27troadster
Posts: 16
Joined: Sun Apr 12, 2015 12:10 pm

RPi B+ Coprosser 15 register settings upon start up

Tue Nov 24, 2015 11:06 pm

In order to know how the arm on the BCM2835 is set up upon booting to a bare metal program, I went through and read all the coprocessor 15 registers and combined that with information from the arm1176 tech manual. I am posting it here for everyone to use.

The format of the following is:
The mrc instruction I used to get the data for the register.
Then the noun name and Op2 code for that register.
The value of the register as returned by "mrc" in hex.
The value of the register as returned by "mrc" in binary.
Then the bit number 31-0, these numbers line up to the binary number when used with a font that uses equal spacing for each character. (I don't see an option to change the font within this post, so I'll leave it the way it is)

It took awhile to put this together, but it was definitely worth the time, I use it as a reference quite often and wanted to share with all of you to use.

Kipp



Co-processor cp15 register data when running Rpi from bare metal.

Ref: arm1176jzfs Tech Manual, Table 3-2 on page 3-14

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c0,c0,Op2:

Main ID: (Op2 = 0)
0x410FB767
0100 0001 0000 1111 1011 0111 0110 0111
31 24 23 16 15 8 7 0
[31:24] 0x41 Implementer: ARM Limited
[23:20] 0x0 Variant number: 0
[19:16] 0xF This means the architecture is given in the CPUID registers
[15:4] 0xB76 Primary part number: ARM1176JZF-S
[3:0] 0x7 Minor Revision number: r0p7

Cache Register: (Op2 = 1)
0X1D152152
0001 1101 0001 0101 0010 0001 0101 0010
31 24 23 16 15 8 7 0

[31:29] SBZ
[28:25] 1110 This processor supports:
• write back cache
• Format C cache lockdown
• Register 7 cache cleaning operations.
[24] b1 Processor has separate instruction and data caches

Data cache info: [23:12]
[23] b0 Pbit: no restriction on page allocation for VA
[22] SBZ
[21:18] b0101 size: 16KB Data cache
[17:15] b010 Processor has 4-way associativity
[14] b0 M bit = 0 (note a)
[13:12] b10 Cache line length of 8 words, that is 32 bytes.

Instruction cache information:[11:0]
[11] b0 Pbit: no restriction on page allocation for VA
[10] SBZ
[9:6] b0101 size: 16KB instruction cache
[5:3] b010 4-way Associativity
[2] b0 M bit = 0 (note a)
[1:0] b10 Cache line length of 8 words, that is 32 bytes.

NOTES:
a. In the ARM1176JZF-S processor the M bit is set to 0, for the Data and Instruction Caches. It is used along with size to determine size of cache and with the associativity bit to determine associativity. Ref ARM reference man. Pg B6-16.
b. According to ARM reference manual pg. B6-6:
Cache size = ASSOCIATIVITY × NSETS × LINELEN
= NWAYS × NSETS × LINELEN
= NWAYS × 2S × 2L bytes
ASSOCIATIVITY = NWAYS = 4
NSETS = 2^7 = 128
LINELEN = 32
Cache size = 4*128*32 = 16384B = 16KBb.
c. Way numbers are 3=0 (associativity = 4). Looking at it from a set point of view: Each set has 4 cache lines, each line within a set is assigned a way number. Looking at it from a way point of view: each cache way has 128 cache lines (one line in each set, 128 sets).



TCM Status Register: (Op2 = 2)
0x00000000
b0
[31:29] - Always b000.
[28:19] - UNPSBZ
[18:16] DTCM Indicates the number of Data TCM banks implemented.
b000 = 0 Data TCMs
b001 = 1 Data TCM
b010 = 2 Data TCMs
All other values reserved
[15:3] - UNP/SBZ
[2:0] ITCM Indicates the number of Instruction TCM banks implemented.
b000 = 0 Instruction TCMs
b001 = 1 Instruction TCM
b010 = 2 Instruction TCMs

=> no TCM on Rpi?????

TLB Type Register: (Op2 = 3)
0x00000800
0000 0000 0000 0000 0000 1000 0000 0000
31 24 23 16 15 8 7 0

[31:24] UNP/SBZ
[23:16] 0x0 Ilsize: Instruction lockable size specifies the number of instruction TLB lockable entries. 0 => unified TLB see [0] below
[15:8] 0x08 Dlsize: Data lockable size specifies the number of unified or data TLB lockable entries. 0X08 => 8 unified TLB lockable entries
[7:1] UNP/SBZ
[0] 0 Unified TLB, ie. does not have separate instruction and data TLBs.







