ARM922T
(Rev 0)
Technical Reference Manual
ARM922T
Technical Reference Manual
Copyright © 2000, 2001 ARM Limited. All rights reserved.
Release Information
Proprietary Notice
Words and logos marked with ® or ™ are registered trademarks or trademarks owned by ARM Limited, except as otherwise stated below in this proprietary notice. Other brands and names mentioned herein may be the trademarks of their respective owners.
Neither the whole nor any part of the information contained in, or the product described in, this document may be adapted or reproduced in any material form except with the prior written permission of the copyright holder.
The product described in this document is subject to continuous developments and improvements. All particulars of the product and its use contained in this document are given by ARM in good faith. However, all warranties implied or expressed, including but not limited to implied warranties of merchantability, or fitness for purpose, are excluded.
This document is intended only to assist the reader in the use of the product. ARM Limited shall not be liable for any loss or damage arising from the use of any information in this document, or any error or omission in such information, or any incorrect use of the product.
Figure 9-5 on page 9-12 reprinted with permission IEEE Std 1149.1-1990, IEEE Standard Test Access Port and Boundary-Scan Architecture Copyright 2000, by IEEE. The IEEE disclaims any responsibility or liability resulting from the placement and use in the described manner.
Confidentiality Status
This document is Non-Confidential. The right to use, copy and disclose this document may be subject to license restrictions in accordance with the terms of the agreement entered into by ARM and the party that ARM delivered this document to.
Product Status
The information in this document is final, that is for a developed product.
Web Address http://www.arm.com
Change history
Date Issue Change
5th September 2000 A First release
18th April 2001 B Second release
Contents
ARM922T Technical Reference Manual
Preface
About this document ... xvi Further reading ... xx Feedback ... xxi
Chapter 1 Introduction
1.1 About the ARM922T ... 1-2 1.2 Processor functional block diagram ... 1-3
Chapter 2 Programmer’s Model
2.1 About the programmer’s model ... 2-2 2.2 About the ARM9TDMI programmer’s model ... 2-3 2.3 CP15 register map summary ... 2-5
Chapter 3 Memory Management Unit
3.1 About the MMU ... 3-2 3.2 MMU program accessible registers ... 3-4 3.3 Address translation ... 3-6 3.4 MMU faults and CPU aborts ... 3-21 3.5 Fault address and fault status registers ... 3-22
Contents
3.8 External aborts ... 3-28 3.9 Interaction of the MMU and caches ... 3-29
Chapter 4 Caches, Write Buffer, and Physical Address TAG (PA TAG) RAM
4.1 About the caches and write buffer ... 4-2 4.2 ICache ... 4-4 4.3 DCache and write buffer ... 4-9 4.4 Cache coherence ... 4-17 4.5 Cache cleaning when lockdown is in use ... 4-20 4.6 Implementation notes ... 4-21 4.7 Physical address TAG RAM ... 4-22 4.8 Drain write buffer ... 4-23 4.9 Wait for interrupt ... 4-24
Chapter 5 Clock Modes
5.1 About ARM922T clocking ... 5-2 5.2 FastBus mode ... 5-3 5.3 Synchronous mode ... 5-4 5.4 Asynchronous mode ... 5-6
Chapter 6 Bus Interface Unit
6.1 About the ARM922T bus interface ... 6-2 6.2 Unidirectional AMBA ASB interface ... 6-3 6.3 Fully-compliant AMBA ASB interface ... 6-5 6.4 AMBA AHB interface ... 6-20 6.5 Level 2 cache support and performance analysis ... 6-22
Chapter 7 Coprocessor Interface
7.1 About the ARM922T coprocessor interface ... 7-2 7.2 LDC/STC ... 7-5 7.3 MCR/MRC ... 7-9 7.4 Interlocked MCR ... 7-11 7.5 CDP ... 7-13 7.6 Privileged instructions ... 7-15 7.7 Busy-waiting and interrupts ... 7-17
Chapter 8 Trace Interface Port
8.1 About the ETM interface ... 8-2
Chapter 9 Debug Support
9.1 About debug ... 9-2 9.2 Debug systems ... 9-3 9.3 Debug interface signals ... 9-5 9.4 Scan chains and JTAG interface ... 9-11 9.5 The JTAG state machine ... 9-12 9.6 Test data registers ... 9-19
Contents
9.7 ARM922T core clocks ... 9-42 9.8 Clock switching during debug ... 9-43 9.9 Clock switching during test ... 9-44 9.10 Determining the core state and system state ... 9-45 9.11 Exit from debug state ... 9-48 9.12 The behavior of the program counter during debug ... 9-51 9.13 EmbeddedICE macrocell ... 9-54 9.14 Vector catching ... 9-62 9.15 Single-stepping ... 9-63 9.16 Debug communications channel ... 9-64
Chapter 10 TrackingICE
10.1 About TrackingICE ... 10-2 10.2 Timing requirements ... 10-3 10.3 TrackingICE outputs ... 10-4
Chapter 11 AMBA Test Interface
11.1 About the AMBA test interface ... 11-2 11.2 Entering and exiting AMBA Test ... 11-3 11.3 Functional test ... 11-4 11.4 Burst operations ... 11-11 11.5 PA TAG RAM test ... 11-12 11.6 Cache test ... 11-15 11.7 MMU test ... 11-19
Chapter 12 Instruction Cycle Summary and Interlocks
12.1 About the instruction cycle summary ... 12-2 12.2 Instruction cycle times ... 12-3 12.3 Interlocks ... 12-6
Chapter 13 AC Characteristics
13.1 ARM922T timing diagrams ... 13-2 13.2 ARM922T timing parameters ... 13-16 13.3 Timing definitions for the ARM922T Trace Interface Port ... 13-26
Appendix A Signal Descriptions
A.1 AMBA signals ... A-2 A.2 Coprocessor interface signals ... A-5 A.3 JTAG and TAP controller signals ... A-7 A.4 Debug signals ... A-10 A.5 Miscellaneous signals ... A-12 A.6 ARM922T Trace Interface Port signals ... A-13
Appendix B CP15 Test Registers
Contents
B.3 Cache test registers and operations ... B-8 B.4 MMU test registers and operations ... B-17 B.5 StrongARM backwards compatibility operations ... B-29
Glossary
List of Tables
ARM922T Technical Reference Manual
Change history ... ii Table 2-1 ARM9TDMI implementation options ... 2-3 Table 2-2 CP15 register map ... 2-5 Table 2-3 Address types in ARM922T ... 2-6 Table 2-4 CP15 abbreviations ... 2-6 Table 2-5 Register 0, ID code ... 2-8 Table 2-6 Cache type register format ... 2-9 Table 2-7 Cache size encoding (M=0) ... 2-10 Table 2-8 Cache associativity encoding (M=0) ... 2-11 Table 2-9 Line length encoding ... 2-11 Table 2-10 Control register 1 bit functions ... 2-12 Table 2-11 Clocking modes ... 2-13 Table 2-12 Register 2, translation table base ... 2-14 Table 2-13 Register 3, domain access control ... 2-14 Table 2-14 Fault status register ... 2-16 Table 2-15 Function descriptions register 7 ... 2-17 Table 2-16 Cache operations register 7 ... 2-18 Table 2-17 TLB operations register 8 ... 2-19 Table 2-18 Accessing the cache lockdown register 9 ... 2-22 Table 2-19 Accessing the TLB lockdown register 10 ... 2-22 Table 3-1 CP15 register functions ... 3-4
