View ARM720T_1358328.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

arm ddi 0192a ARM720T (rev 3) technical reference manual
ii copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a ARM720T technical reference manual copyright ? arm limited 1997, 1998, 2000. all rights reserved. release information proprietary notice arm, the arm powered logo, thumb, and strongarm are registered trademarks of arm limited. the arm logo, amba, angel, armulator, embeddedice, modelgen, multi-ice, primecell, arm7tdmi, arm7tdmi-s, arm9tdmi, arm9e-s, arm946e-s, arm966e-s, etm7, etm9, tdmi, and strong are trademarks of arm limited. figure 7-3 on page 7-10 reprinted with permission ieee std. 1149.1-1990. ieee standard test access port and boundary scan architecture copyright 1997,1998, 2000, by ieee. the ieee disclaims any responsibility or liability resulting from the placement and use in the described manner. document confidentiality status this document is open access. this means there is no restriction on the distribution of the information. product status the information in this document is final (information on a developed product). arm web address http://www.arm.com change history date issue change september 2000 a first release all other products or services mentioned herein may be trademarks of their respective owners. neither the whole nor any part of the information contained in, or the product described in, this document may be adapted or reproduced in any material form except with the prior written permission of the copyright holder. the product described in this document is subject to continuous developments and improvements. all particulars of the product and its use contained in this document are given by arm limited in good faith. however, all warranties implied or expressed, including but not limited to implied warranties or merchantability, or fitness for purpose, are excluded. this document is intended only to assist the reader in the use of the product. arm limited shall not be liable for any loss or damage arising from the use of any information in this document, or any error or omission in such information, or any incorrect use of the product.
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. iii contents ARM720T technical reference manual list of tables ............................................................................................................vii list of figures ............................................................................................................ix preface about this document .....................................................................................................xii further reading..............................................................................................................xv feedback .....................................................................................................................xv i chapter 1 introduction 1.1 about the ARM720T ..................................................................................... 1-2 1.2 coprocessors................................................................................................ 1-4 1.3 about the instruction set ............................................................................... 1-5 chapter 2 programmer?s model 2.1 processor operating states ........................................................................... 2-2 2.2 memory formats ............................................................................................ 2-3 2.3 instruction length........................................................................................... 2-5 2.4 data types..................................................................................................... 2-6 2.5 operating modes .......................................................................................... 2-7 2.6 registers....................................................................................................... 2-8 2.7 the program status registers ...................................................................... 2-13
iv copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 2.8 exceptions .................................................................................................. 2-16 2.9 relocation of low virtual addresses by the fcse pid................................ 2-22 2.10 reset .......................................................................................................... 2-23 2.11 implementation-defined behavior of instructions ........................................ 2-24 chapter 3 configuration 3.1 about configuration....................................................................................... 3-2 3.2 internal coprocessor instructions.................................................................. 3-3 3.3 registers ...................................................................................................... 3-4 chapter 4 instruction and data cache 4.1 about the instruction and data cache ........................................................... 4-2 4.2 idc validity ................................................................................................... 4-4 4.3 idc enable, disable, and reset ..................................................................... 4-5 4.4 idc disable for secure applications .............................................................. 4-6 chapter 5 write buffer 5.1 about the write buffer ................................................................................... 5-2 5.2 write buffer operation ................................................................................... 5-3 chapter 6 memory management unit 6.1 about the mmu............................................................................................. 6-2 6.2 mmu program accessible registers .............................................................. 6-4 6.3 address translation process ......................................................................... 6-5 6.4 level 1 descriptor ......................................................................................... 6-7 6.5 page table descriptor.................................................................................... 6-8 6.6 section descriptor......................................................................................... 6-9 6.7 translating section references ................................................................... 6-11 6.8 level 2 descriptor ....................................................................................... 6-12 6.9 translating small page references ............................................................. 6-14 6.10 translating large page references.............................................................. 6-16 6.11 mmu faults and cpu aborts....................................................................... 6-18 6.12 fault address and fault status registers...................................................... 6-19 6.13 domain access control ............................................................................... 6-21 6.14 fault checking sequence............................................................................ 6-22 6.15 external aborts ........................................................................................... 6-25 6.16 interaction of the mmu, idc, and write buffer ............................................ 6-26 chapter 7 debug interface 7.1 about the debug interface ............................................................................ 7-2 7.2 debug systems............................................................................................. 7-4 7.3 entering debug state .................................................................................... 7-7 7.4 scan chains and jtag interface .................................................................. 7-9 7.5 reset .......................................................................................................... 7-11 7.6 public instructions....................................................................................... 7-12 7.7 test data registers...................................................................................... 7-16 7.8 arm7tdm core clocks............................................................................... 7-23
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. v 7.9 determining the core and system state....................................................... 7-25 7.10 the pc during debug.................................................................................. 7-30 7.11 priorities and exceptions............................................................................. 7-34 7.12 scan interface timing .................................................................................. 7-35 7.13 scan and debug signals used by the embedded trace logic....................... 7-42 chapter 8 embeddedice logic 8.1 about embeddedice logic........................................................................... 8-2 8.2 the watchpoint registers............................................................................... 8-4 8.3 programming breakpoints............................................................................. 8-9 8.4 programming watchpoints........................................................................... 8-11 8.5 the debug control register .......................................................................... 8-13 8.6 debug status register .................................................................................. 8-15 8.7 coupling breakpoints and watchpoints ....................................................... 8-17 8.8 debug communications channel ................................................................. 8-19 chapter 9 bus clocking 9.1 about the ARM720T bus interface................................................................ 9-2 9.2 fastbus extension......................................................................................... 9-3 9.3 standard mode ............................................................................................. 9-5 chapter 10 amba interface 10.1 about the amba interface........................................................................... 10-2 10.2 asb bus interface signals ........................................................................... 10-3 10.3 cycle types ................................................................................................. 10-4 10.4 addressing signals...................................................................................... 10-7 10.5 memory request signals.............................................................................. 10-8 10.6 data signal timing ....................................................................................... 10-9 10.7 slave response signals ............................................................................. 10-10 10.8 maximum sequential length ...................................................................... 10-12 10.9 read-lock-write ......................................................................................... 10-13 10.10 little-endian and big-endian operation...................................................... 10-14 10.11 multi-master operation .............................................................................. 10-17 10.12 bus master handover ................................................................................ 10-19 10.13 default bus master.................................................................................... 10-21 chapter 11 amba test 11.1 slave operation, test mode ......................................................................... 11-2 11.2 ARM720T test mode ................................................................................... 11-3 11.3 arm7tdm core test mode.......................................................................... 11-5 11.4 ram test mode ........................................................................................... 11-6 11.5 tag test mode............................................................................................ 11-8 11.6 mmu test mode......................................................................................... 11-10 11.7 test register mapping ............................................................................... 11-11 chapter 12 trace interface port 12.1 about the etm ............................................................................................ 12-2
vi copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 12.2 etm interface ............................................................................................. 12-3 appendix a signal descriptions a.1 amba interface signals ................................................................................ a-2 a.2 coprocessor interface signals ...................................................................... a-5 a.3 jtag signals ................................................................................................ a-7 a.4 debugger signals.......................................................................................... a-9 a.5 embedded trace macrocell interface signals.............................................. a-10 a.6 miscellaneous signals................................................................................. a-12 a.7 additional signal outputs............................................................................. a-13 index ....................................................................................................................index-i
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. vii list of tables ARM720T technical reference manual table 1-1 key to tables ......................................................................................... 1-5 table 1-2 arm instruction summary ..................................................................... 1-8 table 1-3 addressing mode 2 ............................................................................. 1-11 table 1-4 addressing mode 2 (privileged) .......................................................... 1-12 table 1-5 addressing mode 3 ............................................................................. 1-12 table 1-6 addressing mode 4 (load) ................................................................... 1-13 table 1-7 addressing mode 4 (store).................................................................. 1-13 table 1-8 addressing mode 5 ............................................................................. 1-14 table 1-9 operand 2 ........................................................................................... 1-14 table 1-10 fields................................................................................................... 1-14 table 1-11 condition fields.................................................................................... 1-15 table 1-12 thumb instruction summary ............................................................... 1-17 table 2-1 ARM720T modes of operation .............................................................. 2-7 table 2-2 psr mode bit values........................................................................... 2-14 table 2-3 exception entry and exit...................................................................... 2-17 table 2-4 exception vector addresses ................................................................ 2-20 table 3-1 cache and mmu control register .......................................................... 3-4 table 3-2 cache operation.................................................................................... 3-9 table 3-3 tlb operations.................................................................................... 3-10 table 6-1 mmu program accessible registers....................................................... 6-4 table 6-2 interpreting level 1 descriptor bits [1:0] ................................................. 6-7 table 6-3 interpreting access permission (ap) bits............................................. 6-10 table 6-4 interpreting page table entry bits 1:0................................................... 6-12
viii copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a table 6-5 priority encoding of fault status .......................................................... 6-19 table 6-6 interpreting access bits in domain access control register ................. 6-21 table 6-7 valid mmu, idc and write buffer combinations.................................. 6-26 table 7-1 scan chain number allocation ............................................................ 7-18 table 7-2 ARM720T scan interface timing ......................................................... 7-35 table 7-3 scan chain 0, signals and positions ................................................... 7-37 table 7-4 scan and debug signals used by the etm ......................................... 7-42 table 8-1 function and mapping of embeddedice registers............................... 8-4 table 8-2 mas[1:0] signal encoding..................................................................... 8-7 table 8-3 ifen signal control ............................................................................. 8-14 table 10-1 btran[1:0] encoding......................................................................... 10-8 table 11-1 ram test mode address packet bit positions ..................................... 11-6 table 11-2 tag test mode tag ctl packet bit positions.................................... 11-9 table 11-3 status packet bit positions bits [31:0] ............................................... 11-11 table 11-4 control packet bit positions bits [31:0].............................................. 11-13 table a-1 amba signal descriptions .................................................................... a-2 table a-2 coprocessor interface signal descriptions ........................................... a-5 table a-3 jtag signal descriptions ..................................................................... a-7 table a-4 debugger signal descriptions .............................................................. a-9 table a-5 etm interface signal descriptions ...................................................... a-10 table a-6 miscellaneous signal descriptions ..................................................... a-12
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. ix list of figures ARM720T technical reference manual figure 1-1 block diagram ....................................................................................... 1-3 figure 1-2 arm instruction set formats .................................................................. 1-7 figure 1-3 thumb instruction set formats............................................................. 1-16 figure 2-1 big-endian addresses of bytes with words............................................ 2-3 figure 2-2 little-endian addresses of bytes with words ......................................... 2-4 figure 2-3 register organization in arm state....................................................... 2-9 figure 2-4 register organization in thumb state ................................................. 2-10 figure 2-5 mapping of thumb state registers onto arm state registers .............. 2-11 figure 2-6 program status register format............................................................ 2-13 figure 3-1 mrc and mcr bit pattern..................................................................... 3-3 figure 3-2 id register read ..................................................................................... 3-5 figure 3-3 id register write ..................................................................................... 3-5 figure 3-4 register 1 read...................................................................................... 3-5 figure 3-5 register 1 write ..................................................................................... 3-5 figure 3-6 register 2.............................................................................................. 3-7 figure 3-7 register 3.............................................................................................. 3-7 figure 3-8 register 4.............................................................................................. 3-8 figure 3-9 register 5.............................................................................................. 3-8 figure 3-10 register 6.............................................................................................. 3-9 figure 3-11 register 13 with opcode_2=0 ............................................................. 3-11 figure 3-12 register 13 with opcode_2=1 ............................................................. 3-11 figure 6-1 translation table base register.............................................................. 6-5 figure 6-2 accessing the translation table first level descriptors............................ 6-6
x copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a figure 6-3 level 1 descriptors ............................................................................... 6-7 figure 6-4 section translation .............................................................................. 6-11 figure 6-5 page table entry, level 2 descriptor .................................................... 6-12 figure 6-6 small page translation ........................................................................ 6-15 figure 6-7 large page translation........................................................................ 6-17 figure 6-8 domain access control register format ............................................... 6-21 figure 6-9 sequence for checking faults ............................................................. 6-22 figure 7-1 typical debug system........................................................................... 7-4 figure 7-2 arm7tdm scan chain arrangement .................................................... 7-6 figure 7-3 test access port (tap) controller state transitions............................. 7-10 figure 7-4 id code register format ....................................................................... 7-16 figure 7-5 input scan cell..................................................................................... 7-19 figure 7-6 clock switching on entry to debug state ............................................. 7-24 figure 7-7 scan general timing............................................................................ 7-35 figure 7-8 reset period timing............................................................................. 7-36 figure 7-9 output enable and disable times due to highz tap instruction ....... 7-36 figure 7-10 output enable and disable times due to data scanning...................... 7-37 figure 8-1 arm7tdmi tap controller and embeddedice.................................... 8-2 figure 8-2 embeddedice block diagram............................................................... 8-5 figure 8-3 watchpoint control value and mask format .......................................... 8-6 figure 8-4 debug control register format ............................................................. 8-13 figure 8-5 debug status register format .............................................................. 8-15 figure 8-6 debug control and status register structure........................................ 8-16 figure 8-7 debug comms control register............................................................ 8-19 figure 9-1 conceptual device clocking using the fastbus extension ..................... 9-3 figure 9-2 conceptual device clocking in standard mode ..................................... 9-5 figure 9-3 relationship of fclk and bclk in synchronous mode ....................... 9-7 figure 10-1 simple single-cycle access................................................................. 10-4 figure 10-2 simple sequential access ................................................................... 10-5 figure 10-3 minimum interval between bus accesses ........................................... 10-6 figure 10-4 use of the bwait pin to stop ARM720T for 1 bclk cycle .............. 10-11 figure 10-5 little-endian addresses of bytes within words .................................. 10-14 figure 10-6 big-endian addresses of bytes within words .................................... 10-15 figure 10-7 bus master handover ....................................................................... 10-19 figure 11-1 running a test vector on the processor core...................................... 11-2 figure 11-2 state machine for ARM720T and arm7tdmi test............................. 11-3 figure 11-3 .state machine for ram test mode..................................................... 11-6 figure 11-4 state machine for tag test mode ...................................................... 11-8 figure 11-5 state machine for mmu test mode ................................................... 11-10 figure 12-1 etm interface signal timing ................................................................ 12-3 figure 12-2 etmclk power saving....................................................................... 12-4
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. xi preface this preface introduces the ARM720T and its reference documentation. it contains the following sections: ? about this document on page xii further reading on page xv feedback on page xvi.
preface xii copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a about this document this document is a technical reference manual for the ARM720T. intended audience this document has been written for experienced hardware and software engineers who might or might not have experience of the architecture, configuration, integration, and instruction sets with reference to the arm product range. using this manual this document is organized into the following chapters: chapter 1 introduction read this chapter for an introduction to the ARM720T. chapter 2 programmer?s model read this chapter for a description of the 32-bit arm and 16-bit thumb instruction sets. chapter 3 configuration read this chapter for a description of how the operation and configuration of the ARM720T is controlled. chapter 4 instruction and data cache read this chapter for an overview of the mixed instruction and data cache. chapter 5 write buffer read this chapter for a description of how you can enhance the system performance of the ARM720T by using the write buffer. chapter 6 memory management unit read this chapter for a description of the functions and use of the memory management unit.
preface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. xiii chapter 7 debug interface read this chapter for a description of the hardware extensions used for advanced debugging. chapter 8 embeddedice logic read this chapter for a description of the integrated on-chip debug support for the ARM720T core. chapter 9 bus clocking read this chapter for a description of the ARM720T bus interface. chapter 10 amba interface read this chapter for a description of the functions and operation of the ARM720T bus master. chapter 11 amba test read this chapter for a description of the ARM720T test features. chapter 12 trace interface port read this chapter for a description of the embedded trace macrocell support for the ARM720T. appendix a signal descriptions read this appendix for a list of all ARM720T interface signals. typographical conventions the following typographical conventions are used in this document: bold highlights arm processor signal names, and interface elements such as menu names. also used for terms in descriptive lists, where appropriate. italic highlights special terminology, cross-references, and citations. typewriter denotes text that can be entered at the keyboard, such as commands, file names and program names, and source code. type writer denotes a permitted abbreviation for a command or option. the underlined text can be entered instead of the full command or option name.
preface xiv copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a typewriter italic denotes arguments to commands or functions where the argument is to be replaced by a specific value. typewriter bold denotes language keywords when used outside example code. timing diagram conventions this manual contains one or more timing diagrams. the following key explains the components used in these diagrams. any variations are clearly labeled when they occur. therefore, no additional meaning must be attached unless specifically stated. key to timing diagram conventions shaded bus and signal areas are undefined, so the bus or signal can assume any value within the shaded area at that time. the actual level is unimportant and does not affect normal operation. clock bus stable high to low transient bus to high impedance bus change high/low to high high impedance to stable bus
preface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. xv further reading this section lists publications by arm limited, and by third parties. arm periodically provides updates and corrections to its documentation. see http://www.arm.com for current errata sheets and addenda. see also the arm frequently asked questions list at: http://www.arm.com/devsupp/sales+support/faq.html arm publications this document contains information that is specific to the ARM720T. refer to the following documents for other relevant information: arm architecture reference manual (arm ddi 0100) amba specification (arm ihi 0001) etm7 technical reference manual (arm ddi 0158) arm7tdmi technical reference manual (arm ddi 0029). other publications this section lists relevant documents published by third parties. standard test access port and boundary scan architecture (ieee std. 1149.1.1990).
preface xvi copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a feedback arm limited welcomes feedback both on the ARM720T, and on the documentation. feedback on the ARM720T if you have any comments or suggestions about this product, please contact your supplier giving: the product name a concise explanation of your comments. feedback on the ARM720T documentation if you have any comments about this document, please send email to errata@arm.com giving: the document title the document number the page number(s) to which your comments refer a concise explanation of your comments. general suggestions for additions and improvements are also welcome.
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 1-1 chapter 1 introduction this chapter provides an introduction to the ARM720T. it contains the following sections: about the ARM720T on page 1-2 coprocessors on page 1-4 about the instruction set on page 1-5.
introduction 1-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 1.1 about the ARM720T the ARM720T is a general-purpose 32-bit microprocessor with 8kb cache, enlarged write buffer, and memory management unit (mmu) combined in a single chip. the cpu within the ARM720T is the arm7tdmi. the ARM720T is software-compatible with the arm processor family. the on-chip mixed data and instruction cache, together with the write buffer, substantially raise the average execution speed and reduce the average amount of memory bandwidth required by the processor. this allows the external memory to support additional processors or direct memory access (dma) channels with minimal performance loss. the allocation of virtual addresses with different task ids improve performance in task switching operations with the cache enabled. these relocated virtual addresses are monitored by the embeddedice block. the mmu supports a conventional two-level, page-table structure and a number of extensions that make it ideal for embedded control, unix, and object-oriented systems. the memory interface is designed to allow the performance potential to be realized without incurring high costs in the memory system. speed-critical control signals are pipelined to allow system control functions to be implemented in standard low-power logic, and these control signals permit the exploitation of paged mode access offered by industry-standard drams. the ARM720T is provided with an embedded trace macrocell (etm) interface that brings out the required signals from the arm core to the periphery of the ARM720T. this allows you to connect a standard etm7 macrocell. ARM720T is a fully static part and has been designed to minimize power requirements. this makes it ideal for portable applications where both features are essential. the ARM720T architecture is based on reduced instruction set computer (risc) principles. the instruction set and related decode mechanism are greatly simplified compared with microprogrammed complex instruction set computers (ciscs). a block diagram of the ARM720T is shown in figure 1-1 on page 1-3.
introduction arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 1-3 figure 1-1 block diagram mmu data and address buffers amba interface 8 kb cache control and clocking logic arm7tdmi cpu system control coprocessor virtual address bus amba bus interface jtag debug interface etm interface coprocessor interface internal data bus
introduction 1-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 1.2 coprocessors the ARM720T has an internal coprocessor designated cp15 for internal control of the device (see registers on page 3-4). the ARM720T also includes a port for the connection of on-chip coprocessors. these allow extension of the ARM720T functionality in an architecturally consistent manner.
introduction arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 1-5 1.3 about the instruction set the instruction set comprises ten basic instruction types: two types use the on-chip arithmetic logic unit, barrel shifter, and multiplier to perform high-speed operations on the data in a bank of 31 registers, each 32 bits wide. three types of instruction control the data transfer between memory and the registers: ? one optimized for flexibility of addressing ? one for rapid context switching ? one for swapping data. two instructions control the flow and privilege level of execution. three types are dedicated to the control of external coprocessors. these allow you to extend the functionality of the instruction set off-chip in an open and uniform way. the arm instruction set is a good target for compilers of many different high-level languages. where required for critical code segments, assembly code programming is also straightforward, unlike some risc processors that depend on sophisticated compiler technology to manage complicated instruction interdependencies. 1.3.1 format summary this section provides a summary of the arm and thumb instruction sets: arm instruction set on page 1-6 thumb instruction set on page 1-15. a key to the instruction set tables is listed in table 1-1. the arm7tdmi is an implementation of the armv4t architecture. for a complete description of both instruction sets, see the arm architecture reference manual . table 1-1 key to tables description {cond} refer to table 1-11 on page 1-15 . refer to table 1-9 on page 1-14 . {field} refer to table 1-10 on page 1-14.