Ref pg: 3-26 CPUID Registers:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c0,c1,Op2:

Processor Feature Register 0 (Op2 = 0)
0x00000111
0000 0000 0000 0000 0000 0001 0001 0001
31 24 23 16 15 8 7 0

[31:16] 0 Reserved. RAZ.
[15:12] 0 State3 Processor does not support Thumb-2. (State3)
[11:8] 1 State2 Processor supports Java.
[7:4] 1 State1 Processor supports Thumb-1.
[3:0] 1 State0 Processor supports 32-bit ARM instructions.

Processor Feature Register 1 (Op2 = 1)
0x00000011
0000 0000 0000 0000 0000 0000 0001 0001
31 24 23 16 15 8 7 0

[31:12] - Reserved. RAZ
[11:8] 0 Does not support “Microcontroller programmer’s Model”
[7:4] 1 Supports Security Extension Architecture v1, TrustZone.
[3:0] 1 Supports standard ARMv4 Programmer’s Model

Debug Feature Register 0 (Op2 = 2)
0x00000033
0000 0000 0000 0000 0000 0000 0011 0011
31 24 23 16 15 8 7 0

[31:24] 0 Reserved. RAZ.
[23:20] 0 Does not support memory-mapped microcontroller debug model
[19:16] 0 Does not support memory-mapped Trace debug model
[15:12] 0 Does not support coprocessor-based Trace debug model
[11:8] 0 Does not support embedded processor debug model
[7:4] 0x3 Supports the v6.1 Secure debug architecture based debug model.
[3:0] 0x3 Supports the v6.1 debug model.

Auxiliary Feature Register 0 (Op2 = 3)
0x0
The contents of the Auxiliary Feature Register 0 [31:16] are Reserved. The contents of the
Auxiliary Feature Register 0 [15:0] are Implementation Defined. In the ARM1176JZF-S
processor, the Auxiliary Feature Register 0 reads as 0x00000000.

Memory Model Feature Register 0 (Op2 = 4)
0x01130003
0000 0001 0001 0011 0000 0000 0000 0011
31 24 23 16 15 8 7 0

[31:28] 0 Reserved. RAZ.
[27:24] 1 Supports FCSE.
[23:20] 1 Supports Auxiliary Control Register.
[19:16] 0x3 Supports ARMv6 TCM and DMA.
[15:12] 0 Does not support cache coherency with DMA agent, shared memory model.
[11:8] 0 Does not support cache coherency support with CPU agent, shared memory model.
[7:4] 0 Does not support Protected Memory System Architecture (PMSA).
[3:0] 0x3 Supports Virtual Memory System Architecture (VMSA)v7 remapping and access flag.

Memory Model Feature Register 1 (Op2 = 5)
0x10030302
0001 0000 0000 0011 0000 0011 0000 0010
31 24 23 16 15 8 7 0

[31:28] 1 Processor requires flushing of branch predictor on VA change.
[27:24] 0 Does not support test and clean operations on data cache, Harvard or unified architecture.
[23:20] 0 Does not have unified architecture.
[19:16] 0x3 Supports level one cache, maintenance operations, for Harvard architecture:
• invalidate instruction cache including branch prediction
• invalidate data cache
• invalidate instruction and data cache including branch prediction
• clean data cache, recursive model using cache dirty status bit
• clean and invalidate data cache, recursive model using cache dirty status bit.
[15:12] 0 Does not have unified architecture.
[11:8] 0x3 Supports level one cache line maintenance operations by Set/Way, for Harvard architecture:
• clean data cache line by Set/Way
• clean and invalidate data cache line by Set/Way
• invalidate data cache line by Set/Way
• invalidate instruction cache line by Set/Way.
[7:4] 0 Does not have unified architecture.
[3:0] Ox2 Supports level one cache line maintenance operations by MVA, for Harvard architecture:
• clean data cache line by MVA
• invalidate data cache line by MVA
• invalidate instruction cache line by MVA
• clean and invalidate data cache line by MVA
• invalidation of branch target buffer by MVA.

Memory Model Feature Register 2 (Op2 = 6)
0x01222100
0000 0001 0010 0010 0010 0001 0000 0000
31 24 23 16 15 8 7 0

[31:28] 0 Does not support a Hardware access flag.
[27:24] 1 Supports Wait For Interrupt.
[23:20] 0x2 Supports memory barrier operations:
• Data Synchronization Barrier
• Prefetch Flush
• Data Memory Barrier.
[19:16] 0x2 Supports TLB maintenance operations, unified architecture.
• invalidate all entries
• invalidate TLB entry by MVA
• invalidate TLB entries by ASID match.
[15:12] 0x2 Supports TLB maintenance operations, Harvard architecture:
• invalidate instruction and data TLB, all entries
• invalidate instruction TLB, all entries
• invalidate data TLB, all entries
• invalidate instruction TLB by MVA
• invalidate data TLB by MVA
• invalidate instruction and data TLB entries by ASID match
• invalidate instruction TLB entries by ASID match
• invalidate data TLB entries by ASID match.
[11:8] 1 Supports cache maintenance range operations, Harvard architecture:
• invalidate data cache range by VA
• invalidate instruction cache range by VA
• clean data cache range by VA
• clean and invalidate data cache range by VA.
[7:4] 0 Does not support background prefetch cache range operations, Harvard architecture.
[3:0] 0 Does not support foreground prefetch cache range operations, Harvard architecture.

