1/* 2 * linux/arch/arm/boot/compressed/head.S 3 * 4 * Copyright (C) 1996-2002 Russell King 5 * Copyright (C) 2004 Hyok S. Choi (MPU support) 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11#include <linux/linkage.h> 12 13/* 14 * Debugging stuff 15 * 16 * Note that these macros must not contain any code which is not 17 * 100% relocatable. Any attempt to do so will result in a crash. 18 * Please select one of the following when turning on debugging. 19 */ 20#ifdef DEBUG 21 22#if defined(CONFIG_DEBUG_ICEDCC) 23 24#if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_V6K) || defined(CONFIG_CPU_V7) 25 .macro loadsp, rb, tmp 26 .endm 27 .macro writeb, ch, rb 28 mcr p14, 0, \ch, c0, c5, 0 29 .endm 30#elif defined(CONFIG_CPU_XSCALE) 31 .macro loadsp, rb, tmp 32 .endm 33 .macro writeb, ch, rb 34 mcr p14, 0, \ch, c8, c0, 0 35 .endm 36#else 37 .macro loadsp, rb, tmp 38 .endm 39 .macro writeb, ch, rb 40 mcr p14, 0, \ch, c1, c0, 0 41 .endm 42#endif 43 44#else 45 46#include <mach/debug-macro.S> 47 48 .macro writeb, ch, rb 49 senduart \ch, \rb 50 .endm 51 52#if defined(CONFIG_ARCH_SA1100) 53 .macro loadsp, rb, tmp 54 mov \rb, #0x80000000 @ physical base address 55#ifdef CONFIG_DEBUG_LL_SER3 56 add \rb, \rb, #0x00050000 @ Ser3 57#else 58 add \rb, \rb, #0x00010000 @ Ser1 59#endif 60 .endm 61#elif defined(CONFIG_ARCH_S3C24XX) 62 .macro loadsp, rb, tmp 63 mov \rb, #0x50000000 64 add \rb, \rb, #0x4000 * CONFIG_S3C_LOWLEVEL_UART_PORT 65 .endm 66#else 67 .macro loadsp, rb, tmp 68 addruart \rb, \tmp 69 .endm 70#endif 71#endif 72#endif 73 74 .macro kputc,val 75 mov r0, \val 76 bl putc 77 .endm 78 79 .macro kphex,val,len 80 mov r0, \val 81 mov r1, #\len 82 bl phex 83 .endm 84 85 .macro debug_reloc_start 86#ifdef DEBUG 87 kputc #'\n' 88 kphex r6, 8 /* processor id */ 89 kputc #':' 90 kphex r7, 8 /* architecture id */ 91#ifdef CONFIG_CPU_CP15 92 kputc #':' 93 mrc p15, 0, r0, c1, c0 94 kphex r0, 8 /* control reg */ 95#endif 96 kputc #'\n' 97 kphex r5, 8 /* decompressed kernel start */ 98 kputc #'-' 99 kphex r9, 8 /* decompressed kernel end */ 100 kputc #'>' 101 kphex r4, 8 /* kernel execution address */ 102 kputc #'\n' 103#endif 104 .endm 105 106 .macro debug_reloc_end 107#ifdef DEBUG 108 kphex r5, 8 /* end of kernel */ 109 kputc #'\n' 110 mov r0, r4 111 bl memdump /* dump 256 bytes at start of kernel */ 112#endif 113 .endm 114 115 .section ".start", #alloc, #execinstr 116/* 117 * sort out different calling conventions 118 */ 119 .align 120 .arm @ Always enter in ARM state 121start: 122 .type start,#function 123 .rept 7 124 mov r0, r0 125 .endr 126 ARM( mov r0, r0 ) 127 ARM( b 1f ) 128 THUMB( adr r12, BSYM(1f) ) 129 THUMB( bx r12 ) 130 131 .word 0x016f2818 @ Magic numbers to help the loader 132 .word start @ absolute load/run zImage address 133 .word _edata @ zImage end address 134 THUMB( .thumb ) 1351: mov r7, r1 @ save architecture ID 136 mov r8, r2 @ save atags pointer 137 138#ifndef __ARM_ARCH_2__ 139 /* 140 * Booting from Angel - need to enter SVC mode and disable 141 * FIQs/IRQs (numeric definitions from angel arm.h source). 142 * We only do this if we were in user mode on entry. 143 */ 144 mrs r2, cpsr @ get current mode 145 tst r2, #3 @ not user? 146 bne not_angel 147 mov r0, #0x17 @ angel_SWIreason_EnterSVC 148 ARM( swi 0x123456 ) @ angel_SWI_ARM 149 THUMB( svc 0xab ) @ angel_SWI_THUMB 150not_angel: 151 mrs r2, cpsr @ turn off interrupts to 152 orr r2, r2, #0xc0 @ prevent angel from running 153 msr cpsr_c, r2 154#else 155 teqp pc, #0x0c000003 @ turn off interrupts 156#endif 157 158 /* 159 * Note that some cache flushing and other stuff may 160 * be needed here - is there an Angel SWI call for this? 161 */ 162 163 /* 164 * some architecture specific code can be inserted 165 * by the linker here, but it should preserve r7, r8, and r9. 166 */ 167 168 .text 169 170#ifdef CONFIG_AUTO_ZRELADDR 171 @ determine final kernel image address 172 mov r4, pc 173 and r4, r4, #0xf8000000 174 add r4, r4, #TEXT_OFFSET 175#else 176 ldr r4, =zreladdr 177#endif 178 179 bl cache_on 180 181restart: adr r0, LC0 182 ldmia r0, {r1, r2, r3, r6, r10, r11, r12} 183 ldr sp, [r0, #28] 184 185 /* 186 * We might be running at a different address. We need 187 * to fix up various pointers. 