1/* SPDX-License-Identifier: GPL-2.0-or-later */
2/*
3 *    Copyright (c) 1995-1996 Gary Thomas <gdt@linuxppc.org>
4 *      Initial PowerPC version.
5 *    Copyright (c) 1996 Cort Dougan <cort@cs.nmt.edu>
6 *      Rewritten for PReP
7 *    Copyright (c) 1996 Paul Mackerras <paulus@cs.anu.edu.au>
8 *      Low-level exception handers, MMU support, and rewrite.
9 *    Copyright (c) 1997 Dan Malek <dmalek@jlc.net>
10 *      PowerPC 8xx modifications.
11 *    Copyright (c) 1998-1999 TiVo, Inc.
12 *      PowerPC 403GCX modifications.
13 *    Copyright (c) 1999 Grant Erickson <grant@lcse.umn.edu>
14 *      PowerPC 403GCX/405GP modifications.
15 *    Copyright 2000 MontaVista Software Inc.
16 *	PPC405 modifications
17 *      PowerPC 403GCX/405GP modifications.
18 * 	Author: MontaVista Software, Inc.
19 *         	frank_rowand@mvista.com or source@mvista.com
20 * 	   	debbie_chu@mvista.com
21 *
22 *    Module name: head_4xx.S
23 *
24 *    Description:
25 *      Kernel execution entry point code.
26 */
27
28#include <linux/init.h>
29#include <linux/pgtable.h>
30#include <linux/sizes.h>
31#include <asm/processor.h>
32#include <asm/page.h>
33#include <asm/mmu.h>
34#include <asm/cputable.h>
35#include <asm/thread_info.h>
36#include <asm/ppc_asm.h>
37#include <asm/asm-offsets.h>
38#include <asm/ptrace.h>
39#include <asm/export.h>
40
41#include "head_32.h"
42
43/* As with the other PowerPC ports, it is expected that when code
44 * execution begins here, the following registers contain valid, yet
45 * optional, information:
46 *
47 *   r3 - Board info structure pointer (DRAM, frequency, MAC address, etc.)
48 *   r4 - Starting address of the init RAM disk
49 *   r5 - Ending address of the init RAM disk
50 *   r6 - Start of kernel command line string (e.g. "mem=96m")
51 *   r7 - End of kernel command line string
52 *
53 * This is all going to change RSN when we add bi_recs.......  -- Dan
54 */
55	__HEAD
56_GLOBAL(_stext);
57_GLOBAL(_start);
58
59	mr	r31,r3			/* save device tree ptr */
60
61	/* We have to turn on the MMU right away so we get cache modes
62	 * set correctly.
63	 */
64	bl	initial_mmu
65
66/* We now have the lower 16 Meg mapped into TLB entries, and the caches
67 * ready to work.
68 */
69turn_on_mmu:
70	lis	r0,MSR_KERNEL@h
71	ori	r0,r0,MSR_KERNEL@l
72	mtspr	SPRN_SRR1,r0
73	lis	r0,start_here@h
74	ori	r0,r0,start_here@l
75	mtspr	SPRN_SRR0,r0
76	rfi				/* enables MMU */
77	b	.			/* prevent prefetch past rfi */
78
79/*
80 * This area is used for temporarily saving registers during the
81 * critical exception prolog.
82 */
83	. = 0xc0
84crit_save:
85_GLOBAL(crit_r10)
86	.space	4
87_GLOBAL(crit_r11)
88	.space	4
89_GLOBAL(crit_srr0)
90	.space	4
91_GLOBAL(crit_srr1)
92	.space	4
93_GLOBAL(crit_r1)
94	.space	4
95_GLOBAL(crit_dear)
96	.space	4
97_GLOBAL(crit_esr)
98	.space	4
99
100/*
101 * Exception prolog for critical exceptions.  This is a little different
102 * from the normal exception prolog above since a critical exception
103 * can potentially occur at any point during normal exception processing.
