
        out     0x20, al
        pop     ds
        pop     bx
        pop     ax
        iret

; kbd_feed : AL = one raw scancode byte.
kbd_feed:
        mov     ah, [kb_raw1]        ; log the last 3 raw bytes (for the readout)
        mov     [kb_raw0], ah
        mov     ah, [kb_raw2]
        mov     [kb_raw1], ah
        mov     [kb_raw2], al
        mov     byte [kb_rawdirty], 1
        mov     ah, al               ; plain ScrollLock (0x46) -> NumLock key (0x45),
        and     ah, 0x7F             ;   but NOT extended E0 46 (that is Break)
        cmp     ah, 0x46
        jne     .noal
        cmp     byte [kb_ext], 0
        jne     .noal
        and     al, 0x80             ; keep the break bit
        or      al, 0x45
.noal:  cmp     byte [kb_e1], 0      ; swallow the rest of a Pause (E1) sequence
        je      .noe1
        dec     byte [kb_e1]
        ret
.noe1:  cmp     al, 0xE0             ; extended prefix
        jne     .n1
        mov     byte [kb_ext], 1
        ret
.n1:    cmp     al, 0xE1             ; Pause (E1 ...): also lights the Brk key, then
        jne     .n2                  ;   skips the 2 bytes that follow each E1
        mov     byte [kb_e1], 2
        mov     byte [kb_ext], 0
        mov     ah, 0x46             ; Brk = sc 0x46 ext 1 (shared with E0 46 Break form)
        mov     bl, 1                ; latch ON
        mov     bh, 1
        jmp     .dolatch
.n2:    mov     ah, al               ; ah = code (bit7 = break)
        and     ah, 0x7F
        mov     bl, 1                ; bl = pressed?
        test    al, 0x80
        jz      .p
        xor     bl, bl
.p:     mov     bh, [kb_ext]         ; bh = ext flag for this code
        mov     byte [kb_ext], 0
.dolatch:
        push    bx                   ; save pressed/ext
        xor     si, si               ; find key: sc==ah && ext==bh
        mov     di, kbd_keys
.f:     cmp     si, KBD_N
        jae     .nf
        mov     al, [di+4]           ; scancode
        cmp     al, ah
        jne     .nx
        mov     al, [di+5]           ; ext
        cmp     al, bh
        je      .found
.nx:    add     di, 8
        inc     si
        jmp     .f
.found: pop     bx                   ; bl=pressed bh=ext
        or      bl, bl
        jz      .brk                 ; release
        mov     byte [kbd_state+si], 1   ; press -> latch ON (stays lit once tested)
        call    kbd_drawkey
        ret
.brk:   cmp     ah, 0x01             ; release: leave it lit; only ESC-release exits
        jne     .done
        mov     byte [kb_exit], 1
.done:  ret
.nf:    pop     bx
        ret

; kbd_draw_all : draw every key in its current state.
kbd_draw_all:
        xor     si, si
.l:     cmp     si, KBD_N
        jae     .d
        call    kbd_drawkey
        inc     si
        jmp     .l
.d:     ret

; kbd_drawkey : SI = key index.  Fills the key (navy, or red if pressed) and
;   draws its white label centred.
kbd_drawkey:
        pusha
        mov     ax, si
        shl     ax, 3                ; idx*8 (record size)
        mov     di, kbd_keys
        add     di, ax
        mov     al, [di+1]           ; fr_x = KB_X + col*KB_U
        xor     ah, ah
        mov     bx, KB_U
        mul     bx
        add     ax, KB_X
        mov     [fr_x], ax
        mov     al, [di]             ; fr_y = KB_Y + row*KB_ROWH
        xor     ah, ah
        mov     bx, KB_ROWH
        mul     bx
        add     ax, KB_Y
        mov     [fr_y], ax
        mov     al, [di+2]           ; fr_w = w*KB_U - KB_GAP
        xor     ah, ah
        mov     bx, KB_U
        mul     bx
        sub     ax, KB_GAP
        mov     [fr_w], ax
        mov     al, [di+3]           ; fr_h = h*KB_ROWH - 8
        xor     ah, ah
        mov     bx, KB_ROWH
        mul     bx
        sub     ax, 8
        mov     [fr_h], ax
        mov     ax, [di+6]           ; label pointer
        mov     [kb_lbl], ax
        mov     bl, [kbd_state+si]
        mov     byte [fr_col], C_NAVY
        or      bl, bl
        jz      .fill
        mov     byte [fr_col], C_RED
.fill:  call    g_fillrect
        mov     si, [kb_lbl]         ; centre the label
        call    gt_strlen            ; cx = len
        mov     ax, cx
        shl     ax, 3
        mov     bx, [fr_w]
        sub     bx, ax
        sar     bx, 1
        add     bx, [fr_x]
        mov     [gt_x], bx
        mov     ax, [fr_h]
        sub     ax, 16
        sar     ax, 1
        add     ax, [fr_y]
        mov     [gt_y], ax
        mov     byte [g_col], C_WHITE
        mov     si, [kb_lbl]
        call    gtext
        popa
        ret

; kbd_showraw : show the last 3 raw scancode bytes, to identify unknown keys.
kbd_showraw:
        mov     dh, 27
        mov     dl, 2
        call    gotoxy
        mov     si, kb_rawlbl
        call    puts_tty
        mov     al, [kb_raw0]
        call    print_hex_al
        mov     al, ' '
        call    putc_tty
        mov     al, [kb_raw1]
        call    print_hex_al
        mov     al, ' '
        call    putc_tty
        mov     al, [kb_raw2]
        call    print_hex_al
        ret

test_spk:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, ts_title
        call    puts_tty
        mov     al, 0xB6
        out     0x43, al                ; PIT ch2, mode 3
        mov     al, 0xA9
        out     0x42, al                ; divisor 0x04A9 (~1 kHz)
        mov     al, 0x04
        out     0x42, al
        in      al, 0x61
        or      al, 0x03
        out     0x61, al                ; speaker on
        mov     ax, 8
        call    delay_ticks             ; ~0.44 s
        in      al, 0x61
        and     al, 0xFC
        out     0x61, al                ; speaker off
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret
delay_ticks:                            ; AX = BIOS timer ticks (~18.2/s)
        push    es
        push    bx
        push    cx
        mov     bx, ax
        mov     cx, 0x40
        mov     es, cx
        mov     ax, [es:0x6C]
.w:     mov     cx, [es:0x6C]
        sub     cx, ax
        cmp     cx, bx
        jb      .w
        pop     cx
        pop     bx
        pop     es
        ret

; ============================================================================
;  diag_scan : live hardware diagnostics — probe every PC110 subsystem read-only
;  (index-select writes only; all values read back).  Reuses the RE from the
;  Discovery/Live-Dump chapter.
; ============================================================================
; has_cpuid : ZF=1 (jz) if CPUID is NOT supported
has_cpuid:
        pushfd
        pop     eax
        mov     ecx, eax
        xor     eax, 0x200000
        push    eax
        popfd
        pushfd
        pop     eax
        push    ecx
        popfd
        xor     eax, ecx
        and     eax, 0x200000
        ret
; pr_ff : AL -> print "present" (AL!=0xFF) or "absent" (AL==0xFF)
pr_ff:
        push    si
        cmp     al, 0xFF
        je      .a
        mov     si, dg_present
        jmp     .p
.a:     mov     si, dg_absent
.p:     call    puts_tty
        pop     si
        ret

diag_scan:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, dg_hdr
        call    puts_tty
        ; ---- CPU via CPUID ----
        mov     dh, 2
        mov     dl, 2
        call    gotoxy
        mov     si, dg_cpu
        call    puts_tty
        call    has_cpuid
        jz      .nocpu
        xor     eax, eax
        cpuid
        mov     [cpu_v], ebx
        mov     [cpu_v+4], edx
        mov     [cpu_v+8], ecx
        mov     byte [cpu_v+12], 0
        mov     eax, 1
        cpuid
        mov     [cpu_feat], dx
        mov     [cpu_sig], ax
        mov     si, cpu_v
        call    puts_tty
        mov     si, dg_fam
        call    puts_tty
        mov     ax, [cpu_sig]
        mov     cl, 8
        shr     ax, cl
        and     al, 0x0F
        call    print_dec_al
        mov     si, dg_mdl
        call    puts_tty
        mov     ax, [cpu_sig]
        mov     cl, 4
        shr     ax, cl
        and     al, 0x0F
        call    print_dec_al
        mov     si, dg_stp
        call    puts_tty
        mov     al, [cpu_sig]
        and     al, 0x0F
        call    print_dec_al
        mov     si, dg_fpu
        call    puts_tty
        mov     al, [cpu_feat]
        test    al, 1
        mov     si, dg_no
        jz      .fpup
        mov     si, dg_yes
.fpup:  call    puts_tty
        jmp     .mem
.nocpu:
        mov     si, dg_486
        call    puts_tty
.mem:
        ; ---- Memory ----
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        mov     si, dg_mem
        call    puts_tty
        int     0x12
        call    print_dec_ax
        mov     si, dg_kb
        call    puts_tty
        mov     si, dg_ext
        call    puts_tty
        mov     al, 0x30
        call    read_cmos
        mov     bl, al
        mov     al, 0x31
        call    read_cmos
        mov     ah, al
        mov     al, bl
        call    print_dec_ax
        mov     si, dg_kb
        call    puts_tty
        ; ---- APM ----
        mov     dh, 4
        mov     dl, 2
        call    gotoxy
        mov     si, dg_apm
        call    puts_tty
        mov     ax, 0x5300
        xor     bx, bx
        int     0x15
        jc      .apmno
        mov     ax, 0x530A
        mov     bx, 1
        int     0x15
        jc      .apmp
        mov     [pw_ac], bh
        mov     [pw_pct], cl
        mov     si, dg_present
        call    puts_tty
        mov     si, dg_bat
        call    puts_tty
        mov     al, [pw_pct]
        cmp     al, 0xFF
        je      .scamp
        call    print_dec_al
        mov     al, '%'
        call    putc_tty
        jmp     .scamp
.apmp:  mov     si, dg_present
        call    puts_tty
        jmp     .scamp
.apmno: mov     si, dg_absent
        call    puts_tty
.scamp:
        ; ---- SCAMP VL82C420 (read index port 0x74) ----
        mov     dh, 5
        mov     dl, 2
        call    gotoxy
        mov     si, dg_scamp
        call    puts_tty
        mov     dx, 0x74
        in      al, dx
        call    pr_ff
        ; ---- Power MCU (0xEC index / 0xED data, reg 0) ----
        mov     dh, 6
        mov     dl, 2
        call    gotoxy
        mov     si, dg_pmcu
        call    puts_tty
        mov     dx, 0x00EC
        xor     al, al
        out     dx, al
        mov     dx, 0x00ED
        in      al, dx
        call    pr_ff
        ; ---- PCMCIA PCIC (0x3E0 index / 0x3E1 data) ----
        mov     dh, 7
        mov     dl, 2
        call    gotoxy
        mov     si, dg_pcic
        call    puts_tty
        mov     dx, 0x3E0
        xor     al, al
        out     dx, al
        mov     dx, 0x3E1
        in      al, dx                  ; chip ID
        mov     [tmp_base], ax          ; stash ID
        call    pr_ff
        mov     al, [tmp_base]
        cmp     al, 0xFF
        je      .font
        mov     si, dg_id
        call    puts_tty
        mov     al, [tmp_base]
        call    print_hex_al            ; PCIC chip ID (0x83 on PC110)
.font:
        ; ---- Font ROM window @0xDE000, bank 0 ----
        mov     dh, 8
        mov     dl, 2
        call    gotoxy
        mov     si, dg_font
        call    puts_tty
        mov     dx, 0x1160
        xor     al, al
        out     dx, al
        mov     dx, 0x1162
        mov     al, 0xDE
        out     dx, al
        mov     dx, 0x1163
        mov     al, 1
        out     dx, al
        push    es
        mov     ax, 0xDE00
        mov     es, ax
        mov     ax, [es:0]
        pop     es
        cmp     ax, 0xAA55
        mov     si, dg_sigok
        je      .fontp
        mov     si, dg_signo
.fontp: call    puts_tty
        ; ---- COM1 UART (IIR 0x3FA) ----
        mov     dh, 9
        mov     dl, 2
        call    gotoxy
        mov     si, dg_com1
        call    puts_tty
        mov     dx, 0x3FA
        in      al, dx
        call    pr_ff
        ; ---- RTC / CMOS status ----
        mov     dh, 10
        mov     dl, 2
        call    gotoxy
        mov     si, dg_rtc
        call    puts_tty
        mov     al, 0x0D
        call    read_cmos
        test    al, 0x80                ; VRT: RTC battery valid
        mov     si, dg_batok
        jnz     .rtcb
        mov     si, dg_batlo
.rtcb:  call    puts_tty
        mov     al, 0x0E
        call    read_cmos               ; POST diagnostic byte (0 = OK)
        test    al, al
        mov     si, dg_posterr
        jnz     .rtcp
        mov     si, dg_postok
.rtcp:  call    puts_tty
        ; footer
        mov     dh, 12
        mov     dl, 2
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

; print_bcd : print AL as two BCD digits
print_bcd:
        push    ax
        push    cx
        mov     ah, al
        mov     cl, 4
        shr     al, cl
        add     al, '0'
        call    putc_tty
        mov     al, ah
        and     al, 0x0F
        add     al, '0'
        call    putc_tty
        pop     cx
        pop     ax
        ret

