[U-Boot-Users] Need help understanding cpu/mpc85xx/start.S
Hi all,
My custom 85xx board code off of the latest u-boot git repo is dying - or locking up the bdi somehow - and I've spent the last few days trying to understand the code and how the bdi can tell me what the registers are doing.
Starting with the basics: R1 has a 4K stack from 0xfffff000-0xffffffff and the stack grows down?
Here's the part of the code I'm crashing in and which I trying to understand, shown here from vim with lines enabled:
158 bl tlb1_entry 159 mr r5,r0 160 lwzu r4,0(r5) /* how many TLB1 entries we actually use */ 161 mtctr r4 162 163 0: lwzu r6,4(r5) 164 lwzu r7,4(r5) 165 lwzu r8,4(r5) 166 lwzu r9,4(r5) 167 mtspr MAS0,r6 168 mtspr MAS1,r7 169 mtspr MAS2,r8 170 mtspr MAS3,r9 171 isync 172 msync 173 tlbwe 174 isync 175 bdnz 0b 176 177 1:
Are lines 158-171 setting up the TLB's as defined by 'bl tlb1_entry' ?
Line 160 is disassembled to be address fffff0b8 , which I can set a breakpoint to and analyze as follows:
ATUM>bi 0xfffff0b8 Breakpoint identification is 0 ATUM>go - TARGET: stopped ATUM>info Target CPU : MPC85xx (e500v2 rev.2) Target state : halted Debug entry cause : instruction breakpoint Current PC : 0xfffff0b8 Current CR : 0x00000000 Current MSR : 0x00000200 Current LR : 0xfffff0b4 Current CCSRBAR : 0x0_e0000000 ATUM>rd GPR00: fffff210 fffff0b4 00010001 00000000 GPR04: 00000000 fffff210 00000000 00000000 GPR08: 00000000 00000000 00000000 00000000 GPR12: 00000000 00000000 00000000 00000000 GPR16: 00000000 00000000 00000000 00000000 GPR20: 00000000 00000000 00000000 00000000 GPR24: 00000000 00000000 00000000 00000000 GPR28: 00000000 00000000 00000000 00000000 CR : 00000000 MSR: 00000200 ATUM>mdh 0xfffff210 2 0_fffff210 : 0x0000 0 .. 0_fffff212 : 0x000b 11 ..
I read the above to say that the 'rd' command shows all Rx registers as zero based, and R5 is fffff210. Line 160's 'lwzu r4,0(r5)' will read a 16bit word of a value of 'b' and assign it to R4, confirmed by the next 'ti' :
ATUM>ti Target CPU : MPC85xx (e500v2 rev.2) Target state : halted Debug entry cause : single step Current PC : 0xfffff0bc Current CR : 0x00000000 Current MSR : 0x00000200 Current LR : 0xfffff0b4 Current CCSRBAR : 0x0_e0000000 ATUM>rd GPR00: fffff210 fffff0b4 00010001 00000000 GPR04: 0000000b fffff210 00000000 00000000 GPR08: 00000000 00000000 00000000 00000000 GPR12: 00000000 00000000 00000000 00000000 GPR16: 00000000 00000000 00000000 00000000 GPR20: 00000000 00000000 00000000 00000000 GPR24: 00000000 00000000 00000000 00000000 GPR28: 00000000 00000000 00000000 00000000 CR : 00000000 MSR: 00000200
Here's the part where my code or the bdi is crashing, line 163 which is mapped as fffff0c0 :
163 0: lwzu r6,4(r5)
I can single step or set a breakpoint as shown below:
ATUM>info Target CPU : MPC85xx (e500v2 rev.2) Target state : halted Debug entry cause : instruction breakpoint Current PC : 0xfffff0c0 Current CR : 0x00000000 Current MSR : 0x00000200 Current LR : 0xfffff0b4 Current CCSRBAR : 0x0_e0000000 ATUM>rd GPR00: fffff210 fffff0b4 00010001 00000000 GPR04: 0000000b fffff210 00000000 00000000 GPR08: 00000000 00000000 00000000 00000000 GPR12: 00000000 00000000 00000000 00000000 GPR16: 00000000 00000000 00000000 00000000 GPR20: 00000000 00000000 00000000 00000000 GPR24: 00000000 00000000 00000000 00000000 GPR28: 00000000 00000000 00000000 00000000 CR : 00000000 MSR: 00000200
'lwzu r6,4(r5)' as I read it says: load a word from R5 + 4 bytes, ie, address fffff214:
ATUM>mdh 0xfffff214 2 0_fffff214 : 0x0000 0 .. 0_fffff216 : 0x0000 0 ..
Disassembled u-boot in both my code _and_ current MPC8548CDS shows:
fffff214: 00 00 00 00 .long 0x0
Is my problem is that I am assigning zero here? I'm confused since the CDS code seems to work the same way. The result of single stepping consistently results in:
ATUM>info Target CPU : MPC85xx (e500v2 rev.2) Target state : halted Debug entry cause : instruction breakpoint Current PC : 0xfffff0c0 Current CR : 0x00000000 Current MSR : 0x00000200 Current LR : 0xfffff0b4 Current CCSRBAR : 0x0_e0000000 ATUM>ti - Core status is 0x0041 *** Core is stopped, no debugging possible # PPC: timeout while waiting for halt ATUM> Target CPU : MPC85xx (e500v2 rev.2) Target state : running # Step timeout detected
I sent a question to Abatron technical support about this in the case its a bdi issue - still waiting to see what they say.
Any clues please? Robert
robert lazarski wrote:
Hi all,
My custom 85xx board code off of the latest u-boot git repo is dying - or locking up the bdi somehow - and I've spent the last few days trying to understand the code and how the bdi can tell me what the registers are doing.
Starting with the basics: R1 has a 4K stack from 0xfffff000-0xffffffff and the stack grows down?
Here's the part of the code I'm crashing in and which I trying to understand, shown here from vim with lines enabled:
158 bl tlb1_entry 159 mr r5,r0 160 lwzu r4,0(r5) /* how many TLB1 entries we actually use */ 161 mtctr r4 162 163 0: lwzu r6,4(r5) 164 lwzu r7,4(r5) 165 lwzu r8,4(r5) 166 lwzu r9,4(r5) 167 mtspr MAS0,r6 168 mtspr MAS1,r7 169 mtspr MAS2,r8 170 mtspr MAS3,r9 171 isync 172 msync 173 tlbwe 174 isync 175 bdnz 0b 176 177 1:
Are lines 158-171 setting up the TLB's as defined by 'bl tlb1_entry' ?
Sounds like a good guess.
Here is my guess: you should go through tlb1_entry() with a fine tooth comb and see exactly what it is doing with the TLBs and why that is messing you up.
Where the processor "crashes" is very likely a delayed reaction to a tlb screwup. What happens is that some instructions remain in the processor's prefetch queue so the processor will continue to execute for a little while. Playing with MMUs (TLBs) is like playing with grenades... they don't go off immediately when you pull the pin. DAMHIKT ;-)
When I have a crash in perfectly valid code, I look upstream a few instructions.
