ARM ARM7TDMI Technical Reference Manual Download Page 218

Page: 218 / 286

Debug in Depth

B-8

ARM DDI 0210C

B.4

Instruction register

The instruction register is 4 bits in length.

There is no parity bit.

The fixed value b0001 is loaded into the instruction register during the CAPTURE-IR
controller state.

The least significant bit of the instruction register is scanned in and scanned out first.

Summary of Contents for ARM7TDMI

Page 2: ...document is intended only to assist the reader in the use of the product ARM Limited shall not be liable for any loss or damage arising from the use of any information in this document or any error or omission in such information or any incorrect use of the product Figure B 2 on page B 5 reprinted with permission IEEE Std 1149 1 1990 IEEE Standard Test Access Port and Boundary Scan Architecture Co...

Page 3: ...7TDMI core 1 2 1 2 Architecture 1 5 1 3 Block core and functional diagrams 1 7 1 4 Instruction set summary 1 11 Chapter 2 Programmer s Model 2 1 About the programmer s model 2 2 2 2 Processor operating states 2 3 2 3 Memory formats 2 4 2 4 Data types 2 6 2 5 Operating modes 2 7 2 6 Registers 2 8 2 7 The program status registers 2 13 2 8 Exceptions 2 16 2 9 Interrupt latencies 2 23 2 10 Reset 2 24 ...

Page 4: ...ined instructions 4 16 4 8 Privileged instructions 4 17 Chapter 5 Debug Interface 5 1 About the debug interface 5 2 5 2 Debug systems 5 4 5 3 Debug interface signals 5 7 5 4 ARM7TDMI core clock domains 5 11 5 5 Determining the core and system state 5 13 5 6 About EmbeddedICE RT logic 5 14 5 7 Disabling EmbeddedICE RT 5 16 5 8 Debug Communications Channel 5 17 5 9 Monitor mode 5 21 Chapter 6 Instru...

Page 5: ... 1 Scan chains and the JTAG interface B 3 B 2 Resetting the TAP controller B 6 B 3 Pullup resistors B 7 B 4 Instruction register B 8 B 5 Public instructions B 9 B 6 Test data registers B 14 B 7 The ARM7TDMI core clocks B 22 B 8 Determining the core and system state in debug state B 24 B 9 Behavior of the program counter in debug state B 30 B 10 Priorities and exceptions B 33 B 11 Scan chain cell d...

Page 7: ... 1 22 Table 2 1 Register mode identifiers 2 7 Table 2 2 PSR mode bit values 2 15 Table 2 3 Exception entry and exit 2 16 Table 2 4 Exception vectors 2 21 Table 2 5 Exception priority order 2 22 Table 3 1 Bus cycle types 3 5 Table 3 2 Burst types 3 7 Table 3 3 Significant address bits 3 12 Table 3 4 nOPC 3 12 Table 3 5 nTRANS encoding 3 13 Table 3 6 Tristate control of processor outputs 3 21 Table ...

Page 8: ... 6 21 Table 6 18 coprocessor data transfer instruction cycle operations 6 23 Table 6 19 Coprocessor register transfer load from coprocessor 6 25 Table 6 20 Coprocessor register transfer store to coprocessor 6 26 Table 6 21 Undefined instruction cycle operations 6 27 Table 6 22 Unexecuted instruction cycle operations 6 28 Table 6 23 ARM instruction speed summary 6 29 Table 7 1 General timing parame...

Page 9: ...process A 2 Table A 2 Signal types A 3 Table A 3 Signal descriptions A 4 Table B 1 Public instructions B 9 Table B 2 Scan chain number allocation B 16 Table B 3 Scan chain 0 cells B 35 Table B 4 Scan chain 1 cells B 40 Table B 5 Function and mapping of EmbeddedICE RT registers B 42 Table B 6 MAS 1 0 signal encoding B 45 Table B 7 Debug control register bit assignments B 51 Table B 8 Interrupt sign...

Page 11: ...in words 2 4 Figure 2 2 Big endian addresses of bytes and halfwords within words 2 5 Figure 2 3 Register organization in ARM state 2 9 Figure 2 4 Register organization in Thumb state 2 10 Figure 2 5 Mapping of Thumb state registers onto ARM state registers 2 11 Figure 2 6 Program status register format 2 13 Figure 3 1 Simple memory cycle 3 4 Figure 3 2 Nonsequential memory cycle 3 6 Figure 3 3 Seq...

Page 12: ...system 5 4 Figure 5 2 ARM7TDMI block diagram 5 5 Figure 5 3 Debug state entry 5 8 Figure 5 4 Clock switching on entry to debug state 5 11 Figure 5 5 ARM7 CPU main processor logic TAP controller and EmbeddedICE RT logic 5 14 Figure 5 6 DCC control register format 5 17 Figure 7 1 General timings 7 3 Figure 7 2 ABE address control 7 5 Figure 7 3 Bidirectional data write cycle 7 5 Figure 7 4 Bidirecti...

Page 13: ...D code register format B 14 Figure B 4 Output scan cell B 17 Figure B 5 Clock switching on entry to debug state B 22 Figure B 6 Debug exit sequence B 28 Figure B 7 EmbeddedICE RT block diagram B 43 Figure B 8 Watchpoint control value and mask format B 45 Figure B 9 Debug control register format B 51 Figure B 10 Debug status register format B 54 Figure B 11 Debug control and status register structu...

Page 15: ...Copyright 2001 2004 ARM Limited All rights reserved xv Preface This preface introduces the ARM7TDMI r4p1 Technical Reference Manual It contains the following sections About this manual on page xvi Feedback on page xx ...

Page 16: ... this chapter for an introduction to the architecture Chapter 2 Programmer s Model Read this chapter for a description of the 32 bit ARM and 16 bit Thumb instruction sets Chapter 3 Memory Interface Read this chapter for a description of nonsequential sequential internal and coprocessor register transfer memory cycles Chapter 4 Coprocessor Interface Read this chapter for details of theimplementatio...

Page 17: ...ev 4 of the processor Glossary Read the glossary for a list of terms used in this manual Conventions Conventions that this Thumb can use are described in Typographical Timing diagrams on page xviii Signals on page xviii Numbering on page xix Typographical The typographical conventions are italic Highlights important notes introduces special terminology denotes internal cross references and citatio...

Page 18: ...lains the components used in timing diagrams Variations when they occur have clear labels You must not assume any timing information that is not explicit in the diagrams Shaded bus and signal areas are undefined so the bus or signal can assume any value within the shaded area at that time The actual level is unimportant and does not affect normal operation Key to timing diagram conventions Signals...

Page 19: ...e hexadecimal value of 0x3F This is equivalent to b00111111 8 b1111 is an eight bit wide binary value of b00001111 Further reading This section lists publications by ARM Limited and by third parties ARM Limited periodically provides updates and corrections to its documentation See http www arm com for current errata sheets addenda and the ARM Limited Frequently Asked Questions list ARM publication...

Page 20: ...s or suggestions about this product please contact your supplier giving the product name a concise explanation of your comments Feedback on this manual If you have any comments about this manual send email to errata arm com giving the title the number the relevant page number s to which your comments refer a concise explanation of your comments ARM Limited also welcomes general suggestions for add...

Page 21: ...rved 1 1 Chapter 1 Introduction This chapter introduces the ARM7TDMI r4p1 processor It contains the following sections About the ARM7TDMI core on page 1 2 Architecture on page 1 5 Block core and functional diagrams on page 1 7 Instruction set summary on page 1 11 ...

Page 22: ...all cost effective processor macrocell This section describes The instruction pipeline Memory access on page 1 3 Memory interface on page 1 3 EmbeddedICE RT logic on page 1 3 1 1 1 The instruction pipeline The ARM7TDMI core uses a pipeline to increase the speed of the flow of instructions to the processor This enables several operations to take place simultaneously and the processing and memory sy...

Page 23: ...aries 1 1 3 Memory interface The ARM7TDMI processor memory interface has been designed to allow performance potential to be realized while minimizing the use of memory Speed critical control signals are pipelined to enable system control functions to be implemented in standard low power logic These control signals facilitate the exploitation of the fast burst access modes supported by many on chip...

Page 24: ...Introduction 1 4 Copyright 2001 2004 ARM Limited All rights reserved ARM DDI 0210C For more information about the EmbeddedICE RT logic see Chapter 5 Debug Interface and Appendix B Debug in Depth ...

Page 25: ...hitectures typically have higher code density than 32 bit architectures but approximately half the performance Thumb implements a 16 bit instruction set on a 32 bit architecture to provide higher performance than a 16 bit architecture higher code density than a 32 bit architecture 1 2 2 The Thumb instruction set The Thumb instruction set is a subset of the most commonly used 32 bit ARM instruction...

Page 26: ... therefore makes the ARM7TDMI core ideally suited to embedded applications with restricted memory bandwidth where code density and footprint is important The availability of both 16 bit Thumb and 32 bit ARM instruction sets gives designers the flexibility to emphasize performance or code size on a subroutine level according to the requirements of their applications For example critical loops for a...

Page 27: ...rchitecture core and functional diagrams are illustrated in the following figures Figure 1 2 on page 1 8 shows a block diagram of the ARM7TDMI processor components and major signal paths Figure 1 3 on page 1 9 shows the main processor logic at the core of the ARM7TDMI Figure 1 4 on page 1 10 shows the major signal paths for the ARM7TDMI processor ...

Page 28: ...TDMI processor block diagram EmbeddedICE RT Logic ARM7TDM CPU core TAP controller Scan chain 2 Scan chain 0 Bus splitter RANGEOUT0 RANGEOUT1 EXTERN0 Scan chain 1 EXTERN1 nOPC nRW MAS 1 0 nTRANS nMREQ A 31 0 SCREG 3 0 TAPSM 3 0 IR 3 0 All other signals D 31 0 DOUT 31 0 DIN 31 0 TCK TMS nTRST TDI TDO ...

Page 29: ...ruction controller Write data register nENOUT DBE nENIN B bus 32 bit ALU Barrel shifter 32 x 8 Multiplier D 31 0 DBGRQI BREAKPTI DBGACK ECLK nEXEC ISYNC BL 3 0 APE MCLK nWAIT nRW MAS 1 0 nIRQ nFIQ nRESET ABORT nTRANS nMREQ nOPC SEQ LOCK nCPI CPA CPB nM 4 0 TBE TBIT HIGHZ ALU bus Register bank 31 x 32 bit registers 6 status registers A bus Address incrementer Address register PC bus A 31 0 ALE ABE ...

Page 30: ...APCLK Bus controls APE nHIGHZ SCREG 3 0 TCK TMS TDI nTRST TDO TAPSM 3 0 IR 3 0 nTDOEN TCK1 TCK2 Boundary scan A 31 0 DOUT 31 0 nMREQ SEQ nRW MAS 1 0 BL 3 0 Memory interface D 31 0 DIN 31 0 LOCK nTRANS ABORT Memory management interface nOPC nCPI CPA CPB Coprocessor interface Boundary scan control signals 11 nM 4 0 Processor mode Processor state TBIT DBGRQ INSTRVALID BREAKPT DBGACK nEXEC EXTERN1 EXT...

Page 31: ...sor uses an implementation of the ARMv4T architecture For a complete description of both instruction sets see the ARM Architecture Reference Manual The ARM instruction set formats are shown in Figure 1 5 on page 1 12 Table 1 1 Key to tables Type Description cond Condition field see Table 1 6 on page 1 19 Oprnd2 Operand2 see Table 1 4 on page 1 18 field Control field see Table 1 5 on page 1 19 S Se...

Page 32: ...ate offset Single data transfer Undefined Block data transfer Branch Coprocessor data transfer Coprocessor data operation Coprocessor register transfer Software interrupt Multiply 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Cond Cond Cond Cond Cond Cond Cond Cond Cond Cond Cond Cond Cond Cond 0 0 0 0 0 0 0 0 1 1 1 1 1 1 0 0 0 0 0 0 1 1 0 0 1 1 1 1 1 0 0 0 ...

Page 33: ... Move immediate to CPSR flags MSR cond CPSR_f 32bit_Imm Arithmetic Add ADD cond S Rd Rn Oprnd2 Add with carry ADC cond S Rd Rn Oprnd2 Subtract SUB cond S Rd Rn Oprnd2 Subtract with carry SBC cond S Rd Rn Oprnd2 Subtract reverse subtract RSB cond S Rd Rn Oprnd2 Subtract reverse subtract with carry RSC cond S Rd Rn Oprnd2 Multiply MUL cond S Rd Rm Rs Multiply accumulate MLA cond S Rd Rm Rs Rn Multip...

Page 34: ...ser mode privilege LDR cond BT Rd a_mode2P Byte signed LDR cond SB Rd a_mode3 Halfword LDR cond H Rd a_mode3 Halfword signed LDR cond SH Rd a_mode3 Multiple block data operations Increment before LDM cond IB Rd reglist Increment after LDM cond IA Rd reglist Decrement before LDM cond DB Rd reglist Decrement after LDM cond DA Rd reglist Stack operation LDM cond a_mode4L Rd reglist Stack operation an...

Page 35: ...de2P Halfword STR cond H Rd a_mode3 Multiple block data operations Increment before STM cond IB Rd reglist Increment after STM cond IA Rd reglist Decrement before STM cond DB Rd reglist Decrement after STM cond DA Rd reglist Stack operation STM cond a_mode4S Rd reglist Stack operation with user registers STM cond a_mode4S Rd reglist Swap Word SWP cond Rd Rm Rn Byte SWP cond B Rd Rm Rn Coprocessors...

