从 BIOS 到 start_kernel

// stage2
run_script()
  root_func()
  kernel_func()
    load_image()
  initrd_func()
  savedefault_func()
  boot_func()
    big_linux_boot()

// bzImage
#define LINUX_BZIMAGE_ADDR		RAW_ADDR (0x100000)
// CMD Line
#define LINUX_CL_OFFSET			0x9000
#define LINUX_CL_END_OFFSET		0x90FF


#define MULTIBOOT_SEARCH		8192
  unsigned char buffer[MULTIBOOT_SEARCH];
  grub_open (kernel);
  grub_read (buffer, MULTIBOOT_SEARCH)

  // buffer 判断启动设备
  // case: boot_type is Linux

  data_len = setup_sects << 9;
  //filemax 是在 grub_read 时由文件系统给出，是当前文件大小，这里是 bzImage 的大小
  text_len = filemax - data_len - SECTOR_SIZE;

  linux_data_tmp_addr = (char *) LINUX_BZIMAGE_ADDR + text_len;

  /* 拷贝 setup */
  grub_memmove (linux_data_tmp_addr, buffer, MULTIBOOT_SEARCH);
  grub_read (linux_data_tmp_addr + MULTIBOOT_SEARCH,
             data_len + SECTOR_SIZE - MULTIBOOT_SEARCH);

  /* 内核启动参数拷贝，特别处理了 mem= 参数  */
  char *src = skip_to (0, arg);
  char *dest = linux_data_tmp_addr + LINUX_CL_OFFSET;
  while (dest < linux_data_tmp_addr + LINUX_CL_END_OFFSET && *src)
    *(dest++) = *(src++);

  /* 拷贝 bzImage */
  grub_seek (data_len + SECTOR_SIZE);
  cur_addr = (int) linux_data_tmp_addr + LINUX_SETUP_MOVE_SIZE;
  grub_read ((char *) LINUX_BZIMAGE_ADDR, text_len);

init_bios_info (void)
{
  /*
   *  Get information from BIOS on installed RAM.
   */

  mbi.mem_lower = get_memsize (0); // 639 KiB
  mbi.mem_upper = get_memsize (1); // 2095996 KiB
  ...
}

#define LINUX_SETUP_MOVE_SIZE		0x9100
#define LINUX_OLD_REAL_MODE_ADDR	RAW_ADDR (0x90000)
load_image(){
	  /* Put the real mode part at as a high location as possible.  */
	  linux_data_real_addr
	    = (char *) ((mbi.mem_lower << 10) - LINUX_SETUP_MOVE_SIZE);
	  /* But it must not exceed the traditional area.  */
	  if (linux_data_real_addr > (char *) LINUX_OLD_REAL_MODE_ADDR)
	    linux_data_real_addr = (char *) LINUX_OLD_REAL_MODE_ADDR;
}

ENTRY(big_linux_boot)
	movl	EXT_C(linux_data_real_addr), %ebx
	
	/* copy the real mode part */
	movl	EXT_C(linux_data_tmp_addr), %esi
	movl	%ebx, %edi
	movl	$LINUX_SETUP_MOVE_SIZE, %ecx
	cld
	rep
	movsb

	/* change %ebx to the segment address */
	shrl	$4, %ebx                                                // 0x90000 >> 4 = 0x9000
	movl	%ebx, %eax
	addl	$0x20, %eax                                             // 启动段后 0x20 << 4 = 512
	movl	%eax, linux_setup_seg                                   // 0x9020
			                                                        //  |
	/* XXX new stack pointer in safe area for calling functions */  //  |
	movl	$0x4000, %esp                                           //  |
	call	EXT_C(stop_floppy)                                      //  |
                                                                    //  |
	/* final setup for linux boot */                                //  |
                                                                    //  |
	call	EXT_C(prot_to_real)                                     //  |
	.code16                                                         //  |
                                                                    //  |
	/* final setup for linux boot */                                //  |
	cli                                                             //  | 这里需要手动设置地址断点，否则会跳过
	movw	%bx, %ss                                                //  |
	movw	$LINUX_SETUP_STACK, %sp                                 //  |
	                                                                //  |
	movw	%bx, %ds                                                //  |
	movw	%bx, %es                                                //  |
	movw	%bx, %fs                                                //  |
	movw	%bx, %gs                                                //  |
                                                                    //  |
	/* jump to start */                                             //  |
	/* ljmp */                                                      //  |
	.byte	0xea                                                    //  |
	.word	0                                                       //  |
linux_setup_seg:	                                                // <-
	.word	0
	.code32

