Detailed explanation of S3C2440 cp15 coprocessor

The 2440 coprocessor CP15 has a total of 16 coprocessor registers from c0 to c15, each with a certain function definition. But in general, cp15 is mainly related to the following functions:

1. Get some CPU related information such as device id and cache type.

2. MMU operation. Including enabling and disabling the MMU, and establishing the mapping mechanism from virtual address to physical address

3. Access permission control. Mainly used to implement security mechanisms and Linux copy on write.

4. Set the clock mode. The two functions MMU_SetAsyncBusMode and MMU_SetFastBusMode in init.S

Below I will analyze the above four applications in detail and explain them with code.

1. Get the device ID and cache type. These two pieces of information are stored in the c0 register of p15. Interestingly, the c0 register has two entities, one for storing the device ID (called c0.0) and the other for storing the cache type (called c0.1). The commands for reading these two registers are different. Please refer to the following sample code.

U32 P15_ReadID(void)

{

U32 id;

__asm{

mrc p15,0,id,c0,c0;

}

return id;

}

U32 P15_ReadCacheType(void)

{

U32 id;

__asm{

mrc p15,0,id,c0,c0,1;

}

return id;

}

Explanation of the above code:

(1) The CPU can only use the mrc instruction to read registers from p15. Similarly, the mcr instruction can only be used to write registers to p15. These two instructions are also the only two instructions that p15 can accept.

(2) __asm{ } is used to embed assembly code in C code.

(3) It can be seen from the code that the codes for reading out c0.0 and c0.1 are different at opcode2. (When reading out c0.1, opcode2 is 1. When reading out c0.0, opcode2 is omitted.)

(4) The device ID actually read out by the S3C2440 I used was 0x41129200; the cache type was: 0xd172172. The parameters recognized by Jlink Commander were the same.

2. MMU operation.

The p15 registers related to the MMU are c1 (control register) and c2 (TTB translation table base register). c2 is relatively simple, and is used to store the base address of the address translation table from virtual address to physical address (the translation table is stored in memory, for example, it can be placed at address 0x30000000), so when we initialize the mmu, we only need to transfer the planned translation table base address to the c2 register using the mcr instruction. The c1 register is a control register, and its detailed definition is as follows:

Register 1 - Control (read/write) 

All values ​​set to 0 at power-up. 

o Bit 0 - On-chip MMU turned off (0) or on (1) is used to turn off or enable the MMU.

o Bit 1 - Address alignment fault disabled (0) or enabled (1) Disable or enable address alignment check

o Bit 2 - Data cache turned off (0) or on (1) Data cache turned off or on

o Bit 3 - Write buffer turned off (0) or on (1)   

o Bit 7 - Little-endian operation if 0, big-endian if 1 Used to select the big-endian format

o Bit 8 - System bit - controls the MMU permission system 

o Bit 9 - ROM bit - controls the MMU permission system bit8 (S bit) and bit9 (R bit) are used to manage MMU access permissions, which will be detailed in Part 3

o Bit 12 - Instruction cache turned off (0) or on (1)” Instruction cache turned on or off

o Bit 13 - Base location of exception registers. 0x00000000(0) or 0xffff0000(1) Power-on startup address.

o Bit 14 - Round robin replacement, random replacement(0) or round-robin replacement(1). I don't quite understand this

o Bit 15 ~ Bit 29 reserved

o Bit 30 nF bit Bit30 and bit31 are used together to determine the bus mode. iA: nF = 00 FastBus mode 

o Bit 31 iA bit 01 Synchronous mode 10 reserved 11 Asynchronous mode

Combined with the above analysis of the bit definition of the c1 register, let's take a look at the following function:

void MMU_Init(void)

{

  __asm{

    mov r0,#0x30000000; // r0=TTBase, the base address of the page table

      mcr p15,0,r0,c2,c0,0; // The base address of the address conversion table is stored in C2

      mvn r0, #0;    //Data inversion transmission instruction

        mcr p15,0,r0,c3,c0,0; // Access type is administrator authority

    mrc p15,0,r0,c1,c0,0; // Read out coprocessor C1

    orr r0,r0,#01;    // OR operation, making the lowest bit 1

    mcr p15,0,r0,c1,c0,0; // assign value to C1 

  }

}

The function uses ARM register r0 as the interface to the coprocessor register. mcr p15,0,r0,c2,c0,0 puts the value in r0 (0x30000000, which is the base address of the conversion table we planned) into c2 (hence mcr, so it is from the ARM register to the p15 coprocessor register). c2 is the base address of the conversion table in p15.

mrc p15,0,r0,c1,c0,0; // Read out coprocessor C1

    orr r0,r0,#01;    // OR operation, making the lowest bit 1

    mcr p15,0,r0,c1,c0,0; // assign value to C1 

The purpose of the typical read-modify-write three-step operation is to set bit 0 of the c1 register to 1 without affecting other bits. According to the register definition above, bit 0 of c1 is MMU enable or disable, so these three codes actually turn on the MMU. (Note that the address space changes before and after the MMU is turned on. Before the MMU is turned on, the program works in the physical address space, and after the MMU is turned on, the program works in the virtual address space)

The MMU-related bits in c1 include the opening and closing of the data cache and instruction cache, the access control bits composed of the S bit and the R bit, etc. In addition, there are some other information bits in c1 that we may use.

For example: Bit7 is used to select the big-endian or small-endian mode. There is usually code in the bootloader to set this bit to inform the CPU whether the current board uses little endian or big endian. (Because this bit is 0 by default at power-on, the default mode is little endian.); Bit13 is the power-on startup address, which is the entry address of the reset exception. The power-on default is also 0, so the default power-on startup address is 0x00000000. When we use the mcr instruction to set this bit to 1, we can set the reset exception to 0xffff0000. I remember that this seems to be designed for WinCE porting support.

3. Access permission control.

Access control is mainly controlled by c3 (domain access control register) and the S bit and R bit in c1. For details, please refer to http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0151c/I273867.html.

From the introduction in the link above, we can see that the 32 bits in c3 form 16 groups, each group occupies 2 bits. If these two bits are 0x00, the specific access rules are determined by S bit + R bit. If they are 0x01 or 0x10 or 0x11, S bit and R bit have no effect. In fact, all situations are included in the following table.

4. Set bus mode

There are two functions in the bootloader that are used to set the bus mode. The specific situation of this bus mode is not very clear, so we only analyze its operation process here.

MMU_SetAsyncBusMode

     mrc p15,0,r0,c1,c0,0 ; read c1

     orr r0,r0,#R1_nF:OR:R1_iA;  

     mcr p15,0,r0,c1,c0,0 ; R1's nF and iA positions 1,11 correspond to Asynchronus bus mode

     MOV_PC_LR

MMU_SetFastBusMode

   mrc p15,0,r0,c1,c0,0

   bic r0,r0,#R1_iA:OR:R1_nF ; Clear nF and iA, 00 corresponds to fast bus mode

   mcr p15,0,r0,c1,c0,0

   MOV_PC_LR