; ============================================================================
;  test_clock : live RTC date/time (BCD) until a key is pressed
; ============================================================================
test_clock:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, tc_title
        call    puts_tty
        mov     dh, 5
        mov     dl, 2
        call    gotoxy
        mov     si, tc_hint
        call    puts_tty
.loop:
.uip:   mov     al, 0x0A
        call    read_cmos
        test    al, 0x80
        jnz     .uip
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        mov     si, tc_lbl
        call    puts_tty
        mov     al, 0x32
        call    read_cmos
        call    print_bcd
        mov     al, 0x09
        call    read_cmos
        call    print_bcd
        mov     al, '-'
        call    putc_tty
        mov     al, 0x08
        call    read_cmos
        call    print_bcd
        mov     al, '-'
        call    putc_tty
        mov     al, 0x07
        call    read_cmos
        call    print_bcd
        mov     al, ' '
        call    putc_tty
        mov     al, 0x04
        call    read_cmos
        call    print_bcd
        mov     al, ':'
        call    putc_tty
        mov     al, 0x02
        call    read_cmos
        call    print_bcd
        mov     al, ':'
        call    putc_tty
        mov     al, 0x00
        call    read_cmos
        call    print_bcd
        mov     ah, 1
        int     0x16
        jz      .loop
        xor     ah, ah
        int     0x16
        ret

; ============================================================================
;  test_timer : measure the PIT tick counter over ~1 second
; ============================================================================
test_timer:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, tt_title
        call    puts_tty
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        mov     si, tt_meas
        call    puts_tty
        push    es
        mov     ax, 0x40
        mov     es, ax
        mov     bp, [es:0x6C]
        pop     es
        mov     ax, 18
        call    delay_ticks
        push    es
        mov     ax, 0x40
        mov     es, ax
        mov     ax, [es:0x6C]
        pop     es
        sub     ax, bp
        mov     dh, 5
        mov     dl, 2
        call    gotoxy
        mov     si, tt_res
        call    puts_tty
        call    print_dec_ax
        mov     si, tt_exp
        call    puts_tty
        mov     dh, 7
        mov     dl, 2
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

; ============================================================================
;  test_mouse : pointing-device test read DIRECTLY off the 8042 aux channel
;  (the U75 trackpad), so it works with no INT 33h driver.  Polled, because
;  IRQ12 is masked while we are in a text screen.
; ============================================================================
test_mouse:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, ms_title
        call    puts_tty
        mov     dh, 2
        mov     dl, 2
        call    gotoxy
        mov     si, ms_inst2
        call    puts_tty
        cli                          ; bring the aux device up for polled reading
        mov     al, 0xA8             ; enable aux clock (to_text disabled it)
        call    k_cmd
        call    k_flush
        mov     al, 0xF4             ; ensure data reporting on
        call    aux_write
        call    aux_drain
        sti
        mov     word [tm_x], 0
        mov     word [tm_y], 0
        mov     byte [tm_idx], 0
        mov     byte [tm_p0], 0
        call    tm_show
.loop:  in      al, 0x64
        mov     ah, al
        and     ah, 0x21             ; OBF set AND aux-data (bit5)
        cmp     ah, 0x21
        jne     .key
        in      al, 0x60
        call    tm_feed
.key:   mov     ah, 1
        int     0x16
        jz      .loop
        xor     ah, ah
        int     0x16
        ret

tm_feed:                             ; AL = one aux byte -> assemble 3-byte packet
        mov     bl, [tm_idx]
        or      bl, bl
        jnz     .b1
        test    al, 0x08             ; byte-0 sync bit
        jz      .ret
        mov     [tm_p0], al
        mov     byte [tm_idx], 1
        ret
.b1:    cmp     bl, 1
        jne     .b2
        mov     [tm_p1], al
        mov     byte [tm_idx], 2
        ret
.b2:    mov     [tm_p2], al
        mov     byte [tm_idx], 0
        mov     al, [tm_p1]          ; accumulate signed X / Y deltas
        cbw
        add     [tm_x], ax
        mov     al, [tm_p2]
        cbw
        add     [tm_y], ax
        call    tm_show
.ret:   ret

tm_show:
        mov     dh, 5
        mov     dl, 2
        call    gotoxy
        mov     si, ms_xl
        call    puts_tty
        mov     ax, [tm_x]
        call    print_int_ax
        mov     si, ms_yl
        call    puts_tty
        mov     ax, [tm_y]
        call    print_int_ax
        mov     si, ms_bl
        call    puts_tty
        mov     al, [tm_p0]
        and     al, 7
        add     al, '0'
        call    putc_tty
        mov     si, ms_pad
        call    puts_tty
        ret

print_int_ax:                        ; print AX as signed decimal
        test    ax, ax
        jns     .p
        push    ax
        mov     al, '-'
        call    putc_tty
        pop     ax
        neg     ax
.p:     call    print_dec_ax
        ret

; ============================================================================
;  test_sig : signature / inking-pad test.  The PC110 has a resistive digitizer
;  ("inking pad", driven by INKDRV.COM / INT 51h) behind an I/O window at base
;  0x15E0 (also 0x25E0/0x35E0), fed by the M38223 MCU's touch-panel ADC.  We
;  drive it directly and polled: enable (out base+2,0x38), then read 3-byte
;  packets [flags, rawX, rawY] whenever status (base+1) bit7 is set, acking each
;  byte by pulsing base+2 bit0 (exactly what INKDRV's IRQ handler does).  Packet
;  flags: bit0 = pen-down, bit3 = rawY bit8, bit4 = rawX bit8, bit7 = sync.
;  Draw the strokes so you can literally sign; any key exits (control restored).
; ============================================================================
test_sig:
        mov     ax, 0x0012            ; VGA mode 12h (640x480x16) for real drawing
        int     0x10
        call    set_palette           ; PS2GUI 5-colour theme (0=mauve 1=white 3=navy)
        mov     word [tty_col], 0x0004 ; dark (black) text so it shows on the mauve panel
        mov     dx, 0x0000
        call    gotoxy
        mov     si, ss_title
        call    puts_tty
        mov     dh, 2
        mov     dl, 2
        call    gotoxy
        mov     si, ss_inst
        call    puts_tty
        mov     word [fr_x], 32       ; signing box: navy frame + white field
        mov     word [fr_y], 64
        mov     word [fr_w], 576
        mov     word [fr_h], 340
        mov     byte [fr_col], 3
        call    g_fillrect
        mov     word [fr_x], 40
        mov     word [fr_y], 72
        mov     word [fr_w], 560
        mov     word [fr_h], 324
        mov     byte [fr_col], 1
        call    g_fillrect
        ; --- inking I/O base + IRQ vector from the PC110 BIOS (as INKDRV does)
        mov     ch, 0x96
        mov     ax, 0x5380
        mov     bx, 0x8300
        int     0x15
        mov     bl, cl               ; base = basetab[CL & 3]
        and     bx, 3
        shl     bx, 1
        mov     ax, [cs:sig_basetab+bx]
        mov     [sig_base], ax
        mov     bl, cl               ; irq  = irqtab[(CL & 0x70) >> 4]
        and     bx, 0x70
        shr     bx, 1
        shr     bx, 1
        shr     bx, 1
        shr     bx, 1
        mov     al, [cs:sig_irqtab+bx]
        add     al, 8                ; -> interrupt vector
        cmp     al, 0x10
        jb      .vok
        add     al, 0x60             ; slave-PIC IRQs vector at 0x70+
.vok:   mov     [sig_vec], al
        mov     byte [sig_idx], 0
        mov     word [sig_pkts], 0
        mov     word [sig_ctr], 0
        mov     byte [sig_wr], 0
        mov     byte [sig_rd], 0
        call    sig_status
        ; --- install our ISR on the inking IRQ vector
        mov     al, [sig_vec]
        xor     ah, ah
        mov     bx, ax
        shl     bx, 1
        shl     bx, 1                ; bx = vec*4
        push    es
        xor     ax, ax
        mov     es, ax
        cli
        mov     ax, [es:bx]
        mov     [sig_oldveco], ax
        mov     ax, [es:bx+2]
        mov     [sig_oldvecs], ax
        mov     word [es:bx], sig_isr
        mov     [es:bx+2], cs
        pop     es
        ; --- unmask that IRQ in the PIC (remember reg+bit to restore)
        mov     al, [sig_vec]
        cmp     al, 0x70
        jb      .mmaster
        sub     al, 0x70             ; slave bit 0..7
        mov     word [sig_mport], 0x00A1
        jmp     .mhave
.mmaster:
        sub     al, 8                ; master bit 0..7
        mov     word [sig_mport], 0x0021
.mhave: mov     cl, al
        mov     al, 1
        shl     al, cl
        mov     [sig_mbit], al
        mov     dx, [sig_mport]
        in      al, dx
        mov     [sig_omask], al
        mov     bl, [sig_mbit]
        not     bl
        and     al, bl               ; clear bit = unmask
        out     dx, al
        ; --- save control byte, enable reporting, run
        mov     dx, [sig_base]
        add     dx, 2
        in      al, dx
        mov     [sig_octl], al
        mov     al, 0x38
        out     dx, al
        sti
.loop:
.drain: mov     al, [sig_rd]
        cmp     al, [sig_wr]
        je      .idle
        mov     bl, al
        xor     bh, bh
        mov     al, [sig_ring+bx]
        inc     byte [sig_rd]
        call    sig_feed
        jmp     .drain
.idle:  inc     word [sig_ctr]       ; throttle the on-screen readout
        test    word [sig_ctr], 0x0FFF
        jnz     .kchk
        call    sig_status
.kchk:  mov     ah, 1
        int     0x16
        jz      .loop
        xor     ah, ah
        int     0x16
        cmp     al, 'c'              ; C = run the 4-corner calibration
        je      .docal
        cmp     al, 'C'
        je      .docal
        jmp     .exit
.docal: call    sig_calibrate
        jmp     .loop
.exit:
        ; --- cleanup: disable pad, restore PIC mask + IRQ vector
        cli
        mov     dx, [sig_base]
        add     dx, 2
        mov     al, [sig_octl]
        out     dx, al
        mov     dx, [sig_mport]
        mov     al, [sig_omask]
        out     dx, al
        mov     al, [sig_vec]
        xor     ah, ah
        mov     bx, ax
        shl     bx, 1
        shl     bx, 1
        push    es
        xor     ax, ax
        mov     es, ax
        mov     ax, [sig_oldveco]
        mov     [es:bx], ax
        mov     ax, [sig_oldvecs]
        mov     [es:bx+2], ax
        pop     es
        sti
        mov     word [tty_col], 0x0007 ; restore default teletype colour
        ret

; inking IRQ handler: read one byte from base+0, ring it, ack (pulse base+2 bit0),
; EOI.  Assembly/decoding happens in the main loop (sig_feed).
sig_isr:
        push    ax
        push    bx
        push    dx
        push    ds
        mov     ax, cs
        mov     ds, ax
        mov     dx, [sig_base]
        in      al, dx               ; data byte at base+0
        mov     [sig_dd], al
        mov     bl, [sig_wr]
        xor     bh, bh
        mov     [sig_ring+bx], al
        inc     byte [sig_wr]
        mov     dx, [sig_base]
        add     dx, 2                ; ack: pulse base+2 bit0
        in      al, dx
        mov     ah, al
        or      al, 1
        out     dx, al
        mov     al, ah
        and     al, 0xFE
        out     dx, al
        mov     al, 0x20             ; EOI
        cmp     byte [sig_vec], 0x70
        jb      .meoi
        out     0xA0, al
.meoi:  out     0x20, al
        pop     ds
        pop     dx
        pop     bx
        pop     ax
        iret

sig_feed:                             ; AL = one inking-data byte
        mov     bl, [sig_idx]
        or      bl, bl
        jnz     .b1
        test    al, 0x80              ; byte-0 sync bit
        jz      .ret
        mov     [sig_b0], al
        mov     byte [sig_idx], 1
        ret
.b1:    cmp     bl, 1
        jne     .b2
        mov     [sig_b1], al
        mov     byte [sig_idx], 2
        ret
.b2:    mov     [sig_b2], al
        mov     byte [sig_idx], 0
        inc     word [sig_pkts]
        call    sig_plot
.ret:   ret

sig_plot:                             ; decode packet -> plot + readout
        mov     al, [sig_b1]          ; rawX = b1[0..6] | (b0.4 -> bit7)
        and     al, 0x7F
        test    byte [sig_b0], 0x10
        jz      .nx
        or      al, 0x80
.nx:    mov     ah, 0
        mov     [sig_rx], ax
        mov     al, [sig_b2]          ; rawY = b2[0..6] | (b0.3 -> bit7)
        and     al, 0x7F
        test    byte [sig_b0], 0x08
        jz      .ny
        or      al, 0x80
.ny:    mov     ah, 0
        mov     [sig_ry], ax
        cmp     byte [sig_cal], 0     ; calibration capture: decode only, don't draw
        jne     .done
        ; --- map raw -> screen X (calibrated if available, else default) ---
        mov     ax, [sig_rx]
        cmp     byte [cal_valid], 0
        jne     .calx
        shl     ax, 1                 ; default: 40 + rawX*2
        add     ax, 40
        jmp     .hx
.calx:  mov     bx, [cal_xl]
        mov     cx, [cal_xr]
        mov     word [cal_span], 560
        call    cal_map
        add     ax, 40
.hx:    mov     [sig_sx], ax
        ; --- map raw -> screen Y ---
        mov     ax, [sig_ry]
        cmp     byte [cal_valid], 0
        jne     .caly
        add     ax, 72                ; default: 72 + rawY
        jmp     .hy
.caly:  mov     bx, [cal_yt]
        mov     cx, [cal_yb]
        mov     word [cal_span], 324
        call    cal_map
        add     ax, 72
.hy:    mov     [sig_sy], ax
        test    byte [sig_b0], 1      ; pen down?
        jz      .rd
        mov     al, 3                 ; navy ink, 3x3 block
        mov     dx, [sig_sy]
        mov     bp, 3
.yl:    mov     cx, [sig_sx]
        push    bp
        mov     bp, 3
.xl:    call    putpixel
        inc     cx
        dec     bp
        jnz     .xl
        pop     bp
        inc     dx
        dec     bp
        jnz     .yl
.rd:    test    word [sig_pkts], 0x0F ; refresh readout every 16 packets
        jnz     .done
        call    sig_status
.done:  ret

sig_status:
        ; --- line 1: raw register monitor ---
        mov     dh, 27
        mov     dl, 2
        call    gotoxy
        mov     si, ss_base
        call    puts_tty
        mov     ax, [sig_base]        ; base as 4 hex digits
        mov     al, ah
        call    print_hex_al
        mov     ax, [sig_base]
        call    print_hex_al
        mov     si, ss_st
        call    puts_tty
        mov     al, [sig_vec]
        call    print_hex_al
        mov     si, ss_dd
        call    puts_tty
        mov     al, [sig_dd]
        call    print_hex_al
        ; --- line 2: packets + decoded sample ---
        mov     dh, 28
        mov     dl, 2
        call    gotoxy
        mov     si, ss_pk
        call    puts_tty
        mov     ax, [sig_pkts]
        call    print_dec_ax
        mov     si, ss_rx
        call    puts_tty
        mov     ax, [sig_rx]
        call    print_dec_ax
        mov     si, ss_ry
        call    puts_tty
        mov     ax, [sig_ry]
        call    print_dec_ax
        mov     si, ss_pen
        call    puts_tty
        mov     al, [sig_b0]
        and     al, 1
        add     al, '0'
        call    putc_tty
        mov     si, ms_pad
        call    puts_tty
        ret