Memory Model Feature Register 3 (Op2 = 7)
0x00000000

[31:8] 0 Reserved. RAZ.
[7:4] 0 Does not support hierarchical cache maintenance by MVA, all architectures.
[3:0] 0 Does not support hierarchical cache maintenance by Set/Way, all architectures.








Ref pg: 3-36 Instruction Set Feature Registers:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c0,c2,Op2:

Instruction Set Attributes Register 0 (Op2 = 0)
0x00140011
0000 0000 0001 0100 0000 0000 0001 0001
31 24 23 16 15 8 7 0

[31:28] 0 Reserved. RAZ.
[27:24] 0 Does not Support divide instructions.
[23:20] 1 Supports debug instruction BKPT.
[19:16] 0X4 supportS coprocessor instructions:
• CDP, LDC, MCR, MRC, STC
• CDP2, LDC2, MCR2, MRC2, STC2
• MCRR, MRRC
• MCRR2, MRRC2.
[15:12] 0 Does not support combined compare and branch instructions.
[11:8] 0 Does not support bitfield instructions.
[7:4] 1 Supports bit counting instruction CLZ.
[3:0] 1 Supports atomic load and store instructions SWP and SWPB.

Instruction Set Attributes Register 1 (Op2 = 1)
0x12002111
0001 0010 0000 0000 0010 0001 0001 0001
31 24 23 16 15 8 7 0

[31:28] 1 Supports Java instructions BXJ and J bit in PSRs.
[27:24] 0x2 Supports interworking instructions:
• BX, and T bit in PSRs
• BLX, and PC loads have BX behavior.
[23:20] 0 Does not support for immediate instructions.
[19:16] 0 Does not support for if then instructions.
[15:12] 0x2 Support sign or zero extend instructions:
• SXTB, SXTB16, SXTH, UXTB, UXTB16, and UXTH
• SXTAB, SXTAB16, SXTAH, UXTAB, UXTAB16, and UXTAH.
[11:8] 1 Supports exception 2 instructions: SRS, RFE, and CPS.
[7:4] 1 Supports exception 1 instructions: LDM(2), LDM(3) and STM(2).
[3:0] 1 Supports endianness control instructions: SETEND and E bit in PSRs.

Instruction Set Attributes Register 2 (Op2 = 2)
0x11231121
0001 0001 0010 0011 0001 0001 0010 0001
31 24 23 16 15 8 7 0
[31:28] 1 Supports reversal instructions: REV, REV16, and REVSH.
[27:24] 1 Supports PSR instructions: MRS and MSR exception return instructions for data-processing.
[23:20] 0x2 Supports advanced unsigned multiply instructions:
• UMULL and UMLAL
• UMAAL.
[19:16] 0x3 Supports advanced signed multiply instructions:
• SMULL and SMLAL
• SMLABB, SMLABT, SMLALBB,SMLALBT, SMLALTB, SMLALTT, SMLATB,
SMLATT, SMLAWB, SMLAWT, SMULBB, SMULBT, SMULTB, SMULTT, SMULWB,
SMULWT, and Q flag in PSRs
• SMLAD, SMLADX, SMLALD, SMLALDX, SMLSD, SMLSDX, SMLSLD, SMLSLDX,
SMMLA, SMMLAR, SMMLS, SMMLSR, SMMUL, SMMULR, SMUAD, SMUADX,
SMUSD, and SMUSDX.
[15:12] 1 Supports multiply instruction: MLA.
[11:8] 1 Supports multi-access interruptible instructions: restartable LDM and STM.
[7:4] 0x2 Supports memory hint instruction: PLD.
[3:0] 1 Supports load and store instructions: LDRD and STRD.

Instruction Set Attributes Register 3 (Op2 = 3)
0x01102131
0000 0001 0001 0000 0010 0001 0011 0001
31 24 23 16 15 8 7 0

[31:28] 0 Does not support for Thumb-2 extensions.
[27:24] 1 Supports true NOP instructions and NOP compatable instructions except NOP16.
[23:20] 1 Supports Thumb copy instructions: MOV(3) low register ⇒ low register, and the CPY alias for Thumb MOV(3).
[19:16] 0 Does not support table branch instructions.
[15:12] 0x2 Supports synchronization primitive instructions:
• LDREX and STREX
• LDREXB, LDREXH, LDREXD, STREXB, STREXH, STREXD, and CLREX
[11:8] 1 Supports SVC instructions.
[7:4] 0x3 Supports Single Instruction Multiple Data (SIMD) instructions: PKHBT, PKHTB, QADD16, QADD8, QADDSUBX, QSUB16, QSUB8, QSUBADDX, SADD16, SADD8, SADDSUBX, SEL, SHADD16, SHADD8, SHADDSUBX, SHSUB16, SHSUB8, SHSUBADDX, SSAT, SSAT16, SSUB16, SSUB8, SSUBADDX, SXTAB16, SXTB16, UADD16, UADD8, UADDSUBX, UHADD16, UHADD8, UHADDSUBX, UHSUB16, UHSUB8, UHSUBADDX, UQADD16, UQADD8, UQADDSUBX, UQSUB16, UQSUB8, UQSUBADDX, USAD8, USADA8, USAT, USAT16, USUB16, USUB8, USUBADDX, UXTAB16, UXTB16, and the GE[3:0] bits in the PSRs.
[3:0] 1 Supports saturate instructions: QADD, QDADD, QDSUB, QSUB and Q flag in PSRs.

Instruction Set Attributes Register 4 (Op2 = 4)
0x00001141
0000 0000 0000 0000 0001 0001 0100 0001
31 24 23 16 15 8 7 0

[31:24] 00 Reserved. RAZ.
[23:20] 0 Supports all synchronization primitive instructions.
See Table 3-34 on page 3-41.
[19:16] 0 Supports only the CP15 barrier operations.
[15:12] 1 Supports SMC instruction.
[11:8] 1 Supports all defined writeback addressing modes.
[7:4] 0x4 Supports with shift instructions:
• shifts of loads and stores over the range LSL 0-3
• constant shift options
• register controlled shift options.
[3:0] 1 Supports Unprivileged instructions: LDRBT, LDRT, STRBT, and STRT.

Instruction Set Attributes Register 5 (Op2 = 5)
0x00000000

The contents of the Instruction Set Attributes Register 5 are implementation defined. In the
ARM1176JZF-S processor, Instruction Set Attributes Register 5 is read as 0x00000000.








Ref pg: 3-44 Control Registers:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c1,c0,Op2:

Control Register (Op2 = 0)
0x00050078
0000 0000 0000 0101 0000 0000 0111 1000
31 24 23 16 15 8 7 0

The purpose of the Control Register is to provide control and configuration of:
• memory alignment, endianness, protection, and fault behavior
• MMU and cache enables and cache replacement strategy
• interrupts and the behavior of interrupt latency
• the location for exception vectors
• program flow prediction.

Values upon start up are: (values of interest are bolded)
[31:30] 00 UNP when read. Write as the existing value.
[29] 0 Force Access permissions are disabled
[28] 0 TEX remap disabled. Normal ARMv6 behavior.
[27:26] 00 UNP when read. Write as the existing value.
[25] 0 EE bit: CPSR E bit is set to 0 on an exception.
[24] 0 VE bit: Interrupt vectors are fixed
[23] 0 XP bit: Subpage Access Permissions bits enabled
[22] 0 U bit: Unaligned data access support disabled
[21] 0 FI bit: All performance features enabled
[20:19] 00 UNP/SBZ
[18] 1 IT bit: Deprecated. Global enable for instruction TCM.
Function redundant in ARMv6.
[17] 0 UNP/SBZ
[16] 1 DT bit: Deprecated. Global enable for data TCM.
Function redundant in ARMv6.
[15] 0 L4 bit: Loads to PC set the T bit
[14] 0 RR bit: Normal replacement strategy by random replacement
[13] 0 V bit: Normal exception vectors selected, the Vector Base Address Registers determine the address range
[12] 0 I bit: Instruction Cache disabled
[11] 0 Z bit: Program flow prediction disabled, reset value.
[10] 0 F bit: Should Be Zero
[9] 0 R bit: Banked Deprecated. ROM protection disabled
[8] 0 S bit: Banked Deprecated. MMU protection disabled
[7] 0 B bit: Little-endian memory system
[6:4] b1111 This field returns 1 when read.
[3] 0 W bit: Not implemented in the processor.
[2] 0 C bit: Data cache disabled, reset value.
[1] 0 A bit: Strict alignment fault checking disabled
[0] 0 M bit: MMU disabled

