locore.s revision 187948
1/*-
2 * Copyright (c) 1990 The Regents of the University of California.
3 * All rights reserved.
4 *
5 * This code is derived from software contributed to Berkeley by
6 * William Jolitz.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 * 4. Neither the name of the University nor the names of its contributors
17 *    may be used to endorse or promote products derived from this software
18 *    without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 *
32 *	from: @(#)locore.s	7.3 (Berkeley) 5/13/91
33 * $FreeBSD: head/sys/i386/i386/locore.s 187948 2009-01-31 11:37:21Z obrien $
34 *
35 *		originally from: locore.s, by William F. Jolitz
36 *
37 *		Substantially rewritten by David Greenman, Rod Grimes,
38 *			Bruce Evans, Wolfgang Solfrank, Poul-Henning Kamp
39 *			and many others.
40 */
41
42#include "opt_bootp.h"
43#include "opt_compat.h"
44#include "opt_nfsroot.h"
45#include "opt_pmap.h"
46
47#include <sys/syscall.h>
48#include <sys/reboot.h>
49
50#include <machine/asmacros.h>
51#include <machine/cputypes.h>
52#include <machine/psl.h>
53#include <machine/pmap.h>
54#include <machine/specialreg.h>
55
56#include "assym.s"
57
58/*
59 *	XXX
60 *
61 * Note: This version greatly munged to avoid various assembler errors
62 * that may be fixed in newer versions of gas. Perhaps newer versions
63 * will have more pleasant appearance.
64 */
65
66/*
67 * PTmap is recursive pagemap at top of virtual address space.
68 * Within PTmap, the page directory can be found (third indirection).
69 */
70	.globl	PTmap,PTD,PTDpde
71	.set	PTmap,(PTDPTDI << PDRSHIFT)
72	.set	PTD,PTmap + (PTDPTDI * PAGE_SIZE)
73	.set	PTDpde,PTD + (PTDPTDI * PDESIZE)
74
75/*
76 * Compiled KERNBASE location and the kernel load address
77 */
78	.globl	kernbase
79	.set	kernbase,KERNBASE
80	.globl	kernload
81	.set	kernload,KERNLOAD
82
83/*
84 * Globals
85 */
86	.data
87	ALIGN_DATA			/* just to be sure */
88
89	.space	0x2000			/* space for tmpstk - temporary stack */
90tmpstk:
91
92	.globl	bootinfo
93bootinfo:	.space	BOOTINFO_SIZE	/* bootinfo that we can handle */
94
95		.globl KERNend
96KERNend:	.long	0		/* phys addr end of kernel (just after bss) */
97physfree:	.long	0		/* phys addr of next free page */
98
99	.globl	IdlePTD
100IdlePTD:	.long	0		/* phys addr of kernel PTD */
101
102#ifdef PAE
103	.globl	IdlePDPT
104IdlePDPT:	.long	0		/* phys addr of kernel PDPT */
105#endif
106
107#ifdef SMP
108	.globl	KPTphys
109#endif
110KPTphys:	.long	0		/* phys addr of kernel page tables */
111
112	.globl	proc0kstack
113proc0uarea:	.long	0		/* address of proc 0 uarea (unused)*/
114proc0kstack:	.long	0		/* address of proc 0 kstack space */
115p0upa:		.long	0		/* phys addr of proc0 UAREA (unused) */
116p0kpa:		.long	0		/* phys addr of proc0's STACK */
117
118vm86phystk:	.long	0		/* PA of vm86/bios stack */
119
120	.globl	vm86paddr, vm86pa
121vm86paddr:	.long	0		/* address of vm86 region */
122vm86pa:		.long	0		/* phys addr of vm86 region */
123
