xref: /openbmc/linux/arch/x86/kernel/head_32.S (revision 78b89ecd)
19a163ed8SThomas Gleixner/*
29a163ed8SThomas Gleixner *
39a163ed8SThomas Gleixner *  Copyright (C) 1991, 1992  Linus Torvalds
49a163ed8SThomas Gleixner *
59a163ed8SThomas Gleixner *  Enhanced CPU detection and feature setting code by Mike Jagdis
69a163ed8SThomas Gleixner *  and Martin Mares, November 1997.
79a163ed8SThomas Gleixner */
89a163ed8SThomas Gleixner
99a163ed8SThomas Gleixner.text
109a163ed8SThomas Gleixner#include <linux/threads.h>
118b2f7fffSSam Ravnborg#include <linux/init.h>
129a163ed8SThomas Gleixner#include <linux/linkage.h>
139a163ed8SThomas Gleixner#include <asm/segment.h>
140341c14dSJeremy Fitzhardinge#include <asm/page_types.h>
150341c14dSJeremy Fitzhardinge#include <asm/pgtable_types.h>
169a163ed8SThomas Gleixner#include <asm/cache.h>
179a163ed8SThomas Gleixner#include <asm/thread_info.h>
189a163ed8SThomas Gleixner#include <asm/asm-offsets.h>
199a163ed8SThomas Gleixner#include <asm/setup.h>
20551889a6SIan Campbell#include <asm/processor-flags.h>
2160a5317fSTejun Heo#include <asm/percpu.h>
22551889a6SIan Campbell
23551889a6SIan Campbell/* Physical address */
24551889a6SIan Campbell#define pa(X) ((X) - __PAGE_OFFSET)
259a163ed8SThomas Gleixner
269a163ed8SThomas Gleixner/*
279a163ed8SThomas Gleixner * References to members of the new_cpu_data structure.
289a163ed8SThomas Gleixner */
299a163ed8SThomas Gleixner
309a163ed8SThomas Gleixner#define X86		new_cpu_data+CPUINFO_x86
319a163ed8SThomas Gleixner#define X86_VENDOR	new_cpu_data+CPUINFO_x86_vendor
329a163ed8SThomas Gleixner#define X86_MODEL	new_cpu_data+CPUINFO_x86_model
339a163ed8SThomas Gleixner#define X86_MASK	new_cpu_data+CPUINFO_x86_mask
349a163ed8SThomas Gleixner#define X86_HARD_MATH	new_cpu_data+CPUINFO_hard_math
359a163ed8SThomas Gleixner#define X86_CPUID	new_cpu_data+CPUINFO_cpuid_level
369a163ed8SThomas Gleixner#define X86_CAPABILITY	new_cpu_data+CPUINFO_x86_capability
379a163ed8SThomas Gleixner#define X86_VENDOR_ID	new_cpu_data+CPUINFO_x86_vendor_id
389a163ed8SThomas Gleixner
399a163ed8SThomas Gleixner/*
40c090f532SJeremy Fitzhardinge * This is how much memory in addition to the memory covered up to
41c090f532SJeremy Fitzhardinge * and including _end we need mapped initially.
429a163ed8SThomas Gleixner * We need:
432bd2753fSYinghai Lu *     (KERNEL_IMAGE_SIZE/4096) / 1024 pages (worst case, non PAE)
442bd2753fSYinghai Lu *     (KERNEL_IMAGE_SIZE/4096) / 512 + 4 pages (worst case for PAE)
459a163ed8SThomas Gleixner *
469a163ed8SThomas Gleixner * Modulo rounding, each megabyte assigned here requires a kilobyte of
479a163ed8SThomas Gleixner * memory, which is currently unreclaimed.
489a163ed8SThomas Gleixner *
499a163ed8SThomas Gleixner * This should be a multiple of a page.
502bd2753fSYinghai Lu *
512bd2753fSYinghai Lu * KERNEL_IMAGE_SIZE should be greater than pa(_end)
522bd2753fSYinghai Lu * and small than max_low_pfn, otherwise will waste some page table entries
539a163ed8SThomas Gleixner */
549a163ed8SThomas Gleixner
559a163ed8SThomas Gleixner#if PTRS_PER_PMD > 1
56c090f532SJeremy Fitzhardinge#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
579a163ed8SThomas Gleixner#else
58c090f532SJeremy Fitzhardinge#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
599a163ed8SThomas Gleixner#endif
609a163ed8SThomas Gleixner
61c090f532SJeremy Fitzhardinge/* Enough space to fit pagetables for the low memory linear map */
6260ac9821SH. Peter AnvinMAPPING_BEYOND_END = \
6360ac9821SH. Peter Anvin	PAGE_TABLE_SIZE(((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT) << PAGE_SHIFT
64c090f532SJeremy Fitzhardinge
65c090f532SJeremy Fitzhardinge/*
66c090f532SJeremy Fitzhardinge * Worst-case size of the kernel mapping we need to make:
67c090f532SJeremy Fitzhardinge * the worst-case size of the kernel itself, plus the extra we need
68c090f532SJeremy Fitzhardinge * to map for the linear map.
69c090f532SJeremy Fitzhardinge */
70c090f532SJeremy FitzhardingeKERNEL_PAGES = (KERNEL_IMAGE_SIZE + MAPPING_BEYOND_END)>>PAGE_SHIFT
71c090f532SJeremy Fitzhardinge
72b8a22a62SJeremy FitzhardingeINIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE_asm
732bd2753fSYinghai LuRESERVE_BRK(pagetables, INIT_MAP_SIZE)
74796216a5SJeremy Fitzhardinge
759a163ed8SThomas Gleixner/*
769a163ed8SThomas Gleixner * 32-bit kernel entrypoint; only used by the boot CPU.  On entry,
779a163ed8SThomas Gleixner * %esi points to the real-mode code as a 32-bit pointer.
789a163ed8SThomas Gleixner * CS and DS must be 4 GB flat segments, but we don't depend on
799a163ed8SThomas Gleixner * any particular GDT layout, because we load our own as soon as we
809a163ed8SThomas Gleixner * can.
