1/*
2 *  PowerPC version
3 *    Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
4 *  Rewritten by Cort Dougan (cort@cs.nmt.edu) for PReP
5 *    Copyright (C) 1996 Cort Dougan <cort@cs.nmt.edu>
6 *  Low-level exception handlers and MMU support
7 *  rewritten by Paul Mackerras.
8 *    Copyright (C) 1996 Paul Mackerras.
9 *  MPC8xx modifications by Dan Malek
10 *    Copyright (C) 1997 Dan Malek (dmalek@jlc.net).
11 *
12 *  This file contains low-level support and setup for PowerPC 8xx
13 *  embedded processors, including trap and interrupt dispatch.
14 *
15 *  This program is free software; you can redistribute it and/or
16 *  modify it under the terms of the GNU General Public License
17 *  as published by the Free Software Foundation; either version
18 *  2 of the License, or (at your option) any later version.
19 *
20 */
21
22#include <asm/processor.h>
23#include <asm/page.h>
24#include <asm/mmu.h>
25#include <asm/cache.h>
26#include <asm/pgtable.h>
27#include <asm/cputable.h>
28#include <asm/thread_info.h>
29#include <asm/ppc_asm.h>
30#include <asm/asm-offsets.h>
31
32/* Macro to make the code more readable. */
33#ifdef CONFIG_8xx_CPU6
34#define DO_8xx_CPU6(val, reg)	\
35	li	reg, val;	\
36	stw	reg, 12(r0);	\
37	lwz	reg, 12(r0);
38#else
39#define DO_8xx_CPU6(val, reg)
40#endif
41	.text
42	.globl	_stext
43_stext:
44	.text
45	.globl	_start
46_start:
47
48/* MPC8xx
49 * This port was done on an MBX board with an 860.  Right now I only
50 * support an ELF compressed (zImage) boot from EPPC-Bug because the
51 * code there loads up some registers before calling us:
52 *   r3: ptr to board info data
53 *   r4: initrd_start or if no initrd then 0
54 *   r5: initrd_end - unused if r4 is 0
55 *   r6: Start of command line string
56 *   r7: End of command line string
57 *
58 * I decided to use conditional compilation instead of checking PVR and
59 * adding more processor specific branches around code I don't need.
60 * Since this is an embedded processor, I also appreciate any memory
61 * savings I can get.
62 *
63 * The MPC8xx does not have any BATs, but it supports large page sizes.
64 * We first initialize the MMU to support 8M byte pages, then load one
65 * entry into each of the instruction and data TLBs to map the first
66 * 8M 1:1.  I also mapped an additional I/O space 1:1 so we can get to
67 * the "internal" processor registers before MMU_init is called.
68 *
69 * The TLB code currently contains a major hack.  Since I use the condition
70 * code register, I have to save and restore it.  I am out of registers, so
71 * I just store it in memory location 0 (the TLB handlers are not reentrant).
72 * To avoid making any decisions, I need to use the "segment" valid bit
73 * in the first level table, but that would require many changes to the
74 * Linux page directory/table functions that I don't want to do right now.
75 *
76 * I used to use SPRG2 for a temporary register in the TLB handler, but it
77 * has since been put to other uses.  I now use a hack to save a register
78 * and the CCR at memory location 0.....Someday I'll fix this.....
79 *	-- Dan
80 */
81	.globl	__start
82__start:
83	mr	r31,r3			/* save parameters */
84	mr	r30,r4
85	mr	r29,r5
86	mr	r28,r6
87	mr	r27,r7
88
89	/* We have to turn on the MMU right away so we get cache modes
90	 * set correctly.
91	 */
92	bl	initial_mmu
93
94/* We now have the lower 8 Meg mapped into TLB entries, and the caches
95 * ready to work.
96 */
97
98turn_on_mmu:
99	mfmsr	r0
100	ori	r0,r0,MSR_DR|MSR_IR
101	mtspr	SPRN_SRR1,r0
102	lis	r0,start_here@h
103	ori	r0,r0,start_here@l
104	mtspr	SPRN_SRR0,r0
105	SYNC
106	rfi				/* enables MMU */
107
108/*
109 * Exception entry code.  This code runs with address translation
110 * turned off, i.e. using physical addresses.
111 * We assume sprg3 has the physical address of the current
112 * task's thread_struct.