; ============================================================================
;  sig_calibrate : 4-corner calibration.  Prompts for each pad corner, captures
;    the raw X/Y, and fits a linear raw->screen map (handles a flipped axis).
;    Runs inside test_sig (IRQ + pad already live).  ESC cancels.
; ============================================================================
sig_calibrate:
        mov     byte [sig_cal], 1     ; suppress drawing while capturing
        mov     byte [cal_i], 0       ; corner 0..3 (in memory: g_fillrect trashes BP)
.cloop: call    cal_clearfield
        mov     bl, [cal_i]           ; target square at cal_corners[cal_i]
        xor     bh, bh
        shl     bx, 2
        mov     ax, [cs:cal_corners+bx]
        mov     [fr_x], ax
        mov     ax, [cs:cal_corners+bx+2]
        mov     [fr_y], ax
        mov     word [fr_w], 8
        mov     word [fr_h], 8
        mov     byte [fr_col], C_RED
        call    g_fillrect
        mov     dx, 0x0202            ; prompt at row 2
        call    gotoxy
        mov     bl, [cal_i]
        xor     bh, bh
        shl     bx, 1
        mov     si, [cs:cal_prompts+bx]
        call    puts_tty
        call    cal_getpoint          ; CF set = ESC
        jc      .abort
        mov     bl, [cal_i]
        xor     bh, bh
        shl     bx, 1
        mov     ax, [sig_rx]
        mov     [cal_ptx+bx], ax
        mov     ax, [sig_ry]
        mov     [cal_pty+bx], ax
        inc     byte [cal_i]
        cmp     byte [cal_i], 4
        jb      .cloop
        ; left = avg(pt0,pt2)  right = avg(pt1,pt3)
        mov     ax, [cal_ptx+0]
        add     ax, [cal_ptx+4]
        shr     ax, 1
        mov     [cal_xl], ax
        mov     ax, [cal_ptx+2]
        add     ax, [cal_ptx+6]
        shr     ax, 1
        mov     [cal_xr], ax
        ; top = avg(pt0,pt1)  bottom = avg(pt2,pt3)
        mov     ax, [cal_pty+0]
        add     ax, [cal_pty+2]
        shr     ax, 1
        mov     [cal_yt], ax
        mov     ax, [cal_pty+4]
        add     ax, [cal_pty+6]
        shr     ax, 1
        mov     [cal_yb], ax
        mov     ax, [cal_xr]          ; guard against a zero span
        cmp     ax, [cal_xl]
        jne     .xok
        inc     word [cal_xr]
.xok:   mov     ax, [cal_yb]
        cmp     ax, [cal_yt]
        jne     .yok
        inc     word [cal_yb]
.yok:   mov     byte [cal_valid], 1
        call    cal_clearfield
        mov     dx, 0x0202
        call    gotoxy
        mov     si, cal_msg
        call    puts_tty
        jmp     .done
.abort: mov     dx, 0x0202
        call    gotoxy
        mov     si, cal_cxl
        call    puts_tty
.done:  mov     byte [sig_cal], 0
        ret

; cal_getpoint : wait for the pen to lift then press; captures raw in sig_rx/ry.
;   CF set if ESC was pressed.
cal_getpoint:
.wup:   call    cal_key
        jc      .abort
        call    cal_drain
        test    byte [sig_b0], 1
        jnz     .wup                  ; wait until pen is up
.wdn:   call    cal_key
        jc      .abort
        call    cal_drain
        test    byte [sig_b0], 1
        jz      .wdn                  ; wait for a fresh press
        clc
        ret
.abort: stc
        ret

; cal_key : CF set if ESC is waiting in the keyboard buffer (consumed).
cal_key:
        mov     ah, 1
        int     0x16
        jz      .none
        xor     ah, ah
        int     0x16
        cmp     al, 0x1B
        je      .esc
.none:  clc
        ret
.esc:   stc
        ret

; cal_drain : process any inking bytes the ISR has queued (decode only; sig_cal=1).
cal_drain:
.d:     mov     al, [sig_rd]
        cmp     al, [sig_wr]
        je      .done
        mov     bl, al
        xor     bh, bh
        mov     al, [sig_ring+bx]
        inc     byte [sig_rd]
        call    sig_feed
        jmp     .d
.done:  ret

; cal_clearfield : repaint the white signing field (leaves the navy frame).
cal_clearfield:
        mov     word [fr_x], 40
        mov     word [fr_y], 72
        mov     word [fr_w], 560
        mov     word [fr_h], 324
        mov     byte [fr_col], C_WHITE
        call    g_fillrect
        ret

; cal_map : AX=raw, BX=lo, CX=hi, [cal_span]=span -> AX = (clamp(raw)-lo)*span/(hi-lo)
;   in 0..span.  Clamps raw into [min(lo,hi),max(lo,hi)] first so a flipped axis
;   works and the idiv can't overflow.
cal_map:
        push    si
        push    di
        mov     si, bx               ; si=min, di=max of (lo,hi)
        mov     di, cx
        cmp     si, di
        jle     .o
        xchg    si, di
.o:     cmp     ax, si
        jge     .c1
        mov     ax, si
.c1:    cmp     ax, di
        jle     .c2
        mov     ax, di
.c2:    sub     ax, bx               ; raw - lo (signed)
        imul    word [cal_span]      ; DX:AX = *span
        mov     si, cx
        sub     si, bx               ; hi - lo (nonzero)
        idiv    si                   ; AX = 0..span
        pop     di
        pop     si
        ret

; ============================================================================
;  diag_disk : storage geometry + sector-0 read test (INT 13h, drive 80h)
; ============================================================================
diag_disk:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, dk_title
        call    puts_tty
        mov     ah, 0x08
        mov     dl, 0x80
        int     0x13
        jc      .err
        mov     [dk_cx], cx
        mov     [dk_dx], dx
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        mov     si, dk_cyl
        call    puts_tty
        mov     al, [dk_cx+1]       ; CH = cyl low 8 bits
        xor     ah, ah
        mov     bl, [dk_cx]         ; CL: bits 6-7 = cyl high
        and     bl, 0xC0
        mov     cl, 6
        shr     bl, cl
        mov     bh, bl
        xor     bl, bl             ; bx = high<<8
        add     ax, bx
        inc     ax
        call    print_dec_ax
        mov     si, dk_hd
        call    puts_tty
        mov     al, [dk_dx+1]      ; DH = max head
        xor     ah, ah
        inc     ax
        call    print_dec_ax
        mov     si, dk_spt
        call    puts_tty
        mov     al, [dk_cx]        ; CL & 0x3F = sectors/track
        and     al, 0x3F
        xor     ah, ah
        call    print_dec_ax
        mov     dh, 5
        mov     dl, 2
        call    gotoxy
        mov     si, dk_rd
        call    puts_tty
        mov     ax, 0x0201
        mov     cx, 0x0001
        xor     dh, dh
        mov     dl, 0x80
        push    es
        mov     bx, cs
        mov     es, bx
        mov     bx, MEMBUF
        int     0x13
        pop     es
        mov     si, dk_ok
        jnc     .rok
        mov     si, dk_fail
.rok:   call    puts_tty
        jmp     .fin
.err:
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        mov     si, dk_nodrv
        call    puts_tty
.fin:
        mov     dh, 7
        mov     dl, 2
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

; ============================================================================
;  diag_power : dump the power-MCU register file (0xEC/0xED, 0x00-0x1F)
; ============================================================================
diag_power:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, pm_title
        call    puts_tty
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        xor     bl, bl
.r0:    mov     dx, 0x00EC
        mov     al, bl
        out     dx, al
        mov     dx, 0x00ED
        in      al, dx
        call    print_hex_al
        mov     al, ' '
        call    putc_tty
        inc     bl
        cmp     bl, 0x10
        jb      .r0
        mov     dh, 4
        mov     dl, 2
        call    gotoxy
        mov     bl, 0x10
.r1:    mov     dx, 0x00EC
        mov     al, bl
        out     dx, al
        mov     dx, 0x00ED
        in      al, dx
        call    print_hex_al
        mov     al, ' '
        call    putc_tty
        inc     bl
        cmp     bl, 0x20
        jb      .r1
        mov     dh, 6
        mov     dl, 2
        call    gotoxy
        mov     si, pm_note
        call    puts_tty
        mov     dh, 8
        mov     dl, 2
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

; ============================================================================
;  diag_pcmcia : PCMCIA PCIC socket status (0x3E0/0x3E1)
; ============================================================================
diag_pcmcia:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, pc_title
        call    puts_tty
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        mov     si, pc_id
        call    puts_tty
        mov     dx, 0x3E0
        xor     al, al
        out     dx, al
        mov     dx, 0x3E1
        in      al, dx
        call    print_hex_al
        mov     dh, 4
        mov     dl, 2
        call    gotoxy
        mov     si, pc_s0
        call    puts_tty
        mov     dx, 0x3E0
        mov     al, 0x01
        out     dx, al
        mov     dx, 0x3E1
        in      al, dx
        mov     bl, al
        call    print_hex_al
        mov     si, pc_arrow
        call    puts_tty
        mov     al, bl
        and     al, 0x0C
        cmp     al, 0x0C
        mov     si, pc_card
        je      .s0
        mov     si, pc_empty
.s0:    call    puts_tty
        mov     dh, 5
        mov     dl, 2
        call    gotoxy
        mov     si, pc_s1
        call    puts_tty
        mov     dx, 0x3E0
        mov     al, 0x41
        out     dx, al
        mov     dx, 0x3E1
        in      al, dx
        mov     bl, al
        call    print_hex_al
        mov     si, pc_arrow
        call    puts_tty
        mov     al, bl
        and     al, 0x0C
        cmp     al, 0x0C
        mov     si, pc_card
        je      .s1
        mov     si, pc_empty
.s1:    call    puts_tty
        mov     dh, 7
        mov     dl, 2
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

; ============================================================================
;  diag_scamp : unlock + read + display the VL82C420 SCAMP config space.
;  The config is gated by port 0x22/0x23; it re-locks between bus cycles, so the
;  enable->read->disable is done atomically (interrupts off).  Read-only.
; ============================================================================
diag_scamp:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, cs_title
        call    puts_tty
        ; --- atomic unlock -> read 0x74/0x76 idx 0x00-0x7F -> MEMBUF -> relock ---
        cli
        mov     dx, 0x23
        xor     al, al
        out     dx, al                  ; 0x23 <- 0
        mov     ax, 0x80
        mov     dx, 0x22
        out     dx, al                  ; 0x22 <- 0x80
        out     dx, ax                  ; 0x22 <- word 0x0080  (config access enabled)
        mov     di, MEMBUF
        xor     cl, cl
.rd:    mov     al, cl
        and     al, 0x7F
        mov     dx, 0x74
        out     dx, al
        mov     dx, 0x76
        in      al, dx
        mov     [di], al
        inc     di
        inc     cl
        cmp     cl, 0x80
        jb      .rd
        mov     dx, 0x22
        in      ax, dx
        and     ax, 0xFFFD
        or      ax, 0x100               ; bit8 = locked
        out     dx, ax                  ; config access disabled again
        sti
        ; --- display MEMBUF[0..0x7F] as 8 rows of 16 hex ---
        xor     bx, bx
.dl:    mov     ax, bx
        and     al, 0x0F
        jnz     .noNL
        mov     ax, bx
        mov     cl, 4
        shr     ax, cl
        add     al, 2                   ; screen row = 2 + (offset/16)
        mov     dh, al
        mov     dl, 2
        call    gotoxy
        mov     al, bl
        call    print_hex_al            ; offset label
        mov     al, ':'
        call    putc_tty
        mov     al, ' '
        call    putc_tty
.noNL:  mov     si, MEMBUF
        add     si, bx
        mov     al, [si]
        call    print_hex_al
        mov     al, ' '
        call    putc_tty
        inc     bx
        cmp     bx, 0x80
        jb      .dl
        mov     dh, 11
        mov     dl, 2
        call    gotoxy
        mov     si, cs_note
        call    puts_tty
        mov     dh, 13
        mov     dl, 2
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

