; xlaunch.asm -- create a *first-class* process whose entry is xhello.bin.
;
; The rdebug `jump` payload runs inside the "remote debug" process.  Hypothesis
; H3 is that this process context is not a valid X client; this launcher
; therefore calls the OS's own create_process so xhello runs in a fresh process
; with its own PCB, user area (fd table) and 0x6000-byte stack, exactly like the
; Telnet handler does at ROM 07EDA7A0 (bits 3F6D4340..3F6D4440):
;
;     create_process(entry="Telnet", name, 0x6000, 1, arg)
;
; create_process = bits 3F706A40 (Ghidra 07EE0D48).
;
; Markers (32-bit cells, bit addresses):
;   01860120  PCB returned by create_process (0 = failure)
;   01860140  stage (1 = entered, 2 = create_process returned)
;   01860400  entry A14
;   01860420  entry SP
;
; The new process runs xhello.bin, linked at bit 01840000 (built separately).

	.text
_start:
	setf	16, 0, 0
	setf	32, 0, 1
	mmtm	sp, a0,a1,a2,a3,a4,a5,a6,a7

	move	sp, @01860420h, 1	; entry SP
	move	a14, @01860400h, 1	; entry A14

	movi	1, a0, L
	move	a0, @01860140h, 1	; stage = 1

	; ---- create_process(0x01840000, "0::0", 0x6000, 1, 0) ----------
	; Arguments are pushed last-first, upward through A14, as everywhere
	; else in this firmware.
	move	a14, -*sp, 1
	movi	01862000h, a14, L
	movi	0, a0, L
	move	a0, *a14+, 1		; arg4 = 0 (process argument)
	movi	1, a0, L
	move	a0, *a14+, 1		; arg3 = 1
	movi	06000h, a0, L
	move	a0, *a14+, 1		; arg2 = stack size
	movi	3F30DC00h, a0, L	; ROM "0::0" (any short name will do)
	move	a0, *a14+, 1		; arg1 = name
	movi	01840000h, a0, L	; xhello entry
	move	a0, *a14+, 1		; arg0 = entry
	calla	3F706A40h		; create_process
	move	@01860420h, sp, 1
	move	@01860400h, a14, 1

	move	a8, @01860120h, 1	; MARK PCB
	movi	2, a0, L
	move	a0, @01860140h, 1	; stage = 2

done:
	mmfm	sp, a0,a1,a2,a3,a4,a5,a6,a7
	movi	0, a8, L
	rets
	.end