linux-chenxing.org

PM51

Depending on the chip there seems to be one or more 8051 cores embedded. The main one seems to be pm51 (power management?) but there are references to hk51 (house keeping?) which might be the same thing. There then seems to sometimes also be an 8051 that is responsible for handling part of the video input pipeline.

For now let’s worry about pm51. So far this has only been confirmed in the infinity1, infinity3 and mercury5. The infinity2m and infinity6b don’t seem to have the “mcu” registers at the same place.

The IP used for the 8051 seems to be R8051XC based on the includes in some code for other chips with the same pm51.

pm51 seems to be able to access:

miu: to access the main system memory
riu: to access peripheral registers. Some of the code suggests that pm51 can access the pm domain peripherals by default but needs register configuration to enable accessing registers in the “die domain”.
spi flash: seems to have access to memory mapped spi nor.. not sure where in the flash. The infinity3 docs have an empty section at the start of the flash presumably this is for the pm51
maybe 64KB of it’s own SRAM that is not accessible to the ARM cpu. It seems like BDMA has to be used to transfer data into it. Some of the BDMA headers have “1ksram” however. So it could be either.

Code loading references

Block diagram

This is a guess!

  -----------------
 |     8051 CPU    |
  -----------------          ---------------                      -----           ---------
 | Program Counter |------->| MCU Registers |<------------------>| RIU |<------->| ARM CPU |
  -----------------          ---------------           |      |   -----      |    ---------
 |                 |----------------------------------/       |              |
 |                 |         ---------------       ------     |              |
 |     Memory      |<------>|      SRAM     |<----| BDMA |----/              |
 |                 |         ---------------       ------                    |
 |                 |<--\     ---------------                      -----      |
 |                 |    |   |      DDR      |--------------------| MIU |----/
  -----------------     |    ---------------                      -----
                        |                                           |
                        |                                       --------
                        \------------------------------------->| XD2MIU |
                                                                --------

MCU registers

The program counter is visible to the ARM CPU. In the vendor code checking if the PC is changing is used to detect if the 8051 is running.
The program counter visible to the ARM CPU is 24 bits wide. Presumably the lower 16 bits are the 8051 PC and then upper 8 bits are the current bank or something?
The IO ports are also visibile to the ARM CPU and it seems the ARM cpu can write values into them.. really crappy data exchange method?

infinity1/infinity3/mercury5 - 0x1f002000

offset	name	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0	default	Notes
0x1f8	pc	pc[15]	pc[14]	pc[13]	pc[12]	pc[11]	pc[10]	pc[9]	pc[8]	pc[7]	pc[6]	pc[5]	pc[4]	pc[3]	pc[2]	pc[1]	pc[0]
0x1fc	pc	data[7]	data[6]	data[5]	data[4]	data[3]	data[2]	data[1]	data[0]	pc[23]	pc[22]	pc[21]	pc[20]	pc[19]	pc[18]	pc[17]	pc[16]

Memory map

It seems possible to map in some SRAM that is just for the 8051. It seems that this memory is only writable from the ARM cpu via BDMA and it can’t be read back.
Part of the SPI NOR can be mapped into the 8051 memory map. This seems to need some locking to stop the ARM cpu and 8051 fighting but this code was removed from the linux drivers at some point.
Part of the DDR memory can be mapped into the 8051 memory map.
There seems to be some sort of caching for the code called “icache”.. maybe to get around SPI being slow?
For SRAM, SPI and DDR it seems possible to decide where and how much are mapped in to 24bits of address space.

Clues

some 8051 code for another mstar chip

junk

Interrupt vectors

#	Vector	Source
0	0x003	EX0 – Non-PM intc host 0 FIQ
1	0x00B	Timer 0
2	0x013	EX1 – PM intc IRQ
3	0x01B	Timer 1
4	0x023	Serial
5	0x02B	Reserved?
6	0x033	n/a?
7	0x03B	n/a?
8	0x043
9	0x04B	EX2 – TIMER0
10	0x053	EX3 – TIMER1
11	0x05B	EX4 – WDT
12	0x063
13	0x06B
14	0x073	n/a?
15	0x07B	n/a?
16	0x083
17	0x08B
18	0x093
19	0x09B
20	0x0A3
21	0x0AB

SFR

Addr	Description
0x80	P0 - Code bank
0xA0	P2 - RIU bank (bits 16..23)

XDATA

Address range	Description
0x0000~0x3fff	RIU (banked with P2)
0x4000~0x43ff	1k SRAM
0x5000~0x53ff	Code SRAM mapping
the rest	Free for e.g. XDMIU

MCU

reg00:
    b0~b15 = SRAM map start [16..31]

reg02:
    b0~b15 = SRAM map end [16..31]

reg04:
    b0~b15 = SRAM map start [0..15]

reg06:
    b0~b15 = SRAM map end [0..15]

reg08:
    b0~b15 = DRAM map start [16..31]

reg0A:
    b0~b15 = DRAM map end [16..31]

reg0C:
    b0~b15 = DRAM map start [0..15]

reg0E:
    b0~b15 = DRAM map end [0..15]

reg10:
    b0~b15 = SPI map start [16..31]

reg12:
    b0~b15 = SPI map end [16..31]

reg14:
    b0~b15 = SPI map start [0..15]

reg16:
    b0~b15 = SPI map end [0..15]

reg18:
    b0 = Enable SRAM map
    b1 = Enable SPI map
    b2 = Enable DRAM map
    b3 = icache reset
    b7 = Use code bank number from RIU instead of P0
    b8~b15 = Code bank (RIU)

regE4:
    b0~b7 = SRAM XDATA map base address [10..x]

regE6:
    b3 = Enable SRAM XDATA map (at XDATA 0x5000~0x53ff)

regFC:
   b0~b15 = Current PC

regFE:
   b0~b7 = Current bank
   b8~b15 = Data under PC

CACHE

reg00:
    b0~b15 = DRAM map base address [12..27]

reg20:
    b0 = icache enable

XDMIU

reg00:
    b0 = Reset

reg04:
    b0 = r priority
    b1 = w priority
    b2 = Enable

reg06:
    b0~b7 = 64k window start [10..17]
    b8~b15 = 64k window end [10..17]

reg08:
   b0~b15 = 64k window base address [16..31]

reg0A:
    b0~b7 = 4k window start [10..17]
    b8~b15 = 4k window start [10..17]

reg0C:
    b0~b15 = 4k window base address [12..27]

target miu address:

64k window: (base << 16) | (xdata_addr & 0xffff)
4k window: (base << 12) | (xdata_addr & 0xfff)

xdata_addr is NOT xdata_addr - window_start! It’s an absolute address.

This site is open source. Improve this page.