introduction 1-6 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 1.3.2 arm instruction set this section gives an overview of the arm instructions available. for full details of these instructions, refer to the arm architecture reference manual . the arm instruction set formats are shown at figure 1-2 on page 1-7. s sets condition codes (optional). b byte operation (optional). h halfword operation (optional). t forces address translation. cannot be used with pre-indexed addresses. refer to table 1-3 on page 1-11 . refer to table 1-4 on page 1-12 . refer to table 1-5 on page 1-12 . refer to table 1-6 on page 1-13 . refer to table 1-7 on page 1-13 . refer to table 1-8 on page 1-14 . #32bit_imm a 32-bit constant, formed by right-rotating an 8-bit value by an even number of bits. a comma-separated list of registers, enclosed in braces ( { and } ). table 1-1 key to tables (continued)
introduction arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 1-7 figure 1-2 arm instruction set formats note some instruction codes are not defined but do not cause the undefined instruction trap to be taken. for example, a multiply instruction with bit 6 changed to a 1. you must not use these instructions, as their action might change in future arm implementations. data processing immediate multiply long load/store halfword/ signed byte load/store halfword/ signed byte load/store multiple branch and branch with link coprocessor load and store coprocessor data processing coprocessor register transfers software interrupt 0 0 0 1 1 1 1 1 1 0 0 0 0 0 1 1 1 1 0 0 0 0 1 0 1 1 1 0 p p p 0 0 1 1 u u u 0 1 a w w s l l p u s w l multiply 0 0 0 0 0 0 a s l 24_bit_offset rd rdhi rn rn rn u n w l rn op1 op1 swi_number l rn rdlo rd rd register list rs crn crn crd crd rd cp_num cp_num cp_num rn 1 0 0 1 1 0 0 1 sbz 1 s h 1 high offset 1 s h 1 rm rm rm rm low offset 8_bit_offset op2 op2 0 1 crm crm 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 data processing immediate shift 0 0 0 opcode s rn rd shift immediate shift 0 rm data processing register shift 0 0 0 opcode s rn rd rs shift 1 rm 0 move from status register 0 0 0 1 0 r 0 0 sbo rd sbz move immediate to status register 0 0 1 1 0 r 1 0 mask sbo rotate immediate move register to status register 0 0 0 1 0 r 1 0 mask sbo sbz rm 0 branch/exchange instruction set 0 0 0 1 0 0 1 0 sbo sbo sbo rm 1 0 0 0 load/store immediate offset 0 1 0 p u b w l rn rd immediate load/store register offset 0 1 1 p u b w l rn rd shift immediate shift 0 swap/swap byte 0 0 0 1 0 b 0 0 rn rd 1 0 0 1 sbz rm undefined cond cond cond cond cond cond cond cond cond cond cond cond cond cond cond cond cond cond cond 0 0 1 op s rn rd rotate immediate cond 0 1 1 x 1 x x x x x x x x x x x x x x x x x x x x x x x cond
introduction 1-8 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a the arm instruction set summary is listed in table 1-2. table 1-2 arm instruction summary operation assembler move move mov{cond}{s} rd, move not mvn{cond}{s} rd, move spsr to register mrs{cond} rd, spsr move cpsr to register mrs{cond} rd, cpsr move register to spsr msr{cond} spsr{field}, rm move register to cpsr msr{cond} cpsr{field}, rm move immediate to spsr flags msr{cond} spsr_f, #32bit_imm move immediate to cpsr flags msr{cond} cpsr_f, #32bit_imm arithmetic add add{cond}{s} rd, rn, add with carry adc{cond}{s} rd, rn, subtract sub{cond}{s} rd, rn, subtract with carry sbc{cond}{s} rd, rn, subtract reverse subtract rsb{cond}{s} rd, rn, subtract reverse subtract with carry rsc{cond}{s} rd, rn, multiply mul{cond}{s} rd, rm, rs multiply accumulate mla{cond}{s} rd, rm, rs, rn multiply unsigned long umull{cond}{s} rdlo, rdhi, rm, rs multiply unsigned accumulate long umlal{cond}{s} rdlo, rdhi, rm, rs multiply signed long smull{cond}{s} rdlo, rdhi, rm, rs multiply signed accumulate long smlal{cond}{s} rdlo, rdhi, rm, rs compare cmp{cond} rd, compare negative cmn{cond} rd,
introduction arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 1-9 logical test tst{cond} rn, test equivalence teq{cond} rn, and and{cond}{s} rd, rn, eor eor{cond}{s} rd, rn, orr orr{cond}{s} rd, rn, bit clear bic{cond}{s} rd, rn, branch branch b{cond} label branch with link bl{cond} label branch, and exchange instruction set bx{cond} rn load word ldr{cond} rd, word with user mode privilege ldr{cond}t rd, byte ldr{cond}b rd, byte with user mode privilege ldr{cond}bt rd, byte signed ldr{cond}sb rd, halfword ldr{cond}h rd, halfword signed ldr{cond}sh rd, multiple block data operations increment before ldm{cond}ib rd{!}, {^} increment after ldm{cond}ia rd{!}, {^} decrement before ldm{cond}db rd{!}, {^} decrement after ldm{cond}da rd{!}, {^} stack operations ldm{cond} rd{!}, stack operations, and restore cpsr ldm{cond} rd{!}, ^ table 1-2 arm instruction summary (continued) operation assembler
introduction 1-10 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a user registers ldm{cond} rd{!}, ^ store word str{cond} rd, word with user mode privilege str{cond}t rd, byte str{cond}b rd, byte with user mode privilege str{cond}bt rd, halfword str{cond}h rd, multiple block data operations increment before stm{cond}ib rd{!}, {^} increment after stm{cond}ia rd{!}, {^} decrement before stm{cond}db rd{!}, {^} decrement after stm{cond}da rd{!}, {^} stack operations stm{cond} rd{!}, user registers stm{cond} rd{!}, ^ swap word swp{cond} rd, rm, [rn] byte swp{cond}b rd, rm, [rn] coprocessors data operations cdp{cond} p, , crd, crn, crm, move to arm reg from coproc mrc{cond} p, , rd, crn, crm, move to coproc from arm reg mcr{cond} p, , rd, crn, crm, load ldc{cond} p, crd, store stc{cond} p, crd, software interrupt swi 24bit_imm table 1-2 arm instruction summary (continued) operation assembler
introduction arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 1-11 addressing mode 2 is listed in table 1-3. table 1-3 addressing mode 2 addressing mode 2 immediate offset [rn, #+/-12bit_offset] register offset [rn, +/-rm] scaled register offset [rn, +/-rm, lsl #5bit_shift_imm] [rn, +/-rm, lsr #5bit_shift_imm] [rn, +/-rm, asr #5bit_shift_imm] [rn, +/-rm, ror #5bit_shift_imm] [rn, +/-rm, rrx] pre-indexed offset immediate [rn, #+/-12bit_offset]! register [rn, +/-rm]! scaled register [rn, +/-rm, lsl #5bit_shift_imm]! [rn, +/-rm, lsr #5bit_shift_imm]! [rn, +/-rm, asr #5bit_shift_imm]! [rn, +/-rm, ror #5bit_shift_imm]! [rn, +/-rm, rrx]! post-indexed offset immediate [rn], #+/-12bit_offset register [rn], +/-rm scaled register [rn], +/-rm, lsl #5bit_shift_imm [rn], +/-rm, lsr #5bit_shift_imm [rn], +/-rm, asr #5bit_shift_imm [rn], +/-rm, ror #5bit_shift_imm [rn, +/-rm, rrx]
introduction 1-12 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a addressing mode 2 (privileged) is listed in table 1-4. addressing mode 3 is listed in table 1-5. table 1-4 addressing mode 2 (privileged) addressing mode 2 (privileged) immediate offset [rn, #+/-12bit_offset] register offset [rn, +/-rm] scaled register offset [rn, +/-rm, lsl #5bit_shift_imm] [rn, +/-rm, lsr #5bit_shift_imm] [rn, +/-rm, asr #5bit_shift_imm] [rn, +/-rm, ror #5bit_shift_imm] [rn, +/-rm, rrx] post-indexed offset immediate [rn], #+/-12bit_offset register [rn], +/-rm scaled register [rn], +/-rm, lsl #5bit_shift_imm [rn], +/-rm, lsr #5bit_shift_imm [rn], +/-rm, asr #5bit_shift_imm [rn], +/-rm, ror #5bit_shift_imm [rn, +/-rm, rrx] table 1-5 addressing mode 3 addressing mode 3 - signed byte, and halfword data transfer immediate offset [rn, #+/-8bit_offset] pre-indexed [rn, #+/-8bit_offset]! post-indexed [rn], #+/-8bit_offset
introduction arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 1-13 addressing mode 4 (load) is listed in table 1-6. addressing mode 4 (store) is listed in table 1-7. register [rn, +/-rm] pre-indexed [rn, +/-rm]! post-indexed [rn], +/-rm table 1-6 addressing mode 4 (load) addressing mode 4 (load) addressing mode stack type ia increment after fd full descending ib increment before ed empty descending da decrement after fa full ascending db decrement before ea empty ascending table 1-7 addressing mode 4 (store) addressing mode 4 (store) addressing mode stack type ia increment after ea empty ascending ib increment before fa full ascending da decrement after ed empty descending db decrement before fd full descending table 1-5 addressing mode 3 (continued)
introduction 1-14 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a addressing mode 5 is listed in table 1-8. operand 2 is listed in table 1-9. fields are listed in table 1-10. table 1-8 addressing mode 5 addressing mode 5 - coprocessor data transfer immediate offset [rn, #+/-(8bit_offset*4)] pre-indexed [rn, #+/-(8bit_offset*4)]! post-indexed [rn], #+/-(8bit_offset*4) table 1-9 operand 2 operand 2 immediate value #32bit_imm logical shift left rm lsl #5bit_imm logical shift right rm lsr #5bit_imm arithmetic shift right rm asr #5bit_imm rotate right rm ror #5bit_imm register rm logical shift left rm lsl rs logical shift right rm lsr rs arithmetic shift right rm asr rs rotate right rm ror rs rotate right extended rm rrx table 1-10 fields field {field} suffix sets _c control field mask bit (bit 3)
introduction arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 1-15 condition fields are listed in table 1-11. 1.3.3 thumb instruction set this section gives an overview of the thumb instructions available. for full details of these instructions, see the arm architecture reference manual . _f flags field mask bit (bit 0) _s status field mask bit (bit 1) _x extension field mask bit (bit 2) table 1-11 condition fields condition field {cond} suffix description condition(s) eq equal z set ne not equal z clear cs unsigned higher, or same c set cc unsigned lower c clear mi negative n set pl positive, or zero n clear vs overflow v set vc no overflow v clear hi unsigned higher c set, z clear ls unsigned lower, or same c clear, z set ge greater, or equal n=v (n and v set or n and v clear) lt less than n<>v (n set and v clear) or (n clear and v set) gt greater than z clear, n=v (n and v set or n and v clear) le less than, or equal z set or n<>v (n set and v clear) or (n clear and v set) al always always table 1-10 fields (continued)
introduction 1-16 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a the thumb instruction set formats are shown in figure 1-3. figure 1-3 thumb instruction set formats 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 rd rd rb rb op 0 0 1 h1 h2 0 1 0 0 0 0 0 1 0 0 1 ro 1 l b 0 offset8 op word8 rd rn/ offset3 rd rs op 0 0 0 1 1 1 rd op rd rs rdhd rs/hs 0 1 0 0 0 1 0 1 0 rd rb ro 1 h s 1 0 1 0 offset5 b l 0 1 1 rb rd offset5 0 l 1 0 0 rd word8 1 l 1 0 0 rd word8 0 sp 1 0 1 sword7 0 0 0 s 1 1 0 1 0 rlist 1 0 r 1 1 l 1 0 rlist rb 0 0 l 1 1 softset8 cond 0 1 1 1 value8 1 1 1 1 1 0 1 1 offset11 0 1 1 0 1 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 03 04 06 02 05 07 08 09 10 11 12 13 14 15 16 17 18 19 move shifted register move, compare, add, and subtract immediate alu operation high register operations and branch exchange pc-relative load load and store with relative offset load and store sign-extended byte and halfword load and store with immediate offset load and store halfword sp-relative load and store load address add offset to stack pointer push and pop registers multiple load and store add and subtract conditional branch software interrupt unconditional branch long branch with link offset h 1 1 1 1 offset5 rd rs op 0 0 0 01
introduction arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 1-17 the thumb instruction set summary is listed in table 1-12. table 1-12 thumb instruction summary operation assembler move immediate mov rd, #8bit_imm high to low mov rd, hs low to high mov hd, rs high to high mov hd, hs arithmetic add add rd, rs, #3bit_imm add low, and low add rd, rs, rn add high to low add rd, hs add low to high add hd, rs add high to high add hd, hs add immediate add rd, #8bit_imm add value to sp add sp, #7bit_imm add sp, #-7bit_imm add with carry adc rd, rs subtract sub rd, rs, rn sub rd, rs, #3bit_imm subtract immediate sub rd, #8bit_imm subtract with carry sbc rd, rs negate neg rd, rs multiply mul rd, rs compare low, and low cmp rd, rs compare low, and high cmp rd, hs compare high, and low cmp hd, rs compare high, and high cmp hd, hs compare negative cmn rd, rs compare immediate cmp rd, #8bit_imm logical and and rd, rs eor eor rd, rs or orr rd, rs bit clear bic rd, rs move not mvn rd, rs test bits tst rd, rs
introduction 1-18 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a shift/rotate logical shift left lsl rd, rs, #5bit_shift_imm lsl rd, rs logical shift right lsr rd, rs, #5bit_shift_imm lsr rd, rs arithmetic shift right asr rd, rs, #5bit_shift_imm asr rd, rs rotate right ror rd, rs branch conditional if z set beq label if z clear bne label if c set bcs label if c clear bcc label if n set bmi label if n clear bpl label if v set bvs label if v clear bvc label if c set, and z clear bhi label if c clear, and z set bls label if n set, and v set, or if n clear, and v clear bge label if n set, and v clear, or if n clear, and v set blt label if z clear, and n, or v set, or if z clear, and n, or v clear bgt label if z set, or n set, and v clear, or n clear, and v set ble label unconditional b label long branch with link bl label optional state change to address held in lo reg bx rs to address held in hi reg bx hs table 1-12 thumb instruction summary (continued) operation assembler
introduction arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 1-19 load with immediate offset word ldr rd, [rb, #7bit_offset] halfword ldrh rd, [rb, #6bit_offset] byte ldrb rd, [rb, #5bit_offset] with register offset word ldr rd, [rb, ro] halfword ldrh rd, [rb, ro] signed halfword ldrsh rd, [rb, ro] byte ldrb rd, [rb, ro] signed byte ldrsb rd, [rb, ro] pc-relative ldr rd, [pc, #10bit_offset] sp-relative ldr rd, [sp, #10bit_offset] address using pc add rd, pc, #10bit_offset using sp add rd, sp, #10bit_offset multiple ldmia rb!, store with immediate offset word str rd, [rb, #7bit_offset] halfword strh rd, [rb, #6bit_offset] byte strb rd, [rb, #5bit_offset] with register offset word str rd, [rb, ro] halfword strh rd, [rb, ro] byte strb rd, [rb, ro] sp-relative str rd, [sp, #10bit_offset] multiple stmia rb!, push/pop push registers onto stack push push lr, and registers onto stack push table 1-12 thumb instruction summary (continued) operation assembler
introduction 1-20 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a pop registers from stack pop pop registers, and pc from stack pop software interrupt swi 8bit_imm table 1-12 thumb instruction summary (continued) operation assembler
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 2-1 chapter 2 programmer ? s model this chapter describes the ARM720T programmer ? s model. it contains the following sections: processor operating states on page 2-2 memory formats on page 2-3 instruction length on page 2-5 data types on page 2-6 operating modes on page 2-7 registers on page 2-8 the thumb state register set is a subset of the arm state set. you have direct access to: on page 2-10 the program status registers on page 2-13 exceptions on page 2-16 reset on page 2-23 relocation of low virtual addresses by the fcse pid on page 2-22 implementation-defined behavior of instructions on page 2-24.
programmer?s model 2-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 2.1 processor operating states from the programmer point of view, the ARM720T can be in one of two states: arm state this executes 32-bit, word-aligned arm instructions. thumb state this operates with 16-bit, halfword-aligned thumb instructions. in this state, the pc uses bit 1 to select between alternate halfwords. note transition between these two states does not affect the processor mode or the contents of the registers. 2.1.1 switching state entering thumb state entry into thumb state can be achieved by executing a bx instruction with the state bit (bit 0) set in the operand register. transition to thumb state also occurs automatically on return from an exception, for example, interrupt request (irq), fast interrupt request (fiq), undef, abort, and software interrupt (swi) if the exception was entered with the processor in thumb state. entering arm state entry into arm state happens: on execution of the bx instruction with the state bit clear in the operand register. on the processor taking an exception, for example, irq, fiq, reset, undef, abort, and swi. in this case, the pc is placed in the link register of the exception mode, and execution starts at the vector address of the exception.
programmer ? s model arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 2-3 2.2 memory formats the bigend bit in the control register selects whether the ARM720T treats words in memory as being stored in big-endian or little-endian format. see chapter 3 configuration for more information on the control register. ARM720T views memory as a linear collection of bytes numbered upwards from zero. bytes 0 to 3 hold the first stored word, bytes 4 to 7 the second. and bytes 8 to 11 the third. ARM720T can treat words in memory as being stored as follows: big-endian format little-endian format on page 2-4. 2.2.1 big-endian format in big-endian format, the most significant byte of a word is stored at the lowest numbered byte and the least significant byte at the highest numbered byte. byte 0 of the memory system is therefore connected to data lines 31 to 24. this is shown in figure 2-1. figure 2-1 big-endian addresses of bytes with words higher address 8 4 0 31 24 23 word address 16 15 8 7 0 most significant byte is at lowest address word is addressed by byte address of most significant byte lower address 4 9 5 10 6 11 7 8 0 1 2 3
programmer ? s model 2-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 2.2.2 little-endian format in little-endian format, the lowest numbered byte in a word is considered the least significant byte of the word, and the highest numbered byte the most significant. byte 0 of the memory system is therefore connected to data lines 7 to 0. this is shown in figure 2-2. figure 2-2 little-endian addresses of bytes with words higher address 8 4 0 31 24 23 word address 16 15 8 7 0 lower address least significant byte is at lowest address word is addressed by byte address of least significant byte 7 10 6 9 5 8 4 11 3 2 1 0
programmer ? s model arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 2-5 2.3 instruction length instructions are: 32 bits long in arm state 16 bits long in thumb state.
programmer ? s model 2-6 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 2.4 data types the ARM720T supports the following data types: byte (8-bit) halfword (16-bit) word (32-bit). you must align these as follows: word quantities to 4-byte boundaries halfwords quantities to 2-byte boundaries byte quantities can be placed on any byte boundary.
programmer ? s model arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 2-7 2.5 operating modes the ARM720T supports seven modes of operation as listed in table 2-1. changing modes mode changes can be made under software control, by external interrupts or during exception processing. most application programs execute in user mode. the non-user modes, known as privileged modes, are entered in order to service interrupts or exceptions, or to access protected resources. table 2-1 ARM720T modes of operation mode type description user usr the normal arm program execution state fiq fiq designed to support a data transfer or channel process irq irq used for general-purpose interrupt handling supervisor svc protected mode for the operating system abort mode abt entered after a data abort or instruction prefetch abort system sys a privileged user mode for the operating system undefined und entered when an undefined instruction is executed
programmer ? s model 2-8 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 2.6 registers ARM720T has a total of 37 registers: 31 general-purpose 32-bit registers six status registers. these registers cannot all be seen at once. the processor state and operating mode dictate which registers are available to the programmer. 2.6.1 the arm state register set in arm state, 16 general registers and one or two status registers are visible at any one time. in privileged (non-user) modes, mode-specific banked registers are switched in. figure 2-3 on page 2-9 shows which registers are available in each mode. the banked registers are marked with a shaded triangle. the arm state register set contains 16 directly accessible registers, r0 to r15. all of these, except r15, are general-purpose, and can be used to hold either data or address values. in addition to these, r16 is used to store status information: register 14 r14 is used as the subroutine link register. this receives a copy of r15 when a branch and link ( bl ) code instruction is executed. at all other times it can be treated as a general-purpose register. the corresponding banked registers r14_svc, r14_irq, r14_fiq, r14_abt, and r14_und are similarly used to hold the return values of r15 when interrupts and exceptions arise, or when bl instructions are executed within interrupt or exception routines. register 15 r15 holds the program counter (pc). in arm state, bits [1:0] of r15 are zero and bits [31:2] contain the pc. in thumb state, bit [0] is zero and bits [31:1] contain the pc. register 16 r16 is the current program status register (cpsr). this contains condition code flags and the current mode bits.