static void usage(void)
{
	die("Usage: build [-b] setup system [rootdev] [> image]");
}

// grep -F .section arch/x86/boot/header.S
	.section ".bstext", "ax"
	.section ".bsdata", "a"
	.section ".header", "a"
	.section ".inittext", "ax"
	.section ".initdata", "a"

	.section ".header", "a"
	.globl	hdr
hdr:
setup_sects:	.byte SETUPSECTS
root_flags:	.word ROOT_RDONLY
syssize:	.long SYSSIZE
ram_size:	.word RAMDISK
vid_mode:	.word SVGA_MODE
root_dev:	.word ROOT_DEV
boot_flag:	.word 0xAA55

	# offset 512, entry point

	.globl	_start
_start:
		# Explicitly enter this as bytes, or the assembler
		# tries to generate a 3-byte jump here, which causes
		# everything else to push off to the wrong offset.
		.byte	0xeb		# short (2-byte) jump
		.byte	start_of_setup-1f

code32_start:				# here loaders can put a different
					# start address for 32-bit code.
#ifndef __BIG_KERNEL__
		.long	0x1000		#   0x1000 = default for zImage
#else
		.long	0x100000	# 0x100000 = default for big kernel
#endif

ramdisk_image:	.long	0		# address of loaded ramdisk image
					# Here the loader puts the 32-bit
					# address where it loaded the image.
					# This only will be read by the kernel.

ramdisk_size:	.long	0		# its size in bytes
// ...
cmd_line_ptr:	.long	0		# (Header version 0x0202 or later)
					# If nonzero, a 32-bit pointer
					# to the kernel command line.
					# The command line should be
					# located between the start of
					# setup and the end of low
					# memory (0xa0000), or it may
					# get overwritten before it
					# gets read.  If this field is
					# used, there is no longer
					# anything magical about the
					# 0x90000 segment; the setup
					# can be located anywhere in
					# low memory 0x10000 or higher.

bugger_off_msg:
	.ascii	"Direct booting from floppy is no longer supported.\r\n"
	.ascii	"Please use a boot loader program instead.\r\n"
	.ascii	"\n"
	.ascii	"Remove disk and press any key to reboot . . .\r\n"
	.byte	0

// arch/x86/boot/header.S
_start();
  start_of_setup();
    main(); // arch/x86/boot/main.c
      copy_boot_params();
        memcpy(&boot_params.hdr, &hdr, sizeof hdr); // &hdr 是 header.S 中被 bootloader 修改过的 hdr 记录了各种信息所在
      validate_cpu(); // arch/x86/boot/cpu.c
      go_to_protected_mode(); // arch/x86/boot/pm.c
        protected_mode_jump(boot_params.hdr.code32_start, (u32)&boot_params + (ds() << 4));

// compressed/head_64.S
.section ".text"
relocated:
	/* Setup the stack */
	leaq	user_stack_end(%rip), %rsp
	call	decompress_kernel

user_stack:
	.fill 4096,4,0
user_stack_end:
// end of section .text

asmlinkage void decompress_kernel(void *rmode, unsigned long heap,
	uch *input_data, unsigned long input_len, uch *output)
{
	free_mem_ptr     = heap;	/* Heap  */
	free_mem_end_ptr = heap + HEAP_SIZE;
}
static void *malloc(int size)
{
	void *p;

	if (size <0) error("Malloc error");
	if (free_mem_ptr <= 0) error("Memory error");

	free_mem_ptr = (free_mem_ptr + 3) & ~3;	/* Align */

	p = (void *)free_mem_ptr;
	free_mem_ptr += size;

	if (free_mem_ptr >= free_mem_end_ptr)
		error("Out of memory");

	return p;
}

// arch/x86/boot/compressed/head_64.S
startup_32:
    // ...
	call verify_cpu
    // ...
/*
 * Prepare for entering 64 bit mode
 */