Auxiliary Control Register (Op2 = 1)
0x00000007
0000 0000 0000 0000 0000 0000 0000 0111
31 24 23 16 15 8 7 0

[31] 0 FIO bit: (overrides the FI bit) Normal operation for low interrupt latency configuration
[30] 0 FSD: Enable force speculative operations
1 = Disable force speculative operations.
[29] 0 BFD: Branch folding is enabled
[28] 0 PHD: Prefetch halting is enabled
[27:7] 0 UNP/SBZ
[6] 0 CZ: Normal ARMv6 cache behavior, size not restricted to 16KB
[5] 0 RV: Block transfer cache operations enabled
[4] 0 RA: Clean entire data cache enabled
[3] 0 TR: MicroTLB replacement is Round Robin
[2] 1 SB: Static branch prediction enabled, if the Z bit is set.
[1] 1 DB: Dynamic branch prediction enabled, if the Z bit is set.
[0] 1 RS: Return stack is enabled, if the Z bit is set.

Coprocessor Access Control Register (Op2 = 2)
0x00000000

all access rights to Coprocessors 0-13 are denied.
NOTE see pg 3-52 for instructions on how to determine if a co-processor exists.









Ref pg: 3-52 Secure Configuration Registers:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c1,c1,Op2:

Secure Configuration Register (Op2 = 0)
0x00000000

[31:7] 0 UNP/SBZ.
[6] 0 ET: Early Termination bit not implemented
[5] 0 AW: Disables modification of the A bit in the CPSR in the Non-secure world
[4] 0 FW: Disables modification of the F bit in the CPSR in the Non-secure world
[3] 0 EA: Branch to abort mode on an External Abort exception
[2] 0 FIQ: Branch to FIQ mode on an FIQ exception
[1] 0 IRQ: Branch to IRQ mode on an IRQ exception
[0] 0 NS: Secure mode

Secure Debug Enable Register (Op2 = 1)
0x00000000

[31:2] 0 UNP when read. Write as the existing value.
[1] 0 SUNIDEN: Non-invasive debug is not permitted in Secure User mode
[0] 0 SUIDEN: Invasive debug is not permitted in Secure User mode

Non-Secure Access Control Register (Op2 = 2)
0x00000000

[31:19] 0 Reserved. UNP/SBZ.
[18] 0 DMA: DMA reserved for the Secure world only and the Secure page tables are used for DMA transfers
[17] 0 TL: Reserve TLB Lockdown registers for Secure operation only
[16] 0 CL: Reserve cache lockdown registers for Secure operation only
[15:14] 0 Reserved. UNP/SBZ.
[13:0] 0 CPna: Secure access only to co-processors 0-13














Ref pg: 3-57 Translation Table Registers:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c2,c0,Op2:

Translation Table Base Register 0 (Op2 = 0)
0x00000000

[31:14-N] 0 Translation table base 0 Holds the translation table base address, the physical address of the first level translation table. The reset value is 0.
[13-N:5] 0 UNP/SBZ.
[4:3] 0 RGN: Outer cacheable attributes for page table walking: Outer Noncacheable
[2] 0 P: Error-Correcting Code (ECC) is disabled (not available on ARM11276JZF-S)
[1] 0 S: Page table walk Non-Shared
[0] 0 C: Page table walk is Inner noncacheable

Translation Table Base Register 1 (Op2 = 1)
0x00000000

[31:14] 0 Translation table base 1 Holds the translation table base address, the physical address of the first level
translation table. The reset value is 0.
[13:5] 0 UNP/SBZ.
[4:3] 0 RGN: Outer cacheable attributes for page table walking: Outer Noncacheable
[2] 0 P: Error-Correcting Code (ECC) is disabled(not available in ARM11276JZF-S)
[1] 0 S: Page table walk is Non-Shared
[0] 0 C: Page table walk is Inner Noncacheable

Translation Table Base Control Register (Op2 = 2)
0x00000000

[31:6] 0 UNP/SBZ.
[5] 0 PD1: The processor performs a page table walk on a TLB miss, with Secure or Non-secure privilege appropriate to the current world.
[4] 0 PD0: The processor performs a page table walk on a TLB miss, with Secure or Non-secure privilege appropriate to the current world.
[3] 0 UNP/SBZ.
[2:0] 0 N: Specifies the boundary size of Translation Table Base Register 0: 16KB









Ref pg: 3-63 Domain Access Control Register:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c3,c0,Op2:

Domain Access Control Register (Op2 = 0)
0x00000000

The purpose of the Domain Access Control Register is to hold the access permissions for a maximum of 16 domains

D<n>a The purpose of the fields D15-D0 in the register is to define the access permissions for each one of the 16 domains. These domains can be either sections, large pages or small pages of memory:
b00 = No access, reset value. Any access generates a domain fault.