; ============================================================================
;  diag_ptr : pointing-device (trackpad U75, NEC uPD17137A) identify + settings.
;  U75's only host interface is the PS/2 aux channel via the 8042 KBC, so this
;  talks raw 8042: enable aux, reset/identify, read status (resolution + sample
;  rate), and let the user change them live.  Restores the 8042 command byte on
;  exit.  (A loaded mouse driver re-inits the device, so changes are for testing.)
; ============================================================================
; aux_wait_ibf : spin until the 8042 input buffer is empty (status bit1=0)
aux_wait_ibf:
        push    ax
        push    cx
        xor     cx, cx
.w:     in      al, 0x64
        test    al, 0x02
        jz      .ok
        loop    .w
.ok:    pop     cx
        pop     ax
        ret
; aux_get : read one byte from the 8042 output buffer -> AL, CF=1 on timeout
aux_get:
        push    cx
        xor     cx, cx
.w:     in      al, 0x64
        test    al, 0x01
        jnz     .got
        loop    .w
        pop     cx
        stc
        ret
.got:   in      al, 0x60
        pop     cx
        clc
        ret
; aux_write : send AL to the aux device (0xD4 gate byte, then the data)
aux_write:
        push    ax
        call    aux_wait_ibf
        mov     al, 0xD4
        out     0x64, al
        call    aux_wait_ibf
        pop     ax
        out     0x60, al
        ret
; rd_cmdb : read the 8042 command byte -> AL (0x65 fallback on timeout)
rd_cmdb:
        call    aux_wait_ibf
        mov     al, 0x20
        out     0x64, al
        call    aux_get
        jnc     .ok
        mov     al, 0x65
.ok:    ret

ptr_status:                             ; query resolution + sample rate (0xE9)
        mov     al, 0xE9
        call    aux_write
        call    aux_get                 ; FA (ack)
        jc      .d
        call    aux_get                 ; status flags
        jc      .d
        call    aux_get                 ; resolution code
        jc      .d
        mov     [ptr_res], al
        call    aux_get                 ; sample rate
        jc      .d
        mov     [ptr_rate], al
.d:     ret

ptr_reset:                              ; reset (0xFF): FA, AA (BAT), device id
        mov     byte [ptr_ok], 0
        mov     byte [ptr_ridx], 5      ; reset -> default rate 100/s
        mov     al, 0xFF
        call    aux_write
        call    aux_get                 ; FA
        jc      .fail
        call    aux_get                 ; AA = self-test passed
        jc      .fail
        mov     [ptr_bat], al
        call    aux_get                 ; device id
        jc      .fail
        mov     [ptr_id], al
        mov     byte [ptr_ok], 1
        call    ptr_status
.fail:  ret

ptr_cycle_res:                          ; 0xE8 set-resolution, cycle 0..3
        mov     al, [ptr_res]
        inc     al
        and     al, 3
        mov     [ptr_res], al
        mov     al, 0xE8
        call    aux_write
        call    aux_get                 ; FA
        mov     al, [ptr_res]
        call    aux_write
        call    aux_get                 ; FA
        call    ptr_status
        ret

ptr_cycle_rate:                         ; 0xF3 set-sample-rate from pt_rates[]
        mov     al, [ptr_ridx]
        inc     al
        cmp     al, PT_NRATES
        jb      .ok
        xor     al, al
.ok:    mov     [ptr_ridx], al
        xor     ah, ah
        mov     bx, pt_rates
        add     bx, ax
        mov     al, [bx]
        push    ax
        mov     al, 0xF3
        call    aux_write
        call    aux_get                 ; FA
        pop     ax
        call    aux_write               ; rate value
        call    aux_get                 ; FA
        call    ptr_status
        ret

pt_print_res:                           ; AL = resolution code -> "N counts/mm"
        push    cx
        push    si
        mov     cl, al
        mov     al, 1
        shl     al, cl                  ; 0->1 1->2 2->4 3->8 counts/mm
        xor     ah, ah
        call    print_dec_ax
        mov     si, pt_cpermm
        call    puts_tty
        pop     si
        pop     cx
        ret

ptr_draw:
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        mov     si, pt_title
        call    puts_tty
        cmp     byte [ptr_ok], 0
        je      .noresp
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        mov     si, pt_bat
        call    puts_tty
        mov     al, [ptr_bat]
        cmp     al, 0xAA
        mov     si, pt_pass
        je      .b1
        mov     si, pt_fail
.b1:    call    puts_tty
        mov     dh, 4
        mov     dl, 2
        call    gotoxy
        mov     si, pt_id
        call    puts_tty
        mov     al, [ptr_id]
        call    print_hex_al
        cmp     byte [ptr_id], 0
        jne     .res
        mov     si, pt_idstd
        call    puts_tty
.res:   mov     dh, 5
        mov     dl, 2
        call    gotoxy
        mov     si, pt_res
        call    puts_tty
        mov     al, [ptr_res]
        call    pt_print_res
        mov     dh, 6
        mov     dl, 2
        call    gotoxy
        mov     si, pt_rate
        call    puts_tty
        mov     al, [ptr_rate]
        xor     ah, ah
        call    print_dec_ax
        mov     si, pt_persec
        call    puts_tty
        jmp     .keys
.noresp:
        mov     dh, 3
        mov     dl, 2
        call    gotoxy
        mov     si, pt_nodev
        call    puts_tty
.keys:
        mov     dh, 9
        mov     dl, 2
        call    gotoxy
        mov     si, pt_keys1
        call    puts_tty
        mov     dh, 10
        mov     dl, 2
        call    gotoxy
        mov     si, pt_keys2
        call    puts_tty
        mov     dh, 12
        mov     dl, 2
        call    gotoxy
        mov     si, pt_note
        call    puts_tty
        ret

diag_ptr:
        call    rd_cmdb                 ; save current 8042 command byte
        mov     [ptr_cmdb], al
        call    aux_wait_ibf
        mov     al, 0xA8               ; enable aux device (mouse clock)
        out     0x64, al
        call    ptr_reset
.redraw:
        call    ptr_draw
.k:     call    getkey
        cmp     al, 0x1B
        je      .exit
        cmp     al, 'r'
        je      .cres
        cmp     al, 'R'
        je      .cres
        cmp     al, 's'
        je      .crate
        cmp     al, 'S'
        je      .crate
        cmp     al, 't'
        je      .ret
        cmp     al, 'T'
        je      .ret
        jmp     .k
.cres:  call    ptr_cycle_res
        jmp     .redraw
.crate: call    ptr_cycle_rate
        jmp     .redraw
.ret:   call    ptr_reset
        jmp     .redraw
.exit:
        ; restore the original 8042 command byte (re-disables aux)
        call    aux_wait_ibf
        mov     al, 0x60
        out     0x64, al
        call    aux_wait_ibf
        mov     al, [ptr_cmdb]
        out     0x60, al
        ret

; ============================================================================
;  Command builders. All produce:
;   - cmdtail (DOS EXEC command tail: count,"/C PS2 ...",CR)
;   - cmdshow (ASCIIZ "PS2 ..." for display)
; ============================================================================
; build_cmd_noopt: SI=cmd ptr -> "PS2 <cmd>"
build_cmd_noopt:
        mov     [bld_ptr], si     ; cmd_begin clobbers SI, so stash it
        call    cmd_begin
        mov     si, [bld_ptr]
        call    app_cmdptr
        jmp     cmd_end

; build_cmd_opt: SI=cmd ptr, [cur_opt]=opt ptr -> "PS2 <cmd> <opt>"
build_cmd_opt:
        mov     [bld_ptr], si
        call    cmd_begin
        mov     si, [bld_ptr]
        call    app_cmdptr
        mov     al, ' '
        call    app_char
        mov     si, [cur_opt]
        call    app_optval        ; append value part (after '=' if the option has one)
        jmp     cmd_end

; build_cmd_ultraopt: [cur_opt]=opt -> "<opt>" (for C:\ULTRACHG.COM <opt>)
build_cmd_ultraopt:
        call    cmd_begin
        mov     si, [cur_opt]
        call    app_optval
        jmp     cmd_end

; build_cmd_raw: SI=full arg string (e.g. "_@REVision") -> "PS2 <arg>"
build_cmd_raw:
        mov     [bld_ptr], si
        call    cmd_begin
        mov     si, [bld_ptr]
        call    app_cmdptr
        jmp     cmd_end

; helpers that build both the exec tail and the display string simultaneously
cmd_begin:
        ; display string starts with the show prefix ("PS2 " by default)
        mov     di, cmdshow
        mov     si, [show_pfx]
.cs:    lodsb
        mov     [di], al
        inc     di
        test    al, al
        jnz     .cs
        dec     di                ; back over the NUL
        mov     [show_ptr], di
        ; exec tail starts "/C PS2 "
        mov     di, cmdtail+1     ; leave room for count byte
        mov     si, pfx_cc
.ct:    lodsb
        test    al, al
        jz      .done
        mov     [di], al
        inc     di
        jmp     .ct
.done:
        mov     [tail_ptr], di
        ret

app_cmdptr:                       ; append ASCIIZ at SI to both buffers
.a:     lodsb
        test    al, al
        jz      .done
        call    app_char
        jmp     .a
.done:  ret

; app_optval : append an option's VALUE part to both buffers.  If the option
;              string contains '=', the value is what follows it; else the whole
;              string (SI = option string).
app_optval:
        push    bx
        mov     bx, si
.scan:  mov     al, [bx]
        test    al, al
        jz      .use              ; no '=' found -> use whole string (SI unchanged)
        cmp     al, '='
        je      .after
        inc     bx
        jmp     .scan
.after: inc     bx                ; skip '='
        mov     si, bx
.use:   pop     bx
        call    app_cmdptr
        ret

app_char:                         ; AL -> both buffers
        push    si
        mov     si, [show_ptr]
        mov     [si], al
        inc     si
        mov     [show_ptr], si
        mov     si, [tail_ptr]
        mov     [si], al
        inc     si
        mov     [tail_ptr], si
        pop     si
        ret

cmd_end:
        ; terminate display string
        mov     si, [show_ptr]
        mov     byte [si], 0
        ; terminate tail with CR and set count byte
        mov     si, [tail_ptr]
        mov     byte [si], 0x0D
        ; count = tail_ptr - (cmdtail+1)
        mov     ax, [tail_ptr]
        sub     ax, cmdtail+1
        mov     bx, cmdtail
        mov     [bx], al
        ret

; ============================================================================
;  do_exec : run COMMAND.COM with the built cmdtail
; ============================================================================
do_exec:
        push    ds
        push    es
        mov     [save_sp], sp
        mov     [save_ss], ss
        mov     ax, cs
        mov     ds, ax
        mov     es, ax
        mov     word [pb_env], 0
        mov     word [pb_tail_off], cmdtail
        mov     [pb_tail_seg], cs
        mov     word [pb_f1_off], 0x5C
        mov     [pb_f1_seg], cs
        mov     word [pb_f2_off], 0x6C
        mov     [pb_f2_seg], cs
        mov     dx, [exec_prog]
        mov     bx, parblk
        mov     ax, 0x4B00
        int     0x21
        cli
        mov     ss, [cs:save_ss]
        mov     sp, [cs:save_sp]
        sti
        pop     es
        pop     ds
        ret

; ============================================================================
;  Selection navigation over the rows[] table
; ============================================================================
; row_ptr: BX=row index -> SI = record address (7 bytes each)
row_ptr:
        mov     ax, bx
        mov     cx, 7
        mul     cx
        add     ax, rows
        mov     si, ax
        ret

; cat_ptr: BX=category index -> SI = category record (6 bytes)
cat_ptr:
        push    ax
        push    dx
        mov     ax, bx
        mov     dx, 6
        mul     dx
        add     ax, cats
        mov     si, ax
        pop     dx
        pop     ax
        ret

; scr_off: DH=row DL=col -> BX = B800 byte offset (AX/DX preserved)
scr_off:
        push    ax
        mov     al, dh
        mov     ah, 160
        mul     ah
        mov     bx, ax
        mov     al, dl
        xor     ah, ah
        shl     ax, 1
        add     bx, ax
        pop     ax
        ret

; put_cell: DH=row DL=col BL=char BH=attr (BX/DX/AX preserved)
put_cell:
        push    ax
        push    di
        push    es
        mov     al, dh
        mov     ah, 160
        mul     ah
        mov     di, ax
        mov     al, dl
        xor     ah, ah
        shl     ax, 1
        add     di, ax
        mov     ax, 0xB800
        mov     es, ax
        mov     [es:di], bl
        mov     [es:di+1], bh
        pop     es
        pop     di
        pop     ax
        ret

; ---- menu navigation (clamped) ----
main_up:
        cmp     word [cat_sel], 0
        je      .r
        dec     word [cat_sel]
.r:     ret
main_down:
        mov     ax, [cat_sel]
        inc     ax
        cmp     ax, [menu_catn]
        jae     .r
        mov     [cat_sel], ax
.r:     ret
sub_up:
        cmp     word [sub_sel], 0
        je      .r
        dec     word [sub_sel]
.r:     ret
; sel_cat_ptr : SI = category record for (menu_catbase + cat_sel)
sel_cat_ptr:
        mov     bx, [cat_sel]
        add     bx, [menu_catbase]
        call    cat_ptr
        ret
sub_down:
        call    sel_cat_ptr
        mov     al, [si+5]        ; item count for this category
        xor     ah, ah
        mov     cx, ax
        mov     ax, [sub_sel]
        inc     ax
        cmp     ax, cx
        jae     .r
        mov     [sub_sel], ax
.r:     ret

