xref: /openbmc/linux/arch/powerpc/kernel/head_8xx.S (revision 78c99ba1) 
1/*
2 *  PowerPC version
3 *    Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
4 *  Rewritten by Cort Dougan (cort@cs.nmt.edu) for PReP
5 *    Copyright (C) 1996 Cort Dougan <cort@cs.nmt.edu>
6 *  Low-level exception handlers and MMU support
7 *  rewritten by Paul Mackerras.
8 *    Copyright (C) 1996 Paul Mackerras.
9 *  MPC8xx modifications by Dan Malek
10 *    Copyright (C) 1997 Dan Malek (dmalek@jlc.net).
11 *
12 *  This file contains low-level support and setup for PowerPC 8xx
13 *  embedded processors, including trap and interrupt dispatch.
14 *
15 *  This program is free software; you can redistribute it and/or
16 *  modify it under the terms of the GNU General Public License
17 *  as published by the Free Software Foundation; either version
18 *  2 of the License, or (at your option) any later version.
19 *
20 */
21
22#include <linux/init.h>
23#include <asm/processor.h>
24#include <asm/page.h>
25#include <asm/mmu.h>
26#include <asm/cache.h>
27#include <asm/pgtable.h>
28#include <asm/cputable.h>
29#include <asm/thread_info.h>
30#include <asm/ppc_asm.h>
31#include <asm/asm-offsets.h>
32
33/* Macro to make the code more readable. */
34#ifdef CONFIG_8xx_CPU6
35#define DO_8xx_CPU6(val, reg)	\
36	li	reg, val;	\
37	stw	reg, 12(r0);	\
38	lwz	reg, 12(r0);
39#else
40#define DO_8xx_CPU6(val, reg)
41#endif
42	__HEAD
43_ENTRY(_stext);
44_ENTRY(_start);
45
46/* MPC8xx
47 * This port was done on an MBX board with an 860.  Right now I only
48 * support an ELF compressed (zImage) boot from EPPC-Bug because the
49 * code there loads up some registers before calling us:
50 *   r3: ptr to board info data
51 *   r4: initrd_start or if no initrd then 0
52 *   r5: initrd_end - unused if r4 is 0
53 *   r6: Start of command line string
54 *   r7: End of command line string
55 *
56 * I decided to use conditional compilation instead of checking PVR and
57 * adding more processor specific branches around code I don't need.
58 * Since this is an embedded processor, I also appreciate any memory
59 * savings I can get.
60 *
61 * The MPC8xx does not have any BATs, but it supports large page sizes.
62 * We first initialize the MMU to support 8M byte pages, then load one
63 * entry into each of the instruction and data TLBs to map the first
64 * 8M 1:1.  I also mapped an additional I/O space 1:1 so we can get to
65 * the "internal" processor registers before MMU_init is called.
66 *
67 * The TLB code currently contains a major hack.  Since I use the condition
68 * code register, I have to save and restore it.  I am out of registers, so
69 * I just store it in memory location 0 (the TLB handlers are not reentrant).
70 * To avoid making any decisions, I need to use the "segment" valid bit
71 * in the first level table, but that would require many changes to the
72 * Linux page directory/table functions that I don't want to do right now.
73 *
74 * I used to use SPRG2 for a temporary register in the TLB handler, but it
75 * has since been put to other uses.  I now use a hack to save a register
76 * and the CCR at memory location 0.....Someday I'll fix this.....
77 *	-- Dan
78 */
79	.globl	__start
80__start:
81	mr	r31,r3			/* save parameters */
82	mr	r30,r4
83	mr	r29,r5
84	mr	r28,r6
85	mr	r27,r7
86
87	/* We have to turn on the MMU right away so we get cache modes
88	 * set correctly.
89	 */
90	bl	initial_mmu
91
92/* We now have the lower 8 Meg mapped into TLB entries, and the caches
93 * ready to work.
94 */
95
96turn_on_mmu:
97	mfmsr	r0
98	ori	r0,r0,MSR_DR|MSR_IR
99	mtspr	SPRN_SRR1,r0
100	lis	r0,start_here@h
101	ori	r0,r0,start_here@l
102	mtspr	SPRN_SRR0,r0
103	SYNC
104	rfi				/* enables MMU */
105
106/*
107 * Exception entry code.  This code runs with address translation
108 * turned off, i.e. using physical addresses.
109 * We assume sprg3 has the physical address of the current
110 * task's thread_struct.
