xref: /openbmc/linux/arch/powerpc/kernel/head_64.S (revision 93dc544c)
1/*
2 *  PowerPC version
3 *    Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
4 *
5 *  Rewritten by Cort Dougan (cort@cs.nmt.edu) for PReP
6 *    Copyright (C) 1996 Cort Dougan <cort@cs.nmt.edu>
7 *  Adapted for Power Macintosh by Paul Mackerras.
8 *  Low-level exception handlers and MMU support
9 *  rewritten by Paul Mackerras.
10 *    Copyright (C) 1996 Paul Mackerras.
11 *
12 *  Adapted for 64bit PowerPC by Dave Engebretsen, Peter Bergner, and
13 *    Mike Corrigan {engebret|bergner|mikejc}@us.ibm.com
14 *
15 *  This file contains the low-level support and setup for the
16 *  PowerPC-64 platform, including trap and interrupt dispatch.
17 *
18 *  This program is free software; you can redistribute it and/or
19 *  modify it under the terms of the GNU General Public License
20 *  as published by the Free Software Foundation; either version
21 *  2 of the License, or (at your option) any later version.
22 */
23
24#include <linux/threads.h>
25#include <asm/reg.h>
26#include <asm/page.h>
27#include <asm/mmu.h>
28#include <asm/ppc_asm.h>
29#include <asm/asm-offsets.h>
30#include <asm/bug.h>
31#include <asm/cputable.h>
32#include <asm/setup.h>
33#include <asm/hvcall.h>
34#include <asm/iseries/lpar_map.h>
35#include <asm/thread_info.h>
36#include <asm/firmware.h>
37#include <asm/page_64.h>
38#include <asm/exception.h>
39#include <asm/irqflags.h>
40
41/*
42 * We layout physical memory as follows:
43 * 0x0000 - 0x00ff : Secondary processor spin code
44 * 0x0100 - 0x2fff : pSeries Interrupt prologs
45 * 0x3000 - 0x5fff : interrupt support, iSeries and common interrupt prologs
46 * 0x6000 - 0x6fff : Initial (CPU0) segment table
47 * 0x7000 - 0x7fff : FWNMI data area
48 * 0x8000 -        : Early init and support code
49 */
50
51/*
52 *   SPRG Usage
53 *
54 *   Register	Definition
55 *
56 *   SPRG0	reserved for hypervisor
57 *   SPRG1	temp - used to save gpr
58 *   SPRG2	temp - used to save gpr
59 *   SPRG3	virt addr of paca
60 */
61
62/*
63 * Entering into this code we make the following assumptions:
64 *  For pSeries:
65 *   1. The MMU is off & open firmware is running in real mode.
66 *   2. The kernel is entered at __start
67 *
68 *  For iSeries:
69 *   1. The MMU is on (as it always is for iSeries)
70 *   2. The kernel is entered at system_reset_iSeries
71 */
72
73	.text
74	.globl  _stext
75_stext:
76_GLOBAL(__start)
77	/* NOP this out unconditionally */
78BEGIN_FTR_SECTION
79	b	.__start_initialization_multiplatform
80END_FTR_SECTION(0, 1)
81
82	/* Catch branch to 0 in real mode */
83	trap
84
85	/* Secondary processors spin on this value until it goes to 1. */
86	.globl  __secondary_hold_spinloop
87__secondary_hold_spinloop:
88	.llong	0x0
89
90	/* Secondary processors write this value with their cpu # */
91	/* after they enter the spin loop immediately below.	  */
92	.globl	__secondary_hold_acknowledge
93__secondary_hold_acknowledge:
94	.llong	0x0
95
96#ifdef CONFIG_PPC_ISERIES
97	/*
98	 * At offset 0x20, there is a pointer to iSeries LPAR data.
99	 * This is required by the hypervisor
100	 */
101	. = 0x20
102	.llong hvReleaseData-KERNELBASE
103#endif /* CONFIG_PPC_ISERIES */
104
105	. = 0x60
106/*
107 * The following code is used to hold secondary processors
108 * in a spin loop after they have entered the kernel, but
109 * before the bulk of the kernel has been relocated.  This code
110 * is relocated to physical address 0x60 before prom_init is run.
111 * All of it must fit below the first exception vector at 0x100.
112 */
113_GLOBAL(__secondary_hold)
114	mfmsr	r24
115	ori	r24,r24,MSR_RI
116	mtmsrd	r24			/* RI on */
117
118	/* Grab our physical cpu number */
119	mr	r24,r3
120
121	/* Tell the master cpu we're here */
122	/* Relocation is off & we are located at an address less */
123	/* than 0x100, so only need to grab low order offset.    */
124	std	r24,__secondary_hold_acknowledge@l(0)
125	sync
126
127	/* All secondary cpus wait here until told to start. */
128100:	ld	r4,__secondary_hold_spinloop@l(0)
129	cmpdi	0,r4,1
130	bne	100b
131
132#if defined(CONFIG_SMP) || defined(CONFIG_KEXEC)
133	LOAD_REG_IMMEDIATE(r4, .generic_secondary_smp_init)
134	mtctr	r4
135	mr	r3,r24
136	bctr
137#else
138	BUG_OPCODE
139#endif
140
141/* This value is used to mark exception frames on the stack. */
142	.section ".toc","aw"
143exception_marker:
144	.tc	ID_72656773_68657265[TC],0x7265677368657265
145	.text
146
147/*
148 * This is the start of the interrupt handlers for pSeries
149 * This code runs with relocation off.
150 */
151	. = 0x100
152	.globl __start_interrupts
153__start_interrupts:
154
155	STD_EXCEPTION_PSERIES(0x100, system_reset)
156
157	. = 0x200
158_machine_check_pSeries:
159	HMT_MEDIUM
160	mtspr	SPRN_SPRG1,r13		/* save r13 */
161	EXCEPTION_PROLOG_PSERIES(PACA_EXMC, machine_check_common)
162
163	. = 0x300
164	.globl data_access_pSeries
165data_access_pSeries:
166	HMT_MEDIUM
167	mtspr	SPRN_SPRG1,r13
168BEGIN_FTR_SECTION
169	mtspr	SPRN_SPRG2,r12
170	mfspr	r13,SPRN_DAR
171	mfspr	r12,SPRN_DSISR
172	srdi	r13,r13,60
173	rlwimi	r13,r12,16,0x20
174	mfcr	r12
175	cmpwi	r13,0x2c
176	beq	do_stab_bolted_pSeries
177	mtcrf	0x80,r12
178	mfspr	r12,SPRN_SPRG2
179END_FTR_SECTION_IFCLR(CPU_FTR_SLB)
180	EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, data_access_common)
181
182	. = 0x380
183	.globl data_access_slb_pSeries
184data_access_slb_pSeries:
185	HMT_MEDIUM
186	mtspr	SPRN_SPRG1,r13
187	mfspr	r13,SPRN_SPRG3		/* get paca address into r13 */
188	std	r3,PACA_EXSLB+EX_R3(r13)
189	mfspr	r3,SPRN_DAR
190	std	r9,PACA_EXSLB+EX_R9(r13)	/* save r9 - r12 */
191	mfcr	r9
192#ifdef __DISABLED__
193	/* Keep that around for when we re-implement dynamic VSIDs */
194	cmpdi	r3,0
195	bge	slb_miss_user_pseries
196#endif /* __DISABLED__ */
197	std	r10,PACA_EXSLB+EX_R10(r13)
198	std	r11,PACA_EXSLB+EX_R11(r13)
199	std	r12,PACA_EXSLB+EX_R12(r13)
200	mfspr	r10,SPRN_SPRG1
201	std	r10,PACA_EXSLB+EX_R13(r13)
202	mfspr	r12,SPRN_SRR1		/* and SRR1 */
203	b	.slb_miss_realmode	/* Rel. branch works in real mode */
204
205	STD_EXCEPTION_PSERIES(0x400, instruction_access)
206
207	. = 0x480
208	.globl instruction_access_slb_pSeries
209instruction_access_slb_pSeries:
210	HMT_MEDIUM
211	mtspr	SPRN_SPRG1,r13
212	mfspr	r13,SPRN_SPRG3		/* get paca address into r13 */
213	std	r3,PACA_EXSLB+EX_R3(r13)
214	mfspr	r3,SPRN_SRR0		/* SRR0 is faulting address */
215	std	r9,PACA_EXSLB+EX_R9(r13)	/* save r9 - r12 */
216	mfcr	r9
217#ifdef __DISABLED__
218	/* Keep that around for when we re-implement dynamic VSIDs */
219	cmpdi	r3,0
220	bge	slb_miss_user_pseries
221#endif /* __DISABLED__ */
222	std	r10,PACA_EXSLB+EX_R10(r13)
223	std	r11,PACA_EXSLB+EX_R11(r13)
224	std	r12,PACA_EXSLB+EX_R12(r13)
225	mfspr	r10,SPRN_SPRG1
226	std	r10,PACA_EXSLB+EX_R13(r13)
227	mfspr	r12,SPRN_SRR1		/* and SRR1 */
228	b	.slb_miss_realmode	/* Rel. branch works in real mode */
229
230	MASKABLE_EXCEPTION_PSERIES(0x500, hardware_interrupt)
231	STD_EXCEPTION_PSERIES(0x600, alignment)
232	STD_EXCEPTION_PSERIES(0x700, program_check)
233	STD_EXCEPTION_PSERIES(0x800, fp_unavailable)
234	MASKABLE_EXCEPTION_PSERIES(0x900, decrementer)
235	STD_EXCEPTION_PSERIES(0xa00, trap_0a)
236	STD_EXCEPTION_PSERIES(0xb00, trap_0b)
237
238	. = 0xc00
239	.globl	system_call_pSeries
240system_call_pSeries:
241	HMT_MEDIUM
242BEGIN_FTR_SECTION
243	cmpdi	r0,0x1ebe
244	beq-	1f
245END_FTR_SECTION_IFSET(CPU_FTR_REAL_LE)
246	mr	r9,r13
247	mfmsr	r10
248	mfspr	r13,SPRN_SPRG3
249	mfspr	r11,SPRN_SRR0
250	clrrdi	r12,r13,32
251	oris	r12,r12,system_call_common@h
252	ori	r12,r12,system_call_common@l
253	mtspr	SPRN_SRR0,r12
254	ori	r10,r10,MSR_IR|MSR_DR|MSR_RI
255	mfspr	r12,SPRN_SRR1
256	mtspr	SPRN_SRR1,r10
257	rfid
258	b	.	/* prevent speculative execution */
259
260/* Fast LE/BE switch system call */
2611:	mfspr	r12,SPRN_SRR1
262	xori	r12,r12,MSR_LE
263	mtspr	SPRN_SRR1,r12
264	rfid		/* return to userspace */
265	b	.
