ARMv8 CPU Temperature Monitoring in Kernel on Broadcom BCM2837 SoC

ARMv8 Thermal Management Register Access in Kernel Mode

The Broadcom BCM2837 SoC, which powers the Raspberry Pi B+, integrates an ARM Cortex-A53 processor based on the ARMv8 architecture. Unlike x86 systems, where the Model Specific Registers (MSRs) such as MSR_IA32_THERM_STATUS provide direct access to CPU temperature data, ARMv8 processors do not have an equivalent standardized register for thermal monitoring. Instead, ARMv8 relies on SoC-specific implementations for temperature sensing, which are typically accessed through memory-mapped I/O (MMIO) registers or dedicated peripheral interfaces.

In the case of the BCM2837, the temperature sensor is part of the SoC’s peripheral subsystem, not the CPU core itself. This means that accessing the CPU temperature requires interacting with the BCM2837’s proprietary hardware blocks rather than using ARMv8-specific instructions or registers. The temperature sensor data is typically exposed through a register in the BCM2837’s MMIO space, which can be accessed from the Linux kernel using appropriate driver interfaces or direct memory mapping.

The challenge lies in identifying the correct MMIO address for the temperature sensor register and ensuring that the kernel has the necessary permissions to access this memory region. Additionally, the temperature data may need to be scaled or processed according to the BCM2837’s documentation to obtain an accurate reading in degrees Celsius.

Lack of Standardized Thermal Registers and SoC-Specific Implementations

One of the primary reasons for the difficulty in accessing CPU temperature on ARMv8 processors like the Cortex-A53 is the absence of a standardized thermal management interface across ARM architectures. While x86 systems have well-defined MSRs for thermal monitoring, ARM leaves the implementation of temperature sensing to the SoC manufacturer. This results in significant variability in how temperature data is accessed and interpreted across different ARM-based platforms.

In the case of the Broadcom BCM2837, the temperature sensor is managed by the SoC’s VideoCore GPU subsystem rather than the ARM CPU. The GPU subsystem exposes the temperature data through a specific MMIO register, which is not documented in the ARM architecture reference manuals. This register is typically accessed via the BCM2835/2836/2837 mailbox interface, which facilitates communication between the ARM cores and the GPU.

Another potential cause of confusion is the lack of clear documentation for the BCM2837’s temperature sensor interface. Broadcom’s official documentation is often sparse, and developers must rely on community-driven resources or reverse-engineered specifications to determine the correct MMIO address and data format for the temperature register.

Furthermore, the Linux kernel’s support for ARMv8 thermal management varies depending on the SoC and the specific kernel version. While some ARM-based platforms have well-maintained drivers for temperature monitoring, others may require custom kernel modules or patches to enable access to the temperature sensor.

Accessing BCM2837 Temperature Sensor via Kernel MMIO and Mailbox Interface

To obtain the CPU temperature on a Raspberry Pi B+ with a Broadcom BCM2837 SoC, developers must interact with the SoC’s temperature sensor through the GPU mailbox interface or direct MMIO access. The following steps outline the process for implementing this functionality in the Linux kernel:

1. Identify the Temperature Sensor Register Address: The temperature sensor register in the BCM2837 is typically located at a specific offset within the GPU’s MMIO space. For the BCM2837, this address is often 0x7E212000 (GPU temperature sensor register). However, this address may vary depending on the specific Raspberry Pi model and firmware version.

2. Map the MMIO Region in the Kernel: To access the temperature sensor register, the kernel must map the GPU’s MMIO region into the kernel’s address space. This can be done using the ioremap function, which creates a virtual mapping for the physical MMIO address. For example:

   void __iomem *temp_reg = ioremap(0x7E212000, 0x10);
   if (!temp_reg) {
       pr_err("Failed to map temperature sensor register\n");
       return -ENOMEM;
   }
   

3. Read the Temperature Data: Once the MMIO region is mapped, the temperature data can be read from the appropriate register offset. The temperature value is typically stored in a 32-bit register, with the actual temperature encoded in a specific format. For the BCM2837, the temperature is often represented as a fixed-point number, where the lower 16 bits contain the integer part and the upper 16 bits contain the fractional part. For example:

   u32 temp_data = ioread32(temp_reg + 0x00);
   u16 temp_integer = (temp_data & 0xFFFF);
   u16 temp_fraction = (temp_data >> 16);
   int temperature = (temp_integer << 16) | temp_fraction;
   

4. Scale and Convert the Temperature Value: The raw temperature data read from the register may need to be scaled or converted to obtain a meaningful value in degrees Celsius. The scaling factor and conversion formula depend on the BCM2837’s documentation. For example, if the temperature is represented in units of 0.01°C, the value can be converted as follows:

   int temperature_celsius = temperature / 1000;
   

5. Use the Mailbox Interface for Enhanced Compatibility: Alternatively, the temperature can be accessed via the BCM2837’s mailbox interface, which provides a higher-level abstraction for communicating with the GPU. The mailbox interface uses a set of predefined channels and messages to request temperature data. The following code demonstrates how to use the mailbox interface to obtain the temperature:

   struct bcm2835_mbox_property *prop;
   prop = kzalloc(sizeof(*prop), GFP_KERNEL);
   if (!prop) {
       pr_err("Failed to allocate mailbox property\n");
       return -ENOMEM;
   }
   prop->tag = 0x00030006; // Temperature tag
   prop->data_size = 8;
   prop->req_resp_size = 8;
   bcm2835_mbox_call(prop);
   u32 temperature = prop->data[0];
   kfree(prop);
   

6. Handle Kernel Permissions and Synchronization: Accessing hardware registers from the kernel requires careful handling of permissions and synchronization. Ensure that the kernel module or driver has the necessary privileges to map and access the MMIO region. Additionally, use appropriate synchronization mechanisms, such as spinlocks or mutexes, to prevent race conditions when accessing shared hardware resources.

7. Verify and Debug the Implementation: After implementing the temperature reading functionality, verify its correctness by comparing the obtained temperature values with external measurements or system logs. Use kernel debugging tools, such as pr_debug or dmesg, to log the temperature data and identify any discrepancies.

By following these steps, developers can successfully access the CPU temperature on a Raspberry Pi B+ with a Broadcom BCM2837 SoC. This approach leverages the SoC’s MMIO and mailbox interfaces to interact with the temperature sensor, providing a reliable method for thermal monitoring in the Linux kernel.