188 */ 189 sub r0, r0, r1 @ calculate the delta offset 190 add r6, r6, r0 @ _edata 191 add r10, r10, r0 @ inflated kernel size location 192 193 /* 194 * The kernel build system appends the size of the 195 * decompressed kernel at the end of the compressed data 196 * in little-endian form. 197 */ 198 ldrb r9, [r10, #0] 199 ldrb lr, [r10, #1] 200 orr r9, r9, lr, lsl #8 201 ldrb lr, [r10, #2] 202 ldrb r10, [r10, #3] 203 orr r9, r9, lr, lsl #16 204 orr r9, r9, r10, lsl #24 205 206#ifndef CONFIG_ZBOOT_ROM 207 /* malloc space is above the relocated stack (64k max) */ 208 add sp, sp, r0 209 add r10, sp, #0x10000 210#else 211 /* 212 * With ZBOOT_ROM the bss/stack is non relocatable, 213 * but someone could still run this code from RAM, 214 * in which case our reference is _edata. 215 */ 216 mov r10, r6 217#endif 218 219 mov r5, #0 @ init dtb size to 0 220#ifdef CONFIG_ARM_APPENDED_DTB 221/* 222 * r0 = delta 223 * r2 = BSS start 224 * r3 = BSS end 225 * r4 = final kernel address 226 * r5 = appended dtb size (still unknown) 227 * r6 = _edata 228 * r7 = architecture ID 229 * r8 = atags/device tree pointer 230 * r9 = size of decompressed image 231 * r10 = end of this image, including bss/stack/malloc space if non XIP 232 * r11 = GOT start 233 * r12 = GOT end 234 * sp = stack pointer 235 * 236 * if there are device trees (dtb) appended to zImage, advance r10 so that the 237 * dtb data will get relocated along with the kernel if necessary. 238 */ 239 240 ldr lr, [r6, #0] 241#ifndef __ARMEB__ 242 ldr r1, =0xedfe0dd0 @ sig is 0xd00dfeed big endian 243#else 244 ldr r1, =0xd00dfeed 245#endif 246 cmp lr, r1 247 bne dtb_check_done @ not found 248 249#ifdef CONFIG_ARM_ATAG_DTB_COMPAT 250 /* 251 * OK... Let's do some funky business here. 252 * If we do have a DTB appended to zImage, and we do have 253 * an ATAG list around, we want the later to be translated 254 * and folded into the former here. To be on the safe side, 255 * let's temporarily move the stack away into the malloc 256 * area. No GOT fixup has occurred yet, but none of the 257 * code we're about to call uses any global variable. 258 */ 259 add sp, sp, #0x10000 260 stmfd sp!, {r0-r3, ip, lr} 261 mov r0, r8 262 mov r1, r6 263 sub r2, sp, r6 264 bl atags_to_fdt 265 266 /* 267 * If returned value is 1, there is no ATAG at the location 268 * pointed by r8. Try the typical 0x100 offset from start 269 * of RAM and hope for the best. 270 */ 271 cmp r0, #1 272 sub r0, r4, #TEXT_OFFSET 273 add r0, r0, #0x100 274 mov r1, r6 275 sub r2, sp, r6 276 bleq atags_to_fdt 277 278 ldmfd sp!, {r0-r3, ip, lr} 279 sub sp, sp, #0x10000 280#endif 281 282 mov r8, r6 @ use the appended device tree 283 284 /* 285 * Make sure that the DTB doesn't end up in the final 286 * kernel's .bss area. To do so, we adjust the decompressed 287 * kernel size to compensate if that .bss size is larger 288 * than the relocated code. 289 */ 290 ldr r5, =_kernel_bss_size 291 adr r1, wont_overwrite 292 sub r1, r6, r1 293 subs r1, r5, r1 294 addhi r9, r9, r1 295 296 /* Get the dtb's size */ 297 ldr r5, [r6, #4] 298#ifndef __ARMEB__ 299 /* convert r5 (dtb size) to little endian */ 300 eor r1, r5, r5, ror #16 301 bic r1, r1, #0x00ff0000 302 mov r5, r5, ror #8 303 eor r5, r5, r1, lsr #8 304#endif 305 306 /* preserve 64-bit alignment */ 307 add r5, r5, #7 308 bic r5, r5, #7 309 310 /* relocate some pointers past the appended dtb */ 311 add r6, r6, r5 312 add r10, r10, r5 313 add sp, sp, r5 314dtb_check_done: 315#endif 316 317/* 318 * Check to see if we will overwrite ourselves. 319 * r4 = final kernel address 320 * r9 = size of decompressed image 321 * r10 = end of this image, including bss/stack/malloc space if non XIP 322 * We basically want: 323 * r4 - 16k page directory >= r10 -> OK 324 * r4 + image length <= address of wont_overwrite -> OK 325 */ 326 add r10, r10, #16384 327 cmp r4, r10 328 bhs wont_overwrite 329 add r10, r4, r9 330 adr r9, wont_overwrite 331 cmp r10, r9 332 bls wont_overwrite 333 334/* 335 * Relocate ourselves past the end of the decompressed kernel. 