ARM ARM926EJ-S Technical Reference Manual Download Page 162

Page: 162 / 248

Coprocessor Interface

8-6

ARM DDI0198D

8.3

MCR/MRC

These cycles look very similar to STC/LDC. An example with a busy-wait state is
shown in Figure 8-4.

Figure 8-4 MCR/MRC cycle timing

First,

nCPMREQ

is driven LOW to indicate that the instruction on

CPINSTR

entering the Decode stage of the pipeline. This coprocessor decodes the new instruction
and drives

CHSDE[1:0]

as required.

In the next cycle,

nCPMREQ

is driven LOW to indicate that the instruction has now

been issued to the Execute stage. If the condition codes pass and the instruction is to be
executed, the

CPPASS

signal is driven HIGH and the

CHSDE[1:0]

handshake bus is

examined (it is ignored in all other cases).

For any successive execute cycles the

CHSEX[1:0]

handshake bus is examined. When

the LAST condition is observed, the instruction is committed. In the case of an MCR,
the

CPDOUT[31:0]

bus is driven with the register data during the coprocessor Write

stage. In the case of an MRC,

CPDIN[31:0]

is sampled at the end of the ARM9EJ-S

memory stage and written to the destination register during the next cycle.

Decode

Execute

(WAIT)

Execute

(LAST)

Memory

CLK

CPINSTR[31:0]

nCPMREQ

CPPASS

CPLATECANCEL

CHSDE[1:0]

CHSEX[1:0]

Coprocessor pipeline

Write

Fetch

CPDOUT[31:0]

MCR

CPDIN[31:0]

MRC

MCR/MRC

WAIT

LAST

Ignored

Coproc data

Summary of Contents for ARM926EJ-S

Page 2: ... product and its use contained in this document are given by ARM in good faith However all warranties implied or expressed including but not limited to implied warranties of merchantability or fitness for purpose are excluded This document is intended only to assist the reader in the use of the product ARM Limited shall not be liable for any loss or damage arising from the use of any information i...

Page 3: ...rocessor 1 2 Chapter 2 Programmer s Model 2 1 About the programmer s model 2 2 2 2 Summary of ARM926EJ S system control coprocessor CP15 registers 2 3 2 3 Register descriptions 2 7 Chapter 3 Memory Management Unit 3 1 About the MMU 3 2 3 2 Address translation 3 5 3 3 MMU faults and CPU aborts 3 21 3 4 Domain access control 3 24 3 5 Fault checking sequence 3 26 3 6 External aborts 3 29 3 7 TLB stru...

Page 4: ...nous SRAM as TCM memory 5 31 5 9 TCM clock gating 5 32 Chapter 6 Bus Interface Unit 6 1 About the bus interface unit 6 2 6 2 Supported AHB transfers 6 3 Chapter 7 Noncachable Instruction Fetches 7 1 About noncachable instruction fetches 7 2 Chapter 8 Coprocessor Interface 8 1 About the ARM926EJ S external coprocessor interface 8 2 8 2 LDC STC 8 4 8 3 MCR MRC 8 6 8 4 CDP 8 8 8 5 Privileged instruct...

Page 5: ...agement 12 2 Appendix A Signal Descriptions A 1 Signal properties and requirements A 2 A 2 AHB related signals A 3 A 3 Coprocessor interface signals A 5 A 4 Debug signals A 7 A 5 JTAG signals A 9 A 6 Miscellaneous signals A 10 A 7 ETM interface signals A 12 A 8 TCM interface signals A 14 Appendix B CP15 Test and Debug Registers B 1 About the Test and Debug Registers B 2 Glossary ...

Page 7: ...Line length encoding 2 11 Table 2 10 Example Cache Type Register format 2 11 Table 2 11 Control bit functions register c1 2 13 Table 2 12 Effects of Control Register on caches 2 15 Table 2 13 Effects of Control Register on TCM interface 2 16 Table 2 14 Domain access control defines 2 18 Table 2 15 FSR bit field descriptions 2 19 Table 2 16 FSR status field encoding 2 20 Table 2 17 Function descrip...

Page 8: ...e DCache 4 6 Table 4 4 Page table C and B bit settings for the DCache 4 6 Table 4 5 Instruction access priorities to the TCM and cache 4 8 Table 4 6 Data access priorities to the TCM and cache 4 8 Table 4 7 Values of S and NSETS 4 10 Table 5 1 Relationship between DMDMAEN DRDMACS and DRIDLE 5 6 Table 6 1 Supported HBURST encodings 6 4 Table 6 2 IHPROT 3 0 and DHPROT 3 0 attributes 6 5 Table 8 1 Ha...

Page 9: ...Limited All rights reserved ix Table B 10 MMU Debug Control Register bit assignments B 14 Table B 11 Memory Region Remap Register instructions B 15 Table B 12 Encoding of the Memory Region Remap Register B 16 Table B 13 Encoding of the remap fields B 16 ...

Page 11: ... Register format 2 12 Figure 2 5 Control Register format 2 13 Figure 2 6 TTBR format 2 17 Figure 2 7 Register c3 format 2 18 Figure 2 8 FSR format 2 19 Figure 2 9 Register c7 MVA format 2 23 Figure 2 10 Register c7 Set Way format 2 24 Figure 2 11 Register c8 MVA format 2 26 Figure 2 12 Cache Lockdown Register c9 format 2 27 Figure 2 13 TCM Region Register c9 format 2 30 Figure 2 14 TLB Lockdown Re...

Page 12: ... a single wait state 5 14 Figure 5 8 Loopback of SEQ to produce a single cycle wait state 5 14 Figure 5 9 Cycle timing of loopback circuit 5 15 Figure 5 10 DMA with single wait state for nonsequential accesses 5 16 Figure 5 11 Cycle timing of circuit with DMA and single wait state for nonsequential accesses 5 17 Figure 5 12 Zero wait state RAM example 5 20 Figure 5 13 Byte banks of RAM example 5 2...

Page 13: ... Figure B 3 Rd format for accessing MVA tag of main or lockdown TLB entry B 7 Figure B 4 Rd format for accessing PA and AP data of main or lockdown TLB entry B 8 Figure B 5 Write to the data RAM B 10 Figure B 6 Rd format for selecting lockdown TLB entry B 11 Figure B 7 Cache Debug Control Register format B 12 Figure B 8 MMU Debug Control Register format B 14 Figure B 9 Memory Region Remap Register...

Page 15: ...001 2003 ARM Limited All rights reserved xv Preface This preface introduces the ARM926EJ S Revision r0p4 r0p5 Technical Reference Manual TRM It contains the following sections About this manual on page xvi Feedback on page xxi ...

Page 16: ...s organized into the following chapters Chapter 1 Introduction Read this chapter for an overview of the ARM926EJ S processor Chapter 2 Programmer s Model Read this chapter for details of the programmer s model and ARM926EJ S registers Chapter 3 Memory Management Unit Read this chapter for details of the Memory Management Unit MMU and address translation process and how to use the CP15 register to ...

Page 17: ...or the Instruction Memory Barrier IMB description and how IMB operations are used to ensure consistency between data and instruction streams processed by the ARM926EJ S processor Chapter 10 Embedded Trace Macrocell Support Read this chapter to understand how Embedded Trace Macrocell ETM is supported in the ARM926EJ S processor Chapter 11 Debug Support Read this chapter for a description of the deb...

Page 18: ...pace Denotes a permitted abbreviation for a command or option You can enter the underlined text instead of the full command or option name monospace italic Denotes arguments to monospace text where the argument is to be replaced by a specific value monospace bold denotes language keywords when used outside example code and Angle brackets enclose replaceable terms for assembler syntax where they ap...

Page 19: ...ve LOW signals except in the case of AHB or Advanced Peripheral Bus APB reset signals These are named HRESETn and PRESETn respectively Prefix DH Denotes data side AHB signals Prefix IH Denotes instruction side AHB signals Prefix DR Denotes data side TCM interface signals Prefix IR Denotes instruction side TCM interface signals Prefix ETM Denotes ETM interface signals Prefix DBG Denotes debug JTAG ...

Page 20: ...mited and by third parties ARM Limited periodically provides updates and corrections to its documentation See http www arm com for current errata sheets addenda and the ARM Limited Frequently Asked Questions list ARM publications This manual contains information that is specific to the ARM926EJ S processor Refer to the following documents for other relevant information ARM Architecture Reference M...

Page 21: ...ts or suggestions about this product contact your supplier giving the product name a concise explanation of your comments Feedback on this manual If you have any comments on this manual send email to errata arm com giving the title the number the relevant page number s to which your comments apply a concise explanation of your comments ARM Limited also welcomes general suggestions for additions an...

Page 23: ...yright 2001 2003 ARM Limited All rights reserved 1 1 Chapter 1 Introduction This chapter introduces the ARM926EJ S processor and its features It contains the following section About the ARM926EJ S processor on page 1 2 ...

Page 24: ...e processor subsystem including an ARM9EJ S integer core a Memory Management Unit MMU separate instruction and data AMBA AHB bus interfaces separate instruction and data TCM interfaces The ARM926EJ S processor provides support for external coprocessors enabling floating point or other application specific hardware acceleration to be added The ARM926EJ S processor implements ARM architecture versio...

Page 25: ...he ARM926EJ S interfaces ARM9EJ S FCSE WDATA RDATA INSTR DROUTE IROUTE DCACHE DEXT Write buffer Bus interface unit TCM interface DRDATA IRDATA DRWDATA ITCM DTCM Writeback write buffer PA TAGRAM Cache DMVA IMVA Coprocessor interface CPDIN CPDOUT CPINSTR External coprocessor interface ETM interface MMU DA IA TLB AHB Instruction AHB interface AHB Data AHB interface ICACHE IEXT ...

Page 26: ...RST DBGTCKEN DBGTDI DBGTMS DBGTDO DBGIR 3 0 DBGSCREG 4 0 DBGTAPSM 3 0 DBGnTDOEN DBGSDIN DBGSDOUT DRnRW DRADDR 17 0 DRWR 31 0 DRIDLE DRCS DRWBL 3 0 DRSEQ DRRD 31 0 DRWAIT DRSIZE 3 0 IRnRW IRADDR 17 0 IRWR 31 0 IRIDLE IRCS IRWBL 3 0 IRSEQ IRRD 31 0 IRWAIT IRSIZE 3 0 DHADDR 31 0 DHBL 3 0 DHBURST 2 0 DHBUSREQ DHCLKEN DHGRANT DHLOCK DHPROT 3 0 DHRDATA 31 0 DHREADY DHRESP 1 0 DHSIZE 2 0 DHTRANS 1 0 DHWD...

Page 27: ...ETMDnRW ETMDSEQ ETMRDATA 31 0 ETMDABORT ETMWDATA 31 0 ETMnWAIT ETMDBGACK ETMINSTREXEC ETMRNGOUT ETMID31TO25 6 0 ETMID15TO11 4 0 ETMCHSD 1 0 ETMCHSE 1 0 ETMPASS ETMLATECANCEL ETMINSTRVALID IHADDR 31 0 IHBURST 2 0 IHBUSREQ IHCLKEN IHGRANT IHLOCK IHPROT 3 0 IHRDATA 31 0 IHREADY IHRESP 1 0 IHSIZE 2 0 IHTRANS 1 0 IHWRITE HRESETn ETMPROCID 31 0 ETMPROCIDWR CPCLKEN CPINSTR 31 0 CPDOUT 31 0 CPDIN 31 0 CPP...