111 */
112#define EXCEPTION_PROLOG	\
113	mtspr	SPRN_SPRG0,r10;	\
114	mtspr	SPRN_SPRG1,r11;	\
115	mfcr	r10;		\
116	EXCEPTION_PROLOG_1;	\
117	EXCEPTION_PROLOG_2
118
119#define EXCEPTION_PROLOG_1	\
120	mfspr	r11,SPRN_SRR1;		/* check whether user or kernel */ \
121	andi.	r11,r11,MSR_PR;	\
122	tophys(r11,r1);			/* use tophys(r1) if kernel */ \
123	beq	1f;		\
124	mfspr	r11,SPRN_SPRG3;	\
125	lwz	r11,THREAD_INFO-THREAD(r11);	\
126	addi	r11,r11,THREAD_SIZE;	\
127	tophys(r11,r11);	\
1281:	subi	r11,r11,INT_FRAME_SIZE	/* alloc exc. frame */
129
130
131#define EXCEPTION_PROLOG_2	\
132	CLR_TOP32(r11);		\
133	stw	r10,_CCR(r11);		/* save registers */ \
134	stw	r12,GPR12(r11);	\
135	stw	r9,GPR9(r11);	\
136	mfspr	r10,SPRN_SPRG0;	\
137	stw	r10,GPR10(r11);	\
138	mfspr	r12,SPRN_SPRG1;	\
139	stw	r12,GPR11(r11);	\
140	mflr	r10;		\
141	stw	r10,_LINK(r11);	\
142	mfspr	r12,SPRN_SRR0;	\
143	mfspr	r9,SPRN_SRR1;	\
144	stw	r1,GPR1(r11);	\
145	stw	r1,0(r11);	\
146	tovirt(r1,r11);			/* set new kernel sp */	\
147	li	r10,MSR_KERNEL & ~(MSR_IR|MSR_DR); /* can take exceptions */ \
148	MTMSRD(r10);			/* (except for mach check in rtas) */ \
149	stw	r0,GPR0(r11);	\
150	SAVE_4GPRS(3, r11);	\
151	SAVE_2GPRS(7, r11)
152
153/*
154 * Note: code which follows this uses cr0.eq (set if from kernel),
155 * r11, r12 (SRR0), and r9 (SRR1).
156 *
157 * Note2: once we have set r1 we are in a position to take exceptions
158 * again, and we could thus set MSR:RI at that point.
159 */
160
161/*
162 * Exception vectors.
163 */
164#define EXCEPTION(n, label, hdlr, xfer)		\
165	. = n;					\
166label:						\
167	EXCEPTION_PROLOG;			\
168	addi	r3,r1,STACK_FRAME_OVERHEAD;	\
169	xfer(n, hdlr)
170
171#define EXC_XFER_TEMPLATE(n, hdlr, trap, copyee, tfer, ret)	\
172	li	r10,trap;					\
173	stw	r10,_TRAP(r11);					\
174	li	r10,MSR_KERNEL;					\
175	copyee(r10, r9);					\
176	bl	tfer;						\
177i##n:								\
178	.long	hdlr;						\
179	.long	ret
180
181#define COPY_EE(d, s)		rlwimi d,s,0,16,16
182#define NOCOPY(d, s)
183
184#define EXC_XFER_STD(n, hdlr)		\
185	EXC_XFER_TEMPLATE(n, hdlr, n, NOCOPY, transfer_to_handler_full,	\
186			  ret_from_except_full)
187
188#define EXC_XFER_LITE(n, hdlr)		\
189	EXC_XFER_TEMPLATE(n, hdlr, n+1, NOCOPY, transfer_to_handler, \
190			  ret_from_except)
191
192#define EXC_XFER_EE(n, hdlr)		\
193	EXC_XFER_TEMPLATE(n, hdlr, n, COPY_EE, transfer_to_handler_full, \
194			  ret_from_except_full)
195
196#define EXC_XFER_EE_LITE(n, hdlr)	\
197	EXC_XFER_TEMPLATE(n, hdlr, n+1, COPY_EE, transfer_to_handler, \
198			  ret_from_except)
199
200/* System reset */
201	EXCEPTION(0x100, Reset, unknown_exception, EXC_XFER_STD)
202
203/* Machine check */
204	. = 0x200
205MachineCheck:
206	EXCEPTION_PROLOG
207	mfspr r4,SPRN_DAR
208	stw r4,_DAR(r11)
209	mfspr r5,SPRN_DSISR
210	stw r5,_DSISR(r11)
211	addi r3,r1,STACK_FRAME_OVERHEAD
212	EXC_XFER_STD(0x200, machine_check_exception)
213
214/* Data access exception.
215 * This is "never generated" by the MPC8xx.  We jump to it for other
216 * translation errors.
217 */
218	. = 0x300
219DataAccess:
220	EXCEPTION_PROLOG
221	mfspr	r10,SPRN_DSISR
222	stw	r10,_DSISR(r11)
223	mr	r5,r10
224	mfspr	r4,SPRN_DAR
225	EXC_XFER_EE_LITE(0x300, handle_page_fault)
226
227/* Instruction access exception.