	/* Load new GDT with the 64bit segments using 32bit descriptor */
	leal	gdt(%ebp), %eax
	movl	%eax, gdt+2(%ebp)
	lgdt	gdt(%ebp)

	/* Enable PAE mode */
	xorl	%eax, %eax
	orl	$(1 << 5), %eax
	movl	%eax, %cr4

 /*
  * Build early 4G boot pagetable
  */
	/* Initialize Page tables to 0*/
	leal	pgtable(%ebx), %edi
	xorl	%eax, %eax
	movl	$((4096*6)/4), %ecx             // stosl 每次写 4 字节
	rep	stosl

	/* Build Level 4 */
	leal	pgtable + 0(%ebx), %edi
	leal	0x1007 (%edi), %eax
	movl	%eax, 0(%edi)                   // 写入 Level 4 的第一个表项
    /*
     * %eax = %edi + 0x1007
     *      = pgtable + 0x1000 + 0x7
     *
     * pgtable + 0x1000 是下一级表 Level 3 的基址。
     * 0x1000=4K
     * 低 12 位 0x007 是页表项标志：
     * bit 0 = P   Present
     * bit 1 = RW  Read/Write
     * bit 2 = US  User/Supervisor，这里置 1 表示 User
     */

	/* Build Level 3 */
	leal	pgtable + 0x1000(%ebx), %edi    // %edi 指向 Level 3 表，地址为 pgtable + 0x1000。
	leal	0x1007(%edi), %eax              // Level 2 的基址
	movl	$4, %ecx
1:	movl	%eax, 0x00(%edi)                // 写到 Level 3 的表项
	addl	$0x00001000, %eax               // Level 2 的下一张表的地址(写到 Level 3 的表项)
	addl	$8, %edi                        // Level 3 中的下一个表项
	decl	%ecx
	jnz	1b                                  // 写了 4 项 (%ecx)

	/* Build Level 2 */
	leal	pgtable + 0x2000(%ebx), %edi
	movl	$0x00000183, %eax
	movl	$2048, %ecx
1:	movl	%eax, 0(%edi)                   // 写到 Level 2 的表项
	addl	$0x00200000, %eax               // 0~2M, 2M~4M,... 的物理地址(写到 Level 2 的表项)
	addl	$8, %edi                        // Level 2 中的下一个表项
	decl	%ecx
	jnz	1b                                  // 写了 2048 项 (%ecx)
    /*
     * 0x183 = 0x100 | 0x80 | 0x3
     * bit 0 = P   Present
     * bit 1 = RW  Read/Write
     * bit 7 = PS  Page Size，置 1 表示 2MB 大页
     * bit 8 = G   Global
     *
     * 虚拟地址 0x00000000 -> 物理地址 0x00000000
     * 虚拟地址 0x00200000 -> 物理地址 0x00200000
     * ...
     * 虚拟地址 0xFFE00000 -> 物理地址 0xFFE00000
     *
     * 2048 = 4(KiB/page)/8(B/address) * 4(page)
     *      = 512(address/page)*4(page)
     *      = 2048(address)
     */

	/* Enable the boot page tables */
	leal	pgtable(%ebx), %eax
	movl	%eax, %cr3

    /*
     * PGD[0] -> PUD
     * PUD[0..3] -> 4 张 PMD
     * PMD0[0..512] PMD1[0..512] PMD2[0..512] PMD3[0..512] 2048 地址，每个地址对应 2MB 大页项 -> 恒等映射 0~4GB
     */

	/* Enable Long mode in EFER (Extended Feature Enable Register) */
    //...