113 */
114#define EXCEPTION_PROLOG	\
115	mtspr	SPRN_SPRG0,r10;	\
116	mtspr	SPRN_SPRG1,r11;	\
117	mfcr	r10;		\
118	EXCEPTION_PROLOG_1;	\
119	EXCEPTION_PROLOG_2
120
121#define EXCEPTION_PROLOG_1	\
122	mfspr	r11,SPRN_SRR1;		/* check whether user or kernel */ \
123	andi.	r11,r11,MSR_PR;	\
124	tophys(r11,r1);			/* use tophys(r1) if kernel */ \
125	beq	1f;		\
126	mfspr	r11,SPRN_SPRG3;	\
127	lwz	r11,THREAD_INFO-THREAD(r11);	\
128	addi	r11,r11,THREAD_SIZE;	\
129	tophys(r11,r11);	\
1301:	subi	r11,r11,INT_FRAME_SIZE	/* alloc exc. frame */
131
132
133#define EXCEPTION_PROLOG_2	\
134	CLR_TOP32(r11);		\
135	stw	r10,_CCR(r11);		/* save registers */ \
136	stw	r12,GPR12(r11);	\
137	stw	r9,GPR9(r11);	\
138	mfspr	r10,SPRN_SPRG0;	\
139	stw	r10,GPR10(r11);	\
140	mfspr	r12,SPRN_SPRG1;	\
141	stw	r12,GPR11(r11);	\
142	mflr	r10;		\
143	stw	r10,_LINK(r11);	\
144	mfspr	r12,SPRN_SRR0;	\
145	mfspr	r9,SPRN_SRR1;	\
146	stw	r1,GPR1(r11);	\
147	stw	r1,0(r11);	\
148	tovirt(r1,r11);			/* set new kernel sp */	\
149	li	r10,MSR_KERNEL & ~(MSR_IR|MSR_DR); /* can take exceptions */ \
150	MTMSRD(r10);			/* (except for mach check in rtas) */ \
151	stw	r0,GPR0(r11);	\
152	SAVE_4GPRS(3, r11);	\
153	SAVE_2GPRS(7, r11)
154
155/*
156 * Note: code which follows this uses cr0.eq (set if from kernel),
157 * r11, r12 (SRR0), and r9 (SRR1).
158 *
159 * Note2: once we have set r1 we are in a position to take exceptions
160 * again, and we could thus set MSR:RI at that point.
161 */
162
163/*
164 * Exception vectors.
165 */
166#define EXCEPTION(n, label, hdlr, xfer)		\
167	. = n;					\
168label:						\
169	EXCEPTION_PROLOG;			\
170	addi	r3,r1,STACK_FRAME_OVERHEAD;	\
171	xfer(n, hdlr)
172
173#define EXC_XFER_TEMPLATE(n, hdlr, trap, copyee, tfer, ret)	\
174	li	r10,trap;					\
175	stw	r10,_TRAP(r11);					\
176	li	r10,MSR_KERNEL;					\
177	copyee(r10, r9);					\
178	bl	tfer;						\
179i##n:								\
180	.long	hdlr;						\
181	.long	ret
182
183#define COPY_EE(d, s)		rlwimi d,s,0,16,16
184#define NOCOPY(d, s)
185
186#define EXC_XFER_STD(n, hdlr)		\
187	EXC_XFER_TEMPLATE(n, hdlr, n, NOCOPY, transfer_to_handler_full,	\
188			  ret_from_except_full)
189
190#define EXC_XFER_LITE(n, hdlr)		\
191	EXC_XFER_TEMPLATE(n, hdlr, n+1, NOCOPY, transfer_to_handler, \
192			  ret_from_except)
193
194#define EXC_XFER_EE(n, hdlr)		\
195	EXC_XFER_TEMPLATE(n, hdlr, n, COPY_EE, transfer_to_handler_full, \
196			  ret_from_except_full)
197
198#define EXC_XFER_EE_LITE(n, hdlr)	\
199	EXC_XFER_TEMPLATE(n, hdlr, n+1, COPY_EE, transfer_to_handler, \
200			  ret_from_except)
201
202/* System reset */
203	EXCEPTION(0x100, Reset, unknown_exception, EXC_XFER_STD)
204
205/* Machine check */
206	. = 0x200
207MachineCheck:
208	EXCEPTION_PROLOG
209	mfspr r4,SPRN_DAR
210	stw r4,_DAR(r11)
211	mfspr r5,SPRN_DSISR
212	stw r5,_DSISR(r11)
213	addi r3,r1,STACK_FRAME_OVERHEAD
214	EXC_XFER_STD(0x200, machine_check_exception)
215
216/* Data access exception.
