1/* SPDX-License-Identifier: GPL-2.0-only */ 2/* 3 * linux/arch/arm/kernel/head.S 4 * 5 * Copyright (C) 1994-2002 Russell King 6 * Copyright (c) 2003 ARM Limited 7 * All Rights Reserved 8 * 9 * Kernel startup code for all 32-bit CPUs 10 */ 11#include <linux/linkage.h> 12#include <linux/init.h> 13#include <linux/pgtable.h> 14 15#include <asm/assembler.h> 16#include <asm/cp15.h> 17#include <asm/domain.h> 18#include <asm/ptrace.h> 19#include <asm/asm-offsets.h> 20#include <asm/memory.h> 21#include <asm/thread_info.h> 22 23#if defined(CONFIG_DEBUG_LL) && !defined(CONFIG_DEBUG_SEMIHOSTING) 24#include CONFIG_DEBUG_LL_INCLUDE 25#endif 26/* 27 * swapper_pg_dir is the virtual address of the initial page table. 28 * We place the page tables 16K below KERNEL_RAM_VADDR. Therefore, we must 29 * make sure that KERNEL_RAM_VADDR is correctly set. Currently, we expect 30 * the least significant 16 bits to be 0x8000, but we could probably 31 * relax this restriction to KERNEL_RAM_VADDR >= PAGE_OFFSET + 0x4000. 32 */ 33#define KERNEL_RAM_VADDR (KERNEL_OFFSET + TEXT_OFFSET) 34#if (KERNEL_RAM_VADDR & 0xffff) != 0x8000 35#error KERNEL_RAM_VADDR must start at 0xXXXX8000 36#endif 37 38#ifdef CONFIG_ARM_LPAE 39 /* LPAE requires an additional page for the PGD */ 40#define PG_DIR_SIZE 0x5000 41#define PMD_ORDER 3 42#else 43#define PG_DIR_SIZE 0x4000 44#define PMD_ORDER 2 45#endif 46 47 .globl swapper_pg_dir 48 .equ swapper_pg_dir, KERNEL_RAM_VADDR - PG_DIR_SIZE 49 50 /* 51 * This needs to be assigned at runtime when the linker symbols are 52 * resolved. 53 */ 54 .pushsection .data 55 .align 2 56 .globl kernel_sec_start 57 .globl kernel_sec_end 58kernel_sec_start: 59 .long 0 60kernel_sec_end: 61 .long 0 62 .popsection 63 64 .macro pgtbl, rd, phys 65 add \rd, \phys, #TEXT_OFFSET 66 sub \rd, \rd, #PG_DIR_SIZE 67 .endm 68 69/* 70 * Kernel startup entry point. 71 * --------------------------- 72 * 73 * This is normally called from the decompressor code. The requirements 74 * are: MMU = off, D-cache = off, I-cache = dont care, r0 = 0, 75 * r1 = machine nr, r2 = atags or dtb pointer. 76 * 77 * This code is mostly position independent, so if you link the kernel at 78 * 0xc0008000, you call this at __pa(0xc0008000). 79 * 80 * See linux/arch/arm/tools/mach-types for the complete list of machine 81 * numbers for r1. 82 * 83 * We're trying to keep crap to a minimum; DO NOT add any machine specific 84 * crap here - that's what the boot loader (or in extreme, well justified 85 * circumstances, zImage) is for. 86 */ 87 .arm 88 89 __HEAD 90ENTRY(stext) 91 ARM_BE8(setend be ) @ ensure we are in BE8 mode 92 93 THUMB( badr r9, 1f ) @ Kernel is always entered in ARM. 94 THUMB( bx r9 ) @ If this is a Thumb-2 kernel, 95 THUMB( .thumb ) @ switch to Thumb now. 96 THUMB(1: ) 97 98#ifdef CONFIG_ARM_VIRT_EXT 99 bl __hyp_stub_install 100#endif 101 @ ensure svc mode and all interrupts masked 102 safe_svcmode_maskall r9 103 104 mrc p15, 0, r9, c0, c0 @ get processor id 105 bl __lookup_processor_type @ r5=procinfo r9=cpuid 106 movs r10, r5 @ invalid processor (r5=0)? 