	/* Setup for the jump to 64bit mode
	 *
	 * When the jump is performend we will be in long mode but
	 * in 32bit compatibility mode with EFER.LME = 1, CS.L = 0, CS.D = 1
	 * (and in turn EFER.LMA = 1).	To jump into 64bit mode we use
	 * the new gdt/idt that has __KERNEL_CS with CS.L = 1.
	 * We place all of the values on our mini stack so lret can
	 * used to perform that far jump.
	 */
	pushl	$__KERNEL_CS
	leal	startup_64(%ebp), %eax
	pushl	%eax

	/* Enter paged protected Mode, activating Long Mode */
	movl	$0x80000001, %eax /* Enable Paging and Protected mode */
	movl	%eax, %cr0

	/* Jump from 32bit compatibility mode into 64bit mode. */
	lret

no_longmode:
	/* This isn't an x86-64 CPU so hang */
1:
	hlt
	jmp     1b

// arch/x86/boot/compressed/head_64.S
	/* Be careful here startup_64 needs to be at a predictable
	 * address so I can export it in an ELF header.  Bootloaders
	 * should look at the ELF header to find this address, as
	 * it may change in the future.
	 */
	.code64
	.org 0x200
ENTRY(startup_64)
	/* Setup data segments. */
    // ...

	/* Compute the decompressed kernel start address.  It is where
	 * we were loaded at aligned to a 2M boundary. %rbp contains the
	 * decompressed kernel start address.
	 *
	 * If it is a relocatable kernel then decompress and run the kernel
	 * from load address aligned to 2MB addr, otherwise decompress and
	 * run the kernel from CONFIG_PHYSICAL_START
	 */

	/* Start with the delta to where the kernel will run at. */
	movq	$CONFIG_PHYSICAL_START, %rbp # $CONFIG_PHYSICAL_START=0x200000
	movq	%rbp, %rbx

	/* Replace the compressed data size with the uncompressed size */
	movl	input_len(%rip), %eax
	subq	%rax, %rbx
	movl	output_len(%rip), %eax
	addq	%rax, %rbx
	/* input_len: This is a label pointing to the address where the 4-byte size is stored.
	 * input_len(%rip): This fetches the 4-byte content stored at that address using PC-relative addressing.
	 *
	 * $rbx = CONFIG_PHYSICAL_START - $input_len + $output_len
	 *      = CONFIG_PHYSICAL_START + (解压后大小) - （解压前大小）
	 *
	 * $rbx 存的是拷贝压缩的 vmlinux 到的目标地址
	 *
	 * 所以这里的意思是：
	 * 拷贝完成之后，压缩包放在解压区的末尾。虽然解压时可能会覆盖原始的压缩包，
	 * 但那部分大概是已经被解压完成的了。最差的情况是完全没压缩，那么就是从原始位置拷
	 * 贝出来，拷回原始位置。但是又因为我们有 bss，所以最差的情况还是会有 bss 那么大的
	 * 偏移。栈位于 .text 的末尾
	 */

	/* Add 8 bytes for every 32K input block */
	//...
	/* Add 32K + 18 bytes of extra slack and align on a 4K boundary */
	//...
	/* 微调 $rbx
	 * Gemini: 用于 gzip 算法的硬性要求（滑动窗口缓冲区）
	 * https://share.google/aimode/ZNuxp67UMyrvOCwb4
	 */

	/* Copy the compressed kernel to the end of our buffer
	 * where decompression in place becomes safe.
	 */

	leaq	_end(%rip), %r8
	/* $r8 存的是 _end 段的代码地址
	 * lea 对于 rip 是取相对大小，使得目标寄存器存的就是 _end 代码所在的实际地址
	 */
	leaq	_end(%rbx), %r9
	/* $r9 存的是 _end 的值 + rbx
	 * lea 对于 rbx 是取绝对大小（文件中的 offset）
	 */
	movq	$_end /* - $startup_32 */, %rcx
1:	subq	$8, %r8
	subq	$8, %r9
	movq	0(%r8), %rax
	movq	%rax, 0(%r9)
	subq	$8, %rcx
	jnz	1b

