System Control Coprocessor
3.2.8c1, Auxiliary Control Register
The purpose of the Auxiliary Control Register is to control:
•program flow
•low interrupt latency
•cache cleaning
•MicroTLB cache strategy
•cache size restriction.
For more information on how the system control coprocessor operates with caches, see Cache control and configuration on page 3-7.
Table 3-42 lists the purposes of the individual bits in the Auxiliary Control Register.
The Auxiliary Control Register is:
•in CP15 c1
•a 32-bit:
—read/write register in the Secure world
—read only register in the Non-secure world
•accessible in privileged modes only.
Figure 3-27 shows the arrangement of bits in the register.
31 30 29 28 27 |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
|
||||
F |
F |
B |
P |
|
|
C |
R |
R |
T |
S |
D |
R |
|
I |
S |
F |
H |
|
SBZ/UNP |
|
|||||||
|
Z |
V |
A |
R |
B |
B |
S |
|
|||||
O |
D |
D |
D |
|
|
|
|||||||
|
|
|
|
|
|
|
|
|
|
||||
|
|
|
|
|
Figure 3-27 Auxiliary Control Register format |
||||||||
Table 3-42 lists how the bit values correspond with the Auxiliary Control Register functions.
|
|
|
Table 3-42 Auxiliary Control Register bit functions |
|
|
|
|
Bits |
Field name |
Function |
|
|
|
|
|
[31] |
FIO |
Provides additional level of control for low interrupt latency configuration. This bit overrides the |
|
|
|
FI bit, see FI bit in c1, Control Register on page 3-44: |
|
|
|
0 |
= Normal operation for low interrupt latency configuration, reset value |
|
|
1 |
= Low interrupt latency configuration overridden. This feature: |
|
|
• |
disables the fast interrupt response introduced by setting the FI bit |
|
|
• |
disables Hit-Under-Miss (HUM) functionality |
|
|
• |
abandons restartable external accesses so that all external aborts to loads are precise. |
|
|
|
|
[30] |
FSD |
Provides additional level of control for speculative operations, see c1, Control Register on |
|
|
|
page 3-44. Force speculative operations force the PC to a new value because of static, |
|
|
|
speculative, branch prediction: |
|
|
|
0 |
= Enable force speculative operations, reset value |
|
|
1 |
= Disable force speculative operations. |
|
|
|
|
[29] |
BFD |
Disables branch folding. This behavior also depends on the SB and DB bits, [2:1] in this register, |
|
|
|
and the Z bit, see c1, Control Register on page 3-44: |
|
|
|
0 |
= Branch folding is enabled, when branch prediction is enabled, reset value |
|
|
1 |
= Branch folding is disabled. |
ARM DDI 0333H |
Copyright © 2004-2009 ARM Limited. All rights reserved. |
3-49 |
ID012410 |
Non-Confidential, Unrestricted Access |
|
|
|
|
System Control Coprocessor |
|
|
|
Table 3-42 Auxiliary Control Register bit functions (continued) |
|
|
|
|
Bits |
Field name |
Function |
|
|
|
|
|
[28] |
PHD |
Disables instruction prefetch halting on unconditional, unpredictable instructions that later result |
|
|
|
in a prefetch buffer flush. This prefetch halting is a power saving technique: |
|
|
|
0 |
= Prefetch halting is enabled, reset value |
|
|
1 |
= Prefetch halting is disabled. |
|
|
|
|
[27:7] |
- |
UNP/SBZ |
|
|
|
|
|
[6] |
CZ |
Controls the restriction of cache size to 16KB. This enables the processor to run software that |
|
|
|
does not support ARMv6 page coloring. When set the CZ bit does not effect the Cache Type |
|
|
|
Register. See Restrictions on page table mappings page coloring on page 6-41 for more |
|
|
|
information: |
|
|
|
0 |
= Normal ARMv6 cache behavior, reset value |
|
|
1 |
= Cache size limited to 16KB. |
|
|
|
|
[5] |
RV |
Disables block transfer cache operations: |
|
|
|
0 |
= Block transfer cache operations enabled, reset value |
|
|
1 |
= Block transfer cache operations disabled. |
|
|
|
|
[4] |
RA |
Disables clean entire data cache: |
|
|
|
0 |
= Clean entire data cache enabled, reset value |
|
|
1 |
= Clean entire data cache disabled. |
|
|
|
|
[3] |
TR |
Enables MicroTLB random replacement strategy. This depends on the cache replacement |
|
|
|
strategy that the RR bit controls, see c1, Control Register on page 3-44. The MicroTLB strategy |
|
|
|
is only random when the cache strategy is random: |
|
|
|
0 |
= MicroTLB replacement is Round Robin, reset value |
|
|
1 |
= MicroTLB replacement is Random if cache replacement is also Random. |
|
|
|
|
[2] |
SB |
Enables static branch prediction. This depends on program flow prediction that the Z bit enables, |
|
|
|
see c1, Control Register on page 3-44: |
|
|
|
0 |
= Static branch prediction disabled |
|
|
1 |
= Static branch prediction enabled, if the Z bit is set. The reset value is 1. |
|
|
|
|
[1] |
DB |
Enables dynamic branch prediction. This depends on program flow prediction that the Z bit |
|
|
|
enables, see c1, Control Register on page 3-44: |
|
|
|
0 |
= Dynamic branch prediction disabled |
|
|
1 |
= Dynamic branch prediction enabled, if the Z bit is set. The reset value is 1. |
|
|
|
|
[0] |
RS |
Enables the return stack. This depends on program flow prediction that the Z bit enables, see c1, |
|
|
|
Control Register on page 3-44: |
|
|
|
0 |
= Return stack is disabled |
|
|
1 |
= Return stack is enabled, if the Z bit is set. The reset value is 1. |
|
|
|
|
Table 3-43 lists the results of attempted access for each mode.
