ARM汇编语言(9) CP15

MRC：MRC(Move to ARM Register from Coprocessor) causes a coprocessor to transfer a value to an ARM register or to the condition flags.

MCR：MCR(Move to Coprocessor from ARM Register) passes the value of register <Rd>to the coprocessor whose number is cp_num.

The ARM920T processor containstwo internal coprocessors:
• CP14 for debug control
• CP15 for memory system control and test control.

The ARM920T processor incorporates(包含) the ARM9TDMI integer core, which implements the ARM architecture v4T. Itexecutes the ARM and Thumb instruction sets, and includes EmbeddedICE JTAG software debug features.

The programmer’s model of the ARM920T processor consists of the programmer’s model of the ARM9TDMI core with the following additions and modifications:

• The ARM920T processor incorporates(包含) two coprocessors: 
— CP14, which allows software access to the debug communications channel. You can access the registers defined in CP14 using MCRand MRCinstructions. 

— The system control coprocessor, CP15, which provides additional registers that are used to configure and control the caches, MMU, protection system, the clocking mode, and other system options of the ARM920T, such as big 
or little-endian operation. You can access the registers defined in CP15 using MCRand MRC instructions.  

• The ARM920T processor also features an external coprocessor interface that allows the attachment of a closely-coupled coprocessor on the same chip, for example, a floating-point unit. You can access registers and operations provided by any coprocessors attached to the external coprocessor interface using appropriate coprocessor instructions.

• Memory accesses for instruction fetches and data loads and stores can be cached or buffered. Cache and write buffer configuration and operation is described in detail in Chapter 4 Caches, Write Buffer, and Physical Address TAG (PA TAG) RAM.

• The MMU page tables that reside in main memory describe the virtual to physical address mapping, access permissions, and cache and write buffer configuration. These are created by the operating systemsoftware and accessed automatically by the ARM920T MMU hardware whenever an access causes a TLB miss.

• The ARM920T has a Trace Interface Port that allows the use of Trace hardware and tools for real-time tracingof instructions and data.

CP15定义了16个寄存器，CP15的寄存器映射如下图：

CP15 defines 16 registers，The register map for CP15 is shown：

寄存器位置0可以访问多个寄存器，具体访问哪个寄存器依赖于opcode_2域的值。

Addresses in ARM920T

在ARM920T系统中存在三种不同类型的地址：

VA(Virtual Address)：虚拟地址

MVA(Modified Virtual Address)：修正的虚拟地址

PA(Physical Address)：物理地址

以ARM9TDMI core请求一条指令为例，过程中的地址变换：

1、ARM9TDMI core发出指令的VA；

2、ProcID将指令的VA转换成指令的MVA(IMVA)，IMVA是给指令Cache(ICache)和MMU看的；(It is the IMVA that the Instruction Cache(ICache) and MMU see.)

3、IMMU会对IMVA执行安全检查(protection check)，如果安全检查通过，并且IMVA的tag在ICache中，那么就将指令数据返回给ARM9TDMI core；

4、如果IMVA tag不在ICache中，那么IMMU就会执行转换，产生指令PA(IPA)，这个地址会被传递给AMBA总线接口去访问外部数据；

Accessing CP15 registers

在所有情况下，从CP15的任意寄存器中读取数据，或者向CP15的任意寄存器中写入任意数据，包括那些被标注是unpredicatable或者should be zero的位，这些都不会导致永久的破换(does not cause any permanent damage)。

All CP15 register bits that are defined and contain state, are set to zero by BnRES except the V bit in register 1, which takes the value ofmacrocell input VINITHIwhen BnRESis asserted.

我们只能在特权模式下使用MRC和MCR指令访问CP15的寄存器。

MCR/MRC{cond} P15,opcode_1,Rd,CRn,CRm,opcode_2

Instructions CDP, LDC, and STC, together with unprivileged MRC and MCR instructions to CP15, cause the undefined instruction trap to be taken. 非特权的MRC和MCR指令？什么意思？

The CRn field of MRC and MCR instructions specifies the coprocessor register to access. 

The CRm field and opcode_2 fields specify a particular action when addressing registers. 

The L bit distinguishes between an MRC(L=1) and an MCR(L=0).

注意：

1、从不可读的寄存器中读取数据或者向不可写的寄存器中写入数据，将会引发不可知的结果；

2、The opcode_1, opcode_2, and CRmfields should be zero, except when the values specified are used to select the desired operations, in all instructions that access CP15. Using other values results in unpredictable behavior.

Register 0，ID code register

这是一个只读寄存器，返回一个32位的设备ID code。

将opcode_2的值设备为除1之外的任何值，CRm域的值在读操作的时候应该设置为0，读取CP15寄存器0就是读取ID code寄存器。

(You can access the ID code register by reading CP15 register 0 with the opcode_2field set to any value other than 1 (the CRmfield should be zero whenreading).)

例如：

MCR/MRC{cond} P15,opcode_1,Rd,CRn,CRm,opcode_2

MRC P15, 0, Rd, c0, c0, 0

coproc是P15，也就是协处理器C15，从协处理器C0到C15，标准通用的协处理器名字是：P0，P1，...，P15

opcode_1是0，是特定协处理器的操作码(opcode)

Rd是Rd，是这条指令的目的ARM寄存器， If R15 is specified for <Rd>, the condition code flags are updated instead of a general-purpose register.

CRn是c0，指定包含第一个操作数的协处理器寄存器

CRm是c0，是an additional coprocessor source or destination register

opcode_2是0，是特定协处理器的操作码，If it is omitted, <opcode_2>is assumed to be 0

Register 0，cache type register

这是一个只读寄存器，包含关于cache的size和architecture的信息，允许操作系统allowing operating systems to establish how to perform such operations as cache cleaning and lockdown.

所有ARMv4T和之后的cached processors都包含这个寄存器，允许RTOS厂商to produce future-proof versions of their operating systems

将opcode_2域设置为1，读取CP15的寄存器0访问cache type寄存器，例如：

MRC p15,0,Rd,c0,c0,1

Register 1，control register

这个寄存器包含ARM920T的控制位，所有的保留位must either be written with 0 or 1, as indicated, or written using read-modify-write. 

读取的时候，这些保留位的值是不可知的，使用如下的指令读取和写入寄存器：

MRC P15，0，Rd，c1，c0，0

MCR P15，0，Rd，c1，c0，0

所有定义的控制位在复位时都设置为0，除了V位，V位在复位时，如果VINITHI引脚是LOW，则设置为0，如果VINITHI引脚是HIGH，则设置为1

可以看出，控制信息都在这个寄存器中：

位7控制着ARM920T处理器的大小端设置，修改位7的值，就能够改变ARM920T处理器的大小端：

0：小端；

1：大端；

复位时的值是0，也就是默认的小端模式；

位0、位13也是重要的位，位0控制MMU，位13控制base location of exception registers

待续。。。