List of Tables
Table 3-4 Section descriptor bits ... 3-11 Table 3-5 Coarse page table descriptor bits ... 3-12 Table 3-6 Fine page table descriptor bits ... 3-13 Table 3-7 Level two descriptor bits ... 3-16 Table 3-8 Interpreting page table entry bits [1:0] ... 3-16 Table 3-9 Priority encoding of fault status ... 3-22 Table 3-10 Interpreting access control bits in domain access control register ... 3-23 Table 3-11 Interpreting access permission (AP) bits ... 3-24 Table 4-1 DCache and write buffer configuration ... 4-11 Table 5-1 Clock selection for external memory accesses ... 5-4 Table 6-1 Relationship between bidirectional and unidirectional ASB interface ... 6-3 Table 6-2 ARM922T input/output timing ... 6-4 Table 6-3 AMBA ASB transfer types ... 6-6 Table 6-4 Burst transfers ... 6-7 Table 6-5 Use of WRITEOUT signal ... 6-7 Table 6-6 Noncached LDR and fetch ... 6-11 Table 6-7 Data eviction of 4 or 8 words ... 6-17 Table 6-8 ARM922T supported bus access types ... 6-22 Table 7-1 Handshake encoding ... 7-8 Table 9-1 Public instructions ... 9-14 Table 9-2 ID code register ... 9-20 Table 9-3 Scan chain number allocation ... 9-23 Table 9-4 Scan chain 0 bit order ... 9-25 Table 9-5 Scan chain 1 bit function ... 9-28 Table 9-6 Scan chain 2 bit function ... 9-29 Table 9-7 Scan chain 15 format and access modes ... 9-32 Table 9-8 Scan chain 15 physical access mode bit format ... 9-33 Table 9-9 Physical access mapping to CP15 registers ... 9-33 Table 9-10 Scan chain 15 interpreted access mode bit format ... 9-34 Table 9-11 Interpreted access mapping to CP15 registers ... 9-35 Table 9-12 Interpreted access mapping to the MMU ... 9-36 Table 9-13 Interpreted access mapping to the caches ... 9-36 Table 9-14 Scan chain 4 format ... 9-39 Table 9-15 ARM9TDMI EmbeddedICE macrocell register map ... 9-54 Table 9-16 Watchpoint control register, data comparison bit functions ... 9-57 Table 9-17 Watchpoint control register for instruction comparison bit functions ... 9-59 Table 9-18 Debug status register bit functions ... 9-60 Table 9-19 Debug comms control register bit functions ... 9-65 Table 10-1 ARM922T in TrackingICE mode ... 10-4 Table 11-1 AMBA test modes ... 11-3 Table 11-2 AMBA functional test locations ... 11-4 Table 11-3 Construction of A922Inputs location ... 11-5 Table 11-4 Construction of A922Status1 location ... 11-6 Table 11-5 Construction of A922Status2 location ... 11-7 Table 11-6 Burst locations ... 11-11 Table 11-7 PA TAG RAM locations ... 11-12 Table 11-8 Construction of data pattern write data ... 11-12
List of Tables
Table 11-9 Cache test locations ... 11-15 Table 11-10 CAM write data ... 11-15 Table 11-11 CAM match write data ... 11-16 Table 11-12 CAM match read data ... 11-16 Table 11-13 Invalidate by VA write data ... 11-16 Table 11-14 Lockdown victim and base data ... 11-17 Table 11-15 MMU test locations ... 11-19 Table 11-16 Invalidate by VA data ... 11-19 Table 11-17 Match write data ... 11-20 Table 11-18 CAM data ... 11-20 Table 11-19 CAM data Size_C encoding ... 11-20 Table 11-20 RAM1 data ... 11-21 Table 11-21 RAM1 data access permission bits ... 11-21 Table 11-22 RAM2 data ... 11-22 Table 11-23 RAM2 data Size_R2 encoding ... 11-22 Table 12-1 Symbols used in tables ... 12-3 Table 12-2 Instruction cycle bus times ... 12-3 Table 12-3 Data bus instruction times ... 12-4 Table 13-1 ARM922T timing parameters ... 13-16 Table 13-2 ARM922T Trace Interface Port timing definitions ... 13-26 Table A-1 AMBA signals ... A-2 Table A-2 Coprocessor interface signals ... A-5 Table A-3 JTAG and TAP controller signals ... A-7 Table A-4 Debug signals ... A-10 Table A-5 Miscellaneous signals ... A-12 Table A-6 Trace signals ... A-13 Table B-1 Test state register ... B-3 Table B-2 Clocking mode selection ... B-5 Table B-3 Register 7 operations ... B-8 Table B-4 Register 9 operations ... B-8 Table B-5 Register 15 operations ... B-9 Table B-6 CP15 MCR and MRC instructions ... B-9 Table B-7 Register 7, 9, and 15 operations ... B-10 Table B-8 Write cache victim and lockdown operations ... B-14 Table B-9 TTB register operations ... B-17 Table B-10 DAC register operations ... B-18 Table B-11 FSR register operations ... B-18 Table B-12 FAR register operations ... B-19 Table B-13 Register 8 operations ... B-19 Table B-14 Register 10 operations ... B-19 Table B-15 CAM, RAM1, and RAM2 register 15 operations ... B-19 Table B-16 Register 2, 3, 5, 6, 8, 10, and 15 operations ... B-20 Table B-17 CAM memory region size ... B-23 Table B-18 Access permission bit setting ... B-24 Table B-19 Miss and fault encoding ... B-24
List of Tables
List of Figures
ARM922T Technical Reference Manual
Key to timing diagram conventions ... xix Figure 1-1 ARM922T functional block diagram ... 1-3 Figure 2-1 CP15 MRC and MCR bit pattern ... 2-7 Figure 2-2 Cache type register format ... 2-8 Figure 2-3 Dsize and Isize field format ... 2-9 Figure 2-4 Register 7 MVA format ... 2-19 Figure 2-5 Register 7 index format ... 2-19 Figure 2-6 Register 8 MVA format ... 2-20 Figure 2-7 Register 9 ... 2-21 Figure 2-8 Register 10 ... 2-23 Figure 2-9 Register 13 ... 2-24 Figure 2-10 Address mapping using CP15 Register 13 ... 2-25 Figure 3-1 Translation table base register ... 3-6 Figure 3-2 Translating page tables ... 3-7 Figure 3-3 Accessing translation table level one descriptors ... 3-8 Figure 3-4 Level one descriptor ... 3-9 Figure 3-5 Section descriptor ... 3-11 Figure 3-6 Coarse page table descriptor ... 3-12 Figure 3-7 Fine page table descriptor ... 3-13 Figure 3-8 Section translation ... 3-14 Figure 3-9 Level two descriptor ... 3-15
List of Figures
Figure 3-12 Tiny page translation from a fine page table ... 3-19 Figure 3-13 Domain access control register format ... 3-23 Figure 3-14 Sequence for checking faults ... 3-25 Figure 4-1 Addressing the 8KB ICache ... 4-5 Figure 5-1 ARM922T clocking ... 5-2 Figure 5-2 Synchronous mode FCLK to BCLK zero phase delay ... 5-5 Figure 5-3 Synchronous mode FCLK to BCLK one phase delay ... 5-5 Figure 5-4 Asynchronous mode FCLK to BCLK zero cycle delay ... 5-6 Figure 5-5 Asynchronous mode FCLK to BCLK one cycle delay ... 5-7 Figure 6-1 Output buffer for bidirectional signals ... 6-5 Figure 6-2 Output buffer for unidirectional signals ... 6-5 Figure 6-3 Instruction fetch after reset ... 6-10 Figure 6-4 Example LDR from address 0x108 ... 6-11 Figure 6-5 Example LDM of 5 words from 0x108 ... 6-12 Figure 6-6 Example nonbuffered STR ... 6-13 Figure 6-7 Example nonbuffered STM ... 6-14 Figure 6-8 Example linefill from 0x100 ... 6-15 Figure 6-9 Example 4-word data eviction ... 6-16 Figure 6-10 Example swap operation ... 6-18 Figure 7-1 ARM922T coprocessor clocking ... 