104 * Thus we cannot use the same SPRG registers as the normal prolog above.
105 * Instead we use a couple of words of memory at low physical addresses.
106 * This is OK since we don't support SMP on these processors.
107 */
108.macro CRITICAL_EXCEPTION_PROLOG trapno name
109	stw	r10,crit_r10@l(0)	/* save two registers to work with */
110	stw	r11,crit_r11@l(0)
111	mfspr	r10,SPRN_SRR0
112	mfspr	r11,SPRN_SRR1
113	stw	r10,crit_srr0@l(0)
114	stw	r11,crit_srr1@l(0)
115	mfspr	r10,SPRN_DEAR
116	mfspr	r11,SPRN_ESR
117	stw	r10,crit_dear@l(0)
118	stw	r11,crit_esr@l(0)
119	mfcr	r10			/* save CR in r10 for now	   */
120	mfspr	r11,SPRN_SRR3		/* check whether user or kernel    */
121	andi.	r11,r11,MSR_PR
122	lis	r11,(critirq_ctx-PAGE_OFFSET)@ha
123	lwz	r11,(critirq_ctx-PAGE_OFFSET)@l(r11)
124	beq	1f
125	/* COMING FROM USER MODE */
126	mfspr	r11,SPRN_SPRG_THREAD	/* if from user, start at top of   */
127	lwz	r11,TASK_STACK-THREAD(r11) /* this thread's kernel stack */
1281:	stw	r1,crit_r1@l(0)
129	addi	r1,r11,THREAD_SIZE-INT_FRAME_SIZE /* Alloc an excpt frm  */
130	LOAD_REG_IMMEDIATE(r11, MSR_KERNEL & ~(MSR_ME|MSR_DE|MSR_CE)) /* re-enable MMU */
131	mtspr	SPRN_SRR1, r11
132	lis	r11, 1f@h
133	ori	r11, r11, 1f@l
134	mtspr	SPRN_SRR0, r11
135	rfi
136
137	.text
1381:
139\name\()_virt:
140	lwz	r11,crit_r1@l(0)
141	stw	r11,GPR1(r1)
142	stw	r11,0(r1)
143	mr	r11,r1
144	stw	r10,_CCR(r11)		/* save various registers	   */
145	stw	r12,GPR12(r11)
146	stw	r9,GPR9(r11)
147	mflr	r10
148	stw	r10,_LINK(r11)
149	lis	r9,PAGE_OFFSET@ha
150	lwz	r10,crit_r10@l(r9)
151	lwz	r12,crit_r11@l(r9)
152	stw	r10,GPR10(r11)
153	stw	r12,GPR11(r11)
154	lwz	r12,crit_dear@l(r9)
155	lwz	r9,crit_esr@l(r9)
156	stw	r12,_DEAR(r11)		/* since they may have had stuff   */
157	stw	r9,_ESR(r11)		/* exception was taken		   */
158	mfspr	r12,SPRN_SRR2
159	mfspr	r9,SPRN_SRR3
160	rlwinm	r9,r9,0,14,12		/* clear MSR_WE (necessary?)	   */
161	COMMON_EXCEPTION_PROLOG_END \trapno + 2
162_ASM_NOKPROBE_SYMBOL(\name\()_virt)
163.endm
164
165	/*
166	 * State at this point:
167	 * r9 saved in stack frame, now saved SRR3 & ~MSR_WE
168	 * r10 saved in crit_r10 and in stack frame, trashed
169	 * r11 saved in crit_r11 and in stack frame,
170	 *	now phys stack/exception frame pointer
171	 * r12 saved in stack frame, now saved SRR2
172	 * CR saved in stack frame, CR0.EQ = !SRR3.PR
173	 * LR, DEAR, ESR in stack frame
174	 * r1 saved in stack frame, now virt stack/excframe pointer
175	 * r0, r3-r8 saved in stack frame
176	 */
177
178/*
179 * Exception vectors.