Page 36: ... Rn Rm Scaled register offset Rn Rm LSL 5bit_shift_imm Rn Rm LSR 5bit_shift_imm Rn Rm ASR 5bit_shift_imm Rn Rm ROR 5bit_shift_imm Rn Rm RRX Pre indexed offset Immediate Rn 12bit_Offset Register Rn Rm Scaled register Rn Rm LSL 5bit_shift_imm Rn Rm LSR 5bit_shift_imm Rn Rm ASR 5bit_shift_imm Rn Rm ROR 5bit_shift_imm Rn Rm RRX Post indexed offset Immediate Rn 12bit_Offset Register Rn Rm Scaled regist...

Page 37: ..._Offset Register Rn Rm Scaled register Rn Rm LSL 5bit_shift_imm Rn Rm LSR 5bit_shift_imm Rn Rm ASR 5bit_shift_imm Rn Rm ROR 5bit_shift_imm Rn Rm RRX Mode 3 a_mode3 Immediate offset Rn 8bit_Offset Pre indexed Rn 8bit_Offset Post indexed Rn 8bit_Offset Register Rn Rm Pre indexed Rn Rm Post indexed Rn Rm Mode 4 load a_mode4L IA increment after FD full descending IB increment before ED empty descendin...

Page 38: ...cending Mode 5 coprocessor data transfer a_mode5 Immediate offset Rn 8bit_Offset 4 Pre indexed Rn 8bit_Offset 4 Post indexed Rn 8bit_Offset 4 Table 1 3 Addressing modes continued Addressing mode Type or addressing mode Mnemonic or stack type Table 1 4 Operand 2 Operand Type Mnemonic Operand 2 Oprnd2 Immediate value 32bit_Imm Logical shift left Rm LSL 5bit_Imm Logical shift right Rm LSR 5bit_Imm Ar...

Page 39: ...s field mask bit 1 _x Extension field mask bit 2 Table 1 6 Condition fields Field type Suffix Description Condition Condition cond EQ Equal Z set NE Not equal Z clear CS Unsigned higher or same C set CC Unsigned lower C clear MI Negative N set PL Positive or zero N clear VS Overflow V set VC No overflow V clear HI Unsigned higher C set Z clear LS Unsigned lower or same C clear Z set GE Greater or ...

Page 40: ... in Figure 1 6 on page 1 21 See the ARM Architectural Reference Manual for more information about the ARM instruction set formats GT Greater than Z clear N V N and V set or N and V clear LE Less than or equal Z set or N V N set and V clear or N clear and V set AL Always Flag ignored Table 1 6 Condition fields continued Field type Suffix Description Condition ...

Page 41: ...nd pop registers Multiple load and store Add and subtract Conditional branch Software interrupt Unconditional branch Long branch with link 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Rd Rd Rb Rb Op 0 0 1 H1H2 0 1 0 0 0 0 0 1 0 0 1 Ro 1 L B 0 Offset8 Op Word8 Rd Rn offset3 Rd Rs Op 0 0 0 1 1 1 Rd Op Rd Rs RdHd Rs Hs 0 1 0 0 0 1 0 1 0 Rd Rb Ro 1 H S 1 0 1 0 Offset5 B L 0 1 1 Rb Rd Offset5 0 L 1 0 0 Rd Wor...

Page 42: ...nd Low ADD Rd Rs Rn Add High to Low ADD Rd Hs Add Low to High ADD Hd Rs Add High to High ADD Hd Hs Add Immediate ADD Rd 8bit_Imm Add Value to SP ADD SP 7bit_Imm ADD SP 7bit_Imm Add with carry ADC Rd Rs Subtract SUB Rd Rs Rn SUB Rd Rs 3bit_Imm Subtract Immediate SUB Rd 8bit_Imm Subtract with carry SBC Rd Rs Negate NEG Rd Rs Multiply MUL Rd Rs Compare Low and Low CMP Rd Rs Compare Low and High CMP R...

Page 43: ...te right ROR Rd Rs Branch Conditional if Z set BEQ label if Z clear BNE label if C set BCS label if C clear BCC label if N set BMI label if N clear BPL label if V set BVS label if V clear BVC label if C set and Z clear BHI label if C clear and Z set BLS label if N set and V set or N clear and V clear BGE label if N set and V clear or if N clear and V set BLT label if Z clear and N or V set or N or...

Page 44: ...RB Rd Rb 5bit_offset With register offset word LDR Rd Rb Ro halfword LDRH Rd Rb Ro signed halfword LDRSH Rd Rb Ro byte LDRB Rd Rb Ro signed byte LDRSB Rd Rb Ro PC relative LDR Rd PC 10bit_Offset SP relative LDR Rd SP 10bit_Offset Address using PC ADD Rd PC 10bit_Offset using SP ADD Rd SP 10bit_Offset Multiple LDMIA Rb reglist Store With immediate offset word STR Rd Rb 7bit_offset halfword STRH Rd ...

Page 45: ...Rd Rb Ro SP relative STR Rd SP 10bit_offset Multiple STMIA Rb reglist Push Pop Push registers onto stack PUSH reglist Push LR and registers onto stack PUSH reglist LR Pop registers from stack POP reglist Pop registers and pc from stack POP reglist PC Software Interrupt SWI 8bit_Imm Table 1 7 Thumb instruction set summary continued Operation Assembly syntax ...

Page 47: ...ammer s model It contains the following sections About the programmer s model on page 2 2 Processor operating states on page 2 3 Memory formats on page 2 4 Data types on page 2 6 Operating modes on page 2 7 Registers on page 2 8 The program status registers on page 2 13 Exceptions on page 2 16 Interrupt latencies on page 2 23 Reset on page 2 24 ...

Page 48: ...rved ARM DDI 0210C 2 1 About the programmer s model The ARM7TDMI processor core implements ARM architecture v4T which includes the 32 bit ARM instruction set and the 16 bit Thumb instruction set The programmer s model is described in the ARM Architecture Reference Manual ...

Page 49: ...tion between ARM and Thumb states does not affect the processor mode or the register contents 2 2 1 Switching state The operating state of the ARM7TDMI core can be switched between ARM state and Thumb state using the BX instruction This is described in the ARM Architecture Reference Manual All exception handling is entered in ARM state If an exception occurs in Thumb state the processor reverts to...

Page 50: ...le endian numbers are already set up for the processing order Endian configuration has no relevance unless data is stored as words and then accessed in smaller sized quantities halfwords or bytes 2 3 1 Little endian In little endian format the lowest addressed byte in a word is considered the least significant byte of the word and the highest addressed byte is the most significant So the byte at a...

Page 51: ... of the memory system connects to data lines 31 through 24 For a word aligned address A Figure 2 2 shows how the word at address A the halfword at addresses A and A 2 and the bytes at addresses A A 1 A 2 and A 3 map on to each other when the core is configured as big endian Figure 2 2 Big endian addresses of bytes and halfwords within words 31 24 23 16 15 8 7 0 Halfword at address A Halfword at ad...

Page 52: ...rds 16 bit bytes 8 bit You must align these as follows word quantities must be aligned to four byte boundaries halfword quantities must be aligned to two byte boundaries byte quantities can be placed on any byte boundary Note Memory systems are expected to support all data types In particular the system must support subword writes without corrupting neighboring bytes in that word ...

Page 53: ...after a data or instruction Prefetch Abort System mode is a privileged user mode for the operating system Note You can only enter System mode from another privileged mode by modifying the mode bit of the Current Program Status Register CPSR Undefined mode is entered when an undefined instruction is executed Modes other than User mode are collectively known as privileged modes Privileged modes are ...

Page 54: ...ter Register r14 is used as the subroutine Link Register LR Register r14 receives a copy of r15 when a Branch with Link BL instruction is executed At all other times you can treat r14 as a general purpose register The corresponding banked registers r14_svc r14_irq r14_fiq r14_abt and r14_und are similarly used to hold the return values of r15 when interrupts and exceptions arise or when BL instruc...

Page 55: ... 2 3 Register organization in ARM state ARM state general registers and program counter r0 r1 r2 r3 r4 r5 r6 r7 r8 r9 r10 r11 r12 r13 r14 r15 PC System and User CPSR CPSR SPSR_fiq CPSR SPSR_svc CPSR SPSR_abt CPSR SPSR_irq CPSR SPSR_und ARM state program status registers banked register r0 r1 r2 r3 r4 r5 r6 r7 r8_fiq r9_fiq r10_fiq r11_fiq r12_fiq r13_fiq r14_fiq r15 PC FIQ r0 r1 r2 r3 r4 r5 r6 r7 ...

Page 56: ...er set is shown in Figure 2 4 Figure 2 4 Register organization in Thumb state Thumb state general registers and program counter System and User r0 r1 r2 r3 r4 r5 r6 r7 SP LR PC CPSR CPSR SPSR_fiq CPSR SPSR_svc CPSR SPSR_abt CPSR SPSR_irq CPSR SPSR_und Thumb state program status registers banked register FIQ r0 r1 r2 r3 r4 r5 r6 r7 SP_fiq LR_fiq PC Supervisor r0 r1 r2 r3 r4 r5 r6 r7 SP_svc LR_svc P...

Page 57: ... and SPSRs are identical Thumb state SP maps onto the ARM state r13 Thumb state LR maps onto the ARM state r14 Thumb state pc maps onto the ARM state pc r15 These relationships are shown in Figure 2 5 Figure 2 5 Mapping of Thumb state registers onto ARM state registers Program counter PC r1 r2 r3 r4 r5 Thumb state r6 r7 Stack pointer SP Link register LR Current program status register CPSR Saved p...

Page 58: ...er set The assembly language programmer has limited access to them but can use them for fast temporary storage You can use special variants of the MOV instruction to transfer a value from a low register in the range r0 r7 to a high register and from a high register to a low register The CMP instruction enables you to compare high register values with low register values The ADD instruction enables...

Page 59: ... not alter any of the reserved bits One method of preserving these bits is to use a read write modify strategy when changing the CPSR The remainder of this section describes Condition code flags Control bits on page 2 14 Reserved bits on page 2 15 2 7 1 Condition code flags The N Z C and V bits are the condition code flags you can set them by arithmetic and logical operations They can also be set ...

Page 60: ...change when an exception occurs When the processor is operating in a privileged mode software can manipulate these bits Interrupt disable bits The I and F bits are the interrupt disable bits when the I bit is set IRQ interrupts are disabled when the F bit is set FIQ interrupts are disabled T bit The T bit reflects the operating state when the T bit is set the processor is executing in Thumb state ...

Page 61: ...make sure that your program does not rely on reserved bits containing specific values because future processors might have these bits set to 1 or 0 Table 2 2 PSR mode bit values M 4 0 Mode Visible Thumb state registers Visible ARM state registers 10000 User r0 r7 SP LR PC CPSR r0 r14 PC CPSR 10001 FIQ r0 r7 SP_fiq LR_fiq PC CPSR SPSR_fiq r0 r7 r8_fiq r14_fiq PC CPSR SPSR_fiq 10010 IRQ r0 r7 SP_irq...

Page 62: ... entry and exit summary Entering an exception on page 2 17 Leaving an exception on page 2 18 Fast interrupt request on page 2 18 Interrupt request on page 2 19 Software interrupt instruction on page 2 21 Undefined instruction on page 2 21 Exception vectors on page 2 21 Exception priorities on page 2 22 2 8 1 Exception entry and exit summary Table 2 3 summarizes the pc value preserved in the releva...

Page 63: ...le in the case of a SWI MOVS PC r14_svc always returns to the next instruction regardless of whether the SWI was executed in ARM or Thumb state 2 Copies the CPSR into the appropriate SPSR 3 Forces the CPSR mode bits to a value that depends on the exception 4 Forces the PC to fetch the next instruction from the relevant exception vector The ARM7TDMI processor can also set the interrupt disable flag...

Page 64: ...flags that were set on entry Note The action of restoring the CPSR from the SPSR automatically resets the T bit to whatever value it held immediately prior to the exception 2 8 4 Fast interrupt request The Fast Interrupt Request FIQ exception supports data transfers or channel processes In ARM state FIQ mode has eight banked registers to remove the requirement for register saving This minimizes th...

Page 65: ...y system In such a system the processor is allowed to generate arbitrary addresses When the data at an address is unavailable the Memory Management Unit MMU signals an abort The abort handler must then Work out the cause of the abort and make the requested data available Load the instruction that caused the abort using an LDR Rn R14_abt 8 instruction to determine whether that instruction specifies...

Page 66: ... of the destination register with the loaded data Swap instruction SWP on a read access suppresses the write access and the write to the destination register on a write access suppresses the write to the destination register Block data transfer instructions LDM and STM complete When write back is specified the base register is updated If the base register is in the transfer list and has already be...

Page 67: ...tware can use this mechanism to extend the ARM instruction set by emulating undefined coprocessor instructions After emulating the failed instruction the trap handler executes the following irrespective of the processor operating state MOVS PC R14_und This action restores the CPSR and returns to the next instruction after the undefined instruction For more information about undefined instructions ...

Page 68: ...s the Data Abort handler and proceeds immediately to the FIQ vector A normal return from the FIQ causes the Data Abort handler to resume execution Data Aborts must have higher priority than FIQs to ensure that the transfer error does not escape detection You must add the time for this exception entry to the worst case FIQ latency calculations in a system that uses aborts to support virtual memory ...

Page 69: ...e registers including the PC Tldm is 20 cycles in a zero wait state system Texc The time for the Data Abort entry Texc is three cycles Tfiq The time for FIQ entry Tfiq is two cycles The total latency is therefore 29 processor cycles just over 0 7 microseconds in a system that uses a continuous 40MHz processor clock At the end of this time the ARM7TDMI processor executes the instruction at 0x1c The...

Page 70: ...When nRESET goes HIGH again the ARM7TDMI processor 1 Overwrites R14_svc and SPSR_svc by copying the current values of the PC and CPSR into them The values of the PC and CPSR are indeterminate 2 Forces M 4 0 to b10011 Supervisor mode sets the I and F bits and clears the T bit in the CPSR 3 Forces the PC to fetch the next instruction from address 0x00 4 Reverts to ARM state if necessary and resumes ...