; ============================================================================
;  Options list iteration ( [opt_base] = base, options are ASCIIZ, 0-terminated
;  list ends at an empty string )
; ============================================================================
; opt_count -> CX = number of options
opt_count:
        mov     si, [opt_base]
        xor     cx, cx
.c:     cmp     byte [si], 0
        je      .done
        inc     cx
.skip:  lodsb
        test    al, al
        jnz     .skip
        jmp     .c
.done:  ret

; opt_ptr -> SI = pointer to option number [opt_sel]
opt_ptr:
        mov     si, [opt_base]
        mov     cx, [opt_sel]
.l:     jcxz    .done
.skip:  lodsb
        test    al, al
        jnz     .skip
        dec     cx
        jmp     .l
.done:  ret

; ============================================================================
;  Drawing
; ============================================================================
draw_screen:
        call    fill_desktop         ; grey desktop backdrop
        call    draw_shadow          ; drop shadow (painted before the window)
        call    fill_window          ; cyan window interior
        call    draw_frame           ; yellow double-line border
        ; ---- title + author, inside the window top ----
        mov     dh, TITLE_ROW
        mov     dl, UI_L+2
        call    scr_off
        mov     si, t_title
        mov     ah, A_TITLE
        call    puts_at
        mov     dh, TITLE_ROW
        mov     dl, UI_R-17
        call    scr_off
        mov     si, t_auth
        mov     ah, A_TITLE
        call    puts_at
        ; ---- content by level ----
        cmp     byte [level], 0
        jne     .sub
        call    draw_main
        mov     si, foot_main
        jmp     .foot
.sub:
        call    draw_sub
        mov     si, foot_sub
.foot:
        mov     dh, FOOT_ROW
        mov     dl, UI_L+2
        call    scr_off
        mov     ah, A_FOOT
        call    puts_at
        ret

; fill the whole screen with the grey desktop backdrop
fill_desktop:
        push    es
        mov     ax, 0xB800
        mov     es, ax
        xor     di, di
        mov     cx, 80*25
        mov     ax, (A_DESKTOP<<8)|0x20
        rep     stosw
        pop     es
        ret

; fill the window interior with cyan
fill_window:
        mov     dh, UI_TOP
.r:     mov     dl, UI_L
        mov     bx, UI_R-UI_L+1
        mov     ah, A_DESK
        call    fill_box_row
        inc     dh
        cmp     dh, UI_BOT
        jbe     .r
        ret

; drop shadow: 2-col band on the right + 1-row band at the bottom, offset
draw_shadow:
        mov     dh, UI_TOP+1
.rs:    mov     dl, UI_R+1
        mov     bx, 1               ; right shadow: 1 column wide
        mov     ah, A_SHADOW
        call    fill_box_row
        inc     dh
        cmp     dh, UI_BOT+1
        jbe     .rs
        mov     dh, UI_BOT+1
        mov     dl, UI_L+2
        mov     bx, UI_R-UI_L       ; bottom shadow: ends at UI_R+1 (aligns corner)
        mov     ah, A_SHADOW
        call    fill_box_row
        ret

; draw the window's double-line border
draw_frame:
        mov     bh, A_FRAME
        mov     dh, UI_TOP
        mov     dl, UI_L
        mov     bl, BX_TL
        call    put_cell
        mov     dh, UI_TOP
        mov     dl, UI_R
        mov     bl, BX_TR
        call    put_cell
        mov     dh, UI_BOT
        mov     dl, UI_L
        mov     bl, BX_BL
        call    put_cell
        mov     dh, UI_BOT
        mov     dl, UI_R
        mov     bl, BX_BR
        call    put_cell
        mov     dl, UI_L+1
.h:     cmp     dl, UI_R
        jae     .v
        mov     dh, UI_TOP
        mov     bl, BX_H
        call    put_cell
        mov     dh, UI_BOT
        mov     bl, BX_H
        call    put_cell
        inc     dl
        jmp     .h
.v:     mov     dh, UI_TOP+1
.vl:    cmp     dh, UI_BOT
        jae     .done
        mov     dl, UI_L
        mov     bl, BX_V
        call    put_cell
        mov     dl, UI_R
        mov     bl, BX_V
        call    put_cell
        inc     dh
        jmp     .vl
.done:  ret

; main (category) menu
draw_main:
        mov     dh, BC_ROW
        mov     dl, UI_L+2
        call    scr_off
        mov     si, [menu_title]
        mov     ah, A_KEY
        call    puts_at
        mov     word [ri], 0
.n:
        mov     ax, [ri]
        cmp     ax, [menu_catn]
        jae     .done
        add     ax, ITEM_TOP
        mov     [row_tmp], al
        mov     ax, [ri]
        cmp     ax, [cat_sel]
        jne     .nosel
        mov     byte [sel_attr], A_SEL
        mov     byte [desc_attr], A_SEL
        mov     dh, [row_tmp]
        mov     dl, UI_L+2
        mov     bx, UI_R-UI_L-3
        mov     ah, A_SEL
        call    fill_box_row
        mov     dh, [row_tmp]
        mov     dl, ITEM_COL-2
        mov     bl, GLY_ARROW
        mov     bh, A_SEL
        call    put_cell
        jmp     .txt
.nosel:
        mov     byte [sel_attr], A_ITEM
        mov     byte [desc_attr], A_DESC
.txt:
        mov     bx, [ri]
        add     bx, [menu_catbase]
        call    cat_ptr
        mov     ax, [si]
        mov     [lbl_tmp], ax
        mov     ax, [si+2]
        mov     [desc_tmp], ax
        mov     dh, [row_tmp]
        mov     dl, ITEM_COL
        call    scr_off
        mov     si, [lbl_tmp]
        mov     ah, [sel_attr]
        call    puts_at
        mov     dh, [row_tmp]
        mov     dl, DESC_COL
        call    scr_off
        mov     si, [desc_tmp]
        mov     ah, [desc_attr]
        call    puts_at
        inc     word [ri]
        jmp     .n
.done:  ret

; submenu (items of the selected category)
draw_sub:
        mov     dh, BC_ROW
        mov     dl, UI_L+2
        call    scr_off
        mov     si, [menu_title]
        mov     ah, A_DESC
        call    puts_at
        mov     dh, BC_ROW
        mov     dl, UI_L+12
        mov     bl, GLY_ARROW
        mov     bh, A_KEY
        call    put_cell
        call    sel_cat_ptr
        mov     ax, [si]
        mov     [lbl_tmp], ax
        mov     al, [si+4]
        mov     [cat_start], al
        mov     al, [si+5]
        mov     [cat_count], al
        mov     dh, BC_ROW
        mov     dl, UI_L+14
        call    scr_off
        mov     si, [lbl_tmp]
        mov     ah, A_KEY
        call    puts_at
        mov     word [ri], 0
.n:
        mov     al, [cat_count]
        xor     ah, ah
        mov     bx, [ri]
        cmp     bx, ax
        jae     .done
        mov     ax, [ri]
        add     ax, ITEM_TOP
        mov     [row_tmp], al
        mov     ax, [ri]
        cmp     ax, [sub_sel]
        jne     .nosel
        mov     byte [sel_attr], A_SEL
        mov     dh, [row_tmp]
        mov     dl, UI_L+2
        mov     bx, UI_R-UI_L-3
        mov     ah, A_SEL
        call    fill_box_row
        mov     dh, [row_tmp]
        mov     dl, ITEM_COL-2
        mov     bl, GLY_ARROW
        mov     bh, A_SEL
        call    put_cell
        jmp     .txt
.nosel:
        mov     byte [sel_attr], A_ITEM
.txt:
        mov     al, [cat_start]
        xor     ah, ah
        add     ax, [ri]
        mov     bx, ax
        call    row_ptr
        mov     ax, [si]
        mov     [lbl_tmp], ax
        mov     dh, [row_tmp]
        mov     dl, ITEM_COL
        call    scr_off
        mov     si, [lbl_tmp]
        mov     ah, [sel_attr]
        call    puts_at
        inc     word [ri]
        jmp     .n
.done:  ret

; draw_picker: popup box listing options of the current item
draw_picker:
        ; box at row 6..(6+n+2), col 25..55
        call    opt_count
        mov     [pkd_n], cx
        ; frame background
        mov     word [pk_row], 0
.bg:
        mov     ax, [pk_row]
        mov     cx, [pk_n]
        add     cx, 2
        cmp     ax, cx
        jae     .bgd
        mov     dh, al
        add     dh, 6
        mov     dl, 24
        mov     bx, 30
        mov     ah, A_BOX
        call    fill_box_row
        inc     word [pk_row]
        jmp     .bg
.bgd:
        ; title
        mov     si, pk_title
        mov     ah, A_BOX
        mov     bx, (6*80+26)*2
        call    puts_at
        ; options
        mov     word [pk_i], 0
.op:
        mov     ax, [pk_i]
        cmp     ax, [pkd_n]
        jae     .opd
        mov     [opt_sel_tmp], ax
        ; row = 7 + i
        mov     cx, ax
        add     cx, 7
        imul    cx, 160
        add     cx, 26*2
        mov     di, cx
        ; attr: selected option highlighted
        mov     ah, A_BOX
        mov     bx, [pk_i]
        cmp     bx, [opt_sel]
        jne     .noh
        mov     ah, A_SEL
.noh:
        ; get option ptr #i
        push    ax
        mov     ax, [opt_base]
        mov     [tmp_base], ax
        pop     ax
        call    ptr_to_opt        ; SI = option #[pk_i]
        call    puts_opt          ; display part only (stops at '=')
        inc     word [pk_i]
        jmp     .op
.opd:
        ret

; ptr_to_opt: uses [pk_i] index into [opt_base] -> SI
ptr_to_opt:
        mov     si, [opt_base]
        mov     cx, [pk_i]
.l:     jcxz    .done
.s:     lodsb
        test    al, al
        jnz     .s
        dec     cx
        jmp     .l
.done:  ret

; draw_confirm: box showing the command, Y/N
draw_confirm:
        mov     word [pk_row], 0
.bg:    mov     ax, [pk_row]
        cmp     ax, 5
        jae     .bgd
        mov     dh, al
        add     dh, 9
        mov     dl, 12
        mov     bx, 56
        mov     ah, A_BOX
        call    fill_box_row
        inc     word [pk_row]
        jmp     .bg
.bgd:
        mov     si, cf_title
        mov     ah, A_BOX
        mov     bx, (9*80+14)*2
        call    puts_at
        mov     si, cmdshow
        mov     ah, 0x1E          ; yellow on blue
        mov     bx, (11*80+14)*2
        call    puts_at
        mov     si, cf_prompt
        mov     ah, A_BOX
        mov     bx, (12*80+14)*2
        call    puts_at
        ret

; ============================================================================
;  Low-level screen helpers  (direct write to B800)
; ============================================================================
; puts_at: SI=string, AH=attr, BX=byte offset in B800
puts_at:
        mov     di, bx
puts_di:
        push    es
        push    ax
        mov     ax, 0xB800
        mov     es, ax
        pop     ax
.n:     lodsb
        test    al, al
        jz      .d
        mov     [es:di], al
        mov     [es:di+1], ah
        add     di, 2
        jmp     .n
.d:     pop     es
        ret

; puts_opt : like puts_di, but a "display=value" option prints only the display
;            part (stops at NUL or '=').  SI=string, AH=attr, DI=offset.
puts_opt:
        push    es
        push    ax
        mov     ax, 0xB800
        mov     es, ax
        pop     ax
.n:     lodsb
        test    al, al
        jz      .d
        cmp     al, '='
        je      .d
        mov     [es:di], al
        mov     [es:di+1], ah
        add     di, 2
        jmp     .n
.d:     pop     es
        ret

; fill_row: fill row DH with spaces, attr AH  (whole 80 cols)
fill_row:
        push    es
        push    ax
        mov     al, dh
        mov     ah, 160
        mul     ah
        mov     di, ax
        mov     ax, 0xB800
        mov     es, ax
        pop     ax
        mov     cx, 80
        mov     al, ' '
.f:     mov     [es:di], al
        mov     [es:di+1], ah
        add     di, 2
        loop    .f
        pop     es
        ret

; fill_row_attr: like fill_row but keeps existing chars, sets attr AH on row DH
fill_row_attr:
        push    es
        push    ax
        mov     al, dh
        mov     bl, 160
        mul     bl
        mov     di, ax
        mov     ax, 0xB800
        mov     es, ax
        pop     ax
        mov     cx, 80
.f:     mov     [es:di+1], ah
        add     di, 2
        loop    .f
        pop     es
        ret

; fill_box_row: row DH, start col DL, width BX, attr AH -> spaces
fill_box_row:
        push    es
        push    ax
        mov     al, dh
        mov     ah, 160
        mul     ah
        mov     di, ax            ; row base
        xor     ah, ah
        mov     al, dl
        shl     ax, 1
        add     di, ax            ; + col*2
        mov     ax, 0xB800
        mov     es, ax
        pop     ax
        mov     cx, bx
        mov     al, ' '
.f:     mov     [es:di], al
        mov     [es:di+1], ah
        add     di, 2
        loop    .f
        pop     es
        ret

; cls_body_full : clear to the IBM PS/2 setup theme (white on blue) for the
;                 full-screen diagnostic / test / dump pages
cls_body_full:
        cmp     byte [body_gfx], 0
        jne     .gfx
        push    es
        mov     ax, 0xB800
        mov     es, ax
        xor     di, di
        mov     cx, 80*25
        mov     ax, 0x1F20        ; white on blue (IBM PS/2 reference-diskette look)
        rep     stosw
        pop     es
        ret
.gfx:   mov     word [fr_x], 0    ; graphical page: fill the screen mauve (index 0)
        mov     word [fr_y], 0
        mov     word [fr_w], 640
        mov     word [fr_h], 480
        mov     byte [fr_col], C_MAUVE
        call    g_fillrect
        ret