336 * r6 = _edata 337 * r10 = end of the decompressed kernel 338 * Because we always copy ahead, we need to do it from the end and go 339 * backward in case the source and destination overlap. 340 */ 341 /* 342 * Bump to the next 256-byte boundary with the size of 343 * the relocation code added. This avoids overwriting 344 * ourself when the offset is small. 345 */ 346 add r10, r10, #((reloc_code_end - restart + 256) & ~255) 347 bic r10, r10, #255 348 349 /* Get start of code we want to copy and align it down. */ 350 adr r5, restart 351 bic r5, r5, #31 352 353 sub r9, r6, r5 @ size to copy 354 add r9, r9, #31 @ rounded up to a multiple 355 bic r9, r9, #31 @ ... of 32 bytes 356 add r6, r9, r5 357 add r9, r9, r10 358 3591: ldmdb r6!, {r0 - r3, r10 - r12, lr} 360 cmp r6, r5 361 stmdb r9!, {r0 - r3, r10 - r12, lr} 362 bhi 1b 363 364 /* Preserve offset to relocated code. */ 365 sub r6, r9, r6 366 367#ifndef CONFIG_ZBOOT_ROM 368 /* cache_clean_flush may use the stack, so relocate it */ 369 add sp, sp, r6 370#endif 371 372 bl cache_clean_flush 373 374 adr r0, BSYM(restart) 375 add r0, r0, r6 376 mov pc, r0 377 378wont_overwrite: 379/* 380 * If delta is zero, we are running at the address we were linked at. 381 * r0 = delta 382 * r2 = BSS start 383 * r3 = BSS end 384 * r4 = kernel execution address 385 * r5 = appended dtb size (0 if not present) 386 * r7 = architecture ID 387 * r8 = atags pointer 388 * r11 = GOT start 389 * r12 = GOT end 390 * sp = stack pointer 391 */ 392 orrs r1, r0, r5 393 beq not_relocated 394 395 add r11, r11, r0 396 add r12, r12, r0 397 398#ifndef CONFIG_ZBOOT_ROM 399 /* 400 * If we're running fully PIC === CONFIG_ZBOOT_ROM = n, 401 * we need to fix up pointers into the BSS region. 402 * Note that the stack pointer has already been fixed up. 403 */ 404 add r2, r2, r0 405 add r3, r3, r0 406 407 /* 408 * Relocate all entries in the GOT table. 409 * Bump bss entries to _edata + dtb size 410 */ 4111: ldr r1, [r11, #0] @ relocate entries in the GOT 412 add r1, r1, r0 @ This fixes up C references 413 cmp r1, r2 @ if entry >= bss_start && 414 cmphs r3, r1 @ bss_end > entry 415 addhi r1, r1, r5 @ entry += dtb size 416 str r1, [r11], #4 @ next entry 417 cmp r11, r12 418 blo 1b 419 420 /* bump our bss pointers too */ 421 add r2, r2, r5 422 add r3, r3, r5 423 424#else 425 426 /* 427 * Relocate entries in the GOT table. We only relocate 428 * the entries that are outside the (relocated) BSS region. 429 */ 4301: ldr r1, [r11, #0] @ relocate entries in the GOT 431 cmp r1, r2 @ entry < bss_start || 432 cmphs r3, r1 @ _end < entry 433 addlo r1, r1, r0 @ table. This fixes up the 434 str r1, [r11], #4 @ C references. 435 cmp r11, r12 436 blo 1b 437#endif 438 439not_relocated: mov r0, #0 4401: str r0, [r2], #4 @ clear bss 441 str r0, [r2], #4 442 str r0, [r2], #4 443 str r0, [r2], #4 444 cmp r2, r3 445 blo 1b 446 447/* 448 * The C runtime environment should now be setup sufficiently. 449 * Set up some pointers, and start decompressing. 450 * r4 = kernel execution address 451 * r7 = architecture ID 452 * r8 = atags pointer 453 */ 454 mov r0, r4 455 mov r1, sp @ malloc space above stack 456 add r2, sp, #0x10000 @ 64k max 457 mov r3, r7 458 bl decompress_kernel 459 bl cache_clean_flush 460 bl cache_off 461 mov r0, #0 @ must be zero 462 mov r1, r7 @ restore architecture number 463 mov r2, r8 @ restore atags pointer 464 ARM( mov pc, r4 ) @ call kernel 465 THUMB( bx r4 ) @ entry point is always ARM 466 467 .align 2 468 .type LC0, #object 469LC0: .word LC0 @ r1 470 .word __bss_start @ r2 471 .word _end @ r3 472 .word _edata @ r6 473 .word input_data_end - 4 @ r10 (inflated size location) 474 .word _got_start @ r11 475 .word _got_end @ ip 476 .word .L_user_stack_end @ sp 477 .size LC0, . - LC0 478 479#ifdef CONFIG_ARCH_RPC 480 .globl params 481params: ldr r0, =0x10000100 @ params_phys for RPC 482 mov pc, lr 483 .ltorg 484 .align 485#endif 486 487/* 488 * Turn on the cache. We need to