Table 3-43 Results of access to the Auxiliary Control Register
Secure Privileged |
Non-secure Privileged |
|||
|
|
|
|
User |
Read |
Write |
Read |
Write |
|
|
|
|
|
|
Data |
Data |
Data |
Undefined exception Undefined exception |
|
|
|
|
|
|
ARM DDI 0333H |
Copyright © 2004-2009 ARM Limited. All rights reserved. |
3-50 |
ID012410 |
Non-Confidential, Unrestricted Access |
|
System Control Coprocessor
To use the Auxiliary Control Register you must use a read modify write technique. To access the Auxiliary Control Register read or write CP15 with:
•Opcode_1 set to 0
•CRn set to c1
•CRm set to c0
•Opcode_2 set to 1.
For example:
MRC p15, 0, <Rd>, c1, c0, 1 ; Read Auxiliary Control Register
MCR p15, 0, <Rd>, c1, c0, 1 ; Write Auxiliary Control Register
3.2.9c1, Coprocessor Access Control Register
The purpose of the Coprocessor Access Control Register is to set access rights for the coprocessors CP0 through CP13. This register has no effect on access to CP14, the debug control coprocessor, or CP15, the system control coprocessor. This register also provides a means for software to determine if any particular coprocessor, CP0-CP13, exists in the system.
The Coprocessor Access Control Register is:
•in CP15 c1
•a 32-bit read/write register common to Secure and Non-secure worlds
•accessible in privileged modes only.
Figure 3-28 shows the arrangement of bits in the register.
31 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
|
|
SBZ/UNP |
cp13 |
cp12 |
cp11 |
cp10 |
cp9 |
cp8 |
cp7 |
cp6 |
cp5 |
cp4 |
cp3 |
cp2 |
cp1 |
cp0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Figure 3-28 Coprocessor Access Control Register format |
|||||||||||
|
Table 3-44 lists how the bit values correspond with the Coprocessor Access Control Register |
||||||||||||||||
|
functions. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table 3-44 Coprocessor Access Control Register bit functions |
||||||||||||
|
|
|
|||||||||||||||
Bits |
Field name |
Function |
|||||||||||||||
|
|
|
|
||||||||||||||
[31:28] |
- |
|
UNP/SBZ. |
||||||||||||||
|
|
|
|||||||||||||||
- |
cp<n>a |
Defines access permissions for each coprocessor. |
|||||||||||||||
|
|
|
Access denied is the reset condition. |
||||||||||||||
|
|
|
Access denied is the behavior for non-existent coprocessors: |
||||||||||||||
|
|
|
b00 |
= Access denied, reset value. Attempted access generates an Undefined exception |
|||||||||||||
|
|
|
b01 |
= Privileged mode access only |
|||||||||||||
|
|
|
b10 |
= Reserved. |
|||||||||||||
|
|
|
b11 |
= Privileged and User mode access. |
|||||||||||||
a. n is the coprocessor number between 0 and 13.
Access to coprocessors in the Non-secure world depends on the permissions set in the c1,
Non-Secure Access Control Register on page 3-55.
ARM DDI 0333H |
Copyright © 2004-2009 ARM Limited. All rights reserved. |
3-51 |
ID012410 |
Non-Confidential, Unrestricted Access |
|
System Control Coprocessor
Attempts to read or write the Coprocessor Access Control Register access bits depend on the corresponding bit for each coprocessor in c1, Non-Secure Access Control Register on page 3-55. Table 3-45 lists the results of attempted access to coprocessor access bits for each mode.
Table 3-45 Results of access to the Coprocessor Access Control Register
Corresponding bit in Non-Secure |
Secure Privileged |
Non-secure Privileged |
User |
|||
|
|
|
|
|||
Access Control Register |
Read |
Write |
Read |
Write |
||
|
||||||
|
|
|||||
|
|
|
|
|
|
|
0 |
Data |
Data |
b00 |
Ignored |
Undefined exception |
|
|
|
|
|
|
|
|
1 |
Data |
Data |
Data |
Data |
Undefined exception |
|
|
|
|
|
|
|
|
To use the Coprocessor Access Control Register read or write CP15 with:
•Opcode_1 set to 0
•CRn set to c1
•CRm set to c0
•Opcode_2 set to 2.
For example:
MRC p15, 0, <Rd>, c1, c0, 2 ; Read Coprocessor Access Control Register
MCR p15, 0, <Rd>, c1, c0, 2 ; Write Coprocessor Access Control Register
You must perform an Instruction Memory Barrier (IMB) sequence immediately after an update of the Coprocessor Access Control Register, see Memory Barriers on page 5-8. You must not attempt to execute any instructions that are affected by the change of access rights between the IMB sequence and the register update.
To determine if any particular coprocessor exists in the system write the access bits for the coprocessor of interest with a value other than b00. If the coprocessor does not exist in the system the access rights remain set to b00.
3.2.10c1, Secure Configuration Register
The purpose of the Secure Configuration Register is to define:
•the current world as Secure or Non-secure
•the world in which the core executes exceptions
•the ability to modify the A and I bits in the CPSR in the Non-secure world.
The Secure Configuration Register is: |
|
|
|
|
|
|
|
||
• |
in CP15 c1 |
|
|
|
|
|
|
|
|
• |
a 32 bit read/write register |
|
|
|
|
|
|
|
|
• |
accessible in Secure privileged modes only. |
|
|
|
|
|
|
|
|
Figure 3-29 shows the arrangement of bits in the register. |
|
|
|
|
|
|
|
||
31 |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
|
|
|
SBZ |
n |
A |
F |
E |
F |
IR |
N |
|
|
E |
I |
||||||
|
|
|
T |
W |
W |
A |
Q |
Q |
S |
Figure 3-29 Secure Configuration Register format
ARM DDI 0333H |
Copyright © 2004-2009 ARM Limited. All rights reserved. |
3-52 |
ID012410 |
Non-Confidential, Unrestricted Access |
|
System Control Coprocessor
Table 3-46 lists how the bit values correspond with the Secure Configuration Register functions.
|
|
|
Table 3-46 Secure Configuration Register bit functions |
|
|
|
|
Bits |
Field name |
Function |
|
|
|
|
|
[31:7] |
- |
UNP/SBZ. |
|
|
|
|
|
[6] |
nET |
The Early Termination bit is not implemented in ARM1176JZ-S processors. |
|
|
|
UNP/SBZ. |
|
|
|
|
|
[5] |
AW |
Determines if the A bit in the CPSR can be modified when in the Non-secure world: |
|
|
|
0 |
= Disable modification of the A bit in the CPSR in the Non-secure world, reset value |
|
|
1 |
= Enable modification of the A bit in the CPSR in the Non-secure world. |
|
|
|
|
[4] |
FW |
Determines if the F bit in the CPSR can be modified when in the Non-secure world: |
|
|
|
0 |
= Disable modification of the F bit in the CPSR in the Non-secure world, reset value |
|
|
1 |
= Enable modification of the F bit in the CPSR in the Non-secure world. |
|
|
|
|
[3] |
EA |
Determines External Abort behavior for Secure and Non-secure worlds: |
|
|
|
0 |
= Branch to abort mode on an External Abort exception, reset value |
|
|
1 |
= Branch to Secure Monitor mode on an External Abort exception. |
|
|
|
|
[2] |
FIQ |
Determines FIQ behavior for Secure and Non-secure worlds: |
|
|
|
0 |
= Branch to FIQ mode on an FIQ exception, reset value |
|
|
1 |
= Branch to Secure Monitor mode on an FIQ exception. |
|
|
|
|
[1] |
IRQ |
Determines IRQ behavior for Secure and Non-secure worlds: |
|
|
|
0 |
= Branch to IRQ mode on an IRQ exception, reset value |
|
|
1 |
= Branch to Secure Monitor mode on an IRQ exception. |
|
|
|
|
[0] |
NS bit |
Defines the world for the processor: |
|
|
|
0 |
= Secure, reset value |
|
|
1 |
= Non-secure. |
|
|
|
|
Note
When the core runs in Secure Monitor mode the state is considered Secure regardless of the state of the NS bit. However, Monitor mode code can access nonsecure banked copies of registers if the NS bit is set to 1. See the ARM Architecture Reference Manual for information on the effect of the Security Extensions on the CP15 registers.
The permutations of the bits in the Secure Configuration Register have certain security implications. Table 3-47 lists the results for combinations of the FW and FIQ bits.
|
|
Table 3-47 Operation of the FW and FIQ bits |
|
|
|
FW |
FIQ |
Function |
|
|
|
1 |
0 |
FIQs handled locally. |
|
|
|
0 |
1 |
FIQs can be configured to give deterministic Secure interrupts. |
|
|
|
1 |
1 |
Non-secure world able to make denial of service attack, avoid use of this function. |
|
|
|
0 |
0 |
Avoid because the core might enter an infinite loop for Non-secure FIQ. |
|
|
|
ARM DDI 0333H |
Copyright © 2004-2009 ARM Limited. All rights reserved. |
3-53 |
ID012410 |
Non-Confidential, Unrestricted Access |
|