Page 29: ...cribes the ARM926EJ S registers in CP15 the system control coprocessor and provides information for programming the microprocessor It contains the following sections About the programmer s model on page 2 2 Summary of ARM926EJ S system control coprocessor CP15 registers on page 2 3 Register descriptions on page 2 7 ...

Page 30: ...ol the ARM926EJ S processor The caches Tightly Coupled Memories TCMs Memory Management Unit MMU and most other system options are controlled using CP15 registers You can only access CP15 registers with MRC and MCR instructions in a privileged mode CDP LDC STC MCRR and MRRC instructions and unprivileged MRC or MCR instructions to CP15 cause the Undefined instruction exception to be taken ...

Page 31: ...ble 1 Control Control 2 Translation table base Translation table base 3 Domain access control Domain access control 4 Reserved Reserved 5 Data fault statusa Data fault statusa 5 Instruction fault statusa Instruction fault statusa 6 Fault address Fault address 7 Cache operations Cache operations 8 Unpredictable TLB operations 9 Cache lockdownb b Register location 9 provides access to more than one ...

Page 32: ...the instruction is issued by the ARM9EJ S core 2 The VA is translated using the FCSE PID value to the MVA The Instruction Cache ICache and Memory Management Unit MMU detect the MVA see Process ID Register c13 on page 2 33 3 If the protection check carried out by the MMU on the MVA does not abort and the MVA tag is in the ICache the instruction data is returned to the ARM9EJ S core 4 If the protect...

Page 33: ...ro except when the values specified are used to select the desired behavior Using other values results in Unpredictable behavior Table 2 3 shows the terms and abbreviations used in this chapter Cond 31 28 27 26 25 24 23 21 20 19 16 15 12 11 10 9 8 7 5 4 3 0 1 1 1 0 Opcode _1 L CRn Rd 1 1 1 1 Opcode _2 1 CRm Table 2 3 CP15 abbreviations Term Abbreviation Description Unpredictable UNP For reads The ...

Page 34: ...ld Be One or Should Be Zero does not cause any physical damage to the chip Should Be One SBO When writing to this location all bits in this field Should Be One Should Be Zero or Preserved SBZP When writing to this location all bits of this field Should Be Zero or preserved by writing the same value that has been previously read from the same field Table 2 3 CP15 abbreviations continued Term Abbrev...

Page 35: ... 32 Register c11 and c12 on page 2 33 Process ID Register c13 on page 2 33 Register c14 on page 2 35 Test and Debug Register c15 on page 2 36 2 3 1 ID Code Cache Type and TCM Status Registers c0 Register c0 accesses the ID Register Cache Type Register and TCM Status Registers Reading from this register returns the device ID the cache type or the TCM status depending on the value of Opcode_2 used O...

Page 36: ...ze and architecture of the Instruction Cache ICache and Data Cache DCache enabling operating systems to establish how to perform such operations as cache cleaning and lockdown You can access the cache type register by reading CP15 register c0 with the Opcode_2 field set to 1 For example MRC p15 0 Rd c0 c0 1 returns cache details The format of the Cache Type Register is shown in Figure 2 2 on page ...

Page 37: ...the size length and associativity of the ICache or of the unified cache if the S bit is 0 The Ctype field specifies if the cache supports lockdown or not and how it is cleaned The encoding is shown in Table 2 6 All unused values are reserved The Dsize and Isize fields in the Cache Type Register have the same format This is shown in Figure 2 3 Figure 2 3 Dsize and Isize field format Size The Size f...

Page 38: ...termined by the Size field and the M bit The M bit is 0 for the DCache and ICache The Size field is bits 21 18 for the DCache and bits 9 6 for the ICache The minimum size of each cache is 4KB and the maximum size is 128KB Table 2 7 shows the cache size encoding The associativity of the cache is determined by the Assoc field and the M bit The M bit is 0 for the DCache and ICache The Assoc field is ...

Page 39: ...hes DCache size 8KB ICache size 16KB associativity 4 way line length eight words caches use write back register 7 for cache cleaning and Format C for cache lockdown See Cache Lockdown Register c9 on page 2 26 for more details on Format C for cache lockdown Table 2 9 Line length encoding Len field Cache line length b10 8 words 32 bytes Other values Reserved Table 2 10 Example Cache Type Register fo...

Page 40: ...gister format 2 3 2 Control Register c1 Register c1 is the Control Register for the ARM926EJ S processor This register specifies the configuration used to enable and disable the caches and MMU It is recommended that you access this register using a read modify write sequence For both reading and writing the CRm and Opcode_2 fields Should Be Zero To read and write this register use the instructions...

Page 41: ...15 14 13 12 11 10 9 8 7 6 3 2 1 0 S B O S B Z S B O L 4 R R V I SBZ R S B SBO C A Table 2 11 Control bit functions register c1 Bit Name Function 31 19 Reserved When read returns an Unpredictable value When written Should Be Zero or a value read from bits 31 19 on the same processor Using a read modify write sequence when modifying this register provides the greatest future compatibility 18 Reserve...

Page 42: ... 0 ICache disabled 1 ICache enabled 11 10 SBZ 9 R bit ROM protection This bit modifies the ROM protection system See Domain access control on page 3 24 8 S bit System protection This bit modifies the MMU protection system See Domain access control on page 3 24 7 B bit Endianness 0 Little endian operation 1 Big endian operation Set to the value of BIGENDINIT on reset 6 3 Reserved SBO 2 C bit DCache...

Page 43: ...emory AHB ICache enabled Disabled All instruction fetches are cachable with no protection checks All addresses are flat mapped That is VA MVA PA ICache enabled Enabled Instruction fetches are cachable or noncachable and protection checks are performed All addresses are remapped from VA to PA depending on the MMU page table entry That is VA translated to MVA MVA remapped to PA DCache disabled Enabl...

Page 44: ...ache enabled All instruction fetches are from the TCM interface or from the ICache AHB interface depending on the setting of the base address in the Instruction TCM region register Protection checks are made All addresses are remapped from VA to PA depending on the page entry That is the VA is translated to an MVA and the MVA is remapped to a PA Data TCM disabled Disabled DCache disabled All data ...

Page 45: ...r to the currently active first level translation table in bits 31 14 and an Unpredictable value in bits 13 0 Writing to register c2 updates the pointer to the first level translation table from the value in bits 31 14 of the written value Bits 13 0 Should Be Zero You can use the following instructions to access the TTBR MRC p15 0 Rd c2 c0 0 read TTBR MCR p15 0 Rd c2 c0 0 write TTBR The CRm and Op...

Page 46: ...2 3 6 Fault Status Registers c5 Register c5 accesses the Fault Status Registers FSRs The FSRs contain the source of the last instruction or data fault The instruction side FSR is intended for debug purposes only The FSR is updated for alignment faults and external aborts that occur while the MMU is disabled D15 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 D...

Page 47: ...ns MRC p15 0 Rd c5 c0 0 read DFSR MCR p15 0 Rd c5 c0 0 write DFSR MRC p15 0 Rd c5 c0 1 read IFSR MCR p15 0 Rd c5 c0 1 write IFSR The format of the Fault Status Register is shown in Figure 2 8 Figure 2 8 FSR format Table 2 15 shows the bit field descriptions for the FSR UNP SBZ 31 9 8 7 4 3 0 0 Domain Status Table 2 15 FSR bit field descriptions Bits Description 31 9 UNP SBZP 8 Always reads as zero...

Page 48: ...c6 c0 0 read FAR MCR p15 0 Rd c6 c0 0 write FAR Writing c6 sets the FAR to the value of the data written This is useful for a debugger to restore the value of the FAR to a previous state The CRm and Opcode_2 fields Should Be Zero when reading or writing CP15 c6 2 3 8 Cache Operations Register c7 Register c7 controls the caches and the write buffer The function of each cache operation is selected b...

Page 49: ...ddress Invalidates a single cache line discarding any dirty data Clean single data entry using either index or modified virtual address Writes the specified DCache line to main memory if the line is marked valid and dirty The line is marked as not dirty The valid bit is unchanged Clean and invalidate single data entry using either index or modified virtual address Writes the specified DCache line ...

Page 50: ... Wait for interrupt This instruction drains the contents of the write buffers puts the processor into a low power state and stops it from executing further instructions until an interrupt or debug request occurs When an interrupt does occur the MCR instruction completes and the IRQ or FIQ handler is entered as normal The return link in R14_irq or R14_fiq contains the address of the MCR instruction...

Page 51: ... 8 word line then A log2 associativity log24 2 S log2 NSETS where NSETS cache size in bytes associativity line length in bytes NSETS 16384 4 32 128 Therefore S log2 128 7 Invalidate DCache single entry Set Way Set Way MCR p15 0 Rd c7 c6 2 Clean DCache single entry MVA MVA MCR p15 0 Rd c7 c10 1 Clean DCache single entry Set Way Set Way MCR p15 0 Rd c7 c10 2 Test and clean DCache MRC p15 0 Rd c7 c10...

Page 52: ...truction also sets the condition code flags If the cache contains any dirty lines bit 30 is set to 0 If the cache contains no dirty lines bit 30 is set to 1 This means that you can use the following loop to clean the entire DCache tc_loop MRC p15 0 r15 c7 c10 3 test and clean BNE tc_loop The test clean and invalidate DCache instruction is the same as test and clean DCache except that when the enti...

Page 53: ...try to be loaded into the TLB see the ARM Architecture Reference Manual The invalidate TLB operations invalidate all the unpreserved entries in the TLB The invalidate TLB single entry operations invalidate any TLB entry corresponding to the Modified Virtual Address given in Rd regardless of its preserved state See TLB Lockdown Register c10 on page 2 32 for a description of how to preserve entries ...

Page 54: ...he Cache Lockdown Register uses a cache way based locking scheme Format C that enables you to control each cache way independently These registers enable you to control which cache ways of the four way cache are used for the allocation on a linefill When the registers are defined subsequent linefills are only placed in the specified target cache way This gives you some control over the cache pollu...

Page 55: ...u must only modify the Cache Lockdown Register using a read modify write sequence For example MRC p15 0 Rn c9 c0 1 ORR Rn Rn 0x01 MCR p15 0 Rn c9 c0 1 This sequence sets the L bit to 1 for way 0 of the ICache The format of the cache lockdown register c9 is shown in Figure 2 12 Figure 2 12 Cache Lockdown Register c9 format Table 2 20 Cache Lockdown Register instructions Function Data Instruction Re...

Page 56: ...cked down ensure that all the code executed by the lockdown procedure is in an uncachable area of memory including TCM or in an already locked cache way 3 If a DCache way is being locked down ensure that all data used by the lockdown procedure is in an uncachable area of memory including TCM or is in an already locked cache way 4 Ensure that the data instructions that are to be locked down are in ...

Page 57: ...p15 0 Rn c9 c0 1 TCM Region Register c9 The ARM926EJ S processor supports physically indexed physically tagged TCM The TCM Region Register supports one region of instruction TCM and one region of data TCM The minimum size of TCM region that can be supported is 4KB The TCM Status Register indicates if TCM memories are attached see TCM Status Register c0 on page 2 12 The size of each TCM region is d...