    // rcx: vmlinux 的大小+bss，用于计数
    // r8: vmlinux 的大小+bss 的末尾
    // r9: 拷贝目标区域的末尾

/*
 * Jump to the relocated address.
 */
/*
 * rbx 是新区的压缩 vmlinux 的起始位置，起始位置往后 relocated，那就是新区的 relocated
 */
	leaq	relocated(%rbx), %rax
	jmp	*%rax

.section ".text"
relocated:
	/*
	 * Clear BSS
	 */
	/*
	 * 我们上面拷贝了 bss 区，但是实际上 src 中并没有初始化的 bss 区，所以需要先初始化
	 */
	// ...

	/* Setup the stack */
	leaq	user_stack_end(%rip), %rsp

	/* zero EFLAGS after setting rsp */
	// ...

/*
 * Do the decompression, and jump to the new kernel..
 */
	pushq	%rsi			# Save the real mode argument
	movq	%rsi, %rdi		# real mode address
	leaq	_heap(%rip), %rsi	# _heap
	leaq	input_data(%rip), %rdx  # input_data
	movl	input_len(%rip), %eax
	movq	%rax, %rcx		# input_len
	movq	%rbp, %r8		# output
	call	decompress_kernel
	popq	%rsi


/*
 * Jump to the decompressed kernel.
 */
	jmp	*%rbp # 0x200000

asmlinkage void decompress_kernel(void *rmode, unsigned long heap,
	uch *input_data, unsigned long input_len, uch *output)
{
	real_mode = rmode;

	if (RM_SCREEN_INFO.orig_video_mode == 7) {
		vidmem = (char *) 0xb0000;
		vidport = 0x3b4;
	} else {
		vidmem = (char *) 0xb8000;
		vidport = 0x3d4;
	}
	free_mem_ptr     = heap;	/* Heap  */
	free_mem_end_ptr = heap + HEAP_SIZE;
}

static void putstr(const char *s)
{
	int x,y,pos;
	char c;

	x = RM_SCREEN_INFO.orig_x;
	y = RM_SCREEN_INFO.orig_y;

	while ( ( c = *s++ ) != '\0' ) {
		if ( c == '\n' ) {
			x = 0;
			if ( ++y >= lines ) {
				scroll();
				y--;
			}
		} else {
			vidmem [ ( x + cols * y ) * 2 ] = c; 
			if ( ++x >= cols ) {
				x = 0;
				if ( ++y >= lines ) {
					scroll();
					y--;
				}
			}
		}
	}

	RM_SCREEN_INFO.orig_x = x;
	RM_SCREEN_INFO.orig_y = y;

	pos = (x + cols * y) * 2;	/* Update cursor position */
	outb_p(14, vidport);
	outb_p(0xff & (pos >> 9), vidport+1);
	outb_p(15, vidport);
	outb_p(0xff & (pos >> 1), vidport+1);
}

// include/asm-x86/page_64.h
#define __START_KERNEL_map	_AC(0xffffffff80000000, UL)

// include/asm-x86/pgtable_64.h
#define _PAGE_PRESENT	0x001
#define _PAGE_RW	0x002
#define _PAGE_PWT	0x008
#define _PAGE_PCD	0x010
#define _PAGE_ACCESSED	0x020
#define _PAGE_DIRTY	0x040
// ...
#define _KERNPG_TABLE	(_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED | _PAGE_DIRTY)

/*
 * PMD_SHIFT determines the size of the area a middle-level
 * page table can map
 */
#define PMD_SHIFT	21
/*
 * pte 的数字每 + 1 就涨 4 KiB 那么多，
 * 从按字节编址的角度考虑，不管最后 12位的 offset 的含义。PMD 每增长一个 1 就代表有那么多个 bytes 被映射。同理 PMD 也是
 */
#define PMD_SIZE	(_AC(1,UL) << PMD_SHIFT)

#define __PAGE_KERNEL_EXEC \
	(_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED)
#define __PAGE_KERNEL_LARGE_EXEC \
	(__PAGE_KERNEL_EXEC | _PAGE_PSE)