; gotoxy: DL=col DH=row  (BIOS)
gotoxy:
        push    ax
        push    bx
        mov     ah, 2
        xor     bh, bh
        int     0x10
        pop     bx
        pop     ax
        ret

; puts_tty: SI=ASCIIZ via BIOS teletype (for child-run screens)
puts_tty:
        push    ax
        push    bx
.n:     lodsb
        test    al, al
        jz      .d
        mov     ah, 0x0E
        mov     bx, [tty_col]
        int     0x10
        jmp     .n
.d:     pop     bx
        pop     ax
        ret

; puts_hint : draw SI at the current BIOS cursor in cyan-on-blue (the F-key
;             hint colour of the IBM PS/2 pages) via direct B800 write
puts_hint:
        cmp     byte [body_gfx], 0
        jne     .gfx
        push    ax
        push    bx
        push    cx
        push    dx
        mov     ah, 0x03          ; get cursor position -> DH=row, DL=col
        xor     bh, bh
        int     0x10
        call    scr_off           ; DH,DL -> BX (B800 offset)
        mov     ah, 0x1B          ; cyan on blue
        call    puts_at
        pop     dx
        pop     cx
        pop     bx
        pop     ax
        ret
.gfx:   mov     ax, [tty_col]     ; graphical page: draw the hint in navy on mauve
        push    ax
        mov     word [tty_col], 0x0003
        call    puts_tty
        pop     ax
        mov     [tty_col], ax
        ret

; getkey -> AL=ascii AH=scan
getkey:
        mov     ah, 0
        int     0x16
        ret

; ============================================================================
;  GRAPHICS  (VGA mode 12h — the Easy-Setup screen)
; ============================================================================
; gui_show : enter mode 12h, load the Easy-Setup palette, blit the screen and
;            draw the selection box on the current icon.
gui_show:
        mov     ax, 0x0012
        int     0x10
        call    set_palette
        call    blit_screen
        mov     al, HL_COLOR
        call    draw_ring
        ret

; set DAC entries 0..PAL_N-1 from the espal table (r,g,b 6-bit)
set_palette:
        mov     si, espal
        xor     bx, bx
.pl:    mov     dh, [si]
        mov     ch, [si+1]
        mov     cl, [si+2]
        mov     ax, 0x1010
        int     0x10
        add     si, 3
        inc     bx
        cmp     bx, PAL_N
        jb      .pl
        ret

; blit the 4 RLE-compressed bit-planes into A000 (map-mask per plane)
blit_screen:
        push    es
        mov     ax, 0xA000
        mov     es, ax
        xor     bp, bp
.pl:
        mov     dx, 0x3C4                ; Sequencer Map Mask = 1<<plane
        mov     al, 0x02
        out     dx, al
        inc     dx
        mov     bx, bp
        mov     al, [mm_tab+bx]
        out     dx, al
        mov     bx, bp
        shl     bx, 1
        mov     si, [esplanes+bx]
        xor     di, di
.dec:   lodsb
        mov     ah, al
        lodsb
        mov     cl, ah
        xor     ch, ch
        rep     stosb
        cmp     di, 38400               ; 80 bytes/row * 480 rows
        jb      .dec
        inc     bp
        cmp     bp, 4
        jb      .pl
        mov     dx, 0x3C4               ; re-enable all planes
        mov     al, 0x02
        out     dx, al
        inc     dx
        mov     al, 0x0F
        out     dx, al
        pop     es
        ret

; hl_erase : redraw the selection ring in mauve (palette idx 0)
hl_erase:
        xor     al, al
; draw_ring : AL = colour ; 3-px box in the mauve gap around icon [isel]
draw_ring:
        mov     [ringcol], al
        mov     bx, [isel]
        shl     bx, 3                    ; 8 bytes per icon record
        mov     ax, [icons+bx]
        mov     [bx0], ax
        mov     ax, [icons+bx+2]
        mov     [by0], ax
        mov     ax, [icons+bx+4]
        mov     [bx1], ax
        mov     ax, [icons+bx+6]
        mov     [by1], ax
        mov     byte [ringm], 3
.ring:
        mov     al, [ringm]
        cbw
        mov     cx, ax
        mov     ax, [bx0]
        sub     ax, cx
        mov     [rx0], ax
        mov     ax, [by0]
        sub     ax, cx
        mov     [ry0], ax
        mov     ax, [bx1]
        add     ax, cx
        mov     [rx1], ax
        mov     ax, [by1]
        add     ax, cx
        mov     [ry1], ax
        mov     dx, [ry0]
        call    hline
        mov     dx, [ry1]
        call    hline
        mov     cx, [rx0]
        call    vline
        mov     cx, [rx1]
        call    vline
        inc     byte [ringm]
        cmp     byte [ringm], 6
        jb      .ring
        ret

hline:
        push    dx
        mov     cx, [rx0]
.h:     mov     al, [ringcol]
        call    putpixel
        inc     cx
        cmp     cx, [rx1]
        jbe     .h
        pop     dx
        ret
vline:
        push    cx
        mov     dx, [ry0]
.v:     mov     al, [ringcol]
        call    putpixel
        inc     dx
        cmp     dx, [ry1]
        jbe     .v
        pop     cx
        ret
putpixel:
        push    ax
        push    bx
        mov     ah, 0x0C
        xor     bh, bh
        int     0x10
        pop     bx
        pop     ax
        ret

; show_info : SI = ASCIIZ (may contain CR/LF) ; blue page + cyan "press a key"
show_info:
        push    si
        call    cls_body_full
        mov     dx, 0x0000
        call    gotoxy
        pop     si
        call    puts_tty
        mov     dh, 22
        mov     dl, 2
        call    gotoxy
        mov     si, msg_donekey
        call    puts_hint
        call    getkey
        ret

; ============================================================================
;  DATA
; ============================================================================
sel        dw 0
top        dw 0
ri         dw 0
isel       dw 0          ; Easy-Setup icon selection
gcat       dw 0          ; graphical main-menu category index (0..NCATS-1)
gitem      dw 0          ; graphical sub-menu item index within category
box_row    db 0          ; text row for the selection outline
g_col      db 0          ; current g_puts colour (palette index)
tty_col    dw 0x0007     ; BIOS teletype colour (BL) for puts_tty/putc_tty
body_gfx   db 0          ; 1 = test/report pages render on a graphical mauve page
ic_x       dw 0          ; draw_icon target x
ic_y       dw 0          ; draw_icon target y
; --- icon-grid state ---
grid_n     dw 0
tile_i     dw 0
tile_sel   db 0
t_row      db 0
t_col      db 0
tx         dw 0
ty         dw 0
fr_x       dw 0
fr_y       dw 0
fr_w       dw 0
fr_h       dw 0
fr_col     db 0
fr_fill    db 0
bm_x       dw 0
bm_y       dw 0
bm_ww      dw 0
bm_h       dw 0
bm_r       dw 0
bm_w       dw 0
bm_c       dw 0
lbl_cc     dw 0
lbl_r0     db 0
lbl_len    dw 0
lbl_si     dw 0
lspl       dw 0
s_best   dw 0
half       dw 0
len2       dw 0
pn_n       dw 0
bc_str     dw 0
gidx       dw 0          ; global row index for per-item icon lookup
ls_p       dw 0          ; g_label: current line start ptr
ws_p       dw 0          ; g_label: next word start ptr
we_p       dw 0          ; g_label: current word end ptr
ll_cur     dw 0          ; g_label: current line length
wl_cur     dw 0          ; g_label: current word length
cur_row    db 0          ; g_label: current text row
nlines     db 0          ; g_label: lines drawn so far
font_seg   dw 0          ; ROM 8x16 font pointer (for gtext)
font_off   dw 0
gt_x       dw 0          ; gtext pixel position
gt_y       dw 0
gt_cx      dw 0          ; gtext char index
pkd_n      dw 0          ; picker: option count
pk_h       dw 0          ; picker: dialog height
pk_y       dw 0          ; picker: dialog top y
pk_oy      dw 0          ; picker: current option y
have_mouse db 0
mouse_mode db 0          ; 0=none, 1=INT 33h driver, 2=direct PS/2 (8042 aux + IRQ12)
mpkt_idx   db 0          ; direct: current byte index in the 3-byte packet
mpkt0      db 0
mpkt1      db 0
mpkt2      db 0
old_kbc    db 0          ; saved 8042 command byte
old_i12_off dw 0         ; saved IRQ12 (INT 0x74) vector
old_i12_seg dw 0
ev         db 0          ; last event: 0=key, 1=left click
ev_key     dw 0
ms_x       dw 0
ms_y       dw 0
mbtns      dw 0
ms_pbtn    db 0          ; previous left-button state
ms_prbtn   db 0          ; previous right-button state
cur_valid  db 0
cur_frame  db 0          ; wing-flap frame (0 = up/glide, 1 = down)
cur_fctr   db 0          ; flap animation counter (advances as the cursor moves)
cur_bp     dw 0          ; selected frame's outline / body bitmap pointers
cur_wp     dw 0
cur_off    dw 0          ; VRAM byte offset of the cursor's save/restore window
cur_rowb   dw 0          ; VRAM offset of the current blit row
cur_lx     dw 0
cur_ly     dw 0
cur_col    db 0
hit_col    dw 0
gsel_old   dw 0          ; previous selection index (incremental redraw)
need_full  db 1          ; 1 = repaint whole page (first draw / after mode reset)
tm_x       dw 0          ; test_mouse: accumulated X / Y deltas
tm_y       dw 0
tm_idx     db 0          ; test_mouse: packet-byte index (0..2)
tm_p0      db 0
tm_p1      db 0
tm_p2      db 0
sig_base   dw 0          ; test_sig: inking-pad I/O base (15E0/25E0/35E0)
sig_octl   db 0          ; saved control byte (base+2)
sig_idx    db 0          ; packet-byte index (0..2)
sig_b0     db 0
sig_b1     db 0
sig_b2     db 0
sig_pkts   dw 0          ; packets received
sig_rx     dw 0          ; decoded raw X / Y
sig_ry     dw 0
sig_sx     dw 0          ; screen X / Y of last pen sample
sig_sy     dw 0
sig_dd     db 0          ; last data byte (base+0)
sig_ctr    dw 0          ; readout throttle counter
sig_vec    db 0          ; inking IRQ interrupt-vector number
sig_oldveco dw 0         ; saved previous ISR (offset/segment)
sig_oldvecs dw 0
sig_mport  dw 0          ; PIC mask port (0x21 / 0xA1)
sig_mbit   db 0          ; PIC mask bit for the inking IRQ
sig_omask  db 0          ; saved PIC mask byte
sig_wr     db 0          ; ring write / read indices (ISR vs main loop)
sig_rd     db 0
sig_basetab dw 0x05E0, 0x15E0, 0x25E0, 0x35E0
sig_irqtab  db 3, 4, 10, 11, 12, 15, 5, 7
sig_cal    db 0          ; 1 = calibration capture in progress (no drawing)
cal_valid  db 0          ; 1 = a calibration has been captured
cal_xl     dw 0          ; raw X at the left / right pad edges
cal_xr     dw 0
cal_yt     dw 0          ; raw Y at the top / bottom pad edges
cal_yb     dw 0
cal_span   dw 0          ; cal_map scratch (target span)
cal_i      db 0          ; calibration corner index (BP is unsafe: g_fillrect uses it)
cal_ptx    times 4 dw 0  ; captured raw X/Y per corner (TL,TR,BL,BR)
cal_pty    times 4 dw 0
cal_corners dw 48,80, 592,80, 48,388, 592,388   ; target squares (field corners)
cal_prompts dw cal_p0, cal_p1, cal_p2, cal_p3
sig_ring   times 256 db 0
kb_ext     db 0          ; keyboard test: 0xE0 extended-code pending
kb_raw0    db 0          ; keyboard test: last 3 raw scancode bytes (readout)
kb_raw1    db 0
kb_raw2    db 0
kb_rawdirty db 0         ; keyboard test: raw readout needs refresh
kb_e1      db 0          ; keyboard test: bytes left to skip in a Pause (E1) seq
kb_exit    db 0          ; keyboard test: ESC released -> exit
kbd_wr     db 0          ; scancode ring (ISR writes, loop reads)
kbd_rd     db 0
kb_oldo    dw 0          ; saved INT 9 vector
kb_olds    dw 0
kb_lbl     dw 0          ; kbd_drawkey: current key's label pointer
kbd_ring   times 256 db 0
cur_buf    times 1024 db 0          ; saved bg under the cursor (CUR_W*CUR_H bytes)
foot_copy  db "(C) 2026 Ahmad Byagowi    -    github.com/ahmadexp/PS2GUI",0
t_ps2gui    db "PS2-GUI",0
foot_g_main db "UP/DN Select   ENTER Open   ESC Quit",0
foot_g_sub  db "UP/DN Select   ENTER Choose/Run   ESC Back",0
menu_catbase dw 0        ; category slice base (Config=0, Test=7)
menu_catn  dw 0          ; category slice length
menu_title dw m_config   ; menu title string ptr
ringcol    db 0
ringm      db 0
bx0        dw 0
by0        dw 0
bx1        dw 0
by1        dw 0
rx0        dw 0
ry0        dw 0
rx1        dw 0
ry1        dw 0
mm_tab     db 1, 2, 4, 8
m_config   db "Config",0
m_test     db "Test",0
m_backup   db "Backup",0
level      db 0          ; 0 = main (category) menu, 1 = submenu
cat_sel    dw 0          ; selected category (main menu)
sub_sel    dw 0          ; selected item within the category (submenu)
row_tmp    db 0          ; scratch: current screen row while drawing
lbl_tmp    dw 0          ; scratch: label pointer
desc_tmp   dw 0          ; scratch: description pointer
sel_attr   db 0          ; attribute for the current item row
desc_attr  db 0          ; attribute for the current description
cat_start  db 0          ; submenu: first row index of the category
cat_count  db 0          ; submenu: item count of the category
opt_base   dw 0
opt_sel    dw 0
opt_sel_tmp dw 0
cur_cmd    dw 0
cur_opt    dw 0
show_ptr   dw 0
tail_ptr   dw 0
bld_ptr    dw 0
pw_ok      db 0
pw_stat    db 0
pw_ac      db 0
pw_bat     db 0
pw_pct     db 0
pw_ver     dw 0
pw_flags   dw 0
pw_time    dw 0
pd_go      db 0
save_sp    dw 0
save_ss    dw 0
pk_n       dw 0
pk_row     dw 0
pk_i       dw 0
tmp_base   dw 0
fhandle    dw 0
dseg       dw 0
dchunks    dw 0
exec_prog  dw progname            ; program EXEC'd by do_exec (default PS2.EXE)
show_pfx   dw pfx_ps2             ; confirm-dialog display prefix (default "PS2 ")
ultra_mode db 0                   ; 1 while an ULTRACHG (charging) item is active
cpu_v      times 13 db 0          ; CPUID vendor string
cpu_sig    dw 0                   ; CPUID leaf-1 signature (low word)
cpu_feat   dw 0                   ; CPUID leaf-1 feature flags (low word of EDX)
dk_cx      dw 0                   ; INT 13h/08 returned CX (cyl/sectors)
dk_dx      dw 0                   ; INT 13h/08 returned DX (heads/#drives)
ptr_res    db 0                   ; pointing device: resolution code 0..3
ptr_rate   db 0                   ; pointing device: sample rate (reports/sec)
ptr_id     db 0                   ; pointing device: PS/2 device id
ptr_bat    db 0                   ; pointing device: reset self-test byte (AA=ok)
ptr_ok     db 0                   ; 1 if the aux device answered
ptr_cmdb   db 0                   ; saved 8042 command byte (restored on exit)
ptr_ridx   db 5                   ; index into pt_rates[] (5 = 100/s default)

