xref: /openbmc/linux/arch/powerpc/kernel/head_40x.S (revision f5ad1c74)
1/* SPDX-License-Identifier: GPL-2.0-or-later */
2/*
3 *    Copyright (c) 1995-1996 Gary Thomas <gdt@linuxppc.org>
4 *      Initial PowerPC version.
5 *    Copyright (c) 1996 Cort Dougan <cort@cs.nmt.edu>
6 *      Rewritten for PReP
7 *    Copyright (c) 1996 Paul Mackerras <paulus@cs.anu.edu.au>
8 *      Low-level exception handers, MMU support, and rewrite.
9 *    Copyright (c) 1997 Dan Malek <dmalek@jlc.net>
10 *      PowerPC 8xx modifications.
11 *    Copyright (c) 1998-1999 TiVo, Inc.
12 *      PowerPC 403GCX modifications.
13 *    Copyright (c) 1999 Grant Erickson <grant@lcse.umn.edu>
14 *      PowerPC 403GCX/405GP modifications.
15 *    Copyright 2000 MontaVista Software Inc.
16 *	PPC405 modifications
17 *      PowerPC 403GCX/405GP modifications.
18 * 	Author: MontaVista Software, Inc.
19 *         	frank_rowand@mvista.com or source@mvista.com
20 * 	   	debbie_chu@mvista.com
21 *
22 *    Module name: head_4xx.S
23 *
24 *    Description:
25 *      Kernel execution entry point code.
26 */
27
28#include <linux/init.h>
29#include <linux/pgtable.h>
30#include <asm/processor.h>
31#include <asm/page.h>
32#include <asm/mmu.h>
33#include <asm/cputable.h>
34#include <asm/thread_info.h>
35#include <asm/ppc_asm.h>
36#include <asm/asm-offsets.h>
37#include <asm/ptrace.h>
38#include <asm/export.h>
39
40#include "head_32.h"
41
42/* As with the other PowerPC ports, it is expected that when code
43 * execution begins here, the following registers contain valid, yet
44 * optional, information:
45 *
46 *   r3 - Board info structure pointer (DRAM, frequency, MAC address, etc.)
47 *   r4 - Starting address of the init RAM disk
48 *   r5 - Ending address of the init RAM disk
49 *   r6 - Start of kernel command line string (e.g. "mem=96m")
50 *   r7 - End of kernel command line string
51 *
52 * This is all going to change RSN when we add bi_recs.......  -- Dan
53 */
54	__HEAD
55_ENTRY(_stext);
56_ENTRY(_start);
57
58	mr	r31,r3			/* save device tree ptr */
59
60	/* We have to turn on the MMU right away so we get cache modes
61	 * set correctly.
62	 */
63	bl	initial_mmu
64
65/* We now have the lower 16 Meg mapped into TLB entries, and the caches
66 * ready to work.
67 */
68turn_on_mmu:
69	lis	r0,MSR_KERNEL@h
70	ori	r0,r0,MSR_KERNEL@l
71	mtspr	SPRN_SRR1,r0
72	lis	r0,start_here@h
73	ori	r0,r0,start_here@l
74	mtspr	SPRN_SRR0,r0
75	rfi				/* enables MMU */
76	b	.			/* prevent prefetch past rfi */
77
78/*
79 * This area is used for temporarily saving registers during the
80 * critical exception prolog.
81 */
82	. = 0xc0
83crit_save:
84_ENTRY(crit_r10)
85	.space	4
86_ENTRY(crit_r11)
87	.space	4
88_ENTRY(crit_srr0)
89	.space	4
90_ENTRY(crit_srr1)
91	.space	4
92_ENTRY(saved_ksp_limit)
93	.space	4
94
95/*
96 * Exception prolog for critical exceptions.  This is a little different
97 * from the normal exception prolog above since a critical exception
98 * can potentially occur at any point during normal exception processing.
99 * Thus we cannot use the same SPRG registers as the normal prolog above.
100 * Instead we use a couple of words of memory at low physical addresses.
101 * This is OK since we don't support SMP on these processors.