266
267	STD_EXCEPTION_PSERIES(0xd00, single_step)
268	STD_EXCEPTION_PSERIES(0xe00, trap_0e)
269
270	/* We need to deal with the Altivec unavailable exception
271	 * here which is at 0xf20, thus in the middle of the
272	 * prolog code of the PerformanceMonitor one. A little
273	 * trickery is thus necessary
274	 */
275	. = 0xf00
276	b	performance_monitor_pSeries
277
278	. = 0xf20
279	b	altivec_unavailable_pSeries
280
281	. = 0xf40
282	b	vsx_unavailable_pSeries
283
284#ifdef CONFIG_CBE_RAS
285	HSTD_EXCEPTION_PSERIES(0x1200, cbe_system_error)
286#endif /* CONFIG_CBE_RAS */
287	STD_EXCEPTION_PSERIES(0x1300, instruction_breakpoint)
288#ifdef CONFIG_CBE_RAS
289	HSTD_EXCEPTION_PSERIES(0x1600, cbe_maintenance)
290#endif /* CONFIG_CBE_RAS */
291	STD_EXCEPTION_PSERIES(0x1700, altivec_assist)
292#ifdef CONFIG_CBE_RAS
293	HSTD_EXCEPTION_PSERIES(0x1800, cbe_thermal)
294#endif /* CONFIG_CBE_RAS */
295
296	. = 0x3000
297
298/*** pSeries interrupt support ***/
299
300	/* moved from 0xf00 */
301	STD_EXCEPTION_PSERIES(., performance_monitor)
302	STD_EXCEPTION_PSERIES(., altivec_unavailable)
303	STD_EXCEPTION_PSERIES(., vsx_unavailable)
304
305/*
306 * An interrupt came in while soft-disabled; clear EE in SRR1,
307 * clear paca->hard_enabled and return.
308 */
309masked_interrupt:
310	stb	r10,PACAHARDIRQEN(r13)
311	mtcrf	0x80,r9
312	ld	r9,PACA_EXGEN+EX_R9(r13)
313	mfspr	r10,SPRN_SRR1
314	rldicl	r10,r10,48,1		/* clear MSR_EE */
315	rotldi	r10,r10,16
316	mtspr	SPRN_SRR1,r10
317	ld	r10,PACA_EXGEN+EX_R10(r13)
318	mfspr	r13,SPRN_SPRG1
319	rfid
320	b	.
321
322	.align	7
323do_stab_bolted_pSeries:
324	mtcrf	0x80,r12
325	mfspr	r12,SPRN_SPRG2
326	EXCEPTION_PROLOG_PSERIES(PACA_EXSLB, .do_stab_bolted)
327
328/*
329 * We have some room here  we use that to put
330 * the peries slb miss user trampoline code so it's reasonably
331 * away from slb_miss_user_common to avoid problems with rfid
332 *
333 * This is used for when the SLB miss handler has to go virtual,
334 * which doesn't happen for now anymore but will once we re-implement
335 * dynamic VSIDs for shared page tables
336 */
337#ifdef __DISABLED__
338slb_miss_user_pseries:
339	std	r10,PACA_EXGEN+EX_R10(r13)
340	std	r11,PACA_EXGEN+EX_R11(r13)
341	std	r12,PACA_EXGEN+EX_R12(r13)
342	mfspr	r10,SPRG1
343	ld	r11,PACA_EXSLB+EX_R9(r13)
344	ld	r12,PACA_EXSLB+EX_R3(r13)
345	std	r10,PACA_EXGEN+EX_R13(r13)
346	std	r11,PACA_EXGEN+EX_R9(r13)
347	std	r12,PACA_EXGEN+EX_R3(r13)
348	clrrdi	r12,r13,32
349	mfmsr	r10
350	mfspr	r11,SRR0			/* save SRR0 */
351	ori	r12,r12,slb_miss_user_common@l	/* virt addr of handler */
352	ori	r10,r10,MSR_IR|MSR_DR|MSR_RI
353	mtspr	SRR0,r12
354	mfspr	r12,SRR1			/* and SRR1 */
355	mtspr	SRR1,r10
356	rfid
357	b	.				/* prevent spec. execution */
358#endif /* __DISABLED__ */
359
360#ifdef CONFIG_PPC_PSERIES
361/*
362 * Vectors for the FWNMI option.  Share common code.
363 */
364	.globl system_reset_fwnmi
365      .align 7
366system_reset_fwnmi:
367	HMT_MEDIUM
368	mtspr	SPRN_SPRG1,r13		/* save r13 */
369	EXCEPTION_PROLOG_PSERIES_FORCE_64BIT(PACA_EXGEN, system_reset_common)
370
371	.globl machine_check_fwnmi
372      .align 7
373machine_check_fwnmi:
374	HMT_MEDIUM
375	mtspr	SPRN_SPRG1,r13		/* save r13 */
376	EXCEPTION_PROLOG_PSERIES_FORCE_64BIT(PACA_EXMC, machine_check_common)
377
378#endif /* CONFIG_PPC_PSERIES */
379
380/*** Common interrupt handlers ***/
381
382	STD_EXCEPTION_COMMON(0x100, system_reset, .system_reset_exception)
383
384	/*
385	 * Machine check is different because we use a different
386	 * save area: PACA_EXMC instead of PACA_EXGEN.
387	 */
388	.align	7
389	.globl machine_check_common
390machine_check_common:
391	EXCEPTION_PROLOG_COMMON(0x200, PACA_EXMC)
392	FINISH_NAP
393	DISABLE_INTS
394	bl	.save_nvgprs
395	addi	r3,r1,STACK_FRAME_OVERHEAD
396	bl	.machine_check_exception
397	b	.ret_from_except
398
399	STD_EXCEPTION_COMMON_LITE(0x900, decrementer, .timer_interrupt)
400	STD_EXCEPTION_COMMON(0xa00, trap_0a, .unknown_exception)
401	STD_EXCEPTION_COMMON(0xb00, trap_0b, .unknown_exception)
402	STD_EXCEPTION_COMMON(0xd00, single_step, .single_step_exception)
403	STD_EXCEPTION_COMMON(0xe00, trap_0e, .unknown_exception)
404	STD_EXCEPTION_COMMON_IDLE(0xf00, performance_monitor, .performance_monitor_exception)
405	STD_EXCEPTION_COMMON(0x1300, instruction_breakpoint, .instruction_breakpoint_exception)
406#ifdef CONFIG_ALTIVEC
407	STD_EXCEPTION_COMMON(0x1700, altivec_assist, .altivec_assist_exception)
408#else
409	STD_EXCEPTION_COMMON(0x1700, altivec_assist, .unknown_exception)
410#endif
411#ifdef CONFIG_CBE_RAS
412	STD_EXCEPTION_COMMON(0x1200, cbe_system_error, .cbe_system_error_exception)
413	STD_EXCEPTION_COMMON(0x1600, cbe_maintenance, .cbe_maintenance_exception)
414	STD_EXCEPTION_COMMON(0x1800, cbe_thermal, .cbe_thermal_exception)
415#endif /* CONFIG_CBE_RAS */
416
417/*
418 * Here we have detected that the kernel stack pointer is bad.