819a163ed8SThomas Gleixner */
829a163ed8SThomas Gleixner.section .text.head,"ax",@progbits
839a163ed8SThomas GleixnerENTRY(startup_32)
84a24e7851SRusty Russell	/* test KEEP_SEGMENTS flag to see if the bootloader is asking
85a24e7851SRusty Russell		us to not reload segments */
86a24e7851SRusty Russell	testb $(1<<6), BP_loadflags(%esi)
87a24e7851SRusty Russell	jnz 2f
889a163ed8SThomas Gleixner
899a163ed8SThomas Gleixner/*
909a163ed8SThomas Gleixner * Set segments to known values.
919a163ed8SThomas Gleixner */
92551889a6SIan Campbell	lgdt pa(boot_gdt_descr)
939a163ed8SThomas Gleixner	movl $(__BOOT_DS),%eax
949a163ed8SThomas Gleixner	movl %eax,%ds
959a163ed8SThomas Gleixner	movl %eax,%es
969a163ed8SThomas Gleixner	movl %eax,%fs
979a163ed8SThomas Gleixner	movl %eax,%gs
98a24e7851SRusty Russell2:
999a163ed8SThomas Gleixner
1009a163ed8SThomas Gleixner/*
1019a163ed8SThomas Gleixner * Clear BSS first so that there are no surprises...
1029a163ed8SThomas Gleixner */
103a24e7851SRusty Russell	cld
1049a163ed8SThomas Gleixner	xorl %eax,%eax
105551889a6SIan Campbell	movl $pa(__bss_start),%edi
106551889a6SIan Campbell	movl $pa(__bss_stop),%ecx
1079a163ed8SThomas Gleixner	subl %edi,%ecx
1089a163ed8SThomas Gleixner	shrl $2,%ecx
1099a163ed8SThomas Gleixner	rep ; stosl
1109a163ed8SThomas Gleixner/*
1119a163ed8SThomas Gleixner * Copy bootup parameters out of the way.
1129a163ed8SThomas Gleixner * Note: %esi still has the pointer to the real-mode data.
1139a163ed8SThomas Gleixner * With the kexec as boot loader, parameter segment might be loaded beyond
1149a163ed8SThomas Gleixner * kernel image and might not even be addressable by early boot page tables.
1159a163ed8SThomas Gleixner * (kexec on panic case). Hence copy out the parameters before initializing
1169a163ed8SThomas Gleixner * page tables.
1179a163ed8SThomas Gleixner */
118551889a6SIan Campbell	movl $pa(boot_params),%edi
1199a163ed8SThomas Gleixner	movl $(PARAM_SIZE/4),%ecx
1209a163ed8SThomas Gleixner	cld
1219a163ed8SThomas Gleixner	rep
1229a163ed8SThomas Gleixner	movsl
123551889a6SIan Campbell	movl pa(boot_params) + NEW_CL_POINTER,%esi
1249a163ed8SThomas Gleixner	andl %esi,%esi
125fa76dab9SH. Peter Anvin	jz 1f			# No comand line
126551889a6SIan Campbell	movl $pa(boot_command_line),%edi
1279a163ed8SThomas Gleixner	movl $(COMMAND_LINE_SIZE/4),%ecx
1289a163ed8SThomas Gleixner	rep
1299a163ed8SThomas Gleixner	movsl
1309a163ed8SThomas Gleixner1:
1319a163ed8SThomas Gleixner
132a24e7851SRusty Russell#ifdef CONFIG_PARAVIRT
133551889a6SIan Campbell	/* This is can only trip for a broken bootloader... */
134551889a6SIan Campbell	cmpw $0x207, pa(boot_params + BP_version)
135a24e7851SRusty Russell	jb default_entry
136a24e7851SRusty Russell
137a24e7851SRusty Russell	/* Paravirt-compatible boot parameters.  Look to see what architecture
138a24e7851SRusty Russell		we're booting under. */
139551889a6SIan Campbell	movl pa(boot_params + BP_hardware_subarch), %eax
140a24e7851SRusty Russell	cmpl $num_subarch_entries, %eax
141a24e7851SRusty Russell	jae bad_subarch
142a24e7851SRusty Russell
143551889a6SIan Campbell	movl pa(subarch_entries)(,%eax,4), %eax
144a24e7851SRusty Russell	subl $__PAGE_OFFSET, %eax
145a24e7851SRusty Russell	jmp *%eax
146a24e7851SRusty Russell
147a24e7851SRusty Russellbad_subarch:
148a24e7851SRusty RussellWEAK(lguest_entry)
149a24e7851SRusty RussellWEAK(xen_entry)
150a24e7851SRusty Russell	/* Unknown implementation; there's really
151a24e7851SRusty Russell	   nothing we can do at this point. */
152a24e7851SRusty Russell	ud2a
1538b2f7fffSSam Ravnborg
1548b2f7fffSSam Ravnborg	__INITDATA
1558b2f7fffSSam Ravnborg
156a24e7851SRusty Russellsubarch_entries:
157a24e7851SRusty Russell	.long default_entry		/* normal x86/PC */
158a24e7851SRusty Russell	.long lguest_entry		/* lguest hypervisor */
159a24e7851SRusty Russell	.long xen_entry			/* Xen hypervisor */
160a24e7851SRusty Russellnum_subarch_entries = (. - subarch_entries) / 4
161a24e7851SRusty Russell.previous
162a24e7851SRusty Russell#endif /* CONFIG_PARAVIRT */
163a24e7851SRusty Russell
1649a163ed8SThomas Gleixner/*
1659a163ed8SThomas Gleixner * Initialize page tables.  This creates a PDE and a set of page
1662bd2753fSYinghai Lu * tables, which are located immediately beyond __brk_base.  The variable
167ccf3fe02SJeremy Fitzhardinge * _brk_end is set up to point to the first "safe" location.
1689a163ed8SThomas Gleixner * Mappings are created both at virtual address 0 (identity mapping)
1692bd2753fSYinghai Lu * and PAGE_OFFSET for up to _end.
1709a163ed8SThomas Gleixner *
171551889a6SIan Campbell * Note that the stack is not yet set up!