102 */
103#define CRITICAL_EXCEPTION_PROLOG					     \
104	stw	r10,crit_r10@l(0);	/* save two registers to work with */\
105	stw	r11,crit_r11@l(0);					     \
106	mfcr	r10;			/* save CR in r10 for now	   */\
107	mfspr	r11,SPRN_SRR3;		/* check whether user or kernel    */\
108	andi.	r11,r11,MSR_PR;						     \
109	lis	r11,critirq_ctx@ha;					     \
110	tophys(r11,r11);						     \
111	lwz	r11,critirq_ctx@l(r11);					     \
112	beq	1f;							     \
113	/* COMING FROM USER MODE */					     \
114	mfspr	r11,SPRN_SPRG_THREAD;	/* if from user, start at top of   */\
115	lwz	r11,TASK_STACK-THREAD(r11); /* this thread's kernel stack */\
1161:	addi	r11,r11,THREAD_SIZE-INT_FRAME_SIZE; /* Alloc an excpt frm  */\
117	tophys(r11,r11);						     \
118	stw	r10,_CCR(r11);          /* save various registers	   */\
119	stw	r12,GPR12(r11);						     \
120	stw	r9,GPR9(r11);						     \
121	mflr	r10;							     \
122	stw	r10,_LINK(r11);						     \
123	mfspr	r12,SPRN_DEAR;		/* save DEAR and ESR in the frame  */\
124	stw	r12,_DEAR(r11);		/* since they may have had stuff   */\
125	mfspr	r9,SPRN_ESR;		/* in them at the point where the  */\
126	stw	r9,_ESR(r11);		/* exception was taken		   */\
127	mfspr	r12,SPRN_SRR2;						     \
128	stw	r1,GPR1(r11);						     \
129	mfspr	r9,SPRN_SRR3;						     \
130	stw	r1,0(r11);						     \
131	tovirt(r1,r11);							     \
132	rlwinm	r9,r9,0,14,12;		/* clear MSR_WE (necessary?)	   */\
133	stw	r0,GPR0(r11);						     \
134	lis	r10, STACK_FRAME_REGS_MARKER@ha; /* exception frame marker */\
135	addi	r10, r10, STACK_FRAME_REGS_MARKER@l;			     \
136	stw	r10, 8(r11);						     \
137	SAVE_4GPRS(3, r11);						     \
138	SAVE_2GPRS(7, r11)
139
140	/*
141	 * State at this point:
142	 * r9 saved in stack frame, now saved SRR3 & ~MSR_WE
143	 * r10 saved in crit_r10 and in stack frame, trashed
144	 * r11 saved in crit_r11 and in stack frame,
145	 *	now phys stack/exception frame pointer
146	 * r12 saved in stack frame, now saved SRR2
147	 * CR saved in stack frame, CR0.EQ = !SRR3.PR
148	 * LR, DEAR, ESR in stack frame
149	 * r1 saved in stack frame, now virt stack/excframe pointer
150	 * r0, r3-r8 saved in stack frame
151	 */
152
153/*
154 * Exception vectors.
155 */
156#define CRITICAL_EXCEPTION(n, label, hdlr)			\
157	START_EXCEPTION(n, label);				\
158	CRITICAL_EXCEPTION_PROLOG;				\
159	addi	r3,r1,STACK_FRAME_OVERHEAD;			\
160	EXC_XFER_TEMPLATE(hdlr, n+2, (MSR_KERNEL & ~(MSR_ME|MSR_DE|MSR_CE)), \
161			  crit_transfer_to_handler, ret_from_crit_exc)
162
163/*
164 * 0x0100 - Critical Interrupt Exception
165 */
166	CRITICAL_EXCEPTION(0x0100, CriticalInterrupt, unknown_exception)
167
168/*
169 * 0x0200 - Machine Check Exception
170 */
171	CRITICAL_EXCEPTION(0x0200, MachineCheck, machine_check_exception)
172
173/*
174 * 0x0300 - Data Storage Exception
175 * This happens for just a few reasons.  U0 set (but we don't do that),
176 * or zone protection fault (user violation, write to protected page).