setup some page tables so that we 489 * can have both the I and D caches on. 490 * 491 * We place the page tables 16k down from the kernel execution address, 492 * and we hope that nothing else is using it. If we're using it, we 493 * will go pop! 494 * 495 * On entry, 496 * r4 = kernel execution address 497 * r7 = architecture number 498 * r8 = atags pointer 499 * On exit, 500 * r0, r1, r2, r3, r9, r10, r12 corrupted 501 * This routine must preserve: 502 * r4, r7, r8 503 */ 504 .align 5 505cache_on: mov r3, #8 @ cache_on function 506 b call_cache_fn 507 508/* 509 * Initialize the highest priority protection region, PR7 510 * to cover all 32bit address and cacheable and bufferable. 511 */ 512__armv4_mpu_cache_on: 513 mov r0, #0x3f @ 4G, the whole 514 mcr p15, 0, r0, c6, c7, 0 @ PR7 Area Setting 515 mcr p15, 0, r0, c6, c7, 1 516 517 mov r0, #0x80 @ PR7 518 mcr p15, 0, r0, c2, c0, 0 @ D-cache on 519 mcr p15, 0, r0, c2, c0, 1 @ I-cache on 520 mcr p15, 0, r0, c3, c0, 0 @ write-buffer on 521 522 mov r0, #0xc000 523 mcr p15, 0, r0, c5, c0, 1 @ I-access permission 524 mcr p15, 0, r0, c5, c0, 0 @ D-access permission 525 526 mov r0, #0 527 mcr p15, 0, r0, c7, c10, 4 @ drain write buffer 528 mcr p15, 0, r0, c7, c5, 0 @ flush(inval) I-Cache 529 mcr p15, 0, r0, c7, c6, 0 @ flush(inval) D-Cache 530 mrc p15, 0, r0, c1, c0, 0 @ read control reg 531 @ ...I .... ..D. WC.M 532 orr r0, r0, #0x002d @ .... .... ..1. 11.1 533 orr r0, r0, #0x1000 @ ...1 .... .... .... 534 535 mcr p15, 0, r0, c1, c0, 0 @ write control reg 536 537 mov r0, #0 538 mcr p15, 0, r0, c7, c5, 0 @ flush(inval) I-Cache 539 mcr p15, 0, r0, c7, c6, 0 @ flush(inval) D-Cache 540 mov pc, lr 541 542__armv3_mpu_cache_on: 543 mov r0, #0x3f @ 4G, the whole 544 mcr p15, 0, r0, c6, c7, 0 @ PR7 Area Setting 545 546 mov r0, #0x80 @ PR7 547 mcr p15, 0, r0, c2, c0, 0 @ cache on 548 mcr p15, 0, r0, c3, c0, 0 @ write-buffer on 549 550 mov r0, #0xc000 551 mcr p15, 0, r0, c5, c0, 0 @ access permission 552 553 mov r0, #0 554 mcr p15, 0, r0, c7, c0, 0 @ invalidate whole cache v3 555 /* 556 * ?? ARMv3 MMU does not allow reading the control register, 557 * does this really work on ARMv3 MPU? 558 */ 559 mrc p15, 0, r0, c1, c0, 0 @ read control reg 560 @ .... .... .... WC.M 561 orr r0, r0, #0x000d @ .... .... .... 11.1 562 /* ?? this overwrites the value constructed above? */ 563 mov r0, #0 564 mcr p15, 0, r0, c1, c0, 0 @ write control reg 565 566 /* ?? invalidate for the second time? */ 567 mcr p15, 0, r0, c7, c0, 0 @ invalidate whole cache v3 568 mov pc, lr 569 570#ifdef CONFIG_CPU_DCACHE_WRITETHROUGH 571#define CB_BITS 0x08 572#else 573#define CB_BITS 0x0c 574#endif 575 576__setup_mmu: sub r3, r4, #16384 @ Page directory size 577 bic r3, r3, #0xff @ Align the pointer 578 bic r3, r3, #0x3f00 579/* 580 * Initialise the page tables, turning on the cacheable and bufferable 581 * bits for the RAM area only. 582 */ 583 mov r0, r3 584 mov r9, r0, lsr #18 585 mov r9, r9, lsl #18 @ start of RAM 586 add r10, r9, #0x10000000 @ a reasonable RAM size 587 mov r1, #0x12 @ XN|U + section mapping 588 orr r1, r1, #3 << 10 @ AP=11 589 add r2, r3, #16384 5901: cmp r1, r9 @ if virt > start of RAM 591 cmphs r10, r1 @ && end of RAM > virt 592 bic r1, r1, #0x1c @ clear XN|U + C + B 593 orrlo r1, r1, #0x10 @ Set XN|U for non-RAM 594 orrhs r1, r1, r6 @ set RAM section settings 595 str r1, [r0], #4 @ 1:1 mapping 596 add r1, r1, #1048576 597 teq r0, r2 598 bne 1b 599/* 600 * If ever we are running from Flash, then we surely want the cache 601 * to be enabled also for our execution instance... We map 2MB of it 602 * so there is no map overlap problem for up to 1 MB compressed kernel. 603 * If the execution is in RAM then we would only be duplicating the above. 