locore.s revision 64529
1/*-
2 * Copyright (c) 1990 The Regents of the University of California.
3 * All rights reserved.
4 *
5 * This code is derived from software contributed to Berkeley by
6 * William Jolitz.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 * 3. All advertising materials mentioning features or use of this software
17 *    must display the following acknowledgement:
18 *	This product includes software developed by the University of
19 *	California, Berkeley and its contributors.
20 * 4. Neither the name of the University nor the names of its contributors
21 *    may be used to endorse or promote products derived from this software
22 *    without specific prior written permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 *
36 *	from: @(#)locore.s	7.3 (Berkeley) 5/13/91
37 * $FreeBSD: head/sys/i386/i386/locore.s 64529 2000-08-11 09:05:12Z peter $
38 *
39 *		originally from: locore.s, by William F. Jolitz
40 *
41 *		Substantially rewritten by David Greenman, Rod Grimes,
42 *			Bruce Evans, Wolfgang Solfrank, Poul-Henning Kamp
43 *			and many others.
44 */
45
46#include "opt_bootp.h"
47#include "opt_nfsroot.h"
48
49#include <sys/syscall.h>
50#include <sys/reboot.h>
51
52#include <machine/asmacros.h>
53#include <machine/cputypes.h>
54#include <machine/psl.h>
55#include <machine/pmap.h>
56#include <machine/specialreg.h>
57
58#include "assym.s"
59
60/*
61 *	XXX
62 *
63 * Note: This version greatly munged to avoid various assembler errors
64 * that may be fixed in newer versions of gas. Perhaps newer versions
65 * will have more pleasant appearance.
66 */
67
68/*
69 * PTmap is recursive pagemap at top of virtual address space.
70 * Within PTmap, the page directory can be found (third indirection).
71 */
72	.globl	_PTmap,_PTD,_PTDpde
73	.set	_PTmap,(PTDPTDI << PDRSHIFT)
74	.set	_PTD,_PTmap + (PTDPTDI * PAGE_SIZE)
75	.set	_PTDpde,_PTD + (PTDPTDI * PDESIZE)
76
77/*
78 * APTmap, APTD is the alternate recursive pagemap.
79 * It's used when modifying another process's page tables.
80 */
81	.globl	_APTmap,_APTD,_APTDpde
82	.set	_APTmap,APTDPTDI << PDRSHIFT
83	.set	_APTD,_APTmap + (APTDPTDI * PAGE_SIZE)
84	.set	_APTDpde,_PTD + (APTDPTDI * PDESIZE)
85
86/*
87 * Globals
88 */
89	.data
90	ALIGN_DATA		/* just to be sure */
91
92	.globl	HIDENAME(tmpstk)
93	.space	0x2000		/* space for tmpstk - temporary stack */
94HIDENAME(tmpstk):
95
96	.globl	_boothowto,_bootdev
97
98	.globl	_cpu,_cpu_vendor,_cpu_id,_bootinfo
99	.globl	_cpu_high, _cpu_feature
100
101_cpu:		.long	0			/* are we 386, 386sx, or 486 */
102_cpu_id:	.long	0			/* stepping ID */
103_cpu_high:	.long	0			/* highest arg to CPUID */
104_cpu_feature:	.long	0			/* features */
105_cpu_vendor:	.space	20			/* CPU origin code */
106_bootinfo:	.space	BOOTINFO_SIZE		/* bootinfo that we can handle */
107
108_KERNend:	.long	0			/* phys addr end of kernel (just after bss) */
109physfree:	.long	0			/* phys addr of next free page */
110
111#ifdef SMP
112		.globl	_cpu0prvpage
113cpu0pp:		.long	0			/* phys addr cpu0 private pg */
114_cpu0prvpage:	.long	0			/* relocated version */
115
116		.globl	_SMPpt
117SMPptpa:	.long	0			/* phys addr SMP page table */
118_SMPpt:		.long	0			/* relocated version */
119#endif /* SMP */
120
121	.globl	_IdlePTD