177 * The other Data TLB exceptions bail out to this point
178 * if they can't resolve the lightweight TLB fault.
179 */
180	START_EXCEPTION(0x0300,	DataStorage)
181	EXCEPTION_PROLOG
182	mfspr	r5, SPRN_ESR		/* Grab the ESR, save it, pass arg3 */
183	stw	r5, _ESR(r11)
184	mfspr	r4, SPRN_DEAR		/* Grab the DEAR, save it, pass arg2 */
185	stw	r4, _DEAR(r11)
186	EXC_XFER_LITE(0x300, handle_page_fault)
187
188/*
189 * 0x0400 - Instruction Storage Exception
190 * This is caused by a fetch from non-execute or guarded pages.
191 */
192	START_EXCEPTION(0x0400, InstructionAccess)
193	EXCEPTION_PROLOG
194	mr	r4,r12			/* Pass SRR0 as arg2 */
195	stw	r4, _DEAR(r11)
196	li	r5,0			/* Pass zero as arg3 */
197	EXC_XFER_LITE(0x400, handle_page_fault)
198
199/* 0x0500 - External Interrupt Exception */
200	EXCEPTION(0x0500, HardwareInterrupt, do_IRQ, EXC_XFER_LITE)
201
202/* 0x0600 - Alignment Exception */
203	START_EXCEPTION(0x0600, Alignment)
204	EXCEPTION_PROLOG
205	mfspr	r4,SPRN_DEAR		/* Grab the DEAR and save it */
206	stw	r4,_DEAR(r11)
207	addi	r3,r1,STACK_FRAME_OVERHEAD
208	EXC_XFER_STD(0x600, alignment_exception)
209
210/* 0x0700 - Program Exception */
211	START_EXCEPTION(0x0700, ProgramCheck)
212	EXCEPTION_PROLOG
213	mfspr	r4,SPRN_ESR		/* Grab the ESR and save it */
214	stw	r4,_ESR(r11)
215	addi	r3,r1,STACK_FRAME_OVERHEAD
216	EXC_XFER_STD(0x700, program_check_exception)
217
218	EXCEPTION(0x0800, Trap_08, unknown_exception, EXC_XFER_STD)
219	EXCEPTION(0x0900, Trap_09, unknown_exception, EXC_XFER_STD)
220	EXCEPTION(0x0A00, Trap_0A, unknown_exception, EXC_XFER_STD)
221	EXCEPTION(0x0B00, Trap_0B, unknown_exception, EXC_XFER_STD)
222
223/* 0x0C00 - System Call Exception */
224	START_EXCEPTION(0x0C00,	SystemCall)
225	SYSCALL_ENTRY	0xc00
226/*	Trap_0D is commented out to get more space for system call exception */
227
228/*	EXCEPTION(0x0D00, Trap_0D, unknown_exception, EXC_XFER_STD) */
229	EXCEPTION(0x0E00, Trap_0E, unknown_exception, EXC_XFER_STD)
230	EXCEPTION(0x0F00, Trap_0F, unknown_exception, EXC_XFER_STD)
231
232/* 0x1000 - Programmable Interval Timer (PIT) Exception */
233	. = 0x1000
234	b Decrementer
235
236/* 0x1010 - Fixed Interval Timer (FIT) Exception
237*/
238	. = 0x1010
239	b FITException
240
241/* 0x1020 - Watchdog Timer (WDT) Exception
242*/
243	. = 0x1020
244	b WDTException
245
246/* 0x1100 - Data TLB Miss Exception
247 * As the name implies, translation is not in the MMU, so search the
248 * page tables and fix it.  The only purpose of this function is to
249 * load TLB entries from the page table if they exist.
250 */
251	START_EXCEPTION(0x1100,	DTLBMiss)
252	mtspr	SPRN_SPRG_SCRATCH0, r10 /* Save some working registers */
253	mtspr	SPRN_SPRG_SCRATCH1, r11
254	mtspr	SPRN_SPRG_SCRATCH3, r12
255	mtspr	SPRN_SPRG_SCRATCH4, r9
256	mfcr	r12
257	mfspr	r9, SPRN_PID
258	mtspr	SPRN_SPRG_SCRATCH5, r9
259	mfspr	r10, SPRN_DEAR		/* Get faulting address */
260
261	/* If we are faulting a kernel address, we have to use the
262	 * kernel page tables.