Line 160 is disassembled to be address fffff0b8 , which I can set a breakpoint to and analyze as follows:
ATUM>bi 0xfffff0b8 Breakpoint identification is 0 ATUM>go
- TARGET: stopped
ATUM>info Target CPU : MPC85xx (e500v2 rev.2) Target state : halted Debug entry cause : instruction breakpoint Current PC : 0xfffff0b8 Current CR : 0x00000000 Current MSR : 0x00000200 Current LR : 0xfffff0b4 Current CCSRBAR : 0x0_e0000000 ATUM>rd GPR00: fffff210 fffff0b4 00010001 00000000 GPR04: 00000000 fffff210 00000000 00000000 GPR08: 00000000 00000000 00000000 00000000 GPR12: 00000000 00000000 00000000 00000000 GPR16: 00000000 00000000 00000000 00000000 GPR20: 00000000 00000000 00000000 00000000 GPR24: 00000000 00000000 00000000 00000000 GPR28: 00000000 00000000 00000000 00000000 CR : 00000000 MSR: 00000200 ATUM>mdh 0xfffff210 2 0_fffff210 : 0x0000 0 .. 0_fffff212 : 0x000b 11 ..
I read the above to say that the 'rd' command shows all Rx registers as zero based, and R5 is fffff210.
Yes.
Line 160's 'lwzu r4,0(r5)' will read a 16bit word of a value of 'b' and assign it to R4, confirmed by the next 'ti' :
No, 32 bit word. Time to crack your PPC opcode manual. The lwzu instruction reads the *32 bit* value pointed to by r5 with a zero offset, and updates r5 with r5+offset. Since the offset is zero in this case, r5 still points to 0xfffff210.
The "z" in the lwzu opcode means the upper 32 bits would be zeroed if r4 had 64 bits (lhzu zeros the upper 16 bits, lbzu zeros the upper 24 bits). Since your processor is 32 bits, the "z" is meaningless.
When you get into the loop, however, the offset is 4: 163 0: lwzu r6,4(r5) so r6 (in this case will be loaded from 0xfffff210+4) and r5 will be "updated" to be 0xfffff214. Thus r5 steps through the table.
As discussed above, however, I *strongly* suspect you have a messed up TLB and the grenade only goes off here in the middle of innocent instructions.
Any clues please? Robert
Good luck, gvb
On 9/26/07, Jerry Van Baren gerald.vanbaren@smiths-aerospace.com wrote:
robert lazarski wrote:
As discussed above, however, I *strongly* suspect you have a messed up TLB and the grenade only goes off here in the middle of innocent instructions.
Any clues please? Robert
Good luck, gvb
That makes sense - my TLB's are probably hosed somehow and was masking the error to be something else. Perhaps another set of eyes can see my problem? My code is below. I've tried removing TLB's to get a first pass thru but nothing is working for me. Thanks! Robert
/* * Copyright 2004, 2007 Freescale Semiconductor. * Copyright 2002,2003, Motorola Inc. * * See file CREDITS for list of people who contributed to this * project. * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License as * published by the Free Software Foundation; either version 2 of * the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, * MA 02111-1307 USA */
#include <ppc_asm.tmpl> #include <ppc_defs.h> #include <asm/cache.h> #include <asm/mmu.h> #include <config.h> #include <mpc85xx.h>
#define LAWAR_TRGT_PCI1 0x00000000 #define LAWAR_TRGT_PCI2 0x00100000 #define LAWAR_TRGT_PCIE 0x00200000 #define LAWAR_TRGT_DDR 0x00f00000
/* * TLB0 and TLB1 Entries * * Out of reset, TLB1's Entry 0 maps the highest 4K for CCSRBAR. * However, CCSRBAR is then relocated to CFG_CCSRBAR right after * these TLB entries are established. * * The TLB entries for DDR are dynamically setup in spd_sdram() * and use TLB1 Entries 8 through 15 as needed according to the * size of DDR memory. * * MAS0: tlbsel, esel, nv * MAS1: valid, iprot, tid, ts, tsize * MAS2: epn, sharen, x0, x1, w, i, m, g, e * MAS3: rpn, u0-u3, ux, sx, uw, sw, ur, sr */
#define entry_start \ mflr r1 ; \ bl 0f ;
#define entry_end \ 0: mflr r0 ; \ mtlr r1 ; \ blr ;
.section .bootpg, "ax" .globl tlb1_entry tlb1_entry: entry_start
/* * Number of TLB0 and TLB1 entries in the following table */ .long (2f-1f)/16
1: /* * TLB0 4K Non-cacheable, guarded * 0xff700000 4K Initial CCSRBAR mapping * * This ends up at a TLB0 Index==0 entry, and must not collide * with other TLB0 Entries. */ .long TLB1_MAS0(0, 0, 0) .long TLB1_MAS1(1, 0, 0, 0, 0) .long TLB1_MAS2(E500_TLB_EPN(CFG_CCSRBAR_DEFAULT), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_CCSRBAR_DEFAULT), 0,0,0,0,0,1,0,1,0,1)
/* * TLB0 16K Cacheable, guarded * Temporary Global data for initialization * * Use four 4K TLB0 entries. These entries must be cacheable * as they provide the bootstrap memory before the memory * controler and real memory have been configured. * * These entries end up at TLB0 Indicies 0x10, 0x14, 0x18 and 0x1c, * and must not collide with other TLB0 entries. */ .long TLB1_MAS0(0, 0, 0) .long TLB1_MAS1(1, 0, 0, 0, 0) .long TLB1_MAS2(E500_TLB_EPN(CFG_INIT_RAM_ADDR), 0,0,0,0,0,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_INIT_RAM_ADDR), 0,0,0,0,0,1,0,1,0,1)
.long TLB1_MAS0(0, 0, 0) .long TLB1_MAS1(1, 0, 0, 0, 0) .long TLB1_MAS2(E500_TLB_EPN(CFG_INIT_RAM_ADDR + 4 * 1024), 0,0,0,0,0,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_INIT_RAM_ADDR + 4 * 1024), 0,0,0,0,0,1,0,1,0,1)
.long TLB1_MAS0(0, 0, 0) .long TLB1_MAS1(1, 0, 0, 0, 0) .long TLB1_MAS2(E500_TLB_EPN(CFG_INIT_RAM_ADDR + 8 * 1024), 0,0,0,0,0,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_INIT_RAM_ADDR + 8 * 1024), 0,0,0,0,0,1,0,1,0,1)
.long TLB1_MAS0(0, 0, 0) .long TLB1_MAS1(1, 0, 0, 0, 0) .long TLB1_MAS2(E500_TLB_EPN(CFG_INIT_RAM_ADDR + 12 * 1024), 0,0,0,0,0,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_INIT_RAM_ADDR + 12 * 1024), 0,0,0,0,0,1,0,1,0,1)
/* * TLB 0, 1: 128M Non-cacheable, guarded * 0xf8000000 128M FLASH * Out of reset this entry is only 4K. */ .long TLB1_MAS0(1, 1, 0) .long TLB1_MAS1(1, 1, 0, 0, BOOKE_PAGESZ_64M) .long TLB1_MAS2(E500_TLB_EPN(CFG_FLASH_BASE), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_FLASH_BASE), 0,0,0,0,0,1,0,1,0,1) .long TLB1_MAS0(1, 0, 0) .long TLB1_MAS1(1, 1, 0, 0, BOOKE_PAGESZ_64M) .long TLB1_MAS2(E500_TLB_EPN(CFG_FLASH_BASE+0x4000000), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_FLASH_BASE+0x4000000), 0,0,0,0,0,1,0,1,0,1)
/* * TLB 2: 1G Non-cacheable, guarded * 0x80000000 1G PCI1/PCIE 8,9,a,b */ .long TLB1_MAS0(1, 2, 0) .long TLB1_MAS1(1, 1, 0, 0, BOOKE_PAGESZ_1G) .long TLB1_MAS2(E500_TLB_EPN(CFG_PCI_PHYS), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_PCI_PHYS), 0,0,0,0,0,1,0,1,0,1)
/* * TLB 3, 4: 512M Non-cacheable, guarded * 0xc0000000 1G PCI2 */ .long TLB1_MAS0(1, 3, 0) .long TLB1_MAS1(1, 1, 0, 0, BOOKE_PAGESZ_256M) .long TLB1_MAS2(E500_TLB_EPN(CFG_PCI2_MEM_PHYS), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_PCI2_MEM_PHYS), 0,0,0,0,0,1,0,1,0,1) .long TLB1_MAS0(1, 4, 0) .long TLB1_MAS1(1, 1, 0, 0, BOOKE_PAGESZ_256M) .long TLB1_MAS2(E500_TLB_EPN(CFG_PCI2_MEM_PHYS + 0x10000000), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_PCI2_MEM_PHYS + 0x10000000), 0,0,0,0,0,1,0,1,0,1)
/* * TLB 5: 64M Non-cacheable, guarded * 0xe000_0000 1M CCSRBAR * 0xe200_0000 1M PCI1 IO * 0xe210_0000 1M PCI2 IO * 0xe300_0000 1M PCIe IO */ .long TLB1_MAS0(1, 5, 0) .long TLB1_MAS1(1, 1, 0, 0, BOOKE_PAGESZ_64M) .long TLB1_MAS2(E500_TLB_EPN(CFG_CCSRBAR), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_CCSRBAR), 0,0,0,0,0,1,0,1,0,1)
2: entry_end
/* * LAW(Local Access Window) configuration: * * 0x0000_0000 0x7fff_ffff DDR 2G * 0x8000_0000 0x9fff_ffff PCI1 MEM 512M * 0xa000_0000 0xbfff_ffff PCIe MEM 512M * 0xc000_0000 0xdfff_ffff PCI2 MEM 512M * 0xe000_0000 0xe000_ffff CCSR 1M * 0xe200_0000 0xe10f_ffff PCI1 IO 1M * 0xe280_0000 0xe20f_ffff PCI2 IO 1M * 0xe300_0000 0xe30f_ffff PCIe IO 1M * 0xf800_0000 0xffff_ffff FLASH (boot bank) 128M * * Notes: * CCSRBAR and L2-as-SRAM don't need a configured Local Access Window. * If flash is 8M at default position (last 8M), no LAW needed. * * LAW 0 is reserved for boot mapping */
.section .bootpg, "ax" .globl law_entry law_entry: entry_start
.long (4f-3f)/8 3: .long 0 .long (LAWAR_TRGT_DDR | (LAWAR_SIZE & LAWAR_SIZE_128M)) & ~LAWAR_EN
.long (CFG_PCI1_MEM_PHYS>>12) & 0xfffff .long LAWAR_EN | LAWAR_TRGT_PCI1 | (LAWAR_SIZE & LAWAR_SIZE_512M)
.long (CFG_PCI1_IO_PHYS>>12) & 0xfffff .long LAWAR_EN | LAWAR_TRGT_PCI1 | (LAWAR_SIZE & LAWAR_SIZE_1M)
.long (CFG_PCI2_MEM_PHYS>>12) & 0xfffff .long LAWAR_EN | LAWAR_TRGT_PCI2 | (LAWAR_SIZE & LAWAR_SIZE_512M)
.long (CFG_PCI2_IO_PHYS>>12) & 0xfffff .long LAWAR_EN | LAWAR_TRGT_PCI2 | (LAWAR_SIZE & LAWAR_SIZE_1M)
.long (CFG_PCIE1_MEM_PHYS>>12) & 0xfffff .long LAWAR_EN | LAWAR_TRGT_PCIE | (LAWAR_SIZE & LAWAR_SIZE_512M)
.long (CFG_PCIE1_IO_PHYS>>12) & 0xfffff .long LAWAR_EN | LAWAR_TRGT_PCIE | (LAWAR_SIZE & LAWAR_SIZE_1M) 4: entry_end
/* * (C) Copyright 2007 * Robert Lazarski, Instituto Atlantico, robertlazarski@gmail.com * * Copyright 2004, 2007 Freescale Semiconductor. * * See file CREDITS for list of people who contributed to this * project. * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License as * published by the Free Software Foundation; either version 2 of * the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, * MA 02111-1307 USA */
/* * mpc8548atum board configuration file * * Please refer to doc/README.mpc85xxatum for more info. * */ #ifndef __CONFIG_H #define __CONFIG_H
/* Debug Options */ #define CONFIG_PANIC_HANG 1 /* Disable in production */ #define DEBUG 1 /* Disable in production */
/* High Level Configuration Options */ #define CONFIG_BOOKE 1 /* BOOKE */ #define CONFIG_E500 1 /* BOOKE e500 family */ #define CONFIG_MPC85xx 1 /* MPC8540/60/55/41/48 */ #define CONFIG_MPC8548 1 /* MPC8548 specific */
#define CONFIG_PCI 1 /* enable any pci type devices */ #define CONFIG_PCI1 1 /* PCI controller 1 */ #define CONFIG_PCIE1 1 /* PCIE controler 1 (slot 1) */ #define CONFIG_PCI2 1 /* PCI controller 2 */ #define CONFIG_FSL_PCI_INIT 1 /* Use common FSL init code */
#define CONFIG_TSEC_ENET 1 /* tsec ethernet support */ #define CONFIG_ENV_OVERWRITE #define CONFIG_SPD_EEPROM 1 /* Use SPD EEPROM for DDR setup*/ #undef CONFIG_DDR_2T_TIMING /* Sets the 2T timing bit */
#define CONFIG_DDR_ECC /* only for ECC DDR module */ #define CONFIG_ECC_INIT_VIA_DDRCONTROLLER /* DDR controller or DMA? */ #define CONFIG_MEM_INIT_VALUE 0xDeadBeef #define CONFIG_INTERRUPTS /* enable pci, srio, ddr interrupts */
#define MPC85xx_DDR_SDRAM_CLK_CNTL /* 85xx has clock control reg */
#ifndef __ASSEMBLY__ extern unsigned long get_board_sys_clk(unsigned long dummy); #endif #define CONFIG_SYS_CLK_FREQ get_board_sys_clk(0) /* sysclk for MPC85xx */
/* * These can be toggled for performance analysis, otherwise use default. */ #define CONFIG_L2_CACHE /* toggle L2 cache */ #define CONFIG_BTB /* toggle branch predition */ #define CONFIG_ADDR_STREAMING /* toggle addr streaming */ #define CONFIG_CLEAR_LAW0 /* Clear LAW0 in cpu_init_r */
/* * Only possible on E500 Version 2 or newer cores. */ #define CONFIG_ENABLE_36BIT_PHYS 1
#define CONFIG_BOARD_EARLY_INIT_F 1 /* Call board_pre_init */
#undef CFG_DRAM_TEST /* memory test, takes time */ #define CFG_MEMTEST_START 0x00000000 #define CFG_MEMTEST_END 0x10000000
/* * Base addresses -- Note these are effective addresses where the * actual resources get mapped (not physical addresses) */ #define CFG_CCSRBAR_DEFAULT 0xff700000 /* CCSRBAR Default */ #define CFG_CCSRBAR 0xe0000000 /* relocated CCSRBAR */ #define CFG_IMMR CFG_CCSRBAR /* PQII uses CFG_IMMR */
#define CFG_PCI1_ADDR (CFG_CCSRBAR+0x8000) #define CFG_PCI2_ADDR (CFG_CCSRBAR+0x9000) #define CFG_PCIE1_ADDR (CFG_CCSRBAR+0xa000)
/* * DDR Setup */ #define CFG_DDR_SDRAM_BASE 0x00000000 /* DDR is system memory*/ #define CFG_SDRAM_BASE CFG_DDR_SDRAM_BASE
#define SPD_EEPROM_ADDRESS 0x51 /* DDR DIMM */
/* * Make sure required options are set */ #ifndef CONFIG_SPD_EEPROM #error ("CONFIG_SPD_EEPROM is required") #endif
#undef CONFIG_CLOCKS_IN_MHZ
/* * Local Bus Definitions */
/* * FLASH on the Local Bus * based on flash chip S29GL01GP * One bank, 128M, using the CFI driver. * Boot from BR0 bank at 0xf800_0000 * * BR0: * Base address 0 = 0xF8000000 = BR0[0:16] = 1111 1000 0000 0000 0 * Port Size = 16 bits = BRx[19:20] = 10 * Use GPCM = BRx[24:26] = 000 * Valid = BRx[31] = 1 * * 0 4 8 12 16 20 24 28 * 1111 1000 0000 0000 0001 0000 0000 0001 = f8001001 BR0 * * OR0: * Addr Mask = 128M = ORx[0:16] = 1111 1000 0000 0000 0 * Reserved ORx[17:18] = 00 * CSNT = ORx[20] = 1 * ACS = half cycle delay = ORx[21:22] = 11 * SCY = 6 = ORx[24:27] = 0110 * TRLX = use relaxed timing = ORx[29] = 1 * EAD = use external address latch delay = OR[31] = 1 * * 0 4 8 12 16 20 24 28 * 1111 1000 0000 0000 0000 1110 0110 0101 = f8000E65 ORx */
#define CFG_BOOT_BLOCK 0xf8000000 /* boot TLB block */ #define CFG_FLASH_BASE CFG_BOOT_BLOCK /* start of FLASH 128M */
#define CFG_BR0_PRELIM 0xf8001001
#define CFG_OR0_PRELIM 0xf8000E65
#define CFG_FLASH_BANKS_LIST {CFG_FLASH_BASE} #define CFG_MAX_FLASH_BANKS 1 /* number of banks */ #define CFG_MAX_FLASH_SECT 1024 /* sectors per device */ #undef CFG_FLASH_CHECKSUM #define CFG_FLASH_ERASE_TOUT 512000 /* Flash Erase Timeout (ms) */ #define CFG_FLASH_WRITE_TOUT 8000 /* Flash Write Timeout (ms) */
#define CFG_MONITOR_BASE TEXT_BASE /* start of monitor */
#define CFG_FLASH_CFI_DRIVER 1 #define CFG_FLASH_CFI 1 #define CFG_FLASH_EMPTY_INFO
/* Memory */ #define CFG_INIT_RAM_LOCK 1 #define CFG_INIT_RAM_ADDR 0xe4010000 /* Initial RAM address */ #define CFG_INIT_RAM_END 0x4000 /* End of used area in RAM */
#define CFG_INIT_L2_ADDR 0xf8f80000 /* relocate boot L2SRAM */
#define CFG_GBL_DATA_SIZE 128 /* num bytes initial data */ #define CFG_GBL_DATA_OFFSET (CFG_INIT_RAM_END - CFG_GBL_DATA_SIZE) #define CFG_INIT_SP_OFFSET CFG_GBL_DATA_OFFSET
#define CFG_MONITOR_LEN (256 * 1024) /* Reserve 256 kB for Mon */ #define CFG_MALLOC_LEN (128 * 1024) /* Reserved for malloc */
/* Serial Port */ #define CONFIG_CONS_INDEX 2 #undef CONFIG_SERIAL_SOFTWARE_FIFO #define CFG_NS16550 #define CFG_NS16550_SERIAL #define CFG_NS16550_REG_SIZE 1 #define CFG_NS16550_CLK get_bus_freq(0)
#define CFG_BAUDRATE_TABLE \ {300, 600, 1200, 2400, 4800, 9600, 19200, 38400,115200}
#define CFG_NS16550_COM1 (CFG_CCSRBAR+0x4500) #define CFG_NS16550_COM2 (CFG_CCSRBAR+0x4600)
/* Use the HUSH parser */ #define CFG_HUSH_PARSER #ifdef CFG_HUSH_PARSER #define CFG_PROMPT_HUSH_PS2 "> " #endif
/* pass open firmware flat tree */ #define CONFIG_OF_FLAT_TREE 1 #define CONFIG_OF_BOARD_SETUP 1
/* maximum size of the flat tree (8K) */ #define OF_FLAT_TREE_MAX_SIZE 8192
#define OF_CPU "PowerPC,8548@0" #define OF_SOC "soc8548@e0000000" #define OF_TBCLK (bd->bi_busfreq / 8) #define OF_STDOUT_PATH "/soc8548@e0000000/serial@4600"
/* * I2C */ #define CONFIG_FSL_I2C /* Use FSL common I2C driver */ #define CONFIG_HARD_I2C /* I2C with hardware support*/ #undef CONFIG_SOFT_I2C /* I2C bit-banged */ #define CFG_I2C_SPEED 400000 /* I2C speed and slave address */ #define CFG_I2C_EEPROM_ADDR 0x57 #define CFG_I2C_SLAVE 0x7F #define CFG_I2C_NOPROBES {0x69} /* Don't probe these addrs */ #define CFG_I2C_OFFSET 0x3000
/* * General PCI * Memory space is mapped 1-1, but I/O space must start from 0. */ #define CFG_PCI_PHYS 0x80000000 /* 1G PCI TLB */