; EXEC parameter block
parblk:
pb_env      dw 0
pb_tail_off dw 0
pb_tail_seg dw 0
pb_f1_off   dw 0
pb_f1_seg   dw 0
pb_f2_off   dw 0
pb_f2_seg   dw 0

progname   db "C:\PS2.EXE",0
ultra_prog db "C:\ULTRACHG.COM",0
pfx_cc     db " ",0                 ; child tail is just " <args>"
pfx_ps2    db "PS2 ",0
pfx_ultra  db "ULTRACHG ",0
fn_set     db "C:\PC110SET.BIN",0
cmd_rev    db "_@REVision",0

t_title    db "IBM PalmTop PC110  ",0xFA,"  System Manager  v",PS2TUI_VER,0
t_auth     db "by Ahmad Byagowi",0
foot_main  db "UP/DN Move  ENTER Open  B Battery  C Settings  R Rev  ESC/Q Quit",0
foot_sub   db "UP/DN Move  ENTER Select  ESC Back  Q Quit",0
cf_hdr     db "Current settings  (read live from CMOS)",0
cf_click   db "Keyboard click ...... ",0
cf_stat    db "LCD status panel .... ",0
cf_pmode   db "Power-saving mode ... ",0
cf_vexp    db "Vertical expand ..... ",0
cf_on      db "ON",0
cf_off     db "OFF",0
cf_auto    db "Auto",0
cf_time    db "Time",0
cf_batt    db "Battery",0
cf_high    db "High",0
cf_lowmed  db "Low/Medium",0
cf_note    db "(these read straight from CMOS 44/70/72 - no PS2.EXE)",0
pw_hdr     db "Power / Battery status  (live, via APM BIOS)",0
pw_l_apm   db "APM BIOS ....... ",0
pw_l_ver   db "   (APM spec ver ",0
pw_l_ac    db "AC line ........ ",0
pw_l_bat   db "Battery ........ ",0
pw_l_pct   db "Charge ......... ",0
pw_yes     db "present",0
pw_no      db "not present",0
pw_nostat  db "power status unavailable",0
pw_ac_off  db "Off-line (on battery)",0
pw_ac_on   db "On-line (AC adapter)",0
pw_ac_bak  db "On backup power",0
pw_b_high  db "High",0
pw_b_low   db "Low",0
pw_b_crit  db "Critical",0
pw_b_chg   db "Charging",0
pw_unk     db "Unknown",0
pk_title   db "Choose value:",0
cf_title   db "Run this command?",0
cf_prompt  db "Press Y to run, N to cancel",0
msg_running db "Running: ",0
msg_donekey db "--- done.  Press any key to return to PS2TUI ---",0
crlf       db 13,10,0

; ---- buffers ----
cmdshow    times 96 db 0        ; "PS2 ..." display
cmdtail    times 96 db 0        ; count,"/C PS2 ...",CR

; ============================================================================
;  ROWS TABLE  (each record: dw label, dw cmd, dw opts, db type)  = 7 bytes
; ============================================================================
%macro ROW 4
  dw %1, %2, %3
  db %4
%endmacro
%macro CAT 4              ; label, description, first-row-index, item-count
  dw %1, %2
  db %3, %4
%endmacro

rows:                     ; pure items, grouped by category (no header rows)
  ; -- Power & Battery (0..7) --
  ROW l_pmode, k_pmode, o_pmode, R_ITEM
  ROW l_susp,  k_power, o_min,   R_ITEM
  ROW l_lcdoff,k_lcd,   o_lcd,   R_ITEM
  ROW l_speed, k_speed, o_speed, R_ITEM
  ROW l_cover, k_cover, o_endis, R_ITEM
  ROW l_ring,  k_ri,    o_endis, R_ITEM
  ROW l_charge,0,       o_endis, R_UITEM
  ROW l_pdef,  k_default,0,      R_ACT
  ; -- Display (8..9) --
  ROW l_screen,k_screen,o_screen,R_ITEM
  ROW l_vexp,  k_vexp,  o_onoff, R_ITEM
  ; -- Devices (10..18) --
  ROW l_airq,  k_airq,  o_irq,   R_ITEM
  ROW l_adma,  k_adma,  o_dma,   R_ITEM
  ROW l_aadd,  k_aadd,  o_aadd,  R_ITEM
  ROW l_iirq,  k_iirq,  o_irq,   R_ITEM
  ROW l_iadd,  k_iadd,  o_iadd,  R_ITEM
  ROW l_ir,    k_ir,    o_com,   R_ITEM
  ROW l_ser,   k_ser,   o_com,   R_ITEM
  ROW l_imod,  k_imod,  o_com,   R_ITEM
  ROW l_pmod,  k_pmod,  o_com,   R_ITEM
  ; -- Keyboard & Pointer (19..23) --
  ROW l_click, k_click, o_onoff, R_ITEM
  ROW l_kspd,  k_kspd,  o_kspd,  R_ITEM
  ROW l_kdel,  k_kdel,  o_kdel,  R_ITEM
  ROW l_kdev,  k_kdev,  o_kdev,  R_ITEM
  ROW l_dptr,  diag_ptr, 0,      R_CALL
  ; -- Advanced (24..33) --
  ROW l_lpt,   k_lpt,   o_lpt,   R_ITEM
  ROW l_ata,   k_ata,   o_ata,   R_ITEM
  ROW l_pcic,  k_pcic,  o_endis, R_ITEM
  ROW l_pccd,  k_pccd,  o_endis, R_ITEM
  ROW l_stat,  k_stat,  o_stat,  R_ITEM
  ROW l_batt,  k_batt,  o_batt,  R_ITEM
  ROW l_fddpm, k_fddpm, o_endis, R_ITEM
  ROW l_irqc,  k_irqc,  o_endis, R_ITEM
  ROW l_tokn,  k_tokn,  o_tokn,  R_ITEM
  ROW l_comb,  k_comb,  o_comb,  R_ITEM
  ; -- Dumps & ROM (34..37) --
  ROW l_dbios,  dump_bios,  0, R_CALL
  ROW l_dvbios, dump_vbios, 0, R_CALL
  ROW l_dfont,  dump_font,  0, R_CALL
  ROW l_dcmos,  dump_cmos,  0, R_CALL
  ; -- System Test (38..45) --
  ROW l_tmem,   test_mem,   0, R_CALL
  ROW l_tvid,   test_vid,   0, R_CALL
  ROW l_tkbd,   test_kbd,   0, R_CALL
  ROW l_tspk,   test_spk,   0, R_CALL
  ROW l_tclk,   test_clock, 0, R_CALL
  ROW l_ttmr,   test_timer, 0, R_CALL
  ROW l_tmouse, test_mouse, 0, R_CALL
  ROW l_tsig,   test_sig,   0, R_CALL
  ; -- Diagnostics (46..50) --
  ROW l_diag,   diag_scan,  0, R_CALL
  ROW l_ddisk,  diag_disk,  0, R_CALL
  ROW l_dpwr,   diag_power, 0, R_CALL
  ROW l_dpcm,   diag_pcmcia,0, R_CALL
  ROW l_dcfg,   diag_scamp, 0, R_CALL
  ; -- Backup & Restore (49..50) --
  ROW l_bkup,   backup_settings,  0, R_CALL
  ROW l_rest,   restore_settings, 0, R_CALL
  ; -- Information (51..56) --
  ROW l_binfo,  show_power,  0, R_CALL
  ROW l_cinfo,  show_config, 0, R_CALL
  ROW l_rev,    0,0,            R_INFO
  ROW l_off,    k_off,   0,     R_ACT
  ROW l_hoff,   k_hoff,  0,     R_ACT
  ROW l_adef,   k_adef,  0,     R_ACT
rows_end:
ROWCOUNT equ (rows_end-rows)/7

; Categories in PS2TUI's EXACT order (label, desc, first-row-index, count).
; Config icon opens the whole list (== PS2TUI's menu); Test = slice [5..8),
; Backup = slice [8..9) are quick shortcuts into the same structure.
cats:
  CAT c_power,  d_power,  0,  8    ; 0 Power & Battery
  CAT c_disp,   d_disp,   8,  2    ; 1 Display
  CAT c_dev,    d_dev,    10, 9    ; 2 Devices
  CAT c_kbd,    d_kbd,    19, 5    ; 3 Keyboard & Pointer
  CAT c_adv,    d_adv,    24, 10   ; 4 Advanced
  CAT c_dump,   d_dump,   34, 4    ; 5 Dumps & ROM
  CAT c_test,   d_test,   38, 8    ; 6 System Test
  CAT c_diag,   d_diag,   46, 5    ; 7 Diagnostics
  CAT c_backup, d_backup, 51, 2    ; 8 Backup & Restore
  CAT c_info,   d_info,   53, 6    ; 9 Information
cats_end:
NCATS equ (cats_end-cats)/6

CFG_BASE  equ 0
CFG_N     equ 10       ; Config icon = the full PS2TUI menu (all categories)
TST_BASE  equ 5        ; Dumps & ROM
TST_N     equ 3        ; + System Test + Diagnostics
BKP_BASE  equ 8        ; Backup & Restore
BKP_N     equ 1

; ---- category labels + one-line descriptions (main menu) ----
c_power  db "Power & Battery",0
c_disp   db "Display",0
c_dev    db "Devices",0
c_kbd    db "Keyboard & Pointer",0
c_adv    db "Advanced",0
c_dump   db "Dumps & ROM",0
c_test   db "System Test",0
c_diag   db "Diagnostics",0
c_backup db "Backup & Restore",0
c_info   db "Information",0
d_power  db "Power saving, CPU speed, charging",0
d_disp   db "LCD / CRT output, vertical stretch",0
d_dev    db "Audio, digitizer, IR / serial / modem",0
d_kbd    db "Click, repeat rate, trackpad settings",0
d_adv    db "LPT, ATA, PCMCIA, battery, token-ring",0
d_dump   db "BIOS / video-BIOS / font-ROM images",0
d_test   db "RAM, video, keyboard, speaker, clock",0
d_diag   db "Live hardware probes & chipset config",0
d_backup db "Save / restore all CMOS settings",0
d_info   db "Battery, settings, firmware revisions",0
t_main   db "Main menu",0
l_binfo  db "Battery / AC status (live)",0
l_cinfo  db "Current settings (live)",0