// arch/x86/kernel/head_64.S
.balign PAGE_SIZE

#define NEXT_PAGE(name) \
	.balign	PAGE_SIZE; \
ENTRY(name)

/* Automate the creation of 1 to 1 mapping pmd entries */
#define PMDS(START, PERM, COUNT)		\
	i = 0 ;					\
	.rept (COUNT) ;				\
	.quad	(START) + (i << 21) + (PERM) ;	\
	i = i + 1 ;				\
	.endr

	/*
	 * This default setting generates an ident mapping at address 0x100000
	 * and a mapping for the kernel that precisely maps virtual address
	 * 0xffffffff80000000 to physical address 0x000000. (always using
	 * 2Mbyte large pages provided by PAE mode)
	 */
NEXT_PAGE(init_level4_pgt)
	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE  // Entry       0:     8 bytes
	.fill	257,8,0                                                // Entry   1-257: 257*8 bytes
	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE  // Entry     258:     8 bytes
	.fill	252,8,0                                                // Entry 259-510: 252*8 bytes
	/* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
	.quad	level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE   // Entry 511: 8 bytes

NEXT_PAGE(level3_ident_pgt)
	.quad	level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
	.fill	511,8,0

NEXT_PAGE(level3_kernel_pgt)
	.fill	510,8,0
	/* (2^48-(2*1024*1024*1024)-((2^39)*511))/(2^30) = 510 */
	.quad	level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
	.quad	level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
    /*
     * PGD.511.510: level2_kernel_pgt
     * PGD.511.511: level2_fixmap_pgt
     */

NEXT_PAGE(level2_fixmap_pgt)
	.fill	506,8,0
	.quad	level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
	/* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
	.fill	5,8,0

NEXT_PAGE(level1_fixmap_pgt)
	.fill	512,8,0

NEXT_PAGE(level2_ident_pgt)
	/* Since I easily can, map the first 1G.
	 * Don't set NX because code runs from these pages.
	 */
	PMDS(0x0000000000000000, __PAGE_KERNEL_LARGE_EXEC, PTRS_PER_PMD)

NEXT_PAGE(level2_kernel_pgt)
	/* 40MB kernel mapping. The kernel code cannot be bigger than that.
	   When you change this change KERNEL_TEXT_SIZE in page.h too. */
	/* (2^48-(2*1024*1024*1024)-((2^39)*511)-((2^30)*510)) = 0 */
	PMDS(0x0000000000000000, __PAGE_KERNEL_LARGE_EXEC|_PAGE_GLOBAL, KERNEL_TEXT_SIZE/PMD_SIZE)
	/* Module mapping starts here */
	.fill	(PTRS_PER_PMD - (KERNEL_TEXT_SIZE/PMD_SIZE)),8,0

NEXT_PAGE(level2_spare_pgt)
	.fill   512,8,0

unsigned long __phys_addr(unsigned long x)
{
	if (x >= __START_KERNEL_map)
		return x - __START_KERNEL_map + phys_base;
	return x - PAGE_OFFSET;
}

startup_64:
	/*
	 * At this point the CPU runs in 64bit mode CS.L = 1 CS.D = 1,
	 * and someone has loaded an identity mapped page table
	 * for us.  These identity mapped page tables map all of the
	 * kernel pages and possibly all of memory.
	 *
	 * %esi holds a physical pointer to real_mode_data.
	 *
	 * We come here either directly from a 64bit bootloader, or from
	 * arch/x86_64/boot/compressed/head.S.
	 *
	 * We only come here initially at boot nothing else comes here.
	 *
	 * Since we may be loaded at an address different from what we were
	 * compiled to run at we first fixup the physical addresses in our page
	 * tables and then reload them.
	 */

	/* Compute the delta between the address I am compiled to run at and the
	 * address I am actually running at.
	 */
	leaq	_text(%rip), %rbp
	subq	$_text - __START_KERNEL_map, %rbp