#define CFG_PCI1_MEM_BASE 0x80000000 #define CFG_PCI1_MEM_PHYS CFG_PCI1_MEM_BASE #define CFG_PCI1_MEM_SIZE 0x20000000 /* 512M */ #define CFG_PCI1_IO_BASE 0x00000000 #define CFG_PCI1_IO_PHYS 0xe2000000 #define CFG_PCI1_IO_SIZE 0x00100000 /* 1M */
#ifdef CONFIG_PCI2 #define CFG_PCI2_MEM_BASE 0xC0000000 #define CFG_PCI2_MEM_PHYS CFG_PCI2_MEM_BASE #define CFG_PCI2_MEM_SIZE 0x20000000 /* 512M */ #define CFG_PCI2_IO_BASE 0x00000000 #define CFG_PCI2_IO_PHYS 0xe2800000 #define CFG_PCI2_IO_SIZE 0x00100000 /* 1M */ #endif
#ifdef CONFIG_PCIE1 #define CFG_PCIE1_MEM_BASE 0xa0000000 #define CFG_PCIE1_MEM_PHYS CFG_PCIE1_MEM_BASE #define CFG_PCIE1_MEM_SIZE 0x20000000 /* 512M */ #define CFG_PCIE1_IO_BASE 0x00000000 #define CFG_PCIE1_IO_PHYS 0xe3000000 #define CFG_PCIE1_IO_SIZE 0x00100000 /* 1M */ #endif
#if !defined(CONFIG_PCI_PNP) #define PCI_ENET0_IOADDR 0xe0000000 #define PCI_ENET0_MEMADDR 0xe0000000 #define PCI_IDSEL_NUMBER 0x0c /* slot0->3(IDSEL)=12->15 */ #endif
#if defined(CONFIG_PCI)
#define CONFIG_NET_MULTI #define CONFIG_PCI_PNP /* do pci plug-and-play */
#undef CONFIG_EEPRO100 #undef CONFIG_TULIP
#undef CONFIG_PCI_SCAN_SHOW /* show pci devices on startup */
/* PCI view of System Memory */ #define CFG_PCI_MEMORY_BUS 0x00000000 #define CFG_PCI_MEMORY_PHYS 0x00000000 #define CFG_PCI_MEMORY_SIZE 0x80000000
#endif /* CONFIG_PCI */
#if defined(CONFIG_TSEC_ENET)
#ifndef CONFIG_NET_MULTI #define CONFIG_NET_MULTI 1 #endif
#define CONFIG_MII 1 /* MII PHY management */ #define CONFIG_TSEC1 1 #define CONFIG_TSEC1_NAME "eTSEC0" #define CONFIG_TSEC2 1 #define CONFIG_TSEC2_NAME "eTSEC1" #define CONFIG_TSEC3 1 #define CONFIG_TSEC3_NAME "eTSEC2" #define CONFIG_TSEC4 1 #define CONFIG_TSEC4_NAME "eTSEC3" #undef CONFIG_MPC85XX_FEC
#define TSEC1_PHY_ADDR 0 #define TSEC2_PHY_ADDR 1 #define TSEC3_PHY_ADDR 2 #define TSEC4_PHY_ADDR 3
#define TSEC1_PHYIDX 0 #define TSEC2_PHYIDX 0 #define TSEC3_PHYIDX 0 #define TSEC4_PHYIDX 0 #define TSEC1_FLAGS TSEC_GIGABIT #define TSEC2_FLAGS TSEC_GIGABIT #define TSEC3_FLAGS TSEC_GIGABIT #define TSEC4_FLAGS TSEC_GIGABIT
/* Options are: eTSEC[0-3] */ #define CONFIG_ETHPRIME "eTSEC0" #define CONFIG_PHY_GIGE 1 /* Include GbE speed/duplex detection */ #endif /* CONFIG_TSEC_ENET */
/* * Environment */ #define CFG_ENV_IS_IN_FLASH 1 #define CFG_ENV_ADDR (CFG_MONITOR_BASE + 0x40000) #define CFG_ENV_SECT_SIZE 0x40000 /* 256K(one sector) for env */ #define CFG_ENV_SIZE 0x2000
#define CONFIG_LOADS_ECHO 1 /* echo on for serial download */ #define CFG_LOADS_BAUD_CHANGE 1 /* allow baudrate change */
/* * BOOTP options */ #define CONFIG_BOOTP_BOOTFILESIZE #define CONFIG_BOOTP_BOOTPATH #define CONFIG_BOOTP_GATEWAY #define CONFIG_BOOTP_HOSTNAME
/* * Command line configuration. */ #include <config_cmd_default.h>
#define CONFIG_CMD_PING #define CONFIG_CMD_I2C #define CONFIG_CMD_MII
#if defined(CONFIG_PCI) #define CONFIG_CMD_PCI #endif
#undef CONFIG_WATCHDOG /* watchdog disabled */
/* * Miscellaneous configurable options */ #define CFG_LONGHELP /* undef to save memory */ #define CFG_LOAD_ADDR 0x2000000 /* default load address */ #define CFG_PROMPT "=> " /* Monitor Command Prompt */ #if defined(CONFIG_CMD_KGDB) #define CFG_CBSIZE 1024 /* Console I/O Buffer Size */ #else #define CFG_CBSIZE 256 /* Console I/O Buffer Size */ #endif #define CFG_PBSIZE (CFG_CBSIZE+sizeof(CFG_PROMPT)+16) /* Print Buffer Size */ #define CFG_MAXARGS 16 /* max number of command args */ #define CFG_BARGSIZE CFG_CBSIZE /* Boot Argument Buffer Size */ #define CFG_HZ 1000 /* decrementer freq: 1ms ticks */
/* * For booting Linux, the board info and command line data * have to be in the first 8 MB of memory, since this is * the maximum mapped by the Linux kernel during initialization. */ #define CFG_BOOTMAPSZ (8 << 20) /* Initial Memory map for Linux*/
/* Cache Configuration */ #define CFG_DCACHE_SIZE 32768 #define CFG_CACHELINE_SIZE 32 #if defined(CONFIG_CMD_KGDB) #define CFG_CACHELINE_SHIFT 5 /*log base 2 of the above value*/ #endif
/* * Internal Definitions * * Boot Flags */ #define BOOTFLAG_COLD 0x01 /* Normal Power-On: Boot from FLASH */ #define BOOTFLAG_WARM 0x02 /* Software reboot */
#if defined(CONFIG_CMD_KGDB) #define CONFIG_KGDB_BAUDRATE 230400 /* speed to run kgdb serial port */ #define CONFIG_KGDB_SER_INDEX 2 /* which serial port to use */ #endif
/* * Environment Configuration */
/* The mac addresses for all ethernet interface */ #if defined(CONFIG_TSEC_ENET) #define CONFIG_HAS_ETH0 #define CONFIG_ETHADDR 00:E0:0C:00:00:FD #define CONFIG_HAS_ETH1 #define CONFIG_ETH1ADDR 00:E0:0C:00:01:FD #define CONFIG_HAS_ETH2 #define CONFIG_ETH2ADDR 00:E0:0C:00:02:FD #define CONFIG_HAS_ETH3 #define CONFIG_ETH3ADDR 00:E0:0C:00:03:FD #endif
#define CONFIG_IPADDR 10.101.43.112
#define CONFIG_HOSTNAME unknown #define CONFIG_ROOTPATH /nfsroot #define CONFIG_BOOTFILE 8548atum/uImage.uboot #define CONFIG_UBOOTPATH 8548cds/u-boot.bin /* TFTP server */
#define CONFIG_SERVERIP 10.101.43.10 #define CONFIG_GATEWAYIP 10.101.45.1 #define CONFIG_NETMASK 255.255.248.0
#define CONFIG_LOADADDR 1000000 /*default location for tftp and bootm*/