1729a163ed8SThomas Gleixner */
173a24e7851SRusty Russelldefault_entry:
174551889a6SIan Campbell#ifdef CONFIG_X86_PAE
175551889a6SIan Campbell
176551889a6SIan Campbell	/*
177551889a6SIan Campbell	 * In PAE mode swapper_pg_dir is statically defined to contain enough
178551889a6SIan Campbell	 * entries to cover the VMSPLIT option (that is the top 1, 2 or 3
179551889a6SIan Campbell	 * entries). The identity mapping is handled by pointing two PGD
180551889a6SIan Campbell	 * entries to the first kernel PMD.
181551889a6SIan Campbell	 *
182551889a6SIan Campbell	 * Note the upper half of each PMD or PTE are always zero at
183551889a6SIan Campbell	 * this stage.
184551889a6SIan Campbell	 */
185551889a6SIan Campbell
18686b2b70eSJoe Korty#define KPMDS (((-__PAGE_OFFSET) >> 30) & 3) /* Number of kernel PMDs */
187551889a6SIan Campbell
188551889a6SIan Campbell	xorl %ebx,%ebx				/* %ebx is kept at zero */
189551889a6SIan Campbell
190ccf3fe02SJeremy Fitzhardinge	movl $pa(__brk_base), %edi
191551889a6SIan Campbell	movl $pa(swapper_pg_pmd), %edx
192b2bc2731SSuresh Siddha	movl $PTE_IDENT_ATTR, %eax
1939a163ed8SThomas Gleixner10:
194b2bc2731SSuresh Siddha	leal PDE_IDENT_ATTR(%edi),%ecx		/* Create PMD entry */
195551889a6SIan Campbell	movl %ecx,(%edx)			/* Store PMD entry */
196551889a6SIan Campbell						/* Upper half already zero */
197551889a6SIan Campbell	addl $8,%edx
198551889a6SIan Campbell	movl $512,%ecx
199551889a6SIan Campbell11:
200551889a6SIan Campbell	stosl
201551889a6SIan Campbell	xchgl %eax,%ebx
202551889a6SIan Campbell	stosl
203551889a6SIan Campbell	xchgl %eax,%ebx
204551889a6SIan Campbell	addl $0x1000,%eax
205551889a6SIan Campbell	loop 11b
206551889a6SIan Campbell
207551889a6SIan Campbell	/*
208c090f532SJeremy Fitzhardinge	 * End condition: we must map up to the end + MAPPING_BEYOND_END.
209551889a6SIan Campbell	 */
210c090f532SJeremy Fitzhardinge	movl $pa(_end) + MAPPING_BEYOND_END + PTE_IDENT_ATTR, %ebp
211551889a6SIan Campbell	cmpl %ebp,%eax
212551889a6SIan Campbell	jb 10b
213551889a6SIan Campbell1:
214ccf3fe02SJeremy Fitzhardinge	addl $__PAGE_OFFSET, %edi
215ccf3fe02SJeremy Fitzhardinge	movl %edi, pa(_brk_end)
2166af61a76SYinghai Lu	shrl $12, %eax
2176af61a76SYinghai Lu	movl %eax, pa(max_pfn_mapped)
218551889a6SIan Campbell
219551889a6SIan Campbell	/* Do early initialization of the fixmap area */
220b2bc2731SSuresh Siddha	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
221551889a6SIan Campbell	movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
222551889a6SIan Campbell#else	/* Not PAE */
223551889a6SIan Campbell
224551889a6SIan Campbellpage_pde_offset = (__PAGE_OFFSET >> 20);
225551889a6SIan Campbell
226ccf3fe02SJeremy Fitzhardinge	movl $pa(__brk_base), %edi
227551889a6SIan Campbell	movl $pa(swapper_pg_dir), %edx
228b2bc2731SSuresh Siddha	movl $PTE_IDENT_ATTR, %eax
229551889a6SIan Campbell10:
230b2bc2731SSuresh Siddha	leal PDE_IDENT_ATTR(%edi),%ecx		/* Create PDE entry */
2319a163ed8SThomas Gleixner	movl %ecx,(%edx)			/* Store identity PDE entry */
2329a163ed8SThomas Gleixner	movl %ecx,page_pde_offset(%edx)		/* Store kernel PDE entry */
2339a163ed8SThomas Gleixner	addl $4,%edx
2349a163ed8SThomas Gleixner	movl $1024, %ecx
2359a163ed8SThomas Gleixner11:
2369a163ed8SThomas Gleixner	stosl
2379a163ed8SThomas Gleixner	addl $0x1000,%eax
2389a163ed8SThomas Gleixner	loop 11b
239551889a6SIan Campbell	/*
240c090f532SJeremy Fitzhardinge	 * End condition: we must map up to the end + MAPPING_BEYOND_END.
241551889a6SIan Campbell	 */
242c090f532SJeremy Fitzhardinge	movl $pa(_end) + MAPPING_BEYOND_END + PTE_IDENT_ATTR, %ebp
2439a163ed8SThomas Gleixner	cmpl %ebp,%eax
2449a163ed8SThomas Gleixner	jb 10b
245ccf3fe02SJeremy Fitzhardinge	addl $__PAGE_OFFSET, %edi
246ccf3fe02SJeremy Fitzhardinge	movl %edi, pa(_brk_end)
2476af61a76SYinghai Lu	shrl $12, %eax
2486af61a76SYinghai Lu	movl %eax, pa(max_pfn_mapped)
2499a163ed8SThomas Gleixner
250551889a6SIan Campbell	/* Do early initialization of the fixmap area */
251b2bc2731SSuresh Siddha	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
252551889a6SIan Campbell	movl %eax,pa(swapper_pg_dir+0xffc)
253551889a6SIan Campbell#endif
2549a163ed8SThomas Gleixner	jmp 3f
2559a163ed8SThomas Gleixner/*
2569a163ed8SThomas Gleixner * Non-boot CPU entry point; entered from trampoline.S
2579a163ed8SThomas Gleixner * We can't lgdt here, because lgdt itself uses a data segment, but
2589a163ed8SThomas Gleixner * we know the trampoline has already loaded the boot_gdt for us.