	/* Is the address not 2M aligned? */
	movq	%rbp, %rax
	andl	$~LARGE_PAGE_MASK, %eax
	testl	%eax, %eax
	jnz	bad_address

	/* Is the address too large? */
	leaq	_text(%rip), %rdx
	movq	$PGDIR_SIZE, %rax
	cmpq	%rax, %rdx
	jae	bad_address

	/* Fixup the physical addresses in the page table
	 */
	addq	%rbp, init_level4_pgt + 0(%rip)
	addq	%rbp, init_level4_pgt + (258*8)(%rip)
	addq	%rbp, init_level4_pgt + (511*8)(%rip)

	addq	%rbp, level3_ident_pgt + 0(%rip)

	addq	%rbp, level3_kernel_pgt + (510*8)(%rip)
	addq	%rbp, level3_kernel_pgt + (511*8)(%rip)

	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)

	/* Add an Identity mapping if I am above 1G */
	leaq	_text(%rip), %rdi
	andq	$LARGE_PAGE_MASK, %rdi

	movq	%rdi, %rax
	shrq	$PUD_SHIFT, %rax
	andq	$(PTRS_PER_PUD - 1), %rax
	jz	ident_complete

	leaq	(level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
	leaq	level3_ident_pgt(%rip), %rbx
	movq	%rdx, 0(%rbx, %rax, 8)

	movq	%rdi, %rax
	shrq	$PMD_SHIFT, %rax
	andq	$(PTRS_PER_PMD - 1), %rax
	leaq	__PAGE_KERNEL_LARGE_EXEC(%rdi), %rdx
	leaq	level2_spare_pgt(%rip), %rbx
	movq	%rdx, 0(%rbx, %rax, 8)
ident_complete:

	/* Fixup the kernel text+data virtual addresses
	 */
	leaq	level2_kernel_pgt(%rip), %rdi
	leaq	4096(%rdi), %r8
	/* See if it is a valid page table entry */
1:	testq	$1, 0(%rdi)
	jz	2f
	addq	%rbp, 0(%rdi)
	/* Go to the next page */
2:	addq	$8, %rdi
	cmp	%r8, %rdi
	jne	1b

	/* Fixup phys_base */
	addq	%rbp, phys_base(%rip)

#ifdef CONFIG_SMP
	addq	%rbp, trampoline_level4_pgt + 0(%rip)
	addq	%rbp, trampoline_level4_pgt + (511*8)(%rip)
#endif
#ifdef CONFIG_ACPI_SLEEP
	addq	%rbp, wakeup_level4_pgt + 0(%rip)
	addq	%rbp, wakeup_level4_pgt + (511*8)(%rip)
#endif

	/* Due to ENTRY(), sometimes the empty space gets filled with
	 * zeros. Better take a jmp than relying on empty space being
	 * filled with 0x90 (nop)
	 */
	jmp secondary_startup_64

secondary_startup_64:
	/*
	 * At this point the CPU runs in 64bit mode CS.L = 1 CS.D = 1,
	 * and someone has loaded a mapped page table.
	 *
	 * %esi holds a physical pointer to real_mode_data.
	 *
	 * We come here either from startup_64 (using physical addresses)
	 * or from trampoline.S (using virtual addresses).
	 *
	 * Using virtual addresses from trampoline.S removes the need
	 * to have any identity mapped pages in the kernel page table
	 * after the boot processor executes this code.
	 */

	/* Enable PAE mode and PGE */
	xorq	%rax, %rax
	btsq	$5, %rax
	btsq	$7, %rax
	movq	%rax, %cr4

	/* Setup early boot stage 4 level pagetables. */
	movq	$(init_level4_pgt - __START_KERNEL_map), %rax
	addq	phys_base(%rip), %rax
	movq	%rax, %cr3

	/*
	 * 此时页表中有两个 map:
	 * The Identity Map (Low VA):
	 *      Virtual addresses 0x0000000000XXXXXX map directly to Physical addresses 0x0000000000XXXXXX.
	 * The Kernel High Map (High VA):
	 *      Virtual addresses 0xffffffff80XXXXXX also map to Physical addresses 0x0000000000XXXXXX.
	 *
	 * 这个时候看起来代码还在 pa，但其实 mmu 已经生效了，实际的地址已经是 va 了
	 * https://gemini.google.com/app/ef8a1a938d732438
	 */


	/* 这里正式跳转到 va 地址 */
	/* Ensure I am executing from virtual addresses */
	movq	$1f, %rax
	jmp	*%rax
1:
    // ...

