If the bootloader uses the long descriptor format and jumps to kernel decompressor code, TTBCR may not be in a right state. Before enabling the MMU, it is required to clear the TTBCR.PD0 field to use TTBR0 for translation table walks. The commit dbece45894d3a ("ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 cores") does the reset of TTBCR.N, but doesn't consider all the bits for the size of TTBCR.N. Clear TTBCR.PD0 field and reset all the three bits of TTBCR.N to indicate the use of TTBR0 and the correct base address width.
Unified · Split
| @@ -779,7 +779,7 @@ __armv7_mmu_cache_on: · 778 unmodified lines | |||
| 779 | orrne r0, r0, #1 @ MMU enabled | 779 | orrne r0, r0, #1 @ MMU enabled |
| 780 | movne r1, #0xfffffffd @ domain 0 = client | 780 | movne r1, #0xfffffffd @ domain 0 = client |
| 781 | bic r6, r6, #1 << 31 @ 32-bit translation system | 781 | bic r6, r6, #1 << 31 @ 32-bit translation system |
| 782 | bic r6, r6, #3 << 0 @ use only ttbr0 | 782 | bic r6, r6, #(7 << 0) | (1 << 4) @ use only ttbr0 |
| 783 | mcrne p15, 0, r3, c2, c0, 0 @ load page table pointer | 783 | mcrne p15, 0, r3, c2, c0, 0 @ load page table pointer |
| 784 | mcrne p15, 0, r1, c3, c0, 0 @ load domain access control | 784 | mcrne p15, 0, r1, c3, c0, 0 @ load domain access control |
| 785 | mcrne p15, 0, r6, c2, c0, 2 @ load ttb control | 785 | mcrne p15, 0, r6, c2, c0, 2 @ load ttb control |