604 */ 605 orr r1, r6, #0x04 @ ensure B is set for this 606 orr r1, r1, #3 << 10 607 mov r2, pc 608 mov r2, r2, lsr #20 609 orr r1, r1, r2, lsl #20 610 add r0, r3, r2, lsl #2 611 str r1, [r0], #4 612 add r1, r1, #1048576 613 str r1, [r0] 614 mov pc, lr 615ENDPROC(__setup_mmu) 616 617__arm926ejs_mmu_cache_on: 618#ifdef CONFIG_CPU_DCACHE_WRITETHROUGH 619 mov r0, #4 @ put dcache in WT mode 620 mcr p15, 7, r0, c15, c0, 0 621#endif 622 623__armv4_mmu_cache_on: 624 mov r12, lr 625#ifdef CONFIG_MMU 626 mov r6, #CB_BITS | 0x12 @ U 627 bl __setup_mmu 628 mov r0, #0 629 mcr p15, 0, r0, c7, c10, 4 @ drain write buffer 630 mcr p15, 0, r0, c8, c7, 0 @ flush I,D TLBs 631 mrc p15, 0, r0, c1, c0, 0 @ read control reg 632 orr r0, r0, #0x5000 @ I-cache enable, RR cache replacement 633 orr r0, r0, #0x0030 634#ifdef CONFIG_CPU_ENDIAN_BE8 635 orr r0, r0, #1 << 25 @ big-endian page tables 636#endif 637 bl __common_mmu_cache_on 638 mov r0, #0 639 mcr p15, 0, r0, c8, c7, 0 @ flush I,D TLBs 640#endif 641 mov pc, r12 642 643__armv7_mmu_cache_on: 644 mov r12, lr 645#ifdef CONFIG_MMU 646 mrc p15, 0, r11, c0, c1, 4 @ read ID_MMFR0 647 tst r11, #0xf @ VMSA 648 movne r6, #CB_BITS | 0x02 @ !XN 649 blne __setup_mmu 650 mov r0, #0 651 mcr p15, 0, r0, c7, c10, 4 @ drain write buffer 652 tst r11, #0xf @ VMSA 653 mcrne p15, 0, r0, c8, c7, 0 @ flush I,D TLBs 654#endif 655 mrc p15, 0, r0, c1, c0, 0 @ read control reg 656 bic r0, r0, #1 << 28 @ clear SCTLR.TRE 657 orr r0, r0, #0x5000 @ I-cache enable, RR cache replacement 658 orr r0, r0, #0x003c @ write buffer 659#ifdef CONFIG_MMU 660#ifdef CONFIG_CPU_ENDIAN_BE8 661 orr r0, r0, #1 << 25 @ big-endian page tables 662#endif 663 mrcne p15, 0, r6, c2, c0, 2 @ read ttb control reg 664 orrne r0, r0, #1 @ MMU enabled 665 movne r1, #0xfffffffd @ domain 0 = client 666 bic r6, r6, #1 << 31 @ 32-bit translation system 667 bic r6, r6, #3 << 0 @ use only ttbr0 668 mcrne p15, 0, r3, c2, c0, 0 @ load page table pointer 669 mcrne p15, 0, r1, c3, c0, 0 @ load domain access control 670 mcrne p15, 0, r6, c2, c0, 2 @ load ttb control 671#endif 672 mcr p15, 0, r0, c7, c5, 4 @ ISB 673 mcr p15, 0, r0, c1, c0, 0 @ load control register 674 mrc p15, 0, r0, c1, c0, 0 @ and read it back 675 mov r0, #0 676 mcr p15, 0, r0, c7, c5, 4 @ ISB 677 mov pc, r12 678 679__fa526_cache_on: 680 mov r12, lr 681 mov r6, #CB_BITS | 0x12 @ U 682 bl __setup_mmu 683 mov r0, #0 684 mcr p15, 0, r0, c7, c7, 0 @ Invalidate whole cache 685 mcr p15, 0, r0, c7, c10, 4 @ drain write buffer 686 mcr p15, 0, r0, c8, c7, 0 @ flush UTLB 687 mrc p15, 0, r0, c1, c0, 0 @ read control reg 688 orr r0, r0, #0x1000 @ I-cache enable 689 bl __common_mmu_cache_on 690 mov r0, #0 691 mcr p15, 0, r0, c8, c7, 0 @ flush UTLB 692 mov pc, r12 693 694__common_mmu_cache_on: 695#ifndef CONFIG_THUMB2_KERNEL 696#ifndef DEBUG 697 orr r0, r0, #0x000d @ Write buffer, mmu 698#endif 699 mov r1, #-1 700 mcr p15, 0, r3, c2, c0, 0 @ load page table pointer 701 mcr p15, 0, r1, c3, c0, 0 @ load domain access control 702 b 1f 703 .align 5 @ cache line aligned 7041: mcr p15, 0, r0, c1, c0, 0 @ load control register 705 mrc p15, 0, r0, c1, c0, 0 @ and read it back to 706 sub pc, lr, r0, lsr #32 @ properly flush pipeline 707#endif 708 709#define PROC_ENTRY_SIZE (4*5) 710 711/* 712 * Here follow the relocatable cache support functions for the 713 * various processors. This is a generic hook for locating an 714 * entry and jumping to an instruction at the specified offset 715 * from the start of the block. Please note this is all position 716 * independent code. 717 * 718 * r1 = corrupted 719 * r2 = corrupted 720 * r3 = block offset 721 * r9 = corrupted 722 * r12 = corrupted 723 */ 724 725call_cache_fn: adr r12, proc_types 726#ifdef CONFIG_CPU_CP15 727 mrc p15, 0, r9, c0, c0 @ get processor ID 728#else 729 ldr r9, =CONFIG_PROCESSOR_ID 730#endif 7311: ldr r1, [r12, #0] @ get value 732 ldr r2, [r12, #4] @ get mask 733 eor r1, r1, r9 @ (real ^ match) 734 tst r1, r2 @ & mask 735 ARM( addeq pc, r12, r3 ) @ call cache function 736 THUMB( addeq r12, r3 ) 737 THUMB( moveq pc, r12 ) @ call cache function 738 add r12, r12, #PROC_ENTRY_SIZE 739 b 1b 740 741/* 742 * Table for cache operations. This is basically: 743 * - CPU ID match 744 * - CPU ID mask 745 * - 'cache on' method instruction 746 * - 'cache off' method instruction 747 * - 'cache flush' method instruction 748 * 749 * We match an entry using: ((real_id ^ match) & mask) == 0 750 * 751 * Writethrough caches generally only need 'on' and 'off' 752 * methods. Writeback caches _must_ have the flush method 753 * defined. 