	/* Check if nx is implemented */
    // ...
	/* Setup EFER (Extended Feature Enable Register) */
    // ...
	/* Setup cr0 */
#define CR0_PM				1		/* protected mode */
#define CR0_MP				(1<<1)
#define CR0_ET				(1<<4)
#define CR0_NE				(1<<5)
#define CR0_WP				(1<<16)
#define CR0_AM				(1<<18)
#define CR0_PAGING 			(1<<31)
	movl $CR0_PM|CR0_MP|CR0_ET|CR0_NE|CR0_WP|CR0_AM|CR0_PAGING,%eax
	/* Make changes effective */
	movq	%rax, %cr0

	/* Setup a boot time stack */
	movq init_rsp(%rip),%rsp

	/* zero EFLAGS after setting rsp */
	pushq $0
	popfq

	/*
	 * We must switch to a new descriptor in kernel space for the GDT
	 * because soon the kernel won't have access anymore to the userspace
	 * addresses where we're currently running on. We have to do that here
	 * because in 32bit we couldn't load a 64bit linear address.
	 */
	lgdt	cpu_gdt_descr(%rip)

	/* set up data segments. actually 0 would do too */
	movl $__KERNEL_DS,%eax
	movl %eax,%ds
	movl %eax,%ss
	movl %eax,%es

	/*
	 * We don't really need to load %fs or %gs, but load them anyway
	 * to kill any stale realmode selectors.  This allows execution
	 * under VT hardware.
	 */
	movl %eax,%fs
	movl %eax,%gs

	/* 
	 * Setup up a dummy PDA. this is just for some early bootup code
	 * that does in_interrupt() 
	 */ 
	/* esi is pointer to real mode structure with interesting info.
	   pass it to C */
	/*
     * 这里的 %esi 是 setup.bin 里做的 boot_params
     * 将作为 x86_64_start_kernel 的 real_mode_data 参数
     */
	movl	%esi, %edi
	
	/* Finally jump to run C code and to be on real kernel address
	 * Since we are running on identity-mapped space we have to jump
	 * to the full 64bit address, this is only possible as indirect
	 * jump.  In addition we need to ensure %cs is set so we make this
	 * a far return.
	 */
	movq	initial_code(%rip),%rax
	pushq	$0		# fake return address to stop unwinder
	pushq	$__KERNEL_CS	# set correct cs
	pushq	%rax		# target address in negative space
	lretq
initial_code:
	.quad	x86_64_start_kernel

void __init x86_64_start_kernel(char * real_mode_data)
{
	int i;

	/* clear bss before set_intr_gate with early_idt_handler */
	clear_bss();

	/* Make NULL pointers segfault */
	zap_identity_mappings();

	for (i = 0; i < IDT_ENTRIES; i++)
		set_intr_gate(i, early_idt_handler);
	load_idt((const struct desc_ptr *)&idt_descr);

	early_printk("Kernel alive\n");

 	for (i = 0; i < NR_CPUS; i++)
 		cpu_pda(i) = &boot_cpu_pda[i];

	pda_init(0);
	copy_bootdata(__va(real_mode_data));
#ifdef CONFIG_SMP
	cpu_set(0, cpu_online_map);
#endif
	start_kernel();
}

// include/asm-x86/pgtable_64.h
#define pgd_offset_k(address) (init_level4_pgt + pgd_index(address))

x86_64_start_kernel():
  zap_identity_mappings(void);
    pgd_t *pgd = pgd_offset_k(0UL);
    pgd_clear(pgd);
      set_pgd(pgd, __pgd(0));
    __flush_tlb();
      write_cr3(read_cr3());