180 */
181#define CRITICAL_EXCEPTION(n, label, hdlr)			\
182	START_EXCEPTION(n, label);				\
183	CRITICAL_EXCEPTION_PROLOG n label;				\
184	prepare_transfer_to_handler;				\
185	bl	hdlr;						\
186	b	ret_from_crit_exc
187
188/*
189 * 0x0100 - Critical Interrupt Exception
190 */
191	CRITICAL_EXCEPTION(0x0100, CriticalInterrupt, unknown_exception)
192
193/*
194 * 0x0200 - Machine Check Exception
195 */
196	CRITICAL_EXCEPTION(0x0200, MachineCheck, machine_check_exception)
197
198/*
199 * 0x0300 - Data Storage Exception
200 * This happens for just a few reasons.  U0 set (but we don't do that),
201 * or zone protection fault (user violation, write to protected page).
202 * The other Data TLB exceptions bail out to this point
203 * if they can't resolve the lightweight TLB fault.
204 */
205	START_EXCEPTION(0x0300,	DataStorage)
206	EXCEPTION_PROLOG 0x300 DataStorage handle_dar_dsisr=1
207	prepare_transfer_to_handler
208	bl	do_page_fault
209	b	interrupt_return
210
211/*
212 * 0x0400 - Instruction Storage Exception
213 * This is caused by a fetch from non-execute or guarded pages.
214 */
215	START_EXCEPTION(0x0400, InstructionAccess)
216	EXCEPTION_PROLOG 0x400 InstructionAccess
217	li	r5,0
218	stw	r5, _ESR(r11)		/* Zero ESR */
219	stw	r12, _DEAR(r11)		/* SRR0 as DEAR */
220	prepare_transfer_to_handler
221	bl	do_page_fault
222	b	interrupt_return
223
224/* 0x0500 - External Interrupt Exception */
225	EXCEPTION(0x0500, HardwareInterrupt, do_IRQ)
226
227/* 0x0600 - Alignment Exception */
228	START_EXCEPTION(0x0600, Alignment)
229	EXCEPTION_PROLOG 0x600 Alignment handle_dar_dsisr=1
230	prepare_transfer_to_handler
231	bl	alignment_exception
232	REST_NVGPRS(r1)
233	b	interrupt_return
234
235/* 0x0700 - Program Exception */
236	START_EXCEPTION(0x0700, ProgramCheck)
237	EXCEPTION_PROLOG 0x700 ProgramCheck handle_dar_dsisr=1
238	prepare_transfer_to_handler
239	bl	program_check_exception
240	REST_NVGPRS(r1)
241	b	interrupt_return
242
243	EXCEPTION(0x0800, Trap_08, unknown_exception)
244	EXCEPTION(0x0900, Trap_09, unknown_exception)
245	EXCEPTION(0x0A00, Trap_0A, unknown_exception)
246	EXCEPTION(0x0B00, Trap_0B, unknown_exception)
247
248/* 0x0C00 - System Call Exception */
249	START_EXCEPTION(0x0C00,	SystemCall)
250	SYSCALL_ENTRY	0xc00
251/*	Trap_0D is commented out to get more space for system call exception */
252
253/*	EXCEPTION(0x0D00, Trap_0D, unknown_exception) */
254	EXCEPTION(0x0E00, Trap_0E, unknown_exception)
255	EXCEPTION(0x0F00, Trap_0F, unknown_exception)
256
257/* 0x1000 - Programmable Interval Timer (PIT) Exception */
258	START_EXCEPTION(0x1000, DecrementerTrap)
259	b Decrementer
260
261/* 0x1010 - Fixed Interval Timer (FIT) Exception */
262	START_EXCEPTION(0x1010, FITExceptionTrap)
263	b FITException
264
265/* 0x1020 - Watchdog Timer (WDT) Exception */
266	START_EXCEPTION(0x1020, WDTExceptionTrap)
267	b WDTException
268
269/* 0x1100 - Data TLB Miss Exception
270 * As the name implies, translation is not in the MMU, so search the
271 * page tables and fix it.  The only purpose of this function is to
272 * load TLB entries from the page table if they exist.