419 * R9 contains the saved CR, r13 points to the paca,
420 * r10 contains the (bad) kernel stack pointer,
421 * r11 and r12 contain the saved SRR0 and SRR1.
422 * We switch to using an emergency stack, save the registers there,
423 * and call kernel_bad_stack(), which panics.
424 */
425bad_stack:
426	ld	r1,PACAEMERGSP(r13)
427	subi	r1,r1,64+INT_FRAME_SIZE
428	std	r9,_CCR(r1)
429	std	r10,GPR1(r1)
430	std	r11,_NIP(r1)
431	std	r12,_MSR(r1)
432	mfspr	r11,SPRN_DAR
433	mfspr	r12,SPRN_DSISR
434	std	r11,_DAR(r1)
435	std	r12,_DSISR(r1)
436	mflr	r10
437	mfctr	r11
438	mfxer	r12
439	std	r10,_LINK(r1)
440	std	r11,_CTR(r1)
441	std	r12,_XER(r1)
442	SAVE_GPR(0,r1)
443	SAVE_GPR(2,r1)
444	SAVE_4GPRS(3,r1)
445	SAVE_2GPRS(7,r1)
446	SAVE_10GPRS(12,r1)
447	SAVE_10GPRS(22,r1)
448	lhz	r12,PACA_TRAP_SAVE(r13)
449	std	r12,_TRAP(r1)
450	addi	r11,r1,INT_FRAME_SIZE
451	std	r11,0(r1)
452	li	r12,0
453	std	r12,0(r11)
454	ld	r2,PACATOC(r13)
4551:	addi	r3,r1,STACK_FRAME_OVERHEAD
456	bl	.kernel_bad_stack
457	b	1b
458
459/*
460 * Return from an exception with minimal checks.
461 * The caller is assumed to have done EXCEPTION_PROLOG_COMMON.
462 * If interrupts have been enabled, or anything has been
463 * done that might have changed the scheduling status of
464 * any task or sent any task a signal, you should use
465 * ret_from_except or ret_from_except_lite instead of this.
466 */
467fast_exc_return_irq:			/* restores irq state too */
468	ld	r3,SOFTE(r1)
469	TRACE_AND_RESTORE_IRQ(r3);
470	ld	r12,_MSR(r1)
471	rldicl	r4,r12,49,63		/* get MSR_EE to LSB */
472	stb	r4,PACAHARDIRQEN(r13)	/* restore paca->hard_enabled */
473	b	1f
474
475	.globl	fast_exception_return
476fast_exception_return:
477	ld	r12,_MSR(r1)
4781:	ld	r11,_NIP(r1)
479	andi.	r3,r12,MSR_RI		/* check if RI is set */
480	beq-	unrecov_fer
481
482#ifdef CONFIG_VIRT_CPU_ACCOUNTING
483	andi.	r3,r12,MSR_PR
484	beq	2f
485	ACCOUNT_CPU_USER_EXIT(r3, r4)
4862:
487#endif
488
489	ld	r3,_CCR(r1)
490	ld	r4,_LINK(r1)
491	ld	r5,_CTR(r1)
492	ld	r6,_XER(r1)
493	mtcr	r3
494	mtlr	r4
495	mtctr	r5
496	mtxer	r6
497	REST_GPR(0, r1)
498	REST_8GPRS(2, r1)
499
500	mfmsr	r10
501	rldicl	r10,r10,48,1		/* clear EE */
502	rldicr	r10,r10,16,61		/* clear RI (LE is 0 already) */
503	mtmsrd	r10,1
504
505	mtspr	SPRN_SRR1,r12
506	mtspr	SPRN_SRR0,r11
507	REST_4GPRS(10, r1)
508	ld	r1,GPR1(r1)
509	rfid
510	b	.	/* prevent speculative execution */
511
512unrecov_fer:
513	bl	.save_nvgprs
5141:	addi	r3,r1,STACK_FRAME_OVERHEAD
515	bl	.unrecoverable_exception
516	b	1b
517
518/*
519 * Here r13 points to the paca, r9 contains the saved CR,
520 * SRR0 and SRR1 are saved in r11 and r12,
521 * r9 - r13 are saved in paca->exgen.
522 */
523	.align	7
524	.globl data_access_common
525data_access_common:
526	mfspr	r10,SPRN_DAR
527	std	r10,PACA_EXGEN+EX_DAR(r13)
528	mfspr	r10,SPRN_DSISR
529	stw	r10,PACA_EXGEN+EX_DSISR(r13)
530	EXCEPTION_PROLOG_COMMON(0x300, PACA_EXGEN)
531	ld	r3,PACA_EXGEN+EX_DAR(r13)
532	lwz	r4,PACA_EXGEN+EX_DSISR(r13)
533	li	r5,0x300
534	b	.do_hash_page	 	/* Try to handle as hpte fault */
535
536	.align	7
537	.globl instruction_access_common
538instruction_access_common:
539	EXCEPTION_PROLOG_COMMON(0x400, PACA_EXGEN)
540	ld	r3,_NIP(r1)
541	andis.	r4,r12,0x5820
542	li	r5,0x400
543	b	.do_hash_page		/* Try to handle as hpte fault */
544
545/*
546 * Here is the common SLB miss user that is used when going to virtual
547 * mode for SLB misses, that is currently not used
548 */
549#ifdef __DISABLED__
550	.align	7
551	.globl	slb_miss_user_common
552slb_miss_user_common:
553	mflr	r10
554	std	r3,PACA_EXGEN+EX_DAR(r13)
555	stw	r9,PACA_EXGEN+EX_CCR(r13)
556	std	r10,PACA_EXGEN+EX_LR(r13)
557	std	r11,PACA_EXGEN+EX_SRR0(r13)
558	bl	.slb_allocate_user
559
560	ld	r10,PACA_EXGEN+EX_LR(r13)
561	ld	r3,PACA_EXGEN+EX_R3(r13)
562	lwz	r9,PACA_EXGEN+EX_CCR(r13)
563	ld	r11,PACA_EXGEN+EX_SRR0(r13)
564	mtlr	r10
565	beq-	slb_miss_fault
566
567	andi.	r10,r12,MSR_RI		/* check for unrecoverable exception */
568	beq-	unrecov_user_slb
569	mfmsr	r10
570
571.machine push
572.machine "power4"
573	mtcrf	0x80,r9
574.machine pop
575
576	clrrdi	r10,r10,2		/* clear RI before setting SRR0/1 */
577	mtmsrd	r10,1
578
579	mtspr	SRR0,r11
580	mtspr	SRR1,r12
581
582	ld	r9,PACA_EXGEN+EX_R9(r13)
583	ld	r10,PACA_EXGEN+EX_R10(r13)
584	ld	r11,PACA_EXGEN+EX_R11(r13)
585	ld	r12,PACA_EXGEN+EX_R12(r13)
586	ld	r13,PACA_EXGEN+EX_R13(r13)
587	rfid
588	b	.
589
590slb_miss_fault:
591	EXCEPTION_PROLOG_COMMON(0x380, PACA_EXGEN)
592	ld	r4,PACA_EXGEN+EX_DAR(r13)
593	li	r5,0
594	std	r4,_DAR(r1)
595	std	r5,_DSISR(r1)
596	b	handle_page_fault
597
598unrecov_user_slb:
599	EXCEPTION_PROLOG_COMMON(0x4200, PACA_EXGEN)
600	DISABLE_INTS
601	bl	.save_nvgprs
6021:	addi	r3,r1,STACK_FRAME_OVERHEAD
603	bl	.unrecoverable_exception
604	b	1b
605
606#endif /* __DISABLED__ */
607
608
609/*
610 * r13 points to the PACA, r9 contains the saved CR,
611 * r12 contain the saved SRR1, SRR0 is still ready for return
612 * r3 has the faulting address
613 * r9 - r13 are saved in paca->exslb.