124#ifdef PC98
125	.globl	pc98_system_parameter
126pc98_system_parameter:
127	.space	0x240
128#endif
129
130/**********************************************************************
131 *
132 * Some handy macros
133 *
134 */
135
136#define R(foo) ((foo)-KERNBASE)
137
138#define ALLOCPAGES(foo) \
139	movl	R(physfree), %esi ; \
140	movl	$((foo)*PAGE_SIZE), %eax ; \
141	addl	%esi, %eax ; \
142	movl	%eax, R(physfree) ; \
143	movl	%esi, %edi ; \
144	movl	$((foo)*PAGE_SIZE),%ecx ; \
145	xorl	%eax,%eax ; \
146	cld ; \
147	rep ; \
148	stosb
149
150/*
151 * fillkpt
152 *	eax = page frame address
153 *	ebx = index into page table
154 *	ecx = how many pages to map
155 * 	base = base address of page dir/table
156 *	prot = protection bits
157 */
158#define	fillkpt(base, prot)		  \
159	shll	$PTESHIFT,%ebx		; \
160	addl	base,%ebx		; \
161	orl	$PG_V,%eax		; \
162	orl	prot,%eax		; \
1631:	movl	%eax,(%ebx)		; \
164	addl	$PAGE_SIZE,%eax		; /* increment physical address */ \
165	addl	$PTESIZE,%ebx		; /* next pte */ \
166	loop	1b
167
168/*
169 * fillkptphys(prot)
170 *	eax = physical address
171 *	ecx = how many pages to map
172 *	prot = protection bits
173 */
174#define	fillkptphys(prot)		  \
175	movl	%eax, %ebx		; \
176	shrl	$PAGE_SHIFT, %ebx	; \
177	fillkpt(R(KPTphys), prot)
178
179	.text
180/**********************************************************************
181 *
182 * This is where the bootblocks start us, set the ball rolling...
183 *
184 */
185NON_GPROF_ENTRY(btext)
186
187#ifdef PC98
188	/* save SYSTEM PARAMETER for resume (NS/T or other) */
189	movl	$0xa1400,%esi
190	movl	$R(pc98_system_parameter),%edi
191	movl	$0x0240,%ecx
192	cld
193	rep
194	movsb
195#else	/* IBM-PC */
196/* Tell the bios to warmboot next time */
197	movw	$0x1234,0x472
198#endif	/* PC98 */
199
200/* Set up a real frame in case the double return in newboot is executed. */
201	pushl	%ebp
202	movl	%esp, %ebp
203
204/* Don't trust what the BIOS gives for eflags. */
205	pushl	$PSL_KERNEL
206	popfl
207
208/*
209 * Don't trust what the BIOS gives for %fs and %gs.  Trust the bootstrap
210 * to set %cs, %ds, %es and %ss.
211 */
212	mov	%ds, %ax
213	mov	%ax, %fs
214	mov	%ax, %gs
215
216/*
217 * Clear the bss.  Not all boot programs do it, and it is our job anyway.
218 *
219 * XXX we don't check that there is memory for our bss and page tables
220 * before using it.
221 *
222 * Note: we must be careful to not overwrite an active gdt or idt.  They
223 * inactive from now until we switch to new ones, since we don't load any
224 * more segment registers or permit interrupts until after the switch.
225 */
226	movl	$R(end),%ecx
227	movl	$R(edata),%edi
228	subl	%edi,%ecx
229	xorl	%eax,%eax
230	cld
231	rep
232	stosb
233
234	call	recover_bootinfo
235
236/* Get onto a stack that we can trust. */
237/*
238 * XXX this step is delayed in case recover_bootinfo needs to return via
239 * the old stack, but it need not be, since recover_bootinfo actually
240 * returns via the old frame.