Page 71: ...nterface It contains the following sections About the memory interface on page 3 2 Bus interface signals on page 3 3 Bus cycle types on page 3 4 Addressing signals on page 3 11 Address timing on page 3 14 Data timed signals on page 3 17 Stretching access times on page 3 29 Privileged mode access on page 3 31 Reset sequence after power up on page 3 32 ...

Page 72: ...d All rights reserved ARM DDI 0210C 3 1 About the memory interface The ARM7TDMI processor has a Von Neumann architecture with a single 32 bit data bus carrying both instructions and data Only load store and swap instructions can access data from memory ...

Page 73: ...d clock control signals are MCLK nWAIT ECLK nRESET The address class signals are A 31 0 nRW MAS 1 0 nOPC nTRANS LOCK TBIT The memory request signals are nMREQ SEQ The data timed signals are D 31 0 DIN 31 0 DOUT 31 0 ABORT BL 3 0 The ARM7TDMI processor uses both the rising and falling edges of MCLK Bus cycles can be extended using the nWAIT signal This signal is described in Stretching access times...

Page 74: ...le memory cycle The ARM7TDMI processor bus interface can perform four different types of bus cycle a nonsequential cycle requests a transfer to or from an address which is unrelated to the address used in the preceding cycle a sequential cycle requests a transfer to or from an address which is either the same one word or one halfword greater than the address used in the preceding cycle an internal...

Page 75: ...request The address class and nMREQ and SEQ signals that comprise an N cycle are broadcast on the bus At the end of the next bus cycle the data is transferred between the CPU and the memory It is not uncommon for a memory system to require a longer access time extending the clock cycle for nonsequential accesses This is to allow time for full address decoding or to latch both a row and column addr...

Page 76: ...ign of a memory controller interfacing to a burst memory device such as a DRAM During a sequential cycle the ARM7TDMI processor requests a memory location that is part of a sequential burst For the first cycle in the burst the address can be the same as the previous internal cycle Otherwise the address is incremented from the previous cycle for a burst of word accesses the address is incremented b...

Page 77: ...onsequential access An example of a burst access is shown in Figure 3 3 Figure 3 3 Sequential access cycles 3 3 3 Internal cycles During an internal cycle the ARM7TDMI processor does not require a memory access as an internal function is being performed and no useful prefetching can be performed at the same time Table 3 2 Burst types Burst type Address increment Cause Word read 4 bytes ARM7TDMIcor...

Page 78: ... the ARM7TDMI processor performs an optimization on the bus to allow extra time for memory decode When this happens the address of the next memory cycle is broadcast on this bus during an internal cycle This enables the memory controller to decode the address but it must not initiate a memory access during this cycle In a merged IS cycle the next cycle is a sequential cycle to the same memory loca...

Page 79: ...mory cycle during an I cycle 3 3 5 Coprocessor register transfer cycles During a coprocessor register transfer cycle the ARM7TDMI processor uses the data buses to transfer data to or from a coprocessor A memory cycle is not required and the memory controller does not initiate a transaction The memory system must not drive onto the data bus during a coprocessor register transfer cycle The coprocess...

Page 80: ...ter transfer cycles 3 3 6 Summary of ARM memory cycle timing A summary of ARM7TDMI processor memory cycle timing is shown in Figure 3 7 Figure 3 7 Memory cycle timing MCLK A 31 0 nMREQ SEQ D 31 0 Memory Memory Coprocessor N cycle C cycle C cycle I cycle S cycle a 8 a 4 a MCLK A 31 0 nMREQ SEQ nRAS nCAS D 31 0 N cycle ...

Page 81: ... 1 0 and when a halfword access is signaled the memory system ignores the bottom bit A 0 All data values must be aligned on their natural boundaries All words must be word aligned 3 4 2 nRW nRW specifies the direction of the transfer nRW indicates an ARM7TDMI processor write cycle when HIGH and an ARM7TDMI processor read cycle when LOW A burst of S cycles is always either a read burst or a write b...

Page 82: ...TDMI processor must have individual byte write enables Both the C Compiler and the ARM debug tool chain for example Multi ICE assume that arbitrary bytes in the memory can be written If individual byte write capability is not provided you might not be able to use either of these tools without data corruption 3 4 4 nOPC The nOPC output conveys information about the transfer An MMU can use this sign...

Page 83: ...d mode access on page 3 31 3 4 6 LOCK LOCK is used to indicate to an arbiter that an atomic operation is being performed on the bus LOCK is normally LOW but is set HIGH to indicate that a SWP or SWPB instruction is being performed These instructions perform an atomic read write operation and can be used to implement semaphores 3 4 7 TBIT TBIT is used to indicate the operating state of the ARM7TDMI...

Page 84: ... A 31 0 plus nRW MAS 1 0 LOCK nOPC and nTRANS In most systems particularly a DRAM based system it is desirable to obtain the address from ARM7TDMI processor as early as possible When APE is HIGH then the ARM7TDMI processor address becomes valid after the rising edge of MCLK before the memory cycle to which it refers This timing allows longer periods for address decoding and the generation of DRAM ...

Page 85: ...n be driven to the correct value for the particular bank of memory being accessed The value of APE can be held until the memory control signals denote another nonsequential access Previous ARM processors included the ALE signal and this is retained for backwards compatibility This signal also enables you to modify the address timing to achieve the same results as APE but in a dynamic manner To obt...

Page 86: ...ddress timing Note If ALE is to be used to change address timing then you must tie APE HIGH Similarly if APE is to be used ALE must be tied HIGH You can obtain better system performance when the address pipeline is enabled with APE HIGH This allows longer time for address decoding MCLK nMREQ SEQ APE D 31 0 ALE A 31 0 ...

Page 87: ...onal data buses DIN 31 0 DOUT 31 0 and a bidirectional data bus D 31 0 The configuration input BUSEN is used to select which is active Figure 3 11 shows the arrangement of the data buses and bus splitter logic Figure 3 11 External bus arrangement When the bidirectional data bus is being used then you must disable the unidirectional buses by driving BUSEN LOW The timing of the bus for three cycles ...

Page 88: ... of the data is similar to that of the bidirectional data bus The value on DOUT 31 0 changes after the falling edge of MCLK The bus timing of a read write read cycle combination is shown in Figure 3 13 Figure 3 13 Unidirectional bus timing When the unidirectional data buses are being used and BUSEN is HIGH the bidirectional bus D 31 0 must be left unconnected The unidirectional buses are typically...

Page 89: ...ocessor is reading from memory DIN 31 0 is acting as an input During write cycles the ARM7TDMI core must output data During phase 2 of the previous cycle the signal nRW is driven HIGH to indicate a write cycle During the actual cycle nENOUT is driven LOW to indicate that the processor is driving D 31 0 as an output Figure 3 15 on page 3 20 shows the bus timing with the data bus enabled Figure 3 16...

Page 90: ...rved ARM DDI 0210C Figure 3 15 Data write bus cycle Figure 3 16 Data bus control circuit MCLK A 31 0 nRW nENOUT D 31 0 memory cycle Scan cell Scan cell Scan cell Data direction control from core DBE nENOUT nENIN TBE D 31 0 Write data from core Read data to core ARM7TDMI ...

Page 91: ...d to keep the data bus enabled The processor has another output control signal called TBE This signal is usually only used during test and must be tied HIGH when not in use When driven LOW TBE forces all tristateable outputs to high impedance it is as though both DBE and ABE have been driven LOW causing the data bus the address bus and all other signals normally controlled by ABE to become high im...

Page 92: ... chip In this application care must be taken to prevent bus clash on D 31 0 when the data bus drive changes direction The timing of nENIN and the pad control signals must be arranged so that when the core starts to drive out the pad drive onto D 31 0 is disabled before the core starts to drive Similarly when the bus switches back to input the core must stop driving before the pad is enabled Figure...

Page 93: ... to manually force the internal buses into a high impedance state At the pad level the test chip signal EDBE is used by the bus control logic to enable the external memory controller to arbitrate the bus and asynchronously disable the ARM7TDMI core test chip if necessary Scan cell Scan cell Scan cell Vdd Vss Vdd MCLK DBE nENOUT nEDBE MCLK EDBE nENIN TBE D 31 0 XD 31 0 Pad ARM7TDMI core ARM7TDMI te...

Page 94: ...rols the latching of the data present on D 23 16 BL 1 controls the latching of the data present on D 15 8 BL 0 controls the latching of the data present on D 7 0 Note It is recommended that BL 3 0 is tied HIGH in new designs and word values from narrow memory systems are latched onto latches that are external to the ARM7TDMI core In a memory system that contains 32 bit memory only BL 3 0 can be ti...

Page 95: ...n BL 3 0 can be driven to value 0xF and all of the latches opened This does not affect the operation of the core because the latches on D 31 16 are written with the correct data during the second cycle Note BL 3 0 must be held HIGH during store cycles Figure 3 18 Memory access Figure 3 19 on page 3 26 shows a halfword load from single wait state byte wide memory In the figure each memory access ta...

Page 96: ...ry system can return the complete 32 bit word and the processor extracts the valid halfword or byte field from it The fields extracted depend on the state of the BIGEND signal which determines the endian configuration of the system See Memory formats on page 2 4 A word read from 32 bit memory presents the word value on the whole data bus as listed in Table 3 7 on page 3 27 When connecting 8 bit to...

Page 97: ...orms a byte or halfword write the data being written is replicated across the data bus as shown in Figure 3 20 on page 3 28 The memory system can use the most convenient copy of the data A writable memory system must be capable of performing a write to any single byte in the memory system This capability is required by the ARM C Compiler and the debug tool chain Table 3 7 Read accesses Access type...

Page 98: ...C Figure 3 20 Data replication 0 A B C D 7 8 15 16 23 31 24 ARM register Half word write register 15 0 CD CD CD D 31 16 D 15 0 Word write register 31 0 ABCD ABCD D 31 0 Byte write register 7 0 D D D D D D 31 24 Memory interface D 15 8 D 23 16 D 7 0 Bits Memory interface Memory interface ...

Page 99: ...he nWAIT input can be used together with a free running MCLK Taking nWAIT LOW has the same effect as stretching the LOW period of MCLK 3 7 2 Use of nWAIT to control bus cycles The pipelined nature of the processor bus interface means that there is a distinction between clock cycles and bus cycles nWAIT can be used to stretch a bus cycle so that it lasts for many clock cycles The nWAIT input allows...

Page 100: ...ntroller you are strongly advised to sample the values of nMREQ SEQ and the address class signals only when nWAIT is HIGH This ensures that the state of the memory controller is not accidentally updated during an extended bus cycle A A 4 A 8 B B 4 B 8 C C 4 MCLK nMREQ SEQ A 31 0 nRW nWAIT D 31 0 nRAS nCAS S S Cycles Decode Cycles S S S Decode N N Cycles ...

Page 101: ...ure avoids the possibility of a hacker deliberately passing an invalid pointer to an OS and getting the OS to access this memory with privileged access This technique could otherwise be used by a hacker to enable the user application to access any memory locations such as I O space The least significant five bits of the CPSR are also output from the core as inverted signals nM 4 0 These indicate t...

Page 102: ...the core when nRESET was asserted They are undefined after power up After nRESET has been taken HIGH the ARM core does two further internal cycles before the first instruction is fetched from the reset vector address 0x00000000 It then takes three MCLK cycles to advance this instruction through the Fetch Decode Execute stages of the ARM instruction pipeline before this first instruction is execute...

Page 103: ...ce It contains the following sections About coprocessors on page 4 2 Coprocessor interface signals on page 4 4 Pipeline following signals on page 4 5 Coprocessor interface handshaking on page 4 6 Connecting coprocessors on page 4 12 If you are not using an external coprocessor on page 4 15 Undefined instructions on page 4 16 Privileged instructions on page 4 17 ...

Page 104: ...pipeline and the coprocessor pipeline at the same time The execution of instructions is shared between the ARM7TDMI core and the coprocessor The ARM7TDMI processor 1 Evaluates the instruction type and the condition codes to determine whether the instructions are executed by the coprocessor and communicates this to any coprocessors in the system using nCPI 2 Generates any addresses that are require...

Page 105: ...e Debug Communications Channel DCC coprocessor Other coprocessor numbers have also been reserved Coprocessor availability is listed in Table 4 1 If you intend to design a coprocessor send an email with coprocessor in the subject line to info arm com for up to date information on which coprocessor numbers have been allocated Table 4 1 Coprocessor availability Coprocessor number Allocation 15 Reserv...

Page 106: ...ace signals The signals used to interface the ARM7TDMI core to a coprocessor are grouped into four categories The clock and clock control signals are MCLK nWAIT nRESET The pipeline following signals are nMREQ SEQ nTRANS nOPC TBIT The handshake signals are nCPI CPA CPB The data signals are D 31 0 DIN 31 0 DOUT 31 0 ...

Page 107: ...must be loaded into the pipeline on the falling edge of MCLK and only when nOPC nMREQ and TBIT were all LOW in the previous bus cycle These conditions indicate that this cycle is an ARM instruction fetch so the new opcode must be read into the pipeline The pipeline must be advanced on the falling edge of MCLK when nOPC nMREQ and TBIT are all LOW in the current bus cycle These conditions indicate t...

Page 108: ...processor decodes the instruction currently in the Decode stage of its pipeline and checks whether that instruction is a coprocessor instruction A coprocessor instruction contains a coprocessor number that matches the coprocessor ID of the coprocessor If the instruction currently in the Decode stage is a relevant coprocessor instruction 1 The coprocessor attempts to execute the instruction 2 The c...

Page 109: ...cessor signaling The coprocessor responses are listed in Table 4 3 Table 4 3 Summary of coprocessor signaling CPA CPB Response Remarks 0 0 Coprocessor present If a coprocessor can accept an instruction and can start that instruction immediately it must signal this by driving both CPA and CPB LOW The ARM7TDMI processor then ignores the coprocessor instruction and executes the next instruction as no...