263	 */
264	lis	r11, PAGE_OFFSET@h
265	cmplw	r10, r11
266	blt+	3f
267	lis	r11, swapper_pg_dir@h
268	ori	r11, r11, swapper_pg_dir@l
269	li	r9, 0
270	mtspr	SPRN_PID, r9		/* TLB will have 0 TID */
271	b	4f
272
273	/* Get the PGD for the current thread.
274	 */
2753:
276	mfspr	r11,SPRN_SPRG_THREAD
277	lwz	r11,PGDIR(r11)
2784:
279	tophys(r11, r11)
280	rlwimi	r11, r10, 12, 20, 29	/* Create L1 (pgdir/pmd) address */
281	lwz	r11, 0(r11)		/* Get L1 entry */
282	andi.	r9, r11, _PMD_PRESENT	/* Check if it points to a PTE page */
283	beq	2f			/* Bail if no table */
284
285	rlwimi	r11, r10, 22, 20, 29	/* Compute PTE address */
286	lwz	r11, 0(r11)		/* Get Linux PTE */
287	li	r9, _PAGE_PRESENT | _PAGE_ACCESSED
288	andc.	r9, r9, r11		/* Check permission */
289	bne	5f
290
291	rlwinm	r9, r11, 1, _PAGE_RW	/* dirty => rw */
292	and	r9, r9, r11		/* hwwrite = dirty & rw */
293	rlwimi	r11, r9, 0, _PAGE_RW	/* replace rw by hwwrite */
294
295	/* Create TLB tag.  This is the faulting address plus a static
296	 * set of bits.  These are size, valid, E, U0.
297	*/
298	li	r9, 0x00c0
299	rlwimi	r10, r9, 0, 20, 31
300
301	b	finish_tlb_load
302
3032:	/* Check for possible large-page pmd entry */
304	rlwinm.	r9, r11, 2, 22, 24
305	beq	5f
306
307	/* Create TLB tag.  This is the faulting address, plus a static
308	 * set of bits (valid, E, U0) plus the size from the PMD.
309	 */
310	ori	r9, r9, 0x40
311	rlwimi	r10, r9, 0, 20, 31
312
313	b	finish_tlb_load
314
3155:
316	/* The bailout.  Restore registers to pre-exception conditions
317	 * and call the heavyweights to help us out.
318	 */
319	mfspr	r9, SPRN_SPRG_SCRATCH5
320	mtspr	SPRN_PID, r9
321	mtcr	r12
322	mfspr	r9, SPRN_SPRG_SCRATCH4
323	mfspr	r12, SPRN_SPRG_SCRATCH3
324	mfspr	r11, SPRN_SPRG_SCRATCH1
325	mfspr	r10, SPRN_SPRG_SCRATCH0
326	b	DataStorage
327
328/* 0x1200 - Instruction TLB Miss Exception
329 * Nearly the same as above, except we get our information from different
330 * registers and bailout to a different point.
331 */
332	START_EXCEPTION(0x1200,	ITLBMiss)
333	mtspr	SPRN_SPRG_SCRATCH0, r10	 /* Save some working registers */
334	mtspr	SPRN_SPRG_SCRATCH1, r11
335	mtspr	SPRN_SPRG_SCRATCH3, r12
336	mtspr	SPRN_SPRG_SCRATCH4, r9
337	mfcr	r12
338	mfspr	r9, SPRN_PID
339	mtspr	SPRN_SPRG_SCRATCH5, r9
340	mfspr	r10, SPRN_SRR0		/* Get faulting address */
341
342	/* If we are faulting a kernel address, we have to use the
343	 * kernel page tables.
