Tiny4412模式跳转

　　ARM体系的CPU有以下7种工作模式：

        　　1、用户模式(Usr)：用于正常执行程序；

        　　2、快速中断模式(FIQ)：用于高速数据传输；

        　　3、外部中断模式(IRQ)：用于通常的中断处理；

        　　4、管理模式(svc)：操作系统使用的保护模式；

        　　5、数据访问终止模式(abt)：当数据或指令预取终止时进入该模式，可用于虚拟存储以及存储保护；

        　　6、系统模式(sys)：运行具有特权的操作系统任务；

        　　7、未定义指令中止模式(und)：当未定义的指令执行时进入该模式，可用于支持硬件；

　　如下图：

要进行模式跳转，就需要要有异常事件在触发它进行模式跳转，在ARM中，异常有如下几种：

　　（1）在异常向量表中，需要注意的是未定义指令（undefined），软中断（swi）是发生在译码阶段，其他五种都发生在执行阶段；ARM中的流水线分为：取值，译码，执行，仿存，回写这五步，当一条指令正在执行时，它的下一条指令正在译码，下下一条在取值，pc指向的是正在取值的那条指令，在模式跳转要回去的时候这点需要认真考虑；

　　（2）通过上图我们可以看出要是发生undefined，它就会自动跳到0x0000004这个地址去执行，那如果我们在这个地址放一段代码，到时候就可以知道有没有发生异常，是不是跳到0x0000004这个；思想就是这样，但是现在有遇到一个新的问题，因为在这个三星公司将0x00000000—0x00010000为iROM，这个地址是只能读，不能改，因此我们就要需开启mmu，把0x00000004映射到其他空闲的地址上去：

下面是代码：

int (*printf)(char *, ...) = 0xc3e114d8;
void enable_mmu();
void memcpy(unsigned long *dest, unsigned long *source, int len);
void init_table(unsigned long *addr);
unsigned long swi_init();

int main()
{
    unsigned long source = swi_init();
    printf("source is %x
", source);

    memcpy(0x60000004, source, 0x1000);    
    enable_mmu();

    __asm__ __volatile__ (
        ".word 0xffffffff
"
    );

    printf("welcom back
");    
}

unsigned long swi_init()
{
    unsigned long addr;
    __asm__ __volatile__ (
        "ldr %0, =start 
"
        : "=r" (addr)
    );
    
    return addr;    
}

void memcpy(unsigned long *dest, unsigned long *source, int len)
{
    int i = 0;
    for(i = 0; i < len; i++) {
        dest[i] = source[i];
    }
}

void enable_mmu()
{
    /*构建表*/
    unsigned long addr = 0x50000000;
    init_table(addr);
    /*打开mmu*/
    unsigned long mmu = 0;
    mmu = 1 | (1 << 1) | (1 << 3) | (1 << 8);
    __asm__ __volatile__ (
         "mov r0, #3
"
        "MCR p15, 0, r0, c3, c0, 0
"//设置为管理员
        "MCR p15, 0, %0, c2, c0, 0
"//设置表的地址
        "MCR p15, 0, %1, c1, c0, 0
"//开启mmu
        :    
        :    "r" (addr), "r" (mmu)
        :
    );

}

__asm__ (
    
    "start: 
"
    "mov sp, #0x47000000
"
    "stmdb sp!, {r0-r12, lr}
"

    "ldr r3, data
"
    "ldr r0, =str_und
"
    "blx r3
"
    
    /*跳回去代码*/
    "mov sp, #0x47000000
"
    "ldmdb sp, {r0-r12, pc}^
"//

    "data:
"
    ".word 0xc3e114d8
"

    "str_und:
"
    ".asciz "this is undefined\n"
"
    ".align 2
"
);

void init_table(unsigned long *addr)
{
    unsigned long va = 0;
    unsigned long phys = 0;

    //0x40000000-0x80000000 -> 0x40000000-0x80000000    
    for(va = 0x40000000; va < 0x80000000; va += 0x100000) {
        phys = va;
        addr[va >> 20] = phys | 2;
    }

    //0x10000000-0x14000000 -> 0x10000000-0x140000000    
    for(va = 0x10000000; va < 0x14000000; va += 0x100000) {
        phys = va;
        addr[va >> 20] = phys | 2;
    }
    //0x10000000-0x14000000 -> 0x10000000-0x140000000    
    for(va = 0x0; va < 0x10000000; va += 0x100000) {
        phys = va + 0x60000000;
        addr[va >> 20] = phys | 2;
    }
            
}

在开发板运行结果如下：

　　总结一下：当一个模式发生跳转是，需要三步：（1）将pc存到lr中，pc->lr；（2）将cpsr存到spsr，cpsr-spsr；（3）初始化sp；第一二步由系统硬件自动完成，第三部需要我们手动完成；