228 * This is "never generated" by the MPC8xx.  We jump to it for other
229 * translation errors.
230 */
231	. = 0x400
232InstructionAccess:
233	EXCEPTION_PROLOG
234	mr	r4,r12
235	mr	r5,r9
236	EXC_XFER_EE_LITE(0x400, handle_page_fault)
237
238/* External interrupt */
239	EXCEPTION(0x500, HardwareInterrupt, do_IRQ, EXC_XFER_LITE)
240
241/* Alignment exception */
242	. = 0x600
243Alignment:
244	EXCEPTION_PROLOG
245	mfspr	r4,SPRN_DAR
246	stw	r4,_DAR(r11)
247	mfspr	r5,SPRN_DSISR
248	stw	r5,_DSISR(r11)
249	addi	r3,r1,STACK_FRAME_OVERHEAD
250	EXC_XFER_EE(0x600, alignment_exception)
251
252/* Program check exception */
253	EXCEPTION(0x700, ProgramCheck, program_check_exception, EXC_XFER_STD)
254
255/* No FPU on MPC8xx.  This exception is not supposed to happen.
256*/
257	EXCEPTION(0x800, FPUnavailable, unknown_exception, EXC_XFER_STD)
258
259/* Decrementer */
260	EXCEPTION(0x900, Decrementer, timer_interrupt, EXC_XFER_LITE)
261
262	EXCEPTION(0xa00, Trap_0a, unknown_exception, EXC_XFER_EE)
263	EXCEPTION(0xb00, Trap_0b, unknown_exception, EXC_XFER_EE)
264
265/* System call */
266	. = 0xc00
267SystemCall:
268	EXCEPTION_PROLOG
269	EXC_XFER_EE_LITE(0xc00, DoSyscall)
270
271/* Single step - not used on 601 */
272	EXCEPTION(0xd00, SingleStep, single_step_exception, EXC_XFER_STD)
273	EXCEPTION(0xe00, Trap_0e, unknown_exception, EXC_XFER_EE)
274	EXCEPTION(0xf00, Trap_0f, unknown_exception, EXC_XFER_EE)
275
276/* On the MPC8xx, this is a software emulation interrupt.  It occurs
277 * for all unimplemented and illegal instructions.
278 */
279	EXCEPTION(0x1000, SoftEmu, SoftwareEmulation, EXC_XFER_STD)
280
281	. = 0x1100
282/*
283 * For the MPC8xx, this is a software tablewalk to load the instruction
284 * TLB.  It is modelled after the example in the Motorola manual.  The task
285 * switch loads the M_TWB register with the pointer to the first level table.
286 * If we discover there is no second level table (value is zero) or if there
287 * is an invalid pte, we load that into the TLB, which causes another fault
288 * into the TLB Error interrupt where we can handle such problems.
289 * We have to use the MD_xxx registers for the tablewalk because the
290 * equivalent MI_xxx registers only perform the attribute functions.
291 */
292InstructionTLBMiss:
293#ifdef CONFIG_8xx_CPU6
294	stw	r3, 8(r0)
295#endif
296	DO_8xx_CPU6(0x3f80, r3)
297	mtspr	SPRN_M_TW, r10	/* Save a couple of working registers */
298	mfcr	r10
299	stw	r10, 0(r0)
300	stw	r11, 4(r0)
301	mfspr	r10, SPRN_SRR0	/* Get effective address of fault */
302#ifdef CONFIG_8xx_CPU15
303	addi	r11, r10, 0x1000
304	tlbie	r11
305	addi	r11, r10, -0x1000
306	tlbie	r11
307#endif
308	DO_8xx_CPU6(0x3780, r3)
309	mtspr	SPRN_MD_EPN, r10	/* Have to use MD_EPN for walk, MI_EPN can't */
310	mfspr	r10, SPRN_M_TWB	/* Get level 1 table entry address */
311
312	/* If we are faulting a kernel address, we have to use the
313	 * kernel page tables.
314	 */
315	andi.	r11, r10, 0x0800	/* Address >= 0x80000000 */
316	beq	3f
317	lis	r11, swapper_pg_dir@h
318	ori	r11, r11, swapper_pg_dir@l
319	rlwimi	r10, r11, 0, 2, 19
3203:
321	lwz	r11, 0(r10)	/* Get the level 1 entry */
322	rlwinm.	r10, r11,0,0,19	/* Extract page descriptor page address */
323	beq	2f		/* If zero, don't try to find a pte */
324
325	/* We have a pte table, so load the MI_TWC with the attributes
326	 * for this "segment."