7-3 Figure 7-2 ARM922T LDC/STC cycle timing ... 7-5 Figure 7-3 ARM922T MCR/MRC transfer timing ... 7-9 Figure 7-4 ARM922T interlocked MCR ... 7-12 Figure 7-5 ARM922T late canceled CDP ... 7-14 Figure 7-6 ARM922T privileged instructions ... 7-15 Figure 7-7 ARM922T busy waiting and interrupts ... 7-18 Figure 9-1 Typical debug system ... 9-3 Figure 9-2 Breakpoint timing ... 9-5 Figure 9-3 Watchpoint entry with data processing instruction ... 9-8 Figure 9-4 Watchpoint entry with branch ... 9-9 Figure 9-5 Test access port (TAP) controller state transitions ... 9-12 Figure 9-6 External scan chain multiplexor ... 9-22 Figure 9-7 Write back physical address format ... 9-40 Figure 9-8 Clock switching on entry to debug state ... 9-43 Figure 9-9 Debug exit sequence ... 9-49 Figure 9-10 Debug state entry ... 9-50 Figure 9-11 ARM9TDMI EmbeddedICE macrocell overview ... 9-56 Figure 9-12 Watchpoint control register for data comparison ... 9-57 Figure 9-13 Watchpoint control register for instruction comparison ... 9-58 Figure 9-14 Debug control register ... 9-60 Figure 9-15 Debug status register ... 9-60 Figure 9-16 Vector catch register ... 9-61 Figure 9-17 Debug comms control register ... 9-64 Figure 10-1 Using TrackingICE ... 10-2 Figure 11-1 AMBA functional test state machine ... 11-9 Figure 11-2 Write data format ... 11-13 Figure 12-1 Single load interlock timing ... 12-6
List of Figures
Figure 12-2 Two cycle load interlock ... 12-7 Figure 12-3 LDM interlock ... 12-8 Figure 12-4 LDM dependent interlock ... 12-9 Figure 13-1 ARM922T FCLK timed coprocessor interface ... 13-2 Figure 13-2 ARM922T BCLK timed coprocessor interface ... 13-3 Figure 13-3 ARM922T FCLK related signal timing ... 13-4 Figure 13-4 ARM922T BCLK related signal timing ... 13-5 Figure 13-5 ARM922T SDOUTBS to TDO relationship ... 13-5 Figure 13-6 ARM922T nTRST to other signals relationship ... 13-6 Figure 13-7 ARM922T JTAG output signal timing ... 13-7 Figure 13-8 ARM922T JTAG input signal timing ... 13-8 Figure 13-9 ARM922T FCLK related debug output timing ... 13-8 Figure 13-10 ARM922T BCLK related debug output timing ... 13-9 Figure 13-11 ARM922T TCK related debug output timing ... 13-10 Figure 13-12 ARM922T EDBGRQ to DBGRQI relationship ... 13-10 Figure 13-13 ARM922T DBGEN to output relationship ... 13-11 Figure 13-14 ARM922T BCLK related Trace Interface Port timing ... 13-11 Figure 13-15 ARM922T FCLK related Trace Interface Port timing ... 13-12 Figure 13-16 ARM922T BnRES timing ... 13-12 Figure 13-17 ARM922T ASB slave transfer timing ... 13-13 Figure 13-18 ARM922T ASB master transfer timing ... 13-14 Figure 13-19 ARM922T ASB master transfer timing ... 13-15 Figure B-1 CP15 MRC and MCR bit pattern ... B-2 Figure B-2 Rd format, CAM read ... B-12 Figure B-3 Rd format, CAM write ... B-12 Figure B-4 Rd format, RAM read ... B-12 Figure B-5 Rd format, RAM write ... B-12 Figure B-6 Rd format, CAM match RAM read ... B-13 Figure B-7 Data format, CAM read ... B-13 Figure B-8 Data format, RAM read ... B-13 Figure B-9 Data format, CAM match RAM read ... B-13 Figure B-10 Rd format, write I or D cache victim and lockdown base ... B-14 Figure B-11 Rd format, write I or D cache victim ... B-14 Figure B-12 Rd format, CAM write and data format, CAM read ... B-23 Figure B-13 Rd format, RAM1 write ... B-23 Figure B-14 Data format, RAM1 read ... B-24 Figure B-15 Rd format, RAM2 write and data format, RAM2 read ... B-25 Figure B-16 Rd format, write I or D TLB lockdown ... B-26
List of Figures
Preface
This preface introduces the ARM922T processor and its reference documentation. It contains the following sections:
• About this document on page xvi
• Further reading on page xx
• Feedback on page xxi.
Preface
About this document
This document is the technical reference manual for the ARM922T.
Intended audience
This document has been written for hardware and software engineers who want to design or develop products based upon the ARM922T processor. It assumes no prior knowledge of ARM products.
Using this manual
This document is organized into the following chapters:
Chapter 1 Introduction
Read this chapter for an introduction to the ARM922T.
Chapter 2 Programmer’s Model
Read this chapter for a description of the programmer’s model for the ARM922T.
Chapter 3 Memory Management Unit
Read this chapter for a description of the memory management unit and the memory interface, including descriptions of the instruction and data interfaces.
Chapter 4 Caches, Write Buffer, and Physical Address TAG (PA TAG) RAM Read this chapter for descriptions of cache, write buffer, and PA TAG RAM operation.
Chapter 5 Clock Modes
Read this chapter for a description of the processor clock modes.
Chapter 6 Bus Interface Unit
Read this chapter for a description of the bus interface unit and the AMBA ASB and AHB interface.
Chapter 7 Coprocessor Interface
Read this chapter for a description of the ARM922T coprocessor interface.
Preface
Chapter 8 Trace Interface Port
Read this chapter for a description of the Trace Interface Port of the ARM922T.
Chapter 9 Debug Support
Read this chapter for a description of the debug interface.
Chapter 10 TrackingICE
Read this chapter for a description of how the ARM922T uses TrackingICE mode.
Chapter 11 AMBA Test Interface
Read this chapter for a description of the AMBA test interface.
Chapter 12 Instruction Cycle Summary and Interlocks
Read this chapter for details of instruction cycle times. This chapter contains timing diagrams for interlock timing.
Chapter 13 AC Characteristics
Read this chapter for a description of the timing parameters used in the ARM922T.
Appendix A Signal Descriptions
Read this chapter for a detailed description of the signals used in the ARM922T.
Appendix B CP15 Test Registers
Read this chapter for a detailed description of the CP15 test register used in the ARM922T.
Preface
Typographical conventions
The following typographical conventions are used in this book:
bold Highlights ARM processor signal names, and interface elements, such as menu names and buttons. Also used for terms in descriptive lists, where appropriate.
italic Highlights special terminology, cross-references, and citations.
typewriter Denotes text that can be entered at the keyboard, such as commands, file and program names, and source code.
typewriter Denotes a permitted abbreviation for a command or option. The underlined text may be entered instead of the full command or option name.
typewriter italic
Denotes arguments to commands or functions, where the argument is to be replaced by a specific value.
typewriter bold
Denotes language keywords when used outside example code.