Page 110: ...or IRQ occurs and the appropriate bit is clear in the CSPR then the ARM7TDMI processor abandons the coprocessor instruction and signals this by taking nCPI HIGH A coprocessor that is capable of busy waiting must monitor nCPI to detect this condition When the ARM7TDMI core abandons a coprocessor instruction the coprocessor also abandons the instruction and continues tracking the ARM7TDMI processor ...

Page 111: ...ng the interrupt to retry the coprocessor instruction Other coprocessor instructions can be executed before the interrupted instruction is executed again 4 4 5 Coprocessor register transfer instructions The coprocessor register transfer instructions MCR and MRC are used to transfer data between a register in the ARM7TDMI processor register bank and a register in the coprocessor register bank An ex...

Page 112: ...n a coprocessor and memory They can be used to transfer either a single word of data or a number of the coprocessor registers There is no limit to the number of words of data that can be transferred by a single LDC or STC instruction but by convention no more than 16 words should be transferred in a single instruction An example sequence is shown in Figure 4 4 on page 4 11 Note If you transfer mor...

Page 113: ...11 Figure 4 4 Coprocessor load sequence ADD SUB LDC n 4 TST SUB ADD SUB LDC TST SUB ADD SUB LDC TST SUB MCLK Fetch stage Decode stage Execute stage nCPI CPA CPB D 31 0 CP Data Instr fetch Instr fetch SUB CP Data CP Data CP Data Instr fetch ADD Instr fetch LDC Instr fetch TST Instr fetch SUB ...

Page 114: ...tten from memory LDC data read to memory STC This section describes Connecting a single coprocessor Connecting multiple coprocessors on page 4 13 4 5 1 Connecting a single coprocessor An example of how to connect a coprocessor into an ARM7TDMI processor system if you are using a bidirectional bus is shown in Figure 4 5 a coprocessor into an ARM7TDMI processor system if you are using a unidirection...

Page 115: ...have multiple coprocessors in your system connect the handshake signals as follows nCPI Connect this signal to all coprocessors present in the system CPA and CPB The individual CPA and CPB outputs from each coprocessor must be ANDed together and connected to the CPA and CPB inputs on the ARM7TDMI processor You must multiplex the output data from the coprocessors Connecting multiple coprocessors is...

Page 116: ...terface 4 14 Copyright 2001 2004 ARM Limited All rights reserved ARM DDI 0210C Figure 4 7 Connecting multiple coprocessors ARM core Coprocessor 1 Coprocessor 2 CPA CPB nCPI CPB1 CPA1 CPA2 CPB2 Coprocessor n CPBn CPAn ...

Page 117: ...h CPA and CPB HIGH This indicates that no external coprocessors are present in the system If any coprocessor instructions are received they take the undefined instruction trap so that they can be emulated in software if required The internal coprocessor CP14 can still be used The coprocessor outputs from the ARM7TDMI processor are usually left unconnected but these outputs can be used in other par...

Page 118: ... instruction This enables the core to take the undefined instruction exception The coprocessor must check bit 27 of the instruction to differentiate between the following instruction types undefined instructions have 0 in bit 27 coprocessor instructions have 1 in bit 27 Coprocessor instructions are not supported in the Thumb instruction set but undefined instructions are All coprocessors must moni...

Page 119: ...the nTRANS signal must be sampled at the same time as the coprocessor instruction is fetched and is used in the coprocessor pipeline Decode stage Note If a User mode process with nTRANS LOW tries to access a coprocessor instruction that can only be executed in a privileged mode the coprocessor responds with CPA and CPB HIGH This causes the ARM7TDMI processor to take the undefined instruction trap ...

Page 121: ...ebug interface on page 5 2 Debug systems on page 5 4 Debug interface signals on page 5 7 ARM7TDMI core clock domains on page 5 11 Determining the core and system state on page 5 13 This chapter also describes the ARM7TDMI processor EmbeddedICE RT logic module in the following sections About EmbeddedICE RT logic on page 5 14 Disabling EmbeddedICE RT on page 5 16 Debug Communications Channel on page...

Page 122: ... Monitor mode On a breakpoint or watchpoint an Instruction Abort or Data Abort is generated instead of entering debug state The core still receives and services interrupts as normal In either case you can examine the internal state of the core and the external state of the system while system activity continues 5 1 1 Stages of debug A request on one of the external debug interface signals or on th...

Page 123: ...TCK During normal operation the core is clocked by MCLK and internal logic holds DCLK LOW When the ARM7TDMI processor is in halt mode the core is clocked by DCLK under control of the TAP state machine and MCLK can free run The selected clock is output on the signal ECLK for use by the external system Note NWAIT must be HIGH in debug state In monitor mode the core continues to be clocked by MCLK an...

Page 124: ...software debugger such as the ARM Debugger for Windows ADW The debug host enables you to issue high level commands such as setting breakpoints or examining the contents of memory 5 2 2 Protocol converter The protocol converter communicates with the high level commands issued by the debug host and the low level commands of the ARM7TDMI processor JTAG interface Typically it interfaces to the host th...

Page 125: ...time monitoring of the core resume program execution 5 2 3 Debug target The major blocks of the debug target are shown in Figure 5 2 Figure 5 2 ARM7TDMI block diagram The ARM CPU main processor logic This has hardware support for debug The EmbeddedICE RT logic This is a set of registers and comparators used to generate debug exceptions such as breakpoints This unit is described in About EmbeddedIC...

Page 127: ...bles you to establish whether the exception was because of a breakpoint or watchpoint or to a genuine memory abort You can use the EmbeddedICE RT logic to program the conditions under which a breakpoint or watchpoint can occur Alternatively you can use the BREAKPT signal to enable external logic to flag breakpoints or watchpoints and monitor the following address bus data bus control signals The t...

Page 128: ...g on whether you have set bit 4 in the debug control register the core instruction processing stops or an abort exception is executed Abort on page 2 19 When you examine the internal state you see the state before the breakpointed instruction When your examination is complete the breakpoint must be removed This is usually handled automatically by the debugger which also restarts program execution ...

Page 129: ...t on page 2 19 A watchpoint is always taken but the core might not enter debug state immediately In all cases the current instruction completes If the current instruction is load or store multiple instruction LDM or STM many cycles can elapse before the watchpoint is taken On a watchpoint the following sequence occurs 1 The current instruction completes 2 All changes to the core state are made 3 L...

Page 130: ...knowledge of the debugger nRESET Resetting the core while debugging causes the debugger to lose track of the core When the system applies reset to the ARM7TDMI processor by driving nRESET LOW the processor state changes with the debugger unaware that the core has reset When instructions are executed in halt mode all memory interface outputs except nMREQ and SEQ change asynchronously to the memory ...

Page 131: ...igure 5 4 The core is forced to use DCLK as the primary clock until debugging is complete On exit from debug the core must be allowed to synchronize back to MCLK This must be done by the debugger in the following sequence 1 The final instruction of the debug sequence is shifted into the data bus scan chain and clocked in by asserting DCLK 2 RESTART is clocked into the TAP instruction register The ...

Page 132: ...an use the TAP controller to serially test the processor If scan chain 0 and INTEST are selected DCLK is generated while the state machine is in the RUN TEST IDLE state During EXTEST DCLK is not generated On exit from test RESTART must be selected as the TAP controller instruction When this is done MCLK can be resumed After INTEST testing you must take care to ensure that the core is in a sensible...

Page 133: ...e multiples into the instruction pipeline Before you can examine the core and system state the debugger must determine if the processor entered debug from Thumb state or ARM state by examining bit 4 of the EmbeddedICE RT logic debug status register When bit 4 is HIGH the core has entered debug from Thumb state For more details about determining the core state see Determining the core and system st...

Page 134: ...tween the core the EmbeddedICE RT logic and the TAP controller showing only the pertinent signals Figure 5 5 ARM7 CPU main processor logic TAP controller and EmbeddedICE RT logic The EmbeddedICE RT logic comprises two real time watchpoint units three independent registers debug control register nOPC ARM CPU main processor logic DBGRQI A 31 0 D 31 0 nRW TBIT MAS 1 0 nTRANS DBGACKI BREAKPTI IFEN ECL...

Page 135: ...sed when monitor mode is selected You can program one or both watchpoint units to halt the execution of a program by the core Execution halts when the values programmed into EmbeddedICE RT match the values currently appearing on the address bus data bus and various control signals Note You can mask any bit so that its value does not affect the comparison You can configure each watchpoint unit for ...

Page 136: ...EN LOW Caution Hard wiring the DBGEN input LOW permanently disables the EmbeddedICE RT logic However you must not rely upon this for system security When DBGEN is LOW BREAKPT and DBGRQ are ignored by the core DBGACK is forced LOW by the ARM7TDMI core interrupts pass through to the processor uninhibited by the debug logic the EmbeddedICE RT logic enters low power mode ...

Page 137: ...fixed locations in the EmbeddedICE RT logic register map as shown in Figure B 7 on page B 43 and are accessed from the processor using MCR and MRC instructions to coprocessor 14 The registers are accessed as follows By the debugger Through scan chain 2 in the usual way By the processor Through coprocessor register transfer instructions The following sections describe DCC control register Communica...

Page 138: ...r it by writing to the DCC control register Writing to this register is rarely necessary because in normal operation the processor clears bit 0 after reading it Use the instructions listed in Table 5 1 to access the DCC registers Because the Thumb instruction set does not contain coprocessor instructions you are advised to access this data through SWI instructions when in Thumb state 5 8 2 Communi...

Page 139: ...the R and W bit When the debugger sees that the W bit is set it can read the DCC data write register and scan the data out The action of reading this data register clears the W bit of the DCC control register At this point the communications process can begin again Receiving a message from the debugger Transferring a message from the debugger to the processor is similar to sending a message to the...

Page 140: ...ications control register is to use the COMMTX and COMMRX outputs from the ARM7TDMI processor You can use these outputs to interrupt the processor when a word is available to be read from the DCC data read register the DCC data write register is empty and available for use These outputs are usually connected to the system interrupt controller that drives the nIRQ and nFIQ ARM7TDMI processor inputs...

Page 141: ... EXTERN0 or EXTERN1 User or privileged mode access nTRANS read write access for watchpoints nRW access size watchpoints MAS 1 0 External breakpoints or watchpoints are not supported No support is provided to mix halt mode and monitor mode functionality The fact that an abort has been generated by the monitor mode is recorded in the abort status register in coprocessor 14 see The abort status regis...

Page 143: ...Branch and Exchange on page 6 6 Data operations on page 6 7 Multiply and multiply accumulate on page 6 9 Load register on page 6 12 Store register on page 6 14 Load multiple registers on page 6 15 Store multiple registers on page 6 17 Data swap on page 6 18 Software interrupt and exception entry on page 6 19 Coprocessor data operation on page 6 20 Coprocessor data transfer from memory to coprocess...

Page 144: ...004 ARM Limited All rights reserved ARM DDI 0210C Coprocessor register transfer store to coprocessor on page 6 26 Undefined instructions and coprocessor absent on page 6 27 Unexecuted instructions on page 6 28 Instruction speed summary on page 6 29 ...

Page 145: ...ahead are shown in the cycle to which they apply The address is incremented to prefetch instructions in most cases Because the instruction width is four bytes in ARM state and two bytes in Thumb state the increment varies accordingly The letter L is used to indicate instruction length four bytes in ARM state two bytes in Thumb state The letter i is used to indicate the width of the instruction fet...

Page 146: ...The third cycle performs a fetch from the destination L refilling the instruction pipeline If the instruction is a branch with link R14 is modified four is subtracted from R14 to simplify the return instruction from SUB PC R14 4 to MOV PC R14 This enables subroutines to push R14 onto the stack and pop directly into PC upon completion The cycle timings are listed in Table 6 1 where pc is the addres...

Page 147: ...nal branch destination whilst performing a prefetch from the current PC The second cycle of the second instruction performs a fetch from the branch destination and the return address is stored in R14 The third cycle of the second instruction performs a fetch from the destination 2 refilling the instruction pipeline and R14 is modified with 2 subtracted from it to simplify the return to MOV PC R14 ...

Page 148: ...r 4 dependent on the new specified state refilling the instruction pipeline The cycle timings are listed in Table 6 3 where W and w represent the instruction width before and after the BX respectively The width equals four bytes in ARM state and two bytes in Thumb state For example when changing from ARM to Thumb state W equals four and w equals two I and i represent the memory access size before ...

Page 149: ... data operation occurs on the next cycle which is an internal cycle that does not access memory This internal cycle can be merged with the following sequential access by the memory manager as the address remains stable through both cycles The PC can be one or more of the register operands When it is the destination external bus activity can be affected If the result is written to the PC the conten...

Page 150: ...state Table 6 4 Data operation instruction cycles Operation type Cycle Address MAS 1 0 nRW Data nMREQ SEQ nOPC normal 1 pc 2L i 0 pc 2L 0 1 0 pc 3L dest pc 1 pc 2L i 0 pc 2L 0 0 0 2 alu i 0 alu 0 1 0 3 alu L i 0 alu L 0 1 0 alu 2L shift Rs 1 pc 2L i 0 pc 2L 1 0 0 2 pc 3L i 0 0 1 1 pc 3L shift Rs 1 pc 8 2 0 pc 8 1 0 0 dest pc 2 pc 12 2 0 0 0 1 3 alu 2 0 alu 0 1 0 4 alu 4 2 0 alu 4 0 1 0 alu 8 ...