273 */
274	START_EXCEPTION(0x1100,	DTLBMiss)
275	mtspr	SPRN_SPRG_SCRATCH5, r10 /* Save some working registers */
276	mtspr	SPRN_SPRG_SCRATCH6, r11
277	mtspr	SPRN_SPRG_SCRATCH3, r12
278	mtspr	SPRN_SPRG_SCRATCH4, r9
279	mfcr	r12
280	mfspr	r9, SPRN_PID
281	rlwimi	r12, r9, 0, 0xff
282	mfspr	r10, SPRN_DEAR		/* Get faulting address */
283
284	/* If we are faulting a kernel address, we have to use the
285	 * kernel page tables.
286	 */
287	lis	r11, PAGE_OFFSET@h
288	cmplw	r10, r11
289	blt+	3f
290	lis	r11, swapper_pg_dir@h
291	ori	r11, r11, swapper_pg_dir@l
292	li	r9, 0
293	mtspr	SPRN_PID, r9		/* TLB will have 0 TID */
294	b	4f
295
296	/* Get the PGD for the current thread.
297	 */
2983:
299	mfspr	r11,SPRN_SPRG_THREAD
300	lwz	r11,PGDIR(r11)
301#ifdef CONFIG_PPC_KUAP
302	rlwinm.	r9, r9, 0, 0xff
303	beq	5f			/* Kuap fault */
304#endif
3054:
306	tophys(r11, r11)
307	rlwimi	r11, r10, 12, 20, 29	/* Create L1 (pgdir/pmd) address */
308	lwz	r11, 0(r11)		/* Get L1 entry */
309	andi.	r9, r11, _PMD_PRESENT	/* Check if it points to a PTE page */
310	beq	2f			/* Bail if no table */
311
312	rlwimi	r11, r10, 22, 20, 29	/* Compute PTE address */
313	lwz	r11, 0(r11)		/* Get Linux PTE */
314	li	r9, _PAGE_PRESENT | _PAGE_ACCESSED
315	andc.	r9, r9, r11		/* Check permission */
316	bne	5f
317
318	rlwinm	r9, r11, 1, _PAGE_RW	/* dirty => rw */
319	and	r9, r9, r11		/* hwwrite = dirty & rw */
320	rlwimi	r11, r9, 0, _PAGE_RW	/* replace rw by hwwrite */
321
322	/* Create TLB tag.  This is the faulting address plus a static
323	 * set of bits.  These are size, valid, E, U0.
324	*/
325	li	r9, 0x00c0
326	rlwimi	r10, r9, 0, 20, 31
327
328	b	finish_tlb_load
329
3302:	/* Check for possible large-page pmd entry */
331	rlwinm.	r9, r11, 2, 22, 24
332	beq	5f
333
334	/* Create TLB tag.  This is the faulting address, plus a static
335	 * set of bits (valid, E, U0) plus the size from the PMD.
336	 */
337	ori	r9, r9, 0x40
338	rlwimi	r10, r9, 0, 20, 31
339
340	b	finish_tlb_load
341
3425:
343	/* The bailout.  Restore registers to pre-exception conditions
344	 * and call the heavyweights to help us out.
345	 */
346	mtspr	SPRN_PID, r12
347	mtcrf	0x80, r12
348	mfspr	r9, SPRN_SPRG_SCRATCH4
349	mfspr	r12, SPRN_SPRG_SCRATCH3
350	mfspr	r11, SPRN_SPRG_SCRATCH6
351	mfspr	r10, SPRN_SPRG_SCRATCH5
352	b	DataStorage
353
354/* 0x1200 - Instruction TLB Miss Exception
355 * Nearly the same as above, except we get our information from different
356 * registers and bailout to a different point.
357 */
358	START_EXCEPTION(0x1200,	ITLBMiss)
359	mtspr	SPRN_SPRG_SCRATCH5, r10	 /* Save some working registers */
360	mtspr	SPRN_SPRG_SCRATCH6, r11
361	mtspr	SPRN_SPRG_SCRATCH3, r12
362	mtspr	SPRN_SPRG_SCRATCH4, r9
363	mfcr	r12
364	mfspr	r9, SPRN_PID
365	rlwimi	r12, r9, 0, 0xff
366	mfspr	r10, SPRN_SRR0		/* Get faulting address */
367
368	/* If we are faulting a kernel address, we have to use the
369	 * kernel page tables.
370	 */
371	lis	r11, PAGE_OFFSET@h
372	cmplw	r10, r11
373	blt+	3f
374	lis	r11, swapper_pg_dir@h
375	ori	r11, r11, swapper_pg_dir@l
376	li	r9, 0
377	mtspr	SPRN_PID, r9		/* TLB will have 0 TID */
378	b	4f
379
380	/* Get the PGD for the current thread.
381	 */
3823:
383	mfspr	r11,SPRN_SPRG_THREAD
384	lwz	r11,PGDIR(r11)
385#ifdef CONFIG_PPC_KUAP
386	rlwinm.	r9, r9, 0, 0xff
387	beq	5f			/* Kuap fault */
388#endif
3894:
390	tophys(r11, r11)
391	rlwimi	r11, r10, 12, 20, 29	/* Create L1 (pgdir/pmd) address */
392	lwz	r11, 0(r11)		/* Get L1 entry */
393	andi.	r9, r11, _PMD_PRESENT	/* Check if it points to a PTE page */
394	beq	2f			/* Bail if no table */
395
396	rlwimi	r11, r10, 22, 20, 29	/* Compute PTE address */
397	lwz	r11, 0(r11)		/* Get Linux PTE */
398	li	r9, _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC
399	andc.	r9, r9, r11		/* Check permission */
400	bne	5f
401
402	rlwinm	r9, r11, 1, _PAGE_RW	/* dirty => rw */
403	and	r9, r9, r11		/* hwwrite = dirty & rw */
404	rlwimi	r11, r9, 0, _PAGE_RW	/* replace rw by hwwrite */
405
406	/* Create TLB tag.  This is the faulting address plus a static
407	 * set of bits.  These are size, valid, E, U0.
408	*/
409	li	r9, 0x00c0
410	rlwimi	r10, r9, 0, 20, 31
411
412	b	finish_tlb_load
413
4142:	/* Check for possible large-page pmd entry */
415	rlwinm.	r9, r11, 2, 22, 24
416	beq	5f
417
418	/* Create TLB tag.  This is the faulting address, plus a static
419	 * set of bits (valid, E, U0) plus the size from the PMD.
420	 */
421	ori	r9, r9, 0x40
422	rlwimi	r10, r9, 0, 20, 31
423
424	b	finish_tlb_load
425
4265:
427	/* The bailout.  Restore registers to pre-exception conditions
428	 * and call the heavyweights to help us out.
429	 */
430	mtspr	SPRN_PID, r12
431	mtcrf	0x80, r12
432	mfspr	r9, SPRN_SPRG_SCRATCH4
433	mfspr	r12, SPRN_SPRG_SCRATCH3
434	mfspr	r11, SPRN_SPRG_SCRATCH6
435	mfspr	r10, SPRN_SPRG_SCRATCH5
436	b	InstructionAccess
437
438	EXCEPTION(0x1300, Trap_13, unknown_exception)
439	EXCEPTION(0x1400, Trap_14, unknown_exception)
440	EXCEPTION(0x1500, Trap_15, unknown_exception)
441	EXCEPTION(0x1600, Trap_16, unknown_exception)
442	EXCEPTION(0x1700, Trap_17, unknown_exception)
443	EXCEPTION(0x1800, Trap_18, unknown_exception)
444	EXCEPTION(0x1900, Trap_19, unknown_exception)
445	EXCEPTION(0x1A00, Trap_1A, unknown_exception)
446	EXCEPTION(0x1B00, Trap_1B, unknown_exception)
447	EXCEPTION(0x1C00, Trap_1C, unknown_exception)
448	EXCEPTION(0x1D00, Trap_1D, unknown_exception)
449	EXCEPTION(0x1E00, Trap_1E, unknown_exception)
450	EXCEPTION(0x1F00, Trap_1F, unknown_exception)
451
452/* Check for a single step debug exception while in an exception
453 * handler before state has been saved.  This is to catch the case
454 * where an instruction that we are trying to single step causes
455 * an exception (eg ITLB/DTLB miss) and thus the first instruction of
456 * the exception handler generates a single step debug exception.
