1/*- 2 * Copyright (c) 2003 Peter Wemm 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 * 26 * $FreeBSD$ 27 */ 28 29#include <machine/asmacros.h> /* miscellaneous asm macros */ 30#include <machine/specialreg.h> 31 32#include "assym.inc" 33 34 .data /* So we can modify it */ 35 36 .p2align 4,0 37 .globl mptramp_start 38mptramp_start: 39 .code16 40 /* 41 * The AP enters here in response to the startup IPI. 42 * We are in real mode. %cs is the only segment register set. 43 */ 44 cli /* make sure no interrupts */ 45 mov %cs, %ax /* copy %cs to %ds. Remember these */ 46 mov %ax, %ds /* are offsets rather than selectors */ 47 mov %ax, %ss 48 49 /* 50 * Find relocation base and patch the gdt descript and ljmp targets 51 */ 52 xorl %ebx,%ebx 53 mov %cs, %bx 54 sall $4, %ebx /* %ebx is now our relocation base */ 55 orl %ebx, lgdt_desc-mptramp_start+2 56 orl %ebx, jmp_32-mptramp_start+2 57 orl %ebx, jmp_64-mptramp_start+1 58 59 /* 60 * Load the descriptor table pointer. We'll need it when running 61 * in 16 bit protected mode. 62 */ 63 lgdt lgdt_desc-mptramp_start 64 65 /* Enable protected mode */ 66 movl $CR0_PE, %eax 67 mov %eax, %cr0 68 69 /* 70 * Now execute a far jump to turn on protected mode. This 71 * causes the segment registers to turn into selectors and causes 72 * %cs to be loaded from the gdt. 73 * 74 * The following instruction is: 75 * ljmpl $bootcode-gdt, $protmode-mptramp_start 76 * but gas cannot assemble that. And besides, we patch the targets 77 * in early startup and its a little clearer what we are patching. 78 */ 79jmp_32: 80 .byte 0x66 /* size override to 32 bits */ 81 .byte 0xea /* opcode for far jump */ 82 .long protmode-mptramp_start /* offset in segment */ 83 .word bootcode-gdt /* index in gdt for 32 bit code */ 84 85 /* 86 * At this point, we are running in 32 bit legacy protected mode. 87 */ 88 .code32 89protmode: 90 mov $bootdata-gdt, %eax 91 mov %ax, %ds 92 93 /* 94 * Turn on the PAE bit and optionally the LA57 bit for when paging 95 * is later enabled. 96 */ 97 mov %cr4, %eax 98 orl $CR4_PAE, %eax 99 cmpb $0, mptramp_la57-mptramp_start(%ebx) 100 je 1f 101 orl $CR4_LA57, %eax 1021: mov %eax, %cr4 103 104 /* 105 * Enable EFER.LME so that we get long mode when all the prereqs are 106 * in place. In this case, it turns on when CR0_PG is finally enabled. 107 * Pick up a few other EFER bits that we'll use need we're here. 108 */ 109 movl $MSR_EFER, %ecx 110 rdmsr 111 orl $EFER_LME | EFER_SCE, %eax 112 wrmsr 113 114 /* 115 * Point to the embedded page tables for startup. Note that this 116 * only gets accessed after we're actually in 64 bit mode, however 117 * we can only set the bottom 32 bits of %cr3 in this state. This 118 * means we are required to use a temporary page table that is below 119 * the 4GB limit. %ebx is still our relocation base. We could just 120 * subtract 3 * PAGE_SIZE, but that would be too easy. 121 */ 122 leal mptramp_pagetables-mptramp_start(%ebx),%eax 123 movl (%eax), %eax 124 mov %eax, %cr3 125 126 /* 127 * Finally, switch to long bit mode by enabling paging. We have 128 * to be very careful here because all the segmentation disappears 129 * out from underneath us. The spec says we can depend on the 130 * subsequent pipelined branch to execute, but *only if* everything 131 * is still identity mapped. If any mappings change, the pipeline 132 * will flush. 133 */ 134 mov %cr0, %eax 135 orl $CR0_PG, %eax 136 mov %eax, %cr0 137 138 /* 139 * At this point paging is enabled, and we are in "compatibility" mode. 140 * We do another far jump to reload %cs with the 64 bit selector. 141 * %cr3 points to a 4- or 5-level page table. 