754 */ 755 .align 2 756 .type proc_types,#object 757proc_types: 758 .word 0x00000000 @ old ARM ID 759 .word 0x0000f000 760 mov pc, lr 761 THUMB( nop ) 762 mov pc, lr 763 THUMB( nop ) 764 mov pc, lr 765 THUMB( nop ) 766 767 .word 0x41007000 @ ARM7/710 768 .word 0xfff8fe00 769 mov pc, lr 770 THUMB( nop ) 771 mov pc, lr 772 THUMB( nop ) 773 mov pc, lr 774 THUMB( nop ) 775 776 .word 0x41807200 @ ARM720T (writethrough) 777 .word 0xffffff00 778 W(b) __armv4_mmu_cache_on 779 W(b) __armv4_mmu_cache_off 780 mov pc, lr 781 THUMB( nop ) 782 783 .word 0x41007400 @ ARM74x 784 .word 0xff00ff00 785 W(b) __armv3_mpu_cache_on 786 W(b) __armv3_mpu_cache_off 787 W(b) __armv3_mpu_cache_flush 788 789 .word 0x41009400 @ ARM94x 790 .word 0xff00ff00 791 W(b) __armv4_mpu_cache_on 792 W(b) __armv4_mpu_cache_off 793 W(b) __armv4_mpu_cache_flush 794 795 .word 0x41069260 @ ARM926EJ-S (v5TEJ) 796 .word 0xff0ffff0 797 W(b) __arm926ejs_mmu_cache_on 798 W(b) __armv4_mmu_cache_off 799 W(b) __armv5tej_mmu_cache_flush 800 801 .word 0x00007000 @ ARM7 IDs 802 .word 0x0000f000 803 mov pc, lr 804 THUMB( nop ) 805 mov pc, lr 806 THUMB( nop ) 807 mov pc, lr 808 THUMB( nop ) 809 810 @ Everything from here on will be the new ID system. 811 812 .word 0x4401a100 @ sa110 / sa1100 813 .word 0xffffffe0 814 W(b) __armv4_mmu_cache_on 815 W(b) __armv4_mmu_cache_off 816 W(b) __armv4_mmu_cache_flush 817 818 .word 0x6901b110 @ sa1110 819 .word 0xfffffff0 820 W(b) __armv4_mmu_cache_on 821 W(b) __armv4_mmu_cache_off 822 W(b) __armv4_mmu_cache_flush 823 824 .word 0x56056900 825 .word 0xffffff00 @ PXA9xx 826 W(b) __armv4_mmu_cache_on 827 W(b) __armv4_mmu_cache_off 828 W(b) __armv4_mmu_cache_flush 829 830 .word 0x56158000 @ PXA168 831 .word 0xfffff000 832 W(b) __armv4_mmu_cache_on 833 W(b) __armv4_mmu_cache_off 834 W(b) __armv5tej_mmu_cache_flush 835 836 .word 0x56050000 @ Feroceon 837 .word 0xff0f0000 838 W(b) __armv4_mmu_cache_on 839 W(b) __armv4_mmu_cache_off 840 W(b) __armv5tej_mmu_cache_flush 841 842#ifdef CONFIG_CPU_FEROCEON_OLD_ID 843 /* this conflicts with the standard ARMv5TE entry */ 844 .long 0x41009260 @ Old Feroceon 845 .long 0xff00fff0 846 b __armv4_mmu_cache_on 847 b __armv4_mmu_cache_off 848 b __armv5tej_mmu_cache_flush 849#endif 850 851 .word 0x66015261 @ FA526 852 .word 0xff01fff1 853 W(b) __fa526_cache_on 854 W(b) __armv4_mmu_cache_off 855 W(b) __fa526_cache_flush 856 857 @ These match on the architecture ID 858 859 .word 0x00020000 @ ARMv4T 860 .word 0x000f0000 861 W(b) __armv4_mmu_cache_on 862 W(b) __armv4_mmu_cache_off 863 W(b) __armv4_mmu_cache_flush 864 865 .word 0x00050000 @ ARMv5TE 866 .word 0x000f0000 867 W(b) __armv4_mmu_cache_on 868 W(b) __armv4_mmu_cache_off 869 W(b) __armv4_mmu_cache_flush 870 871 .word 0x00060000 @ ARMv5TEJ 872 .word 0x000f0000 873 W(b) __armv4_mmu_cache_on 874 W(b) __armv4_mmu_cache_off 875 W(b) __armv5tej_mmu_cache_flush 876 877 .word 0x0007b000 @ ARMv6 878 .word 0x000ff000 879 W(b) __armv4_mmu_cache_on 880 W(b) __armv4_mmu_cache_off 881 W(b) __armv6_mmu_cache_flush 882 883 .word 0x000f0000 @ new CPU Id 884 .word 0x000f0000 885 W(b) __armv7_mmu_cache_on 886 W(b) __armv7_mmu_cache_off 887 W(b) __armv7_mmu_cache_flush 888 889 .word 0 @ unrecognised type 890 .word 0 891 mov pc, lr 892 THUMB( nop ) 893 mov pc, lr 894 THUMB( nop ) 895 mov pc, lr 896 THUMB( nop ) 897 898 .size proc_types, . - proc_types 899 900 /* 901 * If you get a "non-constant expression in ".if" statement" 902 * error from the assembler on this line, check that you have 903 * not accidentally written a "b" instruction where you should 904 * have written W(b). 905 */ 906 .if (. - proc_types) % PROC_ENTRY_SIZE != 0 907 .error "The size of one or more proc_types entries is wrong." 