programmer ? s model arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 2-9 interrupt modes fiq mode has seven banked registers mapped to r8-14 (r8_fiq-r14_fiq). in arm state, many fiq handlers do not have to save any registers. user, irq, supervisor, abort, and undefined modes each have two banked registers mapped to r13 and r14, allowing each of these modes to have a private stack pointer and link registers. figure 2-3 register organization in arm state arm state general registers and program counter r0 r1 r2 r3 r4 r5 r6 r7 r8 r9 r10 r11 r12 r13 r14 r15 (pc) system and user cpsr cpsr spsr_fiq cpsr spsr_svc cpsr spsr_abt cpsr spsr_irq cpsr spsr_und arm state program status registers = banked register r0 r1 r2 r3 r4 r5 r6 r7 r8_fiq r9_fiq r10_fiq r11_fiq r12_fiq r13_fiq r14_fiq r15 (pc) fiq r0 r1 r2 r3 r4 r5 r6 r7 r13_svc r14_svc r15 (pc) supervisor r8 r9 r10 r11 r12 r0 r1 r2 r3 r4 r5 r6 r7 r13_abt r14_abt r15 (pc) abort r8 r9 r10 r11 r12 r0 r1 r2 r3 r4 r5 r6 r7 r13_irq r14_irq r15 (pc) irq r8 r9 r10 r11 r12 r0 r1 r2 r3 r4 r5 r6 r7 r13_und r14_und r15 (pc) undefined r8 r9 r10 r11 r12
programmer ? s model 2-10 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 2.6.2 the thumb state register set the thumb state register set is a subset of the arm state set. you have direct access to: eight general registers, (r0 ? r7) the pc a stack pointer (sp) register a link register (lr) the cpsr. there are banked sps, lrs, and saved process status registers (spsrs) for each privileged mode. this is shown in figure 2-4. figure 2-4 register organization in thumb state thumb state general registers and program counter system and user r0 r1 r2 r3 r4 r5 r6 r7 sp lr pc cpsr cpsr spsr_fiq cpsr spsr_svc cpsr spsr_abt cpsr spsr_irq cpsr spsr_und thumb state program status registers = banked register fiq r0 r1 r2 r3 r4 r5 r6 r7 sp_fiq lr_fiq pc supervisor r0 r1 r2 r3 r4 r5 r6 r7 sp_svc lr_svc pc abort r0 r1 r2 r3 r4 r5 r6 r7 sp_abt lr_abt pc irq r0 r1 r2 r3 r4 r5 r6 r7 sp_irq lr_irq pc undefined r0 r1 r2 r3 r4 r5 r6 r7 sp_und lr_und pc
programmer ? s model arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 2-11 2.6.3 the relationship between arm and thumb state registers the thumb state registers relate to the arm state registers in the following ways: thumb state r0 ? r7, and arm state r0 ? r7 are identical thumb state cpsr and spsrs, and arm state cpsr and spsrs are identical thumb state sp maps onto arm state r13 thumb state lr maps onto arm state r14 thumb state pc maps onto arm state pc (r15). this relationship is shown in figure 2-5. figure 2-5 mapping of thumb state registers onto arm state registers 2.6.4 accessing high registers in thumb state in thumb state, registers r8 ? r15 (the high registers) are not part of the standard register set. however, the assembly language programmer has limited access to them, and can use them for fast temporary storage. thumb state arm state r0 r1 r2 r3 r4 r5 r6 r7 sp lr cpsr spsr r0 r1 r2 r3 r4 r5 r6 r7 r8 sp (r13) lr (r14) cpsr spsr r9 r10 r11 r12 pc pc (r15) low registers high registers
programmer ? s model 2-12 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a a value can be transferred from a register in the range r0 ? r7 (a low register) to a high register, and from a high register to a low register, using special variants of the mov instruction. high register values can also be compared against or added to low register values with the cmp and add instructions. see the arm architecture reference manual for details on high register operations.
programmer ? s model arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 2-13 2.7 the program status registers the ARM720T contains a cpsr, and five spsrs for use by exception handlers. these registers: hold information about the most recently performed alu operation control the enabling and disabling of interrupts set the processor operating mode. the arrangement of bits is shown in figure 2-6. figure 2-6 program status register format 2.7.1 the condition code flags the n, z, c, and v bits are the condition code flags. these can be changed as a result of arithmetic and logical operations, and tested to determine whether an instruction executes. in arm state, all instructions can be executed conditionally. in thumb state, only the branch instruction is capable of conditional execution. see the arm architecture reference manual for details. 2.7.2 the control bits the bottom eight bits of a psr (incorporating i, f, t, and m[4:0]) are known collectively as the control bits. these change when an exception arises. if the processor is operating in a privileged mode, they can also be manipulated by software. i and f bits these are the interrupt disable bits. when set, these disable the irq and fiq interrupts respectively. 31 30 29 28 27 26 25 24 23 8 7 6 4 3 2 1 0 reserved condition code flags control bits mode bits state bit fiq disable irq disable overflow carry or borrow or extend zero negative or less than 5 n z c v i f m4 m3 m2 m1 m0 t
programmer ? s model 2-14 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a the t bit this reflects the operating state. when this bit is set, the processor is executing in thumb state, otherwise it is executing in arm state. this is reflected on the tbit external signal. software must never change the state of the tbit in the cpsr. if this happens, the processor then enters an unpredictable state. m[4:0] bits these are the mode bits. these determine the processor operating mode, as shown in table 2-2. not all combinations of the mode bits define a valid processor mode. only those explicitly described can be used. note if you program any illegal value into the mode bits, m[4:0], then the processor enters an unrecoverable state. if this occurs, apply reset. 2.7.3 reserved bits the remaining bits in the psrs are reserved . when changing flag or control bits of a psr, you must ensure that these unused bits are not altered. also, your program must not rely on them containing specific values, because in future processors they might read as one or zero. table 2-2 psr mode bit values m[4:0] mode visible thumb state registers visible arm state registers 10000 user r7 to r0, lr, sp pc, cpsr r14 to r0, pc, cpsr 10001 fiq r7 to r0, lr_fiq, sp_fiq pc, cpsr, spsr_fiq r7 to r0, r14_fiq..r8_fiq, pc, cpsr, spsr_fiq 10010 irq r7 to r0, lr_irq, sp_irq pc, cpsr, spsr_irq r12 to r0, r14_irq, r13_irq, pc, cpsr, spsr_irq 10011 supervisor r7 to r0, lr_svc, sp_svc, pc, cpsr, spsr_svc r12 to r0, r14_svc, r13_svc, pc, cpsr, spsr_svc
programmer ? s model arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 2-15 10111 abort r7 to r0, lr_abt, sp_abt, pc, cpsr, spsr_abt r12 to r0, r14_abt..r13_abt, pc, cpsr, spsr_abt 11011 undefined r7 to r0 lr_und, sp_und, pc, cpsr, spsr_und r12 to r0, r14_und, r13_und, pc, cpsr, spsr_und 11111 system r7 to r0, lr, sp pc, cpsr r14 to r0, pc, cpsr table 2-2 psr mode bit values (continued) m[4:0] mode visible thumb state registers visible arm state registers
programmer ? s model 2-16 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 2.8 exceptions exceptions arise whenever the normal flow of a program has to be halted temporarily, for example to service an interrupt from a peripheral. before an exception can be handled, the current processor state must be preserved so that the original program can resume when the handler routine has finished. several exceptions can arise at the same time. if this happens, they are dealt with in a fixed order. see exception priorities on page 2-21. 2.8.1 action on entering an exception when handling an exception, the ARM720T: 1. preserves the address of the next instruction in the appropriate lr. a. if the exception has been entered from arm state, the address of the next instruction is copied into the lr (that is, current pc+4 or pc+8 depending on the exception, see table 2-3 on page 2-17 for details). b. if the exception has been entered from thumb state, the value written into the lr is the current pc, offset by a value so that the program resumes from the correct place on return from the exception. this means that the exception handler does not have to determine which state the exception was entered from. for example, in the case of swi: movs pc, r14_svc always returns to the next instruction regardless of whether the swi was executed in arm or thumb state. 2. copies the cpsr into the appropriate spsr. 3. forces the cpsr mode bits to a value which depends on the exception. 4. forces the pc to fetch the next instruction from the relevant exception vector. it can also set the interrupt disable flags to prevent otherwise unmanageable nestings of exceptions. if the processor is in thumb state when an exception occurs, it automatically switches into arm state when the pc is loaded with the exception vector address.
programmer ? s model arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 2-17 2.8.2 action on leaving an exception on completion, the exception handler: 1. moves the lr, minus an offset where appropriate, to the pc. the offset varies depending on the type of exception. 2. copies the spsr back to the cpsr. 3. clears the interrupt disable flags, if they were set on entry. note an explicit switch back to thumb state is never necessary, because restoring the cpsr from the spsr automatically sets the t bit to the value it held immediately prior to the exception. 2.8.3 exception entry and exit summary table 2-3 summarizes the pc value preserved in the relevant r14 on exception entry, and the recommended instruction for exiting the exception handler. table 2-3 exception entry and exit exception return instruction previous state arm r14_x thumb r14_x bl a a.where pc is the address of the bl/swi/undefined instruction fetch that had the prefetch abort. mov pc, r14 pc + 4 pc + 2 swi a movs pc, r14_svc pc + 4 pc + 2 udef a movs pc, r14_und pc + 4 pc + 2 fiq b b.where pc is the address of the instruction that was not executed because the fiq or irq took priority. subs pc, r14_fiq, #4 pc + 4 pc + 4 irq b subs pc, r14_irq, #4 pc + 4 pc + 4 pabt a subs pc, r14_abt, #4 pc + 4 pc + 4 dabt c subs pc, r14_abt, #8 pc + 8 pc + 8 reset d na - -
programmer ? s model 2-18 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 2.8.4 fast interrupt request the fiq exception is designed to support a data transfer or channel process. in arm state it has sufficient private registers to remove the necessity for register saving, minimizing the overhead of context switching. fiq is externally generated by taking the nfiq input low. nfiq and nirq are considered asynchronous, and a cycle delay for synchronization is incurred before the interrupt can affect the processor flow. irrespective of whether the exception was entered from arm or thumb state, a fiq handler must leave the interrupt by executing: subs pc, r14_fiq, #4 fiq can be disabled by setting the cpsr f flag. note this is not possible from user mode. if the f flag is clear, ARM720T checks for a low level on the output of the fiq synchronizer at the end of each instruction. 2.8.5 interrupt request the irq exception is a normal interrupt caused by a low level on the nirq input. irq has a lower priority than fiq and is masked out when a fiq sequence is entered. it can be disabled at any time by setting the i bit in the cpsr, though this can only be done from a privileged (non-user) mode. irrespective of whether the exception was entered from arm or thumb state, an irq handler must return from the interrupt by executing: subs pc, r14_irq, #4 2.8.6 abort an abort indicates that the current memory access cannot be completed. it can be signaled either by the protection unit, or by the external berror input. the ARM720T checks for the abort exception during memory access cycles. there are two types of abort: prefetch abort this occurs during an instruction prefetch. c.where pc is the address of the load or store instruction that generated the data abort. d.the value saved in r14_svc upon reset is unpredictable.
programmer ? s model arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 2-19 data abort this occurs during a data access. if a prefetch abort occurs, the prefetched instruction is marked as invalid, but the exception is not taken until the instruction reaches the head of the pipeline. if the instruction is not executed, for example because a branch occurs while it is in the pipeline, the abort does not take place. if a data abort occurs, the action taken depends on the instruction type: 1. single data transfer instructions ( ldr, str ) write-back modified base registers, the abort handler must be aware of this. 2. the swap instruction ( swp ) is aborted as though it had not been executed. 3. block data transfer instructions ( ldm, stm ) complete. if write-back is set, the base is updated. if the instruction attempts to overwrites the base with data (that is, it has the base in the transfer list), the overwriting is prevented. all register overwriting is prevented after an abort is indicated. this means, in particular, that r15 (always the last register to be transferred) is preserved in an aborted ldm instruction. after fixing the reason for the abort, the handler must execute the following irrespective of the state (arm or thumb): subs pc, r14_abt, #4 for a prefetch abort, or subs pc, r14_abt, #8 for a data abort this restores both the pc and the cpsr, and retries the aborted instruction. note there are restrictions on the use of the external abort signal. see external aborts on page 6-25 . 2.8.7 software interrupt the swi instruction is used for entering supervisor mode, usually to request a particular supervisor function. a swi handler must return by executing the following irrespective of the state (arm or thumb): mov pc, r14_svc this restores the pc and cpsr, and returns to the instruction following the swi.
programmer ? s model 2-20 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 2.8.8 undefined instruction when ARM720T comes across an instruction that it cannot handle, it takes the undefined instruction trap. this mechanism can be used to extend either the thumb or arm instruction set by software emulation. after emulating the failed instruction, the trap handler must execute the following irrespective of the state (arm or thumb): movs pc, r14_und this restores the cpsr and returns to the instruction following the undefined instruction. 2.8.9 exception vectors the ARM720T can have exception vectors mapped to either low or high addresses, controlled by the v bit in the control register (see register 1, control register on page 3-5). table 2-4 lists the exception vector addresses. note the low addresses are those generated by the processor core before relocation. table 2-4 exception vector addresses high address low address exception mode on entry 0xffff0000 0x00000000 reset supervisor 0xffff0004 0x00000004 undefined instruction undefined 0xffff0008 0x00000008 software interrupt supervisor 0xffff000c 0x0000000c abort (prefetch) abort 0xffff0010 0x00000010 abort (data) abort 0xffff0014 0x00000014 reserved reserved 0xffff0018 0x00000018 irq irq 0xffff001c 0x0000001c fiq fiq
programmer ? s model arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 2-21 2.8.10 exception priorities when multiple exceptions arise at the same time, a fixed priority system determines the order in which they are handled: 1. reset (highest priority). 2. data abort. 3. fiq. 4. irq. 5. prefetch abort. 6. undefined instruction, swi (lowest priority). 2.8.11 exception restrictions undefined instruction and swi are mutually exclusive, because they each correspond to particular (non-overlapping) decodings of the current instruction. if a data abort occurs at the same time as a fiq, and fiqs are enabled, the cpsr f flag is clear, ARM720T enters the data abort handler and then immediately proceeds to the fiq vector. a normal return from fiq causes the data abort handler to resume execution. placing data abort at a higher priority than fiq is necessary to ensure that the transfer error does not escape detection. the time for this exception entry must be added to worst-case fiq latency calculations.
programmer ? s model 2-22 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 2.9 relocation of low virtual addresses by the fcse pid the ARM720T provides a mechanism, fast context switch extension (fcse), to translate virtual addresses to physical addresses based on the current value of the fcse process identifier (pid). the virtual address produced by the processor core going to the idc and mmu can be relocated if it lies in the bottom 32mb of the virtual address. that is, virtual address bits [31:25] = b0000000 by the substitution of the seven bits [31:25] of the fcse pid register in the cp15 coprocessor. a change to the fcse pid exhibits similar behavior to a delayed branch if: the two instructions fetched immediately following an instruction to change the fcse pid are fetched with a relocation to the previous fcse pid the addresses of the instructions being fetched lie within the range of addresses to be relocated. on reset, the fcse pid register bits [31:25] are set to b 0000000 , disabling all relocation. for this reason, the low address reset exception vector is effectively never relocated by this mechanism. note all addresses produced by the processor core undergo this translation if they lie in the appropriate address range. this includes the exception vectors if they are configured to lie in the bottom of the virtual memory map. this configuration is determined by the v bit in the cp15 control register.
programmer ? s model arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 2-23 2.10 reset when the bnres signal goes low, ARM720T: 1. abandons the executing instruction. 2. flushes the cache and translation lookaside buffer (tlb). 3. disables the write buffer (wb), cache, and mmu. 4. resets the fcse pid. 5. continues to fetch instructions from incrementing word addresses. when bnres goes high again, the ARM720T: 1. overwrites r14_svc and spsr_svc by copying the current values of the pc and cpsr into them. the value of the saved pc and spsr is not defined. 2. forces m[4:0] to 10011 (supervisor mode), sets the i and f bits in the cpsr, and clears the cpsr t bit. 3. forces the pc to fetch the next instruction from the low reset exception vector. 4. resumes execution in arm state.
programmer ? s model 2-24 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 2.11 implementation-defined behavior of instructions the arm architectural reference manual defines the instruction set of the ARM720T: see indexed addressing on a data abort for the behavior of the ARM720T instructions for those features which are denoted as being implementation-defined in that manual. see early termination for those features that define signed and unsigned early termination on the ARM720T. 2.11.1 indexed addressing on a data abort in the event of a data abort with pre-indexed or post-indexed addressing, the value left in rn is defined to be the updated base register value for the following instructions: ldc ldm ldr ldrb ldrbt ldrh ldrsb ldrsh ldrt stc stm str strb strbt strh strt. 2.11.2 early termination on the ARM720T, early termination is defined as: mla, mul signed early termination. smull, smlal signed early termination. umull, umlal unsigned early termination.
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 3-1 chapter 3 configuration this chapter describes the configuration of the ARM720T. it contains the following sections. about configuration on page 3-2 internal coprocessor instructions on page 3-3 registers on page 3-4.
configuration 3-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 3.1 about configuration the operation and configuration of ARM720T is controlled: directly using coprocessor instructions indirectly using the mmu page tables. the coprocessor instructions manipulate a number of on-chip registers which control the configuration of the following: cache write buffer mmu other configuration options. 3.1.1 compatibility to ensure backwards compatibility of future cpus: all reserved or unused bits in registers and coprocessor instructions must be programmed to 0 invalid registers must not be read or written the following bits must be programmed to 0: ? register 1, bits[31:14] and bits [12:10] ? register 2, bits[13:0] ? register 5, bits[31:9] ? register 7, bits[31:0] ? register 13 fcse pid, bits[24:0]. 3.1.2 notation throughout this section, the following terms and abbreviations are used: unpredictable (unp ) if specified for reads, the data returned when reading from this location is unpredictable. it can have any value. if specified for writes, writing to this location causes unpredictable behavior or change in device configuration. should be zero (sbz) when writing to this location, all bits of this field should be zero.
configuration arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 3-3 3.2 internal coprocessor instructions the ARM720T instruction set allows specialized additional instructions to be implemented using coprocessors. these are separate processing units that are coupled to the ARM720T processor. note the cp15 register map might change in future arm processors. you are strongly recommended to structure software so that any code accessing cp15 is contained in a single module. it can then be updated easily. cp15 registers can only be accessed with mrc and mcr instructions in a privileged mode. the instruction bit pattern of the mcr and mrc instructions is shown in figure 3-1. figure 3-1 mrc and mcr bit pattern cdp, ldc, and stc instructions, as well as unprivileged mrc and mcr instructions to cp15 cause the undefined instruction trap to be taken. the crn field of mrc and mcr instructions specifies the coprocessor register to access. the crm field and opcode_2 fields specify a particular action when addressing some registers. in all instructions accessing cp15: the opcode_1 field should be zero (sbz). the opcode_2 and crm fields should be zero except when accessing registers 7, 8, and 13 when the specified values must be used to select the desired cache, tlb, or process identifier operations. 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 1 1 1 opcode_1 l crn crm 0 1 1 1 1 opcode_2 1 rd cond
configuration 3-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 3.3 registers ARM720T contains registers that control the cache and mmu operation. these registers are accessed using cprt instructions to cp15 with the processor in a privileged mode. only some of registers r0 to r15 are valid. an access to an invalid register causes neither the access nor an undefined instruction trap, and therefore must never be carried out. 3.3.1 register 0, id register reading from cp15 register 0 returns the value: 0x41807203 note the final nibble represents the core revision. table 3-1 cache and mmu control register register register reads register writes 0 id register reserved 1 control control 2 translation table base translation table base 3 domain access control domain access control 4 reserved reserved 5 fault status fault status 6 fault address fault address 7 reserved cache operations 8 reserved tlb operations 9 ? 12 reserved reserved 13 process identifier process identifier 14 ? 15 reserved reserved
configuration arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 3-5 the crm and opcode_2 fields should be zero when reading cp15 register 0. this is shown in figure 3-2. figure 3-2 id register read writing to cp15 register 0 is unpredictable. id register write is shown in figure 3-3. figure 3-3 id register write 3.3.2 register 1, control register reading from cp15 register 1 reads the control bits. the crm and opcode_2 fields should be zero when reading cp15 register 1. register 1 read is shown in figure 3-4. figure 3-4 register 1 read writing to cp15 register 1 sets the control bits. the crm and opcode_2 fields must be zero when writing cp15 register 1. register 1 write is shown in figure 3-5. figure 3-5 register 1 write all defined control bits are set to zero on reset. the control bits have the following functions: m bit 0 mmu enable/disable: 0 = mmu disabled 1 = mmu enabled. a bit 1 alignment fault enable/disable: 0 = address alignment fault checking disabled 1 = address alignment fault checking enabled. 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 0 0 0 1 0 0 1 0 0 1 0 0 1 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 1 1 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 unp 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 unp v unp r s b l d p w c a m 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 unp/sbz v unp/ sbz r s b l d p w c a m
configuration 3-6 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a c bit 2 cache enable/disable: 0 = instruction and/or data cache (idc) disabled 1 = instruction and/or data cache (idc) enabled. w bit 3 write buffer enable/disable: 0 = write buffer disabled 1 = write buffer enabled. p bit 4 when read, returns 1. when written, is ignored. d bit 5 when read, returns 1. when written, is ignored. l bit 6 when read, returns 1. when written, is ignored. b bit 7 big-endian/little-endian: 0 = little-endian operation 1 = big-endian operation. s bit 8 system protection: modifies the mmu protection system. r bit 9 rom protection: modifies the mmu protection system. bits 12:10 when read, this returns an unpredictable value. when written, it should be zero, or a value read from these bits on the same processor. note using a read-write-modify sequence when modifying this register provides the greatest future compatibility. v bit 13 location of exception vectors: 0 = low addresses 1 = high addresses. bits 31:14 when read, this returns an unpredictable value. when written, it should be zero, or a value read from these bits on the same processor. enabling the mmu you must take care if the translated address differs from the untranslated address, because the instructions following the enabling of the mmu are fetched using no address translation. enabling the mmu can be considered as a branch with delayed execution.