Page 58: ...e address physical address 31 12 11 6 5 2 1 0 SBZ UNP Size 0 Table 2 23 TCM Region Register c9 Bits Function 31 12 Base address physical address 11 6 SBZ UNP 5 2 Size The Size field reflects the value of the IRSIZE DRSIZE macrocell inputs The Size field encoding is shown in Table 2 24 1 SBZ UNP 0 Enable bit 0 disabled 1 enabled Table 2 24 TCM Size field encoding Memory size Value 0KB absent b0000 ...

Page 59: ...s being read from the instruction TCM See Chapter 9 Instruction Memory Barrier for more details Note Instruction fetches from the data TCM are not possible An attempt to fetch an instruction from an address in the data TCM space does not result in an access to the data TCM and the instruction is fetched from main memory These accesses can result in external aborts because the address range might n...

Page 60: ...n region are preserved so that invalidate TLB operations only invalidate the unpreserved entries in the TLB That is those in the set associative region Invalidate TLB single entry operations invalidate any TLB entry corresponding to the Modified Virtual Address given in Rd regardless of their preserved state That is if they are in the lockdown or set associative regions of the TLB See TLB Operatio...

Page 61: ...ddr is not already in the TLB MRC p15 0 r0 c10 c0 0 read the lockdown register ORR r0 r0 1 set the preserve bit MCR p15 0 r0 c10 c0 0 write to the lockdown register LDR r1 r1 TLB will miss and entry will be loaded MRC p15 0 r0 c10 c0 0 read the lockdown register victim will have incremented BIC r0 r0 1 clear preserve bit MCR p15 0 r0 c10 c0 0 write to the lockdown register 2 3 12 Register c11 and ...

Page 62: ...CSE address translation occurs FCSE translation is not applied for addresses used for entry based cache or TLB maintenance operations For these operations VA MVA Table 2 26 shows the ARM instructions that can be used to access the FCSE PID Register The format of the FCSE PID Register is shown in Figure 2 15 Figure 2 15 Process ID Register format Performing a fast context switch You can perform a f...

Page 63: ...n multi tasking environments The contents of this register are replicated on the ETMPROCID pins of the ARM926EJ S processor ETMPROCIDWR is pulsed when a write occurs to the Context ID Register Table 2 27 shows the ARM instructions that you can use to access the Context ID Register The format of the Context ID Register Rd transferred during this operation is shown in Figure 2 16 Figure 2 16 Context...

Page 64: ... in ARM926EJ S processors Appendix B CP15 Test and Debug Registers describes the registers and functions available using CP15 c15 This register is defined to be reserved for implementation defined purposes in the ARM Architecture Reference Manual If you write software that uses the device specific facilities provided by c15 then this software is unlikely to be either backwards or forwards compatib...

Page 65: ...chapter describes the Memory Management Unit MMU It contains the following sections About the MMU on page 3 2 Address translation on page 3 5 MMU faults and CPU aborts on page 3 21 Domain access control on page 3 24 Fault checking sequence on page 3 26 External aborts on page 3 29 TLB structure on page 3 31 ...

Page 66: ...ain TLB is a two way set associative cache for page table information It has 32 entries per way for a total of 64 entries The lockdown TLB is an eight entry fully associative cache that contains locked TLB entries Locking TLB entries can ensure that a memory access to a given region never incurs the penalty of a page table walk For more details of the TLBs see TLB structure on page 3 31 The MMU fe...

Page 67: ...2 17 3 1 2 Translated entries The main TLB caches 64 translated entries If during a memory access the main TLB contains a translated entry for the MVA the MMU reads the protection data to detrmine if the access is permitted if access is permitted and an off chip access is required the MMU outputs the appropriate physical address corresponding to the MVA if access is permitted and an off chip acces...

Page 68: ...ses 16 two bit fields Each field defines the access control attributes for one of 16 domains D15 to D0 Fault status registers IFSR and DFSR c5 7 0 Indicates the cause of a Data or Prefetch Abort and the domain number of the aborted access when an abort occurs Bits 7 4 specify which of the 16 domains D15 to D0 was being accessed when a fault occurred Bits 3 0 indicate the type of access being attem...

Page 69: ...ng and permission checking process is one or two depending on whether the address is marked as a section mapped access or a page mapped access There are three sizes of page mapped accesses and one size of section mapped access Page mapped accesses are for large pages small pages tiny pages The translation process always begins in the same way with a level one fetch A section mapped access requires...

Page 70: ...ress of a table in physical memory that contains section or page descriptors or both The 14 low order bits 13 0 of the TTBR are Unpredictable on a read and the table must reside on a 16KB boundary Figure 3 1 shows the format of the TTBR Figure 3 1 Translation Table Base Register The translation table has up to 4096 x 32 bit entries each describing 1MB of virtual memory This enables up to 4GB of vi...

Page 71: ...Coarse page table 256 entries Fine page table 1024 entries Coarse page table base Fine page table base Large page 64KB Small page 4KB Tiny page 1KB Large page base Indexed by modified virtual address bits 19 0 Indexed by modified virtual address bits 19 12 Indexed by modified virtual address bits 19 10 Indexed by modified virtual address bits 15 0 Indexed by modified virtual address bits 11 0 Inde...

Page 72: ...cts a 4 byte translation table entry This is a first level descriptor for either a section or a page table 3 2 3 First level descriptor The first level descriptor returned is a section descriptor a coarse page table descriptor or a fine page table descriptor or is invalid Figure 3 4 on page 3 9 shows the format of a first level descriptor Table index 31 20 19 0 Translation base 31 14 13 0 Translat...

Page 73: ...to 1KB blocks First level descriptor bit assignments are shown in Table 3 2 31 20 19 12 11 10 9 8 5 4 3 2 1 0 0 0 Coarse page table base address Domain 1 0 1 Section base address AP Domain 1 C B 1 0 Fine page table base address Domain 1 1 1 Fault Coarse page table Section Fine page table Table 3 2 First level descriptor bits Bits Description Section Coarse Fine 31 20 31 10 31 12 These bits form th...

Page 74: ...rite through cachable noncached buffered or noncached nonbuffered 3 2 3 2 Should Be Zero 1 0 1 0 1 0 These bits indicate the page size and validity and are interpreted as shown in Table 3 3 Table 3 3 Interpreting first level descriptor bits 1 0 Value Meaning Description 0 0 Invalid Generates a section translation fault 0 1 Coarse page table Indicates that this is a coarse page table descriptor 1 0...

Page 75: ...ed from the first level fetch a second level fetch is initiated Table 3 4 Section descriptor bits Bits Description 31 20 Form the corresponding bits of the physical address for a section 19 12 Always written as 0 11 10 The AP bits specify the access permissions for this section 9 Always written as 0 8 5 Specify one of the 16 possible domains held in the domain access control register that contain ...

Page 76: ...iptor Figure 3 7 Fine page table descriptor Note If a fine page table descriptor is returned from the first level fetch a second level fetch is initiated Table 3 5 Coarse page table descriptor bits Bits Description 31 10 These bits form the base for referencing the second level descriptor the coarse page table index for the entry is derived from the MVA 9 Always written as 0 8 5 These bits specify...

Page 77: ...e 3 6 Fine page table descriptor bits Bits Description 31 12 These bits form the base for referencing the second level descriptor the fine page table index for the entry is derived from the MVA 11 9 Always written as 0 8 5 These bits specify one of the 16 possible domains held in the domain access control registers that contain the primary access controls 4 Always written as 1 3 2 Always written a...

Page 78: ...ge table to be used The page table is then accessed and a second level descriptor is returned Figure 3 9 on page 3 15 shows the format of second level descriptors Table index 31 20 19 0 Section index Translation base 31 14 13 0 Translation base 31 14 13 2 1 0 Table index 0 0 Modified virtual address Translation table base Section base address 31 20 19 12 11 10 9 8 5 4 3 2 1 0 SBZ AP 0 Domain 1 C B...

Page 79: ... page descriptors must be repeated in each consecutive entry Fine page tables provide base addresses for large small or tiny pages Large page descriptors must be repeated in 64 consecutive entries Small page descriptors must be repeated in four consecutive entries and tiny page descriptors must be repeated in each consecutive entry Second level descriptor bit assignments are described in Table 3 7...

Page 80: ...lt checking sequence on page 3 26 show how to interpret the access permission bits 3 2 3 2 3 2 These bits C and B indicate whether the area of memory mapped by this page is treated as write back cachable write through cachable noncached buffered or noncached nonbuffered 1 0 1 0 1 0 These bits indicate the page size and validity and are interpreted as shown in Table 3 8 Table 3 8 Interpreting page ...

Page 81: ... six bits of the page index and low order six bits of the fine page table index overlap Each fine page table entry for a large page must therefore be duplicated 64 times Translation base 31 14 13 0 Translation base 31 14 13 2 1 0 Table index 0 0 Modified virtual address Translation table base Table index 31 20 19 16 15 12 11 0 L2 table index Page index Coarse page table base address 31 10 9 8 5 4 ...

Page 82: ...age table index overlap Each fine page table entry for a small page must therefore be duplicated four times Translation base 31 14 13 0 Translation base 31 14 13 2 1 0 Table index 0 0 Modified virtual address Translation table base Table index 31 20 19 12 11 0 Level two table index Page index Coarse page table base address 31 10 9 8 5 4 3 2 1 0 Domain 1 0 1 Coarse page table base address 31 10 9 2...

Page 83: ...criptor is the fine page table descriptor and this is used to point to the first level descriptor Translation base 31 14 13 0 Translation base 31 14 13 2 1 0 Table index 0 0 Modified virtual address Translation table base Table index 31 20 19 10 9 0 Level two table index Page index Fine page table base address 31 12 9 8 5 4 3 2 1 0 Domain 1 1 1 Fine page table base address 31 12 11 2 1 0 L2 table ...

Page 84: ...tails Subpages You can define access permissions for subpages of small and large pages If during a page table walk a small or large page has a different subpage permission only the subpage being accessed is written into the TLB For example a 16KB large page subpage entry is written into the TLB if the subpage permission differs and a 64KB entry is put in the TLB if the subpage permissions are iden...

Page 85: ...ondition to the CPU core The MMU retains status and address information about faults generated by the data accesses in the data fault status register and fault address register see Fault address and fault status registers The MMU also retains status about faults generated by instruction fetches in the instruction fault status register Note The address information for an instruction side abort is c...

Page 86: ... description Aborts masked by a higher priority abort can be regenerated by fixing the cause of the higher priority abort and repeating the access Alignment faults are not possible for instruction fetches The instruction FSR can also be updated for instruction prefetch operations MCR p15 0 Rd c7 c13 1 Table 3 9 Priority encoding of fault status Priority Source Size Status Domain Highest Alignment ...

Page 87: ...s made on external abort behavior The instruction FSR is intended for debugging purposes only Code that is intended to be ported to other ARM architecture v4 or v5 MMUs must not use the instruction FSR Table 3 10 FAR values for multi word transfers Source FAR Alignment MVA of first aborted address in transfer External abort on translation MVA of first aborted address in transfer Translation MVA of...

Page 88: ...Table 3 12 shows how to interpret the Access Permission AP bits and how their interpretation is dependent on the R and S bits Control Register c1 bits 9 8 Table 3 11 Domain access control register access control bits Value Meaning Description 0 0 No access Any access generates a domain fault 0 1 Client Accesses are checked against the access permission bits in the section or page descriptor 1 0 Re...

Page 89: ...ht 2001 2003 ARM Limited All rights reserved 3 25 0 1 x x Read write No access 1 0 x x Read write Read only 1 1 x x Read write Read write Table 3 12 Interpreting access permission AP bits continued AP S R Privileged permissions User permissions ...

Page 90: ...of the faults are described in Alignment faults on page 3 27 Modified virtual address Check address alignment Alignment fault Misaligned Get first level descriptor Invalid Section translation fault Section Page Get page table entry Invalid Page translation fault Check domain status Section Page No access 00 Reserved 10 Section domain fault No access 00 Reserved 10 Page domain fault Client 01 Clien...

Page 91: ...happens if bits 1 0 of the descriptor are both 0 Page A page translation fault is generated if the level one descriptor is marked as invalid This happens if bits 1 0 of the descriptor are both 0 3 5 3 Domain faults There are two types of domain fault Section The level one descriptor holds the four bit domain field which selects one of the 16 two bit domains in the domain access control register Th...

Page 92: ...e level two descriptor is for a large or small page four access permission fields ap3 to ap0 are specified each corresponding to one quarter of the page For small pages ap3 is selected by the top 1KB of the page and ap0 is selected by the bottom 1KB of the page For large pages ap3 is selected by the top 16KB of the page and ap0 is selected by the bottom 16KB of the page The selected AP bits are th...

Page 93: ...xternally aborted 3 6 1 Enabling the MMU Before enabling the MMU using CP15 c1 you must 1 Program the TTB register CP15 c2 and the domain access control register Cp15 c3 2 Program first level and second level page tables as required ensuring that a valid translation table is placed in memory at the location specified by the TTB register When these steps have been performed you can enable the MMU b...

Page 94: ...che and the MMU all three can be enabled using a single MCR instruction 3 6 2 Disabling the MMU To disable the MMU clear bit 0 in CP15 c1 Note If the MMU is enabled then disabled and subsequently re enabled the contents of the TLB are preserved If these are now invalid then the TLB must be invalidated before re enabling the MMU See TLB Operations Register c8 on page 2 24 ...

Page 95: ...ny entry written into the set associative part of the TLB can be removed at any time The set associative part of the TLB must be considered as a temporary cache of translation page table information No reliance must be placed on an entry either residing or not residing in the set associative TLB unless that entry already exists in the lockdown TLB The set associative part of the TLB can contain en...

Page 97: ...apter describes the Instruction Cache ICache the Data Cache DCache and the write buffer It contains the following sections About the caches and write buffer on page 4 2 Write buffer on page 4 4 Enabling the caches on page 4 5 TCM and cache access priorities on page 4 8 Cache MVA and Set Way formats on page 4 9 ...

Page 98: ...pported The caches perform critical word first cache refilling Pseudo random or round robin replacement selectable by the RR bit in CP15 c1 Cache lockdown registers enable control over which cache ways are used for allocation on a linefill providing a mechanism for both lockdown and controlling cache pollution The DCache stores the Physical Address PA tag corresponding to each DCache entry in the ...

Page 99: ... DDI0198D Copyright 2001 2003 ARM Limited All rights reserved 4 3 The latter allows DCache coherency to be efficiently maintained when small code changes occur for example for self modifying code and changes to exception vectors ...

Page 100: ...ffer and a four address buffer The DCache write back buffer has eight data word entries and a single address entry The MCR drain write buffer instruction enables both write buffers to be drained under software control The MCR wait for interrupt causes both write buffers to be drained and the ARM926EJ S processor to be put into a low power state until an interrupt occurs Write buffer behavior is de...

Page 101: ...ings for the ICache CP15 c1 I bit CP15 c1 M bit ARM926EJ S behavior 0 ICache disabled All instruction fetches are fetched from external memory AHB 1 0 ICache enabled MMU disabled All instruction fetches are cachable with no protection checks All addresses are flat mapped that is VA MVA PA 1 1 ICache enabled MMU enabled Instruction fetches are cachable or noncachable depending on the page descripto...

Page 102: ...1 DCache enabled MMU enabled All data accesses are cachable or noncachable depending on the page descriptor C bit and B bit see Table 4 4 and protection checks are performed All addresses are remapped from VA to PA depending on the MMU page table entry that is the VA is translated to an MVA and the MVA is remapped to a PA Table 4 4 Page table C and B bit settings for the DCache Page table C bit Pa...

Page 103: ...4 7 1 1 Write back DCache enabled Read hit Read from DCache Read miss Linefill Write hit Write to the DCache only Write miss Buffered store to external memory Table 4 4 Page table C and B bit settings for the DCache continued Page table C bit Page table B bit Description ARM926EJ S behavior ...

Page 104: ...der for Table 4 6 is deliberately the same as for instruction accesses in Table 4 5 Table 4 5 Instruction access priorities to the TCM and cache Address in ITCM region Address in DTCM region Cachable in page descriptor ARM926EJ S behavior Yes Yes Don t care Access ITCM Yes No Cachable Access ITCM Yes No Noncachable Access ITCM No Don t care Cachable Access ICache No Don t care Noncachable Access e...

Page 105: ...eric virtually indexed virtually addressed cache Figure 4 1 shows a generic virtually indexed virtually addressed cache Figure 4 1 Generic virtually indexed virtually addressed cache The ARM926EJ S cache format is shown in Figure 4 2 on page 4 10 m m m Vitual index virtual tag Tag Index Word Hit Read data TA G TA G 3 2 1 3 4 5 6 7 n TA G 2 1 3 4 5 6 7 n 2 1 2 1 3 4 5 6 7 n TAG 0 0 2 1 3 4 5 6 7 n ...

Page 106: ...cache Figure 4 2 shows the ARM926EJ S cache associativity In Figure 4 2 the following points apply the group of tags of the same Index define a Set the number of tags in a Set is the Associativity 3 1 TAG 0 0 2 1 3 4 5 6 7 n 2 31 S 5 S 4 5 4 2 1 0 Tag Index Word Byte Table 4 7 Values of S and NSETS ARM926EJ S cache size S NSETS 4KB 5 32 8KB 6 64 16KB 7 128 32KB 8 256 64KB 9 512 128KB 10 1024 ...

Page 107: ... addressed by the Index define a Way the number of tags in a Way is the number of Sets NSETS The Set Way Word format for ARM926EJ S caches is shown in Figure 4 3 Figure 4 3 ARM926EJ S cache Set Way Word format In Figure 4 3 A log2 Associativity For example for a four way cache A 2 S log2 NSETS Way SBZ Set select Index Word SBZ 31 32 A 31 A S 5 S 4 5 4 2 1 0 ...

Page 109: ... contains the following sections About the tightly coupled memory interface on page 5 2 TCM interface signals on page 5 4 TCM interface bus cycle types and timing on page 5 8 TCM programmer s model on page 5 19 TCM interface examples on page 5 20 TCM access penalties on page 5 29 TCM write buffer on page 5 30 Using synchronous SRAM as TCM memory on page 5 31 TCM clock gating on page 5 32 ...

Page 110: ...and the location of the TCM regions in the physical address space is controlled by the TCM Region Register see TCM Region Register c9 on page 2 29 The physical size of the TCM regions are defined by external inputs IRSIZE DRSIZE and ranges from 4KB to 1MB The encoding for these pins is shown in TCM Size field encoding on page 2 30 The TCM regions can be placed anywhere in the physical address map ...

Page 111: ...o generate wait states However the timing of these and other interface signals is such that the types of memory sub systems that can be implemented are limited For example schemes that require an address decode to determine if a wait state should be inserted are not possible if operating at maximum frequency DMA access can be performed either by using the IRWAIT DRWAIT signals to insert wait state...

Page 112: ...es place in the next cycle 5 2 1 Data interface signals The signals in the DTCM interface can be grouped by function into four categories Control signals DRCS DRWAIT DRIDLE Address and attribute signals DRSEQ DRADDR 17 0 DRWBL 3 0 DRnRW Data signals DRRD 31 0 DRWD 31 0 DMA signals DRDMAEN DRDMACS DRDMAADDR 17 0 Control signals The control signals for the data interface are DRCS DRCS is used to ind...

Page 113: ...valid with the exception of DRSEQ which also has a defined value during wait states when DRCS is not valid DRSEQ When DRCS is asserted and valid DRSEQ indicates if the address for the current TCM access is sequential to the previous access During wait states DRSEQ is forced HIGH DRADDR 17 0 DRADDR is the word 32 bit address for the transfer DRnRW DRnRW indicates if the access is a read or a write ...

Page 114: ...DMA values should be used to produce DRCS and DRADDR rather than those from the internal ARM926EJ S TCM controller DRDMACS DRDMACS is used to generate DRCS when DRDMAEN is asserted Because of the way the DRDMACS signal is combined with the internal ARM926EJ S TCM controller it is not valid to assert DRDMAEN without DRDMACS asserted unless the internal TCM controller is idle DRIDLE asserted The rel...

Page 115: ...DLE Address and attribute signals IRSEQ IRADDR 17 0 IRWBL 3 0 IRnRW Data signals IRRD 31 0 IRWD 31 0 DMA signals IRDMAEN IRDMACS IRDMAADDR 17 0 5 2 3 Differences between DTCM and ITCM There are three differences between the DTCM and ITCM interfaces DMA to ITCM should not occur be performed unless IRIDLE is asserted Only back to back transfers on the DTCM can be marked as sequential On the ITCM idl...

Page 116: ...data A 1 is the first waited data cycle In this cycle the values of DRADDR DRnRW and DRWBL are no longer valid and their value is non deterministic and DRSEQ is asserted The value on DRWD remains the same if the access is a write As in the request cycle DRWAIT indicates if the access will complete in the following cycle In the penultimate data cycle data A n 1 DRWAIT is deasserted indicating that ...

Page 117: ... cycle T3 no request is made and data is returned for the access to A 1 In cycle T4 a sequential request is made to A 2 In cycle T5 a nonsequential request is made to address B and data is returned for the access to A 2 In cycle T6 a nonsequential request is made to address C and data is returned for the access to B It is important to note that for the ITCM interface cycles of a sequential request...

Page 118: ...T5 a sequential read request is made to address C 1 and data is returned for the access to C In cycle T6 a nonsequential byte write request is made to address D 5 3 2 DMA access to zero wait state TCM For DMA accesses to zero wait state memories the TCM DMA interface can be used which enables an alternative source of address and chip select to be passed through to the TCM memories without impactin...

Page 119: ...ls DMA can be done without impacting timing on these outputs All other TCM interface outputs are non timing critical and can be multiplexed externally The logic used to combine the DMA chip select with the internal chip select signals is designed so that if the DMA inputs are selected then the DMA chip select is also asserted If this is not the case then the chip select output value is non determi...

Page 120: ...nal TCM controller attempts to output values corresponding to a sequential request to address B 2 DRDMAEN is asserted and the value of DRADDR and DRSEQ change accordingly The ARM926EJ S TCM controller is stalled In cycle T5 DRDMAEN is deasserted and the ARM926EJ S TCM controller re issues the request to address B 2 Because of the intervening DMA access DRSEQ is deasserted for the repeated request ...

Page 121: ...e generation of IRWAIT can be used to generate a single wait state for every ITCM access Figure 5 6 Generating a single wait state for ITCM accesses using IRWAIT In cycle T1 IRWAIT is asserted but no request is made In cycle T2 IRWAIT is asserted and a request is made In cycle T3 IRWAIT is deasserted indicating that the access to A will complete in the following cycle In cycle T4 IRWAIT is asserte...

Page 122: ...IRSEQ DRSEQ signals indicate if an access is sequential in the request cycle for an access and are held HIGH during waited cycles This behaviour enables a loopback arrangement where the SEQ output can be fed directly back into the WAIT input through an inverter to produce a single cycle wait state for nonsequential accesses as shown in Figure 5 8 Figure 5 8 Loopback of SEQ to produce a single cycl...

Page 123: ...RWAIT is asserted In cycle T6 IRSEQ is asserted because of the wait state IRWAIT is deasserted IRCS is unknown In cycle T7 the access to B completes For systems that also require DMA access to non zero wait state memories the WAIT signal is used to stall the ARM92EJ S processor for both wait states and DMA arbitration Apart from the DRWD IRWD write data signals the information required to perform ...

Page 124: ...al is an override signal used to force the ARM926EJ S access to be treated as nonsequential because of an intervening DMA access The A WE and nRW inputs to the TCM are either sourced directly from the ARM926EJ S TCM interface from the DMA controller or from the capture register clocked by REQCLK if the ARM926EJ S access is postponed because of DMA activity The cycle timing of the circuit shown in ...

Page 125: ...registered In cycle T2 the DMA access is still active two cycle nonsequential access DRWAIT is held HIGH because of DMAWAIT In cycle T3 the DMA access completes and DMAWAIT is deasserted The access attributes captured at the end of T1 are used to generate the CS A and WE signals for the TCM DRWAIT is asserted because of FORCE_NSEQ In cycle T4 FORCE_NSEQ is deasserted causing DRWAIT to be deasserte...

Page 126: ... access to A 1 completes A sequential request is made to A 2 There is no DMA activity In cycle T7 the access to A 2 completes No request is made and DRCS is deasserted A DMA access to address C starts and DRWAIT is asserted using DMAWAIT In cycle T8 DRWAIT remains HIGH because of DMA access No request is made and DRCS remains LOW In cycle T9 the DMA access to C completes A nonsequential request is...

Page 127: ...M Region Register See TCM Region Register c9 on page 2 29 Note If INITRAM 1 and VINITHI 1 the ITCM is enabled at system reset but the ARM926EJ S processor boots from 0xFFFF0000 5 4 2 Enabling the DTCM Unlike the ITCM there is no way of automatically enabling the DTCM at reset The DTCM can only be enabled by writing to the DTCM Region Register See TCM Region Register c9 on page 2 29 5 4 3 Disabling...

Page 128: ...s the responsibility of the implementer 5 5 1 Zero wait state RAM example Figure 5 12 shows the simplest RAM interface where the RAM block is constructed from a single word wide RAM that has byte write control The TCM interface can connect directly to the RAM block This is a zero wait state memory so DRWAIT is tied LOW Figure 5 12 Zero wait state RAM example 5 5 2 Producing byte writable memory us...

Page 129: ... DRWBL 3 indicates the MSB In big endian mode DRWBL 3 indicates the LSB of the word and DRWBL 0 indicates the MSB 5 5 3 Multiple banks of RAM example If you have to create a large memory out of smaller RAM blocks there are two methods for doing this If minimizing power consumption is more important than a fast design you must follow the example in Optimizing for power on page 5 22 32K RAM b0110 DI...

Page 130: ...n bits the address port of the smaller RAM blocks is m n logb log2 bits wide Address bits m 1 0 are applied to all the RAM blocks Address bits n 1 m are gated with DRCS for a power optimized solution or with IRnRW for a speed optimized solution Pipelined address bits n 1 m are used to select the correct RAM read data Optimizing for power Figure 5 14 on page 5 23 shows how to produce a large memory...

Page 131: ...ite enable control is required for each RAM block WE_bank0 DRADDR 14 DRnRW WE_bank1 DRADDR 14 DRnRW No logic is added to the critical DRCS path but both RAMs are enabled whenever DRCS is asserted resulting in higher power consumption DRSIZE 3 0 DRIDLE DRCS DRSEQ DRWAIT ARM926EJ S RAM 64KB CLK CS DOUT 31 0 RAM 64KB CLK CS DOUT 31 0 b1000 DRADDR 14 DRRD 31 0 DRADDR 13 0 DRWD 31 0 DRADDR 17 0 DRWBL 3...

Page 132: ...structions can cycle at the same frequency as the ARM926EJ S processor it is interfaced to However the memory access time for the ROM time from chip select address to data out is not fast enough to be directly interfaced to the ARM926EJ S processor DRCS DRSEQ DRWAIT ARM926EJ S RAM 64KB CLK CS DOUT 31 0 RAM 64KB CLK CS DOUT 31 0 DRRD 31 0 DRADDR 13 0 DRWD 31 0 DRADDR 17 0 DRWBL 3 0 DRWD 31 0 CLK DI...

Page 133: ...e incrementer is captured at the end of every cycle where the ROM CS chip select is active The address source for the ROM is switched over to the registered version of IRADDR when a nonsequential access occurs Figure 5 17 on page 5 26 shows the timing of the ROM address chip select and read data relative to the ARM926EJ S TCM interface signals The address supplied to the ROM can either be behind i...

Page 134: ... 18 on page 5 27 shows an example TCM subsystem using the DMA interface The signal driving DRDMAEN is connected to both the DRDMAEN and DRDMACS inputs It is also used to control the multiplexing of the non timing critical signals WBL nRW and WD although this is not shown for clarity CLK IRCS IRWAIT IRRD T1 T2 T3 T4 T5 T6 IRADDR A A 1 I A IRSEQ T7 A 2 I A 1 A 3 A 4 CS A A A 1 A 2 A 3 A 4 I A I A 2 ...

Page 135: ...dding a collar of multiplexors around the memory inputs However this method will add undesirable delays to the chip select and address signals This can be avoided by using the DMA interface to perform the multiplexing of address and chip select values This is shown in Figure 5 19 on page 5 28 SRAM DRWD 31 0 DMARD 31 0 DRWBL 3 0 DRDMAADDR 17 0 CS WD 31 0 ARM926EJ S 1 0 DMA 1 0 1 0 DMAWBL 3 0 DMAnRW...

Page 136: ...ecessary to hold the ARM926EJ S core in such a state that the internal value of the chip select is guranteed to be LOW This can be done by holding the ARM926EJ S in reset HRESETn LOW during TCM memory BIST testing Note that this requires that HRESETn cannot also be used as a reset control to the BIST controller SRAM DRWD 31 0 BISTRD 31 0 DRWBL 3 0 DRDMAADDR 17 0 CS WD 31 0 ARM926EJ S 1 0 BIST 1 0 ...

Page 137: ...ess the ITCM To maximize the performance of the ITCM data read accesses to the ITCM are pipelined The ARM926EJ S core is stalled for two cycles to enable the pipeline read to complete This is the only ARM926EJ S TCM interface stall scenario The inclusion of a write buffer in the TCM controller has eliminated all other sources of potential stalling for zero wait state TCM ...

Page 138: ... of order with respect to instruction execution If a read access occurs to a location that also has a corresponding entry in the write buffer then data is forwarded from the write buffer If it is necessary to ensure that all outstanding writes have completed on the TCM interface then the CP15 drain write buffer instruction can be used MCR p15 0 Rd c7 c10 4 This instruction does not complete execut...

Page 139: ...rite control you must construct the word wide RAM out of four byte wide RAMs See Producing byte writable memory using word writable RAM on page 5 20 If your compiler cannot produce a single RAM block that is the required size or if a single RAM block does not meet the timing requirements In these cases you must produce the RAM out of two or more blocks of smaller RAM See Multiple banks of RAM exam...

Page 140: ...CM IRIDLE for ITCM is asserted This indicates that a TCM access will not be performed in that cycle enabling you to stop the TCM clock If no clock stopping is required you can ignore the idle signals You can also use the idle signal to disable power to the RAMs if you require more stringent power control Removing the RAM power invalidates the RAM contents so you must only do this if the TCMs are n...

Page 141: ...RM Limited All rights reserved 6 1 Chapter 6 Bus Interface Unit This chapter describes the ARM926EJ S Bus Interface Unit BIU It contains the following sections About the bus interface unit on page 6 2 Supported AHB transfers on page 6 3 ...

Page 142: ...e the Multi layer AHB Overview and multi AHB systems to be implemented giving the benefit of increased overall bus bandwidth and a more flexible system architecture Each master is a fully compliant AHB bus master and implements the master functions as defined in the AMBA Specification Rev 2 0 To increase system performance write buffers are used to prevent AHB writes stalling the ARM926EJ S system...

Page 143: ...red not only to load code but to enable access to PC relative literal pools and for SWI and emulated instruction handlers to work Note This is unlike some Harvard arrangements whereby the I bus can be connected to the ROM and the D bus only connected to RAM peripherals 6 2 2 Transfer size The ARM926EJ S processor performs all AHB accesses as single word bursts of four words or bursts of eight word...

Page 144: ...and writes are performed as byte HSIZE 2 0 000 halfword HSIZE 2 0 001 or word wide transfers HSIZE 2 0 010 Table 6 1 Supported HBURST encodings HBURST 2 0 Description Operation Single Single transfer Single transfer of word halfword or byte data write NCNB NCB WT or WB that has missed in DCache data read NCNB or NCB NC instruction fetch prefetched and non prefetched page table walk read continuati...

Page 145: ... apply for LDM LDRD and LDC operations Similarly those for STR apply for STM STRD and STC operations A DCache write back can be caused either by an eviction during a linefill or an explicit cache clean operation Table 6 2 IHPROT 3 0 and DHPROT 3 0 attributes Operation IHPROT 3 0 or DHPROT 3 0 Description DCache linefill 1 1 Priva 1 a Priv indicates if the access was caused by a privileged 1 or Use...

Page 146: ...t specify any explicit support for endianness The ARM926EJ S processor provides a supplementary signal DHBL that indicates which bytes are to be updated for write transfers and which bytes should contain valid data for reads This is created using the address and the endianness of the access The CFGBIGEND signal indicates the current endianness setting used by the ARM9EJ S core and reflects the val...

Page 147: ... an extra cycle of latency to get onto the bus if the bus is currently idle This means that if the data BIU is the default bus master it can start AHB transactions a cycle earlier than the instruction BIU nondefault bus master which must wait for ownership of the bus to be handed over This cycle of latency only exists for the first transaction If the instruction BIU is prefetching instructions for...

Page 148: ...instruction memory Each AHB system can be running at different frequencies The ARM926EJ S processor is able to cope with this by providing two HCLKEN inputs DHCLKEN is used to specify the rising HCLK edge for the system in which the data BIU is the master IHCLKEN is used to specify the rising HCLK edge for the system in which the instruction BIU is the master Figure 6 2 on page 6 9 shows an exampl...

Page 149: ... single and multi layer AHB systems the arbitration priority of the two masters determines which of the masters is granted the bus if both make a simultaneous request if the granted master receives a Split or Retry response the other master can be granted the bus and complete its transaction before the split master completes For multi AHB systems the two systems can be operating at different frequ...

Page 150: ...he system instruction BIU bus master Figure 6 3 shows the relationships between CLK HCLK DHCLKEN and IHCLKEN Figure 6 3 AHB clock relationships For single and multi layer AHB systems DHCLKEN and IHCLKEN must be tied together If HCLK and CLK are the same frequency the relevant HCLKEN input or inputs must be tied HIGH CLK and HCLK must be synchronous The skew between CLK and HCLK must be minimized 6...