122_IdlePTD:	.long	0			/* phys addr of kernel PTD */
123
124#ifdef SMP
125	.globl	_KPTphys
126#endif
127_KPTphys:	.long	0			/* phys addr of kernel page tables */
128
129	.globl	_proc0paddr
130_proc0paddr:	.long	0			/* address of proc 0 address space */
131p0upa:		.long	0			/* phys addr of proc0's UPAGES */
132
133vm86phystk:	.long	0			/* PA of vm86/bios stack */
134
135	.globl	_vm86paddr, _vm86pa
136_vm86paddr:	.long	0			/* address of vm86 region */
137_vm86pa:	.long	0			/* phys addr of vm86 region */
138
139#ifdef BDE_DEBUGGER
140	.globl	_bdb_exists			/* flag to indicate BDE debugger is present */
141_bdb_exists:	.long	0
142#endif
143
144#ifdef PC98
145	.globl	_pc98_system_parameter
146_pc98_system_parameter:
147	.space	0x240
148#endif
149
150/**********************************************************************
151 *
152 * Some handy macros
153 *
154 */
155
156#define R(foo) ((foo)-KERNBASE)
157
158#define ALLOCPAGES(foo) \
159	movl	R(physfree), %esi ; \
160	movl	$((foo)*PAGE_SIZE), %eax ; \
161	addl	%esi, %eax ; \
162	movl	%eax, R(physfree) ; \
163	movl	%esi, %edi ; \
164	movl	$((foo)*PAGE_SIZE),%ecx ; \
165	xorl	%eax,%eax ; \
166	cld ; \
167	rep ; \
168	stosb
169
170/*
171 * fillkpt
172 *	eax = page frame address
173 *	ebx = index into page table
174 *	ecx = how many pages to map
175 * 	base = base address of page dir/table
176 *	prot = protection bits
177 */
178#define	fillkpt(base, prot)		  \
179	shll	$2,%ebx			; \
180	addl	base,%ebx		; \
181	orl	$PG_V,%eax		; \
182	orl	prot,%eax		; \
1831:	movl	%eax,(%ebx)		; \
184	addl	$PAGE_SIZE,%eax		; /* increment physical address */ \
185	addl	$4,%ebx			; /* next pte */ \
186	loop	1b
187
188/*
189 * fillkptphys(prot)
190 *	eax = physical address
191 *	ecx = how many pages to map
192 *	prot = protection bits
193 */
194#define	fillkptphys(prot)		  \
195	movl	%eax, %ebx		; \
196	shrl	$PAGE_SHIFT, %ebx	; \
197	fillkpt(R(_KPTphys), prot)
198
199	.text
200/**********************************************************************
201 *
202 * This is where the bootblocks start us, set the ball rolling...
203 *
204 */
205NON_GPROF_ENTRY(btext)
206
207#ifdef PC98
208	/* save SYSTEM PARAMETER for resume (NS/T or other) */
209	movl	$0xa1400,%esi
210	movl	$R(_pc98_system_parameter),%edi
211	movl	$0x0240,%ecx
212	cld
213	rep
214	movsb
215#else	/* IBM-PC */
216#ifdef BDE_DEBUGGER
217#ifdef BIOS_STEALS_3K
218	cmpl	$0x0375c339,0x95504
219#else
220	cmpl	$0x0375c339,0x96104	/* XXX - debugger signature */
221#endif
222	jne	1f
223	movb	$1,R(_bdb_exists)
2241:
225#endif
226/* Tell the bios to warmboot next time */
227	movw	$0x1234,0x472
228#endif	/* PC98 */
229
230/* Set up a real frame in case the double return in newboot is executed. */
231	pushl	%ebp
232	movl	%esp, %ebp
233
234/* Don't trust what the BIOS gives for eflags. */
235	pushl	$PSL_KERNEL
236	popfl
237
238/*
239 * Don't trust what the BIOS gives for %fs and %gs.  Trust the bootstrap
240 * to set %cs, %ds, %es and %ss.
241 */
242	mov	%ds, %ax
243	mov	%ax, %fs
244	mov	%ax, %gs
245
246	call	recover_bootinfo
247
248/* Get onto a stack that we can trust. */
249/*
250 * XXX this step is delayed in case recover_bootinfo needs to return via
251 * the old stack, but it need not be, since recover_bootinfo actually
252 * returns via the old frame.