#define CONFIG_BOOTDELAY 10 /* -1 disables auto-boot */ #undef CONFIG_BOOTARGS /* the boot command will set bootargs*/
#define CONFIG_BAUDRATE 115200
#if defined(CONFIG_PCIE1) #define PCIE_ENV \ "pciereg=md ${a}000 6; md ${a}020 4; md ${a}bf8 2; echo o;md ${a}c00 25;" \ "echo i; md ${a}da0 15; echo e;md ${a}e00 e; echo d; md ${a}f00 c\0" \ "pcieerr=md ${a}020 1; md ${a}e00 e; pci d.b $b.0 7 1; pci d.w $b.0 1e 1;" \ "pci d.w $b.0 56 1; pci d $b.0 104 1; pci d $b.0 110 1;" \ "pci d $b.0 130 1\0" \ "pcieerrc=mw ${a}020 ffffffff; mw ${a}e00 ffffffff; pci w.b $b.0 7 ff;" \ "pci w.w $b.0 1e ffff; pci w.w $b.0 56 ffff; pci w $b.0 104 ffffffff;"\ "pci w $b.0 110 ffffffff; pci w $b.0 130 ffffffff\0" \ "pciecfg=pci d $b.0 0 20; pci d $b.0 100 e; pci d $b.0 400 69\0" \ "pcie1regs=setenv a e000a; run pciereg\0" \ "pcie1cfg=setenv b 3; run pciecfg\0" \ "pcie1err=setenv a e000a; setenv b 3; run pcieerr\0" \ "pcie1errc=setenv a e000a; setenv b 3; run pcieerrc\0" #else #define PCIE_ENV "" #endif
#if defined(CONFIG_PCI1) || defined(CONFIG_PCI2) #define PCI_ENV \ "pcireg=md ${a}000 3; echo o;md ${a}c00 25; echo i; md ${a}da0 15;" \ "echo e;md ${a}e00 9\0" \ "pcierr=md ${a}e00 8; pci d.b $b.0 7 1;pci d.w $b.0 1e 1;" \ "pci d.w $b.0 56 1\0" \ "pcierrc=mw ${a}e00 ffffffff; mw ${a}e0c 0; pci w.b $b.0 7 ff;" \ "pci w.w $b.0 1e ffff; pci w.w $b.0 56 ffff\0" #else #define PCI_ENV "" #endif
#if defined(CONFIG_PCI1) #define PCI_ENV1 \ "pci1regs=setenv a e0008; run pcireg\0" \ "pci1err=setenv a e0008; setenv b 0; run pcierr\0" \ "pci1errc=setenv a e0008; setenv b 0; run pcierrc\0" #else #define PCI_ENV1 "" #endif
#if defined(CONFIG_PCI2) #define PCI_ENV2 \ "pci2regs=setenv a e0009; run pcireg\0" \ "pci2err=setenv a e0009; setenv b 123; run pcierr\0" \ "pci2errc=setenv a e0009; setenv b 123; run pcierrc\0" #else #define PCI_ENV2 "" #endif
#if defined(CONFIG_TSEC_ENET) #define ENET_ENV \ "enetreg1=md ${a}000 2; md ${a}010 9; md ${a}050 4; md ${a}08c 1;" \ "md ${a}098 2\0" \ "enetregt=echo t;md ${a}100 6; md ${a}140 2; md ${a}180 10; md ${a}200 10\0" \ "enetregr=echo r;md ${a}300 6; md ${a}330 5; md ${a}380 10; md ${a}400 10\0" \ "enetregm=echo mac;md ${a}500 5; md ${a}520 28;echo fifo;md ${a}a00 1;" \ "echo mib;md ${a}680 31\0" \ "enetreg=run enetreg1; run enetregm; run enetregt; run enetregr\0" \ "enet1regs=setenv a e0024; run enetreg\0" \ "enet2regs=setenv a e0025; run enetreg\0" \ "enet3regs=setenv a e0026; run enetreg\0" \ "enet4regs=setenv a e0027; run enetreg\0" #else #define ENET_ENV "" #endif
#define CONFIG_EXTRA_ENV_SETTINGS \ "netdev=eth0\0" \ "uboot=" MK_STR(CONFIG_UBOOTPATH) "\0" \ "tftpflash=tftpboot $loadaddr $uboot; " \ "protect off " MK_STR(TEXT_BASE) " +$filesize; " \ "erase " MK_STR(TEXT_BASE) " +$filesize; " \ "cp.b $loadaddr " MK_STR(TEXT_BASE) " $filesize; " \ "protect on " MK_STR(TEXT_BASE) " +$filesize; " \ "cmp.b $loadaddr " MK_STR(TEXT_BASE) " $filesize\0" \ "consoledev=ttyS0\0" \ "ramdiskaddr=2000000\0" \ "ramdiskfile=ramdisk.uboot\0" \ "dtbaddr=c00000\0" \ "dtbfile=mpc8548atum.dtb\0" \ "eoi=mw e00400b0 0\0" \ "iack=md e00400a0 1\0" \ "ddrreg=md ${a}000 8; md ${a}080 8;md ${a}100 d; md ${a}140 4; md ${a}bf0 4;" \ "md ${a}e00 3; md ${a}e20 3; md ${a}e40 7; md ${a}f00 5\0" \ "ddrregs=setenv a e0002; run ddrreg\0" \ "gureg=md ${a}000 2c; md ${a}0b0 1; md ${a}0c0 1; md ${a}b20 3;" \ "md ${a}e00 1; md ${a}e60 1; md ${a}ef0 15\0" \ "guregs=setenv a e00e0; run gureg\0" \ "ecmreg=md ${a}000 1; md ${a}010 1; md ${a}bf8 2; md ${a}e00 6\0" \ "ecmregs=setenv a e0001; run ecmreg\0" \ "lawregs=md e0000c08 4b\0" \ "lbcregs=md e0005000 36\0" \ "dma0regs=md e0021100 12\0" \ "dma1regs=md e0021180 12\0" \ "dma2regs=md e0021200 12\0" \ "dma3regs=md e0021280 12\0" \ PCIE_ENV \ PCI_ENV \ PCI_ENV1 \ PCI_ENV2 \ ENET_ENV
#define CONFIG_NFSBOOTCOMMAND \ "setenv bootargs root=/dev/nfs rw " \ "nfsroot=$serverip:$rootpath " \ "ip=$ipaddr:$serverip:$gatewayip:$netmask:$hostname:$netdev:off " \ "console=$consoledev,$baudrate $othbootargs;" \ "tftp $loadaddr $bootfile;" \ "tftp $dtbaddr $dtbfile;" \ "bootm $loadaddr - $dtbaddr"
#define CONFIG_RAMBOOTCOMMAND \ "setenv bootargs root=/dev/ram rw " \ "console=$consoledev,$baudrate $othbootargs;" \ "tftp $ramdiskaddr $ramdiskfile;" \ "tftp $loadaddr $bootfile;" \ "tftp $dtbaddr $dtbfile;" \ "bootm $loadaddr $ramdiskaddr $dtbaddr"
#define CONFIG_BOOTCOMMAND CONFIG_NFSBOOTCOMMAND
#endif /* __CONFIG_H */
On 9/26/07, robert lazarski robertlazarski@gmail.com wrote:
On 9/26/07, Jerry Van Baren gerald.vanbaren@smiths-aerospace.com wrote:
robert lazarski wrote:
.long TLB1_MAS0(0, 0, 0) .long TLB1_MAS1(1, 0, 0, 0, 0) .long TLB1_MAS2(E500_TLB_EPN(CFG_CCSRBAR_DEFAULT), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_CCSRBAR_DEFAULT), 0,0,0,0,0,1,0,1,0,1)
You might not need this entry. I think you're covering it with the Flash mapping. This is probably true for some other boards, and I don't think it's your problem, but having two mappings for the same virtual address space is technically a programming error. It just happens that there's no negative side effect on e500.