327	 */
328	ori	r11,r11,1		/* Set valid bit */
329	DO_8xx_CPU6(0x2b80, r3)
330	mtspr	SPRN_MI_TWC, r11	/* Set segment attributes */
331	DO_8xx_CPU6(0x3b80, r3)
332	mtspr	SPRN_MD_TWC, r11	/* Load pte table base address */
333	mfspr	r11, SPRN_MD_TWC	/* ....and get the pte address */
334	lwz	r10, 0(r11)	/* Get the pte */
335
336#ifdef CONFIG_SWAP
337	/* do not set the _PAGE_ACCESSED bit of a non-present page */
338	andi.	r11, r10, _PAGE_PRESENT
339	beq	4f
340	ori	r10, r10, _PAGE_ACCESSED
341	mfspr	r11, SPRN_MD_TWC	/* get the pte address again */
342	stw	r10, 0(r11)
3434:
344#else
345	ori	r10, r10, _PAGE_ACCESSED
346	stw	r10, 0(r11)
347#endif
348
349	/* The Linux PTE won't go exactly into the MMU TLB.
350	 * Software indicator bits 21, 22 and 28 must be clear.
351	 * Software indicator bits 24, 25, 26, and 27 must be
352	 * set.  All other Linux PTE bits control the behavior
353	 * of the MMU.
354	 */
3552:	li	r11, 0x00f0
356	rlwimi	r10, r11, 0, 24, 28	/* Set 24-27, clear 28 */
357	DO_8xx_CPU6(0x2d80, r3)
358	mtspr	SPRN_MI_RPN, r10	/* Update TLB entry */
359
360	mfspr	r10, SPRN_M_TW	/* Restore registers */
361	lwz	r11, 0(r0)
362	mtcr	r11
363	lwz	r11, 4(r0)
364#ifdef CONFIG_8xx_CPU6
365	lwz	r3, 8(r0)
366#endif
367	rfi
368
369	. = 0x1200
370DataStoreTLBMiss:
371#ifdef CONFIG_8xx_CPU6
372	stw	r3, 8(r0)
373#endif
374	DO_8xx_CPU6(0x3f80, r3)
375	mtspr	SPRN_M_TW, r10	/* Save a couple of working registers */
376	mfcr	r10
377	stw	r10, 0(r0)
378	stw	r11, 4(r0)
379	mfspr	r10, SPRN_M_TWB	/* Get level 1 table entry address */
380
381	/* If we are faulting a kernel address, we have to use the
382	 * kernel page tables.
383	 */
384	andi.	r11, r10, 0x0800
385	beq	3f
386	lis	r11, swapper_pg_dir@h
387	ori	r11, r11, swapper_pg_dir@l
388	rlwimi	r10, r11, 0, 2, 19
3893:
390	lwz	r11, 0(r10)	/* Get the level 1 entry */
391	rlwinm.	r10, r11,0,0,19	/* Extract page descriptor page address */
392	beq	2f		/* If zero, don't try to find a pte */
393
394	/* We have a pte table, so load fetch the pte from the table.
395	 */
396	ori	r11, r11, 1	/* Set valid bit in physical L2 page */
397	DO_8xx_CPU6(0x3b80, r3)
398	mtspr	SPRN_MD_TWC, r11	/* Load pte table base address */
399	mfspr	r10, SPRN_MD_TWC	/* ....and get the pte address */
400	lwz	r10, 0(r10)	/* Get the pte */
401
402	/* Insert the Guarded flag into the TWC from the Linux PTE.
403	 * It is bit 27 of both the Linux PTE and the TWC (at least
404	 * I got that right :-).  It will be better when we can put
405	 * this into the Linux pgd/pmd and load it in the operation
406	 * above.
407	 */
408	rlwimi	r11, r10, 0, 27, 27
409	DO_8xx_CPU6(0x3b80, r3)
410	mtspr	SPRN_MD_TWC, r11
411
412#ifdef CONFIG_SWAP
413	/* do not set the _PAGE_ACCESSED bit of a non-present page */
414	andi.	r11, r10, _PAGE_PRESENT
415	beq	4f
416	ori	r10, r10, _PAGE_ACCESSED
4174:
418	/* and update pte in table */
419#else
420	ori	r10, r10, _PAGE_ACCESSED
421#endif
422	mfspr	r11, SPRN_MD_TWC	/* get the pte address again */
423	stw	r10, 0(r11)
424
425	/* The Linux PTE won't go exactly into the MMU TLB.
426	 * Software indicator bits 21, 22 and 28 must be clear.
427	 * Software indicator bits 24, 25, 26, and 27 must be
428	 * set.  All other Linux PTE bits control the behavior
429	 * of the MMU.