253 */
254	movl	$R(HIDENAME(tmpstk)),%esp
255
256#ifdef PC98
257	/* pc98_machine_type & M_EPSON_PC98 */
258	testb	$0x02,R(_pc98_system_parameter)+220
259	jz	3f
260	/* epson_machine_id <= 0x0b */
261	cmpb	$0x0b,R(_pc98_system_parameter)+224
262	ja	3f
263
264	/* count up memory */
265	movl	$0x100000,%eax		/* next, talley remaining memory */
266	movl	$0xFFF-0x100,%ecx
2671:	movl	0(%eax),%ebx		/* save location to check */
268	movl	$0xa55a5aa5,0(%eax)	/* write test pattern */
269	cmpl	$0xa55a5aa5,0(%eax)	/* does not check yet for rollover */
270	jne	2f
271	movl	%ebx,0(%eax)		/* restore memory */
272	addl	$PAGE_SIZE,%eax
273	loop	1b
2742:	subl	$0x100000,%eax
275	shrl	$17,%eax
276	movb	%al,R(_pc98_system_parameter)+1
2773:
278
279	movw	R(_pc98_system_parameter+0x86),%ax
280	movw	%ax,R(_cpu_id)
281#endif
282
283	call	identify_cpu
284
285/* clear bss */
286/*
287 * XXX this should be done a little earlier.
288 *
289 * XXX we don't check that there is memory for our bss and page tables
290 * before using it.
291 *
292 * XXX the boot program somewhat bogusly clears the bss.  We still have
293 * to do it in case we were unzipped by kzipboot.  Then the boot program
294 * only clears kzipboot's bss.
295 *
296 * XXX the gdt and idt are still somewhere in the boot program.  We
297 * depend on the convention that the boot program is below 1MB and we
298 * are above 1MB to keep the gdt and idt  away from the bss and page
299 * tables.  The idt is only used if BDE_DEBUGGER is enabled.
300 */
301	movl	$R(_end),%ecx
302	movl	$R(_edata),%edi
303	subl	%edi,%ecx
304	xorl	%eax,%eax
305	cld
306	rep
307	stosb
308
309	call	create_pagetables
310
311/*
312 * If the CPU has support for VME, turn it on.
313 */
314	testl	$CPUID_VME, R(_cpu_feature)
315	jz	1f
316	movl	%cr4, %eax
317	orl	$CR4_VME, %eax
318	movl	%eax, %cr4
3191:
320
321#ifdef BDE_DEBUGGER
322/*
323 * Adjust as much as possible for paging before enabling paging so that the
324 * adjustments can be traced.
325 */
326	call	bdb_prepare_paging
327#endif
328
329/* Now enable paging */
330	movl	R(_IdlePTD), %eax
331	movl	%eax,%cr3			/* load ptd addr into mmu */
332	movl	%cr0,%eax			/* get control word */
333	orl	$CR0_PE|CR0_PG,%eax		/* enable paging */
334	movl	%eax,%cr0			/* and let's page NOW! */
335
336#ifdef BDE_DEBUGGER
337/*
338 * Complete the adjustments for paging so that we can keep tracing through
339 * initi386() after the low (physical) addresses for the gdt and idt become
340 * invalid.
341 */
342	call	bdb_commit_paging
343#endif
344
345	pushl	$begin				/* jump to high virtualized address */
346	ret
347
348/* now running relocated at KERNBASE where the system is linked to run */
349begin:
350	/* set up bootstrap stack */
351	movl	_proc0paddr,%esp	/* location of in-kernel pages */
352	addl	$UPAGES*PAGE_SIZE,%esp	/* bootstrap stack end location */
353	xorl	%eax,%eax			/* mark end of frames */
354	movl	%eax,%ebp
355	movl	_proc0paddr,%eax
356	movl	_IdlePTD, %esi
357	movl	%esi,PCB_CR3(%eax)
358
359	movl	physfree, %esi
360	pushl	%esi				/* value of first for init386(first) */
361	call	_init386			/* wire 386 chip for unix operation */
362	popl	%esi
363
364	call	_mi_startup			/* autoconfiguration, mountroot etc */
365
366	hlt		/* never returns to here */
367
368/*
369 * Signal trampoline, copied to top of user stack
370 */
371NON_GPROF_ENTRY(sigcode)
372	call	*SIGF_HANDLER(%esp)		/* call signal handler */
373	lea	SIGF_UC(%esp),%eax		/* get ucontext_t */
374	pushl	%eax
375	testl	$PSL_VM,UC_EFLAGS(%eax)