107 THUMB( it eq ) @ force fixup-able long branch encoding 108 beq __error_p @ yes, error 'p' 109 110#ifdef CONFIG_ARM_LPAE 111 mrc p15, 0, r3, c0, c1, 4 @ read ID_MMFR0 112 and r3, r3, #0xf @ extract VMSA support 113 cmp r3, #5 @ long-descriptor translation table format? 114 THUMB( it lo ) @ force fixup-able long branch encoding 115 blo __error_lpae @ only classic page table format 116#endif 117 118#ifndef CONFIG_XIP_KERNEL 119 adr_l r8, _text @ __pa(_text) 120 sub r8, r8, #TEXT_OFFSET @ PHYS_OFFSET 121#else 122 ldr r8, =PLAT_PHYS_OFFSET @ always constant in this case 123#endif 124 125 /* 126 * r1 = machine no, r2 = atags or dtb, 127 * r8 = phys_offset, r9 = cpuid, r10 = procinfo 128 */ 129 bl __vet_atags 130#ifdef CONFIG_SMP_ON_UP 131 bl __fixup_smp 132#endif 133#ifdef CONFIG_ARM_PATCH_PHYS_VIRT 134 bl __fixup_pv_table 135#endif 136 bl __create_page_tables 137 138 /* 139 * The following calls CPU specific code in a position independent 140 * manner. See arch/arm/mm/proc-*.S for details. r10 = base of 141 * xxx_proc_info structure selected by __lookup_processor_type 142 * above. 143 * 144 * The processor init function will be called with: 145 * r1 - machine type 146 * r2 - boot data (atags/dt) pointer 147 * r4 - translation table base (low word) 148 * r5 - translation table base (high word, if LPAE) 149 * r8 - translation table base 1 (pfn if LPAE) 150 * r9 - cpuid 151 * r13 - virtual address for __enable_mmu -> __turn_mmu_on 152 * 153 * On return, the CPU will be ready for the MMU to be turned on, 154 * r0 will hold the CPU control register value, r1, r2, r4, and 155 * r9 will be preserved. r5 will also be preserved if LPAE. 156 */ 157 ldr r13, =__mmap_switched @ address to jump to after 158 @ mmu has been enabled 159 badr lr, 1f @ return (PIC) address 160#ifdef CONFIG_ARM_LPAE 161 mov r5, #0 @ high TTBR0 162 mov r8, r4, lsr #12 @ TTBR1 is swapper_pg_dir pfn 163#else 164 mov r8, r4 @ set TTBR1 to swapper_pg_dir 165#endif 166 ldr r12, [r10, #PROCINFO_INITFUNC] 167 add r12, r12, r10 168 ret r12 1691: b __enable_mmu 170ENDPROC(stext) 171 .ltorg 172 173/* 174 * Setup the initial page tables. We only setup the barest 175 * amount which are required to get the kernel running, which 176 * generally means mapping in the kernel code. 177 * 178 * r8 = phys_offset, r9 = cpuid, r10 = procinfo 179 * 180 * Returns: 181 * r0, r3, r5-r7 corrupted 182 * r4 = physical page table address 183 */ 184__create_page_tables: 185 pgtbl r4, r8 @ page table address 186 187 /* 188 * Clear the swapper page table 189 */ 190 mov r0, r4 191 mov r3, #0 192 add r6, r0, #PG_DIR_SIZE 1931: str r3, [r0], #4 194 str r3, [r0], #4 195 str r3, [r0], #4 196 str r3, [r0], #4 197 teq r0, r6 198 bne 1b 199 200#ifdef CONFIG_ARM_LPAE 201 /* 202 * Build the PGD table (first level) to point to the PMD table. A PGD 203 * entry is 64-bit wide. 204 */ 205 mov r0, r4 206 add r3, r4, #0x1000 @ first PMD table address 207 orr r3, r3, #3 @ PGD block type 208 mov r6, #4 @ PTRS_PER_PGD 209 mov r7, #1 << (55 - 32) @ L_PGD_SWAPPER 2101: 211#ifdef CONFIG_CPU_ENDIAN_BE8 212 str r7, [r0], #4 @ set top PGD entry bits 213 str r3, [r0], #4 @ set bottom PGD entry bits 214#else 215 str r3, [r0], #4 @ set bottom PGD entry bits 216 str r7, [r0], #4 @ set top PGD entry bits 217#endif 218 add r3, r3, #0x1000 @ next PMD table 219 subs r6, r6, #1 220 bne 1b 221 222 add r4, r4, #0x1000 @ point to the PMD tables 223#ifdef CONFIG_CPU_ENDIAN_BE8 224 add r4, r4, #4 @ we only write the bottom word 225#endif 226#endif 227 228 ldr r7, [r10, #PROCINFO_MM_MMUFLAGS] @ mm_mmuflags 229 230 /* 231 * Create identity mapping to cater for __enable_mmu. 232 * This identity mapping will be removed by paging_init(). 233 */ 234 adr_l r5, __turn_mmu_on @ _pa(__turn_mmu_on) 235 adr_l r6, __turn_mmu_on_end @ _pa(__turn_mmu_on_end) 236 mov r5, r5, lsr #SECTION_SHIFT 237 mov r6, r6, lsr #SECTION_SHIFT 238 2391: orr r3, r7, r5, lsl #SECTION_SHIFT @ flags + kernel base 240 str r3, [r4, r5, lsl #PMD_ORDER] @ identity mapping 241 cmp r5, r6 242 addlo r5, r5, #1 @ next section 243 blo 1b 244 245 /* 246 * The main matter: map in the kernel using section mappings, and 247 * set two variables to indicate the physical start and end of the 248 * kernel. 249 */ 250 add r0, r4, #KERNEL_OFFSET >> (SECTION_SHIFT - PMD_ORDER) 251 ldr r6, =(_end - 1) 252 adr_l r5, kernel_sec_start @ _pa(kernel_sec_start) 253 str r8, [r5] @ Save physical start of kernel 254 orr r3, r8, r7 @ Add the MMU flags 255 add r6, r4, r6, lsr #(SECTION_SHIFT - PMD_ORDER) 2561: str r3, [r0], #1 << PMD_ORDER 257 add r3, r3, #1 << SECTION_SHIFT 258 cmp r0, r6 259 bls 1b 260 eor r3, r3, r7 @ Remove the MMU flags 261 adr_l r5, kernel_sec_end @ _pa(kernel_sec_end) 262 str r3, [r5] @ Save physical end of kernel 263 264#ifdef CONFIG_XIP_KERNEL 265 /* 266 * Map the kernel image separately as it is not located in RAM. 267 */ 268#define XIP_START XIP_VIRT_ADDR(CONFIG_XIP_PHYS_ADDR) 269 mov r3, pc 270 mov r3, r3, lsr #SECTION_SHIFT 271 orr r3, r7, r3, lsl #SECTION_SHIFT 272 add r0, r4, #(XIP_START & 0xff000000) >> (SECTION_SHIFT - PMD_ORDER) 273 str r3, [r0, #((XIP_START & 0x00f00000) >> SECTION_SHIFT) << PMD_ORDER]! 274 ldr r6, =(_edata_loc - 1) 275 add r0, r0, #1 << PMD_ORDER 276 add r6, r4, r6, lsr #(SECTION_SHIFT - PMD_ORDER) 2771: cmp r0, r6 278 add r3, r3, #1 << SECTION_SHIFT 279 strls r3, [r0], #1 << PMD_ORDER 280 bls 1b 281#endif 282 283 /* 284 * Then map boot params address in r2 if specified. 285 * We map 2 sections in case the ATAGs/DTB crosses a section boundary. 286 */ 287 mov r0, r2, lsr #SECTION_SHIFT 288 cmp r2, #0 289 ldrne r3, =FDT_FIXED_BASE >> (SECTION_SHIFT - PMD_ORDER) 290 addne r3, r3, r4 291 orrne r6, r7, r0, lsl #SECTION_SHIFT 292 strne r6, [r3], #1 << PMD_ORDER 293 addne r6, r6, #1 << SECTION_SHIFT 294 strne r6, [r3] 295 296#if defined(CONFIG_ARM_LPAE) && defined(CONFIG_CPU_ENDIAN_BE8) 297 sub r4, r4, #4 @ Fixup page table pointer 298 @ for 64-bit descriptors 299#endif 300 301#ifdef CONFIG_DEBUG_LL 302#if !defined(CONFIG_DEBUG_ICEDCC) && !defined(CONFIG_DEBUG_SEMIHOSTING) 303 /* 304 * Map in IO space for serial debugging. 305 * This allows debug messages to be output 306 * via a serial console before paging_init. 307 */ 308 addruart r7, r3, r0 309 310 mov r3, r3, lsr #SECTION_SHIFT 311 mov r3, r3, lsl #PMD_ORDER 312 313 add r0, r4, r3 314 mov r3, r7, lsr #SECTION_SHIFT 315 ldr r7, [r10, #PROCINFO_IO_MMUFLAGS] @ io_mmuflags 316 orr r3, r7, r3, lsl #SECTION_SHIFT 317#ifdef CONFIG_ARM_LPAE 318 mov r7, #1 << (54 - 32) @ XN 319#ifdef CONFIG_CPU_ENDIAN_BE8 320 str r7, [r0], #4 321 str r3, [r0], #4 322#else 323 str r3, [r0], #4 324 str r7, [r0], #4 325#endif 326#else 327 orr r3, r3, #PMD_SECT_XN 328 str r3, [r0], #4 329#endif 330 331#else /* CONFIG_DEBUG_ICEDCC || CONFIG_DEBUG_SEMIHOSTING */ 332 /* we don't need any serial debugging mappings */ 333 ldr r7, [r10, #PROCINFO_IO_MMUFLAGS] @ io_mmuflags 334#endif 335 336#if defined(CONFIG_ARCH_NETWINDER) || defined(CONFIG_ARCH_CATS) 337 /* 338 * If we're using the NetWinder or CATS, we also need to map 339 * in the 16550-type serial port for the debug messages 340 */ 341 add r0, r4, #0xff000000 >> (SECTION_SHIFT - PMD_ORDER) 342 orr r3, r7, #0x7c000000 343 str r3, [r0] 344#endif 345#ifdef CONFIG_ARCH_RPC 346 /* 347 * Map in screen at 0x02000000 & SCREEN2_BASE 348 * Similar reasons here - for debug. This is 349 * only for Acorn RiscPC architectures. 350 */ 351 add r0, r4, #0x02000000 >> (SECTION_SHIFT - PMD_ORDER) 352 orr r3, r7, #0x02000000 353 str r3, [r0] 354 add r0, r4, #0xd8000000 >> (SECTION_SHIFT - PMD_ORDER) 355 str r3, [r0] 356#endif 357#endif 358#ifdef CONFIG_ARM_LPAE 359 sub r4, r4, #0x1000 @ point to the PGD table 360#endif 361 ret lr 362ENDPROC(__create_page_tables) 363 .ltorg 364 365#if defined(CONFIG_SMP) 366 .text 367 .arm 368ENTRY(secondary_startup_arm) 369 THUMB( badr r9, 1f ) @ Kernel is entered in ARM. 370 THUMB( bx r9 ) @ If this is a Thumb-2 kernel, 371 THUMB( .thumb ) @ switch to Thumb now. 372 THUMB(1: ) 373ENTRY(secondary_startup) 374 /* 375 * Common entry point for secondary CPUs. 376 * 377 * Ensure that we're in SVC mode, and IRQs are disabled. Lookup 378 * the processor type - there is no need to check the machine type 379 * as it has already been validated by the primary processor. 380 */ 381 382 ARM_BE8(setend be) @ ensure we are in BE8 mode 383 384#ifdef CONFIG_ARM_VIRT_EXT 385 bl __hyp_stub_install_secondary 386#endif 387 safe_svcmode_maskall r9 388 389 mrc p15, 0, r9, c0, c0 @ get processor id 390 bl __lookup_processor_type 391 movs r10, r5 @ invalid processor? 392 moveq r0, #'p' @ yes, error 'p' 393 THUMB( it eq ) @ force fixup-able long branch encoding 394 beq __error_p 395 396 /* 397 * Use the page tables supplied from __cpu_up. 398 */ 399 adr_l r3, secondary_data 400 mov_l r12, __secondary_switched 401 ldrd r4, r5, [r3, #0] @ get secondary_data.pgdir 402ARM_BE8(eor r4, r4, r5) @ Swap r5 and r4 in BE: 403ARM_BE8(eor r5, r4, r5) @ it can be done in 3 steps 404ARM_BE8(eor r4, r4, r5) @ without using a temp reg. 405 ldr r8, [r3, #8] @ get secondary_data.swapper_pg_dir 406 badr lr, __enable_mmu @ return address 407 mov r13, r12 @ __secondary_switched address 408 ldr r12, [r10, #PROCINFO_INITFUNC] 409 add r12, r12, r10 @ initialise processor 410 @ (return control reg) 411 ret r12 412ENDPROC(secondary_startup) 413ENDPROC(secondary_startup_arm) 414 415ENTRY(__secondary_switched) 416 ldr_l r7, secondary_data + 12 @ get secondary_data.stack 417 mov sp, r7 418 mov fp, #0 419 b secondary_start_kernel 420ENDPROC(__secondary_switched) 421 422#endif /* defined(CONFIG_SMP) */ 423 424 425 426/* 427 * Setup common bits before finally enabling the MMU. Essentially 428 * this is just loading the page table pointer and domain access 429 * registers. All these registers need to be preserved by the 430 * processor setup function (or set in the case of r0) 431 * 432 * r0 = cp#15 control register 433 * r1 = machine ID 434 * r2 = atags or dtb pointer 435 * r4 = TTBR pointer (low word) 436 * r5 = TTBR pointer (high word if LPAE) 437 * r9 = processor ID 438 * r13 = *virtual* address to jump to upon completion 439 */ 440__enable_mmu: 441#if defined(CONFIG_ALIGNMENT_TRAP) && __LINUX_ARM_ARCH__ < 6 442 orr r0, r0, #CR_A 443#else 444 bic r0, r0, #CR_A 445#endif 446#ifdef CONFIG_CPU_DCACHE_DISABLE 447 bic r0, r0, #CR_C 448#endif 449#ifdef CONFIG_CPU_BPREDICT_DISABLE 450 bic r0, r0, #CR_Z 451#endif 452#ifdef CONFIG_CPU_ICACHE_DISABLE 453 bic r0, r0, #CR_I 454#endif 455#ifdef CONFIG_ARM_LPAE 456 mcrr p15, 0, r4, r5, c2 @ load TTBR0 457#else 458 mov r5, #DACR_INIT 459 mcr p15, 0, r5, c3, c0, 0 @ load domain access register 460 mcr p15, 0, r4, c2, c0, 0 @ load page table pointer 461#endif 462 b __turn_mmu_on 463ENDPROC(__enable_mmu) 464 465/* 466 * Enable the MMU. This completely changes the structure of the visible 467 * memory space. You will not be able to trace execution through this. 468 * If you have an enquiry about this, *please* check the linux-arm-kernel 469 * mailing list archives BEFORE sending another post to the list. 470 * 471 * r0 = cp#15 control register 472 * r1 = machine ID 473 * r2 = atags or dtb pointer 474 * r9 = processor ID 475 * r13 = *virtual* address to jump to upon completion 476 * 477 * other registers depend on the function called upon completion 478 */ 479 .align 5 480 .pushsection .idmap.text, "ax" 481ENTRY(__turn_mmu_on) 482 mov r0, r0 483 instr_sync 484 mcr p15, 0, r0, c1, c0, 0 @ write control reg 485 mrc p15, 0, r3, c0, c0, 0 @ read id reg 486 instr_sync 487 mov r3, r3 488 mov r3, r13 489 ret r3 490__turn_mmu_on_end: 491ENDPROC(__turn_mmu_on) 492 .popsection 493 494 495#ifdef CONFIG_SMP_ON_UP 496 __HEAD 497__fixup_smp: 498 and r3, r9, #0x000f0000 @ architecture version 499 teq r3, #0x000f0000 @ CPU ID supported? 500 bne __fixup_smp_on_up @ no, assume UP 501 502 bic r3, r9, #0x00ff0000 503 bic r3, r3, #0x0000000f @ mask 0xff00fff0 504 mov r4, #0x41000000 505 orr r4, r4, #0x0000b000 506 orr r4, r4, #0x00000020 @ val 0x4100b020 507 teq r3, r4 @ ARM 11MPCore? 508 reteq lr @ yes, assume SMP 509 510 mrc p15, 0, r0, c0, c0, 5 @ read MPIDR 511 and r0, r0, #0xc0000000 @ multiprocessing extensions and 512 teq r0, #0x80000000 @ not part of a uniprocessor system? 513 bne __fixup_smp_on_up @ no, assume UP 514 515 @ Core indicates it is SMP. Check for Aegis SOC where a single 516 @ Cortex-A9 CPU is present but SMP operations fault. 517 mov r4, #0x41000000 518 orr r4, r4, #0x0000c000 519 orr r4, r4, #0x00000090 520 teq r3, r4 @ Check for ARM Cortex-A9 521 retne lr @ Not ARM Cortex-A9, 522 523 @ If a future SoC *does* use 0x0 as the PERIPH_BASE, then the 524 @ below address check will need to be #ifdef'd or equivalent 525 @ for the Aegis platform. 526 mrc p15, 4, r0, c15, c0 @ get SCU base address 527 teq r0, #0x0 @ '0' on actual UP A9 hardware 528 beq __fixup_smp_on_up @ So its an A9 UP 529 ldr r0, [r0, #4] @ read SCU Config 530ARM_BE8(rev r0, r0) @ byteswap if big endian 531 and r0, r0, #0x3 @ number of CPUs 532 teq r0, #0x0 @ is 1? 533 retne lr 534 535__fixup_smp_on_up: 536 adr_l r4, __smpalt_begin 537 adr_l r5, __smpalt_end 538 b __do_fixup_smp_on_up 539ENDPROC(__fixup_smp) 540 541 .pushsection .data 542 .align 2 543 .globl smp_on_up 544smp_on_up: 545 ALT_SMP(.long 1) 546 ALT_UP(.long 0) 547 .popsection 548#endif 549 550 .text 551__do_fixup_smp_on_up: 552 cmp r4, r5 553 reths lr 554 ldmia r4, {r0, r6} 555 ARM( str r6, [r0, r4] ) 556 THUMB( add r0, r0, r4 ) 557 add r4, r4, #8 558#ifdef __ARMEB__ 559 THUMB( mov r6, r6, ror #16 ) @ Convert word order for big-endian. 560#endif 561 THUMB( strh r6, [r0], #2 ) @ For Thumb-2, store as two halfwords 562 THUMB( mov r6, r6, lsr #16 ) @ to be robust against misaligned r0. 563 THUMB( strh r6, [r0] ) 564 b __do_fixup_smp_on_up 565ENDPROC(__do_fixup_smp_on_up) 566 567ENTRY(fixup_smp) 568 stmfd sp!, {r4 - r6, lr} 569 mov r4, r0 570 add r5, r0, r1 571 bl __do_fixup_smp_on_up 572 ldmfd sp!, {r4 - r6, pc} 573ENDPROC(fixup_smp) 574 575#include "head-common.S" 576