Page 151: ...ong instruction cycle operations are listed in Table 6 7 on page 6 10 multiply accumulate long instruction cycle operations are listed in Table 6 8 on page 6 10 In Table 6 5 to Table 6 8 on page 6 10 m is the number of cycles required by the multiplication algorithm See Instruction speed summary on page 6 29 Table 6 5 Multiply instruction cycle operations Cycle Address nRW MAS 1 0 Data nMREQ SEQ n...

Page 152: ...0 2 pc 12 0 i 1 0 1 pc 12 0 i 1 0 1 m pc 12 0 i 1 0 1 m 1 pc 12 0 i 1 0 1 m 2 pc 12 0 i 0 1 1 pc 12 Table 6 8 Multiply accumulate long instruction cycle operations Cycle Address nRW MAS 1 0 Data nMREQ SEQ nOPC 1 pc 8 0 2 pc 8 1 0 0 2 pc 8 0 2 1 0 1 pc 12 0 2 1 0 1 m pc 12 0 2 1 0 1 m 1 pc 12 0 2 1 0 1 m 2 pc 12 0 2 1 0 1 m 3 pc 12 0 2 0 1 1 pc 12 Table 6 6 Multiply accumulate instruction cycle ope...

Page 153: ...uction Cycle Timings ARM DDI 0210C Copyright 2001 2004 ARM Limited All rights reserved 6 11 Note The multiply accumulate multiply long and multiply accumulate long operations are not available in Thumb state ...

Page 154: ... PC is affected by the instruction The data fetch can abort and in this case the destination modification is prevented In addition if the processor is configured for early abort the base register write back is also prevented The cycle timings are listed in Table 6 9 where c represents the current processor mode c 0 for User mode c 1 for all other modes d 0 if the T bit has been specified in the in...

Page 155: ...nation is the PC are not available in Thumb state 4 pc 2 0 pc 0 1 0 c 5 pc 4 2 0 pc 4 0 1 0 c pc 8 Table 6 9 Load register instruction cycle operations continued Operation type Cycle Address MAS 1 0 nRW Data nMREQ SEQ nOPC nTRANS Table 6 10 MAS 1 0 signal encoding Bit 1 Bit 0 Data size 0 0 byte 0 1 halfword 1 0 word 1 1 reserved ...

Page 156: ...written to memory There is no third cycle The cycle timings are listed in Table 6 11 where c represents the current processor mode c 0 for User mode c 1 for all other modes d 0 if the T bit has been specified in the instruction such as LDRT and d c at all other times s represents the size of the data transfer shown by MAS 1 0 see Table 6 10 on page 6 13 Table 6 11 Store register instruction cycle ...

Page 157: ...st cycle can be merged with the next instruction prefetch to form a single memory N cycle If an abort occurs the instruction continues to completion but all register modification after the abort is prevented The final cycle is altered to restore the modified base register that could have been overwritten by the load activity before the abort occurred When the PC is in the list of registers to be l...

Page 158: ...lu 2 0 alu 0 1 1 n 1 alu 2 0 alu 1 0 1 n 2 pc 3L i 0 0 1 1 pc 3L n registers n 1 including pc 1 pc 2L i 0 pc 2L 0 0 0 2 alu 2 0 alu 0 1 1 alu 2 0 alu 0 1 1 n alu 2 0 alu 0 1 1 n 1 alu 2 0 pc 1 0 1 n 2 pc 3L i 0 0 0 1 n 3 pc i 0 pc 0 1 0 n 4 pc L i 0 pc L 0 1 0 pc 2L Table 6 12 Load multiple registers instruction cycle operations continued Destination registers Cycle Address MAS 1 0 nRW Data nMREQ ...

Page 159: ... as there is no wholesale overwriting of registers The cycle timings are listed in Table 6 13 where Ra is the first register specified R are the subsequent registers specified Table 6 13 Store multiple registers instruction cycle operations Register Cycle Address MAS 1 0 nRW Data nMREQ SEQ nOPC Single register 1 pc 2L i 0 pc 2L 0 0 0 2 alu 2 1 Ra 0 0 1 pc 3L n registers n 1 1 pc 8 i 0 pc 2L 0 0 0 ...

Page 160: ... that both cycles must be allowed to complete without interruption The data swapped can be a byte or word quantity Halfword quantities cannot be specified The swap operation can be aborted in either the read or write cycle and in both cases the destination register is not affected The cycle timings are listed in Table 6 14 where s represents the size of the data transfer shown by MAS 1 0 see Table...

Page 161: ... only to complete the refilling of the instruction pipeline The cycle timings are listed in Table 6 15 where pc for software interrupts is the address of the SWI instruction Prefetch Aborts is the address of the aborting instruction Data Aborts is the address of the instruction following the one which attempted the aborted data transfer other exceptions is the address of the instruction following ...

Page 162: ...ask it must leave CPA and CPB HIGH If it can do the task but cannot commit right now it must drive CPA LOW but leave CPB HIGH until it can commit The core busy waits until CPB goes LOW The cycle timings are listed in Table 6 16 where b represents the busy cycles Note Coprocessor data operations are not available in Thumb state Table 6 16 Coprocessor data operation instruction cycle operations CP s...

Page 163: ...pends the first cycle and any busy wait cycles generating the transfer address and updates the base address during the transfer cycles The cycle timings are listed in Table 6 17 where b represents the busy cycles n represents the number of registers Table 6 17 Coprocessor data transfer instruction cycle operations CP register status Cycles Address MA S 1 0 nRW Data nMREQ SEQ nOPC nCPI CPA CPB Sing...

Page 164: ...ers 1 pc 8 2 0 pc 8 1 0 0 0 0 1 n 1 2 pc 8 2 0 1 0 1 0 0 1 not ready pc 8 2 0 1 0 1 0 0 1 b pc 8 2 0 0 0 1 0 0 0 b 1 alu 2 0 alu 0 1 1 1 0 0 alu 0 alu 0 1 1 1 0 0 n b alu 2 0 alu 0 1 1 1 0 0 n b 1 alu 2 0 alu 0 0 1 1 1 1 pc 12 Table 6 17 Coprocessor data transfer instruction cycle operations continued CP register status Cycles Address MA S 1 0 nRW Data nMREQ SEQ nOPC nCPI CPA CPB ...

Page 165: ...ble 6 18 coprocessor data transfer instruction cycle operations CP register status Cycle Address MA S 1 0 nRW Data nMREQ SEQ nOPC nCPI CPA CPB Single 1 pc 8 2 0 pc 8 0 0 0 0 0 0 register 2 alu 2 1 CPdata 0 0 1 1 1 1 ready pc 12 Single 1 pc 8 2 0 pc 8 1 0 0 0 0 1 register 2 pc 8 2 0 1 0 1 0 0 1 not ready pc 8 2 0 1 0 1 0 0 1 b pc 8 2 0 0 0 1 0 0 0 b 1 alu 2 1 CPdata 0 0 1 1 1 1 pc 12 n registers 1 ...

Page 166: ... are not available in Thumb state b pc 8 2 0 0 0 1 0 0 0 b 1 alu 2 1 CPdata 0 1 1 1 0 0 alu 2 1 CPdata 0 1 1 1 0 0 n b alu 2 1 CPdata 0 1 1 1 0 0 n b 1 alu 2 1 CPdata 0 0 1 1 1 1 pc 12 Table 6 18 coprocessor data transfer instruction cycle operations continued CP register status Cycle Address MA S 1 0 nRW Data nMREQ SEQ nOPC nCPI CPA CPB ...

Page 167: ...h the next prefetch cycle into one memory N cycle as with all processor register load instructions The cycle timings are listed in Table 6 19 where b represents the busy cycles Note Coprocessor register transfer operations are not available in Thumb state Table 6 19 Coprocessor register transfer load from coprocessor Cycle Address MA S 1 0 nRW Data nMREQ SEQ nOPC nCPI CPA CPB ready 1 pc 8 2 0 pc 8...

Page 168: ...ed The cycle timings are listed in Table 6 20 where b represents the busy cycles Note Coprocessor register transfer operations are not available in Thumb state Table 6 20 Coprocessor register transfer store to coprocessor Cycle Address MA S 1 0 nRW Data nMREQ SEQ nOPC nCPI CPA CPB ready 1 pc 8 2 0 pc 8 1 1 0 0 0 0 2 pc 12 2 1 Rd 0 0 1 1 1 1 pc 12 not ready 1 pc 8 2 0 pc 8 1 0 0 0 0 1 2 pc 8 2 0 1 ...

Page 169: ...ned instruction trap Cycle timings are listed in Table 6 21 where C represents the current mode dependent value T represents the current state dependent value Note Coprocessor instructions are not available in Thumb state CPA and CPB are HIGH during the undefined instruction trap Table 6 21 Undefined instruction cycle operations Cycle Address MA S 1 0 nRW Data nMREQ SEQ nOPC nCPI nTRANS Mode TBI T...

Page 170: ...uted instructions Any instruction whose condition code is not met does not execute and adds one cycle to the execution time of the code segment in which it is embedded see Table 6 22 Table 6 22 Unexecuted instruction cycle operations Cycle Address MAS 1 0 nRW Data nMREQ SEQ nOPC 1 pc 2L i 0 pc 2L 0 1 0 pc 3L ...

Page 171: ... These figures assume that the instruction is actually executed Unexecuted instructions take one cycle If the condition is not met then all instructions take one S cycle The cycle types N S I and C are described in Bus cycle types on page 3 4 In Table 6 23 b is the number of cycles spent in the coprocessor busy wait loop m is 1 if bits 31 8 of the multiplier operand are all zero or one else 2 if b...

Page 172: ...ight 2001 2004 ARM Limited All rights reserved ARM DDI 0210C MLA S m 1 I MULL S m 1 I MLAL S m 2 I CDP S bI LDC STC n 1 S 2N bI MCR N bI C MRC S b 1 I C Table 6 23 ARM instruction speed summary continued Instruction Cycle count Additional ...

Page 173: ... All rights reserved 7 1 Chapter 7 AC and DC Parameters This chapter gives the AC timing parameters of the ARM7TDMI core It contains the following sections Timing diagrams on page 7 2 Notes on AC parameters on page 7 20 DC parameters on page 7 26 ...

Page 174: ...e 7 10 Exception timing on page 7 11 Synchronous interrupt timing on page 7 12 Debug timing on page 7 12 DCC output timing on page 7 13 Breakpoint timing on page 7 14 TCK and ECLK relationship on page 7 14 MCLK timing on page 7 15 Scan general timing on page 7 16 Reset period timing on page 7 17 Output enable and disable times due to HIGHZ TAP instruction on page 7 17 Output enable and disable tim...

Page 175: ...In Figure 7 1 nWAIT APE ALE and ABE are all HIGH during the cycle shown Tcdel is the delay on either edge whichever is greater from the edge of MCLK to ECLK Tcdel Tcdel MCLK ECLK Tah Taddr Trwd Trwh Tblh Tbld Tmdd Tmdh Topch Topcd nRW MAS 1 0 LOCK nM 4 0 nTRANS TBIT nOPC A 31 0 Tmsh Tmsd Texh Texd nMREQ SEQ nEXEC INSTRVALID ...

Page 176: ... and LOCK Maximum Tblh MAS 1 0 and LOCK hold from MCLKr Minimum Tcdel MCLK to ECLK delay Maximum Texd MCLKf to nEXEC and INSTRVALID valid Maximum Texh nEXEC and INSTRVALID hold time from MCLKf Minimum Tmdd MCLKr to nTRANS nM 4 0 and TBIT valid Maximum Tmdh nTRANS and nM 4 0 hold time from MCLKr Minimum Tmsd MCLKf to nMREQ and SEQ valid Maximum Tmsh nMREQ and SEQ hold time from MCLKf Minimum Topcd ...

Page 177: ...in Table 7 2 Figure 7 3 Bidirectional data write cycle Note In Figure 7 3 DBE is HIGH and nENIN is LOW during the cycle shown MCLK ABE A 31 0 nRW LOCK nOPC nTRANS MAS 1 0 Tabz Tabe Table 7 2 ABE address control timing parameters Symbol Parameter Parameter type Tabe Address bus enable time Maximum Tabz Address bus disable time Maximum MCLK nENOUT D 31 0 Tnen Tdout Tnenh Tdoh ...

Page 178: ...al data write cycle timing parameters Symbol Parameter Parameter type Tdoh DOUT 31 0 hold from MCLKf Minimum Tdout MCLKf to D 31 0 valid Maximum Tnen MCLKf to nENOUT valid Maximum Tnenh nENOUT hold time from MCLKf Minimum MCLK nENOUT D 31 0 Tnen Tdis BL 3 0 Tbylh Tbyls Tdih Table 7 4 Bidirectional data read cycle timing parameters Symbol Parameter Parameter type Tbylh BL 3 0 hold time from MCLKf M...

Page 179: ...fy the behavior of the data bus and then nENIN The timing parameters used in Figure 7 5 are listed in Table 7 5 Tdbz nENOUT DBE Tdbnen D 31 0 Tdout Tdbe Tdbnen Tdoh nENIN Tdbz Tdbe MCLK Table 7 5 Data bus control timing parameters Symbol Parameter Parameter type Tdbe Data bus enable time from DBEr Maximum Tdbnen DBE to nENOUT valid Maximum Tdbz Data bus disable time from DBEf Maximum Tdoh DOUT 31 ...

Page 180: ...TBE A 31 0 D 31 0 nRW LOCK nOPC nTRANS MAS 1 0 Ttbz Ttbe Table 7 6 Output 3 state time timing parameters Symbol Parameter Parameter type Ttbe Address and Data bus enable time from TBEr Maximum Ttbz Address and Data bus disable time from TBEf Maximum MCLK nENOUT DOUT 31 0 Tdohu Tdoutu Tnen Table 7 7 Unidirectional data write cycle timing parameters Symbol Parameter Parameter type Tdohu DOUT 31 0 ho...