376	jne	9f
377	movl	UC_GS(%eax),%gs			/* restore %gs */
3789:
379	movl	$SYS_sigreturn,%eax
380	pushl	%eax				/* junk to fake return addr. */
381	int	$0x80				/* enter kernel with args */
3820:	jmp	0b
383
384	ALIGN_TEXT
385_osigcode:
386	call	*SIGF_HANDLER(%esp)		/* call signal handler */
387	lea	SIGF_SC(%esp),%eax		/* get sigcontext */
388	pushl	%eax
389	testl	$PSL_VM,SC_PS(%eax)
390	jne	9f
391	movl	SC_GS(%eax),%gs			/* restore %gs */
3929:
393	movl	$0x01d516,SC_TRAPNO(%eax)	/* magic: 0ldSiG */
394	movl	$SYS_sigreturn,%eax
395	pushl	%eax				/* junk to fake return addr. */
396	int	$0x80				/* enter kernel with args */
3970:	jmp	0b
398
399	ALIGN_TEXT
400_esigcode:
401
402	.data
403	.globl	_szsigcode, _szosigcode
404_szsigcode:
405	.long	_esigcode-_sigcode
406_szosigcode:
407	.long	_esigcode-_osigcode
408	.text
409
410/**********************************************************************
411 *
412 * Recover the bootinfo passed to us from the boot program
413 *
414 */
415recover_bootinfo:
416	/*
417	 * This code is called in different ways depending on what loaded
418	 * and started the kernel.  This is used to detect how we get the
419	 * arguments from the other code and what we do with them.
420	 *
421	 * Old disk boot blocks:
422	 *	(*btext)(howto, bootdev, cyloffset, esym);
423	 *	[return address == 0, and can NOT be returned to]
424	 *	[cyloffset was not supported by the FreeBSD boot code
425	 *	 and always passed in as 0]
426	 *	[esym is also known as total in the boot code, and
427	 *	 was never properly supported by the FreeBSD boot code]
428	 *
429	 * Old diskless netboot code:
430	 *	(*btext)(0,0,0,0,&nfsdiskless,0,0,0);
431	 *	[return address != 0, and can NOT be returned to]
432	 *	If we are being booted by this code it will NOT work,
433	 *	so we are just going to halt if we find this case.
434	 *
435	 * New uniform boot code:
436	 *	(*btext)(howto, bootdev, 0, 0, 0, &bootinfo)
437	 *	[return address != 0, and can be returned to]
438	 *
439	 * There may seem to be a lot of wasted arguments in here, but
440	 * that is so the newer boot code can still load very old kernels
441	 * and old boot code can load new kernels.
442	 */
443
444	/*
445	 * The old style disk boot blocks fake a frame on the stack and
446	 * did an lret to get here.  The frame on the stack has a return
447	 * address of 0.
448	 */
449	cmpl	$0,4(%ebp)
450	je	olddiskboot
451
452	/*
453	 * We have some form of return address, so this is either the
454	 * old diskless netboot code, or the new uniform code.  That can
455	 * be detected by looking at the 5th argument, if it is 0
456	 * we are being booted by the new uniform boot code.
457	 */
458	cmpl	$0,24(%ebp)
459	je	newboot
460
461	/*
462	 * Seems we have been loaded by the old diskless boot code, we
463	 * don't stand a chance of running as the diskless structure
464	 * changed considerably between the two, so just halt.
465	 */
466	 hlt
467
468	/*
469	 * We have been loaded by the new uniform boot code.
470	 * Let's check the bootinfo version, and if we do not understand
471	 * it we return to the loader with a status of 1 to indicate this error
472	 */
473newboot:
474	movl	28(%ebp),%ebx		/* &bootinfo.version */
475	movl	BI_VERSION(%ebx),%eax
476	cmpl	$1,%eax			/* We only understand version 1 */
477	je	1f
478	movl	$1,%eax			/* Return status */
479	leave
480	/*
481	 * XXX this returns to our caller's caller (as is required) since
482	 * we didn't set up a frame and our caller did.