430	 */
4312:	li	r11, 0x00f0
432	rlwimi	r10, r11, 0, 24, 28	/* Set 24-27, clear 28 */
433	DO_8xx_CPU6(0x3d80, r3)
434	mtspr	SPRN_MD_RPN, r10	/* Update TLB entry */
435
436	mfspr	r10, SPRN_M_TW	/* Restore registers */
437	lwz	r11, 0(r0)
438	mtcr	r11
439	lwz	r11, 4(r0)
440#ifdef CONFIG_8xx_CPU6
441	lwz	r3, 8(r0)
442#endif
443	rfi
444
445/* This is an instruction TLB error on the MPC8xx.  This could be due
446 * to many reasons, such as executing guarded memory or illegal instruction
447 * addresses.  There is nothing to do but handle a big time error fault.
448 */
449	. = 0x1300
450InstructionTLBError:
451	b	InstructionAccess
452
453/* This is the data TLB error on the MPC8xx.  This could be due to
454 * many reasons, including a dirty update to a pte.  We can catch that
455 * one here, but anything else is an error.  First, we track down the
456 * Linux pte.  If it is valid, write access is allowed, but the
457 * page dirty bit is not set, we will set it and reload the TLB.  For
458 * any other case, we bail out to a higher level function that can
459 * handle it.
460 */
461	. = 0x1400
462DataTLBError:
463#ifdef CONFIG_8xx_CPU6
464	stw	r3, 8(r0)
465#endif
466	DO_8xx_CPU6(0x3f80, r3)
467	mtspr	SPRN_M_TW, r10	/* Save a couple of working registers */
468	mfcr	r10
469	stw	r10, 0(r0)
470	stw	r11, 4(r0)
471
472	/* First, make sure this was a store operation.
473	*/
474	mfspr	r10, SPRN_DSISR
475	andis.	r11, r10, 0x0200	/* If set, indicates store op */
476	beq	2f
477
478	/* The EA of a data TLB miss is automatically stored in the MD_EPN
479	 * register.  The EA of a data TLB error is automatically stored in
480	 * the DAR, but not the MD_EPN register.  We must copy the 20 most
481	 * significant bits of the EA from the DAR to MD_EPN before we
482	 * start walking the page tables.  We also need to copy the CASID
483	 * value from the M_CASID register.
484	 * Addendum:  The EA of a data TLB error is _supposed_ to be stored
485	 * in DAR, but it seems that this doesn't happen in some cases, such
486	 * as when the error is due to a dcbi instruction to a page with a
487	 * TLB that doesn't have the changed bit set.  In such cases, there
488	 * does not appear to be any way  to recover the EA of the error
489	 * since it is neither in DAR nor MD_EPN.  As a workaround, the
490	 * _PAGE_HWWRITE bit is set for all kernel data pages when the PTEs
491	 * are initialized in mapin_ram().  This will avoid the problem,
492	 * assuming we only use the dcbi instruction on kernel addresses.
493	 */
494	mfspr	r10, SPRN_DAR
495	rlwinm	r11, r10, 0, 0, 19
496	ori	r11, r11, MD_EVALID
497	mfspr	r10, SPRN_M_CASID
498	rlwimi	r11, r10, 0, 28, 31
499	DO_8xx_CPU6(0x3780, r3)
500	mtspr	SPRN_MD_EPN, r11
501
502	mfspr	r10, SPRN_M_TWB	/* Get level 1 table entry address */
503
504	/* If we are faulting a kernel address, we have to use the
505	 * kernel page tables.
506	 */
507	andi.	r11, r10, 0x0800
508	beq	3f
509	lis	r11, swapper_pg_dir@h
510	ori	r11, r11, swapper_pg_dir@l
511	rlwimi	r10, r11, 0, 2, 19
5123:
513	lwz	r11, 0(r10)	/* Get the level 1 entry */
514	rlwinm.	r10, r11,0,0,19	/* Extract page descriptor page address */
515	beq	2f		/* If zero, bail */
516
517	/* We have a pte table, so fetch the pte from the table.
518	 */
519	ori	r11, r11, 1		/* Set valid bit in physical L2 page */
520	DO_8xx_CPU6(0x3b80, r3)
521	mtspr	SPRN_MD_TWC, r11		/* Load pte table base address */
522	mfspr	r11, SPRN_MD_TWC		/* ....and get the pte address */
523	lwz	r10, 0(r11)		/* Get the pte */
524
525	andi.	r11, r10, _PAGE_RW	/* Is it writeable? */
526	beq	2f			/* Bail out if not */
527
528	/* Update 'changed', among others.
529	*/
530#ifdef CONFIG_SWAP
531	ori	r10, r10, _PAGE_DIRTY|_PAGE_HWWRITE
532	/* do not set the _PAGE_ACCESSED bit of a non-present page */
533	andi.	r11, r10, _PAGE_PRESENT
534	beq	4f
535	ori	r10, r10, _PAGE_ACCESSED
5364:
537#else
538	ori	r10, r10, _PAGE_DIRTY|_PAGE_ACCESSED|_PAGE_HWWRITE
539#endif
540	mfspr	r11, SPRN_MD_TWC		/* Get pte address again */
541	stw	r10, 0(r11)		/* and update pte in table */
542
543	/* The Linux PTE won't go exactly into the MMU TLB.