614 * r3 is saved in paca->slb_r3
615 * We assume we aren't going to take any exceptions during this procedure.
616 */
617_GLOBAL(slb_miss_realmode)
618	mflr	r10
619
620	stw	r9,PACA_EXSLB+EX_CCR(r13)	/* save CR in exc. frame */
621	std	r10,PACA_EXSLB+EX_LR(r13)	/* save LR */
622
623	bl	.slb_allocate_realmode
624
625	/* All done -- return from exception. */
626
627	ld	r10,PACA_EXSLB+EX_LR(r13)
628	ld	r3,PACA_EXSLB+EX_R3(r13)
629	lwz	r9,PACA_EXSLB+EX_CCR(r13)	/* get saved CR */
630#ifdef CONFIG_PPC_ISERIES
631BEGIN_FW_FTR_SECTION
632	ld	r11,PACALPPACAPTR(r13)
633	ld	r11,LPPACASRR0(r11)		/* get SRR0 value */
634END_FW_FTR_SECTION_IFSET(FW_FEATURE_ISERIES)
635#endif /* CONFIG_PPC_ISERIES */
636
637	mtlr	r10
638
639	andi.	r10,r12,MSR_RI	/* check for unrecoverable exception */
640	beq-	2f
641
642.machine	push
643.machine	"power4"
644	mtcrf	0x80,r9
645	mtcrf	0x01,r9		/* slb_allocate uses cr0 and cr7 */
646.machine	pop
647
648#ifdef CONFIG_PPC_ISERIES
649BEGIN_FW_FTR_SECTION
650	mtspr	SPRN_SRR0,r11
651	mtspr	SPRN_SRR1,r12
652END_FW_FTR_SECTION_IFSET(FW_FEATURE_ISERIES)
653#endif /* CONFIG_PPC_ISERIES */
654	ld	r9,PACA_EXSLB+EX_R9(r13)
655	ld	r10,PACA_EXSLB+EX_R10(r13)
656	ld	r11,PACA_EXSLB+EX_R11(r13)
657	ld	r12,PACA_EXSLB+EX_R12(r13)
658	ld	r13,PACA_EXSLB+EX_R13(r13)
659	rfid
660	b	.	/* prevent speculative execution */
661
6622:
663#ifdef CONFIG_PPC_ISERIES
664BEGIN_FW_FTR_SECTION
665	b	unrecov_slb
666END_FW_FTR_SECTION_IFSET(FW_FEATURE_ISERIES)
667#endif /* CONFIG_PPC_ISERIES */
668	mfspr	r11,SPRN_SRR0
669	clrrdi	r10,r13,32
670	LOAD_HANDLER(r10,unrecov_slb)
671	mtspr	SPRN_SRR0,r10
672	mfmsr	r10
673	ori	r10,r10,MSR_IR|MSR_DR|MSR_RI
674	mtspr	SPRN_SRR1,r10
675	rfid
676	b	.
677
678unrecov_slb:
679	EXCEPTION_PROLOG_COMMON(0x4100, PACA_EXSLB)
680	DISABLE_INTS
681	bl	.save_nvgprs
6821:	addi	r3,r1,STACK_FRAME_OVERHEAD
683	bl	.unrecoverable_exception
684	b	1b
685
686	.align	7
687	.globl hardware_interrupt_common
688	.globl hardware_interrupt_entry
689hardware_interrupt_common:
690	EXCEPTION_PROLOG_COMMON(0x500, PACA_EXGEN)
691	FINISH_NAP
692hardware_interrupt_entry:
693	DISABLE_INTS
694BEGIN_FTR_SECTION
695	bl	.ppc64_runlatch_on
696END_FTR_SECTION_IFSET(CPU_FTR_CTRL)
697	addi	r3,r1,STACK_FRAME_OVERHEAD
698	bl	.do_IRQ
699	b	.ret_from_except_lite
700
701#ifdef CONFIG_PPC_970_NAP
702power4_fixup_nap:
703	andc	r9,r9,r10
704	std	r9,TI_LOCAL_FLAGS(r11)
705	ld	r10,_LINK(r1)		/* make idle task do the */
706	std	r10,_NIP(r1)		/* equivalent of a blr */
707	blr
708#endif
709
710	.align	7
711	.globl alignment_common
712alignment_common:
713	mfspr	r10,SPRN_DAR
714	std	r10,PACA_EXGEN+EX_DAR(r13)
715	mfspr	r10,SPRN_DSISR
716	stw	r10,PACA_EXGEN+EX_DSISR(r13)
717	EXCEPTION_PROLOG_COMMON(0x600, PACA_EXGEN)
718	ld	r3,PACA_EXGEN+EX_DAR(r13)
719	lwz	r4,PACA_EXGEN+EX_DSISR(r13)
720	std	r3,_DAR(r1)
721	std	r4,_DSISR(r1)
722	bl	.save_nvgprs
723	addi	r3,r1,STACK_FRAME_OVERHEAD
724	ENABLE_INTS
725	bl	.alignment_exception
726	b	.ret_from_except
727
728	.align	7
729	.globl program_check_common
730program_check_common:
731	EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN)
732	bl	.save_nvgprs
733	addi	r3,r1,STACK_FRAME_OVERHEAD
734	ENABLE_INTS
735	bl	.program_check_exception
736	b	.ret_from_except
737
738	.align	7
739	.globl fp_unavailable_common
740fp_unavailable_common:
741	EXCEPTION_PROLOG_COMMON(0x800, PACA_EXGEN)
742	bne	1f			/* if from user, just load it up */
743	bl	.save_nvgprs
744	addi	r3,r1,STACK_FRAME_OVERHEAD
745	ENABLE_INTS
746	bl	.kernel_fp_unavailable_exception
747	BUG_OPCODE
7481:	bl	.load_up_fpu
749	b	fast_exception_return
750
751	.align	7
752	.globl altivec_unavailable_common
753altivec_unavailable_common:
754	EXCEPTION_PROLOG_COMMON(0xf20, PACA_EXGEN)
755#ifdef CONFIG_ALTIVEC
756BEGIN_FTR_SECTION
757	beq	1f
758	bl	.load_up_altivec
759	b	fast_exception_return
7601:
761END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
762#endif
763	bl	.save_nvgprs
764	addi	r3,r1,STACK_FRAME_OVERHEAD
765	ENABLE_INTS
766	bl	.altivec_unavailable_exception
767	b	.ret_from_except
768
769#ifdef CONFIG_ALTIVEC
770/*
771 * load_up_altivec(unused, unused, tsk)
772 * Disable VMX for the task which had it previously,
773 * and save its vector registers in its thread_struct.
774 * Enables the VMX for use in the kernel on return.
775 * On SMP we know the VMX is free, since we give it up every
776 * switch (ie, no lazy save of the vector registers).
777 * On entry: r13 == 'current' && last_task_used_altivec != 'current'
778 */
779_STATIC(load_up_altivec)
780	mfmsr	r5			/* grab the current MSR */
781	oris	r5,r5,MSR_VEC@h
782	mtmsrd	r5			/* enable use of VMX now */
783	isync
784
785/*
786 * For SMP, we don't do lazy VMX switching because it just gets too
787 * horrendously complex, especially when a task switches from one CPU
788 * to another.  Instead we call giveup_altvec in switch_to.
789 * VRSAVE isn't dealt with here, that is done in the normal context
790 * switch code. Note that we could rely on vrsave value to eventually
791 * avoid saving all of the VREGs here...