; ---- item labels ----
l_pmode  db "Battery power-saving mode",0
l_susp   db "Auto-suspend after idle",0
l_lcdoff db "Screen off after idle",0
l_speed  db "CPU speed",0
l_cover  db "Suspend when cover closes",0
l_ring   db "Wake on phone ring",0
l_pdef   db "Reset basic settings to defaults",0
l_screen db "Display output",0
l_vexp   db "Stretch display (vertical expand)",0
l_airq   db "SoundBlaster IRQ",0
l_adma   db "SoundBlaster DMA",0
l_iirq   db "Digitizer (inking) IRQ",0
l_iadd   db "Digitizer (inking) I/O address",0
l_ir     db "Infrared port",0
l_ser    db "Serial port",0
l_imod   db "Internal modem port",0
l_pmod   db "PCMCIA modem port",0
l_click  db "Keyboard click sound",0
l_kspd   db "Keyboard typematic rate",0
l_kdel   db "Keyboard typematic delay",0
l_kdev   db "Keyboard device select",0
l_lpt    db "Parallel port mode",0
l_ata    db "IDE/ATA controller order",0
l_pcic   db "PCMCIA controller",0
l_pccd   db "Support 3V PCMCIA cards",0
l_stat   db "LCD status panel shows",0
l_batt   db "Battery charge profile",0
l_fddpm  db "Floppy power management",0
l_irqc   db "IRQ clear",0
l_tokn   db "Token-ring RIPL speed",0
l_comb   db "! COMB serial-mux device",0
l_aadd   db "SoundBlaster I/O address",0
l_dbios  db "Dump system BIOS  -> PC110BIO.BIN",0
l_dvbios db "Dump video BIOS   -> PC110VID.BIN",0
l_dfont  db "Dump font ROM     -> PC110FNT.BIN",0
l_dcmos  db "Dump CMOS/RTC RAM -> PC110CMO.BIN",0
l_tmem   db "Memory info + RAM test",0
l_tvid   db "Video / colour test",0
l_tkbd   db "Keyboard test",0
l_tspk   db "Speaker test (beep)",0
l_tclk   db "Real-time clock test (live)",0
l_ttmr   db "Timer (PIT) test",0
l_tmouse db "Pointing device test",0
l_tsig   db "Signature pad test",0
l_diag   db "Hardware scan / report",0
l_ddisk  db "Storage / disk info + read test",0
l_dpwr   db "Power / battery MCU detail",0
l_dpcm   db "PCMCIA socket status",0
l_dcfg   db "Chipset config (VL82C420)",0
l_dptr   db "Pointing device (identify + settings)",0
l_charge db "Charge while running",0
l_bkup   db "Back up CMOS settings  -> PC110SET.BIN",0
l_rest   db "Restore CMOS settings  <- PC110SET.BIN",0
l_rev    db "Show firmware revisions",0
l_off    db "! Suspend the PC110 now",0
l_hoff   db "! Power OFF the PC110 now",0
l_adef   db "! Reset ALL advanced settings",0

; ---- PS2 command words ----
k_pmode  db "PMODE",0
k_power  db "POWER",0
k_lcd    db "LCD",0
k_speed  db "SPEED",0
k_cover  db "COVER",0
k_ri     db "RI",0
k_default db "DEFAULT",0
k_screen db "SCREEN",0
k_vexp   db "VEXP",0
k_airq   db "IRQAUDIO",0
k_adma   db "DMAAUDIO",0
k_aadd   db "ADDAUdio",0
k_iirq   db "IRQINKING",0
k_iadd   db "ADDINKING",0
k_ir     db "IR",0
k_ser    db "SERIAL",0
k_imod   db "IMODEM",0
k_pmod   db "PMODEM",0
k_click  db "CLICK",0
k_kspd   db "_@KEYBOARD SPEED",0
k_kdel   db "_@KEYBOARD RESPONSE",0
k_kdev   db "_@KEYBOARD DEVICE",0
k_lpt    db "_@LPT",0
k_ata    db "_@ATA",0
k_pcic   db "_@PCIC",0
k_pccd   db "_@PCCD3V",0
k_stat   db "_@STATUS",0
k_batt   db "_@BATTERY",0
k_fddpm  db "_@FDDPM",0
k_irqc   db "_@IRQClear",0
k_tokn   db "_@Token ring",0
k_comb   db "_@COMB",0
k_off    db "OFF",0
k_hoff   db "_@OFF",0
k_adef   db "_@DEFAULT",0

; ---- option lists (ASCIIZ each, empty string terminates) ----
o_pmode  db "High",0,"Medium",0,"Low",0,0
o_min    db "0",0,"1",0,"3",0,"5",0,"10",0,"15",0,"30",0,"60",0,"99",0,0
o_lcd    db "0",0,"1",0,"3",0,"5",0,"10",0,"15",0,"17",0,0
o_speed  db "Fast",0,"Medium",0,"Slow",0,0
o_endis  db "Enable",0,"Disable",0,0
o_screen db "LCD",0,"CRT",0,0
o_onoff  db "ON",0,"OFF",0,0
o_irq    db "5",0,"10",0,"Disable",0,0
o_dma    db "1",0,"3",0,0
o_iadd   db "15E0",0,"25E0",0,"35E0",0,0
o_com    db "COM1=1",0,"COM2=2",0,"Off=Disable",0,0
o_kspd   db "Med",0,"Fast",0,0
o_kdel   db "Normal",0,"Long",0,0
o_kdev   db "Auto",0,"Both",0,0
o_lpt    db "BI",0,"UNI",0,"ECP",0,"EPP",0,0
o_ata    db "Primary",0,"Secondary",0,0
o_stat   db "Auto",0,"Time",0,"Battery",0,0
o_tokn   db "4Mbps",0,"16Mbps",0,0
o_comb   db "RS232",0,"IRda",0,"MIDI",0,"ASK",0,0
o_aadd   db "0220",0,0

; ---- dump / test strings ----
fn_bios   db "C:\PC110BIO.BIN",0
fn_vbios  db "C:\PC110VID.BIN",0
fn_font   db "C:\PC110FNT.BIN",0
fn_cmos   db "C:\PC110CMO.BIN",0
msg_dbios  db "Dumping system BIOS (F000, 64 KB) -> C:\PC110BIO.BIN ...",0
msg_dvbios db "Dumping video BIOS (C000, 32 KB) -> C:\PC110VID.BIN ...",0
msg_dfont  db "Dumping font ROM (1 MB, 128 banks) -> C:\PC110FNT.BIN ...",0
msg_dcmos  db "Dumping CMOS/RTC RAM (128 bytes, 0x00-0x7F) -> C:\PC110CMO.BIN ...",0
msg_ddone  db "Done.",0
msg_backup db "Backing up CMOS settings (0x10-0x7F) -> C:\PC110SET.BIN ...",0
msg_bdone  db "Done.  All CMOS-stored settings saved.",0
msg_restore db "Restore CMOS settings from C:\PC110SET.BIN",0
msg_rconf  db "Overwrite CMOS from backup?  Y = yes (reboot needed), any other key = cancel",0
msg_rcancel db "Cancelled.  CMOS not changed.",0
msg_rdone  db "Restored.  Reboot the PC110 for the settings to take effect.",0
msg_derr   db "ERROR: could not create the output file.",0
msg_tmem   db "Memory information and RAM test",0
tm_base    db "Conventional memory : ",0
tm_ext     db "Extended memory     : ",0
tm_kb      db " KB",0
tm_run     db "RAM pattern test (4 KB scratch) : ",0
tm_pass    db "PASS",0
tm_fail    db "*** FAIL ***",0
tv_title   db "Video / colour test  (16 fg blocks, 8 bg bars, char set)",0
tk_title   db "Keyboard test - press any key; ESC to exit",0
kb_title   db "Keyboard test - press each key; it stays lit once tested.  ESC = exit.",0
kb_rawlbl  db "raw scancodes: ",0
tk_scan    db "scancode = ",0
tk_ascii   db "   ascii = ",0
tk_char    db "   char = ",0
ts_title   db "Speaker test - you should hear a ~1 kHz beep",0
; ---- diagnostics strings ----
dg_hdr     db "Hardware diagnostics  (live probe)",0
dg_cpu     db "CPU ............ ",0
dg_486     db "486-class (pre-CPUID)",0
dg_fam     db "  fam ",0
dg_mdl     db " mdl ",0
dg_stp     db " stp ",0
dg_fpu     db "  FPU: ",0
dg_yes     db "yes",0
dg_no      db "no",0
dg_mem     db "Memory ......... ",0
dg_kb      db " KB",0
dg_ext     db "  ext ",0
dg_apm     db "APM BIOS ....... ",0
dg_bat     db "  batt ",0
dg_scamp   db "SCAMP VL82C420 . ",0
dg_pmcu    db "Power MCU (U6) . ",0
dg_pcic    db "PCMCIA PCIC .... ",0
dg_id      db "  id 0x",0
dg_font    db "Font ROM ....... ",0
dg_sigok   db "signature OK (55AA/FONT)",0
dg_signo   db "signature NOT found",0
dg_com1    db "COM1 UART ...... ",0
dg_rtc     db "RTC / CMOS ..... ",0
dg_present db "present",0
dg_absent  db "absent",0
dg_batok   db "battery OK",0
dg_batlo   db "battery LOW/dead",0
dg_postok  db ", no POST errors",0
dg_posterr db ", POST error flagged",0
; ---- clock / timer / mouse / disk / power-mcu / pcmcia strings ----
tc_title   db "Real-time clock test  (live, from the RTC)",0
tc_lbl     db "Now: ",0
tc_hint    db "(watch the seconds advance; press any key to exit)",0
tt_title   db "Timer (PIT) test",0
tt_meas    db "Measuring ~1 second via the BIOS tick counter ...",0
tt_res     db "PIT ticks in ~1 s: ",0
tt_exp     db "  (expected ~18)  - timer OK",0
ms_title   db "Pointing-device test",0
ms_inst    db "Mouse driver present.  Move the pointer / click:",0
ms_pos     db "  x,y = ",0
ms_btn     db "   buttons = ",0
ms_pad     db "      ",0
ms_none    db "No pointing-device driver loaded (INT 33h not installed).",0
ms_inst2   db "Move the pointer and press its buttons.  Any key exits.",0
ms_xl      db "X = ",0
ms_yl      db "    Y = ",0
ms_bl      db "    Buttons = ",0
ss_title   db "Signature / inking-pad test",0
ss_inst    db "Sign on the pad.  C = calibrate.  Any other key = exit.",0
cal_p0     db "Touch the pad's TOP-LEFT corner  (ESC cancels)         ",0
cal_p1     db "Touch the pad's TOP-RIGHT corner  (ESC cancels)        ",0
cal_p2     db "Touch the pad's BOTTOM-LEFT corner  (ESC cancels)      ",0
cal_p3     db "Touch the pad's BOTTOM-RIGHT corner  (ESC cancels)     ",0
cal_msg    db "Calibration saved.  Sign on the pad.                  ",0
cal_cxl    db "Calibration cancelled.                                ",0
ss_base    db "base=",0
ss_st      db "  IRQvec=",0
ss_dd      db "  data=",0
ss_pk      db "pkts=",0
ss_rx      db "  X=",0
ss_ry      db "  Y=",0
ss_pen     db "  pen=",0
warn_msg:
        db 13,10
        db "*** WARNING - IBM PalmTop PC110 (type 2431) ONLY ***",13,10,13,10
        db "PS2GUI drives PC110-specific hardware directly (SCAMP chipset,",13,10
        db "embedded controller, inking digitizer, CMOS, VGA registers, PS2.EXE).",13,10,13,10
        db "This machine does NOT look like a PC110.  Running PS2GUI on other",13,10
        db "hardware can misprogram those devices and MAY DAMAGE the computer.",13,10,13,10
        db "    ESC = quit (recommended)     F10 = run anyway, at your own risk",13,10
        db "$"
dk_title   db "Storage / disk diagnostics  (INT 13h, drive 80h)",0
dk_cyl     db "Cylinders: ",0
dk_hd      db "   Heads: ",0
dk_spt     db "   Sectors/track: ",0
dk_rd      db "Sector 0 read test: ",0
dk_ok      db "OK",0
dk_fail    db "FAILED",0
dk_nodrv   db "drive 80h not present / INT 13h error",0
pm_title   db "Power / battery MCU register file  (ports 0xEC/0xED)",0
pm_note    db "(live power/battery/thermal telemetry - regs 0x00-0x1F)",0
pc_title   db "PCMCIA sockets  (Intel 82365 PCIC, ports 0x3E0/0x3E1)",0
pc_id      db "Controller chip ID: 0x",0
pc_s0      db "Socket 0 status 0x",0
pc_s1      db "Socket 1 status 0x",0
pc_arrow   db "  ->  ",0
pc_card    db "card present",0
pc_empty   db "empty",0
cs_title   db "VL82C420 (SCAMP) config space  (0x74/0x76, unlocked live)",0
cs_note    db "idx 7A/7B = 'SL' signature.  Gate 0x22/0x23; read atomically.",0
patterns   db 0x55,0xAA,0xFF,0x00,0xFE
o_batt   db "Standard",0,"Other",0,0

; ---- pointing-device (trackpad U75) screen ----
pt_title   db "Pointing device  (trackpad U75, NEC uPD17137A - PS/2 aux)",0
pt_bat     db "Self-test ...... ",0
pt_pass    db "PASS (BAT OK)",0
pt_fail    db "unexpected reset code",0
pt_id      db "Device ID ...... 0x",0
pt_idstd   db "  (standard PS/2 mouse)",0
pt_res     db "Resolution ..... ",0
pt_cpermm  db " counts/mm",0
pt_rate    db "Sample rate .... ",0
pt_persec  db " reports/sec",0
pt_nodev   db "No response on the aux channel (trackpad absent/held off).",0
pt_keys1   db "R = cycle resolution     S = cycle sample rate",0
pt_keys2   db "T = reset / re-identify   ESC = back",0
pt_note    db "(live over the 8042 mouse aux; a mouse driver re-inits U75 on load)",0
pt_rates   db 10,20,40,60,80,100,200
PT_NRATES  equ 7

%include "TILES.INC"
%include "KBD.INC"
%include "ESDATA.INC"

; ----------------------------------------------------------------------------
; Scratch buffer: lives just past the end of the image, inside our 64 KB
; segment and below the stack (SP starts at 0xFFFE).  Used by the dumps,
; CMOS backup/restore and the RAM test.  It is NOT part of the .COM file.
; ----------------------------------------------------------------------------
scratch_area: