ARM协处理器指令

ARM 微处理器可支持多达 16 个协处理器，用于各种协处理操作，在程序执行的过程中，每个协处理器只执行针对自身的协处理指令，忽略 ARM 处理器和其他协处理器的指令。ARM 的协处理器指令主要用于 ARM 处理器初始化 ARM 协处理器的数据处理操作，以及在ARM 处理器的寄存器和协处理器的寄存器之间传送数据，和在 ARM 协处理器的寄存器和存储器之间传送数据。 ARM 协处理器指令包括以下 5 条：

1. CDP 协处理器数操作指令
2. LDC 协处理器数据加载指令
3. STC 协处理器数据存储指令
4. MCR ARM 处理器寄存器到协处理器寄存器的数据传送指令
5. MRC 协处理器寄存器到ARM 处理器寄存器的数据传送指令

......

CP15系统控制协处理器

CP15 —系统控制协处理器 （the system control coprocessor）他通过协处理器指令MCR和MRC提供具体的寄存器来配置和控制caches、MMU、保护系统、配置时钟模式（在bootloader时钟初始化用到）

CP15的寄存器只能被MRC和MCR（Move to Coprocessor from ARM Register ）指令访问

一些要说明的内容，摘录见下：:

Co-processors

There are between zero and three possible co-processors. Most desktop ARM systems do not have logic for external co-processors, so we may either use that which is built into the ARM itself, or an emulated co-processor.
CP15 is reserved on the ARM 3 and later processors for internal configuration, as described in this document.
CP0 and CP1 is used by the floating point system. It may either be an external floating point chip (as used with the ARM 3), hardware built into the processor (as in the ARM 7500FE), or a totally software-based emulation (as with the  FPEmulator  that we all know).

Here is a short exercise for you:

    10 DIM code% 16
    20 P% = code%
    30 [ OPT     3
    40   CDP     CP1, 0, C0, C1, C2, 0
    50   ADFS    F0, F1, F3
    60   MOV     PC, R14
    70 ]
   >RUN
   00008F78                    OPT     3
   00008F78 EE010102           CDP     CP1, 0, C0, C1, C2
   00008F7C EE010102           ADFS    F0, F1, F2
   00008F80 E1A0F00E           MOV     PC, R14
   >

What do you notice?  :-)

 

When the ARM executes a co-processor instruction, or an undefined instruction, it will offer it to any co-processors which may be presently attached. If hardware is available to process the given instruction, then it is expected to do so. If it is busy at the time the instruction is offered, the ARM will wait for it.
If there is no co-processor capable of executing the instruction, the ARM will take its undefined instruction trap, in which case the following will happen:

• The PSR and PC are both saved (the method differs for 26 bit and 32 bit ARMs)
• SVC mode (26 bit) / UND mode (32 bit) is entered, and the I bit of the PSR is set
• The instruction at address &00000004 is executed

This trap may be used to add instructions to the instruction set by emulation, or to implement a software emulation of hardware that isn't fitted. The  Floating Point Emulator  works by doing this.

To return, simply pull the saved PC and PSR (depends on 26/32 bit) and push them to the current PC and PSR, like MOVS PC, R14 in 26 bit systems. This will pick up with the instruction following the one which caused the trap.

All of the co-processor instructions can be executed conditionally. Please note that the conditionals relate to the status of the ARM processor, and not the status of any of the co-processors. This is because the ARM always tries the instruction first, and offers it around and maybe takes the undefined application trap, so the conditions are ARM related.
To make this clearer:

    10 DIM code% 32
    20 P% = code%
    30 [ OPT     3
    40   FLTS    F0, R0
    50   FLTS    F1, R1
    60   FMLS    F2, F0, F1
    70   FIX     R0, F2
    80   MOVS    PC, R14
    90 ]
   100 INPUT "First number : "A%
   110 INPUT "Second number: "B%
   120 PRINT USR(code%)

This probably won't assemble without an enhanced BASIC assembler.

Anyway, you might think the ARM will hand over to the floating point co-processor to do the four FP instructions, then hand back afterwards.
If you did, you would be incorrect!

What actually is executed is:

   MCR     CP1, 0, R0, C0, C0
   MCR     CP1, 0, R1, C1, C0
   CDP     CP1, 9, C2, C0, C1
   MRC     CP1, 0, R0, C0, C2

It is worth pointing out that objasm specifies co-processor registers using the CR notation (ie, CR0 - CR15), which is first defined with the CN directive. It does not appear as if default co-processor instructions are defined in Nick Roberts' ASM, though I've only looked in the instructions at the "defined symbols" section...
Darren Salt's ExtBASICasm provides the register names C0 - C15 to refer to the co-processors. So if any of these examples fail when you try to assemble them, please check what format your assembler provides these instructions.

 

 

MRC

The instruction  MRC  transfers a co-processor register to an ARM register. It takes the form:

   MRC    <co-pro>, <op>, <ARM reg>, <co-pro reg>, <co-pro reg2>, <op2>

The co-processor is denoted in most assemblers by  CPx .
The register  <co-pro reg>  is written to  <ARM reg> , using operation  <op> . This may, possibly, be further modified by  <co-pro reg2>  and  <op2> . For an idea of the sorts of times when this might be necessary, consider instructions of the form  LDR Ra, [Rb], #x . 
The final  <op2>  may be omitted, as it is in the example, but the other parts of the MRC instruction must be supplied.