Page 181: ...figuration pin timing MCLK nENOUT DIN 31 0 Tnen Tdisu BL 3 0 Tbylh Tbyls Tdihu Table 7 8 Unidirectional data read cycle timing parameters Symbol Parameter Parameter type Tbylh BL 3 0 hold time from MCLKf Minimum Tbyls BL 3 0 set up to from MCLKr Minimum Tdihu DIN 31 0 hold time from MCLKf Minimum Tdisu DIN 31 0 set up time to MCLKf Minimum Tnen MCLKf to nENOUT valid Maximum Tcth Tcts Tcts Tcth MCL...

Page 182: ...Most systems can generate CPA and CPB during the previous phase 2 and so the timing of nMREQ and SEQ is always Tmsd The timing parameters used in Figure 7 10 are listed in Table 7 10 Table 7 9 Configuration pin timing parameters Symbol Parameter Parameter type Tcth Configurations hold time Minimum Tcts Configuration setup time Minimum Tcps Tcpi Phase 2 Tcph Tcpih MCLK nCPI CPA CPB nMREQ SEQ Tcpms ...

Page 183: ... fully asynchronously where the exact cycle of recognition is unimportant The timing parameters used in Figure 7 11 are listed in Table 7 11 Tim Tabth Trs Tabts Tis Trm MCLK ABORT nFIQ nIRQ nRESET Table 7 11 Exception timing parameters Symbol Parameter Parameter type Tabth ABORT hold time from MCLKf Minimum Tabts ABORT set up time to MCLKf Minimum Tim Asynchronous interrupt guaranteed nonrecogniti...

Page 184: ...ble 7 12 Figure 7 13 Debug timing Tsih MCLK Tsis nFIQ nIRQ Table 7 12 Synchronous interrupt timing parameters Symbol Parameter Parameter type Tsih Synchronous nFIQ nIRQ hold from MCLKf with ISYNC 1 Minimum Tsis Synchronous nFIQ nIRQ setup to MCLKf with ISYNC 1 Minimum Trgh Tdbgrq Tbrkh Tbrks Tdbgh Tdbgd Trqs Trqh Texts Texth MCLK DBGACK BREAKPT DBGRQ EXTERN 1 DBGRQI RANGEOUT0 RANGEOUT1 Trg ...

Page 185: ...e of BREAKPT to MCLKr Minimum Tdbgd MCLKr to DBGACK valid Maximum Tdbgh DGBACK hold time from MCLKr Minimum Tdbgrq DBGRQ to DBGRQI valid Maximum Texth EXTERN 1 0 hold time from MCLKf Minimum Texts EXTERN 1 0 set up time to MCLKf Minimum Trg MCLKf to RANGEOUT0 RANGEOUT1 valid Maximum Trgh RANGEOUT0 RANGEOUT1 hold time from MCLKf Minimum Trqh DBGRQ guaranteed non recognition time Minimum Trqs DBGRQ ...

Page 186: ...REQ and SEQ in the same phase The timing parameter used in Figure 7 15 is listed in Table 7 15 Figure 7 16 TCK and ECLK relationship Note In Figure 7 16 Tctdel is the delay on either edge whichever is greater from the edge of TCK to ECLK Tbcems MCLK BREAKPT nCPI nEXEC nMREQ SEQ INSTRVALID Table 7 15 Breakpoint timing parameters Symbol Parameter Parameter type Tbcems BREAKPT to nCPI nEXEC nMREQ SEQ...

Page 187: ... MCLK Phase 2 is shown for reference This is the internal clock from which the core times all its activity This signal is included to show how the HIGH phase of the external MCLK has been removed from the internal core clock The timing parameters used in Figure 7 17 are listed in Table 7 17 Table 7 16 TCK and ECLK timing parameters Symbol Parameter Parameter type Tctdel TCK to ECLK delay Maximum T...

Page 188: ...Table 7 17 MCLK timing parameters continued Symbol Parameter Parameter type Tbsss Tbssh Tbsod Tbsih Tbsis Tbscl Tbsch Tbsoh Tbsdh Tbsdd Tbsdh Tbsdd TCK TMS TDI TDO Data in Data out Table 7 18 Scan general timing parameters Symbol Parameter Parameter type Tbsch TCK high period Minimum Tbscl TCK low period Minimum Tbsdd TCK to data output valid Maximum Tbsdh Data output hold time from TCK Minimum Tb...

Page 189: ...TCKf Minimum Tbssh I O signal setup from TCKr Minimum Tbsss I O signal setup to TCKr Minimum Table 7 18 Scan general timing parameters continued Symbol Parameter Parameter type Tbsr nTRST Trstl nRESET Trstd D 31 0 DBGACK nCPI nENOUT nEXEC nMREQ SEQ Table 7 19 Reset period timing parameters Symbol Parameter Parameter type Tbsr nTRST reset period Minimum Trstd nRESETf to D 31 0 DBGACK nCPI nENOUT nE...

Page 190: ...nd disable times due to data scanning Note Figure 7 21 shows the Tbse output enable time parameter and Tbsz output disable time when data scanning due to different logic levels being scanned through the scan cells for ABE and DBE The timing parameters used in Figure 7 21 are listed in Table 7 20 Figure 7 22 ALE address control Tbsz Tbse TCK A D Table 7 20 Output enable and disable timing parameter...

Page 191: ...ntrol The timing parameters used in Figure 7 23 are listed in Table 7 22 Table 7 21 ALE address control timing parameters Symbol Parameter Parameter type Tald Address group latch output time Maximum Tale Address group latch open output delay Maximum Taleh Address group latch output hold time Minimum MCLK Taph A 31 0 nRW LOCK nOPC nTRANS MAS 1 0 Taps APE Tape Tapeh Table 7 22 APE address control ti...

Page 192: ...7 2 on page 7 5 Taddr MCLKr to address valid Maximum Figure 7 1 on page 7 3Figure 7 17 on page 7 15 Tah Address hold time from MCLKr Minimum Figure 7 1 on page 7 3 Tald Address group latch time Maximum Figure 7 22 on page 7 18 Tale Address group latch open output delay Maximum Figure 7 22 on page 7 18 Taleh Address group latch output hold time Minimum Figure 7 22 on page 7 18 Tape MCLKf to address...

Page 193: ...valid Maximum Figure 7 18 on page 7 16 Tbsoh TDO hold time from TCKf Minimum Figure 7 18 on page 7 16 Tbsr nTRST reset period Minimum Figure 7 19 on page 7 17 Tbssh I O signal setup from TCKr Minimum Figure 7 18 on page 7 16 Tbsss I O signal setup to TCKr Minimum Figure 7 18 on page 7 16 Tbsz Output disable time Maximum Figure 7 20 on page 7 17Figure 7 21 on page 7 18 Tbylh BL 3 0 hold time from M...

Page 194: ...MCLKr Minimum Figure 7 13 on page 7 12 Tdbgrq DBGRQ to DBGRQI valid Maximum Figure 7 13 on page 7 12 Tdbnen DBE to nENOUT valid Maximum Figure 7 5 on page 7 7 Tdbz Data bus disable time from DBEf Maximum Figure 7 5 on page 7 7 Tdckf DCLK induced TCKf to various outputs valid Maximum Tdckfh DCLK induced various outputs hold from TCKf Minimum Tdckr DCLK induced TCKr to various outputs valid Maximum ...

Page 195: ...me with ISYNC 0 Maximum Figure 7 11 on page 7 11 Tis Asynchronous interrupt set up time to MCLKf for guaranteed recognition with ISYNC 0 Minimum Figure 7 11 on page 7 11 Tmckh MCLK HIGH time Minimum Figure 7 17 on page 7 15 Tmckl MCLK LOW time Minimum Figure 7 17 on page 7 15 Tmdd MCLKr to nTRANS nM 4 0 and TBIT valid Maximum Figure 7 1 on page 7 3 Tmdh nTRANS and nM 4 0 hold time from MCLKr Minim...

Page 196: ...d Maximum Figure 7 19 on page 7 17 Trstl nRESET LOW for guaranteed reset Minimum Figure 7 19 on page 7 17 Trwd MCLKr to nRW valid Maximum Figure 7 1 on page 7 3 Trwh nRW hold time from MCLKr Minimum Figure 7 1 on page 7 3 Tsdtd SDOUTBS to TDO valid Maximum Tshbsf TCK to SHCLKBS SHCLK2BS falling Maximum Tshbsr TCK to SHCLKBS SHCLK2BS rising Maximum Tsih Synchronous nFIQ nIRQ hold from MCLKf with IS...

Page 197: ...ts hold time from TCKr Minimum Ttrstd nTRSTf to every output valid Maximum Ttrstd nTRSTf to TAP outputs valid Maximum Ttrsts nTRSTr setup to TCKr Maximum Twh nWAIT hold from MCLKf Minimum Figure 7 17 on page 7 15 Tws nWAIT setup to MCLKr Minimum Figure 7 17 on page 7 15 Table 7 23 AC timing parameters used in this chapter continued Symbol Parameter Parameter type Figure cross reference ...

Page 198: ...AC and DC Parameters 7 26 Copyright 2001 2004 ARM Limited All rights reserved ARM DDI 0210C 7 3 DC parameters Contact your supplier for information on operating conditions maximum ratings ...

Page 199: ...erved A 1 Appendix A Signal and Transistor Descriptions This appendix describes the signals and transistors in the ARM7TDMI processor It contains the following sections Transistor dimensions on page A 2 Signal types on page A 3 Transistor dimensions on page A 2 ...

Page 200: ...ghts reserved ARM DDI 0210C A 1 Transistor dimensions Table A 1 shows the dimensions of the output driver for a 0 18µm ARM7TDMI r4p1 processor Table A 1 Transistor gate dimensions of the output driver for a 0 18µm process MOSFET type Width Length P 16 2µm 0 18µm N 8 28µm 0 18µm ...

Page 201: ...ARM DDI 0210C Copyright 2001 2004 ARM Limited All rights reserved A 3 A 2 Signal types Table A 2 lists the signal types used in the ARM7TDMI r4p1 processor Table A 2 Signal types Type Description IC Input CMOS thresholds P Power O Output ...

Page 202: ...onnected HIGH The address bus LOCK MAS 1 0 nRW nOPC and nTRANS signals are latched when this is held LOW This enables these address signals to be held valid for the complete duration of a memory access cycle For example when interfacing to ROM the address must be valid until after the data has been read APE Address pipeline enable IC Selects whether the address bus LOCK MAS 1 0 nRW nTRANS and nOPC...

Page 203: ...tic configuration signal that selects whether the bidirectional data bus D 31 0 or the unidirectional data busses DIN 31 0 and DOUT 31 0 are used for transfer of data between the processor and memory When BUSEN is LOW D 31 0 is used DOUT 31 0 is driven to a value of zero and DIN 31 0 is ignored and must be tied LOW When BUSEN is HIGH DIN 31 0 and DOUT 31 0 are used D 31 0 is ignored and must be le...

Page 204: ...shared bus systems DBGACK Debug acknowledge O When the processor is in a debug state this is HIGH DBGEN Debug enable IC A static configuration signal that disables the debug features of the processor when held LOW This signal must be HIGH to enable the EmbeddedICE RT logic to function DBGRQ Debug request IC This is a level sensitive input that when HIGH causes ARM7TDMI core to enter debug state af...

Page 205: ...e TAP controller state machine is in the CAPTURE DR state then this signal is a pulse equal in width to TCK2 This must be left unconnected if an external boundary scan chain is not connected ECLK External clock output O In normal operation this is simply MCLK optionally stretched with nWAIT exported from the core When the core is being debugged this is DCLK which is generated internally from TCK E...

Page 206: ... required for both read and write cycles become valid before the falling edge of MCLK and remain valid until the rising edge of MCLK during the memory cycle The binary values 00 01 and 10 represent byte halfword and word respectively 11 is reserved This is one of the signals controlled by APE ALE and ABE MCLK Memory clock input IC This is the main clock for all memory accesses and processor operat...

Page 207: ...ignal is level sensitive and must be held LOW until a suitable response is received from the processor nFIQ can be synchronous or asynchronous to MCLK depending on the state of ISYNC nHIGHZ Not HIGHZ O When the current instruction is HIGHZ this signal is LOW This is used to place the scan cells of that scan chain in the high impedance state This must be left unconnected if an external boundary sca...

Page 208: ...the memory management system when address translation is turned on or as an indicator of non User mode activity This is one of the signals controlled by APE ALE and ABE nTRST Not test reset IC Reset signal for the boundary scan logic This pin must be pulsed or driven LOW to achieve normal device operation in addition to the normal device reset nRESET See Chapter 5 Debug Interface nWAIT Not wait IC...

Page 209: ...f an external boundary scan chain is not connected SEQ Sequential address O When the address of the next memory cycle is closely related to that of the last memory access this is HIGH In ARM state the new address can be for the same word or the next In THUMB state the same halfword or the next It can be used in combination with the low order address lines to indicate that the next cycle can use a ...

Page 210: ...M instruction set This signal changes in phase two in the first execute cycle of a BX instruction TCK IC Clock signal for all test circuitry When in debug state this is used to generate DCLK TCK1 and TCK2 TCK1 TCK phase one O HIGH when TCK is HIGH slight phase lag because of the internal clock non overlap TCK2 TCK phase two O HIGH when TCK is LOW slight phase lag because of the internal clock non ...

Page 211: ...TAP controller on page B 6 Pullup resistors on page B 7 Instruction register on page B 8 Public instructions on page B 9 Test data registers on page B 14 The ARM7TDMI core clocks on page B 22 Determining the core and system state in debug state on page B 24 Behavior of the program counter in debug state on page B 30 Priorities and exceptions on page B 33 Scan chain cell data on page B 35 The watch...

Page 212: ...M Limited All rights reserved ARM DDI 0210C The debug status register on page B 54 The abort status register on page B 56 Coupling breakpoints and watchpoints on page B 57 EmbeddedICE RT timing on page B 59 Programming restriction on page B 60 ...