2599a163ed8SThomas Gleixner *
2609a163ed8SThomas Gleixner * If cpu hotplug is not supported then this code can go in init section
2619a163ed8SThomas Gleixner * which will be freed later
2629a163ed8SThomas Gleixner */
2639a163ed8SThomas Gleixner
26478b89ecdSJan Beulich__CPUINIT
2659a163ed8SThomas Gleixner
2669a163ed8SThomas Gleixner#ifdef CONFIG_SMP
2679a163ed8SThomas GleixnerENTRY(startup_32_smp)
2689a163ed8SThomas Gleixner	cld
2699a163ed8SThomas Gleixner	movl $(__BOOT_DS),%eax
2709a163ed8SThomas Gleixner	movl %eax,%ds
2719a163ed8SThomas Gleixner	movl %eax,%es
2729a163ed8SThomas Gleixner	movl %eax,%fs
2739a163ed8SThomas Gleixner	movl %eax,%gs
2745756dd59SIan Campbell#endif /* CONFIG_SMP */
2755756dd59SIan Campbell3:
2769a163ed8SThomas Gleixner
2779a163ed8SThomas Gleixner/*
2789a163ed8SThomas Gleixner *	New page tables may be in 4Mbyte page mode and may
2799a163ed8SThomas Gleixner *	be using the global pages.
2809a163ed8SThomas Gleixner *
2819a163ed8SThomas Gleixner *	NOTE! If we are on a 486 we may have no cr4 at all!
2829a163ed8SThomas Gleixner *	So we do not try to touch it unless we really have
2839a163ed8SThomas Gleixner *	some bits in it to set.  This won't work if the BSP
2849a163ed8SThomas Gleixner *	implements cr4 but this AP does not -- very unlikely
2859a163ed8SThomas Gleixner *	but be warned!  The same applies to the pse feature
2869a163ed8SThomas Gleixner *	if not equally supported. --macro
2879a163ed8SThomas Gleixner *
2889a163ed8SThomas Gleixner *	NOTE! We have to correct for the fact that we're
2899a163ed8SThomas Gleixner *	not yet offset PAGE_OFFSET..
2909a163ed8SThomas Gleixner */
291551889a6SIan Campbell#define cr4_bits pa(mmu_cr4_features)
2929a163ed8SThomas Gleixner	movl cr4_bits,%edx
2939a163ed8SThomas Gleixner	andl %edx,%edx
2949a163ed8SThomas Gleixner	jz 6f
2959a163ed8SThomas Gleixner	movl %cr4,%eax		# Turn on paging options (PSE,PAE,..)
2969a163ed8SThomas Gleixner	orl %edx,%eax
2979a163ed8SThomas Gleixner	movl %eax,%cr4
2989a163ed8SThomas Gleixner
2999a163ed8SThomas Gleixner	btl $5, %eax		# check if PAE is enabled
3009a163ed8SThomas Gleixner	jnc 6f
3019a163ed8SThomas Gleixner
3029a163ed8SThomas Gleixner	/* Check if extended functions are implemented */
3039a163ed8SThomas Gleixner	movl $0x80000000, %eax
3049a163ed8SThomas Gleixner	cpuid
3059a163ed8SThomas Gleixner	cmpl $0x80000000, %eax
3069a163ed8SThomas Gleixner	jbe 6f
3079a163ed8SThomas Gleixner	mov $0x80000001, %eax
3089a163ed8SThomas Gleixner	cpuid
3099a163ed8SThomas Gleixner	/* Execute Disable bit supported? */
3109a163ed8SThomas Gleixner	btl $20, %edx
3119a163ed8SThomas Gleixner	jnc 6f
3129a163ed8SThomas Gleixner
3139a163ed8SThomas Gleixner	/* Setup EFER (Extended Feature Enable Register) */
3149a163ed8SThomas Gleixner	movl $0xc0000080, %ecx
3159a163ed8SThomas Gleixner	rdmsr
3169a163ed8SThomas Gleixner
3179a163ed8SThomas Gleixner	btsl $11, %eax
3189a163ed8SThomas Gleixner	/* Make changes effective */
3199a163ed8SThomas Gleixner	wrmsr
3209a163ed8SThomas Gleixner
3219a163ed8SThomas Gleixner6:
3229a163ed8SThomas Gleixner
3239a163ed8SThomas Gleixner/*
3249a163ed8SThomas Gleixner * Enable paging
3259a163ed8SThomas Gleixner */
326551889a6SIan Campbell	movl $pa(swapper_pg_dir),%eax
3279a163ed8SThomas Gleixner	movl %eax,%cr3		/* set the page table pointer.. */
3289a163ed8SThomas Gleixner	movl %cr0,%eax
329551889a6SIan Campbell	orl  $X86_CR0_PG,%eax
3309a163ed8SThomas Gleixner	movl %eax,%cr0		/* ..and set paging (PG) bit */
3319a163ed8SThomas Gleixner	ljmp $__BOOT_CS,$1f	/* Clear prefetch and normalize %eip */
3329a163ed8SThomas Gleixner1:
3339a163ed8SThomas Gleixner	/* Set up the stack pointer */
3349a163ed8SThomas Gleixner	lss stack_start,%esp
3359a163ed8SThomas Gleixner
3369a163ed8SThomas Gleixner/*
3379a163ed8SThomas Gleixner * Initialize eflags.  Some BIOS's leave bits like NT set.  This would
3389a163ed8SThomas Gleixner * confuse the debugger if this code is traced.
3399a163ed8SThomas Gleixner * XXX - best to initialize before switching to protected mode.
3409a163ed8SThomas Gleixner */
3419a163ed8SThomas Gleixner	pushl $0
3429a163ed8SThomas Gleixner	popfl
3439a163ed8SThomas Gleixner
3449a163ed8SThomas Gleixner#ifdef CONFIG_SMP
34550359501SIan Campbell	cmpb $0, ready
3469a163ed8SThomas Gleixner	jz  1f				/* Initial CPU cleans BSS */
3479a163ed8SThomas Gleixner	jmp checkCPUtype
3489a163ed8SThomas Gleixner1:
3499a163ed8SThomas Gleixner#endif /* CONFIG_SMP */
3509a163ed8SThomas Gleixner
3519a163ed8SThomas Gleixner/*
3529a163ed8SThomas Gleixner * start system 32-bit setup. We need to re-do some of the things done
3539a163ed8SThomas Gleixner * in 16-bit mode for the "real" operations.