457 *
458 * If we get a debug trap on the first instruction of an exception handler,
459 * we reset the MSR_DE in the _exception handler's_ MSR (the debug trap is
460 * a critical exception, so we are using SPRN_CSRR1 to manipulate the MSR).
461 * The exception handler was handling a non-critical interrupt, so it will
462 * save (and later restore) the MSR via SPRN_SRR1, which will still have
463 * the MSR_DE bit set.
464 */
465	/* 0x2000 - Debug Exception */
466	START_EXCEPTION(0x2000, DebugTrap)
467	CRITICAL_EXCEPTION_PROLOG 0x2000 DebugTrap
468
469	/*
470	 * If this is a single step or branch-taken exception in an
471	 * exception entry sequence, it was probably meant to apply to
472	 * the code where the exception occurred (since exception entry
473	 * doesn't turn off DE automatically).  We simulate the effect
474	 * of turning off DE on entry to an exception handler by turning
475	 * off DE in the SRR3 value and clearing the debug status.
476	 */
477	mfspr	r10,SPRN_DBSR		/* check single-step/branch taken */
478	andis.	r10,r10,DBSR_IC@h
479	beq+	2f
480
481	andi.	r10,r9,MSR_IR|MSR_PR	/* check supervisor + MMU off */
482	beq	1f			/* branch and fix it up */
483
484	mfspr   r10,SPRN_SRR2		/* Faulting instruction address */
485	cmplwi  r10,0x2100
486	bgt+    2f			/* address above exception vectors */
487
488	/* here it looks like we got an inappropriate debug exception. */
4891:	rlwinm	r9,r9,0,~MSR_DE		/* clear DE in the SRR3 value */
490	lis	r10,DBSR_IC@h		/* clear the IC event */
491	mtspr	SPRN_DBSR,r10
492	/* restore state and get out */
493	lwz	r10,_CCR(r11)
494	lwz	r0,GPR0(r11)
495	lwz	r1,GPR1(r11)
496	mtcrf	0x80,r10
497	mtspr	SPRN_SRR2,r12
498	mtspr	SPRN_SRR3,r9
499	lwz	r9,GPR9(r11)
500	lwz	r12,GPR12(r11)
501	lwz	r10,crit_r10@l(0)
502	lwz	r11,crit_r11@l(0)
503	rfci
504	b	.
505
506	/* continue normal handling for a critical exception... */
5072:	mfspr	r4,SPRN_DBSR
508	stw	r4,_ESR(r11)		/* DebugException takes DBSR in _ESR */
509	prepare_transfer_to_handler
510	bl	DebugException
511	b	ret_from_crit_exc
512
513	/* Programmable Interval Timer (PIT) Exception. (from 0x1000) */
514	__HEAD
515Decrementer:
516	EXCEPTION_PROLOG 0x1000 Decrementer
517	lis	r0,TSR_PIS@h
518	mtspr	SPRN_TSR,r0		/* Clear the PIT exception */
519	prepare_transfer_to_handler
520	bl	timer_interrupt
521	b	interrupt_return
522
523	/* Fixed Interval Timer (FIT) Exception. (from 0x1010) */
524	__HEAD
525FITException:
526	EXCEPTION_PROLOG 0x1010 FITException
527	prepare_transfer_to_handler
528	bl	unknown_exception
529	b	interrupt_return
530
531	/* Watchdog Timer (WDT) Exception. (from 0x1020) */
532	__HEAD
533WDTException:
534	CRITICAL_EXCEPTION_PROLOG 0x1020 WDTException
535	prepare_transfer_to_handler
536	bl	WatchdogException
537	b	ret_from_crit_exc
538
539/* Other PowerPC processors, namely those derived from the 6xx-series
540 * have vectors from 0x2100 through 0x2F00 defined, but marked as reserved.