217 * This is "never generated" by the MPC8xx.  We jump to it for other
218 * translation errors.
219 */
220	. = 0x300
221DataAccess:
222	EXCEPTION_PROLOG
223	mfspr	r10,SPRN_DSISR
224	stw	r10,_DSISR(r11)
225	mr	r5,r10
226	mfspr	r4,SPRN_DAR
227	EXC_XFER_EE_LITE(0x300, handle_page_fault)
228
229/* Instruction access exception.
230 * This is "never generated" by the MPC8xx.  We jump to it for other
231 * translation errors.
232 */
233	. = 0x400
234InstructionAccess:
235	EXCEPTION_PROLOG
236	mr	r4,r12
237	mr	r5,r9
238	EXC_XFER_EE_LITE(0x400, handle_page_fault)
239
240/* External interrupt */
241	EXCEPTION(0x500, HardwareInterrupt, do_IRQ, EXC_XFER_LITE)
242
243/* Alignment exception */
244	. = 0x600
245Alignment:
246	EXCEPTION_PROLOG
247	mfspr	r4,SPRN_DAR
248	stw	r4,_DAR(r11)
249	mfspr	r5,SPRN_DSISR
250	stw	r5,_DSISR(r11)
251	addi	r3,r1,STACK_FRAME_OVERHEAD
252	EXC_XFER_EE(0x600, alignment_exception)
253
254/* Program check exception */
255	EXCEPTION(0x700, ProgramCheck, program_check_exception, EXC_XFER_STD)
256
257/* No FPU on MPC8xx.  This exception is not supposed to happen.
258*/
259	EXCEPTION(0x800, FPUnavailable, unknown_exception, EXC_XFER_STD)
260
261/* Decrementer */
262	EXCEPTION(0x900, Decrementer, timer_interrupt, EXC_XFER_LITE)
263
264	EXCEPTION(0xa00, Trap_0a, unknown_exception, EXC_XFER_EE)
265	EXCEPTION(0xb00, Trap_0b, unknown_exception, EXC_XFER_EE)
266
267/* System call */
268	. = 0xc00
269SystemCall:
270	EXCEPTION_PROLOG
271	EXC_XFER_EE_LITE(0xc00, DoSyscall)
272
273/* Single step - not used on 601 */
274	EXCEPTION(0xd00, SingleStep, single_step_exception, EXC_XFER_STD)
275	EXCEPTION(0xe00, Trap_0e, unknown_exception, EXC_XFER_EE)
276	EXCEPTION(0xf00, Trap_0f, unknown_exception, EXC_XFER_EE)
277
278/* On the MPC8xx, this is a software emulation interrupt.  It occurs
279 * for all unimplemented and illegal instructions.
280 */
281	EXCEPTION(0x1000, SoftEmu, SoftwareEmulation, EXC_XFER_STD)
282
283	. = 0x1100
284/*
285 * For the MPC8xx, this is a software tablewalk to load the instruction
286 * TLB.  It is modelled after the example in the Motorola manual.  The task
287 * switch loads the M_TWB register with the pointer to the first level table.
288 * If we discover there is no second level table (value is zero) or if there
289 * is an invalid pte, we load that into the TLB, which causes another fault
290 * into the TLB Error interrupt where we can handle such problems.
291 * We have to use the MD_xxx registers for the tablewalk because the
292 * equivalent MI_xxx registers only perform the attribute functions.
293 */
294InstructionTLBMiss:
295#ifdef CONFIG_8xx_CPU6
296	stw	r3, 8(r0)
297#endif
298	DO_8xx_CPU6(0x3f80, r3)
299	mtspr	SPRN_M_TW, r10	/* Save a couple of working registers */
300	mfcr	r10
301	stw	r10, 0(r0)
302	stw	r11, 4(r0)
303	mfspr	r10, SPRN_SRR0	/* Get effective address of fault */
304	DO_8xx_CPU6(0x3780, r3)
305	mtspr	SPRN_MD_EPN, r10	/* Have to use MD_EPN for walk, MI_EPN can't */
306	mfspr	r10, SPRN_M_TWB	/* Get level 1 table entry address */
307
308	/* If we are faulting a kernel address, we have to use the
309	 * kernel page tables.
310	 */
311	andi.	r11, r10, 0x0800	/* Address >= 0x80000000 */
312	beq	3f
313	lis	r11, swapper_pg_dir@h
314	ori	r11, r11, swapper_pg_dir@l
315	rlwimi	r10, r11, 0, 2, 19
3163:
317	lwz	r11, 0(r10)	/* Get the level 1 entry */
318	rlwinm.	r10, r11,0,0,19	/* Extract page descriptor page address */
319	beq	2f		/* If zero, don't try to find a pte */
320
321	/* We have a pte table, so load the MI_TWC with the attributes
322	 * for this "segment."