　　模式跳回去的时候逆过过来就ok，初始化sp，将lr还给pc，spsr还给cpsr，注意需要同时一起还，73行

　　上面代码还有一问题就是，要是几个异常一起发生怎么办，因为我们不能控制它每次执法生一个吧，cpu留给我们处理每个异常的只有4个字节，那么我们就需要进行二级跳转了，下面贴出二级跳转代码：

　

int (*printf)(char *, ...) = 0xc3e114d8;
void enable_mmu();
void init_table(unsigned long *addr);
void memcpy(unsigned char *dest, unsigned char *src, int len);
extern unsigned long  vector_start;

int main()
{    
    memcpy(0x70000000, vector_start, 0x1000);    
    enable_mmu();

    __asm__ __volatile__(
        ".word 0x77777777
"    
        "mov r3, #3
"
        "ldr r0, [r3]
"
    );
    
    printf("welcom back
");

    return 0;
}

void memcpy(unsigned char *dest, unsigned char *src, int len)
{
    int i = 0;
    for(i = 0; i < len; i++) {
        dest[i] = src[i];
    }
}

void enable_mmu()
{
    //step 1: creat ttb
    unsigned long addr = 0x50000000;
    init_table(addr);
    //step 2: enable mmu
    unsigned long mmu = 0;
    mmu = 1 | (1 << 1) | (1 << 3) | (1 << 8);
    __asm__ __volatile__ (
        "mov r0, #3
"
        "MCR p15, 0, r0, c3, c0, 0
"//set manage
        "MCR p15, 0, %0, c2, c0, 0
"//set ttb
        "MCR p15, 0, %1, c1, c0, 0
"//enable mmu
        :    
        :    "r" (addr), "r" (mmu)
        :
    );

}

__asm__(

"vector: 
"
"    b reset
"
"    b und
"
"    b swi
"
"    b pre_abt
"
"    b data_abt
"
"    .word 0x0
"
"    b irq
"
"    b fiq
"

"reset:
"

"und:
"
    /*模式跳转进来分三步：
     *(1)将pc存到lr，pc->lr
    *(2)将cpsr存到spsr
    *(3)初始化sp
    *前两部系统硬件帮我们完成，第三步需要我们手动配置*/
"    mov sp, #0x47000000
"
"    stmdb sp!, {r0-r12, lr}
"

"    ldr r3, show
"
"    ldr r0, =str_und
"
"    blx r3
"

    /*回去的时候逆回去就ok*，^表示同时还回去*/
"    mov sp, #0x47000000
"
"    ldmdb sp, {r0-r12, pc}^    
"

"swi:
"

"    mov sp, #0x47000000
"
"    stmdb sp!, {r0-r12, lr}
"

"    ldr r3, show
"
"    ldr r0, =str_swi
"
"    blx r3
"

"    mov sp, #0x47000000
"
"    ldmdb sp, {r0-r12, pc}^    
"
"pre_abt:
"

"data_abt:
"

"    mov sp, #0x47000000
"
"    sub lr, lr, #4
"//这句需要好好理解
"    stmdb sp!, {r0-r12, lr}
"

"    ldr r3, show
"
"    ldr r0, =str_data
"
"    blx r3
"

"    mov sp, #0x47000000
"
"    ldmdb sp, {r0-r12, pc}^    
"

"irq:
"

"fiq:
"

"show:
"
"    .word 0xc3e114d8
"

"str_data:
"
"    .asciz "this is data abort\n"
"
"    .align 2
"

"str_swi:
"
"    .asciz "this is swi \n"
"
"    .align 2
"

"str_und:
"
"    .asciz "this is undefined \n"
"
"    .align 2
"

    ".global vector_start
"
"vector_start: 
"
    ".word vector 
 "

);

void init_table(unsigned long *addr)
{
    unsigned long va = 0;
    unsigned long phys = 0;

    //0x40000000-0x80000000 -> 0x40000000-0x80000000    
    for(va = 0x40000000; va < 0x80000000; va += 0x100000) {
        phys = va;
        addr[va >> 20] = phys | 2;
    }

    //0x10000000-0x14000000 -> 0x10000000-0x140000000    
    for(va = 0x10000000; va < 0x14000000; va += 0x100000) {
        phys = va;
        addr[va >> 20] = phys | 2;
    }
    //0x10000000-0x14000000 -> 0x10000000-0x140000000    
    for(va = 0x0; va < 0x10000000; va += 0x100000) {
        phys = va + 0x70000000;
        addr[va >> 20] = phys | 2;
    }
            
}

下面是运行结果：