configuration arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 3-7 a similar situation occurs when the mmu is disabled. the correct code sequence for enabling and disabling the mmu is given in interaction of the mmu, idc, and write buffer on page 6-26. if the cache and write buffer are enabled when the mmu is not enabled, the results are unpredictable. 3.3.3 register 2, translation table base register reading from cp15 register 2 returns the pointer to the currently active first-level translation table in bits [31:14] and an unpredictable value in bits [13:0]. the crm and opcode_2 fields should be zero when reading cp15 register 2. writing to cp15 register 2 updates the pointer to the currently active first-level translation table from the value in bits [31:14] of the written value. bits [13:0] should be zero. the crm and opcode_2 fields should be zero when writing cp15 register 2. register 2 is shown in figure 3-6. figure 3-6 register 2 3.3.4 register 3, domain access control register reading from cp15 register 3 returns the value of the domain access control register. writing to cp15 register 3 writes the value of the domain access control register. the domain access control register consists of 16 2-bit fields, each of which defines the access permissions for one of the 16 domains (d15-d0). the crm and opcode_2 fields should be zero when reading or writing cp15 register 3. this is shown in figure 3-7. figure 3-7 register 3 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 translation base table unp/sbz 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 d15 d14 d13 d12 d11 d10 d9 d8 d7 d6 d5 d4 d3 d2 d1 d0
configuration 3-8 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 3.3.5 register 4, reserved register 4 is reserved. reading cp15 register 4 is unpredictable. writing cp15 register 4 is unpredictable. this is shown in figure 3-8. figure 3-8 register 4 3.3.6 register 5, fault status register reading cp15 register 5 returns the value of the fault status register (fsr). the fsr contains the source of the last data fault. note only the bottom 9 bits are returned. the upper 23 bits are unpredictable. the fsr indicates the domain and type of access being attempted when an abort occurred: bit 8 this is always read as zero. bit 8 is ignored on writes. bits [7:4] these specify which of the 16 domains (d15-d0) was being accessed when a fault occurred. bits [3:1] theses indicate the type of access being attempted. the encoding of these bits is shown in fault address and fault status registers on page 6-19. the fsr is only updated for data faults, not for prefetch faults. writing cp15 register 5 sets the fsr to the value of the data written. this is useful when a debugger has to restore the value of the fsr. the upper 24 bits written should be zero. the crm and opcode_2 fields should be zero when reading or writing cp15 register 5. register 5 is shown in figure 3-9. figure 3-9 register 5 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 unp 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 unp/sbz 0 domain status
configuration arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 3-9 3.3.7 register 6, fault address register reading cp15 register 6 returns the value of the fault address register (far). the far holds the virtual address of the access that was attempted when a fault occurred. the far is only updated for data faults, not for prefetch faults. writing cp15 register 6 sets the far to the value of the data written. this is useful when a debugger has to restore the value of the far. the crm and opcode_2 fields should be zero when reading or writing cp15 register 6. register 6 is shown in figure 3-10. figure 3-10 register 6 note register 6 contains a modified virtual address if the fcse pid register is nonzero. 3.3.8 register 7, cache operations writing to cp15 register 7 manages the unified instruction and data cache of the ARM720T. only one cache operation is defined using the following opcode_2 and crm fields in the mcr instruction that writes the cp15 register 7. caution the invalidate id cache function invalidates all cache data. use this with caution. register 7 is shown in table 3-2. reading from cp15 register 7 is undefined. 3.3.9 register 8, tlb operations writing to cp15 register 8 controls the translation lookaside buffer (tlb). the ARM720T implements a unified instruction and data tlb. 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 fault address table 3-2 cache operation function opcode_2 value crm value data instruction invalidate id cache 0b000 0b0111 sbz mcr p15, 0, rd, c7, c7, 0
configuration 3-10 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a two tlb operations are defined, and the function to be performed selected by the opcode_2 and crm fields in the mcr instruction used to write cp15 register 8. this is listed in table 3-3. reading from cp15 register 8 is undefined. the invalidate tlb function invalidates all of the unlocked entries in the tlb. the invalidate tlb single entry function invalidates any tlb entry corresponding to the virtual address given in rd . note register 8 contains a modified virtual address if the fcse pid register is nonzero. 3.3.10 registers 9 to 12, reserved accessing any of these registers is undefined. writing to any of these registers is undefined. 3.3.11 register 13, process identifier two independent process identifier registers can be accessed using register 13: fast context switch extension process identifier on page 3-11 trace process identifier on page 3-11. table 3-3 tlb operations function opcode_2 value crm value data instruction invalidate tlb 0b000 0b0111 sbz mcr p15, 0, rd, c8, c7, 0 invalidate tlb single entry 0b001 0b0111 virtual address mcr p15, 0, rd, c8, c7, 1
configuration arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 3-11 fast context switch extension process identifier reading from cp15 register 13 with opcode_2=0 returns the value of the fcse pid. this is shown in figure 3-11. figure 3-11 register 13 with opcode_2=0 note only bits [31:25] are returned. the remaining 25 bits are unpredictable. writing to cp15 register 13 with opcode_2=0 updates the fcse pid from the value in bits [31:25]. bits [24:0] should be zero. the fcse pid is set to b 0000000 on reset. the crm and opcode_2 should be zero when reading or writing the fcse pid. changing fcse pid you must take care when changing the fcse pid because the following instructions have been fetched with the previous fcse pid. in this way, changing the fcse pid has similarities with a branch with delayed execution. see relocation of low virtual addresses by the fcse pid on page 2-22. trace process identifier a 32-bit read/write register is provided to hold a trace process identifier (procid) up to 32-bits in length visible to the etm7. this is achieved by reading from or writing to the cp15 register 13 with opcode_2 = 1 as shown in figure 3-12. figure 3-12 register 13 with opcode_2=1 signal procidwr is exported to notify the etm7 that the trace procid has been written. 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 fcse pid unp/sbz 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 trace procid
configuration 3-12 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 3.3.12 registers 14-15, reserved accessing any of these registers is undefined. writing to any of these registers is undefined.
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 4-1 chapter 4 instruction and data cache this chapter describes the instruction and data cache. it contains the following sections: about the instruction and data cache on page 4-2 idc validity on page 4-4 idc enable, disable, and reset on page 4-5 idc disable for secure applications on page 4-6.
instruction and data cache 4-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 4.1 about the instruction and data cache the cache only operates on a write-through basis with a read-miss allocation policy and a random replacement algorithm. 4.1.1 idc operation the ARM720T contains an 8kb mixed instruction and data cache (idc). the c bit in the ARM720T control register and the cachable bit in the mmu page tables only affect loading data into the cache. the cache is always searched regardless of these two bits. if the data is found then it is used, so when the cache is disabled, it must also be flushed. the idc has 512 lines of 16 bytes (four words), arranged as a 4-way set-associative cache, and uses the virtual addresses generated by the processor core after relocation by the fcse pid as appropriate. the idc is always reloaded a line at a time (four words). it can be enabled or disabled using the ARM720T control register and is disabled on bnres . the operation of the cache is further controlled by the cachable bit (c bit) stored in the mmu page table (see chapter 6 memory management unit ). for this reason, the mmu must be enabled in order to use the idc. however, the two functions can be enabled simultaneously, with a single write to the control register. 4.1.2 cachable bit the c bit determines whether data being read can be placed in the idc and used for subsequent read operations. typically, main memory is marked as cachable to improve system performance, and i/o space is marked as noncachable to stop the data being stored in the ARM720T cache. for example, if the processor is polling a hardware flag in i/o space, it is important that the processor is forced to read data from the external peripheral, and not a copy of the initial data held in the cache. the cachable bit can be configured for both pages and sections. cachable reads (c=1) a line fetch of four words is performed when a cache miss occurs in a cachable area of memory, and it is randomly placed in a cache bank. uncachable reads (c=0) an external memory access is performed and the cache is not written.
instruction and data cache arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 4-3 4.1.3 read-lock-write the idc treats the read-lock-write instruction as a special case: read phase always forces a read of external memory, regardless of whether the data is contained in the cache. write phase is treated as a normal write operation. if the data is already in the cache, the cache is updated. externally, the two phases are flagged as indivisible by asserting the blok signal.
instruction and data cache 4-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 4.2 idc validity the idc operates with virtual addresses, so you must ensure that its contents remain consistent with the virtual to physical mappings performed by the mmu. if the memory mappings are changed, the idc validity must be ensured. 4.2.1 software idc flush the entire idc can be marked as invalid by writing to the cache operations register r7. the cache is flushed immediately the register is written, but the following two instruction fetches can come from the cache before the register is written. 4.2.2 doubly-mapped space because the cache works with virtual addresses, it is assumed that every virtual address maps to a different physical address. if the same physical location is accessed by more than one virtual address, the cache cannot maintain consistency. each virtual address has a separate entry in the cache, and only one entry can be updated on a processor write operation. to avoid any cache inconsistencies, both doubly-mapped virtual addresses must be marked as uncachable.
instruction and data cache arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 4-5 4.3 idc enable, disable, and reset the idc is automatically disabled and flushed on bnres . once enabled, cachable read accesses cause lines to be placed in the cache. to enable the idc: 1. make sure that the mmu is enabled first by setting bit 0 in the control register. 2. enable the idc by setting bit 2 in the control register. the mmu and idc can be enabled simultaneously with a single write to the control register. to disable the idc: 1. clear bit 2 in the control register. 2. perform a flush by writing to the cache operations register.
instruction and data cache 4-6 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 4.4 idc disable for secure applications you can disable the idc in certain secure applications. this is achieved by forcing the idc to miss without triggering a line fill. caution you are strongly advised not to use this feature in normal applications. when the cachedis signal is not being used then it must be held low. to disable the idc: 1. disable the mmu by writing to cp15 register 1 using an mcr and setting bit 0 low. 2. input the special signal, cachedis . when cachedis is asserted, held high, it masks out some cache signals to disable the cache ram banks and stop a cache hit being generated as a consequence. note you must disable the mmu before cachedis is asserted. you must not enable the mmu until after cachedis is deasserted. arm does not support the use of this feature.
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 5-1 chapter 5 write buffer this chapter describes the write buffer. it contains the following sections: about the write buffer on page 5-2 write buffer operation on page 5-3.
write buffer 5-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 5.1 about the write buffer the ARM720T write buffer is provided to improve system performance. it can buffer up to eight words of data, and four independent addresses. it can be enabled or disabled using the w bit, bit 3, in the ARM720T control register. the buffer is disabled and flushed on reset. the operation of the write buffer is further controlled by the bufferable (b) bit, which is stored in the mmu page tables. for this reason, the mmu must be enabled before using the write buffer. the two functions can, however, be enabled simultaneously, with a single write to the control register. for a write to use the write buffer, both the w bit in the control register and the b bit in the corresponding page table must be set. note it is not possible to abort buffered writes externally. the berror pin is ignored. areas of memory that can generate aborts must be marked as unbufferable in the mmu page tables. 5.1.1 bufferable bit this bit controls whether a write operation uses or does not use the write buffer. typically, main memory is bufferable and i/o space unbufferable. the b bit can be configured for both pages and sections.
write buffer arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 5-3 5.2 write buffer operation when the cpu performs a write operation, the translation entry for that address is inspected and the state of the b bit determines the subsequent action. if the write buffer is disabled using the ARM720T control register, buffered writes are treated in the same way as unbuffered writes. to enable the write buffer: 1. ensure the mmu is enabled by setting bit 0 in the control register. 2. enable the write buffer by setting bit 3 in the control register. the mmu and write buffer can be enabled simultaneously with a single write to the control register. to disable the write buffer, clear bit 3 in the control register. note any writes already in the write buffer complete normally. the write buffer will attempt a write operation as long as there is data present. 5.2.1 bufferable write if the write buffer is enabled and the processor performs a write to a bufferable area, the data is placed in the write buffer at fclk speeds, or bclk speeds if running with fastbus extension, and the cpu continues execution. the write buffer then performs the external write in parallel. if the write buffer is full (either because there are already eight words of data in the buffer, or because there is no slot for the new address), the processor is stalled until there is sufficient space in the buffer. 5.2.2 unbufferable write if the write buffer is disabled or the cpu performs a write to an unbufferable area, the processor is stalled until the write buffer empties and the write completes externally. this might require synchronization and several external clock cycles.
write buffer 5-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 5.2.3 read-lock-write the write phase of a read-lock-write sequence is treated as an unbuffered write, even if it is marked as buffered. note a single write requires one address slot and one data slot in the write buffer. a sequential write of n words requires one address slot and n data slots. the total of eight data slots in the buffer can be used as required. for example, there can be three nonsequential writes and one sequential write of five words in the buffer, and the processor could continue as normal, a fifth write or a sixth word in the fourth write stalls the processor until the first write has completed.
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-1 chapter 6 memory management unit this chapter describes the memory management unit (mmu). it contains the following sections: about the mmu on page 6-2 mmu program accessible registers on page 6-4 address translation process on page 6-5 level 1 descriptor on page 6-7 page table descriptor on page 6-8 section descriptor on page 6-9 translating section references on page 6-11 level 2 descriptor on page 6-12 translating small page references on page 6-14 translating large page references on page 6-16 mmu faults and cpu aborts on page 6-18 fault address and fault status registers on page 6-19 domain access control on page 6-21 fault checking sequence on page 6-22 external aborts on page 6-25 interaction of the mmu, idc, and write buffer on page 6-26.
memory management unit 6-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 6.1 about the mmu the mmu performs two primary functions: translates virtual addresses into physical addresses controls memory access permissions. the mmu hardware required to perform these functions consists of: a tlb access control logic translation table walking logic. when the mmu is turned off, as happens on reset, the virtual address is output directly onto the physical address bus. note the mmu works with virtual addresses after any relocation by the fcse pid. 6.1.1 memory accesses the mmu supports memory accesses based on sections or pages: sections are 1mb blocks of memory. pages two different page sizes are supported: small pages consist of 4kb blocks of memory. additional access control mechanisms are extended to 1kb subpages. large pages consist of 64kb blocks of memory. large pages are supported to allow mapping of a large region of memory while using only a single entry in the tlb. additional access control mechanisms are extended to 16kb subpages. 6.1.2 domains the mmu also supports the concept of domains . these are areas of memory that can be defined to possess individual access rights. the domain access control register specifies access rights for up to 16 separate domains. 6.1.3 tlb the tlb caches 64 translated entries. during most memory accesses, the tlb provides the translation information to the access control logic:
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-3 if the tlb contains a translated entry for the virtual address, the access control logic determines if access is permitted. if access is permitted, the mmu outputs the appropriate physical address corresponding to the virtual address. if access is not permitted, the mmu signals the cpu to abort. if the tlb misses (it does not contain a translated entry for the virtual address), the translation table walking hardware is invoked to retrieve the translation information from a translation table in physical memory. once retrieved, the translation information is placed into the tlb, possibly overwriting an existing value. the entry to be overwritten is chosen by cycling sequentially through the tlb locations. note the tlb must be flushed whenever the virtual to physical address mappings are changed. 6.1.4 effect of reset for information on the effect of reset, see reset on page 2-23.
memory management unit 6-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 6.2 mmu program accessible registers the ARM720T processor provides several 32-bit registers that determine the operation of the mmu. data is written to and read from the mmu registers using the arm cpu mrc and mcr coprocessor instructions. a brief description of the registers is given in table 6-1. each register is discussed in more detail in its relevant section. the fsr and far are only updated for data faults, not for prefetch faults. table 6-1 mmu program accessible registers register description translation table base holds the physical address of the base of the translation table maintained in main memory. this base must reside on a 16kb boundary. domain access control consists of 16 2-bit fields, each of which defines the access permissions for one of the 16 domains (d15 ? d0). tlb operations allows individual or all tlb entries to be marked as invalid. fault status indicates the domain and type of access being attempted when an abort occurred. bits [7:4] specify which of the 16 domains (d15-d0) was being accessed when a fault occurred. bits [3:1] indicate the type of access being attempted. the encoding of these bits is different for internal and external faults (as indicated by bit 0 in the register) and is shown in table 6-5 on page 6-19. fault address holds the virtual address of the access which was attempted when a fault occurred.
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-5 6.3 address translation process the mmu translates virtual addresses generated by the cpu after relocation by the fcse pid into physical addresses to access external memory. it also derives and checks the access permission. translation information, that consists of both the address translation data and the access permission data, resides in a translation table located in physical memory. the mmu provides the logic required to: traverse this translation table obtain the translated address check the access permission. there are three routes by which the address translation, and therefore permission check, takes place. the route taken depends on whether the address has been marked as a section-mapped access or a page-mapped access. there are two sizes of page-mapped access, large pages and small pages. however, the translation process always starts out in the same way, as described in translation table base , with a level one fetch. a section-mapped access only requires a level one fetch, but a page-mapped access also requires a level two fetch. 6.3.1 translation table base the translation process is initiated when the tlb does not contain an entry for the requested virtual address. the translation table base (ttb) register points to the base of a table in physical memory that contains: section and page descriptors section or page descriptors. the 14 low-order bits of the ttb register should be zero as illustrated in figure 6-1. figure 6-1 translation table base register note the table must reside on a 16kb boundary. 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 translation table base sbz
memory management unit 6-6 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 6.3.2 level 1 fetch bits [31:14] of the ttb register are concatenated with bits [31:20] of the virtual address to produce a 30-bit address. this address selects a 4-byte translation table entry that is a first level descriptor for either a section or a page. bit 1 of the returned descriptor specifies whether it is for a section or page. this is shown in figure 6-2. . figure 6-2 accessing the translation table first level descriptors 31 20 19 00 table index section index 31 14 13 00 translation base sbz 31 14 13 02 01 00 translation base table index 31 00 virtual address translation table base first level descriptor 0 0 18 12
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-7 6.4 level 1 descriptor the level 1 descriptor returned is either a page table descriptor or a section descriptor, and its format varies accordingly. figure 6-3 illustrates the format of level 1 descriptors. figure 6-3 level 1 descriptors the two least significant bits indicate the descriptor type and validity, and are interpreted as listed in table 6-2. 31 20 19 00 10 09 04 page table base address 08 03 02 01 section base address 1 12 11 fault 0 1 page domain 1 domain c b 1 section ap sbz reserved 05 0 1 1 0 0 sbz table 6-2 interpreting level 1 descriptor bits [1:0] value meaning notes 0 0 invalid generates a section translation fault 0 1 page indicates that this is a page descriptor 1 0 section indicates that this is a section descriptor 1 1 reserved reserved for future use
memory management unit 6-8 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 6.5 page table descriptor the bits used for the page table descriptor are as follows: bits [3:2] are always written as 0. bit [4] must be written to 1 for backward compatibility. bits [8:5] specify one of the 16 possible domains, held in the domain access control register, that contain the primary access controls. bit [9] is always written as 0. bits [31:10] form the base for referencing the page table entry. the page table index for the entry is derived from the virtual address as illustrated in figure 6-6 on page 6-15. if a page table descriptor is returned from the level one fetch, a level two fetch is initiated as described in section descriptor on page 6-9.