544	 * Software indicator bits 21, 22 and 28 must be clear.
545	 * Software indicator bits 24, 25, 26, and 27 must be
546	 * set.  All other Linux PTE bits control the behavior
547	 * of the MMU.
548	 */
549	li	r11, 0x00f0
550	rlwimi	r10, r11, 0, 24, 28	/* Set 24-27, clear 28 */
551	DO_8xx_CPU6(0x3d80, r3)
552	mtspr	SPRN_MD_RPN, r10	/* Update TLB entry */
553
554	mfspr	r10, SPRN_M_TW	/* Restore registers */
555	lwz	r11, 0(r0)
556	mtcr	r11
557	lwz	r11, 4(r0)
558#ifdef CONFIG_8xx_CPU6
559	lwz	r3, 8(r0)
560#endif
561	rfi
5622:
563	mfspr	r10, SPRN_M_TW	/* Restore registers */
564	lwz	r11, 0(r0)
565	mtcr	r11
566	lwz	r11, 4(r0)
567#ifdef CONFIG_8xx_CPU6
568	lwz	r3, 8(r0)
569#endif
570	b	DataAccess
571
572	EXCEPTION(0x1500, Trap_15, unknown_exception, EXC_XFER_EE)
573	EXCEPTION(0x1600, Trap_16, unknown_exception, EXC_XFER_EE)
574	EXCEPTION(0x1700, Trap_17, unknown_exception, EXC_XFER_EE)
575	EXCEPTION(0x1800, Trap_18, unknown_exception, EXC_XFER_EE)
576	EXCEPTION(0x1900, Trap_19, unknown_exception, EXC_XFER_EE)
577	EXCEPTION(0x1a00, Trap_1a, unknown_exception, EXC_XFER_EE)
578	EXCEPTION(0x1b00, Trap_1b, unknown_exception, EXC_XFER_EE)
579
580/* On the MPC8xx, these next four traps are used for development
581 * support of breakpoints and such.  Someday I will get around to
582 * using them.
583 */
584	EXCEPTION(0x1c00, Trap_1c, unknown_exception, EXC_XFER_EE)
585	EXCEPTION(0x1d00, Trap_1d, unknown_exception, EXC_XFER_EE)
586	EXCEPTION(0x1e00, Trap_1e, unknown_exception, EXC_XFER_EE)
587	EXCEPTION(0x1f00, Trap_1f, unknown_exception, EXC_XFER_EE)
588
589	. = 0x2000
590
591	.globl	giveup_fpu
592giveup_fpu:
593	blr
594
595/*
596 * This is where the main kernel code starts.
597 */
598start_here:
599	/* ptr to current */
600	lis	r2,init_task@h
601	ori	r2,r2,init_task@l
602
603	/* ptr to phys current thread */
604	tophys(r4,r2)
605	addi	r4,r4,THREAD	/* init task's THREAD */
606	mtspr	SPRN_SPRG3,r4
607	li	r3,0
608	mtspr	SPRN_SPRG2,r3	/* 0 => r1 has kernel sp */
609
610	/* stack */
611	lis	r1,init_thread_union@ha
612	addi	r1,r1,init_thread_union@l
613	li	r0,0
614	stwu	r0,THREAD_SIZE-STACK_FRAME_OVERHEAD(r1)
615
616	bl	early_init	/* We have to do this with MMU on */
617
618/*
619 * Decide what sort of machine this is and initialize the MMU.
620 */
621	mr	r3,r31
622	mr	r4,r30
623	mr	r5,r29
624	mr	r6,r28
625	mr	r7,r27
626	bl	machine_init
627	bl	MMU_init
628
629/*
630 * Go back to running unmapped so we can load up new values
631 * and change to using our exception vectors.
632 * On the 8xx, all we have to do is invalidate the TLB to clear
633 * the old 8M byte TLB mappings and load the page table base register.
634 */
635	/* The right way to do this would be to track it down through
636	 * init's THREAD like the context switch code does, but this is
637	 * easier......until someone changes init's static structures.
638	 */
639	lis	r6, swapper_pg_dir@h
640	ori	r6, r6, swapper_pg_dir@l
641	tophys(r6,r6)
642#ifdef CONFIG_8xx_CPU6
643	lis	r4, cpu6_errata_word@h
644	ori	r4, r4, cpu6_errata_word@l
645	li	r3, 0x3980
646	stw	r3, 12(r4)
647	lwz	r3, 12(r4)
648#endif
649	mtspr	SPRN_M_TWB, r6
650	lis	r4,2f@h
651	ori	r4,r4,2f@l
652	tophys(r4,r4)
653	li	r3,MSR_KERNEL & ~(MSR_IR|MSR_DR)
654	mtspr	SPRN_SRR0,r4
655	mtspr	SPRN_SRR1,r3
656	rfi
657/* Load up the kernel context */
6582:
659	SYNC			/* Force all PTE updates to finish */
660	tlbia			/* Clear all TLB entries */
661	sync			/* wait for tlbia/tlbie to finish */
662	TLBSYNC			/* ... on all CPUs */
663
664	/* set up the PTE pointers for the Abatron bdiGDB.
