AP Core TLB not ready on boot (P2020)

[alexy_torres-au]

Hello,

I am writing a bootloader (I cannot use U-Boot in my project) that starts the Core 1 of the P2020 as follows:

1. Copy the Core 1 boot core to 0x00800000 (with branch at 0x00800FFC).

2. Set the BPTR at 0x00800000 (and enable page translation)

3. Release the Core1

However, I see while debuging that the Core1 boots correctly to 0x00800FFC, but the TLB is not correct. Indeed it still translates to 0xFFFFF000 -> 0xFFFFF000 for the entry 0.

So Core 1 crashes. 

When I update the TLB by hand thanks to the debuger and set the entry 0 to translate: 0x00800000 -> 0x00800000 it works and the Core 1 is able to boot and works perfectly!

I am sure I am missing something during the initialization but cannot find it. Do you have any idea on how to debug this?

Thanks

[ufedor]

> 2. Set the BPTR at 0x00800000 (and enable page translation)

Please consider that in the P2020 QorIQ Integrated Processor Reference Manual, 4.4.4 Boot page translation register (Reset_BPTR) it is written:

"8–31
BOOT_PAGE
Translation for boot page. If enabled, the high order 24 bits of accesses to 0x0_FFFF_Fnnn are replaced with this value."

For the address 0x0_00800000 it is needed to set BPTR=0x80000800

[alexy_torres-au]

Yes sorry I should have been more precise. I set the BPTR to point to 0x00800000 so I set it to BPTR=0x80000800.

According to what you wrote this is already how I set it. Sorry for the confusion and thank you for the precision.

[ufedor]

Please confirm that you have configured LAW for the address 0x00800000.

[alexy_torres-au]

I configured a LAW of 1gb starting at 0x0000_0000. Core 0 correctly runs with this configuration and core 1 too if I set the tlb manually before the first fetch.

[ufedor]

You wrote:

>  Indeed it still translates to 0xFFFFF000 -> 0xFFFFF000 for the entry 0.

And this is correct - refer to the P2020 QorIQ Integrated Processor Reference Manual, 4.3.3 Boot page translation.

BPTR (if enabled) works with real/physical address after MMU translation is performed.

Please provide screenshot of a debugger window showing assembler code starting from address 0x00800FE0.

[alexy_torres-au]

Here is the screenshot, you can also find information about the LAW in the upper right corner.

[ufedor]

Please provide screenshot for the code at physical address 0x00800FFC.

[alexy_torres-au]

Sorry I didnt see the address on the screenshot was 0xFFFFFFFC

Here is a screenshot at 0x00800FFC (physical):

Here is the code used to enable core 1:

volatile unsigned int* bptr_reg;

printf("Booting CPU1 \n\r");

/* Change the BPTR value to point to 0x800000 (boot page) */
bptr_reg = (unsigned int*)(CCSBAR_BPTR_OFFSET + CCSBAR_BASE_ADDR);
*bptr_reg = 0x80000800;

copy_boot();

/* Kickstart the CPU 1 */
asm volatile (
"isync\n\t"
"msync\n\t"
"isync\n\t"
"lis 4, 0xE000\n\t"
"lis 3, 0x0200\n\t"
"lwz 5, 0x1010(4)\n\t"
"or 3, 3, 5\n\t"
"stw 3, 0x1010(4)\n\t"
:
:
:
);

copy_boot just copies the boot code to the boot page.

Here is the boot code for Core 1:

__ap_start:

# Enable MCHK and debug
lis r3, 0x0200
ori r3, r3, 0x1200
mtmsr r3

# Manage L1 Caches
li r3, 0x2
mtspr 0x3F2,r3 /* invalidate d-cache */
mtspr 0x3F3,r3 /* invalidate i-cache */

# Map Kernel
create_tlb1_entry 1, 9, 1, 0, 0, BOOKE_PAGESZ_16M, 0, \
MAS2_G, 0, MAS3_SW | MAS3_SR | MAS3_SX | MAS3_UW | MAS3_UX | MAS3_UR);

# Set stack
lis r3, 0xFF
mr r1, r3

# Jump to init AP C function.
loop_inf:
b loop_inf

__ap_start_end:

# Rest of the boot page until 0xFFC is padded with 0

__ap_reset:
ba 0x800000

But the code seems to crash when fetching the first instruction.

[ufedor · Accepted solution]

ba 0x800000

This is your problem.

You have to use relative addressing - not absolute.

[alexy_torres-au]

Definitely my problem. It works with a relative branch.

I didn't understand correctly the role of the BPTR and did not understand that the translation was done after the CPU, I thought it was a register the CPU was loading at reset and setting its TLB accordingly.

Thanks for the clarification!