323	 */
324	ori	r11,r11,1		/* Set valid bit */
325	DO_8xx_CPU6(0x2b80, r3)
326	mtspr	SPRN_MI_TWC, r11	/* Set segment attributes */
327	DO_8xx_CPU6(0x3b80, r3)
328	mtspr	SPRN_MD_TWC, r11	/* Load pte table base address */
329	mfspr	r11, SPRN_MD_TWC	/* ....and get the pte address */
330	lwz	r10, 0(r11)	/* Get the pte */
331
332	ori	r10, r10, _PAGE_ACCESSED
333	stw	r10, 0(r11)
334
335	/* The Linux PTE won't go exactly into the MMU TLB.
336	 * Software indicator bits 21, 22 and 28 must be clear.
337	 * Software indicator bits 24, 25, 26, and 27 must be
338	 * set.  All other Linux PTE bits control the behavior
339	 * of the MMU.
340	 */
3412:	li	r11, 0x00f0
342	rlwimi	r10, r11, 0, 24, 28	/* Set 24-27, clear 28 */
343	DO_8xx_CPU6(0x2d80, r3)
344	mtspr	SPRN_MI_RPN, r10	/* Update TLB entry */
345
346	mfspr	r10, SPRN_M_TW	/* Restore registers */
347	lwz	r11, 0(r0)
348	mtcr	r11
349	lwz	r11, 4(r0)
350#ifdef CONFIG_8xx_CPU6
351	lwz	r3, 8(r0)
352#endif
353	rfi
354
355	. = 0x1200
356DataStoreTLBMiss:
357#ifdef CONFIG_8xx_CPU6
358	stw	r3, 8(r0)
359#endif
360	DO_8xx_CPU6(0x3f80, r3)
361	mtspr	SPRN_M_TW, r10	/* Save a couple of working registers */
362	mfcr	r10
363	stw	r10, 0(r0)
364	stw	r11, 4(r0)
365	mfspr	r10, SPRN_M_TWB	/* Get level 1 table entry address */
366
367	/* If we are faulting a kernel address, we have to use the
368	 * kernel page tables.
369	 */
370	andi.	r11, r10, 0x0800
371	beq	3f
372	lis	r11, swapper_pg_dir@h
373	ori	r11, r11, swapper_pg_dir@l
374	rlwimi	r10, r11, 0, 2, 19
3753:
376	lwz	r11, 0(r10)	/* Get the level 1 entry */
377	rlwinm.	r10, r11,0,0,19	/* Extract page descriptor page address */
378	beq	2f		/* If zero, don't try to find a pte */
379
380	/* We have a pte table, so load fetch the pte from the table.
381	 */
382	ori	r11, r11, 1	/* Set valid bit in physical L2 page */
383	DO_8xx_CPU6(0x3b80, r3)
384	mtspr	SPRN_MD_TWC, r11	/* Load pte table base address */
385	mfspr	r10, SPRN_MD_TWC	/* ....and get the pte address */
386	lwz	r10, 0(r10)	/* Get the pte */
387
388	/* Insert the Guarded flag into the TWC from the Linux PTE.
389	 * It is bit 27 of both the Linux PTE and the TWC (at least
390	 * I got that right :-).  It will be better when we can put
391	 * this into the Linux pgd/pmd and load it in the operation
392	 * above.
393	 */
394	rlwimi	r11, r10, 0, 27, 27
395	DO_8xx_CPU6(0x3b80, r3)
396	mtspr	SPRN_MD_TWC, r11
397
398	mfspr	r11, SPRN_MD_TWC	/* get the pte address again */
399	ori	r10, r10, _PAGE_ACCESSED
400	stw	r10, 0(r11)
401
402	/* The Linux PTE won't go exactly into the MMU TLB.
403	 * Software indicator bits 21, 22 and 28 must be clear.
404	 * Software indicator bits 24, 25, 26, and 27 must be
405	 * set.  All other Linux PTE bits control the behavior
406	 * of the MMU.