665	*/
666	tovirt(r6,r6)
667	lis	r5, abatron_pteptrs@h
668	ori	r5, r5, abatron_pteptrs@l
669	stw	r5, 0xf0(r0)	/* Must match your Abatron config file */
670	tophys(r5,r5)
671	stw	r6, 0(r5)
672
673/* Now turn on the MMU for real! */
674	li	r4,MSR_KERNEL
675	lis	r3,start_kernel@h
676	ori	r3,r3,start_kernel@l
677	mtspr	SPRN_SRR0,r3
678	mtspr	SPRN_SRR1,r4
679	rfi			/* enable MMU and jump to start_kernel */
680
681/* Set up the initial MMU state so we can do the first level of
682 * kernel initialization.  This maps the first 8 MBytes of memory 1:1
683 * virtual to physical.  Also, set the cache mode since that is defined
684 * by TLB entries and perform any additional mapping (like of the IMMR).
685 * If configured to pin some TLBs, we pin the first 8 Mbytes of kernel,
686 * 24 Mbytes of data, and the 8M IMMR space.  Anything not covered by
687 * these mappings is mapped by page tables.
688 */
689initial_mmu:
690	tlbia			/* Invalidate all TLB entries */
691#ifdef CONFIG_PIN_TLB
692	lis	r8, MI_RSV4I@h
693	ori	r8, r8, 0x1c00
694#else
695	li	r8, 0
696#endif
697	mtspr	SPRN_MI_CTR, r8	/* Set instruction MMU control */
698
699#ifdef CONFIG_PIN_TLB
700	lis	r10, (MD_RSV4I | MD_RESETVAL)@h
701	ori	r10, r10, 0x1c00
702	mr	r8, r10
703#else
704	lis	r10, MD_RESETVAL@h
705#endif
706#ifndef CONFIG_8xx_COPYBACK
707	oris	r10, r10, MD_WTDEF@h
708#endif
709	mtspr	SPRN_MD_CTR, r10	/* Set data TLB control */
710
711	/* Now map the lower 8 Meg into the TLBs.  For this quick hack,
712	 * we can load the instruction and data TLB registers with the
713	 * same values.
714	 */
715	lis	r8, KERNELBASE@h	/* Create vaddr for TLB */
716	ori	r8, r8, MI_EVALID	/* Mark it valid */
717	mtspr	SPRN_MI_EPN, r8
718	mtspr	SPRN_MD_EPN, r8
719	li	r8, MI_PS8MEG		/* Set 8M byte page */
720	ori	r8, r8, MI_SVALID	/* Make it valid */
721	mtspr	SPRN_MI_TWC, r8
722	mtspr	SPRN_MD_TWC, r8
723	li	r8, MI_BOOTINIT		/* Create RPN for address 0 */
724	mtspr	SPRN_MI_RPN, r8		/* Store TLB entry */
725	mtspr	SPRN_MD_RPN, r8
726	lis	r8, MI_Kp@h		/* Set the protection mode */
727	mtspr	SPRN_MI_AP, r8
728	mtspr	SPRN_MD_AP, r8
729
730	/* Map another 8 MByte at the IMMR to get the processor
731	 * internal registers (among other things).
732	 */
733#ifdef CONFIG_PIN_TLB
734	addi	r10, r10, 0x0100
735	mtspr	SPRN_MD_CTR, r10
736#endif
737	mfspr	r9, 638			/* Get current IMMR */
738	andis.	r9, r9, 0xff80		/* Get 8Mbyte boundary */
739
740	mr	r8, r9			/* Create vaddr for TLB */
741	ori	r8, r8, MD_EVALID	/* Mark it valid */
742	mtspr	SPRN_MD_EPN, r8
743	li	r8, MD_PS8MEG		/* Set 8M byte page */
744	ori	r8, r8, MD_SVALID	/* Make it valid */
745	mtspr	SPRN_MD_TWC, r8
746	mr	r8, r9			/* Create paddr for TLB */
747	ori	r8, r8, MI_BOOTINIT|0x2 /* Inhibit cache -- Cort */
748	mtspr	SPRN_MD_RPN, r8
749
750#ifdef CONFIG_PIN_TLB
751	/* Map two more 8M kernel data pages.