344	 */
345	lis	r11, PAGE_OFFSET@h
346	cmplw	r10, r11
347	blt+	3f
348	lis	r11, swapper_pg_dir@h
349	ori	r11, r11, swapper_pg_dir@l
350	li	r9, 0
351	mtspr	SPRN_PID, r9		/* TLB will have 0 TID */
352	b	4f
353
354	/* Get the PGD for the current thread.
355	 */
3563:
357	mfspr	r11,SPRN_SPRG_THREAD
358	lwz	r11,PGDIR(r11)
3594:
360	tophys(r11, r11)
361	rlwimi	r11, r10, 12, 20, 29	/* Create L1 (pgdir/pmd) address */
362	lwz	r11, 0(r11)		/* Get L1 entry */
363	andi.	r9, r11, _PMD_PRESENT	/* Check if it points to a PTE page */
364	beq	2f			/* Bail if no table */
365
366	rlwimi	r11, r10, 22, 20, 29	/* Compute PTE address */
367	lwz	r11, 0(r11)		/* Get Linux PTE */
368	li	r9, _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC
369	andc.	r9, r9, r11		/* Check permission */
370	bne	5f
371
372	rlwinm	r9, r11, 1, _PAGE_RW	/* dirty => rw */
373	and	r9, r9, r11		/* hwwrite = dirty & rw */
374	rlwimi	r11, r9, 0, _PAGE_RW	/* replace rw by hwwrite */
375
376	/* Create TLB tag.  This is the faulting address plus a static
377	 * set of bits.  These are size, valid, E, U0.
378	*/
379	li	r9, 0x00c0
380	rlwimi	r10, r9, 0, 20, 31
381
382	b	finish_tlb_load
383
3842:	/* Check for possible large-page pmd entry */
385	rlwinm.	r9, r11, 2, 22, 24
386	beq	5f
387
388	/* Create TLB tag.  This is the faulting address, plus a static
389	 * set of bits (valid, E, U0) plus the size from the PMD.
390	 */
391	ori	r9, r9, 0x40
392	rlwimi	r10, r9, 0, 20, 31
393
394	b	finish_tlb_load
395
3965:
397	/* The bailout.  Restore registers to pre-exception conditions
398	 * and call the heavyweights to help us out.
399	 */
400	mfspr	r9, SPRN_SPRG_SCRATCH5
401	mtspr	SPRN_PID, r9
402	mtcr	r12
403	mfspr	r9, SPRN_SPRG_SCRATCH4
404	mfspr	r12, SPRN_SPRG_SCRATCH3
405	mfspr	r11, SPRN_SPRG_SCRATCH1
406	mfspr	r10, SPRN_SPRG_SCRATCH0
407	b	InstructionAccess
408
409	EXCEPTION(0x1300, Trap_13, unknown_exception, EXC_XFER_STD)
410	EXCEPTION(0x1400, Trap_14, unknown_exception, EXC_XFER_STD)
411	EXCEPTION(0x1500, Trap_15, unknown_exception, EXC_XFER_STD)
412	EXCEPTION(0x1600, Trap_16, unknown_exception, EXC_XFER_STD)
413	EXCEPTION(0x1700, Trap_17, unknown_exception, EXC_XFER_STD)
414	EXCEPTION(0x1800, Trap_18, unknown_exception, EXC_XFER_STD)
415	EXCEPTION(0x1900, Trap_19, unknown_exception, EXC_XFER_STD)
416	EXCEPTION(0x1A00, Trap_1A, unknown_exception, EXC_XFER_STD)
417	EXCEPTION(0x1B00, Trap_1B, unknown_exception, EXC_XFER_STD)
418	EXCEPTION(0x1C00, Trap_1C, unknown_exception, EXC_XFER_STD)
419	EXCEPTION(0x1D00, Trap_1D, unknown_exception, EXC_XFER_STD)
420	EXCEPTION(0x1E00, Trap_1E, unknown_exception, EXC_XFER_STD)
421	EXCEPTION(0x1F00, Trap_1F, unknown_exception, EXC_XFER_STD)
422
423/* Check for a single step debug exception while in an exception
424 * handler before state has been saved.  This is to catch the case
425 * where an instruction that we are trying to single step causes
426 * an exception (eg ITLB/DTLB miss) and thus the first instruction of
427 * the exception handler generates a single step debug exception.
