1. 由于E500 V2的入口地址在0xFFFFFFFC位置,而E500V2上电后有一个默认的LAW 4K映射到FFFFF000~FFFFFFFF,所以上电后的最初执行代码位于FLASH的顶部,下面摘录这顶部4K如下:
U-boot.bin
7FFFF0:FF FF FF FF FF FF FF FF FF FF FF 4B FF F0 04
反汇编后得到
effffffc <.resetvec>:
.section .resetvec,"ax"
b _start_e500
effffffc:
4b ff f0 04
b effff000 <_start_e500>
可以看到复位后,E500会跳转到EFFFF000处去执行,而U-BOOT镜像的终结地址是7FFFFF,所以实际的镜像位置是7FFFFF-FFF=7FF000
下面截图该部分的代码:
对照反汇编结果:
effff000 <_start_e500>:
_start_e500:
/* clear registers/arrays not reset by hardware */
/* L1 */
li r0,2
effff000: 38 00 00 02 li r0,2
mtspr L1CSR0,r0 /* invalidate d-cache */
effff004: 7c 12 fb a6 mtdbcr0 r0
mtspr L1CSR1,r0 /* invalidate i-cache */
effff008: 7c 13 fb a6 mtspr 1011,r0
mfspr r1,DBSR
effff00c: 7c 30 4a a6 mfspr r1,304
mtspr DBSR,r1 /* Clear all valid bits */
effff010: 7c 30 4b a6 mtspr 304,r1
/*
* Enable L1 Caches early
*
*/
lis r2,L1CSR0_CPE@H /* enable parity */
effff014: 3c 40 00 01 lis r2,1
ori r2,r2,L1CSR0_DCE
effff018: 60 42 00 01 ori r2,r2,1
mtspr L1CSR0,r2 /* enable L1 Dcache */
effff01c: 7c 52 fb a6 mtdbcr0 r2
isync
effff020: 4c 00 01 2c isync
mtspr L1CSR1,r2 /* enable L1 Icache */
effff024: 7c 53 fb a6 mtspr 1011,r2
isync
effff028: 4c 00 01 2c isync
msync
effff02c: 7c 00 04 ac sync
/* Setup interrupt vectors */
lis r1,TEXT_BASE@h
effff030: 3c 20 ef f8 lis r1,-4104
mtspr IVPR,r1
effff034: 7c 3f 0b a6 mtspr 63,r1
li r1,0x0100
effff038: 38 20 01 00 li r1,256
mtspr IVOR0,r1 /* 0: Critical input */
effff03c: 7c 30 63 a6 mtspr 400,r1
li r1,0x0200
effff040: 38 20 02 00 li r1,512
mtspr IVOR1,r1 /* 1: Machine check */
effff044: 7c 31 63 a6 mtspr 401,r1
li r1,0x0300
effff048: 38 20 03 00 li r1,768
mtspr IVOR2,r1 /* 2: Data storage */
effff04c: 7c 32 63 a6 mtspr 402,r1
li r1,0x0400
effff050: 38 20 04 00 li r1,1024
mtspr IVOR3,r1 /* 3: Instruction storage */
effff054: 7c 33 63 a6 mtspr 403,r1
可以看到这里就是start.S的_start_e500标号位置
U-BOOT代码里面在cpu初始化时为flash的物理地址开了一个窗口:
EPN:EC000000
RPN:EC000000
SIZE:64M
在configs/P2020SKU.H中有这么一段描述
/* Memory map
*
* 0x0000_0000 0x7fff_ffff DDR2GB cacheablen (at most)
* 0x8000_0000 0xdfff_ffff PCI Express Mem1.5G non-cacheable(PCIe * 3)
* 0xffc0_0000 0xffc3_ffff PCI IO range256k non-cacheable
*
* Localbus cacheable (TBD)
* 0xXXXX_XXXX 0xXXXX_XXXX SRAMYZ M Cacheable
*
* Localbus non-cacheable
* 0xee00_0000 0xefff_ffff FLASH32M non-cacheable
* 0xff90_0000 0xff9f_ffff VSC7385 switch 1M non-cacheable
* 0xffa0_0000 0xffaf_ffff CPLD1M non-cacheable
* 0xffb0_0000 0xffb7_ffff L2 SDRAM(REV.)512K cacheable(optional)
* 0xffd0_0000 0xffd0_3fff L1 for stack16K Cacheable TLB0
* 0xffe0_0000 0xffef_ffff CCSR1M non-cacheable
*/
可见 E0000000-F0000000为FLASH预留地址资源,描述中给出的是32Mflash,我们使用的是64M,所以窗口base为EC000000,这样整个flash的地址空间都映射到了P2020的物理地址空间,flash的地址总线为A[0...23],所以对flash来说复位地址FF-FF-FF-FC在读取flash时与地址EF-FF-FF-FC没有区别,FLASH在烧录u-boot时仿真器使用的地址空间为FFF80000-FFFFFFFF.
下面从U-BOOT命令行打印了flash数据如下:
=> md effffffc 1
effffffc: 4bfff004 K...
=> md effffff0 4
effffff0: ffffffff ffffffff ffffffff 4bfff004 ............K...
=> md eff80000 4
eff80000: 27051956 552d426f 6f742032 3030392e '..VU-Boot 2009.
=> md eff80000 16
eff80000: 27051956 552d426f 6f742032 3030392e '..VU-Boot 2009.
eff80010: 31312d73 766e3637 32322028 4d617220 11-svn6722 (Mar
eff80020: 32322032 30313220 2d203135 3a33373a 22 2012 - 15:37:
eff80030: 31342900 60000000 60000000 60000000 14).`...`...`...
eff80040: 3c20ffd0 60213f80 38000000 9401fffc < ..`!?.8.......
eff80050: 9401fffc 9421fff8 .....!..
=> md effff000 16
effff000: 38000002 7c12fba6 7c13fba6 7c304aa6 8...|...|...|0J.
effff010: 7c304ba6 3c400001 60420001 7c52fba6 |0K.<@..`B..|R..
effff020: 4c00012c 7c53fba6 4c00012c 7c0004ac L..,|S..L..,|...
effff030: 3c20eff8 7c3f0ba6 38200100 7c3063a6 < ..|?..8 ..|0c.
effff040: 38200200 7c3163a6 38200300 7c3263a6 8 ..|1c.8 ..|2c.
effff050: 38200400 7c3363a6 8 ..|3c.
=>