792 */
793#ifndef CONFIG_SMP
794	ld	r3,last_task_used_altivec@got(r2)
795	ld	r4,0(r3)
796	cmpdi	0,r4,0
797	beq	1f
798	/* Save VMX state to last_task_used_altivec's THREAD struct */
799	addi	r4,r4,THREAD
800	SAVE_32VRS(0,r5,r4)
801	mfvscr	vr0
802	li	r10,THREAD_VSCR
803	stvx	vr0,r10,r4
804	/* Disable VMX for last_task_used_altivec */
805	ld	r5,PT_REGS(r4)
806	ld	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
807	lis	r6,MSR_VEC@h
808	andc	r4,r4,r6
809	std	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
8101:
811#endif /* CONFIG_SMP */
812	/* Hack: if we get an altivec unavailable trap with VRSAVE
813	 * set to all zeros, we assume this is a broken application
814	 * that fails to set it properly, and thus we switch it to
815	 * all 1's
816	 */
817	mfspr	r4,SPRN_VRSAVE
818	cmpdi	0,r4,0
819	bne+	1f
820	li	r4,-1
821	mtspr	SPRN_VRSAVE,r4
8221:
823	/* enable use of VMX after return */
824	ld	r4,PACACURRENT(r13)
825	addi	r5,r4,THREAD		/* Get THREAD */
826	oris	r12,r12,MSR_VEC@h
827	std	r12,_MSR(r1)
828	li	r4,1
829	li	r10,THREAD_VSCR
830	stw	r4,THREAD_USED_VR(r5)
831	lvx	vr0,r10,r5
832	mtvscr	vr0
833	REST_32VRS(0,r4,r5)
834#ifndef CONFIG_SMP
835	/* Update last_task_used_math to 'current' */
836	subi	r4,r5,THREAD		/* Back to 'current' */
837	std	r4,0(r3)
838#endif /* CONFIG_SMP */
839	/* restore registers and return */
840	blr
841#endif /* CONFIG_ALTIVEC */
842
843	.align	7
844	.globl vsx_unavailable_common
845vsx_unavailable_common:
846	EXCEPTION_PROLOG_COMMON(0xf40, PACA_EXGEN)
847#ifdef CONFIG_VSX
848BEGIN_FTR_SECTION
849	bne	.load_up_vsx
8501:
851END_FTR_SECTION_IFSET(CPU_FTR_VSX)
852#endif
853	bl	.save_nvgprs
854	addi	r3,r1,STACK_FRAME_OVERHEAD
855	ENABLE_INTS
856	bl	.vsx_unavailable_exception
857	b	.ret_from_except
858
859#ifdef CONFIG_VSX
860/*
861 * load_up_vsx(unused, unused, tsk)
862 * Disable VSX for the task which had it previously,
863 * and save its vector registers in its thread_struct.
864 * Reuse the fp and vsx saves, but first check to see if they have
865 * been saved already.
866 * On entry: r13 == 'current' && last_task_used_vsx != 'current'
867 */
868_STATIC(load_up_vsx)
869/* Load FP and VSX registers if they haven't been done yet */
870	andi.	r5,r12,MSR_FP
871	beql+	load_up_fpu		/* skip if already loaded */
872	andis.	r5,r12,MSR_VEC@h
873	beql+	load_up_altivec		/* skip if already loaded */
874
875#ifndef CONFIG_SMP
876	ld	r3,last_task_used_vsx@got(r2)
877	ld	r4,0(r3)
878	cmpdi	0,r4,0
879	beq	1f
880	/* Disable VSX for last_task_used_vsx */
881	addi	r4,r4,THREAD
882	ld	r5,PT_REGS(r4)
883	ld	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
884	lis	r6,MSR_VSX@h
885	andc	r6,r4,r6
886	std	r6,_MSR-STACK_FRAME_OVERHEAD(r5)
8871:
888#endif /* CONFIG_SMP */
889	ld	r4,PACACURRENT(r13)
890	addi	r4,r4,THREAD		/* Get THREAD */
891	li	r6,1
892	stw	r6,THREAD_USED_VSR(r4) /* ... also set thread used vsr */
893	/* enable use of VSX after return */
894	oris	r12,r12,MSR_VSX@h
895	std	r12,_MSR(r1)
896#ifndef CONFIG_SMP
897	/* Update last_task_used_math to 'current' */
898	ld	r4,PACACURRENT(r13)
899	std	r4,0(r3)
900#endif /* CONFIG_SMP */
901	b	fast_exception_return
902#endif /* CONFIG_VSX */
903
904/*
905 * Hash table stuff
906 */
907	.align	7
908_STATIC(do_hash_page)
909	std	r3,_DAR(r1)
910	std	r4,_DSISR(r1)
911
912	andis.	r0,r4,0xa450		/* weird error? */
913	bne-	handle_page_fault	/* if not, try to insert a HPTE */
914BEGIN_FTR_SECTION
915	andis.	r0,r4,0x0020		/* Is it a segment table fault? */
916	bne-	do_ste_alloc		/* If so handle it */
917END_FTR_SECTION_IFCLR(CPU_FTR_SLB)
918
919	/*
920	 * On iSeries, we soft-disable interrupts here, then
921	 * hard-enable interrupts so that the hash_page code can spin on
922	 * the hash_table_lock without problems on a shared processor.
923	 */
924	DISABLE_INTS
925
926	/*
927	 * Currently, trace_hardirqs_off() will be called by DISABLE_INTS
928	 * and will clobber volatile registers when irq tracing is enabled
929	 * so we need to reload them. It may be possible to be smarter here
930	 * and move the irq tracing elsewhere but let's keep it simple for
931	 * now
932	 */
933#ifdef CONFIG_TRACE_IRQFLAGS
934	ld	r3,_DAR(r1)
935	ld	r4,_DSISR(r1)
936	ld	r5,_TRAP(r1)
937	ld	r12,_MSR(r1)
938	clrrdi	r5,r5,4
939#endif /* CONFIG_TRACE_IRQFLAGS */
940	/*
941	 * We need to set the _PAGE_USER bit if MSR_PR is set or if we are
942	 * accessing a userspace segment (even from the kernel). We assume
943	 * kernel addresses always have the high bit set.
944	 */
945	rlwinm	r4,r4,32-25+9,31-9,31-9	/* DSISR_STORE -> _PAGE_RW */
946	rotldi	r0,r3,15		/* Move high bit into MSR_PR posn */
947	orc	r0,r12,r0		/* MSR_PR | ~high_bit */
948	rlwimi	r4,r0,32-13,30,30	/* becomes _PAGE_USER access bit */
949	ori	r4,r4,1			/* add _PAGE_PRESENT */
950	rlwimi	r4,r5,22+2,31-2,31-2	/* Set _PAGE_EXEC if trap is 0x400 */
951
952	/*
953	 * r3 contains the faulting address
954	 * r4 contains the required access permissions
955	 * r5 contains the trap number
956	 *
957	 * at return r3 = 0 for success
958	 */
959	bl	.hash_page		/* build HPTE if possible */
960	cmpdi	r3,0			/* see if hash_page succeeded */
961
962BEGIN_FW_FTR_SECTION
963	/*
964	 * If we had interrupts soft-enabled at the point where the
965	 * DSI/ISI occurred, and an interrupt came in during hash_page,
966	 * handle it now.
967	 * We jump to ret_from_except_lite rather than fast_exception_return
968	 * because ret_from_except_lite will check for and handle pending
969	 * interrupts if necessary.
970	 */
971	beq	13f
972END_FW_FTR_SECTION_IFSET(FW_FEATURE_ISERIES)
973
974BEGIN_FW_FTR_SECTION
975	/*
976	 * Here we have interrupts hard-disabled, so it is sufficient
977	 * to restore paca->{soft,hard}_enable and get out.
978	 */
979	beq	fast_exc_return_irq	/* Return from exception on success */
980END_FW_FTR_SECTION_IFCLR(FW_FEATURE_ISERIES)
981
982	/* For a hash failure, we don't bother re-enabling interrupts */
983	ble-	12f
984
985	/*
986	 * hash_page couldn't handle it, set soft interrupt enable back
987	 * to what it was before the trap.  Note that .raw_local_irq_restore
988	 * handles any interrupts pending at this point.
989	 */
990	ld	r3,SOFTE(r1)
991	TRACE_AND_RESTORE_IRQ_PARTIAL(r3, 11f)
992	bl	.raw_local_irq_restore
993	b	11f
994
995/* Here we have a page fault that hash_page can't handle. */
996handle_page_fault:
997	ENABLE_INTS
99811:	ld	r4,_DAR(r1)
999	ld	r5,_DSISR(r1)
1000	addi	r3,r1,STACK_FRAME_OVERHEAD
1001	bl	.do_page_fault
1002	cmpdi	r3,0
1003	beq+	13f
1004	bl	.save_nvgprs
1005	mr	r5,r3
1006	addi	r3,r1,STACK_FRAME_OVERHEAD
1007	lwz	r4,_DAR(r1)
1008	bl	.bad_page_fault
1009	b	.ret_from_except
1010
101113:	b	.ret_from_except_lite
1012
1013/* We have a page fault that hash_page could handle but HV refused
1014 * the PTE insertion
1015 */
101612:	bl	.save_nvgprs
1017	mr	r5,r3
1018	addi	r3,r1,STACK_FRAME_OVERHEAD
1019	ld	r4,_DAR(r1)
1020	bl	.low_hash_fault
1021	b	.ret_from_except
1022
1023	/* here we have a segment miss */
1024do_ste_alloc:
1025	bl	.ste_allocate		/* try to insert stab entry */
1026	cmpdi	r3,0
1027	bne-	handle_page_fault
1028	b	fast_exception_return
1029
1030/*
1031 * r13 points to the PACA, r9 contains the saved CR,
1032 * r11 and r12 contain the saved SRR0 and SRR1.