428 *
429 * If we get a debug trap on the first instruction of an exception handler,
430 * we reset the MSR_DE in the _exception handler's_ MSR (the debug trap is
431 * a critical exception, so we are using SPRN_CSRR1 to manipulate the MSR).
432 * The exception handler was handling a non-critical interrupt, so it will
433 * save (and later restore) the MSR via SPRN_SRR1, which will still have
434 * the MSR_DE bit set.
435 */
436	/* 0x2000 - Debug Exception */
437	START_EXCEPTION(0x2000, DebugTrap)
438	CRITICAL_EXCEPTION_PROLOG
439
440	/*
441	 * If this is a single step or branch-taken exception in an
442	 * exception entry sequence, it was probably meant to apply to
443	 * the code where the exception occurred (since exception entry
444	 * doesn't turn off DE automatically).  We simulate the effect
445	 * of turning off DE on entry to an exception handler by turning
446	 * off DE in the SRR3 value and clearing the debug status.
447	 */
448	mfspr	r10,SPRN_DBSR		/* check single-step/branch taken */
449	andis.	r10,r10,DBSR_IC@h
450	beq+	2f
451
452	andi.	r10,r9,MSR_IR|MSR_PR	/* check supervisor + MMU off */
453	beq	1f			/* branch and fix it up */
454
455	mfspr   r10,SPRN_SRR2		/* Faulting instruction address */
456	cmplwi  r10,0x2100
457	bgt+    2f			/* address above exception vectors */
458
459	/* here it looks like we got an inappropriate debug exception. */
4601:	rlwinm	r9,r9,0,~MSR_DE		/* clear DE in the SRR3 value */
461	lis	r10,DBSR_IC@h		/* clear the IC event */
462	mtspr	SPRN_DBSR,r10
463	/* restore state and get out */
464	lwz	r10,_CCR(r11)
465	lwz	r0,GPR0(r11)
466	lwz	r1,GPR1(r11)
467	mtcrf	0x80,r10
468	mtspr	SPRN_SRR2,r12
469	mtspr	SPRN_SRR3,r9
470	lwz	r9,GPR9(r11)
471	lwz	r12,GPR12(r11)
472	lwz	r10,crit_r10@l(0)
473	lwz	r11,crit_r11@l(0)
474	rfci
475	b	.
476
477	/* continue normal handling for a critical exception... */
4782:	mfspr	r4,SPRN_DBSR
479	addi	r3,r1,STACK_FRAME_OVERHEAD
480	EXC_XFER_TEMPLATE(DebugException, 0x2002, \
481		(MSR_KERNEL & ~(MSR_ME|MSR_DE|MSR_CE)), \
482		crit_transfer_to_handler, ret_from_crit_exc)
483
484	/* Programmable Interval Timer (PIT) Exception. (from 0x1000) */
485Decrementer:
486	EXCEPTION_PROLOG
487	lis	r0,TSR_PIS@h
488	mtspr	SPRN_TSR,r0		/* Clear the PIT exception */
489	addi	r3,r1,STACK_FRAME_OVERHEAD
490	EXC_XFER_LITE(0x1000, timer_interrupt)
491
492	/* Fixed Interval Timer (FIT) Exception. (from 0x1010) */
493FITException:
494	EXCEPTION_PROLOG
495	addi	r3,r1,STACK_FRAME_OVERHEAD;
496	EXC_XFER_STD(0x1010, unknown_exception)
497
498	/* Watchdog Timer (WDT) Exception. (from 0x1020) */
499WDTException:
500	CRITICAL_EXCEPTION_PROLOG;
501	addi	r3,r1,STACK_FRAME_OVERHEAD;
502	EXC_XFER_TEMPLATE(WatchdogException, 0x1020+2,
503	                  (MSR_KERNEL & ~(MSR_ME|MSR_DE|MSR_CE)),
504			  crit_transfer_to_handler, ret_from_crit_exc)
505
506/* Other PowerPC processors, namely those derived from the 6xx-series
507 * have vectors from 0x2100 through 0x2F00 defined, but marked as reserved.
