Merge branch 'mpi-master' into wip-k-fmlpwip-k-fmlp

Conflicts:
	litmus/sched_cedf.c

1 files changed, 391 insertions, 135 deletions

diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index eb62bf947212..278c1b0ebb2e 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -22,14 +22,10 @@
 #include <asm/thread_info.h>
 #include <asm/system.h>
 
-#if (PHYS_OFFSET & 0x001fffff)
-#error "PHYS_OFFSET must be at an even 2MiB boundary!"
+#ifdef CONFIG_DEBUG_LL
+#include <mach/debug-macro.S>
 #endif
 
-#define KERNEL_RAM_VADDR        (PAGE_OFFSET + TEXT_OFFSET)
-#define KERNEL_RAM_PADDR        (PHYS_OFFSET + TEXT_OFFSET)
-
-
 /*
  * swapper_pg_dir is the virtual address of the initial page table.
  * We place the page tables 16K below KERNEL_RAM_VADDR.  Therefore, we must
@@ -37,6 +33,7 @@
  * the least significant 16 bits to be 0x8000, but we could probably
  * relax this restriction to KERNEL_RAM_VADDR >= PAGE_OFFSET + 0x4000.
  */
+#define KERNEL_RAM_VADDR        (PAGE_OFFSET + TEXT_OFFSET)
 #if (KERNEL_RAM_VADDR & 0xffff) != 0x8000
 #error KERNEL_RAM_VADDR must start at 0xXXXX8000
 #endif
@@ -44,8 +41,8 @@
         .globl  swapper_pg_dir
         .equ    swapper_pg_dir, KERNEL_RAM_VADDR - 0x4000
 
-        .macro  pgtbl, rd
-        ldr     \rd, =(KERNEL_RAM_PADDR - 0x4000)
+        .macro  pgtbl, rd, phys
+        add     \rd, \phys, #TEXT_OFFSET - 0x4000
         .endm
 
 #ifdef CONFIG_XIP_KERNEL
@@ -62,7 +59,7 @@
  *
  * This is normally called from the decompressor code.  The requirements
  * are: MMU = off, D-cache = off, I-cache = dont care, r0 = 0,
- * r1 = machine nr, r2 = atags pointer.
+ * r1 = machine nr, r2 = atags or dtb pointer.
  *
  * This code is mostly position independent, so if you link the kernel at
  * 0xc0008000, you call this at __pa(0xc0008000).
@@ -81,29 +78,210 @@ ENTRY(stext)
         mrc     p15, 0, r9, c0, c0              @ get processor id
         bl      __lookup_processor_type         @ r5=procinfo r9=cpuid
         movs    r10, r5                         @ invalid processor (r5=0)?
+ THUMB( it      eq )            @ force fixup-able long branch encoding
         beq     __error_p                       @ yes, error 'p'
-        bl      __lookup_machine_type           @ r5=machinfo
-        movs    r8, r5                          @ invalid machine (r5=0)?
-        beq     __error_a                       @ yes, error 'a'
+
+#ifndef CONFIG_XIP_KERNEL
+        adr     r3, 2f
+        ldmia   r3, {r4, r8}
+        sub     r4, r3, r4                      @ (PHYS_OFFSET - PAGE_OFFSET)
+        add     r8, r8, r4                      @ PHYS_OFFSET
+#else
+        ldr     r8, =PLAT_PHYS_OFFSET
+#endif
+
+        /*
+         * r1 = machine no, r2 = atags or dtb,
+         * r8 = phys_offset, r9 = cpuid, r10 = procinfo
+         */
         bl      __vet_atags
+#ifdef CONFIG_SMP_ON_UP
+        bl      __fixup_smp
+#endif
+#ifdef CONFIG_ARM_PATCH_PHYS_VIRT
+        bl      __fixup_pv_table
+#endif
         bl      __create_page_tables
 
         /*
          * The following calls CPU specific code in a position independent
          * manner.  See arch/arm/mm/proc-*.S for details.  r10 = base of
-         * xxx_proc_info structure selected by __lookup_machine_type
+         * xxx_proc_info structure selected by __lookup_processor_type
          * above.  On return, the CPU will be ready for the MMU to be
          * turned on, and r0 will hold the CPU control register value.
          */
-        ldr     r13, __switch_data              @ address to jump to after
+        ldr     r13, =__mmap_switched           @ address to jump to after
                                                 @ mmu has been enabled
-        adr     lr, BSYM(__enable_mmu)          @ return (PIC) address
+        adr     lr, BSYM(1f)                    @ return (PIC) address
+        mov     r8, r4                          @ set TTBR1 to swapper_pg_dir
  ARM(   add     pc, r10, #PROCINFO_INITFUNC     )
  THUMB( add     r12, r10, #PROCINFO_INITFUNC    )
  THUMB( mov     pc, r12                         )
+1:      b       __enable_mmu
 ENDPROC(stext)
+        .ltorg
+#ifndef CONFIG_XIP_KERNEL
+2:      .long   .
+        .long   PAGE_OFFSET
+#endif
+
+/*
+ * Setup the initial page tables.  We only setup the barest
+ * amount which are required to get the kernel running, which
+ * generally means mapping in the kernel code.
+ *
+ * r8 = phys_offset, r9 = cpuid, r10 = procinfo
+ *
+ * Returns:
+ *  r0, r3, r5-r7 corrupted
+ *  r4 = physical page table address
+ */
+__create_page_tables:
+        pgtbl   r4, r8                          @ page table address
+
+        /*
+         * Clear the 16K level 1 swapper page table
+         */
+        mov     r0, r4
+        mov     r3, #0
+        add     r6, r0, #0x4000
+1:      str     r3, [r0], #4
+        str     r3, [r0], #4
+        str     r3, [r0], #4
+        str     r3, [r0], #4
+        teq     r0, r6
+        bne     1b
+
+        ldr     r7, [r10, #PROCINFO_MM_MMUFLAGS] @ mm_mmuflags
+
+        /*
+         * Create identity mapping to cater for __enable_mmu.
+         * This identity mapping will be removed by paging_init().
+         */
+        adr     r0, __enable_mmu_loc
+        ldmia   r0, {r3, r5, r6}
+        sub     r0, r0, r3                      @ virt->phys offset
+        add     r5, r5, r0                      @ phys __enable_mmu
+        add     r6, r6, r0                      @ phys __enable_mmu_end
+        mov     r5, r5, lsr #20
+        mov     r6, r6, lsr #20
+
+1:      orr     r3, r7, r5, lsl #20             @ flags + kernel base
+        str     r3, [r4, r5, lsl #2]            @ identity mapping
+        teq     r5, r6
+        addne   r5, r5, #1                      @ next section
+        bne     1b
+
+        /*
+         * Now setup the pagetables for our kernel direct
+         * mapped region.
+         */
+        mov     r3, pc
+        mov     r3, r3, lsr #20
+        orr     r3, r7, r3, lsl #20
+        add     r0, r4,  #(KERNEL_START & 0xff000000) >> 18
+        str     r3, [r0, #(KERNEL_START & 0x00f00000) >> 18]!
+        ldr     r6, =(KERNEL_END - 1)
+        add     r0, r0, #4
+        add     r6, r4, r6, lsr #18
+1:      cmp     r0, r6
+        add     r3, r3, #1 << 20
+        strls   r3, [r0], #4
+        bls     1b
+
+#ifdef CONFIG_XIP_KERNEL
+        /*
+         * Map some ram to cover our .data and .bss areas.
+         */
+        add     r3, r8, #TEXT_OFFSET
+        orr     r3, r3, r7
+        add     r0, r4,  #(KERNEL_RAM_VADDR & 0xff000000) >> 18
+        str     r3, [r0, #(KERNEL_RAM_VADDR & 0x00f00000) >> 18]!
+        ldr     r6, =(_end - 1)
+        add     r0, r0, #4
+        add     r6, r4, r6, lsr #18
+1:      cmp     r0, r6
+        add     r3, r3, #1 << 20
+        strls   r3, [r0], #4
+        bls     1b
+#endif
+
+        /*
+         * Then map boot params address in r2 or
+         * the first 1MB of ram if boot params address is not specified.
+         */
+        mov     r0, r2, lsr #20
+        movs    r0, r0, lsl #20
+        moveq   r0, r8
+        sub     r3, r0, r8
+        add     r3, r3, #PAGE_OFFSET
+        add     r3, r4, r3, lsr #18
+        orr     r6, r7, r0
+        str     r6, [r3]
+
+#ifdef CONFIG_DEBUG_LL
+#ifndef CONFIG_DEBUG_ICEDCC
+        /*
+         * Map in IO space for serial debugging.
+         * This allows debug messages to be output
+         * via a serial console before paging_init.
+         */
+        addruart r7, r3
+
+        mov     r3, r3, lsr #20
+        mov     r3, r3, lsl #2
+
+        add     r0, r4, r3
+        rsb     r3, r3, #0x4000                 @ PTRS_PER_PGD*sizeof(long)
+        cmp     r3, #0x0800                     @ limit to 512MB
+        movhi   r3, #0x0800
+        add     r6, r0, r3
+        mov     r3, r7, lsr #20
+        ldr     r7, [r10, #PROCINFO_IO_MMUFLAGS] @ io_mmuflags
+        orr     r3, r7, r3, lsl #20
+1:      str     r3, [r0], #4
+        add     r3, r3, #1 << 20
+        teq     r0, r6
+        bne     1b
+
+#else /* CONFIG_DEBUG_ICEDCC */
+        /* we don't need any serial debugging mappings for ICEDCC */
+        ldr     r7, [r10, #PROCINFO_IO_MMUFLAGS] @ io_mmuflags
+#endif /* !CONFIG_DEBUG_ICEDCC */
+
+#if defined(CONFIG_ARCH_NETWINDER) || defined(CONFIG_ARCH_CATS)
+        /*
+         * If we're using the NetWinder or CATS, we also need to map
+         * in the 16550-type serial port for the debug messages
+         */
+        add     r0, r4, #0xff000000 >> 18
+        orr     r3, r7, #0x7c000000
+        str     r3, [r0]
+#endif
+#ifdef CONFIG_ARCH_RPC
+        /*
+         * Map in screen at 0x02000000 & SCREEN2_BASE
+         * Similar reasons here - for debug.  This is
+         * only for Acorn RiscPC architectures.
+         */
+        add     r0, r4, #0x02000000 >> 18
+        orr     r3, r7, #0x02000000
+        str     r3, [r0]
+        add     r0, r4, #0xd8000000 >> 18
+        str     r3, [r0]
+#endif
+#endif
+        mov     pc, lr
+ENDPROC(__create_page_tables)
+        .ltorg
+        .align
+__enable_mmu_loc:
+        .long   .
+        .long   __enable_mmu
+        .long   __enable_mmu_end
 
 #if defined(CONFIG_SMP)
+        __CPUINIT
 ENTRY(secondary_startup)
         /*
          * Common entry point for secondary CPUs.
@@ -117,15 +295,18 @@ ENTRY(secondary_startup)
         bl      __lookup_processor_type
         movs    r10, r5                         @ invalid processor?
         moveq   r0, #'p'                        @ yes, error 'p'
-        beq     __error
+ THUMB( it      eq )            @ force fixup-able long branch encoding
+        beq     __error_p
 
         /*
          * Use the page tables supplied from  __cpu_up.
          */
         adr     r4, __secondary_data
         ldmia   r4, {r5, r7, r12}               @ address to jump to after
-        sub     r4, r4, r5                      @ mmu has been enabled
-        ldr     r4, [r7, r4]                    @ get secondary_data.pgdir
+        sub     lr, r4, r5                      @ mmu has been enabled
+        ldr     r4, [r7, lr]                    @ get secondary_data.pgdir
+        add     r7, r7, #4
+        ldr     r8, [r7, lr]                    @ get secondary_data.swapper_pg_dir
         adr     lr, BSYM(__enable_mmu)          @ return address
         mov     r13, r12                        @ __secondary_switched address
  ARM(   add     pc, r10, #PROCINFO_INITFUNC     ) @ initialise processor
@@ -143,6 +324,8 @@ ENTRY(__secondary_switched)
         b       secondary_start_kernel
 ENDPROC(__secondary_switched)
 
+        .align
+
         .type   __secondary_data, %object
 __secondary_data:
         .long   .
@@ -156,6 +339,13 @@ __secondary_data:
  * Setup common bits before finally enabling the MMU.  Essentially
  * this is just loading the page table pointer and domain access
  * registers.
+ *
+ *  r0  = cp#15 control register
+ *  r1  = machine ID
+ *  r2  = atags or dtb pointer
+ *  r4  = page table pointer
+ *  r9  = processor ID
+ *  r13 = *virtual* address to jump to upon completion
  */
 __enable_mmu:
 #ifdef CONFIG_ALIGNMENT_TRAP
@@ -188,6 +378,9 @@ ENDPROC(__enable_mmu)
  * mailing list archives BEFORE sending another post to the list.
  *
  *  r0  = cp#15 control register
+ *  r1  = machine ID
+ *  r2  = atags or dtb pointer
+ *  r9  = processor ID
  *  r13 = *virtual* address to jump to upon completion
  *
  * other registers depend on the function called upon completion
@@ -200,137 +393,200 @@ __turn_mmu_on:
         mov     r3, r3
         mov     r3, r13
         mov     pc, r3
+__enable_mmu_end:
 ENDPROC(__turn_mmu_on)
 
 
-/*
- * Setup the initial page tables.  We only setup the barest
- * amount which are required to get the kernel running, which
- * generally means mapping in the kernel code.
- *
- * r8  = machinfo
- * r9  = cpuid
- * r10 = procinfo
- *
- * Returns:
- *  r0, r3, r6, r7 corrupted
- *  r4 = physical page table address
- */
-__create_page_tables:
-        pgtbl   r4                              @ page table address
+#ifdef CONFIG_SMP_ON_UP
+        __INIT
+__fixup_smp:
+        and     r3, r9, #0x000f0000     @ architecture version
+        teq     r3, #0x000f0000         @ CPU ID supported?
+        bne     __fixup_smp_on_up       @ no, assume UP
 
-        /*
-         * Clear the 16K level 1 swapper page table
-         */
-        mov     r0, r4
-        mov     r3, #0
-        add     r6, r0, #0x4000
-1:      str     r3, [r0], #4
-        str     r3, [r0], #4
-        str     r3, [r0], #4
-        str     r3, [r0], #4
-        teq     r0, r6
-        bne     1b
+        bic     r3, r9, #0x00ff0000
+        bic     r3, r3, #0x0000000f     @ mask 0xff00fff0
+        mov     r4, #0x41000000
+        orr     r4, r4, #0x0000b000
+        orr     r4, r4, #0x00000020     @ val 0x4100b020
+        teq     r3, r4                  @ ARM 11MPCore?
+        moveq   pc, lr                  @ yes, assume SMP
 
-        ldr     r7, [r10, #PROCINFO_MM_MMUFLAGS] @ mm_mmuflags
+        mrc     p15, 0, r0, c0, c0, 5   @ read MPIDR
+        and     r0, r0, #0xc0000000     @ multiprocessing extensions and
+        teq     r0, #0x80000000         @ not part of a uniprocessor system?
+        moveq   pc, lr                  @ yes, assume SMP
 
-        /*
-         * Create identity mapping for first MB of kernel to
-         * cater for the MMU enable.  This identity mapping
-         * will be removed by paging_init().  We use our current program
-         * counter to determine corresponding section base address.
-         */
-        mov     r6, pc
-        mov     r6, r6, lsr #20                 @ start of kernel section
-        orr     r3, r7, r6, lsl #20             @ flags + kernel base
-        str     r3, [r4, r6, lsl #2]            @ identity mapping
+__fixup_smp_on_up:
+        adr     r0, 1f
+        ldmia   r0, {r3 - r5}
+        sub     r3, r0, r3
+        add     r4, r4, r3
+        add     r5, r5, r3
+        b       __do_fixup_smp_on_up
+ENDPROC(__fixup_smp)
 
-        /*
-         * Now setup the pagetables for our kernel direct
-         * mapped region.
-         */
-        add     r0, r4,  #(KERNEL_START & 0xff000000) >> 18
-        str     r3, [r0, #(KERNEL_START & 0x00f00000) >> 18]!
-        ldr     r6, =(KERNEL_END - 1)
-        add     r0, r0, #4
-        add     r6, r4, r6, lsr #18
-1:      cmp     r0, r6
-        add     r3, r3, #1 << 20
-        strls   r3, [r0], #4
-        bls     1b
+        .align
+1:      .word   .
+        .word   __smpalt_begin
+        .word   __smpalt_end
 
-#ifdef CONFIG_XIP_KERNEL
-        /*
-         * Map some ram to cover our .data and .bss areas.
-         */
-        orr     r3, r7, #(KERNEL_RAM_PADDR & 0xff000000)
-        .if     (KERNEL_RAM_PADDR & 0x00f00000)
-        orr     r3, r3, #(KERNEL_RAM_PADDR & 0x00f00000)
-        .endif
-        add     r0, r4,  #(KERNEL_RAM_VADDR & 0xff000000) >> 18
-        str     r3, [r0, #(KERNEL_RAM_VADDR & 0x00f00000) >> 18]!
-        ldr     r6, =(_end - 1)
-        add     r0, r0, #4
-        add     r6, r4, r6, lsr #18
-1:      cmp     r0, r6
-        add     r3, r3, #1 << 20
-        strls   r3, [r0], #4
-        bls     1b
+        .pushsection .data
+        .globl  smp_on_up
+smp_on_up:
+        ALT_SMP(.long   1)
+        ALT_UP(.long    0)
+        .popsection
 #endif
 