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-9 6.6 section descriptor address data is described as: c (cachable) indicates that data at this address is placed in the cache if the cache is enabled. b (bufferable) indicates that data at this address is written through the write buffer if the write buffer is enabled. note the meaning of the c and b bits might change in later arm processors. you are strongly recommend to structure software so that code that manipulates the mmu page tables is contained in a single module. it can then be updated easily when you port it to a different arm processor. the bits used for the page table descriptor are as follows: bits [3:2] (c, b) control the cache and write buffer related functions. bit [4] must be written to 1 for backward compatibility. bits [8:5] specify one of the 16 possible domains held in the domain access control register that contain the primary access controls. bit [9] is always written as 0. bits [11:10] (ap) specify the access permissions for this section and are interpreted as listed in table 6-3 on page 6-10. their interpretation depends on the setting of the s and r bits, control register bits 8 and 9. the domain access control specifies the primary access control. the ap bits only have an effect in client mode. refer to domain access control on page 6-21. bits [19:12] are always written as 0. bits [31:20] form the corresponding bits of the physical address for the 1mb section.
memory management unit 6-10 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a table 6-3 interpreting access permission (ap) bits ap s r supervisor permission user permission notes 00 0 0 no access no access any access generates a permission fault 00 1 0 read only no access supervisor read only permitted 00 0 1 read only read only any write generates a permission fault 00 1 1 reserved reserved reserved 01 x x read/write no access access allowed only in supervisor mode 10 x x read/write read only writes in user mode cause permission fault 11 x x read/write read/write all access types permitted in both modes xx 1 1 reserved reserved reserved
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-11 6.7 translating section references figure 6-4 shows the complete section translation sequence. note the access permissions contained in the level 1 descriptor must be checked before the physical address is generated. figure 6-4 section translation 31 20 19 00 31 14 13 00 31 14 13 02 01 00 31 00 virtual address translation table base first level descriptor 18 12 20 19 10 09 04 08 03 02 01 12 11 20 19 31 05 00 12 20 translation base table index 0 0 section base address 1 domain c b 1 ap sbz 0 section index section base address translation base sbz table index section index sbz
memory management unit 6-12 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 6.8 level 2 descriptor if the level one fetch returns a page table descriptor, this provides the base address of the page table to be used. the page table is then accessed as described in figure 6-6 on page 6-15, and a page table entry, or level 2 descriptor, is returned. this in turn can define either a small page or a large page access. figure 6-5 shows the format of level 2 descriptors. figure 6-5 page table entry, level 2 descriptor the two least significant bits indicate the page size and validity, and are interpreted as listed in table 6-4. the remaining bits are interpreted as follows: bit [2] b, bufferable, indicates that data at this address is written through the write buffer if the write buffer is enabled. bit [3] c, cacheable, indicates that data at this address is placed in the idc if the cache is enabled. bits [11:4] specify the access permissions (ap3 ? ap0) for the four subpages. interpretation of these bits is listed in table 6-2 on page 6-7. bits [15:12] are programmed as 0 for large pages. 31 00 10 09 04 large page base address 08 03 02 01 small page base address 1 12 11 fault 0 c large page c b 1 small page reserved 1 1 0 05 06 07 16 15 b ap0 ap1 ap2 ap3 sbz ap0 ap1 ap2 ap3 0 0 table 6-4 interpreting page table entry bits 1:0 value meaning notes 0 0 invalid generates a page translation fault 0 1 large page indicates that this is a 64kb page 1 0 small page indicates that this is a 4kb page 1 1 reserved reserved for future use
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-13 bits [31:12] small pages. bits [31:16] large pages. note small and large pages form the corresponding bits of the physical address, that is the physical page number. the page index is derived from the virtual address as illustrated in figure 6-6 on page 6-15 and figure 6-7 on page 6-17.
memory management unit 6-14 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 6.9 translating small page references figure 6-6 illustrates the complete translation sequence for a 4kb small page. page translation involves one additional step beyond that of a section translation. the level 1 descriptor is the page table descriptor, and this points to the level 2 descriptor, or page table entry. as the access permissions are now contained in the level 2 descriptor they must be checked before the physical address is generated. the sequence for checking access permissions is described in fault checking sequence on page 6-22.
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-15 figure 6-6 small page translation 31 20 19 00 31 14 13 00 translation base sbz 31 14 13 02 01 00 translation base table index 31 00 virtual address translation table base first level descriptor 0 0 18 12 10 09 04 08 03 02 01 31 05 8 12 11 00 04 03 02 01 05 08 07 06 11 10 09 12 00 01 10 09 31 00 11 12 31 second level descriptor physical address 12 ap0 1 0 c b ap1 ap2 ap3 page base address page index page base address l2 table index page table base address 0 0 page table base address 1 domain sbz 0 1 table index page index l2 table index sbz
memory management unit 6-16 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 6.10 translating large page references figure 6-7 illustrates the complete translation sequence for a 64kb large page. as the upper four bits of the page index and low-order four bits of the page table index overlap, each page table entry for a large page must be duplicated 16 times, in consecutive memory locations, in the page table.
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-17 figure 6-7 large page translation 31 20 19 00 31 14 13 00 translation base sbz 31 14 13 02 01 00 translation base table index 31 00 virtual address translation table base first level descriptor 0 0 18 12 10 09 04 08 03 02 01 31 05 8 00 04 03 02 01 05 08 07 06 11 10 09 12 00 01 10 09 31 00 15 16 31 second level descriptor physical address 12 16 15 15 16 page table base address 1 domain sbz 0 1 page index page base address l2 table index page table base address 0 0 table index page index l2 table index ap0 0 1 c b ap1 ap2 ap3 page base address sbz sbz
memory management unit 6-18 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 6.11 mmu faults and cpu aborts the mmu generates four types of faults: alignment fault translation fault domain fault permission fault. in addition, an external abort can be raised on external data access. the access control mechanisms of the mmu detect the conditions that produce these faults. if a fault is detected as the result of a memory access, the mmu aborts the access and signals the fault condition to the cpu. the mmu is also capable of retaining status and address information about the abort. the cpu recognizes two types of abort that are treated differently by the mmu: data aborts prefetch aborts. if the mmu detects an access violation, it does so before the external memory access takes place, and it therefore inhibits the access. external aborts do not necessarily inhibit the external access, as described in external aborts on page 6-25 . if the ARM720T is operating in fastbus mode an internally aborting access can cause the address on the external address bus to change, even though the external bus cycle has been canceled. the address that is placed on the bus is the translation of the address that caused the abort, though in the case of a translation fault the value of this address is undefined. no memory access is performed to this address.
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-19 6.12 fault address and fault status registers aborts resulting from data accesses, data aborts are acted upon by the cpu immediately, and the mmu places an encoded 4-bit value fs[3:0], along with the 4-bit encoded domain number, in the fsr. in addition, the virtual processor address which caused the data abort is latched into the far. if an access violation simultaneously generates more than one source of abort, they are encoded in the priority listed in table 6-5. note any abort masked by the priority encoding can be regenerated by fixing the primary abort and restarting the instruction. cpu instructions are prefetched, so a prefetch abort simply flags the instruction as it enters the instruction pipeline. only when, and if, the instruction is executed does it cause an abort. an abort is not acted upon if the instruction is not used, that is, it is table 6-5 priority encoding of fault status priority source fs[3:0] domain [3:0] far highest alignment 00x1 a invalid valid bus error (translation) level 1 level 2 1100 1110 invalid valid valid valid translation section page 0101 0111 invalid valid valid valid domain section page 1001 1011 valid valid valid valid permission section page 1101 1111 valid valid valid valid bus error (linefetch) section page 0100 0110 valid valid contains the address of the start of the linefetch contains the address of the start of the linefetch lowest bus error (other) section page 1000 1010 valid valid valid valid a. x is undefined, and can be read as zero or one.
memory management unit 6-20 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a branched around. because instruction prefetch aborts might not be acted upon, the mmu status information is not preserved for the resulting cpu abort. for a prefetch abort, the mmu does not update the fsr or far. the sections that follow describe the various access permissions and controls supported by the mmu and describe how these are interpreted to generate faults. note the far will contain a modified virtual address if the process identifier register is nonzero.
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-21 6.13 domain access control mmu accesses are primarily controlled through domains. there are 16 domains, and each has a 2-bit field to define it. two basic kinds of users are supported: clients use a domain. managers control the behavior of the domain. the domains are defined in the domain access control register. figure 6-8 illustrates how the 32 bits of the register are allocated to define the 16 2-bit domains. figure 6-8 domain access control register format table 6-6 lists how the bits within each domain are interpreted to specify the access permissions. 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 15 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 table 6-6 interpreting access bits in domain access control register value meaning notes 00 no access any access generates a domain fault. 01 client accesses are checked against the access permission bits in the section or page descriptor. 10 reserved reserved. currently behaves like the no access mode. 11 manager accesses are not checked against the access permission bits so a permission fault cannot be generated.
memory management unit 6-22 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 6.14 fault checking sequence the sequence the mmu uses to check for access faults is slightly different for sections and pages. figure 6-9 illustrates the sequence for both types of access. figure 6-9 sequence for checking faults descriptions of the conditions that generate each of the faults are provided as follows: virtual address check address alignment misaligned alignment fault get level 1 descriptor invalid section translation fault section page get page table entry check domain status invalid page translation fault no access(00) reserved(10) page domain fault section page no access(00) reserved(10) section domain fault client(01) client(01) manager(01) check access permissions check access permissions physical address violation section permission fault violation sub-page permission fault
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-23 alignment fault translation fault domain fault permission fault on page 6-24. 6.14.1 alignment fault if alignment fault is enabled (bit 1 in the control register set), the mmu generates an alignment fault on any data word access without a word-aligned address, irrespective of whether the mmu is enabled or not. in other words, if either of virtual address bits [1:0] are not 0, the alignment fault is enabled. an alignment fault is not generated on any instruction fetch, nor on any byte access. note if the access generates an alignment fault, the access sequence aborts without reference to further permission checks. 6.14.2 translation fault there are two types of translation fault: section is generated if the level 1 descriptor is marked as invalid. this happens if bits[1:0] of the descriptor are both 0, or both 1. page is generated if the page table entry is marked as invalid. this happens if bits[1:0] of the entry are both 0, or both 1. 6.14.3 domain fault there are two types of domain fault: section the domain is checked when the level 1 descriptor is returned. page . the domain is checked when the page table entry is returned. in both cases, the level 1 descriptor holds the 4-bit domain field that selects one of the 16 2-bit domains in the domain access control register. the two bits of the specified domain are then checked for access permissions as listed in table 6-3 on page 6-10. if the specified access is either no access (00) or reserved (10), either a section domain fault or page domain fault occurs.
memory management unit 6-24 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 6.14.4 permission fault permission fault is checked at the same time as domain fault. if the 2-bit domain field returns client (01), the permission access check is invoked as follows: there are two types of permission fault: section subpage. section if the level 1 descriptor defines a section-mapped access, the ap bits of the descriptor define whether or not the access is allowed according to table 6-3 on page 6-10. interpretation depends on the setting of the s bit (control register bit 8). if the access is not allowed, a section permission fault is generated. subpage if the level 1 descriptor defines a page-mapped access then the level 2 descriptor specifies four access permission fields (ap3 to ap0), each corresponding to one quarter of the page: for small pages: ? ap3 is selected by the top 1kb of the page ? ap0 is selected by the bottom 1kb of the page. for large pages: ? ap3 is selected by the top 16kb of the page ? ap0 is selected by the bottom 16kb of the page. the selected ap bits are then interpreted in exactly the same way as for a section (see table 6-3 on page 6-10. the only difference is that the fault generated is a subpage permission fault.
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-25 6.15 external aborts in addition to the mmu-generated aborts, ARM720T has an external abort pin, berror , which can be used to flag an error on an external memory access. however, not all accesses can be aborted in this way, so use this pin with great care. this section describes the restrictions. the following accesses can be aborted and restarted safely. the external access stops on the next cycle if any of the following are aborted: reads unbuffered writes level 1 descriptor fetch level 2 descriptor fetch read-lock-write sequence. in the case of a read-lock-write sequence in which the read aborts, the write does not happen. 6.15.1 cachable reads (linefetches) a linefetch can be safely aborted on any word in the transfer. if an abort occurs during the linefetch, the cache is purged, so it does not contain invalid data. if the abort happens on a word that has been requested by the ARM720T, it is aborted, otherwise the cache line is purged but program flow is not interrupted. the line is therefore purged under all circumstances. 6.15.2 buffered writes buffered writes cannot be externally aborted. therefore, the system must be configured so that it does not attempt buffered writes to areas of memory that are capable of flagging an external abort. note areas of memory that can generate an external abort on a location that has previously been read successfully must not be marked as cachable or unbufferable. this applies to both the mmu page tables and the configuration register. if all writes to an area of memory abort, it is recommended that you mark it as read-only in the mmu, otherwise mark it as uncachable and unbufferable.
memory management unit 6-26 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 6.16 interaction of the mmu, idc, and write buffer the mmu, idc, and wb can be enabled or disabled independently. however, in order for the write buffer or the cache to be enabled the mmu must also be enabled. there are no hardware interlocks on these restrictions, so invalid combinations cause undefined results. valid buffer combinations are listed in table 6-7. the procedures described in enabling the mmu and disabling the mmu on page 6-27 must be observed. 6.16.1 enabling the mmu to enable the mmu: 1. program the translation table base and domain access control registers 2. program level 1 and level 2 page tables as required. 3. enable the mmu by setting bit 0 in the control register. note you must take care if the translated address differs from the untranslated address because the two instructions following the enabling of the mmu have been fetched using flat translation. enabling the mmu might be considered as a branch with delayed execution. a similar situation occurs when the mmu is disabled. consider the following code sequence: mov r1, #0x1 mcr 15,0,r1,0,0; enable mmu fetch flat fetch flat fetch translated table 6-7 valid mmu, idc and write buffer combinations mmu idc wb off off off on off off on on off on off on on on on
memory management unit arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 6-27 6.16.2 disabling the mmu to disable the mmu: 1. disable the wb by clearing bit 3 in the control register. 2. disable the idc by clearing bit 2 in the control register. 3. disable the mmu by clearing bit 0 in the control register. you can disable all three functions simultaneously. note if the mmu is enabled, then disabled and subsequently re-enabled, the contents of the tlb are preserved. if these are now invalid, you must flush the tlb before re-enabling the mmu.
memory management unit 6-28 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-1 chapter 7 debug interface this chapter describes the ARM720T advanced debug interface. it contains the following sections: about the debug interface on page 7-2 debug systems on page 7-4 entering debug state on page 7-7 scan chains and jtag interface on page 7-9 reset on page 7-11 public instructions on page 7-12 test data registers on page 7-16 arm7tdm core clocks on page 7-23 determining the core and system state on page 7-25 the pc during debug on page 7-30 priorities and exceptions on page 7-34 scan interface timing on page 7-35 scan and debug signals used by the embedded trace logic on page 7-42.
debug interface 7-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 7.1 about the debug interface in this chapter arm7tdm refers to the arm7tdmi core excluding the embeddedice logic. the arm7tdm debug interface is based on ieee std. 1149.1-1990, standard test access port and boundary-scan architecture . refer to this standard for an explanation of the terms used in this chapter and for a description of the tap controller states. 7.1.1 debug extensions arm7tdm contains hardware extensions for advanced debugging features. these are intended to ease the development of application software, operating systems, and the hardware itself. the debug extensions allow you to stop the core either on a given instruction fetch (breakpoint) or data access (watchpoint), or asynchronously by a debug-request. when this happens, arm7tdm is said to be in debug state . at this point, the internal state of the core and the external state of the system can be examined. once examination is complete, the core and system state can be restored and program execution resumed. debug state arm7tdm is forced into debug state either by a request on one of the external debug interface signals, or by an internal functional unit known as embeddedice logic. once in debug state, the core isolates itself from the memory system. the core can then be examined while all other system activity continues as normal. internal state the internal state of the arm7tdm is examined through a jtag-style serial interface, that allows instructions to be serially inserted into the pipeline of the core without using the external data bus. when in debug state, a store multiple ( stm ) can be inserted into the instruction pipeline and this dumps the contents of the arm7tdm registers. this data can be serially shifted out without affecting the rest of the system. 7.1.2 pullup resistors the ieee 1149.1 standard effectively requires that xtdi , xntrst , and xtms have internal pullup resistors. in order to minimize static current draw, these resistors are not fitted to arm7tdm. accordingly, the four inputs to the test interface (the above three signals plus xtck ) must all be driven to good logic levels to achieve normal circuit operation.
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-3 7.1.3 instruction register the instruction register is four bits in length. there is no parity bit. the fixed value loaded into the instruction register during the capture-ir controller state is b0001.
debug interface 7-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 7.2 debug systems the arm7tdm forms one component of a debug system that interfaces from the high-level debugging performed by the user to the low-level interface supported by arm7tdm. figure 7-1 shows a typical debug system. figure 7-1 typical debug system a debug system typically has three parts: debug host protocol converter resume program execution. on page 7-5. 7.2.1 debug host this is a computer, for example a personal computer, running a software debugger such as arm debugger for windows (adw). the debug host allows you to issue high level commands such as setting breakpoints, or examining the contents of memory. 7.2.2 protocol converter the protocol converter interfaces between the high-level commands issued by the debug host and the low-level commands of the ARM720T jtag interface. typically it interfaces to the host through an interface such as an enhanced parallel port. protocol converter debug host debug target host computer running debugger development system containing arm7tdm
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-5 7.2.3 ARM720T the ARM720T has hardware extensions that ease debugging at the lowest level. the debug extensions: allow you to stall the core from program execution examine the core internal state examine the state of the memory system resume program execution. the ARM720T contains the arm7tdm core. the major blocks of the arm7tdm core are: the arm cpu core this has hardware support for debug. the embeddedice logic this is a set of registers and comparators used to generate debug exceptions (such as breakpoints). this unit is described in chapter 8 embeddedice logic . the tap controller this controls the action of the scan chains using a jtag serial interface. the anatomy of arm7tdm is shown in figure 7-2 on page 7-6 with the ARM720T system control processor. the debug host and the protocol converter are system-dependent.
debug interface 7-6 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a figure 7-2 arm7tdm scan chain arrangement arm7tdm processor system control processor arm7tdm embeddedice scan chain 2 scan chain 1 scan chain 15 scan chain 0 arm7tdm tap controller
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-7 7.3 entering debug state arm7tdm is forced into debug state after a breakpoint, watchpoint, or debug request. you can program the conditions under which a breakpoint or watchpoint occur using embeddedice logic. alternatively, external logic can monitor the address and data bus, and flag breakpoints and watchpoints using the breakpoint pin. 7.3.1 entering debug state on breakpoint after an instruction has been breakpointed, the core does not enter debug state immediately. instructions are marked as being breakpointed as they enter the arm7tdm instruction pipeline. therefore arm7tdm only enters debug state when and if the instruction reaches the execute stage of the pipeline. there are two reasons why a breakpointed instruction might not cause arm7tdm to enter debug state: a branch precedes the breakpointed instruction. when the branch is executed, the instruction pipeline is flushed and the breakpoint is canceled. an exception has occurred. again, the instruction pipeline is flushed and the breakpoint is canceled. however, the normal way to exit from an exception is to branch back to the instruction that would have executed next. this involves refilling the pipeline, and so the breakpoint can be re-flagged. when a breakpointed conditional instruction reaches the execute stage of the pipeline, the breakpoint is always taken and arm7tdm enters debug state, regardless of whether the condition was met. breakpointed instructions are not executed. instead, arm7tdm enters debug state, so that when the internal state is examined, the state before the breakpointed instruction is seen. once examination is complete, the breakpoint must be removed and program execution restarted from the previously breakpointed instruction. 7.3.2 entering debug state on watchpoint watchpoints occur on data accesses. a watchpoint is always taken, but the core might not enter debug state immediately. in all cases, the current instruction does complete. if this is a multi-word load or store ( ldm or stm ), many cycles can elapse before the watchpoint is taken. watchpoints are similar to data aborts. the difference is that if a data abort occurs, although the instruction completes, all subsequent changes to arm7tdm state are prevented. this allows the cause of the abort to be cured by the abort handler, and the
debug interface 7-8 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a instruction re-executed. in the case of a watchpoint, the instruction completes and all changes to the core state occur (load data is written into the destination registers, and base writeback occurs). therefore, the instruction does not have to be restarted. watchpoints are always taken. if an exception is pending when a watchpoint occurs, the core enters debug state in the mode of that exception. 7.3.3 entering debug state on debug-request arm7tdm can also be forced into debug state on debug request. this can be done either through embeddedice programming (see chapter 8 embeddedice logic ), or by the assertion of the dbgrq pin. this pin is an asynchronous input and is therefore synchronized by logic inside arm7tdm before it takes effect. following synchronization, the core normally enters debug state at the end of the current instruction. however, if the current instruction is a busy-waiting access to a coprocessor, the instruction terminates and arm7tdm enters debug state immediately. this is similar to the action of nirq and nfiq .