541 * However, for the 4xx-series processors these are neither defined nor
542 * reserved.
543 */
544
545	__HEAD
546	/* Damn, I came up one instruction too many to fit into the
547	 * exception space :-).  Both the instruction and data TLB
548	 * miss get to this point to load the TLB.
549	 * 	r10 - TLB_TAG value
550	 * 	r11 - Linux PTE
551	 *	r9 - available to use
552	 *	PID - loaded with proper value when we get here
553	 *	Upon exit, we reload everything and RFI.
554	 * Actually, it will fit now, but oh well.....a common place
555	 * to load the TLB.
556	 */
557tlb_4xx_index:
558	.long	0
559finish_tlb_load:
560	/*
561	 * Clear out the software-only bits in the PTE to generate the
562	 * TLB_DATA value.  These are the bottom 2 bits of the RPM, the
563	 * top 3 bits of the zone field, and M.
564	 */
565	li	r9, 0x0ce2
566	andc	r11, r11, r9
567
568	/* load the next available TLB index. */
569	lwz	r9, tlb_4xx_index@l(0)
570	addi	r9, r9, 1
571	andi.	r9, r9, PPC40X_TLB_SIZE - 1
572	stw	r9, tlb_4xx_index@l(0)
573
574	tlbwe	r11, r9, TLB_DATA		/* Load TLB LO */
575	tlbwe	r10, r9, TLB_TAG		/* Load TLB HI */
576
577	/* Done...restore registers and get out of here.
578	*/
579	mtspr	SPRN_PID, r12
580	mtcrf	0x80, r12
581	mfspr	r9, SPRN_SPRG_SCRATCH4
582	mfspr	r12, SPRN_SPRG_SCRATCH3
583	mfspr	r11, SPRN_SPRG_SCRATCH6
584	mfspr	r10, SPRN_SPRG_SCRATCH5
585	rfi			/* Should sync shadow TLBs */
586	b	.		/* prevent prefetch past rfi */
587
588/* This is where the main kernel code starts.
589 */
590start_here:
591
592	/* ptr to current */
593	lis	r2,init_task@h
594	ori	r2,r2,init_task@l
595
596	/* ptr to phys current thread */
597	tophys(r4,r2)
598	addi	r4,r4,THREAD	/* init task's THREAD */
599	mtspr	SPRN_SPRG_THREAD,r4
600
601	/* stack */
602	lis	r1,init_thread_union@ha
603	addi	r1,r1,init_thread_union@l
604	li	r0,0
605	stwu	r0,THREAD_SIZE-STACK_FRAME_OVERHEAD(r1)
606
607	bl	early_init	/* We have to do this with MMU on */
608
609/*
610 * Decide what sort of machine this is and initialize the MMU.
611 */
612#ifdef CONFIG_KASAN
613	bl	kasan_early_init
614#endif
615	li	r3,0
616	mr	r4,r31
617	bl	machine_init
618	bl	MMU_init
619
620/* Go back to running unmapped so we can load up new values
621 * and change to using our exception vectors.
622 * On the 4xx, all we have to do is invalidate the TLB to clear
623 * the old 16M byte TLB mappings.
