Index: user/nwhitehorn/kboot/powerpc/kboot/kerneltramp.S
===================================================================
--- user/nwhitehorn/kboot/powerpc/kboot/kerneltramp.S	(revision 276686)
+++ user/nwhitehorn/kboot/powerpc/kboot/kerneltramp.S	(revision 276687)
@@ -1,38 +1,55 @@
 /*
  * This is the analog to the kexec "purgatory" code
  *
  * The goal here is to call the actual kernel entry point with the arguments it
  * expects when kexec calls into it with no arguments. The value of the kernel
- * entry point and arguments r3-r7 are copied into the trampoline text (which can
- * be executed from any address) at bytes 8-32.
+ * entry point and arguments r3-r7 are copied into the trampoline text (which
+ * can be executed from any address) at bytes 8-32. kexec begins execution
+ * of APs at 0x60 bytes past the entry point, executing in a copy relocated
+ * to the absolute address 0x60. Here we implement a loop waiting on the release
+ * of a lock by the kernel at 0x40.
  * 
- * TODO:
- * - This may or may not need to relocate the kernel before executing it
- * - kexec enters at address 0x60 for all APs. We need to catch these and hold
- *   them.
  */
 
 #include <machine/asm.h>
 
         .globl  CNAME(kerneltramp),CNAME(szkerneltramp)
 CNAME(kerneltramp):
 	mflr %r9
-	bl 1f
+	bl 2f
 	.space 24	/* branch address, r3-r7 */
-1:
+
+. = kerneltramp + 0x40	/* AP spinlock */
+	.long 0
+
+. = kerneltramp + 0x60	/* AP entry point */
+	li	%r3,0x40
+1:	lwz	%r1,0(%r3)
+	cmpwi	%r1,0
+	beq	1b
+
+	/* Jump into CPU reset */
+	li	%r0,0x100
+	icbi	0,%r0
+	isync
+	sync
+	ba	0x100
+
+2:			/* Continuation of kerneltramp */
 	mflr	%r8
 	mtlr	%r9
 	lwz	%r3,0(%r8)
 	ld	%r3,0(%r3)	/* Resolve function descriptor */
 	mtctr	%r3
 	lwz	%r3,4(%r8)
 	lwz	%r4,8(%r8)
 	lwz	%r5,12(%r8)
 	lwz	%r6,16(%r8)
 	lwz	%r7,20(%r8)
 	bctr
+	
 endkerneltramp:
 
 	.data
 CNAME(szkerneltramp):
 	.long endkerneltramp - CNAME(kerneltramp)
Index: user/nwhitehorn/kboot/powerpc/kboot/ppc64_elf_freebsd.c
===================================================================
--- user/nwhitehorn/kboot/powerpc/kboot/ppc64_elf_freebsd.c	(revision 276686)
+++ user/nwhitehorn/kboot/powerpc/kboot/ppc64_elf_freebsd.c	(revision 276687)
@@ -1,114 +1,114 @@
 /*-
  * Copyright (c) 2001 Benno Rice <benno@FreeBSD.org>
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
 #define __ELF_WORD_SIZE 64
 
 #include <sys/param.h>
 #include <sys/linker.h>
 
 #include <machine/metadata.h>
 #include <machine/elf.h>
 
 #include <stand.h>
 
 #include "bootstrap.h"
 #include "host_syscall.h"
 
 extern char		end[];
 extern vm_offset_t	reloc;	/* From <arch>/conf.c */
 extern void		*kerneltramp;
 extern size_t		szkerneltramp;
 extern int		nkexec_segments;
 extern void *		loaded_segments;
 
 int
 ppc64_elf_loadfile(char *filename, u_int64_t dest,
     struct preloaded_file **result)
 {
 	int	r;
 
 	r = __elfN(loadfile)(filename, dest, result);
 	if (r != 0)
 		return (r);
 
 	return (0);
 }
 
 int
 ppc64_elf_exec(struct preloaded_file *fp)
 {
 	struct file_metadata	*fmp;
 	vm_offset_t		mdp, dtb;
 	Elf_Ehdr		*e;
 	int			error;
 	uint32_t		*trampoline;
-	vm_offset_t		trampolinebase = 16*1024*1024; /* XXX */
+	vm_offset_t		trampolinebase = 96*1024*1024; /* XXX */
 
 	if ((fmp = file_findmetadata(fp, MODINFOMD_ELFHDR)) == NULL) {
 		return(EFTYPE);
 	}
 	e = (Elf_Ehdr *)&fmp->md_data;
 	
 	/* Handle function descriptor */
 	trampoline = malloc(szkerneltramp);
 	memcpy(trampoline, &kerneltramp, szkerneltramp);
 	trampoline[2] = e->e_entry;
 	trampoline[4] = 0; /* Phys. mem offset */
 	trampoline[5] = 0; /* OF entry point */
 
 	if ((error = md_load64(fp->f_args, &mdp, &dtb)) != 0)
 		return (error);
 
 	trampoline[3] = dtb;
 	trampoline[6] = mdp;
 	trampoline[7] = sizeof(mdp);
 	printf("Kernel entry at %#jx ...\n", e->e_entry);
 
 	dev_cleanup();
 
 	archsw.arch_copyin(trampoline, trampolinebase, szkerneltramp);
 	free(trampoline);
 
 	error = kexec_load(trampolinebase, nkexec_segments, &loaded_segments);
 	if (error != 0)
 		panic("kexec_load returned error: %d", error);
 	error = host_reboot(0xfee1dead, 672274793,
 	    0x45584543 /* LINUX_REBOOT_CMD_KEXEC */, NULL);
 	if (error != 0)
 		panic("reboot returned error: %d", error);
 	while (1) {}
 
 	panic("exec returned");
 }
 
 struct file_format	ppc_elf64 =
 {
 	ppc64_elf_loadfile,
 	ppc64_elf_exec
 };