483	 */
484	ret
485
4861:
487	/*
488	 * If we have a kernelname copy it in
489	 */
490	movl	BI_KERNELNAME(%ebx),%esi
491	cmpl	$0,%esi
492	je	2f			/* No kernelname */
493	movl	$MAXPATHLEN,%ecx	/* Brute force!!! */
494	movl	$R(_kernelname),%edi
495	cmpb	$'/',(%esi)		/* Make sure it starts with a slash */
496	je	1f
497	movb	$'/',(%edi)
498	incl	%edi
499	decl	%ecx
5001:
501	cld
502	rep
503	movsb
504
5052:
506	/*
507	 * Determine the size of the boot loader's copy of the bootinfo
508	 * struct.  This is impossible to do properly because old versions
509	 * of the struct don't contain a size field and there are 2 old
510	 * versions with the same version number.
511	 */
512	movl	$BI_ENDCOMMON,%ecx	/* prepare for sizeless version */
513	testl	$RB_BOOTINFO,8(%ebp)	/* bi_size (and bootinfo) valid? */
514	je	got_bi_size		/* no, sizeless version */
515	movl	BI_SIZE(%ebx),%ecx
516got_bi_size:
517
518	/*
519	 * Copy the common part of the bootinfo struct
520	 */
521	movl	%ebx,%esi
522	movl	$R(_bootinfo),%edi
523	cmpl	$BOOTINFO_SIZE,%ecx
524	jbe	got_common_bi_size
525	movl	$BOOTINFO_SIZE,%ecx
526got_common_bi_size:
527	cld
528	rep
529	movsb
530
531#ifdef NFS_ROOT
532#ifndef BOOTP_NFSV3
533	/*
534	 * If we have a nfs_diskless structure copy it in
535	 */
536	movl	BI_NFS_DISKLESS(%ebx),%esi
537	cmpl	$0,%esi
538	je	olddiskboot
539	movl	$R(_nfs_diskless),%edi
540	movl	$NFSDISKLESS_SIZE,%ecx
541	cld
542	rep
543	movsb
544	movl	$R(_nfs_diskless_valid),%edi
545	movl	$1,(%edi)
546#endif
547#endif
548
549	/*
550	 * The old style disk boot.
551	 *	(*btext)(howto, bootdev, cyloffset, esym);
552	 * Note that the newer boot code just falls into here to pick
553	 * up howto and bootdev, cyloffset and esym are no longer used
554	 */
555olddiskboot:
556	movl	8(%ebp),%eax
557	movl	%eax,R(_boothowto)
558	movl	12(%ebp),%eax
559	movl	%eax,R(_bootdev)
560
561	ret
562
563
564/**********************************************************************
565 *
566 * Identify the CPU and initialize anything special about it
567 *
568 */
569identify_cpu:
570
571	/* Try to toggle alignment check flag; does not exist on 386. */
572	pushfl
573	popl	%eax
574	movl	%eax,%ecx
575	orl	$PSL_AC,%eax
576	pushl	%eax
577	popfl
578	pushfl
579	popl	%eax
580	xorl	%ecx,%eax
581	andl	$PSL_AC,%eax
582	pushl	%ecx
583	popfl
584
585	testl	%eax,%eax
586	jnz	try486
587
588	/* NexGen CPU does not have aligment check flag. */
589	pushfl
590	movl	$0x5555, %eax
591	xorl	%edx, %edx
592	movl	$2, %ecx
593	clc
594	divl	%ecx
595	jz	trynexgen
596	popfl
597	movl	$CPU_386,R(_cpu)
598	jmp	3f
599
600trynexgen:
601	popfl
602	movl	$CPU_NX586,R(_cpu)
603	movl	$0x4778654e,R(_cpu_vendor)	# store vendor string
604	movl	$0x72446e65,R(_cpu_vendor+4)
605	movl	$0x6e657669,R(_cpu_vendor+8)
606	movl	$0,R(_cpu_vendor+12)
607	jmp	3f
608
609try486:	/* Try to toggle identification flag; does not exist on early 486s. */
610	pushfl
611	popl	%eax
612	movl	%eax,%ecx
613	xorl	$PSL_ID,%eax
614	pushl	%eax
615	popfl
616	pushfl
617	popl	%eax
618	xorl	%ecx,%eax
619	andl	$PSL_ID,%eax
620	pushl	%ecx
621	popfl
622
623	testl	%eax,%eax
624	jnz	trycpuid
625	movl	$CPU_486,R(_cpu)
626
627	/*
628	 * Check Cyrix CPU
629	 * Cyrix CPUs do not change the undefined flags following
630	 * execution of the divide instruction which divides 5 by 2.