241 */
242	movl	$R(tmpstk),%esp
243
244#ifdef PC98
245	/* pc98_machine_type & M_EPSON_PC98 */
246	testb	$0x02,R(pc98_system_parameter)+220
247	jz	3f
248	/* epson_machine_id <= 0x0b */
249	cmpb	$0x0b,R(pc98_system_parameter)+224
250	ja	3f
251
252	/* count up memory */
253	movl	$0x100000,%eax		/* next, talley remaining memory */
254	movl	$0xFFF-0x100,%ecx
2551:	movl	0(%eax),%ebx		/* save location to check */
256	movl	$0xa55a5aa5,0(%eax)	/* write test pattern */
257	cmpl	$0xa55a5aa5,0(%eax)	/* does not check yet for rollover */
258	jne	2f
259	movl	%ebx,0(%eax)		/* restore memory */
260	addl	$PAGE_SIZE,%eax
261	loop	1b
2622:	subl	$0x100000,%eax
263	shrl	$17,%eax
264	movb	%al,R(pc98_system_parameter)+1
2653:
266
267	movw	R(pc98_system_parameter+0x86),%ax
268	movw	%ax,R(cpu_id)
269#endif
270
271	call	identify_cpu
272	call	create_pagetables
273
274/*
275 * If the CPU has support for VME, turn it on.
276 */
277	testl	$CPUID_VME, R(cpu_feature)
278	jz	1f
279	movl	%cr4, %eax
280	orl	$CR4_VME, %eax
281	movl	%eax, %cr4
2821:
283
284/* Now enable paging */
285#ifdef PAE
286	movl	R(IdlePDPT), %eax
287	movl	%eax, %cr3
288	movl	%cr4, %eax
289	orl	$CR4_PAE, %eax
290	movl	%eax, %cr4
291#else
292	movl	R(IdlePTD), %eax
293	movl	%eax,%cr3		/* load ptd addr into mmu */
294#endif
295	movl	%cr0,%eax		/* get control word */
296	orl	$CR0_PE|CR0_PG,%eax	/* enable paging */
297	movl	%eax,%cr0		/* and let's page NOW! */
298
299	pushl	$begin			/* jump to high virtualized address */
300	ret
301
302/* now running relocated at KERNBASE where the system is linked to run */
303begin:
304	/* set up bootstrap stack */
305	movl	proc0kstack,%eax	/* location of in-kernel stack */
306			/* bootstrap stack end location */
307	leal	(KSTACK_PAGES*PAGE_SIZE-PCB_SIZE)(%eax),%esp
308
309	xorl	%ebp,%ebp		/* mark end of frames */
310
311#ifdef PAE
312	movl	IdlePDPT,%esi
313#else
314	movl	IdlePTD,%esi
315#endif
316	movl	%esi,(KSTACK_PAGES*PAGE_SIZE-PCB_SIZE+PCB_CR3)(%eax)
317
318	pushl	physfree		/* value of first for init386(first) */
319	call	init386			/* wire 386 chip for unix operation */
320
321	/*
322	 * Clean up the stack in a way that db_numargs() understands, so
323	 * that backtraces in ddb don't underrun the stack.  Traps for
324	 * inaccessible memory are more fatal than usual this early.