Page 213: ...B 20 Two additional scan chains exist numbered four and eight but these are reserved for ARM use only See Table B 2 on page B 16 for a summary of scan chain number allocation The following sections describe Scan chain implementation TAP state machine on page B 5 B 1 1 Scan chain implementation A JTAG style Test Access Port TAP controller controls the scan chains For further details of the JTAG spe...

Page 214: ... bits 0 to 31 2 The core control signals 3 Address bus bits 31 to 0 4 EmbeddedICE RT control signals The EmbeddedICE RT control signals specifically DBGRQI are scanned out first Scan chain 1 Scan chain 1 is a subset of scan chain 0 and BREAKPT It provides serial access to the core data bus D 31 0 and the BREAKPT signal There are 33 bits in this scan chain the order from serial data in to serial da...

Page 215: ...occur in the TAP controller Figure B 2 Test access port controller state transitions From IEEE Std 1149 1 1990 Copyright 1999 IEEE All rights reserved Test Logic Reset 0xF Run Test Idle 0xC Select DR Scan 0x7 Capture DR 0x6 Capture IR 0xE Shift DR 0x2 Shift IR 0xA Exit1 DR 0x1 Exit1 IR 0x9 Pause DR 0x3 Pause IR 0xB Exit2 DR 0x0 Exit2 IR 0x8 Update DR 0x5 Update IR 0xD Select IR Scan 0x4 tms 1 tms ...

Page 216: ... TCK is not necessary to reset the device The nTRST signal 1 Selects system mode This means that the boundary scan cells do not intercept any of the signals passing between the external system and the core 2 Selects the IDCODE instruction When the TAP controller is put into the SHIFT DR state and TCK is pulsed the contents of the ID register are clocked out of TDO 3 Sets the TAP controller state m...

Page 217: ...standard implies that nTRST TDI and TMS must have internal pullup resistors To minimize static current draw these resistors are not fitted to the ARM7TDMI core Accordingly the four inputs to the test interface the nTRST TDI and TMS signal plus TCK must all be driven to good logic levels to achieve normal circuit operation ...

Page 218: ...C B 4 Instruction register The instruction register is 4 bits in length There is no parity bit The fixed value b0001 is loaded into the instruction register during the CAPTURE IR controller state The least significant bit of the instruction register is scanned in and scanned out first ...

Page 219: ...AN_N b0010 on page B 10 SAMPLE PRELOAD b0011 on page B 10 RESTART b0100 on page B 10 CLAMP b0101 on page B 11 HIGHZ b0111 on page B 11 CLAMPZ b1001 on page B 11 INTEST b1100 on page B 12 IDCODE b1110 on page B 12 BYPASS b1111 on page B 12 B 5 1 EXTEST b0000 The selected scan chain is placed in test mode by the EXTEST instruction Table B 1 Public instructions Instruction Binary Hexadecimal EXTEST b...

Page 220: ...IFT DR state the ID number of the desired scan path is shifted into the scan path select register In the UPDATE DR state the scan register of the selected scan chain is connected between TDI and TDO and remains connected until a subsequent SCAN_N instruction is issued On reset scan chain 3 is selected by default The scan path select register is 4 bits long in this implementation although no finite...

Page 221: ...W nOPC LOCK MAS 1 0 and nTRANS are all driven to the high impedance state and the external HIGHZ signal is driven HIGH This is as if the signal TBE had been driven LOW In the CAPTURE DR state a 0 is captured by the bypass register In the SHIFT DR state test data is shifted into the bypass register using TDI and out using TDO after a delay of one TCK cycle The first bit shifted out is a 0 In the UP...

Page 222: ...using the INTEST instruction B 5 9 IDCODE b1110 The IDCODE instruction connects the device identification code register or ID register between TDI and TDO The register is a 32 bit register that enables the manufacturer part number and version of a component to be read through the TAP See ARM7TDMI core device IDentification ID code register on page B 14 for details of the ID register format When th...

Page 223: ...a 0 is captured the bypass register In the SHIFT DR state test data is shifted into the bypass register through TDI and shifted out through TDO after a delay of one TCK cycle The first bit to shift out is a 0 In the UPDATE DR state the bypass register is not affected All unused instruction codes default to the BYPASS instruction Note BYPASS does not enable the processor to exit debug state or sync...

Page 224: ... and TDO Length 1 bit Operating mode When the BYPASS instruction is the current instruction in the instruction register serial data is transferred from TDI to TDO in the SHIFT DR state with a delay of one TCK cycle There is no parallel output from the bypass register A 0 is loaded from the parallel input of the bypass register in the CAPTURE DR state B 6 2 ARM7TDMI core device IDentification ID co...

Page 225: ...value in the instruction register becomes the current instruction During the CAPTURE IR state b0001 is loaded into this register This value is shifted out during SHIFT IR On reset IDCODE becomes the current instruction The least significant bit of the register is scanned in and out first B 6 4 Scan path select register Purpose Changes the current active scan chain Length 4 bits Operating mode SCAN...

Page 226: ...TAP controller on the SDOUTBS input The scan chain present between SDINBS and SDOUTBS is connected between TDI and TDO whenever scan chain 3 is selected or when any of the unassigned scan chain numbers is selected If there is more than one external scan chain a multiplexor must be built externally to apply the desired scan chain output to SDOUTBS The multiplexor can be controlled by decoding SCREG...

Page 227: ...r the contents of the serial register and this is controlled by the multiplexor For output cells see Figure B 4 the capture stage involves placing the output value of a core into the serial shift register During shift this value is output serially The value applied to the system from an output cell is either the core output or the contents of the serial register Figure B 4 Output scan cell All the...

Page 228: ...he TAP controller must be placed in INTEST mode after scan chain 0 has been selected During CAPTURE DR the current outputs from the core logic are captured in the output cells During SHIFT DR this captured data is shifted out while a new serial test pattern is scanned in therefore applying known stimuli to the inputs During RUN TEST IDLE the core is clocked Usually the TAP controller only spends o...

Page 229: ...the BREAKPT input from the system can be captured 3 While debugging the value placed in the 33rd bit determines if the ARM7TDMI core synchronizes back to system speed before executing the instruction See System speed access on page B 32 for further details 4 After the ARM7TDMI core has entered debug state the first time this bit is captured and scanned out its value tells the debugger if the core ...

Page 230: ...aged device The following control signals are provided which are generated only when scan chain 3 has been selected These outputs are inactive at all other times DRIVEBS This is used to switch the scan cells from system mode to test mode This signal is asserted whenever either the INTEST EXTEST CLAMP or CLAMPZ instruction is selected PCLKBS This is an update clock generated in the UPDATE DR state ...

Page 231: ...truction is loaded into the instruction register and HIGH at all other times RSTCLKBS This signal is active when the TAP controller state machine is in the RESET TEST LOGIC state It can be used to reset any additional scan cells In addition to these control outputs SDINBS output and SDOUTBS input are also provided When an external scan chain is in use SDOUTBS must be connected to the serial data o...

Page 232: ... core continues to be clocked by MCLK and DCLK is not used B 7 1 Clock switch during debug When the ARM7TDMI core enters halt mode it must switch from MCLK to DCLK This is handled automatically by logic in the ARM7TDMI core On entry to debug state the core asserts DBGACK in the HIGH phase of MCLK The switch between the two clocks occurs on the next falling edge of MCLK This is shown in Figure B 5 ...

Page 233: ... core must be clocked using DCLK Entry into test is less automatic than debug and some care must be taken On the way into test MCLK must be held LOW The TAP controller can now be used to serially test the ARM7TDMI core If scan chain 0 and INTEST are selected DCLK is generated while the state machine is in the RUN TEST IDLE state During EXTEST DCLK is not generated On exit from test RESTART must be...

Page 234: ...nto ARM state The debugger can then repeat the same sequence of instructions to determine the processor state To force the processor into ARM state while in debug execute the following sequence of Thumb instructions on the core STR R0 R0 Save R0 before use MOV R0 PC Copy PC into R0 STR R0 R0 Now save the PC in R0 BX PC Jump into ARM state MOV R8 R8 NOP MOV R8 R8 NOP Note Because all Thumb instruct...

Page 235: ...e the instruction sequence can be as listed in Example B 2 Example B 2 Determining the state of the User and FIQ mode registers STM R0 R0 R15 Save current registers MRS R0 CPSR STR R0 R0 Save CPSR to determine current mode BIC R0 0x1F Clear mode bits ORR R0 0x10 Select user mode MSR CPSR R0 Enter USER mode STM R0 R13 R14 Save register not previously visible ORR R0 0x01 Select FIQ mode MSR CPSR R0 ...

Page 236: ...tem clock 2 It executes the instruction at system speed 3 It re enters debug state 4 It switches itself back to the internally generated DCLK When the instruction has completed DBGACK is HIGH and the core is switched back to DCLK At this point INTEST can be selected in the TAP controller and debugging can resume To determine that a system speed instruction has completed the debugger must look at b...

Page 237: ...ug state on page B 30 for a description of how to calculate the branch 3 The ARM7TDMI core synchronizes back to MCLK Bit 33 of scan chain 1 is used to force the ARM7TDMI core to resynchronize back to MCLK as follows 1 The penultimate instruction of the debug sequence is scanned in with bit 33 set HIGH 2 The final instruction of the debug sequence is the branch and this is scanned in with bit 33 LO...

Page 238: ...causes extra memory accesses You can use DBGACK to inhibit any system peripheral that is sensitive to the number of memory accesses performed as shown in Example B 3 Example B 3 Using DBGACK to mask out memory accesses Consider a peripheral that counts the number of memory cycles This cycle counter must return the same count whether a program is run with or without debugging Figure B 6 shows the b...

Page 239: ...debug state occurs the core temporarily drops out of debug state so DBGACK might go LOW If there are peripherals that are sensitive to the number of memory accesses they must be forced to behave as though the core is still in debug state By programming the EmbeddedICE RT macrocell control register DBGACK can be forced HIGH ...

Page 240: ... address For example if the ARM7TDMI core entered debug state from a breakpoint set on a given address and two debug speed instructions were executed a branch of minus seven addresses must occur four for debug entry two for the instructions one for the final branch The following sequence shows the data scanned into scan chain 1 most significant bit first The value of the first digit goes to the BR...

Page 241: ...n exception has occurred causes the PC to be incremented by three instructions rather than four and this must be considered in the return branch calculation when exiting debug state For example suppose that an abort occurs on a watchpointed access and ten instructions have been executed to determine this eventuality You can use the following sequence to return to program execution 0 E1A00000 MOV R...

Page 242: ... fix because the abort was not caused by an instruction in the main program and so the PC does not point to the instruction that caused the abort An abort handler usually looks at the PC to determine the instruction that caused the abort and also the abort address In this case the value of the PC is invalid but because the debugger can determine which location was being accessed the debugger can b...

Page 243: ...to return to the previously invalid address This time when the instruction is fetched and providing the breakpoint is activated it can be data dependent the ARM7TDMI core enters debug state The Prefetch Abort therefore takes higher priority than the breakpoint B 10 2 Interrupts When the ARM7TDMI core enters halt debug state interrupts are automatically disabled If an interrupt is pending during th...

Page 244: ...ts reserved ARM DDI 0210C B 10 3 Data Aborts When a Data Abort occurs on a watchpointed access the ARM7TDMI core enters debug state in abort mode The watchpoint therefore has higher priority than the abort but the ARM7TDMI core remembers that the abort happened ...

Page 245: ...hain 0 cells as listed in Table B 3 Table B 3 Scan chain 0 cells Number Signal Type 1 D 0 Input output 2 D 1 Input output 3 D 2 Input output 4 D 3 Input output 5 D 4 Input output 6 D 5 Input output 7 D 6 Input output 8 D 7 Input output 9 D 8 Input output 10 D 9 Input output 11 D 10 Input output 12 D 11 Input output 13 D 12 Input output 14 D 13 Input output 15 D 14 Input output 16 D 15 Input output...

Page 246: ...24 Input output 26 D 25 Input output 27 D 26 Input output 28 D 27 Input output 29 D 28 Input output 30 D 29 Input output 31 D 30 Input output 32 D 31 Input output 33 nENIN Input 34 nENOUT Output 35 LOCK Output 36 BIGEND Input 37 DBE Input 38 MAS 0 Output 49 MAS 1 Output 40 BL 0 Input 41 BL 1 Input 42 BL 2 Input 43 BL 3 Input 44 nRW Output Table B 3 Scan chain 0 cells continued Number Signal Type ...

Page 247: ... 50 nOPC Output 51 nCPI Output 52 nMREQ Output 53 SEQ Output 54 nTRANS Output 55 nM 4 Output 56 nM 3 Output 57 nM 2 Output 58 nM 1 Output 59 nM 0 Output 60 nEXEC Output 61 INSTRVALID Output 62 ALE Input 63 ABE Input 64 APE Input 65 TBIT Output 66 nWAIT Input 67 A 31 Output 68 A 30 Output 69 A 29 Output Table B 3 Scan chain 0 cells continued Number Signal Type ...

Page 248: ...utput 75 A 23 Output 76 A 22 Output 77 A 21 Output 78 A 20 Output 79 A 19 Output 80 A 18 Output 81 A 17 Output 82 A 16 Output 83 A 15 Output 84 A 14 Output 85 A 13 Output 86 A 12 Output 87 A 11 Output 88 A 10 Output 89 A 9 Output 90 A 8 Output 91 A 7 Output 92 A 6 Output 93 A 5 Output 94 A 4 Output Table B 3 Scan chain 0 cells continued Number Signal Type ...