3549a163ed8SThomas Gleixner */
3559a163ed8SThomas Gleixner	call setup_idt
3569a163ed8SThomas Gleixner
3579a163ed8SThomas GleixnercheckCPUtype:
3589a163ed8SThomas Gleixner
3599a163ed8SThomas Gleixner	movl $-1,X86_CPUID		#  -1 for no CPUID initially
3609a163ed8SThomas Gleixner
3619a163ed8SThomas Gleixner/* check if it is 486 or 386. */
3629a163ed8SThomas Gleixner/*
3639a163ed8SThomas Gleixner * XXX - this does a lot of unnecessary setup.  Alignment checks don't
3649a163ed8SThomas Gleixner * apply at our cpl of 0 and the stack ought to be aligned already, and
3659a163ed8SThomas Gleixner * we don't need to preserve eflags.
3669a163ed8SThomas Gleixner */
3679a163ed8SThomas Gleixner
3689a163ed8SThomas Gleixner	movb $3,X86		# at least 386
3699a163ed8SThomas Gleixner	pushfl			# push EFLAGS
3709a163ed8SThomas Gleixner	popl %eax		# get EFLAGS
3719a163ed8SThomas Gleixner	movl %eax,%ecx		# save original EFLAGS
3729a163ed8SThomas Gleixner	xorl $0x240000,%eax	# flip AC and ID bits in EFLAGS
3739a163ed8SThomas Gleixner	pushl %eax		# copy to EFLAGS
3749a163ed8SThomas Gleixner	popfl			# set EFLAGS
3759a163ed8SThomas Gleixner	pushfl			# get new EFLAGS
3769a163ed8SThomas Gleixner	popl %eax		# put it in eax
3779a163ed8SThomas Gleixner	xorl %ecx,%eax		# change in flags
3789a163ed8SThomas Gleixner	pushl %ecx		# restore original EFLAGS
3799a163ed8SThomas Gleixner	popfl
3809a163ed8SThomas Gleixner	testl $0x40000,%eax	# check if AC bit changed
3819a163ed8SThomas Gleixner	je is386
3829a163ed8SThomas Gleixner
3839a163ed8SThomas Gleixner	movb $4,X86		# at least 486
3849a163ed8SThomas Gleixner	testl $0x200000,%eax	# check if ID bit changed
3859a163ed8SThomas Gleixner	je is486
3869a163ed8SThomas Gleixner
3879a163ed8SThomas Gleixner	/* get vendor info */
3889a163ed8SThomas Gleixner	xorl %eax,%eax			# call CPUID with 0 -> return vendor ID
3899a163ed8SThomas Gleixner	cpuid
3909a163ed8SThomas Gleixner	movl %eax,X86_CPUID		# save CPUID level
3919a163ed8SThomas Gleixner	movl %ebx,X86_VENDOR_ID		# lo 4 chars
3929a163ed8SThomas Gleixner	movl %edx,X86_VENDOR_ID+4	# next 4 chars
3939a163ed8SThomas Gleixner	movl %ecx,X86_VENDOR_ID+8	# last 4 chars
3949a163ed8SThomas Gleixner
3959a163ed8SThomas Gleixner	orl %eax,%eax			# do we have processor info as well?
3969a163ed8SThomas Gleixner	je is486
3979a163ed8SThomas Gleixner
3989a163ed8SThomas Gleixner	movl $1,%eax		# Use the CPUID instruction to get CPU type
3999a163ed8SThomas Gleixner	cpuid
4009a163ed8SThomas Gleixner	movb %al,%cl		# save reg for future use
4019a163ed8SThomas Gleixner	andb $0x0f,%ah		# mask processor family
4029a163ed8SThomas Gleixner	movb %ah,X86
4039a163ed8SThomas Gleixner	andb $0xf0,%al		# mask model
4049a163ed8SThomas Gleixner	shrb $4,%al
4059a163ed8SThomas Gleixner	movb %al,X86_MODEL
4069a163ed8SThomas Gleixner	andb $0x0f,%cl		# mask mask revision
4079a163ed8SThomas Gleixner	movb %cl,X86_MASK
4089a163ed8SThomas Gleixner	movl %edx,X86_CAPABILITY
4099a163ed8SThomas Gleixner
4109a163ed8SThomas Gleixneris486:	movl $0x50022,%ecx	# set AM, WP, NE and MP
4119a163ed8SThomas Gleixner	jmp 2f
4129a163ed8SThomas Gleixner
4139a163ed8SThomas Gleixneris386:	movl $2,%ecx		# set MP
4149a163ed8SThomas Gleixner2:	movl %cr0,%eax
4159a163ed8SThomas Gleixner	andl $0x80000011,%eax	# Save PG,PE,ET
4169a163ed8SThomas Gleixner	orl %ecx,%eax
4179a163ed8SThomas Gleixner	movl %eax,%cr0
4189a163ed8SThomas Gleixner
4199a163ed8SThomas Gleixner	call check_x87
4209a163ed8SThomas Gleixner	lgdt early_gdt_descr
4219a163ed8SThomas Gleixner	lidt idt_descr
4229a163ed8SThomas Gleixner	ljmp $(__KERNEL_CS),$1f
4239a163ed8SThomas Gleixner1:	movl $(__KERNEL_DS),%eax	# reload all the segment registers
4249a163ed8SThomas Gleixner	movl %eax,%ss			# after changing gdt.
4259a163ed8SThomas Gleixner
4269a163ed8SThomas Gleixner	movl $(__USER_DS),%eax		# DS/ES contains default USER segment
4279a163ed8SThomas Gleixner	movl %eax,%ds
4289a163ed8SThomas Gleixner	movl %eax,%es
4299a163ed8SThomas Gleixner
4300dd76d73SBrian Gerst	movl $(__KERNEL_PERCPU), %eax
4310dd76d73SBrian Gerst	movl %eax,%fs			# set this cpu's percpu
4320dd76d73SBrian Gerst
43360a5317fSTejun Heo#ifdef CONFIG_CC_STACKPROTECTOR
43460a5317fSTejun Heo	/*
43560a5317fSTejun Heo	 * The linker can't handle this by relocation.  Manually set
43660a5317fSTejun Heo	 * base address in stack canary segment descriptor.