1033 * r9 - r13 are saved in paca->exslb.
1034 * We assume we aren't going to take any exceptions during this procedure.
1035 * We assume (DAR >> 60) == 0xc.
1036 */
1037	.align	7
1038_GLOBAL(do_stab_bolted)
1039	stw	r9,PACA_EXSLB+EX_CCR(r13)	/* save CR in exc. frame */
1040	std	r11,PACA_EXSLB+EX_SRR0(r13)	/* save SRR0 in exc. frame */
1041
1042	/* Hash to the primary group */
1043	ld	r10,PACASTABVIRT(r13)
1044	mfspr	r11,SPRN_DAR
1045	srdi	r11,r11,28
1046	rldimi	r10,r11,7,52	/* r10 = first ste of the group */
1047
1048	/* Calculate VSID */
1049	/* This is a kernel address, so protovsid = ESID */
1050	ASM_VSID_SCRAMBLE(r11, r9, 256M)
1051	rldic	r9,r11,12,16	/* r9 = vsid << 12 */
1052
1053	/* Search the primary group for a free entry */
10541:	ld	r11,0(r10)	/* Test valid bit of the current ste	*/
1055	andi.	r11,r11,0x80
1056	beq	2f
1057	addi	r10,r10,16
1058	andi.	r11,r10,0x70
1059	bne	1b
1060
1061	/* Stick for only searching the primary group for now.		*/
1062	/* At least for now, we use a very simple random castout scheme */
1063	/* Use the TB as a random number ;  OR in 1 to avoid entry 0	*/
1064	mftb	r11
1065	rldic	r11,r11,4,57	/* r11 = (r11 << 4) & 0x70 */
1066	ori	r11,r11,0x10
1067
1068	/* r10 currently points to an ste one past the group of interest */
1069	/* make it point to the randomly selected entry			*/
1070	subi	r10,r10,128
1071	or 	r10,r10,r11	/* r10 is the entry to invalidate	*/
1072
1073	isync			/* mark the entry invalid		*/
1074	ld	r11,0(r10)
1075	rldicl	r11,r11,56,1	/* clear the valid bit */
1076	rotldi	r11,r11,8
1077	std	r11,0(r10)
1078	sync
1079
1080	clrrdi	r11,r11,28	/* Get the esid part of the ste		*/
1081	slbie	r11
1082
10832:	std	r9,8(r10)	/* Store the vsid part of the ste	*/
1084	eieio
1085
1086	mfspr	r11,SPRN_DAR		/* Get the new esid			*/
1087	clrrdi	r11,r11,28	/* Permits a full 32b of ESID		*/
1088	ori	r11,r11,0x90	/* Turn on valid and kp			*/
1089	std	r11,0(r10)	/* Put new entry back into the stab	*/
1090
1091	sync
1092
1093	/* All done -- return from exception. */
1094	lwz	r9,PACA_EXSLB+EX_CCR(r13)	/* get saved CR */
1095	ld	r11,PACA_EXSLB+EX_SRR0(r13)	/* get saved SRR0 */
1096
1097	andi.	r10,r12,MSR_RI
1098	beq-	unrecov_slb
1099
1100	mtcrf	0x80,r9			/* restore CR */
1101
1102	mfmsr	r10
1103	clrrdi	r10,r10,2
1104	mtmsrd	r10,1
1105
1106	mtspr	SPRN_SRR0,r11
1107	mtspr	SPRN_SRR1,r12
1108	ld	r9,PACA_EXSLB+EX_R9(r13)
1109	ld	r10,PACA_EXSLB+EX_R10(r13)
1110	ld	r11,PACA_EXSLB+EX_R11(r13)
1111	ld	r12,PACA_EXSLB+EX_R12(r13)
1112	ld	r13,PACA_EXSLB+EX_R13(r13)
1113	rfid
1114	b	.	/* prevent speculative execution */
1115
1116/*
1117 * Space for CPU0's segment table.
1118 *
1119 * On iSeries, the hypervisor must fill in at least one entry before
1120 * we get control (with relocate on).  The address is given to the hv
1121 * as a page number (see xLparMap below), so this must be at a
1122 * fixed address (the linker can't compute (u64)&initial_stab >>
1123 * PAGE_SHIFT).
1124 */
1125	. = STAB0_OFFSET	/* 0x6000 */
1126	.globl initial_stab
1127initial_stab:
1128	.space	4096
1129
1130#ifdef CONFIG_PPC_PSERIES
1131/*
1132 * Data area reserved for FWNMI option.
1133 * This address (0x7000) is fixed by the RPA.
1134 */
1135	.= 0x7000
1136	.globl fwnmi_data_area
1137fwnmi_data_area:
1138#endif /* CONFIG_PPC_PSERIES */
1139
1140	/* iSeries does not use the FWNMI stuff, so it is safe to put
1141	 * this here, even if we later allow kernels that will boot on
1142	 * both pSeries and iSeries */
1143#ifdef CONFIG_PPC_ISERIES
1144        . = LPARMAP_PHYS
1145	.globl xLparMap
1146xLparMap:
1147	.quad	HvEsidsToMap		/* xNumberEsids */
1148	.quad	HvRangesToMap		/* xNumberRanges */
1149	.quad	STAB0_PAGE		/* xSegmentTableOffs */
1150	.zero	40			/* xRsvd */
1151	/* xEsids (HvEsidsToMap entries of 2 quads) */
1152	.quad	PAGE_OFFSET_ESID	/* xKernelEsid */
1153	.quad	PAGE_OFFSET_VSID	/* xKernelVsid */
1154	.quad	VMALLOC_START_ESID	/* xKernelEsid */
1155	.quad	VMALLOC_START_VSID	/* xKernelVsid */
1156	/* xRanges (HvRangesToMap entries of 3 quads) */
1157	.quad	HvPagesToMap		/* xPages */
1158	.quad	0			/* xOffset */
1159	.quad	PAGE_OFFSET_VSID << (SID_SHIFT - HW_PAGE_SHIFT)	/* xVPN */
1160
1161#endif /* CONFIG_PPC_ISERIES */
1162
1163#ifdef CONFIG_PPC_PSERIES
1164        . = 0x8000
1165#endif /* CONFIG_PPC_PSERIES */
1166
1167/*
1168 * On pSeries and most other platforms, secondary processors spin
1169 * in the following code.
1170 * At entry, r3 = this processor's number (physical cpu id)
1171 */
1172_GLOBAL(generic_secondary_smp_init)
1173	mr	r24,r3
1174
1175	/* turn on 64-bit mode */
1176	bl	.enable_64b_mode
1177
1178	/* Set up a paca value for this processor. Since we have the
1179	 * physical cpu id in r24, we need to search the pacas to find
1180	 * which logical id maps to our physical one.
1181	 */
1182	LOAD_REG_IMMEDIATE(r13, paca)	/* Get base vaddr of paca array	 */
1183	li	r5,0			/* logical cpu id                */
11841:	lhz	r6,PACAHWCPUID(r13)	/* Load HW procid from paca      */
1185	cmpw	r6,r24			/* Compare to our id             */
1186	beq	2f
1187	addi	r13,r13,PACA_SIZE	/* Loop to next PACA on miss     */
1188	addi	r5,r5,1
1189	cmpwi	r5,NR_CPUS
1190	blt	1b
1191
1192	mr	r3,r24			/* not found, copy phys to r3	 */
1193	b	.kexec_wait		/* next kernel might do better	 */
1194
11952:	mtspr	SPRN_SPRG3,r13		/* Save vaddr of paca in SPRG3	 */
1196	/* From now on, r24 is expected to be logical cpuid */
1197	mr	r24,r5
11983:	HMT_LOW
1199	lbz	r23,PACAPROCSTART(r13)	/* Test if this processor should */
1200					/* start.			 */
1201
1202#ifndef CONFIG_SMP
1203	b	3b			/* Never go on non-SMP		 */
1204#else
1205	cmpwi	0,r23,0
1206	beq	3b			/* Loop until told to go	 */
1207
1208	sync				/* order paca.run and cur_cpu_spec */
1209
1210	/* See if we need to call a cpu state restore handler */
1211	LOAD_REG_IMMEDIATE(r23, cur_cpu_spec)
1212	ld	r23,0(r23)
1213	ld	r23,CPU_SPEC_RESTORE(r23)
1214	cmpdi	0,r23,0
1215	beq	4f
1216	ld	r23,0(r23)
1217	mtctr	r23
1218	bctrl
1219
12204:	/* Create a temp kernel stack for use before relocation is on.	*/
1221	ld	r1,PACAEMERGSP(r13)
1222	subi	r1,r1,STACK_FRAME_OVERHEAD
1223
1224	b	__secondary_start
1225#endif
1226
1227_STATIC(__mmu_off)
1228	mfmsr	r3
1229	andi.	r0,r3,MSR_IR|MSR_DR
1230	beqlr
1231	andc	r3,r3,r0
1232	mtspr	SPRN_SRR0,r4
1233	mtspr	SPRN_SRR1,r3
1234	sync
1235	rfid
1236	b	.	/* prevent speculative execution */
1237
1238
1239/*
1240 * Here is our main kernel entry point. We support currently 2 kind of entries
1241 * depending on the value of r5.