325	 */
326	addl	$4,%esp
327
328	call	mi_startup		/* autoconfiguration, mountroot etc */
329	/* NOTREACHED */
330	addl	$0,%esp			/* for db_numargs() again */
331
332/*
333 * Signal trampoline, copied to top of user stack
334 */
335NON_GPROF_ENTRY(sigcode)
336	calll	*SIGF_HANDLER(%esp)
337	leal	SIGF_UC(%esp),%eax	/* get ucontext */
338	pushl	%eax
339	testl	$PSL_VM,UC_EFLAGS(%eax)
340	jne	1f
341	mov	UC_GS(%eax),%gs		/* restore %gs */
3421:
343	movl	$SYS_sigreturn,%eax
344	pushl	%eax			/* junk to fake return addr. */
345	int	$0x80			/* enter kernel with args */
346					/* on stack */
3471:
348	jmp	1b
349
350#ifdef COMPAT_FREEBSD4
351	ALIGN_TEXT
352freebsd4_sigcode:
353	calll	*SIGF_HANDLER(%esp)
354	leal	SIGF_UC4(%esp),%eax	/* get ucontext */
355	pushl	%eax
356	testl	$PSL_VM,UC4_EFLAGS(%eax)
357	jne	1f
358	mov	UC4_GS(%eax),%gs	/* restore %gs */
3591:
360	movl	$344,%eax		/* 4.x SYS_sigreturn */
361	pushl	%eax			/* junk to fake return addr. */
362	int	$0x80			/* enter kernel with args */
363					/* on stack */
3641:
365	jmp	1b
366#endif
367
368#ifdef COMPAT_43
369	ALIGN_TEXT
370osigcode:
371	call	*SIGF_HANDLER(%esp)	/* call signal handler */
372	lea	SIGF_SC(%esp),%eax	/* get sigcontext */
373	pushl	%eax
374	testl	$PSL_VM,SC_PS(%eax)
375	jne	9f
376	mov	SC_GS(%eax),%gs		/* restore %gs */
3779:
378	movl	$103,%eax		/* 3.x SYS_sigreturn */
379	pushl	%eax			/* junk to fake return addr. */
380	int	$0x80			/* enter kernel with args */
3810:	jmp	0b
382#endif /* COMPAT_43 */
383
384	ALIGN_TEXT
385esigcode:
386
387	.data
388	.globl	szsigcode
389szsigcode:
390	.long	esigcode-sigcode
391#ifdef COMPAT_FREEBSD4
392	.globl	szfreebsd4_sigcode
393szfreebsd4_sigcode:
394	.long	esigcode-freebsd4_sigcode
395#endif
396#ifdef COMPAT_43
397	.globl	szosigcode
398szosigcode:
399	.long	esigcode-osigcode
400#endif
401	.text
402
403/**********************************************************************
404 *
405 * Recover the bootinfo passed to us from the boot program
406 *
407 */
408recover_bootinfo:
409	/*
410	 * This code is called in different ways depending on what loaded
411	 * and started the kernel.  This is used to detect how we get the
412	 * arguments from the other code and what we do with them.
413	 *
414	 * Old disk boot blocks:
415	 *	(*btext)(howto, bootdev, cyloffset, esym);
416	 *	[return address == 0, and can NOT be returned to]
417	 *	[cyloffset was not supported by the FreeBSD boot code
418	 *	 and always passed in as 0]
419	 *	[esym is also known as total in the boot code, and
420	 *	 was never properly supported by the FreeBSD boot code]
421	 *
422	 * Old diskless netboot code:
423	 *	(*btext)(0,0,0,0,&nfsdiskless,0,0,0);
424	 *	[return address != 0, and can NOT be returned to]
425	 *	If we are being booted by this code it will NOT work,
426	 *	so we are just going to halt if we find this case.
427	 *
428	 * New uniform boot code:
429	 *	(*btext)(howto, bootdev, 0, 0, 0, &bootinfo)
430	 *	[return address != 0, and can be returned to]
431	 *
432	 * There may seem to be a lot of wasted arguments in here, but
433	 * that is so the newer boot code can still load very old kernels
434	 * and old boot code can load new kernels.
435	 */
436
437	/*
438	 * The old style disk boot blocks fake a frame on the stack and
439	 * did an lret to get here.  The frame on the stack has a return
440	 * address of 0.
441	 */
442	cmpl	$0,4(%ebp)
443	je	olddiskboot
444
445	/*
446	 * We have some form of return address, so this is either the
447	 * old diskless netboot code, or the new uniform code.  That can
448	 * be detected by looking at the 5th argument, if it is 0
449	 * we are being booted by the new uniform boot code.
450	 */
451	cmpl	$0,24(%ebp)
452	je	newboot
453
454	/*
455	 * Seems we have been loaded by the old diskless boot code, we
456	 * don't stand a chance of running as the diskless structure
457	 * changed considerably between the two, so just halt.
458	 */
459	 hlt
460
461	/*
462	 * We have been loaded by the new uniform boot code.
