+# Set up page tables for one-to-map linear to physical map for the
+# first 64 MB of RAM.
+# See [IA32-v3a] section 3.7.6 "Page-Directory and Page-Table Entries"
+# for a description of the bits in %eax.
+
+ movw $0x1000, %ax
+ movw %ax, %es
+ movl $0x7, %eax
+ movl $0x4000, %ecx
+ subl %edi, %edi
+1: movl %eax, %es:(%di)
+ addw $4, %di
+ addl $0x1000, %eax
+ loop 1b
+
+# Set page directory base register.
+
+ movl $0xf000, %eax
+ movl %eax, %cr3
+
+#### Switch to protected mode.
+
+# First, disable interrupts. We won't set up the IDT until we get
+# into C code, so any interrupt would blow us away.
+
+ cli
+
+# Protected mode requires a GDT, so point the GDTR to our GDT.
+# We need a data32 prefix to ensure that all 32 bits of the GDT
+# descriptor are loaded (default is to load only 24 bits).
+# The CPU doesn't need an addr32 prefix but ELF doesn't do 16-bit
+# relocations.
+
+ data32 addr32 lgdt gdtdesc - LOADER_PHYS_BASE - 0x20000
+
+# Then we turn on the following bits in CR0:
+# PE (Protect Enable): this turns on protected mode.
+# PG (Paging): turns on paging.
+# WP (Write Protect): if unset, ring 0 code ignores
+# write-protect bits in page tables (!).
+# EM (Emulation): forces floating-point instructions to trap.
+# We don't support floating point.
+
+ movl %cr0, %eax
+ orl $CR0_PE | CR0_PG | CR0_WP | CR0_EM, %eax
+ movl %eax, %cr0
+
+# We're now in protected mode in a 16-bit segment. The CPU still has
+# the real-mode code segment cached in %cs's segment descriptor. We
+# need to reload %cs, and the easiest way is to use a far jump.
+# Because we're not running in a 32-bit segment the data32 prefix is
+# needed to jump to a 32-bit offset in the target segment.
+
+ data32 ljmp $SEL_KCSEG, $1f
+
+# We're now in protected mode in a 32-bit segment.
+# Let the assembler know.
+
+ .code32
+
+# Reload all the other segment registers and the stack pointer to
+# point into our new GDT.
+
+1: mov $SEL_KDSEG, %ax
+ mov %ax, %ds
+ mov %ax, %es
+ mov %ax, %fs
+ mov %ax, %gs
+ mov %ax, %ss
+ addl $LOADER_PHYS_BASE, %esp
+ movl $0, %ebp # Null-terminate main()'s backtrace
+
+#### Call main().
+
+ call main
+
+# main() shouldn't ever return. If it does, spin.