1242 *
1243 *   r5 != NULL -> OF entry, we go to prom_init, "legacy" parameter content
1244 *                 in r3...r7
1245 *
1246 *   r5 == NULL -> kexec style entry. r3 is a physical pointer to the
1247 *                 DT block, r4 is a physical pointer to the kernel itself
1248 *
1249 */
1250_GLOBAL(__start_initialization_multiplatform)
1251	/*
1252	 * Are we booted from a PROM Of-type client-interface ?
1253	 */
1254	cmpldi	cr0,r5,0
1255	beq	1f
1256	b	.__boot_from_prom		/* yes -> prom */
12571:
1258	/* Save parameters */
1259	mr	r31,r3
1260	mr	r30,r4
1261
1262	/* Make sure we are running in 64 bits mode */
1263	bl	.enable_64b_mode
1264
1265	/* Setup some critical 970 SPRs before switching MMU off */
1266	mfspr	r0,SPRN_PVR
1267	srwi	r0,r0,16
1268	cmpwi	r0,0x39		/* 970 */
1269	beq	1f
1270	cmpwi	r0,0x3c		/* 970FX */
1271	beq	1f
1272	cmpwi	r0,0x44		/* 970MP */
1273	beq	1f
1274	cmpwi	r0,0x45		/* 970GX */
1275	bne	2f
12761:	bl	.__cpu_preinit_ppc970
12772:
1278
1279	/* Switch off MMU if not already */
1280	LOAD_REG_IMMEDIATE(r4, .__after_prom_start - KERNELBASE)
1281	add	r4,r4,r30
1282	bl	.__mmu_off
1283	b	.__after_prom_start
1284
1285_INIT_STATIC(__boot_from_prom)
1286	/* Save parameters */
1287	mr	r31,r3
1288	mr	r30,r4
1289	mr	r29,r5
1290	mr	r28,r6
1291	mr	r27,r7
1292
1293	/*
1294	 * Align the stack to 16-byte boundary
1295	 * Depending on the size and layout of the ELF sections in the initial
1296	 * boot binary, the stack pointer will be unalignet on PowerMac
1297	 */
1298	rldicr	r1,r1,0,59
1299
1300	/* Make sure we are running in 64 bits mode */
1301	bl	.enable_64b_mode
1302
1303	/* put a relocation offset into r3 */
1304	bl	.reloc_offset
1305
1306	LOAD_REG_IMMEDIATE(r2,__toc_start)
1307	addi	r2,r2,0x4000
1308	addi	r2,r2,0x4000
1309
1310	/* Relocate the TOC from a virt addr to a real addr */
1311	add	r2,r2,r3
1312
1313	/* Restore parameters */
1314	mr	r3,r31
1315	mr	r4,r30
1316	mr	r5,r29
1317	mr	r6,r28
1318	mr	r7,r27
1319
1320	/* Do all of the interaction with OF client interface */
1321	bl	.prom_init
1322	/* We never return */
1323	trap
1324
1325_STATIC(__after_prom_start)
1326
1327/*
1328 * We need to run with __start at physical address PHYSICAL_START.
1329 * This will leave some code in the first 256B of
1330 * real memory, which are reserved for software use.
1331 * The remainder of the first page is loaded with the fixed
1332 * interrupt vectors.  The next two pages are filled with
1333 * unknown exception placeholders.
1334 *
1335 * Note: This process overwrites the OF exception vectors.
1336 *	r26 == relocation offset
1337 *	r27 == KERNELBASE
1338 */
1339	bl	.reloc_offset
1340	mr	r26,r3
1341	LOAD_REG_IMMEDIATE(r27, KERNELBASE)
1342
1343	LOAD_REG_IMMEDIATE(r3, PHYSICAL_START)	/* target addr */
1344
1345	// XXX FIXME: Use phys returned by OF (r30)
1346	add	r4,r27,r26 		/* source addr			 */
1347					/* current address of _start	 */
1348					/*   i.e. where we are running	 */
1349					/*	the source addr		 */
1350
1351	cmpdi	r4,0			/* In some cases the loader may  */
1352	bne	1f
1353	b	.start_here_multiplatform /* have already put us at zero */
1354					/* so we can skip the copy.      */
13551:	LOAD_REG_IMMEDIATE(r5,copy_to_here) /* # bytes of memory to copy */
1356	sub	r5,r5,r27
1357
1358	li	r6,0x100		/* Start offset, the first 0x100 */
1359					/* bytes were copied earlier.	 */
1360
1361	bl	.copy_and_flush		/* copy the first n bytes	 */
1362					/* this includes the code being	 */
1363					/* executed here.		 */
1364
1365	LOAD_REG_IMMEDIATE(r0, 4f)	/* Jump to the copy of this code */
1366	mtctr	r0			/* that we just made/relocated	 */
1367	bctr
1368
13694:	LOAD_REG_IMMEDIATE(r5,klimit)
1370	add	r5,r5,r26
1371	ld	r5,0(r5)		/* get the value of klimit */
1372	sub	r5,r5,r27
1373	bl	.copy_and_flush		/* copy the rest */
1374	b	.start_here_multiplatform
1375
1376/*
1377 * Copy routine used to copy the kernel to start at physical address 0
1378 * and flush and invalidate the caches as needed.
1379 * r3 = dest addr, r4 = source addr, r5 = copy limit, r6 = start offset
1380 * on exit, r3, r4, r5 are unchanged, r6 is updated to be >= r5.
1381 *
1382 * Note: this routine *only* clobbers r0, r6 and lr
1383 */
1384_GLOBAL(copy_and_flush)
1385	addi	r5,r5,-8
1386	addi	r6,r6,-8
13874:	li	r0,8			/* Use the smallest common	*/
1388					/* denominator cache line	*/
1389					/* size.  This results in	*/
1390					/* extra cache line flushes	*/
1391					/* but operation is correct.	*/
1392					/* Can't get cache line size	*/
1393					/* from NACA as it is being	*/
1394					/* moved too.			*/
1395
1396	mtctr	r0			/* put # words/line in ctr	*/
13973:	addi	r6,r6,8			/* copy a cache line		*/
1398	ldx	r0,r6,r4
1399	stdx	r0,r6,r3
1400	bdnz	3b
1401	dcbst	r6,r3			/* write it to memory		*/
1402	sync
1403	icbi	r6,r3			/* flush the icache line	*/
1404	cmpld	0,r6,r5
1405	blt	4b
1406	sync
1407	addi	r5,r5,8
1408	addi	r6,r6,8
1409	blr
1410
1411.align 8
1412copy_to_here:
1413
1414#ifdef CONFIG_SMP
1415#ifdef CONFIG_PPC_PMAC
1416/*
1417 * On PowerMac, secondary processors starts from the reset vector, which
1418 * is temporarily turned into a call to one of the functions below.
1419 */
1420	.section ".text";
1421	.align 2 ;
1422
1423	.globl	__secondary_start_pmac_0
1424__secondary_start_pmac_0:
1425	/* NB the entries for cpus 0, 1, 2 must each occupy 8 bytes. */
1426	li	r24,0
1427	b	1f
1428	li	r24,1
1429	b	1f
1430	li	r24,2
1431	b	1f
1432	li	r24,3
14331:
1434
1435_GLOBAL(pmac_secondary_start)
1436	/* turn on 64-bit mode */
1437	bl	.enable_64b_mode
1438
1439	/* Copy some CPU settings from CPU 0 */
1440	bl	.__restore_cpu_ppc970
1441
1442	/* pSeries do that early though I don't think we really need it */
1443	mfmsr	r3
1444	ori	r3,r3,MSR_RI
1445	mtmsrd	r3			/* RI on */
1446
1447	/* Set up a paca value for this processor. */
1448	LOAD_REG_IMMEDIATE(r4, paca)	/* Get base vaddr of paca array	*/
1449	mulli	r13,r24,PACA_SIZE	 /* Calculate vaddr of right paca */
1450	add	r13,r13,r4		/* for this processor.		*/
1451	mtspr	SPRN_SPRG3,r13		 /* Save vaddr of paca in SPRG3	*/
1452
1453	/* Create a temp kernel stack for use before relocation is on.	*/
1454	ld	r1,PACAEMERGSP(r13)
1455	subi	r1,r1,STACK_FRAME_OVERHEAD
1456
1457	b	__secondary_start
1458
1459#endif /* CONFIG_PPC_PMAC */
1460
1461/*
1462 * This function is called after the master CPU has released the
1463 * secondary processors.  The execution environment is relocation off.