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-9 7.4 scan chains and jtag interface there are three jtag style scan chains inside arm7tdm and an additional scan chain inside ARM720T. these allow testing, debugging, and embeddedice programming. in addition, support is provided for further scan chains outside of ARM720T. unused scan chains can be used for application-specific integrated circuit (asic) boundary scan or for asic test. the control signals provided for this are described later. the scan chains are controlled from a jtag-style test access port (tap) controller. for further details of the jtag specification, refer to ieee standard 1149.1-1990 standard test access port and boundary-scan architecture . note the scan cells are not fully jtag-compliant, see scan limitations for a description of the limitations on their use. 7.4.1 scan limitations the three arm7tdm scan paths are referred to as scan chain 0, 1, and 2. these are shown in figure 7-2 on page 7-6. scan chain functions are described below: scan chain 0 allows access to the entire periphery of the arm7tdm core, including the data bus. the scan chain functions allow inter-device testing (extest) and serial testing of the core (intest). the order of the scan chain (from sdin to sdout ) is: ? data bus bits 0 to 31 ? the control signals ? the address bus bits 31 to 0. scan chain 1 is a subset of the signals that are accessible through scan chain 0. access to the core data bus d[31:0] , and the breakpoint signal is available serially. there are 33 bits in this scan chain. the order is (from serial data in to out): ? data bus bits 0 through 31 ? breakpoint scan chain 2 allows access to the embeddedice logic registers. see chapter 8 embeddedice logic for details. scan chain 15 allows access to the system control coprocessor registers.
debug interface 7-10 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 7.4.2 the jtag state machine the process of serial test and debug is best explained in conjunction with the jtag state machine. figure 7-3 shows the state transitions that occur in the tap controller. the state numbers are also shown on the diagram. figure 7-3 test access port (tap) controller state transitions from ieee std. 1149.1-1999, copyright 1997, 1998, 2000 ieee. all rights reserved. test-logic reset 0xf run-test/idle 0xc select-dr-scan 0x7 capture-dr 0x6 capture-ir 0xe shift-dr 0x2 shift-ir 0xa exit1-dr 0x1 exit1-ir 0x9 pause-dr 0x3 pause-ir 0xb exit2-dr 0x0 exit2-ir 0x8 update-dr 0x5 update-ir 0xd select-ir-scan 0x4 tms=1 tms=0 tms=0 tms=1 tms=1 tms=1 tms=0 tms=0 tms=1 tms=0 tms=1 tms=1 tms=1 tms=0 tms=0 tms=1 tms=1 tms=1 tms=0 tms=1 tms=0 tms=0 tms=1 tms=0 tms=1 tms=1 tms=0 tms=1 tms=0 tms=0 tms=0 tms=0
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-11 7.5 reset the boundary-scan interface includes a state machine controller, the tap controller. to force the tap controller into the correct state after power-up of the device, a reset pulse must be applied to the xntrst signal. if the boundary scan interface is to be used, xntrst must be driven low, and then high again. if the boundary scan interface is not to be used, the xntrst input can be tied permanently low. note a clock on xtck is not necessary to reset the device. the action of reset is as follows: 1. system mode is selected (the boundary scan chain cells do not intercept any of the signals passing between the external system and the core). 2. the idcode instruction is selected. if the tap controller is put into the shift-dr state and xtck is pulsed, the contents of the id register are clocked out of xtdo .
debug interface 7-12 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 7.6 public instructions the public instructions are listed in this section. in the descriptions that follow, xtdi and xtms are sampled on the rising edge of xtck and all output transitions on xtdo occur as a result of the falling edge of xtck . 7.6.1 extest (0000) this instruction places the selected scan chain in test mode. it connects the selected scan chain between xtdi and xtdo . when the instruction register is loaded with extest, all the scan cells are placed in their test mode of operation. capture-dr inputs from the system logic and outputs from the output scan cells to the system are captured by the scan cells. shift-dr the previously captured test data is shifted out of the scan chain using xtdo , while new test data is shifted in through the xtdi input. this data is applied immediately to the system logic and system pins. 7.6.2 scan_n (0010) this instruction connects the scan path select register between xtdi and xtdo . on reset, scan chain 3 is selected by default. the scan path select register is four bits long in this implementation, although no finite length is specified. capture-dr the fixed value 1000 is loaded into the register. shift-dr the id number of the desired scan path is shifted into the scan path select register. update-dr the scan register of the selected scan chain is connected between xtdi and xtdo , and remains connected until a subsequent scan_n instruction is issued. 7.6.3 intest (1100) this instruction places the selected scan chain in test mode. it connects the selected scan chain between xtdi and xtdo . when the instruction register is loaded with this instruction, all the scan cells are placed in their test mode of operation. single-step operation is possible using the intest instruction.
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-13 capture-dr the value of the data applied from the core logic to the output scan cells, and the value of the data applied from the system logic to the input scan cells is captured. shift-dr the previously captured test data is shifted out of the scan chain using the xtdo pin, while new test data is shifted in using the xtdi pin. 7.6.4 idcode (1110) this instruction connects the device identification (id) register between xtdi and xtdo . the id register is a 32-bit register that allows the manufacturer, part number, and version of a component to be determined through the tap. see arm7tdm device identification code register on page 7-16 for details of the id register format. when the instruction register is loaded with this instruction, all the scan cells are placed in their normal, system, mode of operation: capture-dr the device identification code is captured by the id register. shift-dr the previously captured device identification code is shifted out of the id register using the xtdo pin, while data is shifted in through the xtdi pin into the id register. update-dr the id register is unaffected. 7.6.5 bypass (1111) this instruction connects a 1-bit shift register, the bypass register, between xtdi and xtdo . when this instruction is loaded into the instruction register, all the scan cells are placed in their normal, system, mode of operation. this instruction has no effect on the system pins. capture-dr a logic 0 is captured by the bypass register. shift-dr test data is shifted into the bypass register through xtdi and out through xtdo after a delay of one xtck cycle. note the first bit shifted out is a zero. all unused instruction codes default to the bypass instruction. update-dr the bypass register is not affected.
debug interface 7-14 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 7.6.6 clamp (0101) this instruction connects a 1-bit shift register, the bypass register, between xtdi and xtdo . when this instruction is loaded into the instruction register, the state of all the output signals is defined by the values previously loaded into the currently loaded scan chain. note this instruction must only be used when scan chain 0 is the currently selected scan chain. capture-dr a logic 0 is captured by the bypass register. shift-dr test data is shifted into the bypass register using xtdi and out using xtdo after a delay of one xtck cycle. note the first bit shifted out is a zero. update-dr the bypass register is not affected. 7.6.7 highz (0111) this instruction connects a 1-bit shift register, the bypass register, between xtdi and xtdo . when this instruction is loaded into the instruction register, the address bus, a[31:0] , the data bus, d[31:0] , plus nrw , nopc , lock , mas[1:0] , and ntrans are all driven to the high impedance state and the external highz signal is driven high. this is as if the signal tbe had been driven low. capture-dr a logic 0 is captured by the bypass register. shift-dr test data is shifted into the bypass register using xtdi and out using xtdo after a delay of one xtck cycle. note the first bit shifted out is a zero. update-dr the bypass register is not affected.
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-15 7.6.8 clampz (1001) this instruction connects a 1-bit shift register, the bypass register, between xtdi and xtdo . when this instruction is loaded into the instruction register, all the 3-state outputs are placed in their inactive state, but the data supplied to the outputs is derived from the scan cells. the purpose of this instruction is to ensure that, during production test, each output can be disabled when its data value is either a logic 0 or a logic 1. capture-dr a logic 0 is captured by the bypass register. shift-dr test data is shifted into the bypass register through xtdi and out through xtdo after a delay of one xtck cycle. note the first bit shifted out will be a zero. update-dr the bypass register is not affected. 7.6.9 restart (0100) this instruction restarts the processor on exit from debug state. it connects the bypass register between xtdi and xtdo, and the tap controller behaves as if the bypass instruction had been loaded. the processor resynchronizes back to the memory system once the run-test/idle state is entered. 7.6.10 sample/preload (0011) this instruction is included for production test only, and must never be used.
debug interface 7-16 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 7.7 test data registers you can connect five test data registers between xtdi and xtdo : this register bypasses the device during scan testing by providing a path between xtdi and xtdo. the bypass register is 1 bit in length. arm7tdm device identification code register this register changes the current tap instruction. the register is four bits in length. on page 7-17 this register changes the current active scan chain. the register is 4 bits in length. on page 7-17 these allow serial access to the core logic, and to embeddedice logic for programming purposes. they are described in this section and shown in figure 7-5 on page 7-19. on page 7-18. these are described in the following sections. 7.7.1 bypass register this register bypasses the device during scan testing by providing a path between xtdi and xtdo . the bypass register is 1 bit in length. operating mode when the bypass instruction is the current instruction in the instruction register, serial data is transferred from xtdi to xtdo in the shift-dr state with a delay of one xtck cycle. there is no parallel output from the bypass register. a logic 0 is loaded from the parallel input of the bypass register in the capture-dr state. 7.7.2 arm7tdm device identification code register this register reads the 32-bit device id code. no programmable supplementary identification code is provided. the register is 32 bits in length. the format of the id register is shown in figure 7-4. figure 7-4 id code register format 0 1 11 12 27 28 31 version part number manufacturer identity 1
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-17 contact your supplier for the correct device identification code. operating mode when the idcode instruction is current, the id register is selected as the serial path between xtdi and xtdo . there is no parallel output from the id register. the 32-bit device identification code is loaded into the id register from its parallel inputs during the capture-dr state. 7.7.3 instruction register this register changes the current tap instruction. the register is four bits in length. operating mode when in the shift-ir state, the instruction register is selected as the serial path between xtdi and xtdo . during the capture-ir state, the value 0001 binary is loaded into this register. this is shifted out during shift-ir least significant bit (lsb) first, while a new instruction is shifted in (lsb first). during the update-ir state, the value in the instruction register becomes the current instruction. on reset, idcode becomes the current instruction. 7.7.4 scan chain select register this register changes the current active scan chain. the register is 4 bits in length. operating mode after scan_n has been selected as the current instruction, when in the shift-dr state, the scan chain select register is selected as the serial path between xtdi and xtdo . during the capture-dr state, the value 1000 binary is loaded into this register. this is shifted out during shift-dr (lsb first), while a new value is shifted in (lsb first). during the update-dr state, the value in the register selects a scan chain to become the currently active scan chain. all further instructions, such as intest, then apply to that scan chain.
debug interface 7-18 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a the currently selected scan chain only changes when a scan_n instruction is executed, or a reset occurs. on reset, scan chain 3 is selected as the active scan chain. the number of the currently selected scan chain is reflected on the screg[3:0] outputs. you can use the tap controller to drive external scan chains in addition to those within the arm7tdm macrocell. you must assign the external scan chain a number and control signals for it can be derived from screg[3:0] , ir[3:0] , tapsm[3:0] , tck1 , and tck2 . the list of scan chain numbers allocated by arm are listed in table 7-1. an external scan chain can take any other number. the serial data stream to be applied to the external scan chain is made present on sdinbs . the serial data back from the scan chain must be presented to the tap controller on the sdoutbs input. the scan chain present between sdinbs and sdoutbs is connected between xtdi and xtdo whenever scan chain 3 is selected, or when any of the unassigned scan chain numbers is selected. if there is more than one external scan chain, a multiplexor must be built externally to apply the desired scan chain output to sdoutbs . the multiplexor can be controlled by decoding screg[3:0] . 7.7.5 scan chains 0, 1, 2, and 15 these allow serial access to the core logic, and to embeddedice logic for programming purposes. they are described in this section and shown in figure 7-5 on page 7-19. scan chains 0 and 1 allow access to the processor core for test and debug. they have the following lengths: scan chain 0, 105 bits table 7-1 scan chain number allocation scan chain number function 0 macrocell scan test 1debug 2 embeddedice programming 3 reserved (external boundary scan) 4reserved 8reserved 15 system control coprocessor
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-19 scan chain 1, 33 bits. each scan chain cell consists of a serial register and a multiplexor. the scan cells perform two basic functions: capture for input cells, the capture stage involves copying the value of the system input to the core into the serial register. for output cells, capture involves placing the value of a core output into the serial register. shift for input cells, during shift, this value is output serially. the value applied to the core from an input cell is either the system input or the contents of the serial register, and this is controlled by the multiplexor. for output cells, during shift, this value is serially output as before. the value applied to the system from an output cell is either the core output, or the contents of the serial register. figure 7-5 input scan cell all the control signals for the scan cells are generated internally by the tap controller. the action of the tap controller is determined by the current instruction, and the state of the tap state machine. this is described in operating modes on page 7-20. serial data in shift register latch system data in capture clock shift clock serial data out data to core test enable 0 1
debug interface 7-20 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a operating modes the scan chains have three basic modes of operation, selected by the various tap controller instructions: system mode the scan cells are idle. system data is applied to inputs, and core outputs are applied to the system. intest mode the core is internally tested. the data serially scanned in is applied to the core, and the resulting outputs are captured in the output cells and scanned out. extest mode data is scanned onto the core outputs and applied to the external system. system input data is captured in the input cells and then shifted out. note the scan cells are not fully jtag-compliant because they do not have an update stage. therefore, while data is being moved around the scan chain, the contents of the scan cell are not isolated from the output. therefore the output from the scan cell to the core or to the external system can change on every scan clock. this does not affect arm7tdm because its internal state does not change until it is clocked. however, the rest of the system has to be aware that every output can change asynchronously as data is moved around the scan chain. external logic must ensure that this does not harm the rest of the system. 7.7.6 scan chain 0 scan chain 0 is intended primarily for inter-device testing (extest), and testing the core (intest). scan chain 0 is selected using the scan_n instruction. serial testing the core intest allows serial testing of the core. the tap controller must be placed in intest mode after scan chain 0 has been selected: during capture-dr, the current outputs from the core logic are captured in the output cells. during shift-dr, this captured data is shifted out while a new serial test pattern is scanned in, applying known stimuli to the inputs. during run-test-idle, the core is clocked. the tap controller must only spend one cycle in run-test-idle.
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-21 the whole operation can then be repeated. see arm7tdm core clocks on page 7-23 for details of the core clocks during test and debug. inter-device testing extest allows inter-device testing. this is useful for verifying the connections between devices on a circuit board. the tap controller must be placed in extest mode after scan chain 0 has been selected: during capture-dr, the current inputs to the core logic from the system are captured in the input cells. during shift-dr, this captured data is shifted out while a new serial test pattern is scanned in, applying known values on the core outputs. during update-dr, the value shifted into the data bus d[31:0] scan cells appears on the outputs. for all other outputs, the value appears as the data is shifted round. note during run-test/idle, the core is not clocked. the operation can then be repeated. the ordering of signals on scan chain 0 is listed in table 7-3 on page 7-37. 7.7.7 scan chain 1 the primary use for scan chain 1 is for debugging, although it can be used for extest on the data bus. scan chain 1 is selected using the scan_n tap controller instruction. debugging is similar to intest, and the procedure described above for scan chain 0 must be followed. scan chain length and purpose this scan chain is 33 bits long.32 bits are for the data value, plus an additional bit for the scan cell on the breakpoint core input. this 33rd bit serves four purposes: 1. under normal intest test conditions, it allows a known value to be scanned into the breakpoint input. 2. during extest test conditions, the value applied to the breakpoint input from the system can be captured.
debug interface 7-22 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 3. while debugging, the value placed in the 33rd bit determines whether arm7tdm synchronizes back to system speed before executing the instruction. see system-speed access on page 7-32 for more information. 4. after arm7tdm has entered debug state, the first time this bit is captured and scanned out, its value tells the debugger whether the core entered debug state is due to a breakpoint (bit 33 low), or a watchpoint (bit 33 high). 7.7.8 scan chain 2 this scan chain allows you to access the embeddedice logic registers. the scan chain is 38 bits in length. the order of the scan chain from xtdi to xtdo is: read/write register address bits 4 to 0 data value bits 31 to 0 see figure 8-2 on page 8-5 for more information. to access this serial register, scan chain 2 must first be selected using the scan_n tap controller instruction. the tap controller must then be place in intest mode: no action is taken during capture-dr. during shift-dr, a data value is shifted into the serial register. bits 32 to 36 specify the address of the embeddedice logic register to be accessed. during update-dr, this register is either read or written depending on the value of bit 37 (0 = read). refer to chapter 8 embeddedice logic for further details. 7.7.9 scan chain 15 this scan chain allows access to the system control coprocessor registers. scan chain 15 is selected using the scan_n tap controller instruction. this scan chain is 33 bits long. 32 bits are for the data or instruction value plus an additional bit that identifies the value as instruction (1) or data (0). this scan chain must only be used during intest. the order of the scan chain from xtdi to xtdo is: cpdata [0:31] instruction or data flag.
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-23 7.8 arm7tdm core clocks arm7tdm has two clocks: the memory clock, mclk , generated by the ARM720T an internally xtck -generated clock, dclk . during normal operation, the core is clocked by mclk , and internal logic holds dclk low. there are two cases in which the clocks switch: during debugging during testing. 7.8.1 clock switch during debug when arm7tdm is in the debug state, the core is clocked by dclk under the control of the tap state machine, and mclk can free run. the selected clock is output on the signal eclk for use by the external system. note when the cpu core is being debugged and is running from dclk , nwait has no effect.
debug interface 7-24 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a when arm7tdm enters debug state, it must switch from mclk to dclk . this is handled automatically by logic in the arm7tdm. on entry to debug state, arm7tdm asserts dbgack in the high phase of mclk . the switch between the two clocks occurs on the next falling edge of mclk . this is shown in figure 7-6. figure 7-6 clock switching on entry to debug state arm7tdm is forced to use dclk as the primary clock until debugging is complete. on exit from debug, the core must be allowed to synchronize back to mclk . this must be done in the following sequence: 1. the final instruction of the debug sequence must be shifted into the data bus scan chain and clocked in by asserting dclk . 2. at this point, bypass must be clocked into the tap instruction register. 3. arm7tdm now automatically resynchronizes back to mclk and starts fetching instructions from memory at mclk speed. see exit from debug state on page 7-28 for more information. mclk dbgack dclk eclk m u ltiple xo r sw itc h ing po int
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-25 7.9 determining the core and system state when arm7tdm is in debug state, you can examine the core and system state. this is done by forcing load and store multiples into the instruction pipeline. 7.9.1 determining arm or thumb state before the core and system state can be examined, the debugger must first determine whether the processor was in thumb or arm state when it entered debug. you can achieve this by examining bit 4 of the embeddedice logic debug status register. if this is high, the core was in thumb state when it entered debug. 7.9.2 determining the state of the core if the processor has entered debug state from thumb state, the simplest course of action is for the debugger to force the core back into arm state. once this is done, the debugger can always execute the same sequence of instructions to determine the processor state. while in debug state, only the following instructions can legally be scanned into the instruction pipeline for execution: all data-processing instructions, except teqp all load, store, load multiple, and store multiple instructions msr and mrs. moving to arm state to force the processor into arm state, the following sequence of thumb instructions must be executed on the core: str r0, [r0] ; save r0 before use mov r0, pc ; copy pc into r0 str r0, [r0] ; now save the pc in r0 bx pc ; jump into arm state mov r8, r8 ; nop mov r8, r8; nop as all thumb instructions are only 16 bits long, the simplest method when shifting them into scan chain 1 is to repeat the instruction twice. for example, the encoding for bx r0 is 0x4700 . therefore, if 0x47004700 is shifted into scan chain 1, the debugger does not have to keep track of which half of the bus the processor expects to read the data from.
debug interface 7-26 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a from this point on, the processor state can be determined by the sequences of arm instructions described in arm state . in arm state once the processor is in arm state, the first instruction executed is typically: stm r0, {r0-r15} this makes the contents of the registers visible on the data bus. these values can then be sampled and shifted out. note the use of r0 as the base register for stm is for illustration only. any register can be used. accessing banked registers after determining the values in the current bank of registers, you might want to access the banked registers. this can only be done by changing mode. usually, a mode change can only occur if the core is already in a privileged mode. however, while in debug state, a mode change from any mode into any other mode can occur. note the debugger must restore the original mode before exiting debug state. for example, assume that the debugger is asked to return the state of the user and fiq mode registers, and debug state was entered in supervisor mode. the instruction sequence might be as listed below: stm r0, {r0-r15} save current registers mrs r0, cpsr str r0, r0; save cpsr to determine current mode bic r0, 0x1f; clear mode bits orr r0, 0x10; select user mode msr cpsr, r0; enter user mode stm r0, {r13,r14}; save register not previously visible orr r0, 0x01; select fiq mode msr cpsr, r0; enter fiq mode stm r0, {r8-r14}; save banked fiq registers
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-27 all these instructions are said to execute at debug speed . debug speed is much slower than system speed because between each core clock, 33 scan clocks occur to shift in an instruction, or shift out data. executing instructions more slowly than usual is acceptable for accessing the core state because arm7tdm is fully static. however, this same method cannot be used for determining the state of the rest of the system. 7.9.3 determining system state to meet the dynamic timing requirements of the memory system, any attempt to access system state must occur synchronously with it. therefore, arm7tdm must be forced to synchronize back to system speed. this is controlled by the 33rd bit of scan chain 1. you can place any instruction in scan chain 1 with bit 33, the breakpt bit, low. this instruction is then executed at debug speed. to execute an instruction at system speed, the instruction prior to it must be scanned into scan chain 1 with bit 33 set high. after the system speed instruction has been scanned into the data bus and clocked into the pipeline, the bypass instruction must be loaded into the tap controller. this makes the arm7tdm automatically synchronize back to mclk, the system clock, executes the instruction at system speed, and then re-enters debug state and switches itself back to the internally generated dclk . when the instruction has completed, dbgack is high and the core switches back to dclk . at this point, intest can be selected in the tap controller, and debugging can resume. to determine that a system speed instruction has completed, the debugger must look at both dbgack and nmreq . in order to access memory, arm7tdm drives nmreq low after it has synchronized back to system speed. this transition is used by the memory controller to arbitrate whether arm7tdm can have the bus in the next cycle. if the bus is not available, arm7tdm can have its clock stalled indefinitely. therefore, the only way to tell that the memory access has completed, is to examine the state of both nmreq and dbgack . when both are high, the access has completed. the debugger normally uses embeddedice logic to control debugging, and by reading the embeddedice logic status register, the state of nmreq and dbgack can be determined. refer to chapter 8 embeddedice logic for more details. using system speed load multiples and debug speed store multiples, the system memory state can be fed back to the debug host. restrictions there are restrictions on which instructions can have the 33rd bit set. the only valid instructions where this bit can be set are: loads stores
debug interface 7-28 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a load multiple store multiple. see also exit from debug state . when arm7tdm returns to debug state after a system speed access, bit 33 of scan chain 1 is set high. this gives the debugger information about why the core entered debug state the first time this scan chain is read. 7.9.4 determining system control coprocessor state to access the system control coprocessor registers, debug state must be entered by a breakpoint, watchpoint, or debug request. this ensures that the arm7tdm core stops execution of code that might be dependent on the system control coprocessor. scan chain 15 can then be selected using the scan_n instruction. instructions can then be scanned down the scan chain as if being executed from the arm7tdm core. as the arm7tdm is idle while scan chain 15 is being accessed, you must provide the register data using the scan chain. the instruction prior to the data must have the instruction or data flag cleared. the data operation requires an additional clock from the tap controller. this can be achieved by remaining in the run-test-idle state for an additional xtck cycle. 7.9.5 exit from debug state leaving debug state involves: 1. restoring arm7tdm internal state. 2. branching to the next instruction to be executed. 3. synchronizing back to mclk . after restoring internal state, a branch instruction must be loaded into the pipeline. see the pc during debug on page 7-30 for details on calculating the branch. bit 33 of scan chain 1 is used to force arm7tdm to resynchronize back to mclk . the penultimate instruction of the debug sequence is scanned in with bit 33 set high. the final instruction of the debug sequence is the branch, and this is scanned in with bit 33 low. the core is then clocked to load the branch into the pipeline. now, the restart instruction is selected in the tap controller. when the state machine enters the run-test-idle state, the scan chain reverts back to system mode and clock resynchronization to mclk occurs within arm7tdm. arm7tdm then resumes normal operation, fetching instructions from memory. this
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-29 delay, until the state machine is in the run-test-idle state, allows conditions to be set up in other devices in a multiprocessor system without taking immediate effect. then, when the run-test-idle state is entered, all the processors resume operation simultaneously.