908 .endif 909 910/* 911 * Turn off the Cache and MMU. ARMv3 does not support 912 * reading the control register, but ARMv4 does. 913 * 914 * On exit, 915 * r0, r1, r2, r3, r9, r12 corrupted 916 * This routine must preserve: 917 * r4, r7, r8 918 */ 919 .align 5 920cache_off: mov r3, #12 @ cache_off function 921 b call_cache_fn 922 923__armv4_mpu_cache_off: 924 mrc p15, 0, r0, c1, c0 925 bic r0, r0, #0x000d 926 mcr p15, 0, r0, c1, c0 @ turn MPU and cache off 927 mov r0, #0 928 mcr p15, 0, r0, c7, c10, 4 @ drain write buffer 929 mcr p15, 0, r0, c7, c6, 0 @ flush D-Cache 930 mcr p15, 0, r0, c7, c5, 0 @ flush I-Cache 931 mov pc, lr 932 933__armv3_mpu_cache_off: 934 mrc p15, 0, r0, c1, c0 935 bic r0, r0, #0x000d 936 mcr p15, 0, r0, c1, c0, 0 @ turn MPU and cache off 937 mov r0, #0 938 mcr p15, 0, r0, c7, c0, 0 @ invalidate whole cache v3 939 mov pc, lr 940 941__armv4_mmu_cache_off: 942#ifdef CONFIG_MMU 943 mrc p15, 0, r0, c1, c0 944 bic r0, r0, #0x000d 945 mcr p15, 0, r0, c1, c0 @ turn MMU and cache off 946 mov r0, #0 947 mcr p15, 0, r0, c7, c7 @ invalidate whole cache v4 948 mcr p15, 0, r0, c8, c7 @ invalidate whole TLB v4 949#endif 950 mov pc, lr 951 952__armv7_mmu_cache_off: 953 mrc p15, 0, r0, c1, c0 954#ifdef CONFIG_MMU 955 bic r0, r0, #0x000d 956#else 957 bic r0, r0, #0x000c 958#endif 959 mcr p15, 0, r0, c1, c0 @ turn MMU and cache off 960 mov r12, lr 961 bl __armv7_mmu_cache_flush 962 mov r0, #0 963#ifdef CONFIG_MMU 964 mcr p15, 0, r0, c8, c7, 0 @ invalidate whole TLB 965#endif 966 mcr p15, 0, r0, c7, c5, 6 @ invalidate BTC 967 mcr p15, 0, r0, c7, c10, 4 @ DSB 968 mcr p15, 0, r0, c7, c5, 4 @ ISB 969 mov pc, r12 970 971/* 972 * Clean and flush the cache to maintain consistency. 973 * 974 * On exit, 975 * r1, r2, r3, r9, r10, r11, r12 corrupted 976 * This routine must preserve: 977 * r4, r6, r7, r8 978 */ 979 .align 5 980cache_clean_flush: 981 mov r3, #16 982 b call_cache_fn 983 984__armv4_mpu_cache_flush: 985 mov r2, #1 986 mov r3, #0 987 mcr p15, 0, ip, c7, c6, 0 @ invalidate D cache 988 mov r1, #7 << 5 @ 8 segments 9891: orr r3, r1, #63 << 26 @ 64 entries 9902: mcr p15, 0, r3, c7, c14, 2 @ clean & invalidate D index 991 subs r3, r3, #1 << 26 992 bcs 2b @ entries 63 to 0 993 subs r1, r1, #1 << 5 994 bcs 1b @ segments 7 to 0 995 996 teq r2, #0 997 mcrne p15, 0, ip, c7, c5, 0 @ invalidate I cache 998 mcr p15, 0, ip, c7, c10, 4 @ drain WB 999 mov pc, lr 1000 1001__fa526_cache_flush: 1002 mov r1, #0 1003 mcr p15, 0, r1, c7, c14, 0 @ clean and invalidate D cache 1004 mcr p15, 0, r1, c7, c5, 0 @ flush I cache 1005 mcr p15, 0, r1, c7, c10, 4 @ drain WB 1006 mov pc, lr 1007 1008__armv6_mmu_cache_flush: 1009 mov r1, #0 1010 mcr p15, 0, r1, c7, c14, 0 @ clean+invalidate D 1011 mcr p15, 0, r1, c7, c5, 0 @ invalidate I+BTB 1012 mcr p15, 0, r1, c7, c15, 0 @ clean+invalidate unified 1013 mcr p15, 0, r1, c7, c10, 4 @ drain WB 1014 mov pc, lr 1015 1016__armv7_mmu_cache_flush: 1017 mrc p15, 0, r10, c0, c1, 5 @ read ID_MMFR1 1018 tst r10, #0xf << 16 @ hierarchical cache (ARMv7) 1019 mov r10, #0 1020 beq hierarchical 1021 mcr p15, 0, r10, c7, c14, 0 @ clean+invalidate D 1022 b iflush 1023hierarchical: 1024 mcr p15, 0, r10, c7, c10, 5 @ DMB 1025 stmfd sp!, {r0-r7, r9-r11} 1026 mrc p15, 1, r0, c0, c0, 1 @ read clidr 1027 ands r3, r0, #0x7000000 @ extract loc from clidr 1028 mov r3, r3, lsr #23 @ left align loc bit field 1029 beq finished @ if loc is 0, then no need to clean 1030 mov r10, #0 @ start clean at cache level 0 1031loop1: 1032 add r2, r10, r10, lsr #1 @ work out 3x current cache level 1033 mov r1, r0, lsr r2 @ extract cache type bits from clidr 1034 and r1, r1, #7 @ mask of the bits for current cache only 1035 cmp r1, #2 @ see what cache we have at this level 1036 blt skip @ skip if no cache, or just i-cache 1037 mcr p15, 2, r10, c0, c0, 0 @ select current cache level in cssr 1038 mcr p15, 0, r10, c7, c5, 4 @ isb to sych the new cssr&csidr 1039 mrc p15, 1, r1, c0, c0, 0 @ read the new csidr 1040 and r2, r1, #7 @ extract the length of the cache lines 1041 add r2, r2, #4 @ add 4 (line length offset) 1042 ldr r4, =0x3ff 1043 ands r4, r4, r1, lsr #3 @ find maximum number on the way size 1044 clz r5, r4 @ find bit position of way size increment 1045 ldr r7, =0x7fff 1046 ands r7, r7, r1, lsr #13 @ extract max number of the index