631	 *
632	 * Note: CPUID is enabled on M2, so it passes another way.
633	 */
634	pushfl
635	movl	$0x5555, %eax
636	xorl	%edx, %edx
637	movl	$2, %ecx
638	clc
639	divl	%ecx
640	jnc	trycyrix
641	popfl
642	jmp	3f		/* You may use Intel CPU. */
643
644trycyrix:
645	popfl
646	/*
647	 * IBM Bluelighting CPU also doesn't change the undefined flags.
648	 * Because IBM doesn't disclose the information for Bluelighting
649	 * CPU, we couldn't distinguish it from Cyrix's (including IBM
650	 * brand of Cyrix CPUs).
651	 */
652	movl	$0x69727943,R(_cpu_vendor)	# store vendor string
653	movl	$0x736e4978,R(_cpu_vendor+4)
654	movl	$0x64616574,R(_cpu_vendor+8)
655	jmp	3f
656
657trycpuid:	/* Use the `cpuid' instruction. */
658	xorl	%eax,%eax
659	.byte	0x0f,0xa2			# cpuid 0
660	movl	%eax,R(_cpu_high)		# highest capability
661	movl	%ebx,R(_cpu_vendor)		# store vendor string
662	movl	%edx,R(_cpu_vendor+4)
663	movl	%ecx,R(_cpu_vendor+8)
664	movb	$0,R(_cpu_vendor+12)
665
666	movl	$1,%eax
667	.byte	0x0f,0xa2			# cpuid 1
668	movl	%eax,R(_cpu_id)			# store cpu_id
669	movl	%edx,R(_cpu_feature)		# store cpu_feature
670	rorl	$8,%eax				# extract family type
671	andl	$15,%eax
672	cmpl	$5,%eax
673	jae	1f
674
675	/* less than Pentium; must be 486 */
676	movl	$CPU_486,R(_cpu)
677	jmp	3f
6781:
679	/* a Pentium? */
680	cmpl	$5,%eax
681	jne	2f
682	movl	$CPU_586,R(_cpu)
683	jmp	3f
6842:
685	/* Greater than Pentium...call it a Pentium Pro */
686	movl	$CPU_686,R(_cpu)
6873:
688	ret
689
690
691/**********************************************************************
692 *
693 * Create the first page directory and its page tables.
694 *
695 */
696
697create_pagetables:
698
699	testl	$CPUID_PGE, R(_cpu_feature)
700	jz	1f
701	movl	%cr4, %eax
702	orl	$CR4_PGE, %eax
703	movl	%eax, %cr4
7041:
705
706/* Find end of kernel image (rounded up to a page boundary). */
707	movl	$R(_end),%esi
708
709/* Include symbols, if any. */
710	movl	R(_bootinfo+BI_ESYMTAB),%edi
711	testl	%edi,%edi
712	je	over_symalloc
713	movl	%edi,%esi
714	movl	$KERNBASE,%edi
715	addl	%edi,R(_bootinfo+BI_SYMTAB)
716	addl	%edi,R(_bootinfo+BI_ESYMTAB)
717over_symalloc:
718
719/* If we are told where the end of the kernel space is, believe it. */
720	movl	R(_bootinfo+BI_KERNEND),%edi
721	testl	%edi,%edi
722	je	no_kernend
723	movl	%edi,%esi
724no_kernend:
725
726	addl	$PAGE_MASK,%esi
727	andl	$~PAGE_MASK,%esi
728	movl	%esi,R(_KERNend)	/* save end of kernel */
729	movl	%esi,R(physfree)	/* next free page is at end of kernel */
730
731/* Allocate Kernel Page Tables */
732	ALLOCPAGES(NKPT)
733	movl	%esi,R(_KPTphys)
734
735/* Allocate Page Table Directory */
736	ALLOCPAGES(1)
737	movl	%esi,R(_IdlePTD)
738
739/* Allocate UPAGES */
740	ALLOCPAGES(UPAGES)
741	movl	%esi,R(p0upa)
742	addl	$KERNBASE, %esi
743	movl	%esi, R(_proc0paddr)
744
745	ALLOCPAGES(1)			/* vm86/bios stack */
746	movl	%esi,R(vm86phystk)
747