407	 */
4082:	li	r11, 0x00f0
409	rlwimi	r10, r11, 0, 24, 28	/* Set 24-27, clear 28 */
410	DO_8xx_CPU6(0x3d80, r3)
411	mtspr	SPRN_MD_RPN, r10	/* Update TLB entry */
412
413	mfspr	r10, SPRN_M_TW	/* Restore registers */
414	lwz	r11, 0(r0)
415	mtcr	r11
416	lwz	r11, 4(r0)
417#ifdef CONFIG_8xx_CPU6
418	lwz	r3, 8(r0)
419#endif
420	rfi
421
422/* This is an instruction TLB error on the MPC8xx.  This could be due
423 * to many reasons, such as executing guarded memory or illegal instruction
424 * addresses.  There is nothing to do but handle a big time error fault.
425 */
426	. = 0x1300
427InstructionTLBError:
428	b	InstructionAccess
429
430/* This is the data TLB error on the MPC8xx.  This could be due to
431 * many reasons, including a dirty update to a pte.  We can catch that
432 * one here, but anything else is an error.  First, we track down the
433 * Linux pte.  If it is valid, write access is allowed, but the
434 * page dirty bit is not set, we will set it and reload the TLB.  For
435 * any other case, we bail out to a higher level function that can
436 * handle it.
437 */
438	. = 0x1400
439DataTLBError:
440#ifdef CONFIG_8xx_CPU6
441	stw	r3, 8(r0)
442#endif
443	DO_8xx_CPU6(0x3f80, r3)
444	mtspr	SPRN_M_TW, r10	/* Save a couple of working registers */
445	mfcr	r10
446	stw	r10, 0(r0)
447	stw	r11, 4(r0)
448
449	/* First, make sure this was a store operation.
450	*/
451	mfspr	r10, SPRN_DSISR
452	andis.	r11, r10, 0x0200	/* If set, indicates store op */
453	beq	2f
454
455	mfspr	r10, SPRN_DAR
456	rlwinm	r11, r10, 0, 0, 19
457	ori	r11, r11, MD_EVALID
458	mfspr	r10, SPRN_M_CASID
459	rlwimi	r11, r10, 0, 28, 31
460	DO_8xx_CPU6(0x3780, r3)
461	mtspr	SPRN_MD_EPN, r11
462
463	mfspr	r10, SPRN_M_TWB	/* Get level 1 table entry address */
464
465	/* If we are faulting a kernel address, we have to use the
466	 * kernel page tables.
467	 */
468	andi.	r11, r10, 0x0800
469	beq	3f
470	lis	r11, swapper_pg_dir@h
471	ori	r11, r11, swapper_pg_dir@l
472	rlwimi	r10, r11, 0, 2, 19
4733:
474	lwz	r11, 0(r10)	/* Get the level 1 entry */
475	rlwinm.	r10, r11,0,0,19	/* Extract page descriptor page address */
476	beq	2f		/* If zero, bail */
477
478	/* We have a pte table, so fetch the pte from the table.
479	 */
480	ori	r11, r11, 1		/* Set valid bit in physical L2 page */
481	DO_8xx_CPU6(0x3b80, r3)
482	mtspr	SPRN_MD_TWC, r11		/* Load pte table base address */
483	mfspr	r11, SPRN_MD_TWC		/* ....and get the pte address */
484	lwz	r10, 0(r11)		/* Get the pte */
485
486	andi.	r11, r10, _PAGE_RW	/* Is it writeable? */
487	beq	2f			/* Bail out if not */
488
489	/* Update 'changed', among others.
490	*/
491	ori	r10, r10, _PAGE_DIRTY|_PAGE_ACCESSED|_PAGE_HWWRITE
492	mfspr	r11, SPRN_MD_TWC		/* Get pte address again */
493	stw	r10, 0(r11)		/* and update pte in table */
494
495	/* The Linux PTE won't go exactly into the MMU TLB.
496	 * Software indicator bits 21, 22 and 28 must be clear.
497	 * Software indicator bits 24, 25, 26, and 27 must be
498	 * set.  All other Linux PTE bits control the behavior
499	 * of the MMU.