Preface
Timing diagram conventions
This manual contains a number of timing diagrams. explains the components used in these diagrams. Any variations are clearly labeled when they occur. Therefore, you must not attach any additional meaning unless specifically stated.
Key to timing diagram conventions Shaded bus and signal areas are undefined, so the bus or signal can assume any value within the shaded area at that time. The actual level is unimportant and does not affect normal operation.
Clock
Bus stable HIGH to LOW
Transient
Bus to high impedance
Bus change HIGH/LOW to HIGH
High impedance to stable bus
Preface
Further reading
This section lists publications by ARM Limited, and by third parties.
If you would like further information on ARM products, or if you have questions not answered by this document, please contact info@arm.com or visit our web site at http://www.arm.com.
ARM publications
This document contains information that is specific to the ARM922T. Refer to the following documents for other relevant information:
• ARM Architecture Reference Manual (ARM DDI 0100)
• ARM9TDMI Data Sheet (ARM DDI 0029).
Other publications
This section lists relevant documents published by third parties.
• IEEE Std. 1149.1- 1990, Standard Test Access Port and Boundary-Scan Architecture.
Preface
Feedback
ARM Limited welcomes feedback both on the ARM922T, and on the documentation.
Feedback on the ARM922T
If you have any comments or suggestions about this product, please contact your supplier giving:
• the product name
• a concise explanation of your comments.
Feedback on the ARM922T Technical Reference Manual
If you have any comments about this document, please send email to errata@arm.com giving:
• the document title
• the document number
• the page number(s) to which your comments refer
• a concise explanation of your comments.
General suggestions for additions and improvements are also welcome.
Preface
Chapter 1 Introduction
This chapter introduces the ARM922T processor. It contains the following sections:
• About the ARM922T on page 1-2
• Processor functional block diagram on page 1-3.
Introduction
1.1 About the ARM922T
The ARM922T processor is a member of the ARM9TDMI family of general-purpose microprocessors, which includes:
• ARM9TDMI (core)
• ARM940T (core plus 4K and 4K caches and protection unit)
• ARM920T (core plus 16K and 16K caches and MMU)
• ARM922T (core plus 8K and 8K caches and MMU).
The ARM9TDMI processor core is a Harvard architecture device implemented using a five-stage pipeline consisting of Fetch, Decode, Execute, Memory, and Write stages. It can be provided as a standalone core that can be embedded into more complex devices.
The standalone core has a simple bus interface that allows you to design your own caches and memory systems around it.
The ARM9TDMI family of microprocessors supports both the 32-bit ARM and 16-bit Thumb instruction sets, allowing you to trade off between high performance and high code density.
The ARM922T processor is a Harvard cache architecture processor that is targeted at multiprogrammer applications where full memory management, high performance, and low power are all-important. The separate instruction and data caches in this design are 8KB each in size, with an 8-word line length. The ARM922T implements an enhanced ARM architecture v4 MMU to provide translation and access permission checks for instruction and data addresses.
The ARM922T processor supports the ARM debug architecture and includes logic to assist in both hardware and software debug. The ARM922T also includes support for coprocessors, exporting the instruction and data buses along with simple handshaking signals.
The ARM922T interface to the rest of the system is over unified address and data buses.
This interface enables implementation of either an Advanced Microcontroller Bus Architecture (AMBA) Advanced System Bus (ASB) or Advanced High-performance Bus (AHB) bus scheme either as a fully-compliant AMBA bus master, or as a slave for production test. The ARM922T also has a Tracking ICE mode which allows an approach similar to a conventional ICE mode of operation.
The ARM922T processor supports the addition of an Embedded Trace Macrocell (ETM) for real-time tracing of instructions and data.
Introduction
1.2 Processor functional block diagram
Figure 1-1 shows the functional block diagram of the ARM922T processor.
Figure 1-1 ARM922T functional block diagram The blocks shown in Figure 1-1 are described as follows:
• The ARM9TDMI core is described in the ARM9TDMI Technical Reference Manual.
• Register 13 and coprocessor 15 are described in Chapter 2 Programmer’s Model.
• The instruction and data MMUs are described in Chapter 3 Memory Management Unit.
• The instruction and data caches, the write buffer, and the write-back PA TAG RAM are described in Chapter 4 Caches, Write Buffer, and Physical Address TAG (PA TAG) RAM.
External coprocessor
interface
ARM9TDMI Processor core (Integral EmbeddedICE)
Write buffer ID[31:0]
IMVA[31:0]
WBPA[31:0]
DPA[31:0]
IPA[31:0]
ASB
Write back PA TAG RAM CP15
R13
IVA[31:0]
DVA[31:0]
JTAG
DD[31:0]
Instruction cache
Instruction MMU
Data MMU Data
cache R13
DINDEX[5:0]
Trace interface
port
AMBA bus interface
DMVA[31:0]
Introduction
• The external coprocessor interface is described in Chapter 7 Coprocessor Interface.
• The trace interface port is described in Chapter 8 Trace Interface Port.
Chapter 2
Programmer’s Model
This chapter describes the ARM922T registers and provides details required when programming the microprocessor. It contains the following sections:
• About the programmer’s model on page 2-2
• About the ARM9TDMI programmer’s model on page 2-3
• CP15 register map summary on page 2-5.
Programmer’s Model
2.1 About the programmer’s model
The ARM922T processor incorporates the ARM9TDMI integer core, which implements the ARM architecture v4T. It executes the ARM and Thumb instruction sets, and includes EmbeddedICE JTAG software debug features.
The programmer’s model of the ARM922T consists of the programmer’s model of the ARM9TDMI core (see About the ARM9TDMI programmer’s model on page 2-3) with the following additions and modifications:
• The ARM922T incorporates two coprocessors:
— CP14, which allows software access to the debug communications channel.
You can access the registers defined in CP14 using MCR and MRC instructions.
These are described in Debug communications channel on page 9-64.
— The system control coprocessor, CP15, which provides additional registers that are used to configure and control the caches, MMU, protection system, the clocking mode, and other system options of the ARM922T, such as big or little-endian operation. You can access the registers defined in CP15 using MCR and MRC instructions. These are described in CP15 register map summary on page 2-5.
• The ARM922T processor also features an external coprocessor interface that allows the attachment of a closely-coupled coprocessor on the same chip, for example, a floating-point unit. You can access registers and operations provided by any coprocessors attached to the external coprocessor interface using appropriate coprocessor instructions.
• Memory accesses for instruction fetches and data loads and stores can be cached or buffered. Cache and write buffer configuration and operation is described in detail in Chapter 4 Caches, Write Buffer, and Physical Address TAG (PA TAG) RAM.
• The MMU page tables that reside in main memory describe the virtual to physical address mapping, access permissions, and cache and write buffer configuration.
These are created by the operating system software and accessed automatically by the ARM922T MMU hardware whenever an access causes a TLB miss.
• The ARM922T processor has a Trace Interface Port that allows the use of Trace hardware and tools for real-time tracing of instructions and data.
Programmer’s Model
2.2 About the ARM9TDMI programmer’s model
The ARM9TDMI processor core implements ARM architecture v4T, and executes the ARM 32-bit instruction set and the compressed Thumb 16-bit instruction set. The programmer’s model is fully described in the ARM Architecture Reference Manual. The ARM9TDMI Technical Reference Manual gives implementation details, including instruction execution cycle times.