463	 * Let's check the bootinfo version, and if we do not understand
464	 * it we return to the loader with a status of 1 to indicate this error
465	 */
466newboot:
467	movl	28(%ebp),%ebx		/* &bootinfo.version */
468	movl	BI_VERSION(%ebx),%eax
469	cmpl	$1,%eax			/* We only understand version 1 */
470	je	1f
471	movl	$1,%eax			/* Return status */
472	leave
473	/*
474	 * XXX this returns to our caller's caller (as is required) since
475	 * we didn't set up a frame and our caller did.
476	 */
477	ret
478
4791:
480	/*
481	 * If we have a kernelname copy it in
482	 */
483	movl	BI_KERNELNAME(%ebx),%esi
484	cmpl	$0,%esi
485	je	2f			/* No kernelname */
486	movl	$MAXPATHLEN,%ecx	/* Brute force!!! */
487	movl	$R(kernelname),%edi
488	cmpb	$'/',(%esi)		/* Make sure it starts with a slash */
489	je	1f
490	movb	$'/',(%edi)
491	incl	%edi
492	decl	%ecx
4931:
494	cld
495	rep
496	movsb
497
4982:
499	/*
500	 * Determine the size of the boot loader's copy of the bootinfo
501	 * struct.  This is impossible to do properly because old versions
502	 * of the struct don't contain a size field and there are 2 old
503	 * versions with the same version number.
504	 */
505	movl	$BI_ENDCOMMON,%ecx	/* prepare for sizeless version */
506	testl	$RB_BOOTINFO,8(%ebp)	/* bi_size (and bootinfo) valid? */
507	je	got_bi_size		/* no, sizeless version */
508	movl	BI_SIZE(%ebx),%ecx
509got_bi_size:
510
511	/*
512	 * Copy the common part of the bootinfo struct
513	 */
514	movl	%ebx,%esi
515	movl	$R(bootinfo),%edi
516	cmpl	$BOOTINFO_SIZE,%ecx
517	jbe	got_common_bi_size
518	movl	$BOOTINFO_SIZE,%ecx
519got_common_bi_size:
520	cld
521	rep
522	movsb
523
524#ifdef NFS_ROOT
525#ifndef BOOTP_NFSV3
526	/*
527	 * If we have a nfs_diskless structure copy it in
528	 */
529	movl	BI_NFS_DISKLESS(%ebx),%esi
530	cmpl	$0,%esi
531	je	olddiskboot
532	movl	$R(nfs_diskless),%edi
533	movl	$NFSDISKLESS_SIZE,%ecx
534	cld
535	rep
536	movsb
537	movl	$R(nfs_diskless_valid),%edi
538	movl	$1,(%edi)
539#endif
540#endif
541
542	/*
543	 * The old style disk boot.
544	 *	(*btext)(howto, bootdev, cyloffset, esym);
545	 * Note that the newer boot code just falls into here to pick
546	 * up howto and bootdev, cyloffset and esym are no longer used
547	 */
548olddiskboot:
549	movl	8(%ebp),%eax
550	movl	%eax,R(boothowto)
551	movl	12(%ebp),%eax
552	movl	%eax,R(bootdev)
553
554	ret
555
556
557/**********************************************************************
558 *
559 * Identify the CPU and initialize anything special about it
560 *
561 */
562identify_cpu:
563
564	/* Try to toggle alignment check flag; does not exist on 386. */
565	pushfl
566	popl	%eax
567	movl	%eax,%ecx
568	orl	$PSL_AC,%eax
569	pushl	%eax
570	popfl
571	pushfl
572	popl	%eax
573	xorl	%ecx,%eax