500	 */
501	li	r11, 0x00f0
502	rlwimi	r10, r11, 0, 24, 28	/* Set 24-27, clear 28 */
503	DO_8xx_CPU6(0x3d80, r3)
504	mtspr	SPRN_MD_RPN, r10	/* Update TLB entry */
505
506	mfspr	r10, SPRN_M_TW	/* Restore registers */
507	lwz	r11, 0(r0)
508	mtcr	r11
509	lwz	r11, 4(r0)
510#ifdef CONFIG_8xx_CPU6
511	lwz	r3, 8(r0)
512#endif
513	rfi
5142:
515	mfspr	r10, SPRN_M_TW	/* Restore registers */
516	lwz	r11, 0(r0)
517	mtcr	r11
518	lwz	r11, 4(r0)
519#ifdef CONFIG_8xx_CPU6
520	lwz	r3, 8(r0)
521#endif
522	b	DataAccess
523
524	EXCEPTION(0x1500, Trap_15, unknown_exception, EXC_XFER_EE)
525	EXCEPTION(0x1600, Trap_16, unknown_exception, EXC_XFER_EE)
526	EXCEPTION(0x1700, Trap_17, unknown_exception, EXC_XFER_EE)
527	EXCEPTION(0x1800, Trap_18, unknown_exception, EXC_XFER_EE)
528	EXCEPTION(0x1900, Trap_19, unknown_exception, EXC_XFER_EE)
529	EXCEPTION(0x1a00, Trap_1a, unknown_exception, EXC_XFER_EE)
530	EXCEPTION(0x1b00, Trap_1b, unknown_exception, EXC_XFER_EE)
531
532/* On the MPC8xx, these next four traps are used for development
533 * support of breakpoints and such.  Someday I will get around to
534 * using them.
535 */
536	EXCEPTION(0x1c00, Trap_1c, unknown_exception, EXC_XFER_EE)
537	EXCEPTION(0x1d00, Trap_1d, unknown_exception, EXC_XFER_EE)
538	EXCEPTION(0x1e00, Trap_1e, unknown_exception, EXC_XFER_EE)
539	EXCEPTION(0x1f00, Trap_1f, unknown_exception, EXC_XFER_EE)
540
541	. = 0x2000
542
543	.globl	giveup_fpu
544giveup_fpu:
545	blr
546
547/*
548 * This is where the main kernel code starts.
549 */
550start_here:
551	/* ptr to current */
552	lis	r2,init_task@h
553	ori	r2,r2,init_task@l
554
555	/* ptr to phys current thread */
556	tophys(r4,r2)
557	addi	r4,r4,THREAD	/* init task's THREAD */
558	mtspr	SPRN_SPRG3,r4
559	li	r3,0
560	mtspr	SPRN_SPRG2,r3	/* 0 => r1 has kernel sp */
561
562	/* stack */
563	lis	r1,init_thread_union@ha
564	addi	r1,r1,init_thread_union@l
565	li	r0,0
566	stwu	r0,THREAD_SIZE-STACK_FRAME_OVERHEAD(r1)
567
568	bl	early_init	/* We have to do this with MMU on */
569
570/*
571 * Decide what sort of machine this is and initialize the MMU.
572 */
573	mr	r3,r31
574	mr	r4,r30
575	mr	r5,r29
576	mr	r6,r28
577	mr	r7,r27
578	bl	machine_init
579	bl	MMU_init
580
581/*
582 * Go back to running unmapped so we can load up new values
583 * and change to using our exception vectors.
584 * On the 8xx, all we have to do is invalidate the TLB to clear
585 * the old 8M byte TLB mappings and load the page table base register.
586 */
587	/* The right way to do this would be to track it down through
588	 * init's THREAD like the context switch code does, but this is
589	 * easier......until someone changes init's static structures.
590	 */
591	lis	r6, swapper_pg_dir@h
592	ori	r6, r6, swapper_pg_dir@l
593	tophys(r6,r6)
594#ifdef CONFIG_8xx_CPU6
595	lis	r4, cpu6_errata_word@h
596	ori	r4, r4, cpu6_errata_word@l
597	li	r3, 0x3980
598	stw	r3, 12(r4)
599	lwz	r3, 12(r4)
600#endif
601	mtspr	SPRN_M_TWB, r6
602	lis	r4,2f@h
603	ori	r4,r4,2f@l
604	tophys(r4,r4)
605	li	r3,MSR_KERNEL & ~(MSR_IR|MSR_DR)
606	mtspr	SPRN_SRR0,r4
607	mtspr	SPRN_SRR1,r3
608	rfi
609/* Load up the kernel context */
6102:
611	SYNC			/* Force all PTE updates to finish */
612	tlbia			/* Clear all TLB entries */
613	sync			/* wait for tlbia/tlbie to finish */
614	TLBSYNC			/* ... on all CPUs */
615
616	/* set up the PTE pointers for the Abatron bdiGDB.