size 1047loop2: 1048 mov r9, r4 @ create working copy of max way size 1049loop3: 1050 ARM( orr r11, r10, r9, lsl r5 ) @ factor way and cache number into r11 1051 ARM( orr r11, r11, r7, lsl r2 ) @ factor index number into r11 1052 THUMB( lsl r6, r9, r5 ) 1053 THUMB( orr r11, r10, r6 ) @ factor way and cache number into r11 1054 THUMB( lsl r6, r7, r2 ) 1055 THUMB( orr r11, r11, r6 ) @ factor index number into r11 1056 mcr p15, 0, r11, c7, c14, 2 @ clean & invalidate by set/way 1057 subs r9, r9, #1 @ decrement the way 1058 bge loop3 1059 subs r7, r7, #1 @ decrement the index 1060 bge loop2 1061skip: 1062 add r10, r10, #2 @ increment cache number 1063 cmp r3, r10 1064 bgt loop1 1065finished: 1066 ldmfd sp!, {r0-r7, r9-r11} 1067 mov r10, #0 @ swith back to cache level 0 1068 mcr p15, 2, r10, c0, c0, 0 @ select current cache level in cssr 1069iflush: 1070 mcr p15, 0, r10, c7, c10, 4 @ DSB 1071 mcr p15, 0, r10, c7, c5, 0 @ invalidate I+BTB 1072 mcr p15, 0, r10, c7, c10, 4 @ DSB 1073 mcr p15, 0, r10, c7, c5, 4 @ ISB 1074 mov pc, lr 1075 1076__armv5tej_mmu_cache_flush: 10771: mrc p15, 0, r15, c7, c14, 3 @ test,clean,invalidate D cache 1078 bne 1b 1079 mcr p15, 0, r0, c7, c5, 0 @ flush I cache 1080 mcr p15, 0, r0, c7, c10, 4 @ drain WB 1081 mov pc, lr 1082 1083__armv4_mmu_cache_flush: 1084 mov r2, #64*1024 @ default: 32K dcache size (*2) 1085 mov r11, #32 @ default: 32 byte line size 1086 mrc p15, 0, r3, c0, c0, 1 @ read cache type 1087 teq r3, r9 @ cache ID register present? 1088 beq no_cache_id 1089 mov r1, r3, lsr #18 1090 and r1, r1, #7 1091 mov r2, #1024 1092 mov r2, r2, lsl r1 @ base dcache size *2 1093 tst r3, #1 << 14 @ test M bit 1094 addne r2, r2, r2, lsr #1 @ +1/2 size if M == 1 1095 mov r3, r3, lsr #12 1096 and r3, r3, #3 1097 mov r11, #8 1098 mov r11, r11, lsl r3 @ cache line size in bytes 1099no_cache_id: 1100 mov r1, pc 1101 bic r1, r1, #63 @ align to longest cache line 1102 add r2, r1, r2 11031: 1104 ARM( ldr r3, [r1], r11 ) @ s/w flush D cache 1105 THUMB( ldr r3, [r1] ) @ s/w flush D cache 1106 THUMB( add r1, r1, r11 ) 1107 teq r1, r2 1108 bne 1b 1109 1110 mcr p15, 0, r1, c7, c5, 0 @ flush I cache 1111 mcr p15, 0, r1, c7, c6, 0 @ flush D cache 1112 mcr p15, 0, r1, c7, c10, 4 @ drain WB 1113 mov pc, lr 1114 1115__armv3_mmu_cache_flush: 1116__armv3_mpu_cache_flush: 1117 mov r1, #0 1118 mcr p15, 0, r1, c7, c0, 0 @ invalidate whole cache v3 1119 mov pc, lr 1120 1121/* 1122 * Various debugging routines for printing hex characters and 1123 * memory, which again must be relocatable. 1124 */ 1125#ifdef DEBUG 1126 .align 2 1127 .type phexbuf,#object 1128phexbuf: .space 12 1129 .size phexbuf, . - phexbuf 1130 1131@ phex corrupts {r0, r1, r2, r3} 1132phex: adr r3, phexbuf 1133 mov r2, #0 1134 strb r2, [r3, r1] 11351: subs r1, r1, #1 1136 movmi r0, r3 1137 bmi puts 1138 and r2, r0, #15 1139 mov r0, r0, lsr #4 1140 cmp r2, #10 1141 addge r2, r2, #7 1142 add r2, r2, #'0' 1143 strb r2, [r3, r1] 1144 b 1b 1145 1146@ puts corrupts {r0, r1, r2, r3} 1147puts: loadsp r3, r1 11481: ldrb r2, [r0], #1 1149 teq r2, #0 1150 moveq pc, lr 11512: writeb r2, r3 1152 mov r1, #0x00020000 11533: subs r1, r1, #1 1154 bne 3b 1155 teq r2, #'\n' 1156 moveq r2, #'\r' 1157 beq 2b 1158 teq r0, #0 1159 bne 1b 1160 mov pc, lr 1161@ putc corrupts {r0, r1, r2, r3} 1162putc: 1163 mov r2, r0 1164 mov r0, #0 1165 loadsp r3, r1 1166 b 2b 1167 1168@ memdump corrupts {r0, r1, r2, r3, r10, r11, r12, lr} 1169memdump: mov r12, r0 1170 mov r10, lr 1171 mov r11, #0 11722: mov r0, r11, lsl #2 1173 add r0, r0, r12 1174 mov r1, #8 1175 bl phex 1176 mov r0, #':' 1177 bl putc 11781: mov r0, #' ' 1179 bl putc 1180 ldr r0, [r12, r11, lsl #2] 1181 mov r1, #8 1182 bl phex 1183 and r0, r11, #7 1184 teq r0, #3 1185 moveq r0, #' ' 1186 bleq putc 1187 and r0, r11, #7 1188 add r11, r11, #1 1189 teq r0, #7 1190 bne 1b 1191 mov r0, #'\n' 1192 bl putc 1193 cmp r11, #64 1194 blt 2b 1195 mov pc, r10 1196#endif 1197 1198 .ltorg 1199reloc_code_end: 1200 1201 .align 1202 .section ".stack", "aw", %nobits 1203.L_user_stack: .space 4096 1204.L_user_stack_end: 1205