508 * However, for the 4xx-series processors these are neither defined nor
509 * reserved.
510 */
511
512	/* Damn, I came up one instruction too many to fit into the
513	 * exception space :-).  Both the instruction and data TLB
514	 * miss get to this point to load the TLB.
515	 * 	r10 - TLB_TAG value
516	 * 	r11 - Linux PTE
517	 *	r9 - available to use
518	 *	PID - loaded with proper value when we get here
519	 *	Upon exit, we reload everything and RFI.
520	 * Actually, it will fit now, but oh well.....a common place
521	 * to load the TLB.
522	 */
523tlb_4xx_index:
524	.long	0
525finish_tlb_load:
526	/*
527	 * Clear out the software-only bits in the PTE to generate the
528	 * TLB_DATA value.  These are the bottom 2 bits of the RPM, the
529	 * top 3 bits of the zone field, and M.
530	 */
531	li	r9, 0x0ce2
532	andc	r11, r11, r9
533
534	/* load the next available TLB index. */
535	lwz	r9, tlb_4xx_index@l(0)
536	addi	r9, r9, 1
537	andi.	r9, r9, PPC40X_TLB_SIZE - 1
538	stw	r9, tlb_4xx_index@l(0)
539
540	tlbwe	r11, r9, TLB_DATA		/* Load TLB LO */
541	tlbwe	r10, r9, TLB_TAG		/* Load TLB HI */
542
543	/* Done...restore registers and get out of here.
544	*/
545	mfspr	r9, SPRN_SPRG_SCRATCH5
546	mtspr	SPRN_PID, r9
547	mtcr	r12
548	mfspr	r9, SPRN_SPRG_SCRATCH4
549	mfspr	r12, SPRN_SPRG_SCRATCH3
550	mfspr	r11, SPRN_SPRG_SCRATCH1
551	mfspr	r10, SPRN_SPRG_SCRATCH0
552	rfi			/* Should sync shadow TLBs */
553	b	.		/* prevent prefetch past rfi */
554
555/* This is where the main kernel code starts.
556 */
557start_here:
558
559	/* ptr to current */
560	lis	r2,init_task@h
561	ori	r2,r2,init_task@l
562
563	/* ptr to phys current thread */
564	tophys(r4,r2)
565	addi	r4,r4,THREAD	/* init task's THREAD */
566	mtspr	SPRN_SPRG_THREAD,r4
567
568	/* stack */
569	lis	r1,init_thread_union@ha
570	addi	r1,r1,init_thread_union@l
571	li	r0,0
572	stwu	r0,THREAD_SIZE-STACK_FRAME_OVERHEAD(r1)
573
574	bl	early_init	/* We have to do this with MMU on */
575
576/*
577 * Decide what sort of machine this is and initialize the MMU.
578 */
579#ifdef CONFIG_KASAN
580	bl	kasan_early_init
581#endif
582	li	r3,0
583	mr	r4,r31
584	bl	machine_init
585	bl	MMU_init
586
587/* Go back to running unmapped so we can load up new values
588 * and change to using our exception vectors.
589 * On the 4xx, all we have to do is invalidate the TLB to clear
590 * the old 16M byte TLB mappings.
591 */
592	lis	r4,2f@h
593	ori	r4,r4,2f@l
594	tophys(r4,r4)
595	lis	r3,(MSR_KERNEL & ~(MSR_IR|MSR_DR))@h
596	ori	r3,r3,(MSR_KERNEL & ~(MSR_IR|MSR_DR))@l
597	mtspr	SPRN_SRR0,r4
598	mtspr	SPRN_SRR1,r3
599	rfi
600	b	.		/* prevent prefetch past rfi */
601
602/* Load up the kernel context */
6032:
604	sync			/* Flush to memory before changing TLB */
605	tlbia
606	isync			/* Flush shadow TLBs */
607
608	/* set up the PTE pointers for the Abatron bdiGDB.