* These entries end up at TLB0 Indicies 0x10, 0x14, 0x18 and 0x1c, * and must not collide with other TLB0 entries. */ .long TLB1_MAS0(0, 0, 0) .long TLB1_MAS1(1, 0, 0, 0, 0) .long TLB1_MAS2(E500_TLB_EPN(CFG_INIT_RAM_ADDR), 0,0,0,0,0,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_INIT_RAM_ADDR), 0,0,0,0,0,1,0,1,0,1)
What did you set CFG_INIT_RAM_ADDR to?
/* * TLB 0, 1: 128M Non-cacheable, guarded * 0xf8000000 128M FLASH * Out of reset this entry is only 4K. */ .long TLB1_MAS0(1, 1, 0) .long TLB1_MAS1(1, 1, 0, 0, BOOKE_PAGESZ_64M) .long TLB1_MAS2(E500_TLB_EPN(CFG_FLASH_BASE), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_FLASH_BASE), 0,0,0,0,0,1,0,1,0,1) .long TLB1_MAS0(1, 0, 0) .long TLB1_MAS1(1, 1, 0, 0, BOOKE_PAGESZ_64M) .long TLB1_MAS2(E500_TLB_EPN(CFG_FLASH_BASE+0x4000000), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_FLASH_BASE+0x4000000), 0,0,0,0,0,1,0,1,0,1)
Try reordering these entries so that TLB1, entry 0 is initialized before TLB1, entry 1. I'm fighting a cold right now, so I'm not thinking of any good reason why this is necessary, but I know that's how I did it on the 8568 MDS board.
Another possibility to consider is that the BDI's config that you are using is creating its own bad mappings.
Andy
On 9/26/07, Andy Fleming afleming@gmail.com wrote:
On 9/26/07, robert lazarski robertlazarski@gmail.com wrote:
On 9/26/07, Jerry Van Baren gerald.vanbaren@smiths-aerospace.com wrote:
robert lazarski wrote:
.long TLB1_MAS0(0, 0, 0) .long TLB1_MAS1(1, 0, 0, 0, 0) .long TLB1_MAS2(E500_TLB_EPN(CFG_CCSRBAR_DEFAULT), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_CCSRBAR_DEFAULT), 0,0,0,0,0,1,0,1,0,1)You might not need this entry. I think you're covering it with the Flash mapping. This is probably true for some other boards, and I don't think it's your problem, but having two mappings for the same virtual address space is technically a programming error. It just happens that there's no negative side effect on e500.
I tried removing it, but I still get the same error.
* These entries end up at TLB0 Indicies 0x10, 0x14, 0x18 and 0x1c, * and must not collide with other TLB0 entries. */ .long TLB1_MAS0(0, 0, 0) .long TLB1_MAS1(1, 0, 0, 0, 0) .long TLB1_MAS2(E500_TLB_EPN(CFG_INIT_RAM_ADDR), 0,0,0,0,0,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_INIT_RAM_ADDR), 0,0,0,0,0,1,0,1,0,1)What did you set CFG_INIT_RAM_ADDR to?
0xe4010000 . Seems like a lot of boards do that - what is the significance of this address? This gets used only after relocation, is that correct? I only have DDR2. This is actually TLB0 if I understand correctly, TLB1 processing is actually where my code seems to die, right?
/* * TLB 0, 1: 128M Non-cacheable, guarded * 0xf8000000 128M FLASH * Out of reset this entry is only 4K. */ .long TLB1_MAS0(1, 1, 0) .long TLB1_MAS1(1, 1, 0, 0, BOOKE_PAGESZ_64M) .long TLB1_MAS2(E500_TLB_EPN(CFG_FLASH_BASE), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_FLASH_BASE), 0,0,0,0,0,1,0,1,0,1) .long TLB1_MAS0(1, 0, 0) .long TLB1_MAS1(1, 1, 0, 0, BOOKE_PAGESZ_64M) .long TLB1_MAS2(E500_TLB_EPN(CFG_FLASH_BASE+0x4000000), 0,0,0,0,1,0,1,0) .long TLB1_MAS3(E500_TLB_RPN(CFG_FLASH_BASE+0x4000000), 0,0,0,0,0,1,0,1,0,1)Try reordering these entries so that TLB1, entry 0 is initialized before TLB1, entry 1. I'm fighting a cold right now, so I'm not thinking of any good reason why this is necessary, but I know that's how I did it on the 8568 MDS board.
Tried that, seemingly no help. I really am thinking my flash is the culprit here though - its the first thing parsed through the loop in start.S right?. I tried both locking and unlocking my flash in the bdi config file, but I seen no change. With my 128MB of flash unlocked vi the bdi config, I can write to the beginning as shown here:
ATUM>erase 0xF8000000 0x4000 0x20 Erasing flash at 0xf8000000 ... ATUM>mmh 0xf8000000 0xcafe ATUM>mdh 0xf8000000 1 0_f8000000 : 0xcafe -13570 ..
Is there anything I can do further to see if my flash is the cause of my problems?
Another possibility to consider is that the BDI's config that you are using is creating its own bad mappings.
Andy
I've looked at the bdi config a lot today. I think I get the 'core is stopped' issue because of my IVOR15 is bad. I'm hoping if I can fix that I might be able to get better clues on what is wrong. Abatron support tells me:
"As mentioned in the manual, debugging works only if the Debug Interrupt (IVOR15) points to a valid, mapped and therefore executable opcode. If not then the core will crash!"
Any suggestions on what that needs to be when debugging before relocation? This doesn't seem to be working for me - I'm not using a workspace:
WSPR 63 0xffff0000 ;IVPR to boot core WSPR 415 0x0000f000 ;IVOR15 : Debug exception
Another thing: I seemingly can skip IVOR15 all together by using GDB - so says arbartron:
One way to debug code where the above conditions are not meet, is to use "BREAKMODE LOOP" and then use GDB to debug. Use always "run to cursor" or make sure that you remove the breakpoint that triggers before you continue, this to prevent GDB to do any single stepping.
I started the bdi in BREAKMODE LOOP, but the gdb part if not working for me. I can connect to the bdi, and I can hit the beginning of start.S. Anything after that appears to be dying on me - still working on it.
Thanks all, Robert
On 9/26/07, robert lazarski robertlazarski@gmail.com wrote:
Hi all,
Starting with the basics: R1 has a 4K stack from 0xfffff000-0xffffffff and the stack grows down?