ARMv4T specifies a small number of implementation options. The options selected in the ARM9TDMI implementation are listed in Table 2-1. For comparison, the options selected for the ARM7TDMI implementation are also shown.
The ARM9TDMI core is code-compatible with the ARM7TDMI, with two exceptions:
• The ARM9TDMI core implements the base restored Data Abort model. This significantly simplifies the software Data Abort handler.
• The ARM9TDMI core fully implements the instruction set extension spaces added to the ARM (32-bit) instruction set in ARMv4 and ARMv4T.
These differences are explained in more detail in the following sections:
• Data Abort model
• Instruction set extension spaces on page 2-4.
2.2.1 Data Abort model
The base restored Data Abort model differs from the base updated Data Abort model implemented by ARM7TDMI.
The difference in the Data Abort models affects only a very small section of operating system code, the Data Abort handler. It does not affect user code. With the base restored Data Abort model, when a Data Abort exception occurs during the execution of a memory access instruction, the base register is always restored by the processor hardware to the value the register contained before the instruction was executed. This removes the requirement for the Data Abort handler to unwind any base register update
Table 2-1 ARM9TDMI implementation options Processor
core Architecture Data Abort model
Value stored by direct STR, STRT, and STM of PC
ARM7TDMI ARMv4T Base updated Address of instruction + 12
ARM9TDMI ARMv4T Base restored Address of instruction + 12
Programmer’s Model
2.2.2 Instruction set extension spaces
All ARM processors implement the undefined instruction space as one of the entry mechanisms for the undefined instruction exception. That is, ARM instructions with opcode[27:25] = 0b011 and opcode[4] = 0b1 are undefined on all ARM processors including the ARM9TDMI and ARM7TDMI.
ARMv4 and ARMv4T also introduce a number of instruction set extension spaces to the ARM instruction set. These are:
• arithmetic instruction extension space
• control instruction extension space
• coprocessor instruction extension space
• load/store instruction extension space.
Instructions in these spaces are undefined, and cause an undefined instruction exception. The ARM9TDMI fully implements all the instruction set extension spaces defined in ARMv4T as undefined instructions, allowing emulation of future instruction set additions.
Programmer’s Model
2.3 CP15 register map summary
CP15 defines 16 registers. The register map for CP15 is shown in Table 2-2.
Table 2-2 CP15 register map
Register Read Write
0 ID code a
a. Register location 0 provides access to more than one register. The register accessed depends on the value of the opcode_2 field. See the register description for details.
Unpredictable
0 Cache type a Unpredictable
1 Control Control
2 Translation table base Translation table base 3 Domain access control Domain access control
4 Unpredictable Unpredictable
5 Fault status b
b. Separate registers for instruction and data. See the register description for details.
Fault status b
6 Fault address Fault address
7 Unpredictable Cache operations
8 Unpredictable TLB operations
9 Cache lockdown b Cache lockdown b
10 TLB lockdown b TLB lockdown b
11 Unpredictable Unpredictable
12 Unpredictable Unpredictable
13 FCSE PID FCSE PID
14 Unpredictable Unpredictable
15 Test configuration Test configuration
Programmer’s Model
2.3.1 Addresses in ARM922T
Three distinct types of address exist in an ARM922T system:
• Virtual Address (VA)
• Modified Virtual Address (MVA)
• Physical Address (PA).
Below is an example of the address manipulation when the ARM9TDMI core requests an instruction (see Figure 2-10 on page 2-25).
1. The Instruction VA (IVA) is issued by the ARM9TDMI core.
2. This is translated by the ProcID to the Instruction MVA (IMVA). It is the IMVA that the Instruction Cache (ICache) and MMU see.
3. If the protection check carried out by the IMMU on the IMVA does not abort, and the IMVA tag is in the ICache, the instruction data is returned to the ARM9TDMI.
4. If the ICache misses (the IMVA tag is not in the ICache), then the IMMU performs a translation to produce the Instruction PA (IPA). This address is given to the AMBA bus interface to perform an external access.
2.3.2 Accessing CP15 registers
The terms and abbreviations shown in Table 2-4 are used throughout this section.
Table 2-3 Address types in ARM922T
Domain ARM9TDMI Caches and TLBs AMBA bus
Address Virtual (VA) Modified Virtual (MVA) Physical (PA)
Table 2-4 CP15 abbreviations Term Abbreviation Description
Unpredictable UNP For reads, the data returned when reading from this location is unpredictable. It can have any value.
For writes, writing to this location causes unpredictable behavior, or an unpredictable change in device configuration.
Should be zero SBZ When writing to this location, all bits of this field should be 0.
Programmer’s Model
In all cases, reading from, or writing any data values to any CP15 registers, including those fields specified as unpredictable or should be zero, does not cause any permanent damage.
All CP15 register bits that are defined and contain state, are set to zero by BnRES except the V bit in register 1, which takes the value of macrocell input VINITHI when BnRES is asserted.
You can only access CP15 registers with MRC and MCR instructions in a privileged mode.
The instruction bit pattern of the MCR and MRC instructions is shown in Figure 2-1. The assembler for these instructions is:
MCR/MRC{cond} P15,opcode_1,Rd,CRn,CRm,opcode_2
Figure 2-1 CP15 MRC and MCR bit pattern Instructions CDP, LDC, and STC, together with unprivileged MRC and MCR instructions to CP15, cause the undefined instruction trap to be taken. The CRn field of MRC and MCR instructions specifies the coprocessor register to access. The CRm field and opcode_2 fields specify a particular action when addressing registers. The L bit distinguishes between an MRC (L=1) and an MCR (L=0).
Note
Attempting to read from a nonreadable register, or to write to a nonwritable register causes unpredictable results.
The opcode_1, opcode_2, and CRm fields should be zero, except when the values specified are used to select the desired operations, in all instructions that access CP15. Using other values results in unpredictable behavior.
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
1 1 1 0 1 1 1 1 1
CRm opcode_2
CRn Rd L opcode_1 Cond
Programmer’s Model
2.3.3 Register 0, ID code register
This is a read-only register that returns a 32-bit device ID code.
You can access the ID code register by reading CP15 register 0 with the opcode_2 field set to any value other than 1 (the CRm field should be zero when reading). For example:
MRC p15,0,Rd,c0,c0,0 ; returns ID register The contents of the ID code are shown in Table 2-5.
2.3.4 Register 0, cache type register
This is a read-only register that contains information about the size and architecture of the caches, allowing operating systems to establish how to perform such operations as cache cleaning and lockdown. All ARMv4T and later cached processors contain this register, allowing RTOS vendors to produce future-proof versions of their operating systems.
You can access the cache type register by reading CP15 register 0 with the opcode_2 field set to 1. For example:
MRC p15,0,Rd,c0,c0,1 ; returns cache details
The format of the cache type register is shown in Figure 2-2.
Figure 2-2 Cache type register format ctype The ctype field determines the cache type.
Table 2-5 Register 0, ID code Register bits Function Value
31:24 Implementer 0x41
23:20 Specification revision 0x0
19:16 Architecture (ARMv4T) 0x2
15:4 Part number 0x922
3:0 Layout revision Revision
31 30 29 28 25 24 23 12 11 0
0 0 0 ctype S Dsize Isize
Programmer’s Model
S bit Specifies whether the cache is a unified cache or separate instruction and data caches.
Dsize Specifies the size, line length, and associativity of the data cache.
Isize Specifies the size, line length, and associativity of the instruction cache.
The Dsize and Isize fields in the cache type register have the same format. This is shown in Figure 2-3.
Figure 2-3 Dsize and Isize field format size The size field determines the cache size in conjunction with the M bit.
assoc The assoc field determines the cache associativity in conjunction with the M bit.
M bit The multiplier bit. Determines the cache size and cache associativity values in conjunction with the size and assoc fields.
len The len field determines the line length of the cache.
The register values for the ARM922T cache type register are listed in Table 2-6.
11 10 9 8 7 6 5 4 3 2 1 0 0 0 0 size assoc M len 23 22 21 20 19 18 17 16 15 14 13 12
Table 2-6 Cache type register format
Function Register bits Value
Reserved 31:29 0b000
ctype 28:25 0b0110
S 24 0b1 = Harvard cache
Dsize Reserved 23:21 0b000
size 20:18 0b100 = 8KB
assoc 17:15 0b110 = 64-way
M 14 0b0
len 13:12 0b10 = 8 words per line (32 bytes)
Programmer’s Model
Bits [28:25] indicate which major cache class the implementation falls into. 0x6 means that the cache provides:
• cache-clean-step operation
• cache-flush-step operation
• lockdown facilities.
The size of the cache is determined by the size field and the M bit. The M bit is 0 for the data and instruction caches. Bits [20:18] for the Data Cache (DCache) and bits [8:6]
for the Instruction Cache (ICache) are the size field. Table 2-7 shows the cache size encoding.
Isize Reserved 11:9 0b000
size 8:6 0b100 = 8KB
assoc 5:3 0b110 = 64-way
M 2 0b0
len 1:0 0b10 = 8 words per line (32 bytes)
Table 2-7 Cache size encoding (M=0) size field Cache size
0b000 512B
0b001 1KB
0b010 2KB
0b011 4KB
0b100 8KB
0b101 16KB
0b110 32KB
0b111 64KB
Table 2-6 Cache type register format (continued)
Function Register bits Value
Programmer’s Model
The associativity of the cache is determined by the assoc field and the M bit. The M bit is 0 for the data and instruction caches. Bits [17:15] for the DCache and bits [5:3] for the ICache are the assoc field. Table 2-8 shows the cache associativity encoding.
The line length of the cache is determined by the len field. Bits [13:12] for the DCache and bits [1:0] for the ICache are the len field. Table 2-9 shows the line length encoding.
Table 2-8 Cache associativity encoding (M=0) assoc field Associativity
0b000 Direct mapped
0b001 2-way
0b010 4-way
0b011 8-way
0b100 16-way
0b101 32-way
0b110 64-way
0b111 128-way
Table 2-9 Line length encoding len field Cache line length
00 2 words (8 bytes)
01 4 words (16 bytes)
10 8 words (32 bytes)
11 16 words (64 bytes)
Programmer’s Model
2.3.5 Register 1, control register
This register contains the control bits of the ARM922T. All reserved bits must either be written with 0 or 1, as indicated, or written using read-modify-write. The reserved bits have an unpredictable value when read. Use the following instructions to read and write this register:
MRC p15, 0, Rd, c1, c0, 0 ; read control register MCR p15, 0, Rd, c1, c0, 0 ; write control register
All defined control bits are set to 0 on reset, except the V bit. The V bit is set to 0 at reset if the VINITHI pin is LOW, or 1 if the VINITHI pin is HIGH. The functions of the control bits are shown in Table 2-10.
Table 2-10 Control register 1 bit functions Register
bits Name Function Value
31 iA bit Asynchronous clock select See Table 2-11 on page 2-13.
30 nF bit notFastBus select See Table 2-11 on page 2-13.
29:15 - Reserved Read = Unpredictable.
Write = Should be zero.
14 RR bit Round robin replacement 0 = Random replacement.
1 = Round-robin replacement.
13 V bit Base location of exception
registers
0 = Low addresses = 0x00000000. 1 = High addresses = 0xFFFF0000.
12 I bit ICache enable 0 = ICache disabled.
1 = ICache enabled.
11:10 - Reserved Read = 00.
Write = 00.
9 R bit ROM protection This bit modifies the MMU protection
system. See Domain access control on page 3-23.
8 S bit System protection This bit modifies the MMU protection
system. See Domain access control on page 3-23.
7 B bit Endianness 0 = Little-endian operation.
1 = Big-endian operation.
Programmer’s Model
Register 1 bits [31:30] select the clocking mode of the ARM922T, as shown in Table 2-11.
Enabling the MMU
You must take care with the address mapping of the code sequence used to enable the MMU (see Enabling the MMU on page 3-29).
See Enabling and disabling the ICache on page 4-6 and Enabling and disabling the DCache and write buffer on page 4-10 for the restrictions and the effects of having caches enabled with the MMU disabled.
6:3 - Reserved Read = 1111.
Write = 1111.
2 C bit DCache enable 0 = DCache disabled.
1 = DCache enabled.
1 A bit Alignment fault enable Data address alignment fault checking.
0 = Fault checking disabled.
1 = Fault checking enabled.
0 M bit MMU enable 0 = MMU disabled.
1 = MMU enabled.
Table 2-11 Clocking modes
Clocking mode iA nF
FastBus mode 0 0
Synchronous 0 1
Reserved 1 0
Asynchronous 1 1
Table 2-10 Control register 1 bit functions (continued) Register
bits Name Function Value
Programmer’s Model
2.3.6 Register 2, translation table base (TTB) register
This is the Translation Table Base (TTB) register, for the currently active first-level translation table. The contents of register 2 are shown in Table 2-12.
Reading from register 2 returns the pointer to the currently active first-level translation table in bits [31:14]. Writing to register 2 updates the pointer to the first-level translation table from bits [31:14] of the written value.
Bits [13:0] should be zero when written, and are unpredictable when read.
You can use the following instructions to access the TTB:
MRC p15, 0, Rd, c2, c0, 0 ; read TTB register MCR p15, 0, Rd, c2, c0, 0 ; write TTB register
2.3.7 Register 3, domain access control register
Register 3 is the read and write domain access control register, consisting of 16 2-bit fields. Each of these 2-bit fields defines the access permissions for the domains shown in Table 2-13.
Table 2-12 Register 2, translation table base Register
bits Function
31:14 Pointer to first-level translation table base. Read/write.
13:0 Reserved:
Read = Unpredictable.
Write = Should be zero.
Table 2-13 Register 3, domain access control Register
bits Domain
31:30 D15
29:28 D14
27:26 D13
25:24 D12
Programmer’s Model
The encoding of the two bit domain access permission field is given in Domain access control on page 3-23. You can use the following instructions to access the domain access control register:
MRC p15, 0, Rd, c3, c0, 0 ; read domain 15:0 access permissions MCR p15, 0, Rd, c3, c0, 0 ; write domain 15:0 access permissions
2.3.8 Register 4, reserved
You must not access (read or write) this register because it causes unpredictable behavior.
23:22 D11
21:20 D10
19:18 D9
17:16 D8
15:14 D7
13:12 D6
11:10 D5
9:8 D4
7:6 D3
5:4 D2
3:2 D1
1:0 D0
Table 2-13 Register 3, domain access control (continued) Register
bits Domain
Programmer’s Model
2.3.9 Register 5, fault status registers
Register 5 is the Fault Status Register (FSR). The FSR contains the source of the last data fault, indicating the domain and type of access being attempted when the Data Abort occurred. Table 2-14 shows bit allocations for the FSR.
The fault type encoding is shown in Fault address and fault status registers on page 3-22.
The data FSR is defined in ARMv4T. Additionally, a pipelined prefetch FSR is available, for debug purposes only. The pipeline matches that of the ARM9TDMI.