43760a5317fSTejun Heo	 */
43860a5317fSTejun Heo	cmpb $0,ready
43960a5317fSTejun Heo	jne 1f
44060a5317fSTejun Heo	movl $per_cpu__gdt_page,%eax
44160a5317fSTejun Heo	movl $per_cpu__stack_canary,%ecx
4425c79d2a5STejun Heo	subl $20, %ecx
44360a5317fSTejun Heo	movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
44460a5317fSTejun Heo	shrl $16, %ecx
44560a5317fSTejun Heo	movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
44660a5317fSTejun Heo	movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
44760a5317fSTejun Heo1:
44860a5317fSTejun Heo#endif
44960a5317fSTejun Heo	movl $(__KERNEL_STACK_CANARY),%eax
4509a163ed8SThomas Gleixner	movl %eax,%gs
45160a5317fSTejun Heo
45260a5317fSTejun Heo	xorl %eax,%eax			# Clear LDT
4539a163ed8SThomas Gleixner	lldt %ax
4549a163ed8SThomas Gleixner
4559a163ed8SThomas Gleixner	cld			# gcc2 wants the direction flag cleared at all times
4569a163ed8SThomas Gleixner	pushl $0		# fake return address for unwinder
4579a163ed8SThomas Gleixner#ifdef CONFIG_SMP
4589a163ed8SThomas Gleixner	movb ready, %cl
4599a163ed8SThomas Gleixner	movb $1, ready
4609a163ed8SThomas Gleixner	cmpb $0,%cl		# the first CPU calls start_kernel
4619a163ed8SThomas Gleixner	je   1f
4623e970473SGlauber Costa	movl (stack_start), %esp
4639a163ed8SThomas Gleixner1:
4649a163ed8SThomas Gleixner#endif /* CONFIG_SMP */
465e3f77edfSGlauber Costa	jmp *(initial_code)
4669a163ed8SThomas Gleixner
4679a163ed8SThomas Gleixner/*
4689a163ed8SThomas Gleixner * We depend on ET to be correct. This checks for 287/387.
4699a163ed8SThomas Gleixner */
4709a163ed8SThomas Gleixnercheck_x87:
4719a163ed8SThomas Gleixner	movb $0,X86_HARD_MATH
4729a163ed8SThomas Gleixner	clts
4739a163ed8SThomas Gleixner	fninit
4749a163ed8SThomas Gleixner	fstsw %ax
4759a163ed8SThomas Gleixner	cmpb $0,%al
4769a163ed8SThomas Gleixner	je 1f
4779a163ed8SThomas Gleixner	movl %cr0,%eax		/* no coprocessor: have to set bits */
4789a163ed8SThomas Gleixner	xorl $4,%eax		/* set EM */
4799a163ed8SThomas Gleixner	movl %eax,%cr0
4809a163ed8SThomas Gleixner	ret
4819a163ed8SThomas Gleixner	ALIGN
4829a163ed8SThomas Gleixner1:	movb $1,X86_HARD_MATH
4839a163ed8SThomas Gleixner	.byte 0xDB,0xE4		/* fsetpm for 287, ignored by 387 */
4849a163ed8SThomas Gleixner	ret
4859a163ed8SThomas Gleixner
4869a163ed8SThomas Gleixner/*
4879a163ed8SThomas Gleixner *  setup_idt
4889a163ed8SThomas Gleixner *
4899a163ed8SThomas Gleixner *  sets up a idt with 256 entries pointing to
4909a163ed8SThomas Gleixner *  ignore_int, interrupt gates. It doesn't actually load
4919a163ed8SThomas Gleixner *  idt - that can be done only after paging has been enabled
4929a163ed8SThomas Gleixner *  and the kernel moved to PAGE_OFFSET. Interrupts
4939a163ed8SThomas Gleixner *  are enabled elsewhere, when we can be relatively
4949a163ed8SThomas Gleixner *  sure everything is ok.
4959a163ed8SThomas Gleixner *
4969a163ed8SThomas Gleixner *  Warning: %esi is live across this function.
4979a163ed8SThomas Gleixner */
4989a163ed8SThomas Gleixnersetup_idt:
4999a163ed8SThomas Gleixner	lea ignore_int,%edx
5009a163ed8SThomas Gleixner	movl $(__KERNEL_CS << 16),%eax
5019a163ed8SThomas Gleixner	movw %dx,%ax		/* selector = 0x0010 = cs */
5029a163ed8SThomas Gleixner	movw $0x8E00,%dx	/* interrupt gate - dpl=0, present */
5039a163ed8SThomas Gleixner
5049a163ed8SThomas Gleixner	lea idt_table,%edi
5059a163ed8SThomas Gleixner	mov $256,%ecx
5069a163ed8SThomas Gleixnerrp_sidt:
5079a163ed8SThomas Gleixner	movl %eax,(%edi)
5089a163ed8SThomas Gleixner	movl %edx,4(%edi)
5099a163ed8SThomas Gleixner	addl $8,%edi
5109a163ed8SThomas Gleixner	dec %ecx
5119a163ed8SThomas Gleixner	jne rp_sidt
5129a163ed8SThomas Gleixner
5139a163ed8SThomas Gleixner.macro	set_early_handler handler,trapno
5149a163ed8SThomas Gleixner	lea \handler,%edx
5159a163ed8SThomas Gleixner	movl $(__KERNEL_CS << 16),%eax
5169a163ed8SThomas Gleixner	movw %dx,%ax
5179a163ed8SThomas Gleixner	movw $0x8E00,%dx	/* interrupt gate - dpl=0, present */
5189a163ed8SThomas Gleixner	lea idt_table,%edi
5199a163ed8SThomas Gleixner	movl %eax,8*\trapno(%edi)
5209a163ed8SThomas Gleixner	movl %edx,8*\trapno+4(%edi)
5219a163ed8SThomas Gleixner.endm
5229a163ed8SThomas Gleixner
5239a163ed8SThomas Gleixner	set_early_handler handler=early_divide_err,trapno=0
5249a163ed8SThomas Gleixner	set_early_handler handler=early_illegal_opcode,trapno=6