752	*/
753	addi	r10, r10, 0x0100
754	mtspr	SPRN_MD_CTR, r10
755
756	lis	r8, KERNELBASE@h	/* Create vaddr for TLB */
757	addis	r8, r8, 0x0080		/* Add 8M */
758	ori	r8, r8, MI_EVALID	/* Mark it valid */
759	mtspr	SPRN_MD_EPN, r8
760	li	r9, MI_PS8MEG		/* Set 8M byte page */
761	ori	r9, r9, MI_SVALID	/* Make it valid */
762	mtspr	SPRN_MD_TWC, r9
763	li	r11, MI_BOOTINIT	/* Create RPN for address 0 */
764	addis	r11, r11, 0x0080	/* Add 8M */
765	mtspr	SPRN_MD_RPN, r11
766
767	addis	r8, r8, 0x0080		/* Add 8M */
768	mtspr	SPRN_MD_EPN, r8
769	mtspr	SPRN_MD_TWC, r9
770	addis	r11, r11, 0x0080	/* Add 8M */
771	mtspr	SPRN_MD_RPN, r11
772#endif
773
774	/* Since the cache is enabled according to the information we
775	 * just loaded into the TLB, invalidate and enable the caches here.
776	 * We should probably check/set other modes....later.
777	 */
778	lis	r8, IDC_INVALL@h
779	mtspr	SPRN_IC_CST, r8
780	mtspr	SPRN_DC_CST, r8
781	lis	r8, IDC_ENABLE@h
782	mtspr	SPRN_IC_CST, r8
783#ifdef CONFIG_8xx_COPYBACK
784	mtspr	SPRN_DC_CST, r8
785#else
786	/* For a debug option, I left this here to easily enable
787	 * the write through cache mode
788	 */
789	lis	r8, DC_SFWT@h
790	mtspr	SPRN_DC_CST, r8
791	lis	r8, IDC_ENABLE@h
792	mtspr	SPRN_DC_CST, r8
793#endif
794	blr
795
796
797/*
798 * Set up to use a given MMU context.
799 * r3 is context number, r4 is PGD pointer.
800 *
801 * We place the physical address of the new task page directory loaded
802 * into the MMU base register, and set the ASID compare register with
803 * the new "context."
804 */
805_GLOBAL(set_context)
806
807#ifdef CONFIG_BDI_SWITCH
808	/* Context switch the PTE pointer for the Abatron BDI2000.
809	 * The PGDIR is passed as second argument.
810	 */
811	lis	r5, KERNELBASE@h
812	lwz	r5, 0xf0(r5)
813	stw	r4, 0x4(r5)
814#endif
815
816#ifdef CONFIG_8xx_CPU6
817	lis	r6, cpu6_errata_word@h
818	ori	r6, r6, cpu6_errata_word@l
819	tophys	(r4, r4)
820	li	r7, 0x3980
821	stw	r7, 12(r6)
822	lwz	r7, 12(r6)
823        mtspr   SPRN_M_TWB, r4               /* Update MMU base address */
824	li	r7, 0x3380
825	stw	r7, 12(r6)
826	lwz	r7, 12(r6)
827        mtspr   SPRN_M_CASID, r3             /* Update context */
828#else
829        mtspr   SPRN_M_CASID,r3		/* Update context */
830	tophys	(r4, r4)
831	mtspr	SPRN_M_TWB, r4		/* and pgd */
832#endif
833	SYNC
834	blr
835
836#ifdef CONFIG_8xx_CPU6
837/* It's here because it is unique to the 8xx.
838 * It is important we get called with interrupts disabled.  I used to
839 * do that, but it appears that all code that calls this already had
840 * interrupt disabled.
841 */
842	.globl	set_dec_cpu6
843set_dec_cpu6:
844	lis	r7, cpu6_errata_word@h
845	ori	r7, r7, cpu6_errata_word@l
846	li	r4, 0x2c00
847	stw	r4, 8(r7)
848	lwz	r4, 8(r7)
849        mtspr   22, r3		/* Update Decrementer */
850	SYNC
851	blr
852#endif
853
854/*
855 * We put a few things here that have to be page-aligned.
856 * This stuff goes at the beginning of the data segment,
857 * which is page-aligned.
858 */
859	.data
860	.globl	sdata
861sdata:
862	.globl	empty_zero_page
863empty_zero_page:
864	.space	4096
865
866	.globl	swapper_pg_dir
867swapper_pg_dir:
868	.space	4096
869
870/* Room for two PTE table poiners, usually the kernel and current user
871 * pointer to their respective root page table (pgdir).
872 */
873abatron_pteptrs:
874	.space	8
875
876#ifdef CONFIG_8xx_CPU6
877	.globl	cpu6_errata_word
878cpu6_errata_word:
879	.space	16
880#endif
881
882