Ref pg: 3-64 Fault Status Registers:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c5,c0,Op2:

Data Fault Status Register (Op2 = 0)
0x00000000

[31:13] 0 UNP/SBZ.
[12] 0 SD: AXI Decode error caused the abort
[11] 0 RW: Read access caused the abort
[10] 0 S: Part of the Status field. See Bits [3:0] in this table. The reset value is 0.
[9:8] 0 Always read as 0. Writes ignored.
[7:4] 0 Domain Indicates the domain from the 16 domains, D15-D0, is accessed when a data fault occurs. Takes values 0-15. The reset value is 0.
[3:0] 0 (with bit[10] = 0)Status Indicates type of fault generated. b0000 = no function
[3:0] 0 (with bit[10] = 1)Status Indicates type of fault generated. b0000 = no function

Instruction Fault Status Register (Op2 = 1)
0x00000000

[31:13] 0 UNP/SBZ.
[12] 0 SD: AXI Decode error caused the abort
[11] 0 RW: Read access caused the abort
[10] 0 S: Part of the Status field. See Bits [3:0] in this table. The reset value is 0.
[9:8] 0 Always read as 0. Writes ignored.
[7:4] 0 Domain Indicates the domain from the 16 domains, D15-D0, is accessed when a data fault occurs. Takes values 0-15. The reset value is 0.
[3:0] 0 (with bit[10] = 0)Status Indicates type of fault generated. b0000 = no function
[3:0] 0 (with bit[10] = 1)Status Indicates type of fault generated. b0000 = no function









Ref pg: 3-64 Fault Address Register:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c6,c0,Op2:

Fault Address Register (Op2 = 0)
0x00000000

The purpose of the Fault Address Register (FAR) is to hold the Modified Virtual Address (MVA)of the fault when a precise abort occurs.

Watchpoint Fault Address Register (Op2 = 1)
0x00000000

Access to the Watchpoint Fault Address register through the system control coprocessor is
deprecated, see CP14 c6, Watchpoint Fault Address Register (WFAR) on page 13-12.

Instruction Fault Address Register (Op2 = 2)
0x00000000

The purpose of the Instruction Fault Address Register (IFAR) is to hold the address of instructions that cause a prefetch abort.








Ref pg: 3-80 Cache operations:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c7,c4,Op2:

PA Register (Op2 = 0)
0x00000000

The purpose of the PA Register is to hold:
• the PA after a successful translation
• the source of the abort for an unsuccessful translation.


mrc p15,0,r0,c7,c10,Op2:
Cache Dirty Status Register (Op2 = 6)
0x00000000

The purpose of the Cache Dirty Status Register is to indicate when the Cache is dirty.

[31:1] 0 UNP/SBZ.
[0] 0 C: Indicates if the cache is dirty.
0 = indicates that no write has hit the cache since the last cache clean, clean and invalidate, or
invalidate all operation, or reset, successfully left the cache clean. This is the reset value.
1 = indicates that the cache might contain dirty data.









Ref pg: 3-87 Data and instruction cache lockdown registers:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c9,c0,Op2:

Data cache lockdown registers (Op2 = 0)
0xFFFFFFF0
1111 1111 1111 1111 1111 1111 1111 0000
31 24 23 16 15 8 7 0

[31:4] 0xF SBO UNP on reads, SBO on writes.
[3:0] 0 L: bit for each cache way (ways 3 to 0) 0 indicates that this cache way is not locked. Allocation to this cache way is determined by the
standard replacement algorithm. This is the reset state.
1 indicates that this cache way is locked. No allocation is performed to this cache way.

Instruction cache lockdown registers (Op2 = 1)
0xFFFFFFF0
1111 1111 1111 1111 1111 1111 1111 0000
31 24 23 16 15 8 7 0

[31:4] 0xF SBO UNP on reads, SBO on writes.
[3:0] 0 L: bit for each cache way (ways 3 to 0) 0 indicates that this cache way is not locked. Allocation to this cache way is determined by the
standard replacement algorithm. This is the reset state.
1 indicates that this cache way is locked. No allocation is performed to this cache way.








Ref pg: 3-89 Data and Instruction TCM Region Register:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c9,c1,Op2:

Data TCM Region Register (Op2 = 0)
0x00000000

[31:12] 0 Base address Contains the physical base address of the TCM.
The base address must be aligned to the size of the TCM.
Any bits in the range [(log2(RAMSize)-1):12] are ignored. The base address is 0 at Reset.
[11:7] 0 UNP/SBZ.
[6:2] 0 Size Indicates the size of the TCM on reads. All other values are reserved:
b00000 = 0KB
b00011 = 4KB
b00100 = 8KB
b00101 = 16KB
b00110 = 32KB.
[1] 0 UNP/SBZ.
[0] 0 En: TCM disabled, reset value
1 = TCM enabled.