574	andl	$PSL_AC,%eax
575	pushl	%ecx
576	popfl
577
578	testl	%eax,%eax
579	jnz	try486
580
581	/* NexGen CPU does not have aligment check flag. */
582	pushfl
583	movl	$0x5555, %eax
584	xorl	%edx, %edx
585	movl	$2, %ecx
586	clc
587	divl	%ecx
588	jz	trynexgen
589	popfl
590	movl	$CPU_386,R(cpu)
591	jmp	3f
592
593trynexgen:
594	popfl
595	movl	$CPU_NX586,R(cpu)
596	movl	$0x4778654e,R(cpu_vendor)	# store vendor string
597	movl	$0x72446e65,R(cpu_vendor+4)
598	movl	$0x6e657669,R(cpu_vendor+8)
599	movl	$0,R(cpu_vendor+12)
600	jmp	3f
601
602try486:	/* Try to toggle identification flag; does not exist on early 486s. */
603	pushfl
604	popl	%eax
605	movl	%eax,%ecx
606	xorl	$PSL_ID,%eax
607	pushl	%eax
608	popfl
609	pushfl
610	popl	%eax
611	xorl	%ecx,%eax
612	andl	$PSL_ID,%eax
613	pushl	%ecx
614	popfl
615
616	testl	%eax,%eax
617	jnz	trycpuid
618	movl	$CPU_486,R(cpu)
619
620	/*
621	 * Check Cyrix CPU
622	 * Cyrix CPUs do not change the undefined flags following
623	 * execution of the divide instruction which divides 5 by 2.
624	 *
625	 * Note: CPUID is enabled on M2, so it passes another way.
626	 */
627	pushfl
628	movl	$0x5555, %eax
629	xorl	%edx, %edx
630	movl	$2, %ecx
631	clc
632	divl	%ecx
633	jnc	trycyrix
634	popfl
635	jmp	3f		/* You may use Intel CPU. */
636
637trycyrix:
638	popfl
639	/*
640	 * IBM Bluelighting CPU also doesn't change the undefined flags.
641	 * Because IBM doesn't disclose the information for Bluelighting
642	 * CPU, we couldn't distinguish it from Cyrix's (including IBM
643	 * brand of Cyrix CPUs).
644	 */
645	movl	$0x69727943,R(cpu_vendor)	# store vendor string
646	movl	$0x736e4978,R(cpu_vendor+4)
647	movl	$0x64616574,R(cpu_vendor+8)
648	jmp	3f
649
650trycpuid:	/* Use the `cpuid' instruction. */
651	xorl	%eax,%eax
652	cpuid					# cpuid 0
653	movl	%eax,R(cpu_high)		# highest capability
654	movl	%ebx,R(cpu_vendor)		# store vendor string
655	movl	%edx,R(cpu_vendor+4)
656	movl	%ecx,R(cpu_vendor+8)
657	movb	$0,R(cpu_vendor+12)
658
659	movl	$1,%eax
660	cpuid					# cpuid 1
661	movl	%eax,R(cpu_id)			# store cpu_id
662	movl	%ebx,R(cpu_procinfo)		# store cpu_procinfo
663	movl	%edx,R(cpu_feature)		# store cpu_feature
664	movl	%ecx,R(cpu_feature2)		# store cpu_feature2
665	rorl	$8,%eax				# extract family type
666	andl	$15,%eax
667	cmpl	$5,%eax
668	jae	1f
669
670	/* less than Pentium; must be 486 */
671	movl	$CPU_486,R(cpu)
672	jmp	3f
6731:
674	/* a Pentium? */
675	cmpl	$5,%eax
676	jne	2f
677	movl	$CPU_586,R(cpu)
678	jmp	3f
6792:
680	/* Greater than Pentium...call it a Pentium Pro */
681	movl	$CPU_686,R(cpu)
6823:
683	ret
684
685
686/**********************************************************************
687 *
688 * Create the first page directory and its page tables.