1464 * The paca for this processor has the following fields initialized at
1465 * this point:
1466 *   1. Processor number
1467 *   2. Segment table pointer (virtual address)
1468 * On entry the following are set:
1469 *   r1	= stack pointer.  vaddr for iSeries, raddr (temp stack) for pSeries
1470 *   r24   = cpu# (in Linux terms)
1471 *   r13   = paca virtual address
1472 *   SPRG3 = paca virtual address
1473 */
1474	.globl	__secondary_start
1475__secondary_start:
1476	/* Set thread priority to MEDIUM */
1477	HMT_MEDIUM
1478
1479	/* Load TOC */
1480	ld	r2,PACATOC(r13)
1481
1482	/* Do early setup for that CPU (stab, slb, hash table pointer) */
1483	bl	.early_setup_secondary
1484
1485	/* Initialize the kernel stack.  Just a repeat for iSeries.	 */
1486	LOAD_REG_ADDR(r3, current_set)
1487	sldi	r28,r24,3		/* get current_set[cpu#]	 */
1488	ldx	r1,r3,r28
1489	addi	r1,r1,THREAD_SIZE-STACK_FRAME_OVERHEAD
1490	std	r1,PACAKSAVE(r13)
1491
1492	/* Clear backchain so we get nice backtraces */
1493	li	r7,0
1494	mtlr	r7
1495
1496	/* enable MMU and jump to start_secondary */
1497	LOAD_REG_ADDR(r3, .start_secondary_prolog)
1498	LOAD_REG_IMMEDIATE(r4, MSR_KERNEL)
1499#ifdef CONFIG_PPC_ISERIES
1500BEGIN_FW_FTR_SECTION
1501	ori	r4,r4,MSR_EE
1502	li	r8,1
1503	stb	r8,PACAHARDIRQEN(r13)
1504END_FW_FTR_SECTION_IFSET(FW_FEATURE_ISERIES)
1505#endif
1506BEGIN_FW_FTR_SECTION
1507	stb	r7,PACAHARDIRQEN(r13)
1508END_FW_FTR_SECTION_IFCLR(FW_FEATURE_ISERIES)
1509	stb	r7,PACASOFTIRQEN(r13)
1510
1511	mtspr	SPRN_SRR0,r3
1512	mtspr	SPRN_SRR1,r4
1513	rfid
1514	b	.	/* prevent speculative execution */
1515
1516/*
1517 * Running with relocation on at this point.  All we want to do is
1518 * zero the stack back-chain pointer before going into C code.
1519 */
1520_GLOBAL(start_secondary_prolog)
1521	li	r3,0
1522	std	r3,0(r1)		/* Zero the stack frame pointer	*/
1523	bl	.start_secondary
1524	b	.
1525#endif
1526
1527/*
1528 * This subroutine clobbers r11 and r12
1529 */
1530_GLOBAL(enable_64b_mode)
1531	mfmsr	r11			/* grab the current MSR */
1532	li	r12,1
1533	rldicr	r12,r12,MSR_SF_LG,(63-MSR_SF_LG)
1534	or	r11,r11,r12
1535	li	r12,1
1536	rldicr	r12,r12,MSR_ISF_LG,(63-MSR_ISF_LG)
1537	or	r11,r11,r12
1538	mtmsrd	r11
1539	isync
1540	blr
1541
1542/*
1543 * This is where the main kernel code starts.
1544 */
1545_INIT_STATIC(start_here_multiplatform)
1546	/* get a new offset, now that the kernel has moved. */
1547	bl	.reloc_offset
1548	mr	r26,r3
1549
1550	/* Clear out the BSS. It may have been done in prom_init,
1551	 * already but that's irrelevant since prom_init will soon
1552	 * be detached from the kernel completely. Besides, we need
1553	 * to clear it now for kexec-style entry.
1554	 */
1555	LOAD_REG_IMMEDIATE(r11,__bss_stop)
1556	LOAD_REG_IMMEDIATE(r8,__bss_start)
1557	sub	r11,r11,r8		/* bss size			*/
1558	addi	r11,r11,7		/* round up to an even double word */
1559	rldicl. r11,r11,61,3		/* shift right by 3		*/
1560	beq	4f
1561	addi	r8,r8,-8
1562	li	r0,0
1563	mtctr	r11			/* zero this many doublewords	*/
15643:	stdu	r0,8(r8)
1565	bdnz	3b
15664:
1567
1568	mfmsr	r6
1569	ori	r6,r6,MSR_RI
1570	mtmsrd	r6			/* RI on */
1571
1572	/* The following gets the stack and TOC set up with the regs */
1573	/* pointing to the real addr of the kernel stack.  This is   */
1574	/* all done to support the C function call below which sets  */
1575	/* up the htab.  This is done because we have relocated the  */
1576	/* kernel but are still running in real mode. */
1577
1578	LOAD_REG_IMMEDIATE(r3,init_thread_union)
1579	add	r3,r3,r26
1580
1581	/* set up a stack pointer (physical address) */
1582	addi	r1,r3,THREAD_SIZE
1583	li	r0,0
1584	stdu	r0,-STACK_FRAME_OVERHEAD(r1)
1585
1586	/* set up the TOC (physical address) */
1587	LOAD_REG_IMMEDIATE(r2,__toc_start)
1588	addi	r2,r2,0x4000
1589	addi	r2,r2,0x4000
1590	add	r2,r2,r26
1591
1592	/* Do very early kernel initializations, including initial hash table,
1593	 * stab and slb setup before we turn on relocation.	*/
1594
1595	/* Restore parameters passed from prom_init/kexec */
1596	mr	r3,r31
1597 	bl	.early_setup
1598
1599	LOAD_REG_IMMEDIATE(r3, .start_here_common)
1600	LOAD_REG_IMMEDIATE(r4, MSR_KERNEL)
1601	mtspr	SPRN_SRR0,r3
1602	mtspr	SPRN_SRR1,r4
1603	rfid
1604	b	.	/* prevent speculative execution */
1605
1606	/* This is where all platforms converge execution */
1607_INIT_GLOBAL(start_here_common)
1608	/* relocation is on at this point */
1609
1610	/* The following code sets up the SP and TOC now that we are */
1611	/* running with translation enabled. */
1612
1613	LOAD_REG_IMMEDIATE(r3,init_thread_union)
1614
1615	/* set up the stack */
1616	addi	r1,r3,THREAD_SIZE
1617	li	r0,0
1618	stdu	r0,-STACK_FRAME_OVERHEAD(r1)
1619
1620	/* Load the TOC */
1621	ld	r2,PACATOC(r13)
1622	std	r1,PACAKSAVE(r13)
1623
1624	bl	.setup_system
1625
1626	/* Load up the kernel context */
16275:
1628	li	r5,0
1629	stb	r5,PACASOFTIRQEN(r13)	/* Soft Disabled */
1630#ifdef CONFIG_PPC_ISERIES
1631BEGIN_FW_FTR_SECTION
1632	mfmsr	r5
1633	ori	r5,r5,MSR_EE		/* Hard Enabled on iSeries*/
1634	mtmsrd	r5
1635	li	r5,1
1636END_FW_FTR_SECTION_IFSET(FW_FEATURE_ISERIES)
1637#endif
1638	stb	r5,PACAHARDIRQEN(r13)	/* Hard Disabled on others */
1639
1640	bl	.start_kernel
1641
1642	/* Not reached */
1643	BUG_OPCODE
1644
1645/*
1646 * We put a few things here that have to be page-aligned.
1647 * This stuff goes at the beginning of the bss, which is page-aligned.
1648 */
1649	.section ".bss"
1650
1651	.align	PAGE_SHIFT
1652
1653	.globl	empty_zero_page
1654empty_zero_page:
1655	.space	PAGE_SIZE
1656
1657	.globl	swapper_pg_dir
1658swapper_pg_dir:
1659	.space	PGD_TABLE_SIZE
1660