142 * We cannot yet jump all the way to the kernel because we can only 143 * specify a 32 bit linear address. So, we use yet another trampoline. 144 * 145 * The following instruction is: 146 * ljmp $kernelcode-gdt, $tramp_64-mptramp_start 147 * but gas cannot assemble that. And besides, we patch the targets 148 * in early startup and its a little clearer what we are patching. 149 */ 150jmp_64: 151 .byte 0xea /* opcode for far jump */ 152 .long tramp_64-mptramp_start /* offset in segment */ 153 .word kernelcode-gdt /* index in gdt for 64 bit code */ 154 155 /* 156 * Yeehar! We're running in 64 bit mode! We can mostly ignore our 157 * segment registers, and get on with it. 158 * Note that we are running at the correct virtual address, but with 159 * a 1:1 1GB mirrored mapping over entire address space. We had better 160 * switch to a real %cr3 promptly so that we can get to the direct map 161 * space. Remember that jmp is relative and that we've been relocated, 162 * so use an indirect jump. 163 */ 164 .code64 165tramp_64: 166 movabsq $entry_64,%rax /* 64 bit immediate load */ 167 jmp *%rax 168 169 .p2align 4,0 170gdt: 171 /* 172 * All segment descriptor tables start with a null descriptor 173 */ 174 .long 0x00000000 175 .long 0x00000000 176 177 /* 178 * This is the 64 bit long mode code descriptor. There is no 179 * 64 bit data descriptor. 180 */ 181kernelcode: 182 .long 0x00000000 183 .long 0x00209800 184 185 /* 186 * This is the descriptor for the 32 bit boot code. 187 * %cs: +A, +R, -C, DPL=0, +P, +D, +G 188 * Accessed, Readable, Present, 32 bit, 4G granularity 189 */ 190bootcode: 191 .long 0x0000ffff 192 .long 0x00cf9b00 193 194 /* 195 * This is the descriptor for the 32 bit boot data. 196 * We load it into %ds and %ss. The bits for each selector 197 * are interpreted slightly differently. 198 * %ds: +A, +W, -E, DPL=0, +P, +D, +G 199 * %ss: +A, +W, -E, DPL=0, +P, +B, +G 200 * Accessed, Writeable, Expand up, Present, 32 bit, 4GB 201 * For %ds, +D means 'default operand size is 32 bit'. 202 * For %ss, +B means the stack register is %esp rather than %sp. 203 */ 204bootdata: 205 .long 0x0000ffff 206 .long 0x00cf9300 207 208gdtend: 209 210 /* 211 * The address of our page table pages that the boot code 212 * uses to trampoline up to kernel address space. 213 */ 214 .globl mptramp_pagetables 215mptramp_pagetables: 216 .long 0 217 218 /* 5-level paging ? */ 219 .globl mptramp_la57 220mptramp_la57: 221 .long 0 222 223 /* 224 * The pseudo descriptor for lgdt to use. 225 */ 226lgdt_desc: 227 .word gdtend-gdt /* Length */ 228 .long gdt-mptramp_start /* Offset plus %ds << 4 */ 229 230mptramp_end: 231 /* 232 * The size of the trampoline code that needs to be relocated 233 * below the 1MiB boundary. 234 */ 235 .globl bootMP_size 236bootMP_size: 237 .long mptramp_end - mptramp_start 238 239 /* 240 * From here on down is executed in the kernel .text section. 241 */ 242 .text 243 .code64 244 .p2align 4,0 245entry_64: 246 /* 247 * If the BSP reported NXE support, enable EFER.NXE for all APs 248 * prior to loading %cr3. This avoids page faults if the AP 249 * encounters memory marked with the NX bit prior to detecting and 250 * enabling NXE support. 251 */ 252 movq pg_nx, %rbx 253 testq %rbx, %rbx 254 je 1f 255 movl $MSR_EFER, %ecx 256 rdmsr 257 orl $EFER_NXE, %eax 258 wrmsr 259 2601: 261 /* 262 * Load a real %cr3 that has all the direct map stuff and switches 263 * off the 1GB replicated mirror. Load a stack pointer and jump 264 * into AP startup code in C. 265 */ 266 cmpl $0, la57 267 jne 2f 268 movq KPML4phys, %rax 269 jmp 3f 2702: movq KPML5phys, %rax 2713: movq %rax, %cr3 272 movq bootSTK, %rsp 273 jmp init_secondary 274