609	*/
610	lis	r6, swapper_pg_dir@h
611	ori	r6, r6, swapper_pg_dir@l
612	lis	r5, abatron_pteptrs@h
613	ori	r5, r5, abatron_pteptrs@l
614	stw	r5, 0xf0(0)	/* Must match your Abatron config file */
615	tophys(r5,r5)
616	stw	r6, 0(r5)
617
618/* Now turn on the MMU for real! */
619	lis	r4,MSR_KERNEL@h
620	ori	r4,r4,MSR_KERNEL@l
621	lis	r3,start_kernel@h
622	ori	r3,r3,start_kernel@l
623	mtspr	SPRN_SRR0,r3
624	mtspr	SPRN_SRR1,r4
625	rfi			/* enable MMU and jump to start_kernel */
626	b	.		/* prevent prefetch past rfi */
627
628/* Set up the initial MMU state so we can do the first level of
629 * kernel initialization.  This maps the first 16 MBytes of memory 1:1
630 * virtual to physical and more importantly sets the cache mode.
631 */
632initial_mmu:
633	tlbia			/* Invalidate all TLB entries */
634	isync
635
636	/* We should still be executing code at physical address 0x0000xxxx
637	 * at this point. However, start_here is at virtual address
638	 * 0xC000xxxx. So, set up a TLB mapping to cover this once
639	 * translation is enabled.
640	 */
641
642	lis	r3,KERNELBASE@h		/* Load the kernel virtual address */
643	ori	r3,r3,KERNELBASE@l
644	tophys(r4,r3)			/* Load the kernel physical address */
645
646	iccci	r0,r3			/* Invalidate the i-cache before use */
647
648	/* Load the kernel PID.
649	*/
650	li	r0,0
651	mtspr	SPRN_PID,r0
652	sync
653
654	/* Configure and load one entry into TLB slots 63 */
655	clrrwi	r4,r4,10		/* Mask off the real page number */
656	ori	r4,r4,(TLB_WR | TLB_EX)	/* Set the write and execute bits */
657
658	clrrwi	r3,r3,10		/* Mask off the effective page number */
659	ori	r3,r3,(TLB_VALID | TLB_PAGESZ(PAGESZ_16M))
660
661        li      r0,63                    /* TLB slot 63 */
662
663	tlbwe	r4,r0,TLB_DATA		/* Load the data portion of the entry */
664	tlbwe	r3,r0,TLB_TAG		/* Load the tag portion of the entry */
665
666	isync
667
668	/* Establish the exception vector base
669	*/
670	lis	r4,KERNELBASE@h		/* EVPR only uses the high 16-bits */
671	tophys(r0,r4)			/* Use the physical address */
672	mtspr	SPRN_EVPR,r0
673
674	blr
675
676_GLOBAL(abort)
677        mfspr   r13,SPRN_DBCR0
678        oris    r13,r13,DBCR0_RST_SYSTEM@h
679        mtspr   SPRN_DBCR0,r13
680
681_GLOBAL(set_context)
682
683#ifdef CONFIG_BDI_SWITCH
684	/* Context switch the PTE pointer for the Abatron BDI2000.
685	 * The PGDIR is the second parameter.
686	 */
687	lis	r5, abatron_pteptrs@ha
688	stw	r4, abatron_pteptrs@l + 0x4(r5)
689#endif
690	sync
691	mtspr	SPRN_PID,r3
692	isync				/* Need an isync to flush shadow */
693					/* TLBs after changing PID */
694	blr
695
696/* We put a few things here that have to be page-aligned. This stuff
697 * goes at the beginning of the data segment, which is page-aligned.
698 */
699	.data
700	.align	12
701	.globl	sdata
702sdata:
703	.globl	empty_zero_page
704empty_zero_page:
705	.space	4096
706EXPORT_SYMBOL(empty_zero_page)
707	.globl	swapper_pg_dir
708swapper_pg_dir:
709	.space	PGD_TABLE_SIZE
710
711/* Room for two PTE pointers, usually the kernel and current user pointers
712 * to their respective root page table.
713 */
714abatron_pteptrs:
715	.space	8
716