Page 151: ...red writes an Error response is ignored If the ARM926EJ S processor is to be used in a system which has to be tolerant to soft errors in external memory then both soft error detection and correction must be done in hardware at the time the AHB transfer is made The DHREADY and IHREADY signals can be used to extend the transfer until corrected data is available ...

Page 153: ...imited All rights reserved 7 1 Chapter 7 Noncachable Instruction Fetches This chapter describes noncachable instruction fetches in the ARM926EJ S processor It contains the following section About noncachable instruction fetches on page 7 2 ...

Page 154: ...nabled see Chapter 4 Caches and Write Buffer and that cache pollution can be controlled using the cache lockdown register see Cache Lockdown and TCM Region Registers c9 on page 2 26 7 1 2 Self modifying code A four word buffer is used to hold speculatively fetched instructions Only sequential instructions are fetched speculatively and in the event of the ARM9EJ S core issuing a nonsequential instr...

Page 155: ...Instruction Memory Barrier 7 1 3 AHB behavior If instruction prefetching is disabled all instruction fetches appear on the AHB interface as single nonsequential fetches If prefetching is enabled then instruction fetches either appear as bursts of four instructions or as single nonsequential fetches No speculative instruction fetching is done across a 1KB boundary All instruction fetches including ...

Page 157: ...M926EJ S coprocessor interface It contains the following sections About the ARM926EJ S external coprocessor interface on page 8 2 LDC STC on page 8 4 MCR MRC on page 8 6 CDP on page 8 8 Privileged instructions on page 8 9 Busy waiting and interrupts on page 8 10 CPBURST on page 8 11 CPABORT on page 8 12 nCPINSTRVALID on page 8 13 ...

Page 158: ...coprocessor pipeline must operate one clock cycle behind the ARM9EJ S core pipeline The two pipelines are synchronized by stalling the ARM9EJ S core pipeline in its first Execute cycle whenever an external coprocessor instruction moves from the Decode to the Execute stage To enable coprocessors to continue execution of coprocessor data operations while the ARM9EJ S core pipeline is stalled for exa...

Page 159: ...ed and the coprocessor pipeline should not advance Coprocessor instructions There are three classes of coprocessor instructions LDC or STC Load coprocessor register from memory or store coprocessor register to memory MCR MCRR or MRC MRRC Register transfer between the coprocessor and the ARM processor core CDP Coprocessor data operation Examples of how a coprocessor must execute these instruction c...

Page 160: ...CPMREQ nCPMREQ is an active LOW signal that indicates if the ARM9EJ S pipeline has advanced CPINSTR is updated with the fetched instruction in the next cycle This means that the instruction currently on CPINSTR must enter the Decode stage of the coprocessor pipeline and that the instruction in the Decode stage of the coprocessor pipeline must enter its Execute stage During the Execute stage the co...

Page 161: ...o occur If CHSEX 1 0 changes to ABSENT then the undefined instruction trap is taken If CHSEX 1 0 changes to GO or LAST then the instruction proceeds as described in GO If an interrupt occurs then the ARM9EJ S core is forced out of the busy wait state This is indicated to the coprocessor by the CPPASS signal going LOW When the instruction is restarted the coprocessor must not commit to the instruct...

Page 162: ... pass and the instruction is to be executed the CPPASS signal is driven HIGH and the CHSDE 1 0 handshake bus is examined it is ignored in all other cases For any successive execute cycles the CHSEX 1 0 handshake bus is examined When the LAST condition is observed the instruction is committed In the case of an MCR the CPDOUT 31 0 bus is driven with the register data during the coprocessor Write sta...

Page 163: ...he register being transferred is the destination from a preceding LDR instruction In this situation the MCR instruction enters the Decode stage of the coprocessor pipeline and remains there for a number of cycles before entering the Execute stage Figure 8 5 shows an example of an interlocked MCR Figure 8 5 Interlocked MCR MCR MRC WAIT LAST Ignored Coproc data Decode interlock Execute WAIT Execute ...

Page 164: ... 0 with WAIT and then CHSEX 1 0 with LAST Figure 8 6 shows a CDP that is canceled due to the previous instruction causing a Data Abort Figure 8 6 Latecanceled CDP The CDP instruction enters the Execute stage of the pipeline and is signaled to execute by CPPASS In the following phase CPLATECANCEL is asserted This causes the coprocessor to terminate execution of the CDP instruction and for it to cau...

Page 165: ...privileged modes only To do this the coprocessor has to track the nCPTRANS output Figure 8 7 shows how nCPTRANS changes after a mode change Figure 8 7 Privileged instructions Decode Execute Memory CLK CPINSTR 31 0 nCPMREQ nCPTRANS CPLATECANCEL CHSDE 1 0 CHSEX 1 0 Coprocessor pipeline Instruction aborted Fetch CPRT Ignored LAST Ignored Decode Ignored Decode Old mode New mode CPPASS ...

Page 166: ...ep the instruction in the busy wait loop For interrupt latency reasons the coprocessor might be interrupted while busy waiting causing the instruction to be abandoned using CPPASS The coprocessor must monitor the state of CPPASS during every busy wait cycle If it is HIGH the instruction must be executed If it is LOW the instruction must be abandoned Figure 8 8 shows a busy waited coprocessor instr...

Page 167: ...ngle word transfer and an unknown number of transfers is the same If CPBURST is set to b0000 for an STC or LDC operation and this results in an access to either a noncached or nonbuffered region of memory then any resultant AHB bus transfers are performed as individual nonsequential accesses CPBURST is driven by external coprocessors in the same cycle as the CHSDE response This must be driven to b...

Page 168: ...as aborted CPABORT is asserted in the cycle after the Memory stage of the aborting LDC STC instruction This is shown in Figure 8 9 Figure 8 9 CPBURST and CPABORT timing CLK CPINSTR 31 0 nCPMREQ CHSDE 1 0 CHSEX 1 0 Coprocessor pipeline Execute 1 Fetch LDC STC GO Decode Memory 1 Write 1 ABSENT LAST Execute 2 Memory 2 Write 2 ABSENT 0001 0000 0000 CPBURST CPDIN 3 0 CPDOUT 3 0 CPABORT ...

Page 169: ...uction currently on the CPINSTR bus is valid and should be decoded by the coprocessor If nCPINSTRVALID is 1 then the instruction should not be decoded by the coprocessor and an ABSENT response should be made for all corresponding Decode cycles for this instruction nCPINSTRVALID is the equivalent of the CPTBIT signal in the ARM946E S and ARM966E S processors ...

Page 170: ...ixed response of b10 Absent when it is inactive The other external coprocessor inputs CPDIN and CPBURST are combined by ORing This is shown in Figure 8 10 Figure 8 10 Arrangement for connecting two coprocessors The OR arrangement for CPBURST and CPDIN means that coprocessors must drive zero values onto their CPBURST and CPDIN outputs when they are inactive or do not own the corresponding coprocess...

Page 171: ... Chapter 9 Instruction Memory Barrier This chapter describes the ARM926EJ S Instruction Memory Barrier IMB operation It contains the following sections About the instruction memory barrier operation on page 9 2 IMB operation on page 9 3 Example IMB sequences on page 9 5 ...

Page 172: ...IMB operation must be used to ensure consistency between the data and instruction streams processed by the ARM926EJ S processor Usually the instruction and data streams are considered to be completely independent by the ARM926EJ S processor memory system and any changes in the data side are not automatically reflected in the instruction side For example if code is modified in main memory then the ...

Page 173: ...che maintenance operations 9 2 2 Drain the write buffer Executing a drain write buffer instruction causes the ARM9EJ S core to wait until outstanding buffered writes have completed on the AHB interface This includes writes that occur as a result of data being written back to main memory because of clean operations and data for store instructions 9 2 3 Synchronize data and instruction streams in le...

Page 174: ...o remove any stale copies of instructions that are no longer valid If the ICache is not being used or the modified regions are not in cachable areas of memory then this might not be required 9 2 5 Flush the prefetch buffer To ensure consistency the prefetch buffer should be flushed before self modifying code is executed See Self modifying code on page 7 2 ...

Page 175: ...c10 4 drain write buffer STR rx ry nonbuffered store to signal L2 world to synchronize MCR p15 0 r0 c7 c5 0 invalidate icache The following sequence illustrates an IMB sequence used after modifying a single instruction for example setting a software breakpoint with no external synchronization required STR rx ry store that modifies instruction at address ry MCR p15 0 ry c7 c10 1 clean dcache single...

Page 177: ...All rights reserved 10 1 Chapter 10 Embedded Trace Macrocell Support This chapter describes the Embedded Trace Macrocell ETM support for the ARM926EJ S processor It contains the following section About Embedded Trace Macrocell support on page 10 2 ...

Page 178: ...comparators counter and sequencers The ETM is used to compress the trace information and export it through a narrow trace port An external Trace Port Analyzer TPA is used to capture the trace information The ARM926EJ S ETM interface exports the required signals for the ETM to perform trace The interface is enabled and disabled by the ETMEN input signal Where an ETM module is not required the ETMEN...

Page 179: ...M Limited All rights reserved 10 3 Note Stalling the core with FIFOFULL affects real time operating performance If connected an ETM must be disabled during normal ARM926EJ S processor operation to prevent FIFOFULL adversely affecting the ARM926EJ S processor performance ...

Page 181: ...pyright 2001 2003 ARM Limited All rights reserved 11 1 Chapter 11 Debug Support This chapter describes the debug support for the ARM926EJ S processor It contains the following section About debug support on page 11 2 ...

Page 182: ... S processor 11 1 1 Debug clocks The system and test clocks must be synchronized externally to the ARM926EJ S macrocell To synchronize off chip debug clocking with the ARM926EJ S macrocell requires a three state synchronizer This is described in the debug chapter of the ARM9EJ S Technical Reference Manual 11 1 2 Scan chain 15 Scan chain 15 enables access to the CP15 registers Scan chain 15 is 48 b...

Page 183: ...o step 3 Note If Multi ICE is used then this has the restriction that a maximum of 40 bits of any scan chain can be written at a time Because scan chain 15 is 48 bits long CP15 register writes require two operations to write all the required bits and initiate the access This can be done by first writing bits 31 0 with the required data value and bit 32 to 0 This has the effect of presetting the da...

Page 184: ...ent MCR instruction Memory system debug operations CRn c15 which require an address to be used to select an entry use the value held in the debug address register see Debug and Test Address Register on page B 4 The format of the address field is identical to that used for the value of Rd for the equivalent MCR instruction If an invalid instruction is scanned into scan chain 15 it is translated int...

Page 185: ...003 ARM Limited All rights reserved 12 1 Chapter 12 Power Management This chapter describes the power management facilities provided by the ARM926EJ S processor It contains the following section About power management on page 12 2 ...

Page 186: ...rrupt mode all internal ARM926EJ S clocks can be stopped The switch into the low power state is delayed until all write buffers have been drained and the ARM926EJ S memory system is in a quiescent state The switch into low power state is indicated by the assertion of the STANDBYWFI signal If STANDBYWFI is asserted then it is guaranteed that all of ARM926EJ S external interfaces AHB TCM and externa...