You can use the following instructions to access the data and prefetch FSR:
MRC p15, 0, Rd, c5, c0, 0 ;read data FSR value MCR p15, 0, Rd, c5, c0, 0 ;write data FSR value MRC p15, 0, Rd, c5, c0, 1 ;read prefetch FSR value MCR p15, 0, Rd, c5, c0, 1 ;write prefetch FSR value
The ability to write to the FSR is useful for a debugger to restore the value of the FSR.
You must write to the register using the read-modify-write method. Bits[31:8] should be zero.
Table 2-14 Fault status register Bit Description
31:9 UNP when read SBZ for write
8 0 when read
SBZ for write
7:4 Domain being accessed when fault occurred (D15 - D0)
3:0 Fault type
Programmer’s Model
2.3.10 Register 6, fault address register
Register 6 is the Fault Address Register (FAR). This contains the MVA of the access being attempted when the last fault occurred. The FAR is only updated for data faults, not for prefetch faults. (You can find the address for a prefetch fault in R14.)
You can use the following instructions to access the FAR:
MRC p15, 0, Rd, c6, c0, 0 ;read FAR data MCR p15, 0, Rd, c6, c0, 0 ;write FAR data
The ability to write to the FAR is provided to allow a debugger to restore a previous state.
2.3.11 Register 7, cache operations register
Register 7 is a write-only register used to manage the ICache and DCache.
The cache operations provided by register 7 are described in Table 2-15.
The function of each cache operation is selected by the opcode_2 and CRm fields in the MCR instruction used to write CP15 register 7. Writing other opcode_2 or CRm values is unpredictable.
Table 2-15 Function descriptions register 7
Function Description
Invalidate cache Invalidates all cache data, including any dirty data.a Use with caution.
a. Dirty data is data that has been modified in the cache but not yet written to main memory.
Invalidate single entry using MVA
Invalidates a single cache line, discarding any dirty data.a Use with caution.
Clean D single entry using either index or MVA
Writes the specified cache line to main memory, if the line is marked valid and dirty, and marks the line as not dirty.a The valid bit is unchanged.
Clean and Invalidate D entry using either index or MVA
Writes the specified cache line to main memory, if the line is marked valid and dirty.a The line is marked not valid.
Prefetch cache line Performs an ICache lookup of the specified MVA.
If the cache misses, and the region is cachable, a linefill is performed.
Programmer’s Model
Table 2-16 shows instructions that you can use to perform cache operations with register 7.
The operations that you can carry out on a single cache line identify the line using the data passed in the MCR instruction. The data is interpreted using one of the formats shown in Figure 2-4 on page 2-19 or Figure 2-5 on page 2-19.
Table 2-16 Cache operations register 7
Function Data Instruction
Invalidate ICache and DCache SBZ MCR p15,0,Rd,c7,c7,0
Invalidate ICache SBZ MCR p15,0,Rd,c7,c5,0
Invalidate ICache single entry (using MVA) MVA format
MCR p15,0,Rd,c7,c5,1
Prefetch ICache line (using MVA) MVA
format
MCR p15,0,Rd,c7,c13,1
Invalidate DCache SBZ MCR p15,0,Rd,c7,c6,0
Invalidate DCache single entry (using MVA)
MVA format
MCR p15,0,Rd,c7,c6,1
Clean DCache single entry (using MVA) MVA format
MCR p15,0,Rd,c7,c10,1
Clean and Invalidate DCache entry (using MVA)
MVA format
MCR p15,0,Rd,c7,c14,1
Clean DCache single entry (using index) Index format
MCR p15,0,Rd,c7,c10,2
Clean and Invalidate DCache entry (using index)
Index format
MCR p15,0,Rd,c7,c14,2
Drain write buffer a
a. Stops execution until the write buffer has drained.
SBZ MCR p15,0,Rd,c7,c10,4 Wait for interrupt b
b. Stops execution in a LOW power state until an interrupt occurs.
SBZ MCR p15,0,Rd,c7,c0,4
Programmer’s Model
Figure 2-4 Register 7 MVA format
Figure 2-5 Register 7 index format The use of register 7 is described in Chapter 4 Caches, Write Buffer, and Physical Address TAG (PA TAG) RAM.
2.3.12 Register 8, TLB operations register
Register 8 is a write-only register used to manage the Translation Lookaside Buffers (TLBs), the instruction TLB, and the data TLB.
Five TLB operations are defined and you can select the function to be performed with the opcode_2 and CRm fields in the MCR instruction used to write CP15 register 8. Writing other opcode_2 or CRm values is unpredictable. Reading from CP15 register 8 is unpredictable.
Table 2-17 shows instructions that you can use to perform TLB operations using register 8.
31 5 4 0
Modified virtual address SBZ
31 26 25 7 6 5 4 0
Index SBZ Seg SBZ
Table 2-17 TLB operations register 8
Function Data Instruction
Invalidate TLB(s) SBZ MCR p15,0,Rd,c8,c7,0
Invalidate I TLB SBZ MCR p15,0,Rd,c8,c5,0
Invalidate I TLB single entry (using MVA) MVA format
MCR p15,0,Rd,c8,c5,1
Invalidate D TLB SBZ MCR p15,0,Rd,c8,c6,0
Invalidate D TLB single entry (using MVA) MVA format
MCR p15,0,Rd,c8,c6,1
Programmer’s Model
Note
These functions invalidate all the unpreserved entries in the TLB. Invalidate TLB single entry functions invalidate any TLB entry corresponding to the MVA given in Rd, regardless of its preserved state. See Register 10, TLB lockdown register on page 2-22.
Figure 2-6 shows the MVA format used for operations on single entry TLB lines using register 8.
Figure 2-6 Register 8 MVA format
2.3.13 Register 9, cache lockdown register
Register 9 is the cache lockdown register. The cache lockdown register is 0x0 on reset.
The cache lockdown register allows software to control which cache line in the ICache or DCache respectively is loaded for a linefill and to prevent lines in the ICache or DCache from being evicted during a linefill, locking them into the cache.
There is a register for each of the ICache and DCache. The value of opcode_2 determines which cache register to access:
• opcode_2 = 0x0 accesses the DCache register
• opcode_2 = 0x1 accesses the ICache register.
The Opcode_1 and CRm fields should be zero.
Reading CP15 register 9 returns the value of the cache lockdown register, which is the base pointer for all cache segments.
Note
Only bits [31:26] are returned. Bits [25:0] are unpredictable.
Writing CP15 register 9 updates the cache lockdown register, both the base and the current victim pointer for all cache segments. Bits [25:0] should be zero.
The victim counter specifies the cache line to be used as the victim for the next linefill.
This is incremented using either a random or round-robin replacement policy,
determined by the state of the RR bit in register 1. The victim counter generates values in the range (base to 63). This locks lines with index values in the range (0 to base-1).
If base = 0, there are no locked lines.
31 10 9 0
Modified virtual address SBZ
Programmer’s Model
Writing to CP15 register 9 updates the base pointer and the current victim pointer. The next linefill uses, and then increments, the victim pointer. The victim pointer continues incrementing on linefills, and wraps around to the base pointer. For example, setting the base pointer to 0x3 prevents the victim pointer from selecting entries 0x0 to 0x2, locking them into the cache. Example 2-1 shows how you can load a cache line into ICache line 0 and lock it down.
Example 2-1 Load a cache line into ICache line 0 and lock it down
MCR to CP15 register 9, opcode_2 = 0x1, Victim=Base=0x0
MCR I prefetch. Assuming the ICache misses, a linefill occurs to line 0.