debug interface 7-30 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 7.10 the pc during debug the debugger must keep track of what happens to the pc so that arm7tdm can be forced to branch back to the place at which program flow was interrupted by debug. there are five cases when this occurs: entry to the debug state from a breakpoint advances the pc by four addresses, or 16 bytes. each instruction executed in debug state advances the pc by one address, or four bytes. the normal way to exit from debug state after a breakpoint is to remove the breakpoint, and branch back to the previously breakpointed address. returning to program execution after entering debug state from a watchpoint is done in the same way as the procedure described above. debug entry adds four addresses to the pc, and every instruction adds one address. the difference is that because the instruction that caused the watchpoint has executed, the program returns to the next instruction. on page 7-31 watchpoint with another exception on page 7-31 debug request on page 7-32 system-speed access on page 7-32. a summary of the method used to determine the return address is provided in summary of return address calculations on page 7-33. 7.10.1 breakpoint entry to the debug state from a breakpoint advances the pc by four addresses, or 16 bytes. each instruction executed in debug state advances the pc by one address, or four bytes. the normal way to exit from debug state after a breakpoint is to remove the breakpoint, and branch back to the previously breakpointed address. for example, if arm7tdm entered debug state from a breakpoint set on a given address and two debug-speed instructions were executed, a branch of minus seven addresses must occur. four are for debug entry, plus two for the instructions, plus one for the final branch. the following sequence shows the data scanned into scan chain 1. this is most significant bit (msb) first, and so the first digit is the value placed in the breakpt bit, followed by the instruction data: 0 e0802000; add r2, r0, r0 1 e1826001; orr r6, r2, r1 0 eafffff9; b -7 (2s complement)
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-31 once in debug state, a minimum of two instructions must be executed before the branch, although these can both be nops, for example: mov r0, r0 for small branches, the final branch can be replaced by a subtract with the pc as the destination: sub pc, pc, #28 7.10.2 watchpoint returning to program execution after entering debug state from a watchpoint is done in the same way as the procedure described above. debug entry adds four addresses to the pc, and every instruction adds one address. the difference is that because the instruction that caused the watchpoint has executed, the program returns to the next instruction. 7.10.3 watchpoint with another exception if a watchpointed access simultaneously causes a data abort, arm7tdm enters debug state in abort mode. entry into debug is held off until the core has changed into abort mode, and fetched the instruction from the abort vector. a similar sequence is followed when an interrupt, or any other exception, occurs during a watchpointed memory access. arm7tdm enters debug state in the exception mode, and so the debugger must check to see whether this happened. the debugger can deduce whether an exception occurred by looking at the current and previous mode, in the cpsr and spsr, and the value of the pc. if an exception does take place, you must give the user the choice of whether to service the exception before debugging. exiting from debug state exiting debug state if an exception occurred is slightly different from the other cases. here, entry to debug state causes the pc to be incremented by three addresses rather than four, and this must be taken into account in the return branch calculation. for example, suppose that an abort occurred on a watchpointed access and ten instructions had been executed to determine this. the following sequence can be used to return to program execution: 0 e1a00000; mov r0, r0 1 e1a00000; mov r0, r0 0 eafffff0; b -16
debug interface 7-32 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a this forces a branch back to the abort vector, causing the instruction at that location to be refetched and executed. note after the abort service routine, the instruction that caused the abort and watchpoint is re-executed. this generates the watchpoint and arm7tdm enters debug state again. 7.10.4 debug request entry into debug state through a debug request is similar to a breakpoint. however, unlike a breakpoint, the last instruction has completed execution and so must not be refetched on exit from debug state. therefore, entry to debug state adds three addresses to the pc, and every instruction executed in debug state adds one. for example, suppose that you invoke a debug request, and decide to return to program execution straight away. the following sequence can be used: 0 e1a00000; mov r0, r0 1 e1a00000; mov r0, r0 0 eafffffa; b -6 this restores the pc, and restarts the program from the next instruction. 7.10.5 system-speed access if a system-speed access is performed during debug state, the value of the pc is increased by three addresses. as system-speed instructions access the memory system, aborts can take place. if an abort occurs during a system-speed memory access, arm7tdm enters abort mode before returning to debug state. this is similar to an aborted watchpoint except that the problem is much harder to fix, because the abort was not caused by an instruction in the main program, and the pc does not point to the instruction that caused the abort. an abort handler usually looks at the pc to determine the instruction which caused the abort, and therefore the abort address. in this case, the value of the pc is invalid, but the debugger must know what location was being accessed. therefore, the debugger can be written to help the abort handler fix the memory system.
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-33 7.10.6 summary of return address calculations the calculation of the branch return address can be summarized as follows: for normal breakpoint and watchpoint, the branch is: (4 + n + 3s) for entry through debug request ( dbgrq ), or watchpoint with exception, the branch is: (3 + n + 3s) where: n is the number of debug speed instructions executed, including the final branch s is the number of system speed instructions executed.
debug interface 7-34 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 7.11 priorities and exceptions because the normal program flow is broken when a breakpoint or a debug request occurs, debug can be considered as being another type of exception. some of the interaction with other exceptions is been described in entering debug state on page 7-7 and the pc during debug on page 7-30. this section summarizes these priorities. 7.11.1 breakpoint with prefetch abort when a breakpointed instruction fetch causes a prefetch abort, the abort is taken and the breakpoint is disregarded. usually, prefetch aborts occur when, for example, an access is made to a virtual address that does not physically exist, and the returned data is therefore invalid. in this case, the normal action of the operating system is to swap in the page of memory and return to the previously invalid address. here, when the instruction is fetched, and providing the breakpoint is activated (it might be data-dependent), arm7tdm enters debug state. in this case, the prefetch abort takes higher priority than the breakpoint. 7.11.2 interrupt when arm7tdm enters debug state, interrupts are automatically disabled. if interrupts are disabled during debug, arm7tdm is never forced into an interrupt mode. interrupts only have this effect on watchpointed accesses. they are ignored at all times on breakpoints. if an interrupt is pending during the instruction prior to entering debug state, arm7tdm enters debug state in the mode of the interrupt. so, on entry to debug state, the debugger cannot assume that arm7tdm is in the expected mode of the program. it must check the pc, the cpsr, and the spsr to fully determine the reason for the exception. debug takes higher priority than the interrupt, although arm7tdm remembers that an interrupt has occurred. 7.11.3 data aborts when a data abort occurs on a watchpointed access, arm7tdm enters debug state in abort mode. therefore, the watchpoint has higher priority than the abort although, as in the case of interrupt, arm7tdm remembers that the abort happened.
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-35 7.12 scan interface timing figure 7-7 and table 7-2 provide general scan timing information. figure 7-7 scan general timing t bsss t bssh t bsod t bsih t bsis t bscl t bsch t bsoh t bsdh t bsdd t bsdh t bsdd data in xtck xtms xtdi xtdo data out table 7-2 ARM720T scan interface timing symbol parameter t bscl xtck low period t bsch xtck high period t bsis xtdi , xtms setup to xtck r t bsih xtdi , xtms hold from xtck r t bsoh xtdo hold time from xtck f t bsod xtck f to xtdo valid
debug interface 7-36 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a figure 7-8 shows the t bsr (reset period timing) parameter. figure 7-8 reset period timing figure 7-9 shows the t bse parameter (output enable time) and t bsz (output disable time) when the highz tap instruction is loaded into the instruction register. figure 7-9 output enable and disable times due to highz tap instruction t bsss a i/o signal setup to xtck r t bssh a i/o signal hold from xtck r t bsdh data output hold time from xtck t bsdd xtck to data output valid t bsr reset period t bse output enable time t bsz output disable time a.for correct data latching, the i/o signals (from the core and pads) must be setup and held with respect to the rising edge of xtck in the capture-dr state of the intest and extest instructions contact your supplier for ac timing parameter values. table 7-2 ARM720T scan interface timing (continued) symbol parameter t bsr ntrst t bsz t bse xtck a[ ] d[ ]
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-37 figure 7-10 shows the t bse parameter (output enable time) and t bsz (output disable time) when data scanning. figure 7-10 output enable and disable times due to data scanning table 7-3 lists the signals and positions for scan chain 0. table 7-3 scan chain 0, signals and positions number signal type 1 d[0] input/output 2 d[1] input/output 3 d[2] input/output 4 d[3] input/output 5 d[4] input/output 6 d[5] input/output 7 d[6] input/output 8 d[7] input/output 9 d[8] input/output 10 d[9] input/output 11 d[10] input/output 12 d[11] input/output 13 d[12] input/output 14 d[13] input/output 15 d[14] input/output 16 d[15] input/output t bsz t bse xtck a[ ] d[ ]
debug interface 7-38 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 17 d[16] input/output 18 d[17] input/output 19 d[18] input/output 20 d[19] input/output 21 d[20] input/output 22 d[21] input/output 23 d[22] input/output 24 d[23] input/output 25 d[24] input/output 26 d[25] input/output 27 d[26] input/output 28 d[27] input/output 29 d[28] input/output 30 d[29] input/output 31 d[30] input/output 32 d[31] input/output 33 breakpt input 34 nenin input 35 nenout output 36 lock output 37 bigend input 38 dbe input 39 mas[0] output 40 mas[1] output 41 bl[0] input table 7-3 scan chain 0, signals and positions (continued) number signal type
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-39 42 bl[1] input 43 bl[2] input 44 bl[3] input 45 dctl a output 46 nrw output 47 dbgack output 48 cgendbgack output 49 nfiq input 50 nirq input 51 nreset input 52 isync input 53 dbgrq input 54 abort input 55 cpa input 56 nopc output 57 ifen input 58 ncpi output 59 nmreq output 60 seq output 61 ntrans output 62 cpb input 63 nm[4] output 64 nm[3] output 65 nm[2] output 66 nm[1] output table 7-3 scan chain 0, signals and positions (continued) number signal type
debug interface 7-40 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 67 nm[0] output 68 nexec output 69 ale input 70 abe input 71 ape input 72 tbit output 73 nwait input 74 a[31] output 75 a[30] output 76 a[29] output 77 a[28] output 78 a[27] output 79 a[26] output 80 a[25] output 81 a[24] output 82 a[23] output 83 a[22] output 84 a[21] output 85 a[20] output 86 a[19] output 87 a[18] output 88 a[17] output 89 a[16] output 90 a[15] output 91 a[14] output table 7-3 scan chain 0, signals and positions (continued) number signal type
debug interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 7-41 92 a[13] output 93 a[12] output 94 a[11] output 95 a[10] output 96 a[9] output 97 a[8] output 98 a[7] output 99 a[6] output 100 a[5] output 101 a[4] output 102 a[3] output 103 a[2] output 104 a[1] output 105 a[0] output a. dctl is not described in this datasheet. dctl is an output from the processor used to control the unidirectional data out latch, dout[31:0] . this signal is not visible from the periphery of arm7tdm. table 7-3 scan chain 0, signals and positions (continued) number signal type
debug interface 7-42 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 7.13 scan and debug signals used by the embedded trace logic the signals listed in table 7-4 exist on the ARM720T and are used to configure and control the etm. refer to the etm7 technical reference manual for more information on scan chain connection between the ARM720T core and etm7, and dbgrq connection. table 7-4 scan and debug signals used by the etm signal type dbgrq input xntrst input sdoutbs input xtck input xtdi input xtms input rangeout0 output rangeout1 output
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 8-1 chapter 8 embeddedice logic this chapter describes the ARM720T embeddedice logic. it contains the following sections. about embeddedice logic on page 8-2 the watchpoint registers on page 8-4 programming breakpoints on page 8-9 programming watchpoints on page 8-11 the debug control register on page 8-13 debug status register on page 8-15 coupling breakpoints and watchpoints on page 8-17 debug communications channel on page 8-19.
embeddedice logic 8-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 8.1 about embeddedice logic the arm7tdm embeddedice logic, referred to as embeddedice , provides integrated on-chip debug support for the arm7tdm core. in this chapter arm7tdm refers to the arm7tdmi core excluding the embeddedice logic. embeddedice is programmed in a serial fashion using the arm7tdm tap controller. it consists of two real-time watchpoint units, together with a control and status register. you can program one or both watchpoint units to halt the execution of instructions by the arm7tdm core using the breakpt signal. two independent registers, debug control and debug status, provide overall control of embeddedice operation. figure 8-1 shows the relationship between the core, embeddedice, and the tap controller. figure 8-1 arm7tdmi tap controller and embeddedice nopc arm7tdm dbgrqi a[31:0] d[31:0] nrw tbit mas[1:0] ntrans dbgacki breakpti ifen eclk nmreq embeddedice logic rangeout1 dbgack breakpoint rangeout0 extern0 dbgrq extern1 dbgen dbgrqi tap xtck xtms xtdi xtdo xntrst sdout control sdin
embeddedice logic arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 8-3 execution is halted when a match occurs between the values programmed into embeddedice and the values currently appearing on the address bus, data bus, and various control signals. any bit can be masked so that its value does not affect the comparison. note only those signals that are pertinent to embeddedice are shown. in the ARM720T, the embeddedice module is connected directly to the arm7tdm core and therefore functions on the virtual address of the processor after relocation by the fcse pid. either of the two real-time watchpoint units can be configured to be a watchpoint (monitoring data accesses) or a breakpoint (monitoring instruction fetches). you can make watchpoints and breakpoints data-dependent. 8.1.1 disabling embeddedice you can disable embeddedice by wiring the dbgen input low. when dbgen is low, breakpoint and dbgrq to the core are forced low, dbgack from the arm7tdm is also forced low, and the ifen input to the core is forced high, enabling interrupts to be detected by arm7tdm. when dbgen is low, embeddedice is also put into a low-power mode. 8.1.2 embeddedice timing the extern1 and extern0 inputs are sampled by embeddedice on the falling edge of eclk . therefore you must allow sufficient set-up and hold time for these signals.
embeddedice logic 8-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 8.2 the watchpoint registers the two watchpoint units, known as watchpoint 0 and watchpoint 1. each contain three pairs of registers: address value and address mask data value and data mask control value and control mask. each register is independently programmable and has its own address, as listed in table 8-1. table 8-1 function and mapping of embeddedice registers address width function 00000 3 debug control 00001 5 debug status 00100 6 debug comms control register 00101 32 debug comms data register 01000 32 watchpoint 0 address value 01001 32 watchpoint 0 address mask 01010 32 watchpoint 0 data value 01011 32 watchpoint 0 data mask 01100 9 watchpoint 0 control value 01101 8 watchpoint 0 control mask 10000 32 watchpoint 1address value 10001 32 watchpoint 1 address mask 10010 32 watchpoint 1 data value 10011 32 watchpoint 1 data mask 10100 9 watchpoint 1 control value 10101 8 watchpoint 1 control mask
embeddedice logic arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 8-5 8.2.1 programming and reading watchpoint registers a register is programmed by scanning data into the embeddedice scan chain using scan chain 2. the scan chain consists of a 38-bit shift register comprising: a 32-bit data field a 5-bit address field a read/write bit. this is shown in figure 8-2. figure 8-2 embeddedice block diagram read/write 0 4 31 0 data scan chain register address address decoder xtdi xtdo value mask comparator control d[31:0] a[31:0] + breakpoint condition watchpoint registers and comparators update 32
embeddedice logic 8-6 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a the data to be written is scanned into the 32-bit data field, the address of the register into the 5-bit address field, and a 1 into the read/write bit. a register is read by scanning its address into the address field and scanning a 0 into the read/write bit. the 32-bit data field is ignored. the register addresses are shown in table 8-1 on page 8-4. note a read or write takes place when the tap controller enters the update-dr state. 8.2.2 using the mask registers for each value register in a register pair, there is a mask register of the same format. setting a bit to 1 in the mask register has the effect of disregarding the corresponding bit in the value register in the comparison. for example, if a watchpoint is required on a particular memory location but the data value is irrelevant, you can program the data mask register to 0xffffffff, all bits set to 1, to make the entire data bus field ignored. note the mask is an xnor mask rather than a conventional and mask. when a mask bit is set to 1, the comparator for that bit position always matches, irrespective of the value register or the input value. setting the mask bit to 0 means that the comparator only matches if the input value matches the value programmed into the value register. 8.2.3 the control registers control value and control mask registers are mapped identically in the lower 8 bits. bit 8 of the control value register is the enable bit, which cannot be masked. the control value and mask format is shown in figure 8-3. figure 8-3 watchpoint control value and mask format the bits have the following functions: nrw compares against the not-read/write signal from the core in order to detect the direction of bus activity. nrw is 0 for a read cycle and 1 for a write cycle. enable chain range extern nopc ntrans mas[1] nrw mas[0] 8 6 7 5 3 4 2 0 1
embeddedice logic arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 8-7 mas[1:0] compares against the mas[1:0] signal from the core in order to detect the size of bus activity. the encoding is shown in table 8-2. nopc detects if the current cycle is an instruction fetch (nopc = 0) or a data access (nopc = 1). ntrans compares against the not-translate signal from the core in order to distinguish between user mode (ntrans = 0) and non-user mode (ntrans = 1) accesses. extern is an external input to embeddedice that allows the watchpoint to be dependent upon an external condition. the extern input for watchpoint 0 is labeled extern0 and the extern input for watchpoint 1 is labeled extern1. this is known as nuser on ARM720T and has an allocated output. chain can be connected to the chain output of another watchpoint in order to implement, for example, debugger requests of the form breakpoint on address yyy only when in process xxx . in the arm7tdm embeddedice, the chainout output of watchpoint 1 is connected to the chain input of watchpoint 0. the chainout output is derived from a latch. the address/control field comparator drives the write enable for the latch and the input to the latch is the value of the data field comparator. the chainout latch is cleared when the control value register is written or when xntrst is low. range can be connected to the range output of another watchpoint register. in the arm7tdm embeddedice, the rangeout output of watchpoint 1 is connected to the range input of watchpoint 0. this allows the two watchpoints to be coupled for detecting conditions that occur simultaneously, for example, in range-checking. table 8-2 mas[1:0] signal encoding bit 1bit 0data size 00byte 01halfword 10word 1 1 (reserved)
embeddedice logic 8-8 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a enable only exists in the value register and it cannot be masked. if a watchpoint match occurs, the breakpoint signal is asserted only when the enable bit is set. for each of the bits [8:0] in the control value register, there is a corresponding bit in the control mask register. this removes the dependency on particular signals.