617	*/
618	tovirt(r6,r6)
619	lis	r5, abatron_pteptrs@h
620	ori	r5, r5, abatron_pteptrs@l
621	stw	r5, 0xf0(r0)	/* Must match your Abatron config file */
622	tophys(r5,r5)
623	stw	r6, 0(r5)
624
625/* Now turn on the MMU for real! */
626	li	r4,MSR_KERNEL
627	lis	r3,start_kernel@h
628	ori	r3,r3,start_kernel@l
629	mtspr	SPRN_SRR0,r3
630	mtspr	SPRN_SRR1,r4
631	rfi			/* enable MMU and jump to start_kernel */
632
633/* Set up the initial MMU state so we can do the first level of
634 * kernel initialization.  This maps the first 8 MBytes of memory 1:1
635 * virtual to physical.  Also, set the cache mode since that is defined
636 * by TLB entries and perform any additional mapping (like of the IMMR).
637 * If configured to pin some TLBs, we pin the first 8 Mbytes of kernel,
638 * 24 Mbytes of data, and the 8M IMMR space.  Anything not covered by
639 * these mappings is mapped by page tables.
640 */
641initial_mmu:
642	tlbia			/* Invalidate all TLB entries */
643#ifdef CONFIG_PIN_TLB
644	lis	r8, MI_RSV4I@h
645	ori	r8, r8, 0x1c00
646#else
647	li	r8, 0
648#endif
649	mtspr	SPRN_MI_CTR, r8	/* Set instruction MMU control */
650
651#ifdef CONFIG_PIN_TLB
652	lis	r10, (MD_RSV4I | MD_RESETVAL)@h
653	ori	r10, r10, 0x1c00
654	mr	r8, r10
655#else
656	lis	r10, MD_RESETVAL@h
657#endif
658#ifndef CONFIG_8xx_COPYBACK
659	oris	r10, r10, MD_WTDEF@h
660#endif
661	mtspr	SPRN_MD_CTR, r10	/* Set data TLB control */
662
663	/* Now map the lower 8 Meg into the TLBs.  For this quick hack,
664	 * we can load the instruction and data TLB registers with the
665	 * same values.
666	 */
667	lis	r8, KERNELBASE@h	/* Create vaddr for TLB */
668	ori	r8, r8, MI_EVALID	/* Mark it valid */
669	mtspr	SPRN_MI_EPN, r8
670	mtspr	SPRN_MD_EPN, r8
671	li	r8, MI_PS8MEG		/* Set 8M byte page */
672	ori	r8, r8, MI_SVALID	/* Make it valid */
673	mtspr	SPRN_MI_TWC, r8
674	mtspr	SPRN_MD_TWC, r8
675	li	r8, MI_BOOTINIT		/* Create RPN for address 0 */
676	mtspr	SPRN_MI_RPN, r8		/* Store TLB entry */
677	mtspr	SPRN_MD_RPN, r8
678	lis	r8, MI_Kp@h		/* Set the protection mode */
679	mtspr	SPRN_MI_AP, r8
680	mtspr	SPRN_MD_AP, r8
681
682	/* Map another 8 MByte at the IMMR to get the processor
683	 * internal registers (among other things).
684	 */
685#ifdef CONFIG_PIN_TLB
686	addi	r10, r10, 0x0100
687	mtspr	SPRN_MD_CTR, r10
688#endif
689	mfspr	r9, 638			/* Get current IMMR */
690	andis.	r9, r9, 0xff80		/* Get 8Mbyte boundary */
691
692	mr	r8, r9			/* Create vaddr for TLB */
693	ori	r8, r8, MD_EVALID	/* Mark it valid */
694	mtspr	SPRN_MD_EPN, r8
695	li	r8, MD_PS8MEG		/* Set 8M byte page */
696	ori	r8, r8, MD_SVALID	/* Make it valid */
697	mtspr	SPRN_MD_TWC, r8
698	mr	r8, r9			/* Create paddr for TLB */
699	ori	r8, r8, MI_BOOTINIT|0x2 /* Inhibit cache -- Cort */
700	mtspr	SPRN_MD_RPN, r8
701
702#ifdef CONFIG_PIN_TLB
703	/* Map two more 8M kernel data pages.