Instruction TCM Region Register (Op2 = 1)
0x00000000

[31:12] 0 Base address: Contains the physical base address of the TCM. The base address must be aligned to the size of the
TCM. Any bits in the range [(log2(RAMSize)-1):12] are ignored.
The base address is 0 at Reset.
[11:7] 0 UNP/SBZ.
[6:2] 0 Size of the TCM on reads. All other values are reserved:
b00000 = 0KB
b00011 = 4KB
b00100 = 8KB
b00101 = 16KB
b00110 = 32KB.
[1] 0 UNP/SBZ.
[0] 0 En: Indicates if the TCM is enabled:
0 = TCM disabled.
1 = TCM enabled.
The reset value of this bit depends on the value of the INITRAM static configuration signal. If
INITRAM is HIGH then this bit resets to 1. If INITRAM is LOW then this bit resets to 0. For more
information see Static configuration signals on page A-4.

Data TCM Non-secure Control Access Register (Op2 = 2)
0x00000000

[31:1] 0 UNP/SBZ.
[0] 0 NS access Makes Data TCM invisible to the Non-secure world and makes TCM data Secure.
0 = Data TCM Region Register only accessible in the Secure world. Data TCM only visible in the Secure world and only when the NS Attribute in the page table is 0.

Instruction TCM Non-secure Control Access Register (Op2 = 3)
0x00000000

31:1] 0 UNP/SBZ.
[0] 0 NS access Makes Data TCM invisible to the Non-secure world and makes TCM data Secure.
0 = Data TCM Region Register only accessible in the Secure world. Data TCM only visible in the Secure world and only when the NS Attribute in the page table is 0.








Ref pg: 3-96 TCM Selection Register:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c9,c2,Op2:

TCM Selection Register (Op2 = 0)
0x00000000

[31:2] 0 UNP/SBZ.
[1:0] b00 TCM number: Selects the bank of CP15 registers related to TCM configuration.
b00 = TCM 0, reset value.
b01 = TCM 1. NOTE: When there is only one TCM on both Instruction and Data sides, write access is ignored.
b10 = Write access ignored.
b11 = Write access ignored.







Ref pg: 3-97 Cache Behavior Override Register:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c9,c8,Op2:

Cache Behavior Override Register (Op2 = 0)
0x00000000

[31:6] 0 UNP/SBZ.
[5] 0 S_WT: Secure only, Do not force write-through
[4] 0 S_IL: Secure only, Instruction Cache line fill enabled
[3] 0 S_DL: Secure only, Data Cache line fill enabled
[2] 0 NS_WT: Do not force write-through
[1] 0 NS_IL: Instruction Cache line fill enabled
[0] 0 NS_DL: Data Cache line fill enabled








Ref pg: 3-100 TLB Lockdown Register:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c10,c0,Op2:

TLB Lockdown Register (Op2 = 0)
0x00000000

[31:29] 0 UNP/SBZ.
[28:26] 0 Victim Specifies the entry in the lockdown region where a subsequent hardware page table walk can place a TLB entry. The reset value is 0. 0-7, defines the Lockdown region for the TLB entry.
[25:1] 0 UNP/SBZ.
[0] 0 P: Determines if subsequent hardware page table walks place a TLB entry in the lockdown region or in the set associative region of the TLB:
0 = Place the TLB entry in the set associative region of the TLB, reset value.
1 = Place the TLB entry in the lockdown region of the TLB as defined by the Victim bits [28:26].







Ref pg: 3-101 Memory region remap registers:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c10,c2,Op2:

Primary region remap registers (Op2 = 0)
0x00098AA4
0000 0000 0000 1001 1000 1010 1010 0100
31 24 23 16 15 8 7 0

[31:20] 0 UNP/SBZ
[19] 1 Remaps shareable attribute when S=1 for Normal regions
[18] 0 Remaps shareable attribute when S=0 for Normal regions
[17] 0 Remaps shareable attribute when S=1 for Device regions
[16] 1 Remaps shareable attribute when S=0 for Device regions
[15:14] b10 Remaps {TEX[0],C,B} = b111, b10 = reset value
[13:12] 0 Remaps {TEX[0],C,B} = b110, b00 = reset value
[11:10] b10 Remaps {TEX[0],C,B} = b101, b10 = reset value
[9:8] b10 Remaps {TEX[0],C,B} = b100, b10 = reset value
[7:6] b10 Remaps {TEX[0],C,B} = b011, b10 = reset value
[5:4] b10 Remaps {TEX[0],C,B} = b010, b10 = reset value
[3:2] b10 Remaps {TEX[0],C,B} = b001, b01 = reset value
[1:0] 0 Remaps {TEX[0],C,B} = b000, b00 = reset value