5259a163ed8SThomas Gleixner	set_early_handler handler=early_protection_fault,trapno=13
5269a163ed8SThomas Gleixner	set_early_handler handler=early_page_fault,trapno=14
5279a163ed8SThomas Gleixner
5289a163ed8SThomas Gleixner	ret
5299a163ed8SThomas Gleixner
5309a163ed8SThomas Gleixnerearly_divide_err:
5319a163ed8SThomas Gleixner	xor %edx,%edx
5329a163ed8SThomas Gleixner	pushl $0	/* fake errcode */
5339a163ed8SThomas Gleixner	jmp early_fault
5349a163ed8SThomas Gleixner
5359a163ed8SThomas Gleixnerearly_illegal_opcode:
5369a163ed8SThomas Gleixner	movl $6,%edx
5379a163ed8SThomas Gleixner	pushl $0	/* fake errcode */
5389a163ed8SThomas Gleixner	jmp early_fault
5399a163ed8SThomas Gleixner
5409a163ed8SThomas Gleixnerearly_protection_fault:
5419a163ed8SThomas Gleixner	movl $13,%edx
5429a163ed8SThomas Gleixner	jmp early_fault
5439a163ed8SThomas Gleixner
5449a163ed8SThomas Gleixnerearly_page_fault:
5459a163ed8SThomas Gleixner	movl $14,%edx
5469a163ed8SThomas Gleixner	jmp early_fault
5479a163ed8SThomas Gleixner
5489a163ed8SThomas Gleixnerearly_fault:
5499a163ed8SThomas Gleixner	cld
5509a163ed8SThomas Gleixner#ifdef CONFIG_PRINTK
551382f64abSIngo Molnar	pusha
5529a163ed8SThomas Gleixner	movl $(__KERNEL_DS),%eax
5539a163ed8SThomas Gleixner	movl %eax,%ds
5549a163ed8SThomas Gleixner	movl %eax,%es
5559a163ed8SThomas Gleixner	cmpl $2,early_recursion_flag
5569a163ed8SThomas Gleixner	je hlt_loop
5579a163ed8SThomas Gleixner	incl early_recursion_flag
5589a163ed8SThomas Gleixner	movl %cr2,%eax
5599a163ed8SThomas Gleixner	pushl %eax
5609a163ed8SThomas Gleixner	pushl %edx		/* trapno */
5619a163ed8SThomas Gleixner	pushl $fault_msg
5629a163ed8SThomas Gleixner	call printk
5639a163ed8SThomas Gleixner#endif
56494878efdSIngo Molnar	call dump_stack
5659a163ed8SThomas Gleixnerhlt_loop:
5669a163ed8SThomas Gleixner	hlt
5679a163ed8SThomas Gleixner	jmp hlt_loop
5689a163ed8SThomas Gleixner
5699a163ed8SThomas Gleixner/* This is the default interrupt "handler" :-) */
5709a163ed8SThomas Gleixner	ALIGN
5719a163ed8SThomas Gleixnerignore_int:
5729a163ed8SThomas Gleixner	cld
5739a163ed8SThomas Gleixner#ifdef CONFIG_PRINTK
5749a163ed8SThomas Gleixner	pushl %eax
5759a163ed8SThomas Gleixner	pushl %ecx
5769a163ed8SThomas Gleixner	pushl %edx
5779a163ed8SThomas Gleixner	pushl %es
5789a163ed8SThomas Gleixner	pushl %ds
5799a163ed8SThomas Gleixner	movl $(__KERNEL_DS),%eax
5809a163ed8SThomas Gleixner	movl %eax,%ds
5819a163ed8SThomas Gleixner	movl %eax,%es
5829a163ed8SThomas Gleixner	cmpl $2,early_recursion_flag
5839a163ed8SThomas Gleixner	je hlt_loop
5849a163ed8SThomas Gleixner	incl early_recursion_flag
5859a163ed8SThomas Gleixner	pushl 16(%esp)
5869a163ed8SThomas Gleixner	pushl 24(%esp)
5879a163ed8SThomas Gleixner	pushl 32(%esp)
5889a163ed8SThomas Gleixner	pushl 40(%esp)
5899a163ed8SThomas Gleixner	pushl $int_msg
5909a163ed8SThomas Gleixner	call printk
591d5e397cbSIngo Molnar
592d5e397cbSIngo Molnar	call dump_stack
593d5e397cbSIngo Molnar
5949a163ed8SThomas Gleixner	addl $(5*4),%esp
5959a163ed8SThomas Gleixner	popl %ds
5969a163ed8SThomas Gleixner	popl %es
5979a163ed8SThomas Gleixner	popl %edx
5989a163ed8SThomas Gleixner	popl %ecx
5999a163ed8SThomas Gleixner	popl %eax
6009a163ed8SThomas Gleixner#endif
6019a163ed8SThomas Gleixner	iret
6029a163ed8SThomas Gleixner
6030e83815bSRobert Richter	__REFDATA
604583323b9SThomas Gleixner.align 4
605583323b9SThomas GleixnerENTRY(initial_code)
606583323b9SThomas Gleixner	.long i386_start_kernel
607583323b9SThomas Gleixner
6089a163ed8SThomas Gleixner/*
6099a163ed8SThomas Gleixner * BSS section
6109a163ed8SThomas Gleixner */
6119a163ed8SThomas Gleixner.section ".bss.page_aligned","wa"
6129a163ed8SThomas Gleixner	.align PAGE_SIZE_asm
613551889a6SIan Campbell#ifdef CONFIG_X86_PAE
614ed2b7e2bSAdrian Bunkswapper_pg_pmd:
615551889a6SIan Campbell	.fill 1024*KPMDS,4,0
616551889a6SIan Campbell#else
6179a163ed8SThomas GleixnerENTRY(swapper_pg_dir)
6189a163ed8SThomas Gleixner	.fill 1024,4,0
619551889a6SIan Campbell#endif
620aa65af3fSAdrian Bunkswapper_pg_fixmap:
6219a163ed8SThomas Gleixner	.fill 1024,4,0
6229a163ed8SThomas GleixnerENTRY(empty_zero_page)
6239a163ed8SThomas Gleixner	.fill 4096,1,0
6242bd2753fSYinghai Lu
6259a163ed8SThomas Gleixner/*
6269a163ed8SThomas Gleixner * This starts the data section.