It better not. r1 will eventually have a stack somewhere. Initially, we put it in unmapped memory space which allows us to use the cache as memory. 0xfffff000-0xffffffff is the last page in memory, and that is a) in Flash, and b) the boot page. Until you execute the code you're having a problem with below, that last page will be the only page mapped.
Here's the part of the code I'm crashing in and which I trying to understand, shown here from vim with lines enabled:
158 bl tlb1_entry 159 mr r5,r0 160 lwzu r4,0(r5) /* how many TLB1 entries we actually use */ 161 mtctr r4 162 163 0: lwzu r6,4(r5) 164 lwzu r7,4(r5) 165 lwzu r8,4(r5) 166 lwzu r9,4(r5) 167 mtspr MAS0,r6 168 mtspr MAS1,r7 169 mtspr MAS2,r8 170 mtspr MAS3,r9 171 isync 172 msync 173 tlbwe 174 isync 175 bdnz 0b 176 177 1:
Are lines 158-171 setting up the TLB's as defined by 'bl tlb1_entry' ?
It sets up the TLBs as you should have set up in your board's init.S file. When tlb1_entry returns, r0 will point to a word with the number of TLB entries. After that, it's an array which is fairly straightforward:
MAS0 MAS1 MAS2 MAS3
Here's the part where my code or the bdi is crashing, line 163 which is mapped as fffff0c0 :
163 0: lwzu r6,4(r5)
'lwzu r6,4(r5)' as I read it says: load a word from R5 + 4 bytes, ie, address fffff214:
ATUM>mdh 0xfffff214 2 0_fffff214 : 0x0000 0 .. 0_fffff216 : 0x0000 0 ..
Ok, but that's what you would expect, if you look in init.S. The first entry is:
TLB1_MAS0(0,0,0)
The TLB1 part is misleading (one day, I will change all of those macros), but it sets up MAS0 to point at TLB0, entry 0.
Is my problem is that I am assigning zero here? I'm confused since the CDS code seems to work the same way. The result of single stepping consistently results in:
I can assure that's not the problem.
ATUM>info Target CPU : MPC85xx (e500v2 rev.2) Target state : halted Debug entry cause : instruction breakpoint Current PC : 0xfffff0c0 Current CR : 0x00000000 Current MSR : 0x00000200 Current LR : 0xfffff0b4 Current CCSRBAR : 0x0_e0000000 ATUM>ti
- Core status is 0x0041
*** Core is stopped, no debugging possible # PPC: timeout while waiting for halt ATUM> Target CPU : MPC85xx (e500v2 rev.2) Target state : running # Step timeout detected
I sent a question to Abatron technical support about this in the case its a bdi issue - still waiting to see what they say.
Any clues please? Robert
Well, there's nothing wrong with the code you've shown us so far. Does the CDS show the same problem when single-stepping? Are you sure you're single-stepping? My first guess would be that you've set up TLB1, entry 0 with something that's not Flash, and that what you are seeing is the result of unmapping your Flash while executing out of it.
What does your init.S look like?
Andy
On 9/26/07, Andy Fleming afleming@gmail.com wrote:
On 9/26/07, robert lazarski robertlazarski@gmail.com wrote:
Hi all,
Starting with the basics: R1 has a 4K stack from 0xfffff000-0xffffffff and the stack grows down?
It better not. r1 will eventually have a stack somewhere. Initially, we put it in unmapped memory space which allows us to use the cache as memory. 0xfffff000-0xffffffff is the last page in memory, and that is a) in Flash, and b) the boot page. Until you execute the code you're having a problem with below, that last page will be the only page mapped.
Can I get clarification on one point in particular here please? Before the TLB's get processed, IVPR is set to the TEXT_BASE - 0xfff80000 - and then IVOR15 is set to 0x0f00, ie 'Debug' interrupt type is mapped to 0xfff80f00 . If that is correct, isn't 0xfff80f00 unmapped, since only the last page 0xfffff000-0xffffffff is mapped?
I ask because for bdi, debugging works only if the Debug Interrupt (IVOR15) points to a valid, mapped and therefore executable opcode. If not then the core crashes. I ask because I may have a TLB issue and I'm having a hard finding it. Or maybe the bdi core is crashing simply because IVOR15 is not an executable opcode ?
Thanks all, I hope I'm asking valid questions that are of general interest, Robert
On 9/28/07, robert lazarski robertlazarski@gmail.com wrote:
On 9/26/07, Andy Fleming afleming@gmail.com wrote:
On 9/26/07, robert lazarski robertlazarski@gmail.com wrote:
Hi all,
Starting with the basics: R1 has a 4K stack from 0xfffff000-0xffffffff and the stack grows down?
It better not. r1 will eventually have a stack somewhere. Initially, we put it in unmapped memory space which allows us to use the cache as memory. 0xfffff000-0xffffffff is the last page in memory, and that is a) in Flash, and b) the boot page. Until you execute the code you're having a problem with below, that last page will be the only page mapped.
Can I get clarification on one point in particular here please? Before the TLB's get processed, IVPR is set to the TEXT_BASE - 0xfff80000 - and then IVOR15 is set to 0x0f00, ie 'Debug' interrupt type is mapped to 0xfff80f00 . If that is correct, isn't 0xfff80f00 unmapped, since only the last page 0xfffff000-0xffffffff is mapped?
I ask because for bdi, debugging works only if the Debug Interrupt (IVOR15) points to a valid, mapped and therefore executable opcode. If not then the core crashes. I ask because I may have a TLB issue and I'm having a hard finding it. Or maybe the bdi core is crashing simply because IVOR15 is not an executable opcode ?
Thanks all, I hope I'm asking valid questions that are of general interest, Robert
I know its poor form to keep replying to myself, but I believe I narrowed my problem down to be IVOR + IVOR15 for sure and _not_ the tlb1 entries, ie, the bdi is crashing and its not because of a bad tlb at this point. After looking at code and debugging best I could, these lines in start.S:
158 bl tlb1_entry 159 mr r5,r0 160 lwzu r4,0(r5) /* how many TLB1 entries we actually use */ 161 mtctr r4 162 163 0: lwzu r6,4(r5)
At least the first time through and where the bdi crashes have so far _only_ processed in my init.S :
53 #define entry_start \ 54 mflr r1 ; \ 55 bl 0f ; 56 57 #define entry_end \ 58 0: mflr r0 ; \ 59 mtlr r1 ; \ 60 blr ; 61 62 63 .section .bootpg, "ax" 64 .globl tlb1_entry 65 tlb1_entry: 66 entry_start 67 68 /* 69 * Number of TLB0 and TLB1 entries in the following table 70 */ 71 .long (2f-1f)/16
That code is standard on all 85xx boards, ie, AFAIK only the number of TLB's are known at this stage and a 'bl 1f' where the TLB0 and TLB1 are actually processed haven't been executed yet. Make sense? If so, that leaves me with (a) figuring out how to get IVOR + IVO15 to have a mapped and executable opcode (b) debugging this part of the code without the bdi and without a serial port (c) using the new bdi firmware which Abatron tells me can , via gdb, debug without IVOR + IVO15 .
Best regards, Robert
participants (3)
-
Andy Fleming -
Jerry Van Baren -
robert lazarski