Normal region remap registers (Op2 = 1)
0x44E048E0
0100 0100 1110 0000 0100 1000 1110 0000
31 24 23 16 15 8 7 0

[31:30] - Remaps Outer attribute for {TEX[0],C,B} = b111
b01 = reset value
[29:28] - Remaps Outer attribute for {TEX[0],C,B} = b110
b00 = reset value
[27:26] - Remaps Outer attribute for {TEX[0],C,B} = b101
b01 = reset value
[25:24] - Remaps Outer attribute for {TEX[0],C,B} = b100
b00 = reset value
[23:22] - Remaps Outer attribute for {TEX[0],C,B} = b011
b11 = reset value
[21:20] - Remaps Outer attribute for {TEX[0],C,B} = b010
b10 = reset value
[19:18] - Remaps Outer attribute for {TEX[0],C,B} = b001
b00 = reset value
[17:16] - Remaps Outer attribute for {TEX[0],C,B} = b000
b00 = reset value
[15:14] - Remaps Inner attribute for {TEX[0],C,B} = b111
b01 = reset value
*Continues int the same manner for [14:0]








Ref pg: 3-106 DMA identification and status registers

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c11,c0,Op2:

DMA identification and status registers CRm = c0-c2 & c4-c8 & c15 (and all associated Op2 codes):
0x00000000









Ref pg: 3-121 Vector Base Address Register:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c12,c0,Op2:

Secure or Non-secure Vector Base Address Register CRm = c0, Op2 = 0
Monitor Vector Base Address Register CRm = c0, Op2 = 1
Interrupt Status Register CRm = c1 Op2 = 0
0x00000000









Ref pg: 3-126 FCSE PID Register:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c13,c0,Op2:

FCSE PID Register (Op2 = 0)
Context ID Register (Op2 = 1)
Thread and process ID registers (Op2 = 2,3,4)
0x00000000







Register c15:
Ref pg. 3-130 to 3-144

MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,*,r0,c15,c*,*:

Peripheral Port Memory Remap Register
Secure User and Non-secure Access Validation Control Register
Performance Monitor Control Register
Cycle Counter Register
Count Register 0
Count Register 1
System Validation Counter Register
System Validation Operations Register
0x00000000









Ref pg: 3-145 System Validation Cache Size Mask Register:

using command:
MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,0,r0,c12,c0,Op2:

System Validation Cache Size Mask Register (Op2 = 0)
0x00000055
0000 0000 0000 0000 0000 0000 0101 0101
31 24 23 16 15 8 7 0

[31] 0 Read as zero. Write enable: Enables the update of the Cache and TCM sizes:
0 = The Cache and TCM sizes are not changed, reset value.
1 = The Cache and TCM sizes take the new values that the DTCM, ITCM, DCache and Icache fields of this register specify.
Note: This bit is write access only and Read As Zero.
[30:15] 0 SBZ UNP/SBZ.
[14:12] 0 DTCM Specifies apparent size of Data TCM and apparent number of Data TCM banks, as it appears to the processor. b000 = Not present
[11] 0 SBZ UNP/SBZ.
10:8] 0 ITCM Specifies apparent size of Instruction TCM and apparent number of Instruction TCM banks, as it appears to the processor. b000 = Not present
[7] 0 SBZ UNP/SBZ.
[6:4] b101 DCache Specifies apparent size of Data Cache, as it appears to the processor. b101 = 16KB
[3] 0 SBZ UNP/SBZ.
[2:0] b101 ICache Specifies apparent size of Instruction Cache, as it appears to the processor. b101 = 16KB







Register c15:
Ref pg. 3-147 to 3-153

MRC{cond} P15,<Opcode_1>,<Rd>,<CRn>,<CRm>,<Opcode_2>

mrc p15,*,r0,c15,c*,*:

Instruction Cache Master Valid Register
Data Cache Master Valid Register
TLB lockdown access registers
0x00000000

david.given
Posts: 15
Joined: Sat Dec 05, 2015 8:10 pm

Re: RPi B+ Coprosser 15 register settings upon start up

Thu Dec 10, 2015 11:16 pm

That's really useful --- thanks!

As the A and the other Bs have the same processor core, they should all have the same settings, right? How different is it likely to look for the Pi2?

Return to “Bare metal, Assembly language”