Page 187: ...nally to maintain the relationship between the ARM926EJ S JTAG logic and the RTCK signal used by the debugger See the ARM9EJ S Technical Reference Manual for details of how DBGTCKEN is generated and used 12 1 2 Static power management leakage control The ARM926EJ S design is partitioned so that the SRAM blocks that are used for the caches and the MMU can be powered down under certain conditions Ca...

Page 188: ...as been disabled using CP15 control register c1 and it contains no valid entries While the MMU is disabled only explicit CP15 operations can cause the MMU RAM to be accessed c8 TLB maintenance operations and c15 MMU test debug operations These instructions must not be executed while the MMU RAM is powered down The MMU RAM must be powered up prior to re enabling the MMU ...

Page 189: ...cessor input and output signals It contains the following sections Signal properties and requirements on page A 2 AHB related signals on page A 3 Coprocessor interface signals on page A 5 Debug signals on page A 7 JTAG signals on page A 9 Miscellaneous signals on page A 10 ETM interface signals on page A 12 TCM interface signals on page A 14 ...

Page 190: ... all signals and buses are unidirectional all inputs are required to be synchronous to the single clock These techniques simplify the definition of the top level ARM926EJ S processor signals because all outputs change from the rising edge and all inputs are sampled with the rising edge of the clock In addition all signals are either input or output only Bidirectional signals are not used Note You ...

Page 191: ...HB bus grant signal data DHLOCK Output AHB bus lock signal data DHPROT 3 0 Output AHB bus access information data DHRDATA 31 0 Input AHB read data data DHREADY Input AHB transfer complete signal data DHRESP 1 0 Input AHB transfer response data DHSIZE 2 0 Output AHB transfer size data indicating byte halfword or word DHSIZE 2 is tied LOW DHTRANS 1 0 Output AHB transfer type data DHWDATA 31 0 Output...

Page 192: ...ruction IHREADY Input AHB transfer complete signal instruction IHRDATA 31 0 Input AHB read data instruction IHRESP 1 0 Input AHB transfer response instruction IHSIZE 2 0 Output AHB transfer size instruction indicating byte halfword or word IHSIZE 2 is tied LOW IHTRANS 1 0 Output AHB transfer type instruction IHWRITE Output AHB transfer direction instruction Table A 1 AHB related signals continued ...

Page 193: ... Coprocessor read data Output The coprocessor data bus for transferring data to the coprocessor CPEN Coprocessor enable Input When LOW disables the external coprocessor interface If CPEN is LOW then CHSDE and CHSEX must both be driven to b10 ABSENT response CPINSTR 31 0 Coprocessor instruction data Output The coprocessor instruction bus that instructions are transferred over to the pipeline follow...

Page 194: ...onse nCPINSTRVALID Coprocessor valid instruction Output Valid instruction indicator for CPINSTR replaces CPTBIT nCPMREQ Not coprocessor instruction request Output If this signal is LOW on the rising edge of CLK and CPCLKEN is HIGH the instruction on CPINSTR must enter the coprocessor pipeline nCPTRANS Not coprocessor memory translate Output When LOW the coprocessor interface is in a nonprivileged ...

Page 195: ...on of the processor for debug purposes If HIGH at the end of a data memory request cycle it causes the ARM926EJ S processor to enter debug state DBGEN Debug enable Input Enables the debug features of the processor This signal must be tied LOW if debug is not required DBGEXT 1 0 EmbeddedICE RT external input Input Inputs to the EmbeddedICE RT logic that enable breakpoints or watchpoints to be depen...

Page 196: ... and control buses This signal is independent of the state of the watchpoint enable control bit DBGRQI Internal debug request Output Represents the debug request signal that is presented to the core debug logic This is a combination of EDBGRQ and bit 1 of the debug control register EDBGRQ External debug request Input An external debugger can force the processor into debug state by asserting this s...

Page 197: ...out of the DBGTDO output Normally used as an output enable for a DBGTDO pin in a packaged part DBGSCREG 4 0 Output These five bits reflect the ID number of the scan chain currently selected by the TAP controller These bits change when the TAP controller is in the UPDATE DR state DBGSDIN External scan chain serial input data Output Contains the serial data to be applied to an external scan chain DB...

Page 198: ... operations Through the use of the DBGTCKEN signal this clock also controls JTAG and debug operations CFGBIGEND ARM9EJ S core endianness configuration Output This signal reflects the setting of the B bit in CP15 c1 When HIGH the processor treats bytes in memory as being in big endian format When LOW memory is treated as little endian EXTEST Input EXTEST mode test signal This signal must be LOW dur...

Page 199: ... to 0x07926F0F for an ARM926EJ S processor when the device is instantiated TESTMODE Input Test mode test signal This signal must be LOW during normal operation VINITHI Exception vector location at reset Input Determines the reset location of the exception vectors When LOW the vectors are located at 0x00000000 When HIGH the vectors are located at 0xFFFF0000 Table A 5 Miscellaneous signals continued...

Page 200: ...MORE Output ETM more sequential data indication ETMDnMREQ Output ETM data memory request ETMDnRW Output ETM data not read write ETMDSEQ Output ETM sequential data indication ETMEN Input Synchronous ETM interface enable This signal must be tied LOW if an ETM is not used ETMHIVECS Output ETM exception vectors configuration ETMIA 31 0 Output ETM instruction address ETMIABORT Output ETM instruction ab...

Page 201: ...PROCIDWR Output ETMPROCID write strobe ETMRDATA 31 0 Output ETM read data ETMRNGOUT 1 0 Output ETM watchpoint register match indication ETMWDATA 31 0 Output ETM write data ETMZIFIRST Output Indicates the current Decode cycle is the first being traced for the current Java instruction ETMZILAST Output Indicates the current Decode cycle is the last being traced for the current Java instruction FIFOFU...

Page 202: ...to DRADDR DRDMAEN Input DMA access cycle If asserted DRADDR is directly sourced from DRDMAADDR and DRCS is the result of logically ORing DRDMACS with the chip select value for the current TCM access DRDMACS Input Direct memory access chip select for DTCM DRIDLE Output Data TCM interface idle 0 TCM access 1 no access will take place in the current cycle or TCM disabled Not valid for DMA accesses DR...

Page 203: ...eads set to b0000 For writes indicates which byte s are to be written depending on the address and the size of the access word halfword or byte Bits of DRWBL are set only when a write is taking place so when DnRW is unset all the bits of DRWBL are also unset DRWD 31 0 Output Data TCM write data Valid during request cycles when DRnRW is 0 Valid during waited write cycles INITRAM Input Enables instr...

Page 204: ... valid for DMA accesses IRnRW Output Instruction TCM read not write 0 read 1 write Indicates if the access is a read or write Valid during request cycles IRRD 31 0 Input Instruction TCM read data Valid during non waited data cycles IRSEQ Output Request sequential Valid during request cycles asserted during wait cycles Indicates that the address in the current cycle is sequential to the address use...

Page 205: ...M write data byte lane indicator Valid during request cycles For reads set to b0000 For writes indicates which byte s are to be written depending on the address and the size of the access word halfword or byte Bits of IRWBL are set only when a write is taking place so when IRnRW is unset all the bits of IRWBL are also unset IRWD 31 0 Output Instruction TCM write data Valid during request cycles wh...

Page 207: ...003 ARM Limited All rights reserved B 1 Appendix B CP15 Test and Debug Registers This appendix describes the ARM926EJ S CP15 Test and Debug Registers It contains the following section About the Test and Debug Registers on page B 2 ...

Page 208: ...ual describes this register as implementation defined The format of the CP15 test and debug operations is MCR MRC p15 Opcode_1 Rd c15 CRm Opcode_2 The MRC and MCR bit pattern is shown in Figure B 1 Figure B 1 CP15 MRC and MCR bit pattern The L bit distinguishes between an MCR L 1 and an MRC L 0 B 1 1 Debug Override Register You can use the Debug Override Register to modify the behavior of the ARM9...

Page 209: ...egion remap register Table B 1 Debug Override Register Bits Function or name Description 31 20 Reserved Read Unpredictable Write Should Be Zero 19 Test and clean all 0 Default behavior for test and clean instructions 1 Modifies the behavior of test and clean and test clean and invalidate instructions so that they act on the complete cache 18 Abort data TLB miss 0 Do not abort DTLB miss 1 Abort DTL...

Page 210: ...ult in instruction fetches on the AHB interface Bits 17 18 abort instruction TLB miss You can use the abort data TLB miss and abort instruction TLB miss bits to prevent page table walks occurring as the result of a TLB miss When set a TLB miss results in the access being aborted as if the access has resulted in a translation fault and a value of 0000 being written into the status field of the appr...

Page 211: ... stalled if FIFOFULL is asserted Table B 2 shows the bit assignments for the Trace Control Register Bits 2 1 of this register are reset to 0 B 1 4 MMU test operations The MMU test operations support accessing TLB structures in the MMU and are used in conjunction with the Debug and Test Address Register You can access the MMU test operations using the instructions in Table B 3 Table B 2 Trace Contr...

Page 212: ...5 c5 0 Read PA and access permission data in main TLB entry Write PA and access permission data data in main TLB entry MCR p15 4 5 Rd c15 c7 0 Transfer main TLB entry into RAM MRC P15 4 5 Rd c15 c2 1 MCR P15 4 5 Rd c15 c3 1 Read tag in lockdown TLB entry Write tag in lockdown TLB entry MRC P15 4 5 Rd c15 c4 1 MCR P15 4 5 Rd c15 c5 1 Read PA and access permission data in lockdown TLB entry Write PA...

Page 213: ...register 3 Use the following MMU Test Register instructions to access the PA and access permission data MRC p15 4 5 Rd c15 c4 0 read PA and access permission data 30 15 Should Be Zero 14 10 Indexed entry Indexed entry in main TLB 9 0 Should Be Zero Table B 4 Encoding of the main TLB entry select bit fields Bit Name Definition 0 MVA tag SBZ 4 3 9 5 10 31 V Size of entry Table B 5 Encoding of the TL...

Page 214: ...ge into RAM To write an entry into the 2 way main TLB the full sequence is therefore MCR p15 4 5 Rd c15 c3 0 write tag main TLB storage reg MCR p15 4 5 Rd c15 c5 0 write PA PROT main TLB storage reg MCR p15 4 5 Rd c15 c7 0 transfer main storage into RAM 4 3 0 PA 9 Domain select SBZ 1 2 C AP 1 0 B 31 10 7 8 Table B 6 Encoding of the TLB entry PA and AP bit fields Bit Name Definition 31 10 PA Physic...

Page 215: ...own below and would appear on MMUxWD 111 0 as shown in Table B 7 During writes the data is replicated so that each way receives the same copy of the data The exact way that is written and the exact index of the way is specified in the Test and Debug Address Register Figure B 5 on page B 10 shows what happens during a write to the data RAM attached to the main MMU Table B 7 Main TLB mapping to MMUx...

Page 216: ...UxWE 2 0 read 1 write MMUxWD 85 57 into RAM MMUxWE 3 0 read 1 write MMUxWD 111 86 into RAM In the case of the main MMU the output enable MMUxOE is driven at all times The MMUxRD data bus must be strongly driven at all times The controller samples the data from the MMUxRD data bus when a read is being performed Inserting or reading entries in the lockdown TLB Use this procedure to access entries in...

