Hi,
Now I understand your question. Basically, however will be the configuration (cfg1 or cfg 2..) these addresses is what you see when you program the u-boot & RCW (after the flash is proper initialized - TLB, LAW, eLBC and so on are set up correctly).
When the processor is booting up, based on boot location (the cfg_rom_loc and RCW location are driven by DIP SW Settings or/and FPGA code) it can map the 4KB of code (the default TLB during booting time has 4KB).
The e500mc core boot start address(0xFFFF_FFFC) will point to the end of CS0 Flash due to OR0[AM]=0. In this phase, the core is using the relative addressing.
After you change the BR0,OR0, you can use absolute addressing.
Keep in mind, the bootloader is placed to the end of CS0, and the RCW is placed to the start of CS0.
Just for your info -> in our nomenclature a CS0 (ChipSelect 0) refers to BR0 and OR0's pair (used for setting up the eLBC controller).
When the chip starts execution, the boot vector is mapped at 0xfffffffc. The boot code then changes the flash mapping (with an interim state where it's mapped repeatedly throughout the address space) before it runs any code that depends on the link address.
You can take a look in the P4080 Reference Manul also. Quote from manual - Boot Space Translation - chapter 4.3.1.3
"When each core comes out of reset, its MMU has one 4-Kbyte page defined at 0x0_FFFF_Fnnn. Each core begins execution with the instruction at effective address 0x0_FFFF_FFFC. To get this instruction, the core's first instruction fetch is a burst read of boot code from effective address 0x0_FFFF_FFE0. For systems in which the boot code resides at a different address, the device provides boot space translation capability. Note that boot space translation affects transactions initiated by all cores in the same manner".
So, like a conclusion this is processor/hardware capability to fetch the booting code according with RCW and DIP SW settings.
Regards,
Marius