-        /*
-         * Then map first 1MB of ram in case it contains our boot params.
-         */
-        add     r0, r4, #PAGE_OFFSET >> 18
-        orr     r6, r7, #(PHYS_OFFSET & 0xff000000)
-        .if     (PHYS_OFFSET & 0x00f00000)
-        orr     r6, r6, #(PHYS_OFFSET & 0x00f00000)
-        .endif
-        str     r6, [r0]
+        .text
+__do_fixup_smp_on_up:
+        cmp     r4, r5
+        movhs   pc, lr
+        ldmia   r4!, {r0, r6}
+ ARM(   str     r6, [r0, r3]    )
+ THUMB( add     r0, r0, r3      )
+#ifdef __ARMEB__
+ THUMB( mov     r6, r6, ror #16 )       @ Convert word order for big-endian.
+#endif
+ THUMB( strh    r6, [r0], #2    )       @ For Thumb-2, store as two halfwords
+ THUMB( mov     r6, r6, lsr #16 )       @ to be robust against misaligned r3.
+ THUMB( strh    r6, [r0]        )
+        b       __do_fixup_smp_on_up
+ENDPROC(__do_fixup_smp_on_up)
 
-#ifdef CONFIG_DEBUG_LL
-        ldr     r7, [r10, #PROCINFO_IO_MMUFLAGS] @ io_mmuflags
-        /*
-         * Map in IO space for serial debugging.
-         * This allows debug messages to be output
-         * via a serial console before paging_init.
-         */
-        ldr     r3, [r8, #MACHINFO_PGOFFIO]
-        add     r0, r4, r3
-        rsb     r3, r3, #0x4000                 @ PTRS_PER_PGD*sizeof(long)
-        cmp     r3, #0x0800                     @ limit to 512MB
-        movhi   r3, #0x0800
-        add     r6, r0, r3
-        ldr     r3, [r8, #MACHINFO_PHYSIO]
-        orr     r3, r3, r7
-1:      str     r3, [r0], #4
-        add     r3, r3, #1 << 20
-        teq     r0, r6
-        bne     1b
-#if defined(CONFIG_ARCH_NETWINDER) || defined(CONFIG_ARCH_CATS)
-        /*
-         * If we're using the NetWinder or CATS, we also need to map
-         * in the 16550-type serial port for the debug messages
-         */
-        add     r0, r4, #0xff000000 >> 18
-        orr     r3, r7, #0x7c000000
-        str     r3, [r0]
+ENTRY(fixup_smp)
+        stmfd   sp!, {r4 - r6, lr}
+        mov     r4, r0
+        add     r5, r0, r1
+        mov     r3, #0
+        bl      __do_fixup_smp_on_up
+        ldmfd   sp!, {r4 - r6, pc}
+ENDPROC(fixup_smp)
+
+#ifdef CONFIG_ARM_PATCH_PHYS_VIRT
+
+/* __fixup_pv_table - patch the stub instructions with the delta between
+ * PHYS_OFFSET and PAGE_OFFSET, which is assumed to be 16MiB aligned and
+ * can be expressed by an immediate shifter operand. The stub instruction
+ * has a form of '(add|sub) rd, rn, #imm'.
+ */
+        __HEAD
+__fixup_pv_table:
+        adr     r0, 1f
+        ldmia   r0, {r3-r5, r7}
+        sub     r3, r0, r3      @ PHYS_OFFSET - PAGE_OFFSET
+        add     r4, r4, r3      @ adjust table start address
+        add     r5, r5, r3      @ adjust table end address
+        add     r7, r7, r3      @ adjust __pv_phys_offset address
+        str     r8, [r7]        @ save computed PHYS_OFFSET to __pv_phys_offset
+#ifndef CONFIG_ARM_PATCH_PHYS_VIRT_16BIT
+        mov     r6, r3, lsr #24 @ constant for add/sub instructions
+        teq     r3, r6, lsl #24 @ must be 16MiB aligned
+#else
+        mov     r6, r3, lsr #16 @ constant for add/sub instructions
+        teq     r3, r6, lsl #16 @ must be 64kiB aligned
 #endif
-#ifdef CONFIG_ARCH_RPC
-        /*
-         * Map in screen at 0x02000000 & SCREEN2_BASE
-         * Similar reasons here - for debug.  This is
-         * only for Acorn RiscPC architectures.
-         */