704	*/
705	addi	r10, r10, 0x0100
706	mtspr	SPRN_MD_CTR, r10
707
708	lis	r8, KERNELBASE@h	/* Create vaddr for TLB */
709	addis	r8, r8, 0x0080		/* Add 8M */
710	ori	r8, r8, MI_EVALID	/* Mark it valid */
711	mtspr	SPRN_MD_EPN, r8
712	li	r9, MI_PS8MEG		/* Set 8M byte page */
713	ori	r9, r9, MI_SVALID	/* Make it valid */
714	mtspr	SPRN_MD_TWC, r9
715	li	r11, MI_BOOTINIT	/* Create RPN for address 0 */
716	addis	r11, r11, 0x0080	/* Add 8M */
717	mtspr	SPRN_MD_RPN, r8
718
719	addis	r8, r8, 0x0080		/* Add 8M */
720	mtspr	SPRN_MD_EPN, r8
721	mtspr	SPRN_MD_TWC, r9
722	addis	r11, r11, 0x0080	/* Add 8M */
723	mtspr	SPRN_MD_RPN, r8
724#endif
725
726	/* Since the cache is enabled according to the information we
727	 * just loaded into the TLB, invalidate and enable the caches here.
728	 * We should probably check/set other modes....later.
729	 */
730	lis	r8, IDC_INVALL@h
731	mtspr	SPRN_IC_CST, r8
732	mtspr	SPRN_DC_CST, r8
733	lis	r8, IDC_ENABLE@h
734	mtspr	SPRN_IC_CST, r8
735#ifdef CONFIG_8xx_COPYBACK
736	mtspr	SPRN_DC_CST, r8
737#else
738	/* For a debug option, I left this here to easily enable
739	 * the write through cache mode
740	 */
741	lis	r8, DC_SFWT@h
742	mtspr	SPRN_DC_CST, r8
743	lis	r8, IDC_ENABLE@h
744	mtspr	SPRN_DC_CST, r8
745#endif
746	blr
747
748
749/*
750 * Set up to use a given MMU context.
751 * r3 is context number, r4 is PGD pointer.
752 *
753 * We place the physical address of the new task page directory loaded
754 * into the MMU base register, and set the ASID compare register with
755 * the new "context."
756 */
757_GLOBAL(set_context)
758
759#ifdef CONFIG_BDI_SWITCH
760	/* Context switch the PTE pointer for the Abatron BDI2000.
761	 * The PGDIR is passed as second argument.
762	 */
763	lis	r5, KERNELBASE@h
764	lwz	r5, 0xf0(r5)
765	stw	r4, 0x4(r5)
766#endif
767
768#ifdef CONFIG_8xx_CPU6
769	lis	r6, cpu6_errata_word@h
770	ori	r6, r6, cpu6_errata_word@l
771	tophys	(r4, r4)
772	li	r7, 0x3980
773	stw	r7, 12(r6)
774	lwz	r7, 12(r6)
775        mtspr   SPRN_M_TWB, r4               /* Update MMU base address */
776	li	r7, 0x3380
777	stw	r7, 12(r6)
778	lwz	r7, 12(r6)
779        mtspr   SPRN_M_CASID, r3             /* Update context */
780#else
781        mtspr   SPRN_M_CASID,r3		/* Update context */
782	tophys	(r4, r4)
783	mtspr	SPRN_M_TWB, r4		/* and pgd */
784#endif
785	SYNC
786	blr
787
788#ifdef CONFIG_8xx_CPU6
789/* It's here because it is unique to the 8xx.
790 * It is important we get called with interrupts disabled.  I used to
791 * do that, but it appears that all code that calls this already had
792 * interrupt disabled.
793 */
794	.globl	set_dec_cpu6
795set_dec_cpu6:
796	lis	r7, cpu6_errata_word@h
797	ori	r7, r7, cpu6_errata_word@l
798	li	r4, 0x2c00
799	stw	r4, 8(r7)
800	lwz	r4, 8(r7)
801        mtspr   22, r3		/* Update Decrementer */
802	SYNC
803	blr
804#endif
805
806/*
807 * We put a few things here that have to be page-aligned.
808 * This stuff goes at the beginning of the data segment,
809 * which is page-aligned.
810 */
811	.data
812	.globl	sdata
813sdata:
814	.globl	empty_zero_page
815empty_zero_page:
816	.space	4096
817
818	.globl	swapper_pg_dir
819swapper_pg_dir:
820	.space	4096
821
822/*
823 * This space gets a copy of optional info passed to us by the bootstrap
824 * Used to pass parameters into the kernel like root=/dev/sda1, etc.
825 */
826	.globl	cmd_line
827cmd_line:
828	.space	512
829
830/* Room for two PTE table poiners, usually the kernel and current user
831 * pointer to their respective root page table (pgdir).
832 */
833abatron_pteptrs:
834	.space	8
835
836#ifdef CONFIG_8xx_CPU6
837	.globl	cpu6_errata_word
838cpu6_errata_word:
839	.space	16
840#endif
841