Question about mpc85xx(P2040) startup using Nor Flash

[jiaguo]

I'm porting u-boot to P2040 based board these days.

As u-boot/arch/powerpc/mpc85xx/start.s commented:

The processor starts at 0xffff_fffc and the code is first executed in the last 4K page in flash/rom.

In u-boot/arch/powerpc/mpc85xx/resetvec.S:

.section .resetvec,"ax"

b _start_e500

And in u-boot.lds linker script:

.resetvec RESET_VECTOR_ADDRESS :

{

     KEEP(*(.resetvec))

} :text = 0xffff

The E500MCRM Chapter 6.6 mentioned:

This default TLB entry translates the first instruction fetch out of reset(at effective address 0xffff_fffc).

This instruction should be a branch to the beginning of this page.

So, if I configure the HCW to let powerpc boot from Nor Flash, why should I suppose that the Nor Flash's

last 4K is mapped to 0xffff_f000~0xffff_ffff? Since there're no LAW setup yet and the default BR0/OR0 of Local Bus

does not match that range.

Best Regards,

Hook Guo

[alexander_yakov · Accepted solution]

P2040 Refernce Manual, Section 4.3.3 "Boot Page Translation":

When each core comes out of reset, its MMU has one 4 KB page defined at

0x0_FFFF_Fnnn. Each core begins execution with the instruction at effective address

0x0_FFFF_FFFC. To get this instruction, the core's first instruction fetch is a burst read

of boot code from effective address 0x0_FFFF_FFE0.

[jiaguo]

Hi alexander.yakovlev,

@ I think I'm nearly get the point.

When RCW set eLBC GPCM Nor Flash 16-bit as booting ROM, the Boot Window is pointed to eLBC, and processor starts at 0xFFFF_FFFC (which falls into the Boot Window), the real address is mapped to last 2 words of Nor Flash.

As P2040RM 13.4.2 mentioned:

On system reset, a global chip-select is available that provides a boot ROM chip-select LCS0_B prior to the system being fully configured.

The last 2 words of Nor Flash is a branch instruction to _start_e500, which is at the start of .bootpg. Codes in .bootpg section setup more TLB entry to make reset of u-boot code take effect.

And one more question:

When each core comes out of reset, its MMU has one 4 KB page defined at

0x0_FFFF_Fnnn. Each core begins execution with the instruction at effective address

0x0_FFFF_FFFC. To get this instruction, the core's first instruction fetch is a burst read

of boot code from effective address 0x0_FFFF_FFE0.

                                                      ~~~~~~~~~~~~

Why is 0x0_FFFF_FFE0? Please forgive my ignorance.:smileyblush:

BR,

Hook Guo

[alexander_yakov]

Because of burst size. One burst transaction fetches all instructions from 0x0_FFFF_FFE0 to 0x0_FFFF_FFFF

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[jiaguo]

Hi alexander.yakovlev,

Each core begins execution with the instruction at effective address 0x0_FFFF_FFFC.

------

What is the real address of 0x0_FFFF_FFFC translated by MMU? Does it pointed to u-boot

in Nor Flash? What's the Nor Flash mapping at system reset?

Thanks,

Jia

[hwrobel]

Please check the P2040RM, chapter 2.1, regarding “boot window”. Also check the note in 2.3.1 and the end of 2.3.5.

[jiaguo]

Hi Heinz,

The P2040RM says: The 8 Mbytes boot window is valid at core start up, and it's from 0xffc0_0000 to 0xffff_ffff.

But why should I suppose that range is Nor Flash?

Why is the .bootpg section located at the LAST page, which is mapped by MMU L2 TLB1 ?

Another question is: Does P2040 always have MMU enabled so as to translate 32-bit effective address

to 36-bit real address even at u-boot stage? If so, beside accessing to CCSRBAR, all other address

access should have TLB entry setup first.