748	ALLOCPAGES(3)			/* pgtable + ext + IOPAGES */
749	movl	%esi,R(_vm86pa)
750	addl	$KERNBASE, %esi
751	movl	%esi, R(_vm86paddr)
752
753#ifdef SMP
754/* Allocate cpu0's private data page */
755	ALLOCPAGES(1)
756	movl	%esi,R(cpu0pp)
757	addl	$KERNBASE, %esi
758	movl	%esi, R(_cpu0prvpage)	/* relocated to KVM space */
759
760/* Allocate SMP page table page */
761	ALLOCPAGES(1)
762	movl	%esi,R(SMPptpa)
763	addl	$KERNBASE, %esi
764	movl	%esi, R(_SMPpt)		/* relocated to KVM space */
765#endif	/* SMP */
766
767/* Map read-only from zero to the end of the kernel text section */
768	xorl	%eax, %eax
769#ifdef BDE_DEBUGGER
770/* If the debugger is present, actually map everything read-write. */
771	cmpl	$0,R(_bdb_exists)
772	jne	map_read_write
773#endif
774	xorl	%edx,%edx
775
776#if !defined(SMP)
777	testl	$CPUID_PGE, R(_cpu_feature)
778	jz	2f
779	orl	$PG_G,%edx
780#endif
781
7822:	movl	$R(_etext),%ecx
783	addl	$PAGE_MASK,%ecx
784	shrl	$PAGE_SHIFT,%ecx
785	fillkptphys(%edx)
786
787/* Map read-write, data, bss and symbols */
788	movl	$R(_etext),%eax
789	addl	$PAGE_MASK, %eax
790	andl	$~PAGE_MASK, %eax
791map_read_write:
792	movl	$PG_RW,%edx
793#if !defined(SMP)
794	testl	$CPUID_PGE, R(_cpu_feature)
795	jz	1f
796	orl	$PG_G,%edx
797#endif
798
7991:	movl	R(_KERNend),%ecx
800	subl	%eax,%ecx
801	shrl	$PAGE_SHIFT,%ecx
802	fillkptphys(%edx)
803
804/* Map page directory. */
805	movl	R(_IdlePTD), %eax
806	movl	$1, %ecx
807	fillkptphys($PG_RW)
808
809/* Map proc0's UPAGES in the physical way ... */
810	movl	R(p0upa), %eax
811	movl	$UPAGES, %ecx
812	fillkptphys($PG_RW)
813
814/* Map ISA hole */
815	movl	$ISA_HOLE_START, %eax
816	movl	$ISA_HOLE_LENGTH>>PAGE_SHIFT, %ecx
817	fillkptphys($PG_RW)
818
819/* Map space for the vm86 region */
820	movl	R(vm86phystk), %eax
821	movl	$4, %ecx
822	fillkptphys($PG_RW)
823
824/* Map page 0 into the vm86 page table */
825	movl	$0, %eax
826	movl	$0, %ebx
827	movl	$1, %ecx
828	fillkpt(R(_vm86pa), $PG_RW|PG_U)
829
830/* ...likewise for the ISA hole */
831	movl	$ISA_HOLE_START, %eax
832	movl	$ISA_HOLE_START>>PAGE_SHIFT, %ebx
833	movl	$ISA_HOLE_LENGTH>>PAGE_SHIFT, %ecx
834	fillkpt(R(_vm86pa), $PG_RW|PG_U)
835
836#ifdef SMP
837/* Map cpu0's private page into global kmem (4K @ cpu0prvpage) */
838	movl	R(cpu0pp), %eax
839	movl	$1, %ecx
840	fillkptphys($PG_RW)
841
842/* Map SMP page table page into global kmem FWIW */
843	movl	R(SMPptpa), %eax
844	movl	$1, %ecx
845	fillkptphys($PG_RW)
846
847/* Map the private page into the SMP page table */
848	movl	R(cpu0pp), %eax
849	movl	$0, %ebx		/* pte offset = 0 */
850	movl	$1, %ecx		/* one private page coming right up */
851	fillkpt(R(SMPptpa), $PG_RW)
852
853/* ... and put the page table table in the pde. */
854	movl	R(SMPptpa), %eax
855	movl	$MPPTDI, %ebx
856	movl	$1, %ecx
857	fillkpt(R(_IdlePTD), $PG_RW)
858
859/* Fakeup VA for the local apic to allow early traps. */
860	ALLOCPAGES(1)
861	movl	%esi, %eax