Page 217: ... for the read or write data in the Rd register 4 Use the following instruction to complete a write to an entry MCR p15 4 Rd c15 c7 1 transfer lockdown storage into RAM To write an entry into the lockdown TLB the full sequence is therefore MCR p15 4 5 Rd c15 c3 1 write tag lockdown TLB storage reg MCR p15 4 5 Rd c15 c5 1 write PA PROT lockdown TLB storage reg MCR p15 4 5 Rd c15 c7 1 transfer lockdo...

Page 218: ... 0 write cache debug control register The Cache Debug Control Register format is shown in Figure B 7 Figure B 7 Cache Debug Control Register format The Cache Debug Control Register bit assignments are listed in Table B 9 The reset value of the Cache Debug Control Register is 0x0 0 SBZ DDL 1 2 DIL DWB 31 3 Table B 9 Cache Debug Control Register bit assignments Bit Name Function Description 31 3 Res...

Page 219: ... back to main memory to achieve coherency Disabling cache linefills Setting the DDL and DIL bits prevents the relevant cache from updating when performing a linefill on a miss When set a linefill is performed on a cache miss reading eight words from external memory but the cache is not updated with the linefill data The memory region mapping is unchanged This mode of operation is required for debu...

Page 220: ... in Table B 10 The reset value of the MMU Debug Control Register is 0x0 6 3 2 0 SBZ DMTMD 4 5 DMTLI DDUTM 1 DIUTL DMTLD DIUTM DMTMI DDUTL 7 31 8 Table B 10 MMU Debug Control Register bit assignments Bit Name Function Description 31 8 Reserved Read Unpredictable Write Should Be Zero 7 DMTMI Disable main TLB matching for instruction fetches 0 Enable matching 1 Disable matching 6 DMTMD Disable main T...

Page 221: ...re B 9 Memory Region Remap Register format 3 DIUTM Disable instruction micro TLB match 0 Enable I micro TLB load 1 Disable I micro TLB load 2 DDUTM Disable data micro TLB match 0 Enable D micro TLB match 1 Disable D micro TLB match 1 DIUTL Disable instruction micro TLB load 0 Enable D micro TLB load 1 Disable D micro TLB load 0 DDUTL Disable data micro TLB load 0 Enable I micro TLB load 1 Disable ...

Page 222: ...its for instruction side write through region b10 11 10 INCB Remap select bits for instruction side noncachable bufferable region b01 9 8 INCNB Remap select bits for instruction side noncachable nonbufferable region b00 7 6 DWB Remap select bits for data side write back region b11 5 4 DWT Remap select bits for data side write through region b10 3 2 DNCB Remap select bits for data side noncachable ...

Page 223: ...attributes of a memory reference Figure B 10 Memory region attribute resolution MMU Memory region remapping NCNB NCB CNB write through CB write back NCNB NCB CNB write through CB write back Force NCB store to be NCNB MDDEB bit MMU disabled DCache enabled Memory Region Remap Register Debug Override Register Page table descriptor FNCB bit Force NCB store to be NCNB C and B bits M C and I bits Contro...

Page 225: ...tch Abort Abort model An abort model is the defined behavior of an ARM processor in response to a Data Abort exception Different abort models behave differently with regard to load and store instructions that specify base register write back Access permission The mechanism that controls if a task or process is allowed to access sections or pages of memory If an access is attempted to an area of me...

Page 226: ...l than AHB It is designed for use with ancillary or general purpose peripherals such as timers interrupt controllers UARTs and I O ports Connection to the main system bus is through a system to peripheral bus bridge that helps to reduce system power consumption See also Advanced High performance Bus AHB See Advanced High performance Bus Aligned Aligned data items are stored so that their address i...

Page 227: ...teristics from the implementation process onto a model Banked registers Those physical registers whose use is defined by the current processor mode The banked registers are r8 to r14 Base register A register specified by a load or store instruction that is used to hold the base value for the instruction s address calculation Depending on the instruction and its addressing mode an offset can be add...

Page 228: ...that form the chain connected between TDI and TDO through which test data is shifted Processors can contain several shift registers to enable you to access selected parts of the device Breakpoint A breakpoint is a mechanism provided by debuggers to identify an instruction at which program execution is to be halted Breakpoints are inserted by the programmer to enable inspection of register contents...

Page 229: ...s glossary Cache line index The number associated with each cache line in a cache way Within each cache way the cache lines are numbered from 0 to set associativity 1 See also Cache terminology diagram on the last page of this glossary Cache lockdown To fix a line in cache memory so that it cannot be overwritten Cache lockdown enables critical instructions and or data to be loaded into the cache s...

Page 230: ... warm reset is required See also Warm reset Communications channel The hardware used for communicating between the software running on the processor and an external host using the debug interface When this communication is for debug purposes it is called the Debug Comms Channel In an ARMv6 compliant core the communications channel includes the Data Transfer Register some bits of the Data Status an...

Page 231: ...rocessor It carries out additional functions that the main processor cannot perform Usually used for floating point math calculations signal processing or memory management Copy back See Write back Core A core is that part of a processor that contains the ALU the datapath the general purpose registers the Program Counter and the instruction decode and control circuitry Core module In the context o...

Page 232: ...software faults together with custom hardware that supports software debugging Debug Test Access Port DBGTAP The collection of four mandatory and one optional terminals that form the input output and control interface to a JTAG boundary scan architecture The mandatory terminals are DBGTDI DBGTDO DBGTMS and TCK The optional terminal is TRST DBGnTRST This signal is mandatory in ARM cores because it ...

Page 233: ... 8 EmbeddedICE logic An on chip logic block that provides TAP based debug support for ARM processor cores It is accessed through the TAP controller on the ARM core using the JTAG interface EmbeddedICE RT The JTAG based hardware provided by debuggable ARM processors to aid debugging in real time Embedded Trace Buffer The ETB provides on chip storage of trace data using a configurable sized RAM Embe...

Page 234: ...ss starts If processes are switched often enough they can appear to a user to be running in parallel as well as being able to respond quicker to external events that might affect them In ARM processors a fast context switch is caused by the selection of a non zero PID value to switch the context to that of the next process A fast context switch causes each Virtual Address for a memory access gener...

Page 235: ...cations for exception vectors The high vector address range is near the top of the address space rather than at the bottom Host A computer that provides data and other services to another computer Especially a computer providing debugging services to a target being debugged ICache A block of on chip fast access memory locations situated between the processor and main memory used for storing and re...

Page 236: ...s Internal scan chain A series of registers connected together to form a path through a device used during production testing to import test patterns into internal nodes of the device and export the resulting values Interrupt handler A program that control of the processor is passed to when an interrupt occurs Interrupt vector One of a number of fixed addresses in low memory or in high memory if h...

Page 237: ...d writes of multiple words at a time rather than single words All memory banks are addressed simultaneously and a bank enable or chip select signal determines which of the banks is accessed for each transfer Accesses to sequential word addresses cause accesses to sequential banks This enables the delays associated with accessing a bank to occur during the access to its adjacent bank speeding up me...

Page 238: ... the cache Writes are performed to main memory through a write buffer so processor core execution can continue while the write is completed to main memory Noncachable Nonbufferable Is a memory region where reads are performed from main memory and are not allocated to the cache Writes are performed to main memory without buffering so processor core execution is halted while the write is completed P...

Page 239: ...tructions that are accelerated by hardware can cause a number of reads to occur according to the state of the Java stack and the implementation of the Java hardware acceleration RealView ICE A system for debugging embedded processor cores using a JTAG interface Region A partition of instruction or data memory space Remapping Changing the address of physical memory or devices after the application ...

Page 240: ...he generation of the result for each destination Should Be One SBO Should be written as 1 or all 1s for bit fields by software Writing a 0 produces Unpredictable results Should Be Zero SBZ Should be written as 0 or all 0s for bit fields by software Writing a 1 produces Unpredictable results Should Be Zero or Preserved SBZP Should be written as 0 or all 0s for bit fields by software or preserved by...

Page 241: ... interrupt handling scratchpad data data types whose locality is not suited to caching critical data structures such as interrupt stacks TLB See Translation Look aside Buffer Translation Lookaside Buffer TLB A cache of recently used page table entries that avoid the overhead of page table walking on every memory access Part of the Memory Management Unit Translation table A table held in memory tha...

Page 242: ... are using the debugging features of a processor Watchpoint A watchpoint is a mechanism provided by debuggers to halt program execution when the data contained by a particular memory address is changed Watchpoints are inserted by the programmer to allow inspection of register contents memory locations and variable values when memory is written to test that the program is operating correctly Watchp...

Page 243: ...hese cases the memory system might only indicate completion of the write when the access has affected the state of the target unless it is impossible to distinguish between having the effect of the write visible and having the state of target updated This stricter requirement for some types of memory ensures that any side effects of the memory access can be guaranteed by the processor to have take...

Page 244: ...ram below illustrates the following cache terminology block address cache line cache set cache way index tag Tag Tag Tag Tag Index Word Hit way number Read data way that corresponds 3 1 Tag 0 0 2 1 3 4 5 6 7 n Byte Cache way Cache set m 1 2 0 Cache line 2 Block address Line number Word number Cache tag RAM Cache data RAM ...

Page 245: ...interfaces 1 3 programmer s model 2 2 Assoc field 2 10 B Block diagram 1 2 Bus interface unit 6 2 Busy waiting 8 10 Byte accesses 6 6 Byte lane indication 6 6 Byte writable memory 5 20 C C and B bits DCache 4 6 write through WT 4 2 C bit 2 14 settings ICache 4 5 Cache access priorities 4 8 associativity encoding 2 10 debug control register B 12 enabling 4 5 features 4 2 lockdown regsiter 2 26 oper...

Page 246: ...ded trace macrocell 10 2 Enable bit TCM 2 30 Endianness 6 6 ETM 10 2 interface signals A 12 Exception vectors 2 14 External aborts 3 29 F FAR 2 20 Fast context switch 2 34 Fast context switch extension FCSE 2 34 Fault alignment 3 27 checking sequence 3 26 domain 3 27 permission 3 28 Fault address register 2 20 3 21 Fault status register 2 18 3 21 FCSE PID register 2 34 FIFOFULL 10 2 Fine page tabl...

Page 247: ...wer management 12 2 dynamic 12 2 static 12 3 Prefetch ICache line 2 21 Privileged instructions 8 9 Process ID register 2 33 Process identifier 2 34 Product revision status xvi R R bit ROM protection 2 14 Register descriptions 2 7 Registers cache debug control B 12 cache lockdown 2 26 cache operations 2 21 cache type 2 7 2 8 context ID 2 35 control 2 12 CP15 2 3 debug override B 2 debug test addres...

Page 248: ...Thumb instruction fetches 6 6 Timing diagram conventions xviii Tiny page references translating 3 19 TLB lockdown register 2 32 operations 2 25 structure 3 31 TLB operations register 2 24 Trace control register B 5 Trace port 10 2 Transfer size 6 3 Translated entries 3 3 Translating page tables 3 7 Translation fault 3 27 Translation table base 3 6 register 2 17 Trigering facilities 10 2 TTB 3 6 Ty...

Search results

Summary of Contents for ARM926EJ-S

Reviews:

Related manuals for ARM926EJ-S

Brands by name

Popular brands

ARM ARM926EJ-S, Technical Reference Manual

Search results

Summary of Contents for ARM926EJ-S

Reviews:

Related manuals for ARM926EJ-S

Brands by name

Popular brands