 

MCR

The instruction  MCR  transfers an ARM register to a co-processor register. It takes the form:

   MCR    <co-pro>, <op>, <ARM reg>, <co-pro reg>, <co-pro reg2>, <op2>

The co-processor is free to interpret the fields as it desires, but the standard interpretation is that the contents of the ARM register are written to the co-processor register using the operation code given, which may be further modified by the second co-processor register and/or the second operation code.

在U-Boot中我们用到了c7 和 c8这两个协处理器，再来看看MCR的详细用法：

MCR指令：

MCR指令将ARM处理器的寄存器中的数据传送到协处理器寄存器中。如果协处理器不能成功地执行该操作，将产生未定义的指令异常中断。

指令语法格式：

MCR{<cond>} <p>，< opcode_1>，<Rd>,<CRn>,<CRm>{,<opcode_2>}

MCR{<cond>} p15，0，<Rd>,<CRn>,<CRm>{,<opcode_2>}

其中

• <cond>

  指令执行的条件码.当<cond>忽略时指令为无条件执行。

• <opcode_1>

  协处理器将执行的操作的操作码。对于CP15协处理器来说，<opcode_1>永远为0b000，当<opcode_1>不为0b000时，该指令操作结果不可预知。

• <Rd>

  作为源寄存器的ARM寄存器，其值将被传送到协处理器寄存器中

• <CRn>

  作为目标寄存器的协处理器寄存器，其编号可能是C0，C1，…，C15。

<CRm>和<opcode_2>两者组合决定对协处理器寄存器进行所需要的操作，如果没有指定，则将为<CRm>为C0，opcode_2为0

  	  mcr	p15, 0, r0, c7, c7, 0	/* flush v3/v4 cache */

可以看出，其中

rd为r0=0

CRn为C7

CRm为C7

对于这行代码的作用，以此按照语法，来一点点解释如下：

首先，mcr做的事情，其实很简单，就是“ARM处理器的寄存器中的数据传送到协处理器寄存器中”，

此处即是，将ARM的寄存器r0中的数据，此时r0=0,所以就是把0这个数据，传送到协处理器CP15中。

而对应就是写入到“<CRn>”这个“目标寄存器的协处理器寄存器”，此处CRn为C7，即将0写入到寄存器7（Register 7）中去。

而上面关于Register 7的含义中也说了，“Any data written to this location will cause the selected cache to be flushed”，即你往这个寄存器7中写入任何数据，都会导致对应的缓存被清空。而到底那个缓存被清空呢，即我们这行指令

mcr	p15, 0, r0, c7, c7, 0

起了什么作用呢

那是由“<CRm>和<opcode_2>两者组合决定”的。

而此处CRm为C7，opcode_2为0，而对于C7和0的组合的作用，参见上面的那个表中Register 7中的Flash I+D那一行，

当opcode_2为0，CRm为0111=7，就是我们要找的，其作用是“Flush I + D”，即清空指令缓存I Cache和数据缓存D Cache。

根据该表，同理，如果是opcode_2=0，而CRm=0101b=5，那么对应的就是去“Flush I”，即只清除指令缓存I Cache了。

而对应的指令也就是

mcr	p15, 0, r0, c7, c5, 0

此注释说此行代码的作用是，清理v3或v4的缓存

其中v4，我们很好理解，因为我们此处的CPU是ARM920T的核心，是属于ARM V4的，而为何又说，也可以清除v3的cache呢？

那是因为，本身这些寄存器位域的定义，都是向下兼容的，参见上面引用的内容，也写到了：

ARM 710

• Register 7 - IDC flush (write only)

  Any data written to this location will cause the IDC (Instruction/Data cache) to be flushed.

即，对于ARM7的话，你写同样的这行代码

mcr	p15, 0, r0, c7, c7, 0

也还是向register 7中写入了数据0，这也同样满足了其所说的“Any data written to this location”，也会产生同样的效果“cause the IDC (Instruction/Data cache) to be flushed”。

同理，可以看出此行是去操作寄存器8，而对应的各个参数为：

rd为r0=0

CRn为C8

CRm为C7

opcode_2为0

对照寄存器8的表：

• Register 8 - TLB operations (write only)

  Any data written to this location will cause the selected TLB flush operation.

  The OPC_2 and CRm co-processor fields select which cache

  operation should occur:

  Function OPC_2 CRm Data

  Flush I + D %0000 %0111 -

  Flush I %0000 %0101 -

  Flush D %0000 %0110 -

  Flush D single %0001 %0110 Virtual address”

其含义为：

向寄存器8中写入数据，会导致对应的TLB被清空。具体是哪个TLB，由opcode_2和CRm组合决定，

此处opcode_2为0，CRm为7=0111b，所以对应的作用是“Flush I + D”，即清空指令和数据的TLB。