6279a163ed8SThomas Gleixner */
628551889a6SIan Campbell#ifdef CONFIG_X86_PAE
629551889a6SIan Campbell.section ".data.page_aligned","wa"
630551889a6SIan Campbell	/* Page-aligned for the benefit of paravirt? */
631551889a6SIan Campbell	.align PAGE_SIZE_asm
632551889a6SIan CampbellENTRY(swapper_pg_dir)
633b2bc2731SSuresh Siddha	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
634551889a6SIan Campbell# if KPMDS == 3
635b2bc2731SSuresh Siddha	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR),0
636b2bc2731SSuresh Siddha	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR+0x1000),0
637b2bc2731SSuresh Siddha	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR+0x2000),0
638551889a6SIan Campbell# elif KPMDS == 2
639551889a6SIan Campbell	.long	0,0
640b2bc2731SSuresh Siddha	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR),0
641b2bc2731SSuresh Siddha	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR+0x1000),0
642551889a6SIan Campbell# elif KPMDS == 1
643551889a6SIan Campbell	.long	0,0
644551889a6SIan Campbell	.long	0,0
645b2bc2731SSuresh Siddha	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR),0
646551889a6SIan Campbell# else
647551889a6SIan Campbell#  error "Kernel PMDs should be 1, 2 or 3"
648551889a6SIan Campbell# endif
649551889a6SIan Campbell	.align PAGE_SIZE_asm		/* needs to be page-sized too */
650551889a6SIan Campbell#endif
651551889a6SIan Campbell
6529a163ed8SThomas Gleixner.data
6539a163ed8SThomas GleixnerENTRY(stack_start)
6549a163ed8SThomas Gleixner	.long init_thread_union+THREAD_SIZE
6559a163ed8SThomas Gleixner	.long __BOOT_DS
6569a163ed8SThomas Gleixner
6579a163ed8SThomas Gleixnerready:	.byte 0
6589a163ed8SThomas Gleixner
6599a163ed8SThomas Gleixnerearly_recursion_flag:
6609a163ed8SThomas Gleixner	.long 0
6619a163ed8SThomas Gleixner
6629a163ed8SThomas Gleixnerint_msg:
663d5e397cbSIngo Molnar	.asciz "Unknown interrupt or fault at: %p %p %p\n"
6649a163ed8SThomas Gleixner
6659a163ed8SThomas Gleixnerfault_msg:
666575ca735SVegard Nossum/* fault info: */
667575ca735SVegard Nossum	.ascii "BUG: Int %d: CR2 %p\n"
668575ca735SVegard Nossum/* pusha regs: */
669575ca735SVegard Nossum	.ascii "     EDI %p  ESI %p  EBP %p  ESP %p\n"
670575ca735SVegard Nossum	.ascii "     EBX %p  EDX %p  ECX %p  EAX %p\n"
671575ca735SVegard Nossum/* fault frame: */
672575ca735SVegard Nossum	.ascii "     err %p  EIP %p   CS %p  flg %p\n"
673575ca735SVegard Nossum	.ascii "Stack: %p %p %p %p %p %p %p %p\n"
674575ca735SVegard Nossum	.ascii "       %p %p %p %p %p %p %p %p\n"
675575ca735SVegard Nossum	.asciz "       %p %p %p %p %p %p %p %p\n"
6769a163ed8SThomas Gleixner
6779a163ed8SThomas Gleixner#include "../../x86/xen/xen-head.S"
6789a163ed8SThomas Gleixner
6799a163ed8SThomas Gleixner/*
6809a163ed8SThomas Gleixner * The IDT and GDT 'descriptors' are a strange 48-bit object
6819a163ed8SThomas Gleixner * only used by the lidt and lgdt instructions. They are not
6829a163ed8SThomas Gleixner * like usual segment descriptors - they consist of a 16-bit
6839a163ed8SThomas Gleixner * segment size, and 32-bit linear address value:
6849a163ed8SThomas Gleixner */
6859a163ed8SThomas Gleixner
6869a163ed8SThomas Gleixner.globl boot_gdt_descr
6879a163ed8SThomas Gleixner.globl idt_descr
6889a163ed8SThomas Gleixner
6899a163ed8SThomas Gleixner	ALIGN
6909a163ed8SThomas Gleixner# early boot GDT descriptor (must use 1:1 address mapping)
6919a163ed8SThomas Gleixner	.word 0				# 32 bit align gdt_desc.address
6929a163ed8SThomas Gleixnerboot_gdt_descr:
6939a163ed8SThomas Gleixner	.word __BOOT_DS+7
6949a163ed8SThomas Gleixner	.long boot_gdt - __PAGE_OFFSET
6959a163ed8SThomas Gleixner
6969a163ed8SThomas Gleixner	.word 0				# 32-bit align idt_desc.address
6979a163ed8SThomas Gleixneridt_descr:
6989a163ed8SThomas Gleixner	.word IDT_ENTRIES*8-1		# idt contains 256 entries
6999a163ed8SThomas Gleixner	.long idt_table
7009a163ed8SThomas Gleixner
7019a163ed8SThomas Gleixner# boot GDT descriptor (later on used by CPU#0):
7029a163ed8SThomas Gleixner	.word 0				# 32 bit align gdt_desc.address
7039a163ed8SThomas GleixnerENTRY(early_gdt_descr)
7049a163ed8SThomas Gleixner	.word GDT_ENTRIES*8-1
7059a163ed8SThomas Gleixner	.long per_cpu__gdt_page		/* Overwritten for secondary CPUs */
7069a163ed8SThomas Gleixner
7079a163ed8SThomas Gleixner/*
7089a163ed8SThomas Gleixner * The boot_gdt must mirror the equivalent in setup.S and is
7099a163ed8SThomas Gleixner * used only for booting.
7109a163ed8SThomas Gleixner */
7119a163ed8SThomas Gleixner	.align L1_CACHE_BYTES
7129a163ed8SThomas GleixnerENTRY(boot_gdt)
7139a163ed8SThomas Gleixner	.fill GDT_ENTRY_BOOT_CS,8,0
7149a163ed8SThomas Gleixner	.quad 0x00cf9a000000ffff	/* kernel 4GB code at 0x00000000 */
7159a163ed8SThomas Gleixner	.quad 0x00cf92000000ffff	/* kernel 4GB data at 0x00000000 */
716