862	movl	$(NPTEPG-1), %ebx	/* pte offset = NTEPG-1 */
863	movl	$1, %ecx		/* one private pt coming right up */
864	fillkpt(R(SMPptpa), $PG_RW)
865
866/* Initialize mp lock to allow early traps */
867	movl	$1, R(_mp_lock)
868#endif	/* SMP */
869
870/* install a pde for temporary double map of bottom of VA */
871	movl	R(_KPTphys), %eax
872	xorl	%ebx, %ebx
873	movl	$1, %ecx
874	fillkpt(R(_IdlePTD), $PG_RW)
875
876/* install pde's for pt's */
877	movl	R(_KPTphys), %eax
878	movl	$KPTDI, %ebx
879	movl	$NKPT, %ecx
880	fillkpt(R(_IdlePTD), $PG_RW)
881
882/* install a pde recursively mapping page directory as a page table */
883	movl	R(_IdlePTD), %eax
884	movl	$PTDPTDI, %ebx
885	movl	$1,%ecx
886	fillkpt(R(_IdlePTD), $PG_RW)
887
888	ret
889
890#ifdef BDE_DEBUGGER
891bdb_prepare_paging:
892	cmpl	$0,R(_bdb_exists)
893	je	bdb_prepare_paging_exit
894
895	subl	$6,%esp
896
897	/*
898	 * Copy and convert debugger entries from the bootstrap gdt and idt
899	 * to the kernel gdt and idt.  Everything is still in low memory.
900	 * Tracing continues to work after paging is enabled because the
901	 * low memory addresses remain valid until everything is relocated.
902	 * However, tracing through the setidt() that initializes the trace
903	 * trap will crash.
904	 */
905	sgdt	(%esp)
906	movl	2(%esp),%esi		/* base address of bootstrap gdt */
907	movl	$R(_gdt),%edi
908	movl	%edi,2(%esp)		/* prepare to load kernel gdt */
909	movl	$8*18/4,%ecx
910	cld
911	rep				/* copy gdt */
912	movsl
913	movl	$R(_gdt),-8+2(%edi)	/* adjust gdt self-ptr */
914	movb	$0x92,-8+5(%edi)
915	lgdt	(%esp)
916
917	sidt	(%esp)
918	movl	2(%esp),%esi		/* base address of current idt */
919	movl	8+4(%esi),%eax		/* convert dbg descriptor to ... */
920	movw	8(%esi),%ax
921	movl	%eax,R(bdb_dbg_ljmp+1)	/* ... immediate offset ... */
922	movl	8+2(%esi),%eax
923	movw	%ax,R(bdb_dbg_ljmp+5)	/* ... and selector for ljmp */
924	movl	24+4(%esi),%eax		/* same for bpt descriptor */
925	movw	24(%esi),%ax
926	movl	%eax,R(bdb_bpt_ljmp+1)
927	movl	24+2(%esi),%eax
928	movw	%ax,R(bdb_bpt_ljmp+5)
929	movl	R(_idt),%edi
930	movl	%edi,2(%esp)		/* prepare to load kernel idt */
931	movl	$8*4/4,%ecx
932	cld
933	rep				/* copy idt */
934	movsl
935	lidt	(%esp)
936
937	addl	$6,%esp
938
939bdb_prepare_paging_exit:
940	ret
941
942/* Relocate debugger gdt entries and gdt and idt pointers. */
943bdb_commit_paging:
944	cmpl	$0,_bdb_exists
945	je	bdb_commit_paging_exit
946
947	movl	$_gdt+8*9,%eax		/* adjust slots 9-17 */
948	movl	$9,%ecx
949reloc_gdt:
950	movb	$KERNBASE>>24,7(%eax)	/* top byte of base addresses, was 0, */
951	addl	$8,%eax			/* now KERNBASE>>24 */
952	loop	reloc_gdt
953
954	subl	$6,%esp
955	sgdt	(%esp)
956	addl	$KERNBASE,2(%esp)
957	lgdt	(%esp)
958	sidt	(%esp)
959	addl	$KERNBASE,2(%esp)
960	lidt	(%esp)
961	addl	$6,%esp
962
963	int	$3
964
965bdb_commit_paging_exit:
966	ret
967
968#endif /* BDE_DEBUGGER */
969