-        add     r0, r4, #0x02000000 >> 18
-        orr     r3, r7, #0x02000000
-        str     r3, [r0]
-        add     r0, r4, #0xd8000000 >> 18
-        str     r3, [r0]
+THUMB(  it      ne              @ cross section branch )
+        bne     __error
+        str     r6, [r7, #4]    @ save to __pv_offset
+        b       __fixup_a_pv_table
+ENDPROC(__fixup_pv_table)
+
+        .align
+1:      .long   .
+        .long   __pv_table_begin
+        .long   __pv_table_end
+2:      .long   __pv_phys_offset
+
+        .text
+__fixup_a_pv_table:
+#ifdef CONFIG_THUMB2_KERNEL
+#ifdef CONFIG_ARM_PATCH_PHYS_VIRT_16BIT
+        lsls    r0, r6, #24
+        lsr     r6, #8
+        beq     1f
+        clz     r7, r0
+        lsr     r0, #24
+        lsl     r0, r7
+        bic     r0, 0x0080
+        lsrs    r7, #1
+        orrcs   r0, #0x0080
+        orr     r0, r0, r7, lsl #12
 #endif
+1:      lsls    r6, #24
+        beq     4f
+        clz     r7, r6
+        lsr     r6, #24
+        lsl     r6, r7
+        bic     r6, #0x0080
+        lsrs    r7, #1
+        orrcs   r6, #0x0080
+        orr     r6, r6, r7, lsl #12
+        orr     r6, #0x4000
+        b       4f
+2:      @ at this point the C flag is always clear
+        add     r7, r3
+#ifdef CONFIG_ARM_PATCH_PHYS_VIRT_16BIT
+        ldrh    ip, [r7]
+        tst     ip, 0x0400      @ the i bit tells us LS or MS byte
+        beq     3f
+        cmp     r0, #0          @ set C flag, and ...
+        biceq   ip, 0x0400      @ immediate zero value has a special encoding
+        streqh  ip, [r7]        @ that requires the i bit cleared
+#endif
+3:      ldrh    ip, [r7, #2]
+        and     ip, 0x8f00
+        orrcc   ip, r6  @ mask in offset bits 31-24
+        orrcs   ip, r0  @ mask in offset bits 23-16
+        strh    ip, [r7, #2]
+4:      cmp     r4, r5
+        ldrcc   r7, [r4], #4    @ use branch for delay slot
+        bcc     2b
+        bx      lr
+#else
+#ifdef CONFIG_ARM_PATCH_PHYS_VIRT_16BIT
+        and     r0, r6, #255    @ offset bits 23-16
+        mov     r6, r6, lsr #8  @ offset bits 31-24
+#else
+        mov     r0, #0          @ just in case...
 #endif
+        b       3f
+2:      ldr     ip, [r7, r3]
+        bic     ip, ip, #0x000000ff
+        tst     ip, #0x400      @ rotate shift tells us LS or MS byte
+        orrne   ip, ip, r6      @ mask in offset bits 31-24
+        orreq   ip, ip, r0      @ mask in offset bits 23-16
+        str     ip, [r7, r3]
+3:      cmp     r4, r5
+        ldrcc   r7, [r4], #4    @ use branch for delay slot
+        bcc     2b
         mov     pc, lr
-ENDPROC(__create_page_tables)
-        .ltorg
+#endif
+ENDPROC(__fixup_a_pv_table)
+
+ENTRY(fixup_pv_table)
+        stmfd   sp!, {r4 - r7, lr}
+        ldr     r2, 2f                  @ get address of __pv_phys_offset
+        mov     r3, #0                  @ no offset
+        mov     r4, r0                  @ r0 = table start
+        add     r5, r0, r1              @ r1 = table size
+        ldr     r6, [r2, #4]            @ get __pv_offset
+        bl      __fixup_a_pv_table
+        ldmfd   sp!, {r4 - r7, pc}
+ENDPROC(fixup_pv_table)
+
+        .align
+2:      .long   __pv_phys_offset
+
+        .data
+        .globl  __pv_phys_offset
+        .type   __pv_phys_offset, %object
+__pv_phys_offset:
+        .long   0
+        .size   __pv_phys_offset, . - __pv_phys_offset
+__pv_offset:
+        .long   0
+#endif
 
 #include "head-common.S"