689 *
690 */
691
692create_pagetables:
693
694/* Find end of kernel image (rounded up to a page boundary). */
695	movl	$R(_end),%esi
696
697/* Include symbols, if any. */
698	movl	R(bootinfo+BI_ESYMTAB),%edi
699	testl	%edi,%edi
700	je	over_symalloc
701	movl	%edi,%esi
702	movl	$KERNBASE,%edi
703	addl	%edi,R(bootinfo+BI_SYMTAB)
704	addl	%edi,R(bootinfo+BI_ESYMTAB)
705over_symalloc:
706
707/* If we are told where the end of the kernel space is, believe it. */
708	movl	R(bootinfo+BI_KERNEND),%edi
709	testl	%edi,%edi
710	je	no_kernend
711	movl	%edi,%esi
712no_kernend:
713
714	addl	$PDRMASK,%esi		/* Play conservative for now, and */
715	andl	$~PDRMASK,%esi		/*   ... wrap to next 4M. */
716	movl	%esi,R(KERNend)		/* save end of kernel */
717	movl	%esi,R(physfree)	/* next free page is at end of kernel */
718
719/* Allocate Kernel Page Tables */
720	ALLOCPAGES(NKPT)
721	movl	%esi,R(KPTphys)
722
723/* Allocate Page Table Directory */
724#ifdef PAE
725	/* XXX only need 32 bytes (easier for now) */
726	ALLOCPAGES(1)
727	movl	%esi,R(IdlePDPT)
728#endif
729	ALLOCPAGES(NPGPTD)
730	movl	%esi,R(IdlePTD)
731
732/* Allocate KSTACK */
733	ALLOCPAGES(KSTACK_PAGES)
734	movl	%esi,R(p0kpa)
735	addl	$KERNBASE, %esi
736	movl	%esi, R(proc0kstack)
737
738	ALLOCPAGES(1)			/* vm86/bios stack */
739	movl	%esi,R(vm86phystk)
740
741	ALLOCPAGES(3)			/* pgtable + ext + IOPAGES */
742	movl	%esi,R(vm86pa)
743	addl	$KERNBASE, %esi
744	movl	%esi, R(vm86paddr)
745
746/*
747 * Enable PSE and PGE.
748 */
749#ifndef DISABLE_PSE
750	testl	$CPUID_PSE, R(cpu_feature)
751	jz	1f
752	movl	$PG_PS, R(pseflag)
753	movl	%cr4, %eax
754	orl	$CR4_PSE, %eax
755	movl	%eax, %cr4
7561:
757#endif
758#ifndef DISABLE_PG_G
759	testl	$CPUID_PGE, R(cpu_feature)
760	jz	2f
761	movl	$PG_G, R(pgeflag)
762	movl	%cr4, %eax
763	orl	$CR4_PGE, %eax
764	movl	%eax, %cr4
7652:
766#endif
767
768/*
769 * Initialize page table pages mapping physical address zero through the
770 * end of the kernel.  All of the page table entries allow read and write
771 * access.  Write access to the first physical page is required by bios32
772 * calls, and write access to the first 1 MB of physical memory is required
773 * by ACPI for implementing suspend and resume.  We do this even
774 * if we've enabled PSE above, we'll just switch the corresponding kernel
775 * PDEs before we turn on paging.
776 *
777 * XXX: We waste some pages here in the PSE case!  DON'T BLINDLY REMOVE
778 * THIS!  SMP needs the page table to be there to map the kernel P==V.