MCR to CP15 register 9, opcode_2 = 0x1, Victim=Base=0x1
More ICache linefills now occur into lines 1-63.
Example 2-2 shows how you can load a cache line into DCache line 0 and lock it down.
Example 2-2 Load a cache line into DCache line 0 and lock it down
MCR to CP15 register 9, opcode_2 = 0x0, Victim=Base=0x0
Data load (LDR/LDM). Assuming the DCache misses, a linefill occurs to line 0.
MCR to CP15 register 9, opcode_2 = 0x0, Victim=Base=0x1
More DCache linefills now occur into lines 1-63.
Note
Writing CP15 register 9, with the CRm field set to b0001, updates the current victim pointer only for the specified segment. Bits [31:26] specify the victim. Bits [7:5] specify the segment (for a 16KB cache). All other bits should be zero. This encoding is intended for debug use. You are not recommended to use this encoding.
Figure 2-7 shows the format of bits in register 9.
Figure 2-7 Register 9
31 26 25 0
Index UNP/SBZ
Programmer’s Model
Table 2-18 shows the instructions you can use to access the cache lockdown register.
2.3.14 Register 10, TLB lockdown register
Register 10 is the TLB lockdown register. The TLB lockdown register is 0x0 on reset.
There is a TLB lockdown register for each of the TLBs, the value of opcode_2 determines which TLB register to access:
• opcode_2 = 0x0 accesses the D TLB register
• opcode_2 = 0x1 accesses the I TLB register.
Reading CP15 register 10 returns the value of the TLB lockdown counter base register, the current victim number, and the preserve bit (P bit). Bits [19:1] are unpredictable when read.
Writing CP15 register 10 updates the TLB lockdown counter base register, the current victim pointer, and the state of the preserve bit. Bits [19:1] should be zero when written.
Table 2-19 shows the instructions you can use to access the TLB lockdown register.
Figure 2-8 on page 2-23 shows the format of bits in register 10.
Table 2-18 Accessing the cache lockdown register 9
Function Data Instruction
Read DCache lockdown base Base MRC p15,0,Rd,c9,c0,0
Write DCache victim and lockdown base Victim=Base MCR p15,0,Rd,c9,c0,0
Read ICache lockdown base Base MRC p15,0,Rd,c9,c0,1
Write ICache victim and lockdown base Victim=Base MCR p15,0,Rd,c9,c0,1
Table 2-19 Accessing the TLB lockdown register 10
Function Data Instruction
Read D TLB lockdown TLB lockdown MRC p15,0,Rd,c10,c0,0
Write D TLB lockdown TLB lockdown MCR p15,0,Rd,c10,c0,0
Read I TLB lockdown TLB lockdown MRC p15,0,Rd,c10,c0,1
Write I TLB lockdown TLB lockdown MCR p15,0,Rd,c10,c0,1
Programmer’s Model
Figure 2-8 Register 10 The entries in the TLBs are replaced using a round-robin replacement policy. This is implemented using a victim counter that counts from entry 0 up to 63, and then wraps back round to the base value and continues counting, wrapping around to the base value from 63 each time.
There are two mechanisms available for ensuring entries are not removed from the TLB:
• Locking an entry down prevents it from being selected for overwriting during a table walk. You can do this by programming the base value to which the victim counter reloads. For example, if the bottom 3 entries (0–2) are to be locked down, you must program the base counter to 3.
• You can preserve an entry during an Invalidate All instruction. You can do this by ensuring the P bit is set when the entry is loaded into the TLB. Examples that show how you can load a single entry into the I and D TLBs at location 0, make it immune to Invalidate All, and lock it down are shown in Example 2-3 and Example 2-4.
Example 2-3 Load a single entry into I TLB location 0, make it immune to Invalidate All and lock it down
MCR to CP15 register 10, opcode_2 = 0x1, Base Value = 0, Current Victim = 0, P = 1
MCR I prefetch.
Assuming an I TLB miss occurs, then entry 0 is loaded.
MCR to CP15 register 10, opcode_2 = 0x1, Base Value = 1, Current Victim = 1, P = 0
Example 2-4 Load a single entry into D TLB location 0, make it immune to Invalidate All and lock it down
MCR to CP15 register 10, opcode_2 = 0x0, Base Value = 0, Current Victim = 0, P = 1
Data load (LDR/LDM) or store (STR/STM). Assuming a D TLB miss occurs, then entry 0 is loaded.
31 26 25 20 19 1 0
Base Victim SBZ/UNP P
Programmer’s Model
P = 0
2.3.15 Registers 11, 12, and 14, reserved
Accessing (reading or writing) any of these registers causes unpredictable behavior.
2.3.16 Register 13, FCSE PID register
Register 13 is the Fast Context Switch Extension (FCSE) Process Identifier (PID) register. The FCSE PID register is 0x0 on reset.
Reading from CP15 register 13 returns the value of the FCSE PID. Writing CP15 register 13 updates the FCSE PID to the value in bits [31:25]. Bits [24:0] should be zero.
Register 13 bit assignments are shown in Figure 2-9.
Figure 2-9 Register 13 You can access register 13 using the following instructions:
MRC p15, 0, Rd, c13, c0, 0 ;read FCSE PID MCR p15, 0, Rd, c13, c0, 0 ;write FCSE PID
Using the FCSE process identifier (FCSE PID)
Addresses issued by the ARM9TDMI core in the range 0 to 32MB are translated by CP15 register 13, the FCSE PID register. Address A becomes A + (FCSE_PID x 32MB).
It is this translated address that is seen by both the caches and MMU. See Processor functional block diagram on page 1-3. Addresses above 32MB undergo no translation.
This is shown in Figure 2-10 on page 2-25.
The FCSE_PID is a 7-bit field, enabling 128 x 32MB processes to be mapped.
Note
If FCSE_PID is zero, as it is on reset, then there is a flat mapping between the ARM9TDMI and the caches and MMU.
31 25 24 0
FCSE PID SBZ
Programmer’s Model
Figure 2-10 Address mapping using CP15 Register 13
Changing the FCSE PID, performing a fast context switch
To do a fast context switch, write to CP15 register 13. The contents of the caches and TLBs do not have to be flushed after a fast context switch because they still hold valid address tags. The two instructions after the MCR to write the FCSE_PID are fetched with the old FCSE_PID value:
{FCSE_PID = 0}
MOV r0, #1:SHL:25 ; Fetched with FCSE_PID = 0 MCR p15,0,r0,c13,c0,0 ; Fetched with FCSE_PID = 0
A1 ; Fetched with FCSE_PID = 0
A2 ; Fetched with FCSE_PID = 0
A3 ; Fetched with FCSE_PID = 1
2.3.17 Register 15, test configuration register
Register 15 is used for test purposes. Accessing (reading or writing) this register causes the ARM922T to have unpredictable behavior.
0 1 2 127
C13 Virtual address (VA)
issued by ARM9TDMI
Modified virtual address (MVA) input to caches and MMU
0 4GB
0 32MB 4GB
32MB 64MB
Programmer’s Model
Chapter 3
Memory Management Unit
This chapter describes the Memory Management Unit (MMU). It contains the following sections:
• About the MMU on page 3-2
• MMU program accessible registers on page 3-4
• Address translation on page 3-6
• MMU faults and CPU aborts on page 3-21
• Fault address and fault status registers on page 3-22
• Domain access control on page 3-23
• Fault checking sequence on page 3-25
• External aborts on page 3-28
• Interaction of the MMU and caches on page 3-29.