[Windows Phone 7 Development and Hacking] spavlin:
========================================

c13, Thread and Process ID Registers

========================================

The purpose of the Thread and Process ID Registers is to provide locations to store the IDs of software threads and processes for OS management purposes.

The Thread and Process ID Registers are:

three read/write registers banked for Secure and Nonsecure states:

user read/write Thread and Process ID Register

user read-only Thread and Process ID Register

privileged only Thread and Process ID Register.

accessible in different modes:

the user read/write Thread and Process ID Register is read/write in User and privileged modes the user read-only Thread and Process ID Register is read-only in User mode, and read/write in privileged modes the privileged only Thread and Process ID Register is only accessible in privileged modes, and is read/write.

To access the Thread and Process ID Registers, read or write CP15 with:

MRC p15, 0, <Rd>, c13, c0, 2 ; Read User read/write Thread and Process ID Register

MCR p15, 0, <Rd>, c13, c0, 2 ; Write User read/write Thread and Process ID Register

MRC p15, 0, <Rd>, c13, c0, 3 ; Read User read-only Thread and Process ID Register

MCR p15, 0, <Rd>, c13, c0, 3 ; Write User read-only Thread and Process ID Register

MRC p15, 0, <Rd>, c13, c0, 4 ; Read Privileged only Thread and Process ID Register

MCR p15, 0, <Rd>, c13, c0, 4 ; Write Privileged only Thread and Process ID Register

Reading or writing the Thread and Process ID Registers has no effect on the processor state or operation.

These registers provide OS support and must be managed by the OS.

You must clear the contents of all Thread and Process ID Registers on process switches to prevent data leaking from one process to another. This is important to ensure the security of secure data.

========================================

c13, FCSE PID Register

========================================

The c13, Context ID Register replaces the FCSE PID Register. Use of the FCSE PID Register is deprecated.

The FCSE PID Register is:

a read/write register banked for Secure and Nonsecure states

accessible in privileged modes only. Attempts to write to this register in secure privileged mode when CP15SDISABLE is HIGH result in an Undefined

Instruction exception, see Security Extensions write access disable.

An entry of Undefined in the table means that the access gives an Undefined Instruction exception when the coprocessor instruction is executed.

To access the FCSE PID Register, read or write CP15 with:

MRC p15, 0, <Rd>, c13, c0, 0 ; Read FCSE PID Register

MCR p15, 0, <Rd>, c13, c0, 0 ; Write FCSE PID Register

To change the ProcID and perform a fast context switch, write to the FCSE PID Register. You are not required to flush the contents of the TLB after the switch because the TLB still holds the valid address tags. Because a write to the FCSE PID Register causes a pipeline flush, the effect is immediate. The next executed

instruction is fetched with the new PID.

You must not rely on this behavior for future compatibility. An IMB must be executed between changing the ProcID and fetching from locations that are translated by the ProcID. Addresses issued by the processor in the range 0-32MB are translated by the ProcID. Address A becomes A + (ProcID x 32MB). The MMU uses this translated address, the MVA. Addresses above 32MB are not translated. The ProcID is a 7-bit field, enabling 128 x 32MB processes to be mapped.

If ProcID is 0, as it is on Reset, then there is a flat mapping between the processor and the MMU.

========================================

Security Extensions write access disable

========================================

The processor supports a primary input pin, CP15SDISABLE, to disable write access to the CP15 registers.

When the CP15SDISABLE input is set to 1, any attempt to write to the secure version of the banked register, NS-bit is 0, or any non-banked register, NS-state is 0 results in an Undefined Instruction exception.

Changes in the pin on an instruction boundary occur as quickly as practically possible after a change to this pin.

Software must perform a IMB after a change to this pin has occurred on the boundary of the macros to ensure that its effects are recognized on following instructions.

At reset, it is expected that this pin is set to logic 0 by the SoC hardware. Control of this pin is expected to remain within the SoC chip that implements the processor.

CP15 registers affected by CP15SDISABLE

Register	Instruction

Control Register

MCR p15, 0, <Rd>, c1, c0, 0

Translation Table Base 0

MCR p15, 0, <Rd>, c2, c0, 0

Translation Table Control Register

MCR p15, 0, <Rd>, c2, c0, 2

Domain Access Control

MCR p15, 0, <Rd>, c3, c0, 0

Primary Region Remap

MCR p15, 0, <Rd>, c10, c2, 0

Normal Memory Region Remap

MCR p15, 0, <Rd>, c10, c2, 1

Vector Base

MCR p15, 0, <Rd>, c12, c0, 0

Monitor Base

MCR p15, 0, <Rd>, c12, c0, 1

FCSE	MCR p15, 0, <Rd>, c13, c0, 0

Array operations

MCR p15, 0, <Rd>, c15, c0-15, 0-7

MRC p15, 0, <Rd>, c15, c0-15, 0-7