624 */
625	lis	r4,2f@h
626	ori	r4,r4,2f@l
627	tophys(r4,r4)
628	lis	r3,(MSR_KERNEL & ~(MSR_IR|MSR_DR))@h
629	ori	r3,r3,(MSR_KERNEL & ~(MSR_IR|MSR_DR))@l
630	mtspr	SPRN_SRR0,r4
631	mtspr	SPRN_SRR1,r3
632	rfi
633	b	.		/* prevent prefetch past rfi */
634
635/* Load up the kernel context */
6362:
637	sync			/* Flush to memory before changing TLB */
638	tlbia
639	isync			/* Flush shadow TLBs */
640
641	/* set up the PTE pointers for the Abatron bdiGDB.
642	*/
643	lis	r6, swapper_pg_dir@h
644	ori	r6, r6, swapper_pg_dir@l
645	lis	r5, abatron_pteptrs@h
646	ori	r5, r5, abatron_pteptrs@l
647	stw	r5, 0xf0(0)	/* Must match your Abatron config file */
648	tophys(r5,r5)
649	stw	r6, 0(r5)
650
651/* Now turn on the MMU for real! */
652	lis	r4,MSR_KERNEL@h
653	ori	r4,r4,MSR_KERNEL@l
654	lis	r3,start_kernel@h
655	ori	r3,r3,start_kernel@l
656	mtspr	SPRN_SRR0,r3
657	mtspr	SPRN_SRR1,r4
658	rfi			/* enable MMU and jump to start_kernel */
659	b	.		/* prevent prefetch past rfi */
660
661/* Set up the initial MMU state so we can do the first level of
662 * kernel initialization.  This maps the first 32 MBytes of memory 1:1
663 * virtual to physical and more importantly sets the cache mode.
664 */
665initial_mmu:
666	tlbia			/* Invalidate all TLB entries */
667	isync
668
669	/* We should still be executing code at physical address 0x0000xxxx
670	 * at this point. However, start_here is at virtual address
671	 * 0xC000xxxx. So, set up a TLB mapping to cover this once
672	 * translation is enabled.
673	 */
674
675	lis	r3,KERNELBASE@h		/* Load the kernel virtual address */
676	ori	r3,r3,KERNELBASE@l
677	tophys(r4,r3)			/* Load the kernel physical address */
678
679	iccci	r0,r3			/* Invalidate the i-cache before use */
680
681	/* Load the kernel PID.
682	*/
683	li	r0,0
684	mtspr	SPRN_PID,r0
685	sync
686
687	/* Configure and load one entry into TLB slots 63 */
688	clrrwi	r4,r4,10		/* Mask off the real page number */
689	ori	r4,r4,(TLB_WR | TLB_EX)	/* Set the write and execute bits */
690
691	clrrwi	r3,r3,10		/* Mask off the effective page number */
692	ori	r3,r3,(TLB_VALID | TLB_PAGESZ(PAGESZ_16M))
693
694        li      r0,63                    /* TLB slot 63 */
695
696	tlbwe	r4,r0,TLB_DATA		/* Load the data portion of the entry */
697	tlbwe	r3,r0,TLB_TAG		/* Load the tag portion of the entry */
698
699	li	r0,62			/* TLB slot 62 */
700	addis	r4,r4,SZ_16M@h
701	addis	r3,r3,SZ_16M@h
702	tlbwe	r4,r0,TLB_DATA		/* Load the data portion of the entry */
703	tlbwe	r3,r0,TLB_TAG		/* Load the tag portion of the entry */
704
705	isync
706
707	/* Establish the exception vector base
708	*/
709	lis	r4,KERNELBASE@h		/* EVPR only uses the high 16-bits */
710	tophys(r0,r4)			/* Use the physical address */
711	mtspr	SPRN_EVPR,r0
712
713	blr
714
715_GLOBAL(abort)
716        mfspr   r13,SPRN_DBCR0
717        oris    r13,r13,DBCR0_RST_SYSTEM@h
718        mtspr   SPRN_DBCR0,r13
719