779 */
780	xorl	%eax, %eax
781	movl	R(KERNend),%ecx
782	shrl	$PAGE_SHIFT,%ecx
783	fillkptphys($PG_RW)
784
785/* Map page directory. */
786#ifdef PAE
787	movl	R(IdlePDPT), %eax
788	movl	$1, %ecx
789	fillkptphys($PG_RW)
790#endif
791
792	movl	R(IdlePTD), %eax
793	movl	$NPGPTD, %ecx
794	fillkptphys($PG_RW)
795
796/* Map proc0's KSTACK in the physical way ... */
797	movl	R(p0kpa), %eax
798	movl	$(KSTACK_PAGES), %ecx
799	fillkptphys($PG_RW)
800
801/* Map ISA hole */
802	movl	$ISA_HOLE_START, %eax
803	movl	$ISA_HOLE_LENGTH>>PAGE_SHIFT, %ecx
804	fillkptphys($PG_RW)
805
806/* Map space for the vm86 region */
807	movl	R(vm86phystk), %eax
808	movl	$4, %ecx
809	fillkptphys($PG_RW)
810
811/* Map page 0 into the vm86 page table */
812	movl	$0, %eax
813	movl	$0, %ebx
814	movl	$1, %ecx
815	fillkpt(R(vm86pa), $PG_RW|PG_U)
816
817/* ...likewise for the ISA hole */
818	movl	$ISA_HOLE_START, %eax
819	movl	$ISA_HOLE_START>>PAGE_SHIFT, %ebx
820	movl	$ISA_HOLE_LENGTH>>PAGE_SHIFT, %ecx
821	fillkpt(R(vm86pa), $PG_RW|PG_U)
822
823/*
824 * Create an identity mapping for low physical memory, including the kernel.
825 * The part of this mapping that covers the first 1 MB of physical memory
826 * becomes a permanent part of the kernel's address space.  The rest of this
827 * mapping is destroyed in pmap_bootstrap().  Ordinarily, the same page table
828 * pages are shared by the identity mapping and the kernel's native mapping.
829 * However, the permanent identity mapping cannot contain PG_G mappings.
830 * Thus, if the kernel is loaded within the permanent identity mapping, that
831 * page table page must be duplicated and not shared.
832 *
833 * N.B. Due to errata concerning large pages and physical address zero,
834 * a PG_PS mapping is not used.
835 */
836	movl	R(KPTphys), %eax
837	xorl	%ebx, %ebx
838	movl	$NKPT, %ecx
839	fillkpt(R(IdlePTD), $PG_RW)
840#if KERNLOAD < (1 << PDRSHIFT)
841	testl	$PG_G, R(pgeflag)
842	jz	1f
843	ALLOCPAGES(1)
844	movl	%esi, %edi
845	movl	R(IdlePTD), %eax
846	movl	(%eax), %esi
847	movl	%edi, (%eax)
848	movl	$PAGE_SIZE, %ecx
849	cld
850	rep
851	movsb
8521:
853#endif
854
855/*
856 * For the non-PSE case, install PDEs for PTs covering the KVA.
857 * For the PSE case, do the same, but clobber the ones corresponding
858 * to the kernel (from btext to KERNend) with 4M (2M for PAE) ('PS')
859 * PDEs immediately after.
860 */
861	movl	R(KPTphys), %eax
862	movl	$KPTDI, %ebx
863	movl	$NKPT, %ecx
864	fillkpt(R(IdlePTD), $PG_RW)
865	cmpl	$0,R(pseflag)
866	je	done_pde
867
868	movl	R(KERNend), %ecx
869	movl	$KERNLOAD, %eax
870	subl	%eax, %ecx
871	shrl	$PDRSHIFT, %ecx
872	movl	$(KPTDI+(KERNLOAD/(1 << PDRSHIFT))), %ebx
873	shll	$PDESHIFT, %ebx
874	addl	R(IdlePTD), %ebx
875	orl	$(PG_V|PG_RW|PG_PS), %eax
8761:	movl	%eax, (%ebx)
877	addl	$(1 << PDRSHIFT), %eax
878	addl	$PDESIZE, %ebx
879	loop	1b
880
881done_pde:
882/* install a pde recursively mapping page directory as a page table */
883	movl	R(IdlePTD), %eax
884	movl	$PTDPTDI, %ebx
885	movl	$NPGPTD,%ecx
886	fillkpt(R(IdlePTD), $PG_RW)
887
888#ifdef PAE
889	movl	R(IdlePTD), %eax
890	xorl	%ebx, %ebx
891	movl	$NPGPTD, %ecx
892	fillkpt(R(IdlePDPT), $0x0)
893#endif
894
895	ret
896