> At system startup time, the firmware is living in a known location in
> VA space: that covered by the first L1 PTE.  Therefore, I squirrel
> that away, and when necessary swap it with the 'normal' first L1 PTE
> of the running process, do the firmware access, then swap it back.

Hmm, the PTE of the running process.  I am not afraid to admit that
this would not have occurred to me, at least at my current level of 
understanding.

Thanks again for the information,
Jason