Page 249: ... A 0 Output 99 DBGRQ Input 100 DBGEN Input 101 CPA Input 102 CPB Input 103 BUSEN Input 104 EXTERN0 Input 105 EXTERN1 Input 106 BREAKPT Input 107 DBGACK Output 108 RANGEOUT0 Output 109 RANGEOUT1 Output 110 nENOUT1 Output 111 COMMTX Output 112 COMMRX Output 113 DBGRQI Output Table B 3 Scan chain 0 cells continued Number Signal Type ...

Page 250: ...output 2 D 1 Input output 3 D 2 Input output 4 D 3 Input output 5 D 4 Input output 6 D 5 Input output 7 D 6 Input output 8 D 7 Input output 9 D 8 Input output 10 D 9 Input output 11 D 10 Input output 12 D 11 Input output 13 D 12 Input output 14 D 13 Input output 15 D 14 Input output 16 D 15 Input output 17 D 16 Input output 18 D 17 Input output 19 D 18 Input output 20 D 19 Input output 21 D 20 Inp...

Page 251: ...served B 41 24 D 23 Input output 25 D 24 Input output 26 D 25 Input output 27 D 26 Input output 28 D 27 Input output 29 D 28 Input output 30 D 29 Input output 31 D 30 Input output 32 D 31 Input output 33 BREAKPT Input Table B 4 Scan chain 1 cells continued Number Signal Type ...

Page 252: ...e B 5 Table B 5 Function and mapping of EmbeddedICE RT registers Address Width Function 00000 6 Debug control 00001 5 Debug status 00010 1 Abort status 00100 6 Debug comms control register 00101 32 Debug comms data register 01000 32 Watchpoint 0 address value 01001 32 Watchpoint 0 address mask 01010 32 Watchpoint 0 data value 01011 32 Watchpoint 0 data mask 01100 9 Watchpoint 0 control value 01101...

Page 253: ...bit data field a 5 bit address field for watchpoint register writes a read write bit This setup is shown in Figure B 7 Figure B 7 EmbeddedICE RT block diagram The data to be written is shifted into the 32 bit data field The address of the register is shifted into the 5 bit address field The read write bit is set Read write 0 4 31 0 Data Scan chain register Address Address decoder TDI TDO Value Mas...

Page 254: ...g the mask registers For each value register in a register pair there is a mask register of the same format If a bit is set in the mask register the same bit in the corresponding value register is disregarded during a comparison For example when a watchpoint is required on a particular memory location but the data value is irrelevant you can program the data mask register to 0xFFFFFFFF Setting all...

Page 255: ...ata access with nOPC 1 nTRANS Compares against the not translate signal from the core to distinguish between User Mode with nTRANS 0 and non user mode with nTRANS 1 accesses EXTERN 1 0 Is an external input to EmbeddedICE RT that enables the watchpoint to be dependent upon some external condition The EXTERN input for Watchpoint 0 is labeled EXTERN0 The EXTERN input for Watchpoint 1 is labeled EXTER...

Page 256: ...s LOW RANGE Can be referred to another watchpoint unit In the ARM7TDMI core EmbeddedICE RT logic the RANGEOUT output of Watchpoint 1 is referred to the RANGE input of Watchpoint 0 This enables the two watchpoints to be coupled for detecting conditions that occur simultaneously such as range checking ENABLE When a watchpoint match occurs the internal BREAKPT signal is asserted only when the ENABLE ...

Page 257: ...ction fetches 1 Program its address value register with the address of the instruction to be breakpointed 2 For an ARM state breakpoint program bits 1 0 of the address mask register to b11 For a breakpoint in Thumb state program bits 1 0 of the address mask register to b01 3 Program the data value register if you require a data dependent breakpoint A data dependent breakpoint is one that matches t...

Page 258: ... 0xDEEE program 0xDEEEDEEE When a 16 bit instruction is fetched EmbeddedICE RT compares only the valid half of the data bus against the contents of the data value register In this way you can use a single watchpoint register to catch software breakpoints on both the upper and lower halves of the data bus 3 Program the data mask register to 0x00000000 4 Program the control value register with nOPC ...

Page 259: ...Debug in Depth ARM DDI 0210C Copyright 2001 2004 ARM Limited All rights reserved B 49 Clearing the breakpoint To clear the software breakpoint restore the instruction to the address ...

Page 260: ...he control value register as follows nOPC 1 nRW 0 for a read or nRW 1 for a write program MAS 1 0 with the value corresponding to the appropriate data size 5 Program the control mask register as follows nOPC 0 nRW 0 MAS 1 0 0 all other bits set You can set nRW or MAS 1 0 when both reads and writes or data size accesses are to be watchpointed respectively 6 If you wish to make the distinction betwe...

Page 261: ... breakpoint registers are being programmed This bit can be read and written through JTAG Set bit 5 when programming breakpoint or watchpoint registers changing bit 4 of the debug control register You must clear bit 5 after you have made the changes to re enable the EmbeddedICE RT logic Bit 5 is writable when the core is synchronized to MCLK when it is safe to mask the comparator outputs and readab...

Page 262: ...uring debugging DBGACK HIGH when the INTDIS bit is HIGH The IFEN signal is driven as shown in Table B 8 B 15 3 Forcing DBGRQ Figure B 11 on page B 55 shows that the value stored in bit 1 of the debug control register is synchronized and then ORed with the external DBGRQ before being applied to the processor The output of this OR gate is the signal DBGRQI which is brought out externally from the ma...

Page 263: ...m the core is ORed with the value held in bit 0 of the debug control register to generate the external value of DBGACK seen at the periphery of the ARM7TDMI core This enables the debug system to signal to the rest of the system that the core is still being debugged even when system speed accesses are being performed when the internal DBGACK signal from the core is LOW ...

Page 264: ... structure of the debug control and status registers is shown in Figure B 11 on page B 55 4 TBIT 3 cgenL 2 IFEN 1 DBGRQ 0 DBGACK Table B 9 Debug status register bit assignments Bit Function 4 Enables TBIT to be read This enables the debugger to determine the processor state and therefore which instructions to execute 3 Enables the state of the NMREQ signal from the core synchronized to TCK to be r...

Page 265: ...re Bit 4 TBIT Bit 3 cgenl Bit 2 INTDIS Bit 1 DBGRQ Bit 0 DBGACK Bit 0 DBGACK Bit 2 IFEN Bit 1 DBGRQ Debug control register Debug status register TBIT from core cgenL from core DBGACK from core IFEN to core DBGRQ from ARM7TDMI input DBGACKI from core DBGACK to ARM7TDMI output DBGRQI to core and ARM7TDMI output Synch Synch Synch Synch Synch ...

Page 266: ...at is shown in Figure B 12 Figure B 12 Debug abort status register This bit is set when the ARM7TDMI core takes a prefetch or data abort as a result of a breakpoint or watchpoint If on a particular instruction or data fetch both the debug abort and the external abort signal are asserted then the external abort takes priority and the DbgAbt bit is not set When set DbgAbt remains set until reset by ...

Page 267: ...rol mask register C 9 0 be the combined control bus from the ARM7TDMI core other watchpoint registers and the EXTERN signal CHAINOUT signal The CHAINOUT signal is derived as follows WHEN Av 31 0 Cv 4 0 XNOR A 31 0 C 4 0 OR Am 31 0 Cm 4 0 0xFFFFFFFFF CHAINOUT Dv 31 0 Cv 7 5 XNOR D 31 0 C 7 5 OR Dm 31 0 Cm 7 5 0x7FFFFFFFF The CHAINOUT output of watchpoint register 1 provides the CHAIN input to Watch...

Page 268: ...to watchpoint register 0 This RANGE input enables you to couple two breakpoints together to form range breakpoints Selectable ranges are restricted to being powers of 2 For example if a breakpoint is to occur when the address is in the first 256 bytes of memory but not in the first 32 bytes program the watchpoint as follows For Watchpoint 1 1 Program Watchpoint 1 with an address value of 0x0000000...

Page 269: ... B 19 EmbeddedICE RT timing EmbeddedICE RT samples the EXTERN1 and EXTERN0 inputs on the falling edge of ECLK Sufficient set up and hold time must therefore be enabled for these signals See Chapter 7 AC and DC Parameters for details of the required setup and hold times for these signals ...

Page 270: ...ility of false matches occurring during changes to the watchpoint registers caused by old data in some registers and new data in others you must 1 Disable the watchpoint unit by setting EmbeddedICE RT disable bit 5 in the debug control register 2 Poll the debug control register until the EmbeddedICE RT disable bit is read back as set 3 Change the other registers 4 Re enable the watchpoint unit by ...

Page 271: ...nces Between Rev 3a and Rev 4 This appendix describes the differences between Rev 3a and Rev 4 of the ARM7TDMI processor It contains the following sections Summary of differences between Rev 3a and Rev 4 on page C 2 Detailed descriptions of differences between Rev 3a and Rev 4 on page C 3 ...

Page 272: ...follows improved low voltage operation addition of EmbeddedICE RT logic enhancement to ETM interface ability to minimize power consumption by disabling EmbeddedICE RT improvement in Debug Communications Channel DCC bandwidth support for access to DCC through JTAG alterations to TAP Controller Scan Chain These are described in detail in Detailed descriptions of differences between Rev 3a and Rev 4 ...

Page 273: ...system failure The addition of two extra bits to the debug control register and the addition of a new register R2 in the coprocessor register map are the only alterations to the programmer s model Bit 4 of the debug control register is monitor mode enable and controls how the device reacts on a breakpoint or watchpoint when set the core takes the instruction or data abort exception when clear the ...

Page 274: ...hain The status bit in the DCC control register is left unchanged to ensure backwards compatibility C 2 5 Access to Debug Communications Channel through JTAG The DCC control register can be controlled from the JTAG interface in ARM7TDMI Rev 4 A write clears bit 0 the data read control bit C 2 6 Alterations to TAP controller scan chain The alterations to the TAP controller scan chain are as follows...

Page 275: ...Scan chains 4 and 8 are reserved for internal use by ARM Limited C 2 7 Change to pin positioning Pin order remains the same with only one new pin appearing at the upper left corner of the device see Enhancement to ETM interface on page C 4 C 2 8 Increased number of metal layers The ARM7TDMI Rev 4 requires four metal layers compared to three for the ARM7TDMI Rev 3a C 2 9 Increased power consumption...

Page 277: ...addresses which is the traditional role of an addressing mode A fifth addressing mode generates values to be used as operands by data processing instructions Arithmetic Logic Unit The part of a computer that performs all arithmetic computations such as addition and multiplication and all comparison operations ALU See Arithmetic Logic Unit ARM state A processor that is executing ARM 32 bit instruct...

Page 278: ...n of a processor Usually used to find errors in the application program flow Debugger A debugging system which includes a program used to detect locate and correct software faults together with custom hardware that supports software debugging EmbeddedICE The EmbeddedICE Logic is controlled via the JTAG test access port using a protocol converter such as MultiICE an extra piece of hardware that all...

Page 279: ... byte LR See Link register Macrocell A complex logic block with a defined interface and behavior A typical VLSI system will comprise several macrocells such as an ARM7TDMI an ETM7 and a memory block plus application specific logic Memory Management Unit Allows control of a memory system Most of the control is provided through translation tables held in memory The ARM7TDMI processor does not includ...

Page 280: ...ecause the instructions are so simple they require fewer transistors this makes them cheaper to produce and more power efficient See also Complex Instruction Set Computer RISC See Reduced Instruction Set Computer Saved Program Status Register The Saved Program Status Register which is associated with the current processor mode and is undefined if there is no such Saved Program Status Register as i...

Page 281: ...ls are TDI TDO TMS and TCK The optional terminal is nTRST Thumb instruction A halfword which specifies an operation for an ARM processor in Thumb state to perform Thumb instructions must be halfword aligned Thumb state A processor that is executing Thumb 16 bit instructions is operating in Thumb state UND See Undefined Undefined Indicates an instruction that generates an undefined instruction trap...

Page 283: ...rectional data read cycle 7 9 unidirectional data write cycle 7 8 units of nanoseconds 7 20 Access times stretching 3 29 Accesses byte 3 26 halfword 3 26 reads 3 26 writes 3 27 AccessinghighregistersinThumbstate 2 12 Address bits significant 3 12 Address bus configuring 3 14 Address timing 3 14 Addressing signals 3 11 ARM instruction summary 1 13 ARM state addressing modes 1 15 condition fields 1 ...

Page 284: ...C 4 communications through 5 18 interrupt driven use 5 20 registers 5 17 DCC control register 5 17 Debug behavior of PC B 30 breakpoints B 30 hardware B 47 programming B 47 software B 48 B 49 bypass register B 14 clock 5 3 clock switch during B 22 clock switch during test 5 12 B 23 clock switching 5 11 communications channel see DCC communications through the DCC 5 18 control and status register f...

Page 285: ...ID code register B 14 Instruction cycle timings branch 6 4 branch and exchange 6 6 branch with link 6 4 coprocessor absent 6 27 coprocessor data operation 6 20 coprocessor data transfer 6 21 coprocessor register transfer 6 25 data operations 6 7 data swap 6 18 exceptions 6 19 instruction speed summary 6 29 load multiple registers 6 15 load register 6 12 multiply 6 9 multiply accumulate 6 9 store m...

Page 286: ...tial access cycle 3 7 Sequential cycles 3 6 Signal naming conventions xviii Signal types A 3 Signals address class 3 11 bus interface 3 3 clock and clock control 4 4 coprocessor interface 4 4 descriptions A 4 Significant address bits 3 12 Simple memory cycle 3 4 SRAM compatible address timing 3 16 STC 4 10 Supervisor Mode 2 7 Switching state 2 3 System Mode 2 7 System speed access B 32 System timi...

Search results

Summary of Contents for ARM7TDMI

Reviews:

Related manuals for ARM7TDMI

Brands by name

Popular brands

ARM ARM7TDMI, Technical Reference Manual

Search results

Summary of Contents for ARM7TDMI

Reviews:

Related manuals for ARM7TDMI

Brands by name

Popular brands