embeddedice logic arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 8-9 8.3 programming breakpoints breakpoints can be classified as hardware breakpoints or software breakpoints: hardware these typically monitor the address value and can be set in any code, even in code that is in rom or code that is self-modifying. software these monitor a particular bit pattern being fetched from any address. therefore you can use one embeddedice watchpoint to support any number of software breakpoints. software breakpoints can usually only be set in ram because an instruction has to be replaced by the special bit pattern chosen to cause a software breakpoint. 8.3.1 hardware breakpoints to make a watchpoint unit cause hardware breakpoints on instruction fetches: 1. program its address value register with the address of the instruction to be breakpointed. 2. program the breakpoint bits for each state as follows: a. arm, set bits [1:0] of the address mask register to one. b. thumb, set bit 0 of the address mask to one. in both cases, the remaining bits are set to zero. 3. program the data value register only if you require a data-dependent breakpoint, that is, only if the actual instruction code fetched must be matched as well as the address. if the data value is not required, program the data mask register to 0xffffffff , all bits to one, otherwise program it to 0x00000000 . 4. program the control value register with nopc = zero. 5. program the control mask register with nopc = zero, all other bits to one. 6. if you have to make the distinction between user and non-user mode instruction fetches, program the ntrans value and mask bits as above. 7. if required, program the extern , range , and chain bits in the same way. 8.3.2 software breakpoints to make a watchpoint unit cause software breakpoints, that is, on instruction fetches of a particular bit pattern:
embeddedice logic 8-10 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 1. program its address mask register to 0xffffffff , all bits set to one, so that the address is disregarded. 2. program the data value register with the particular bit pattern that has been chosen to represent a software breakpoint. 3. for a thumb software breakpoint, the 16-bit pattern must be repeated in both halves of the data value register. for example, if the bit pattern is 0xdfff , then 0xdfffdfff must be programmed. when a 16-bit instruction is fetched, embeddedice only compares the valid half of the data bus against the contents of the data value register. in this way, a single watchpoint register can be used to catch software breakpoints on both the upper and lower halves of the data bus. 4. program the data mask register to 0x00000000 . 5. program the control value register with nopc = zero. 6. program the control mask register with nopc = zero, all other bits to one. 7. if you have to make the distinction between user and non-user mode instruction fetches, program the ntrans bit in the control value and control mask registers accordingly. 8. if required, program the extern , range , and chain bits in the same way. note the address value register does not have to be programmed. setting the breakpoint to set the software breakpoint: 1. read the instruction at the desired address and store it. 2. write the special bit pattern representing a software breakpoint at the address. clearing the breakpoint to clear the software breakpoint, restore the instruction to the address.
embeddedice logic arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 8-11 8.4 programming watchpoints this section contains examples of how to program the watchpoint register to generate breakpoints and watchpoints. many other ways of programming the registers are possible. for instance, simple range breakpoints can be provided by setting one or more of the address mask bits. to make a watchpoint unit cause watchpoints, that is, on data accesses: 1. program its address value register with the address of the data access to be watchpointed. 2. program the address mask register to 0x00000000 . 3. program the data value register only if you require a data-dependent watchpoint, that is, only if the actual data value read or written must be matched as well as the address. if the data value is irrelevant, program the data mask register to 0xffffffff (all bits set to one) otherwise program it to 0x00000000 . 4. program the control value register with: a. nopc = one. b. nrw = zero for a read. c. nrw = one for a write. d. mas[1:0] with the value corresponding to the appropriate data size. 5. program the control mask register with: a. nopc = zero. b. nrw = zero. c. mas[1:0] = zero. d. all other bits to zero. note nrw or mas[1:0] can be set to one if both reads and writes or data size accesses are to be watchpointed respectively. 6. if you have to make the distinction between user and non-user mode data accesses, program the ntrans bit in the control value and control mask registers accordingly. 7. if required, program the extern , range , and chain bits in the same way.
embeddedice logic 8-12 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 8.4.1 programming restriction the embeddedice watchpoint units must only be programmed when the clock to the core is stopped. you can achieve this by putting the core into the debug state. the reason for this restriction is that if the core continues to run at eclk rates when embeddedice is being programmed at xtck rates, it is possible for the breakpoint signal to be asserted asynchronously to the core. this restriction does not apply if mclk and xtck are driven from the same clock, or if it is known that the breakpoint or watchpoint condition can only occur some time after embeddedice has been programmed. note this restriction does not apply to the debug control or status registers.
embeddedice logic arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 8-13 8.5 the debug control register the debug control register is 3 bits wide. if the register is accessed for a write, with the read/write bit high, the control bits are written. if the register is accessed for a read, with the read/write bit low, the control bits are read. the functions of the register bits are shown in figure 8-4 and described as follows: dbgrq dbgack intdis on page 8-14. figure 8-4 debug control register format bits 1 and 0 allow you to force the values on dbgrq and dbgack . 8.5.1 dbgrq as shown in figure 8-6 on page 8-16, the value stored in bit 1 of the control register is synchronized and then ored with the external dbgrq before being applied to the processor. the output of this or gate is the signal dbgrqi which is brought out externally from the macrocell. the synchronization between control bit 1 and dbgrqi assists in multiprocessor environments. the synchronization latch only opens when the tap controller state machine is in the run-test-idle state. this allows an enter debug condition to be set up in all the processors in the system while they are still running. once the condition is set up in all the processors, you can then applied it to them simultaneously by entering the run-test-idle state. 8.5.2 dbgack in the case of dbgack , the value of dbgack from the core is ored with the value held in bit 0 to generate the external value of dbgack seen at the periphery of arm7tdm. this allows the debug system to signal to the rest of the system that the core is still being debugged even when system-speed accesses are being performed. the internal dbgack signal from the core is low. intdis dbgrq dbgack 2 1 0
embeddedice logic 8-14 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 8.5.3 intdis if bit 2, intdis , is asserted, the interrupt enable signal, ifen , of the core is forced low. therefore all interrupts (irq and fiq) are disabled during debugging ( dbgack =1) or if the intdis bit is asserted. the ifen signal is driven as listed in table 8-3. table 8-3 ifen signal control dbgack intdis ifen 001 1x0 x10
embeddedice logic arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 8-15 8.6 debug status register the debug status register is 5 bits wide: if it is accessed for a write, with the read/write bit set high, the status bits are written if it is accessed for a read, with the read/write bit low, the status bits are read. the debug status register is shown in figure 8-5:. figure 8-5 debug status register format the function of each bit in this register is as follows: bits 1 and 0 allow the values on the synchronized versions of dbgrq and dbgack to be read. bit 2 allows the state of the core interrupt enable signal, ifen, to be read. as the capture clock for the scan chain can be asynchronous to the processor clock, the dbgack output from the core is synchronized before being used to generate the ifen status bit. bit 3 allows the state of the nmreq signal from the core, synchronized to xtck to be read. this allows the debugger to determine that a memory access from the debug state has completed. bit 4 allows tbit to be read. this enables the debugger to determine what state the processor is in, and which instructions to execute. the structure of the debug status register is shown in figure 8-6 on page 8-16. 4 tbit 3 nmreq 2 ifen 1 dbgrq 0 dbgack
embeddedice logic 8-16 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a figure 8-6 debug control and status register structure bit 4 bit 3 bit 2 bit 1 bit 0 bit 0 + + + + bit 2 bit 1 debug control register debug status register tbit (from core) nmreq (from core) dbgack (from core) ifen (to core) dbgrq (from arm7tdmi input) dbgack (from core) dbgack (to arm7tdmi output) dbgrqi (to core and arm7tdmi output) synch synch synch synch synch
embeddedice logic arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 8-17 8.7 coupling breakpoints and watchpoints you can couple watchpoint units 1 and 0 together using the chain and range inputs: chain enables watchpoint 0 to be triggered only if watchpoint 1 has previously matched range enables simple range checking to be performed by combining the outputs of both watchpoints. example 8-1 coupling breakpoints and watchpoints let: av[31:0] be the value in the address value register. am[31:0] be the value in the address mask register. a[31:0] be the address bus from the arm7tdm. dv[31:0] be the value in the data value register. dm[31:0] be the value in the data mask register. d[31:0] be the data bus from the arm7tdm. cv[8:0] be the value in the control value register. cm[7:0] be the value in the control mask register. c[9:0] be the combined control bus from the arm7tdm, other watchpoint registers and the extern signal. 8.7.1 chainout the chainout signal is then derived as follows: when (({av[31:0],cv[4:0]} xnor {a[31:0],c[4:0]}) or {am[31:0],cm[4:0]} == 0x1fffffffff) chainout = ((({dv[31:0],cv[7:5]} xnor {d[31:0],c[7:5]}) or {dm[31:0],cm[7:5]}) == 0x7ffffffff) the chainout output of watchpoint register 1 provides the chain input to watchpoint 0. this allows for quite complicated configurations of breakpoints and watchpoints. for example, consider the request by a debugger to breakpoint on the instruction at location yyy when running process xxx in a multiprocess system.
embeddedice logic 8-18 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a if the current process id is stored in memory, you can implement the above function with a watchpoint and breakpoint chained together. the watchpoint address is set to a known memory location containing the current process id. the watchpoint data is set to the required process id and the enable bit is set to off . the address comparator output of the watchpoint drives the write enable for the chainout latch, the input to the latch being the output of the data comparator from the same watchpoint. the output of the latch drives the chain input of the breakpoint comparator. the address yyy is stored in the breakpoint register and when the chain input is asserted, and the breakpoint address matches, the breakpoint triggers correctly. 8.7.2 rangeout the rangeout signal is then derived as follows: rangeout = ((({av[31:0],cv[4:0]} xnor {a[31:0],c[4:0]}) or {am[31:0],cm[4:0]}) == 0xfffffffff) and ((({dv[31:0],cv[7:5]} xnor {d[31:0],c[7:5]}) or {dm[31:0],cm[7:5]}) == 0x7ffffffff) the rangeout output of watchpoint register 1 provides the range input to watchpoint register 0. this allows you to couple two breakpoints together to form range breakpoints. note selectable ranges are restricted to being powers of 2. if a breakpoint is to occur when the address is in the first 256 bytes of memory, but not in the first 32 bytes, the watchpoint registers must be programmed as follows: 1. watchpoint 1 is programmed with an address value of 0x00000000 and an address mask of 0x0000001f . the enable bit is cleared. all other watchpoint 1 registers are programmed as normal for a breakpoint. an address within the first 32 bytes causes the range output to go high but the breakpoint is not triggered. 2. watchpoint 0 is programmed with an address value of 0x00000000 and an address mask of 0x000000ff . the enable bit is set and the range bit programmed to match a 0. all other watchpoint 0 registers are programmed as normal for a breakpoint. if watchpoint 0 matches but watchpoint 1 does not (that is, the range input to watchpoint 0 is 0), the breakpoint is triggered.
embeddedice logic arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 8-19 8.8 debug communications channel the arm7tdm embeddedice contains a communication channel for passing information between the target and the host debugger. this is implemented as coprocessor 14. the communications channel consists of: a 32-bit wide comms data read register a 32-bit wide comms data write register a 6-bit wide comms control register for synchronized handshaking between the processor and the asynchronous debugger. these registers live in fixed locations in the embeddedice memory map (as shown in table 8-1 on page 8-4) and are accessed from the processor using mcr and mrc instructions to coprocessor 14. 8.8.1 debug communications channel registers the debug comms control register is read-only and allows synchronized handshaking between the processor and the debugger. the register format is shown in figure 8-7. figure 8-7 debug comms control register the function of each register bit is: bits [31:28] contain a fixed pattern that denotes the embeddedice version number, in this case 0001. bit [1] denotes whether the comms data write register is free from the processor point of view. from the processor point of view: if the comms data write register is free (w=0), new data can be written. if it is not free (w=1), the processor must poll until w=0. from the debugger point of view, if w=1 then new data has been written which can then be scanned out. bit [0] denotes if there is some new data in the comms data read register. 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 0 r w 1 0 0
embeddedice logic 8-20 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a from the processor point of view: if r=1, there is some new data which can be read using an mrc instruction. from the debugger point of view: if r=0, the comms data read register is free and new data can be placed there through the scan chain. if r=1, this denotes that data previously placed there through the scan chain has not been collected by the processor and so the debugger must wait. from the debugger point of view, the registers are accessed using the scan chain in the usual way. from the processors point of view, these registers are accessed using coprocessor register transfer instructions. instructions the following instructions must be used: this instruction returns the debug comms control register into rd: mrc cp14, 0, rd, c0, c0 this instruction writes the value in rn to the comms data write register: mcr cp14, 0, rn, c1, c0 this instruction returns the debug data read register into rd: mrc cp14, 0, rd, c1, c0 note as the thumb instruction set does not contain coprocessor instructions, it is recommended that these are accessed using swi instructions when in thumb state. 8.8.2 communications using the comms channel communication between the debugger and the processor occurs as follows:
embeddedice logic arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 8-21 1. when the processor wishes to send a message to embeddedice, it first checks that the comms data write register is free for use. this is done by reading the debug comms control register to check that the w bit is clear: a. if it is clear, the comms data write register is empty and a message is written by a register transfer to the coprocessor. the action of this data transfer automatically sets the w bit. b. if it is set, this implies that previously-written data has not been picked up by the debugger and the processor must poll until the w bit is clear. 2. because the data transfer occurs from the processor to the comms data write register, the w bit is set in the debug comms control register. 3. when the debugger polls this register, it sees a synchronized version of both the r and w bit: a. when the debugger sees that the w bit is set, it can read the comms data write register and scan the data out. b. the action of reading this data register clears the w bit of the debug comms control register. at this point, the communications process will begin again. 8.8.3 message transfer message transfer from the debugger to the processor is carried out in a similar fashion to communications using the comms channel on page 8-20: 1. the debugger polls the r bit of the debug comms control register: a. if the r bit is low, the data read register is free and so data can be placed there for the processor to read. b. if the r bit is set, previously deposited data has not yet been collected and so the debugger must wait. 2. when the comms data read register is free, data is written there using the scan chain. the action of this write sets the r bit in the debug comms control register. 3. when the processor polls this register, it sees an mclk synchronized version: a. if the r bit is set, this denotes that there is data waiting to be collected, and this can be read using a cprt load. the action of this load clears the r bit in the debug comms control register. b. if the r bit is clear, this denotes that the data has been taken and the process can now be repeated.
embeddedice logic 8-22 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 9-1 chapter 9 bus clocking this chapter describes the bus interface clocking. it contains the following sections: about the ARM720T bus interface on page 9-2 fastbus extension on page 9-3 standard mode on page 9-5.
bus clocking 9-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 9.1 about the ARM720T bus interface the ARM720T bus interface can be operated using either: the standard mode of operation the new fastbus extension. as the ARM720T is a fully static design, you can stop the clock indefinitely in either mode of operation. note take care to ensure that the memory system does not dissipate power in the state in which it is stopped. 9.1.1 standard mode for designs using low-cost, low-speed memory, and if operation of the core at a faster speed is required, it is recommended that you use standard mode. this mode consists of: two clocks, fclk and bclk synchronous or fully asynchronous operation. 9.1.2 fastbus extension for new designs, you can operate the device using the fastbus extension. in fastbus mode, the device is clocked off a single clock, and the bus is operated at the same frequency as the core. this allows the bus interface to be clocked faster than if the device is operated in standard mode. it is recommended that you use this mode of operation in systems with high-speed memory and a single clock. this mode consists of: single device clock increased maximum bclk frequency.
bus clocking arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 9-3 9.2 fastbus extension using the fastbus extension, the ARM720T has a single input clock, bclk . this clocks the internals of the device, and qualified by bwait, controls the memory interface as shown in figure 9-1. figure 9-1 conceptual device clocking using the fastbus extension when operating the device with xfastbus high, the inputs fclk and xsna are not used. note to prevent unwanted power dissipation, ensure that they do not float to an undefined level. new designs must tie these signals low for compatibility with future products. 9.2.1 using bwait the bwait signal inserts entire bclk cycles into the bus cycle timing. bwait can only change when bclk is low, and extends the memory access by inserting bclk cycles into the access while bwait is asserted. figure 10-4 on page 10-11 shows the use of bwait in more detail. cpu cache bus interface bclk bwait
bus clocking 9-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a memory cycles it is preferable to use bwait to extend memory cycles, rather than stretching bclk externally to the device because it is possible for the core to be accessing the cache while bus activity is occurring. this allows the maximum performance, as the core can continue execution in parallel with the memory bus activity. all bclk cycles are available to the cpu and cache, regardless of the state of bwait . in some circumstances, it is desirable to stretch bclk phases to match memory timing that is not an integer multiple of bclk . there are certain cases where this results in a higher performance than using bwait to extend the access by an integer number of cycles. cpu and cache operation cpu and cache operation can only continue in parallel with buffered writes to the external bus. for all read accesses, the cpu is stalled until the bus activity has completed. so, if read accesses can be achieved faster by stretching bclk rather than using bwait, this results in improved performance. an example of where this can be useful is to interface to a rom which has a cycle time of 2.5 times the bclk period.
bus clocking arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 9-5 9.3 standard mode using the standard mode of operation, without the fastbus extension, and xfastbus tied low, the ARM720T has two input clocks: ?fclk bclk . the bus interface is always controlled by the memory clock, bclk , qualified by bwait . however, the core and cache are clocked by the fast clock, fclk . in standard mode, the fclk frequency must be greater than or equal to the bclk frequency at all times. this relationship must be maintained on a cycle-by-cycle basis. 9.3.1 memory access when running in this mode, you can stretch memory access cycles by: using bwait by stretching phases of bclk . the resulting performance is determined by the access time, regardless of which method is used. this is shown in figure 9-2. figure 9-2 conceptual device clocking in standard mode cpu cache bus interface bclk bwait fclk
bus clocking 9-6 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 9.3.2 synchronous and asynchronous modes when not using the fastbus extension, the ARM720T bus interface has two distinct modes of operation: synchronous asynchronous. these are selected by tying xsna either high or low. fclk and bclk the two modes differ in the relationship between fclk and bclk : in asynchronous mode ( xsna low), the clocks can be completely asynchronous and of unrelated frequency. in synchronous mode ( xsna high), bclk can only make transitions before the falling edge of fclk . in systems where a satisfactory relationship exists between fclk and bclk , synchronization penalties can be avoided by selecting the synchronous mode of operation. asynchronous mode in this mode, fclk and bclk can be completely asynchronous. you must select this mode by tying xsna low when the two clocks are of unrelated frequency. there is a synchronization penalty whenever the internal core clock switches between the two input clocks. this penalty is symmetrical, and varies between zero and a whole period of the clock to which the core is resynchronizing: when changing from fclk to bclk , the average resynchronization penalty is half a bclk period when changing from bclk to fclk , the average resynchronization penalty is half an fclk period.
bus clocking arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 9-7 synchronous mode you select this mode by tying xsna high. in this mode, there is a tightly defined relationship between fclk and bclk , in that bclk can only make transitions on the falling edge of fclk . some jitter between the two clocks is permitted, but bclk must meet the setup and hold requirements relative to fclk . this is shown in figure 9-3. figure 9-3 relationship of fclk and bclk in synchronous mode t fclkl t fclkh t fmh t fms fclk bclk
bus clocking 9-8 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 10-1 chapter 10 amba interface this chapter describes the operation of the amba bus interface. it contains the following sections: about the amba interface on page 10-2 asb bus interface signals on page 10-3 cycle types on page 10-4 addressing signals on page 10-7 memory request signals on page 10-8 data signal timing on page 10-9 slave response signals on page 10-10 maximum sequential length on page 10-12 read-lock-write on page 10-13 little-endian and big-endian operation on page 10-14 multi-master operation on page 10-17 bus master handover on page 10-19 default bus master on page 10-21.
amba interface 10-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 10.1 about the amba interface in normal operation, the ARM720T is an advanced system bus (asb) bus master. as a bus master it performs a subset of the possible asb cycle types. the asb is further described in the amba specification .
amba interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 10-3 10.2 asb bus interface signals the signals in the asb interface can be grouped into four categories: addressing ba[31:0] bwrite bsize[1:0] blok bprot[1:0] . memory request btran[1:0] . data sampled bd[31:0] . slave response berror bwait blast . in addition to the signals provided above, there are also three controls communicating with control logic in the system: agnt selects the arm as a bus master. areq indicates that the ARM720T requires bus mastership. dsel selects the arm as a bus slave.
amba interface 10-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 10.3 cycle types in normal operation, the ARM720T bus interface can perform two types of cycle: address cycles sequential cycles. these cycles are differentiated by the pipelined signal btran[1:0] . conventionally, cycles are considered to start from the falling edge of bclk , and this is how they are shown in all diagrams. these cycle types are a subset of the possible asb cycle types. other cycle types can be forced by the use of the slave response signals. see the amba specification for more details. the addressing and memory request signals are pipelined ahead of the data addressing by a phase, half a cycle, and btran[1:0] by one cycle. this advance information allows the implementation of efficient memory systems. 10.3.1 single-word memory access a simple single-word memory access is shown in figure 10-1. figure 10-1 simple single-cycle access the access starts with the address being broadcast. you can be use this for decoding, but the access is not committed until btran[1:0] , bus transaction type, signals a sequential cycle in the following high phase of bclk . this indicates that the next cycle is a memory access cycle. in this example, btran[1:0] returns to address after a single cycle, indicating that there is a single memory access cycle, followed by an address cycle. the data is transferred on the falling edge of bclk at the end of the sequential cycle. address address bclk ba[31:0] bwrite bsize[31:0] block bd[31:0] btran[1:0] seq address data idle cycle memory cycle idle cycle
amba interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 10-5 therefore, a memory access consists of: an address cycle, with a valid address a memory cycle with the same address. the initial address cycle allows the memory controller more time to decode the address. see table 10-1 on page 10-8 for the encoding of btran[1:0] . 10.3.2 sequential accesses ARM720T can perform sequential bursts of accesses. these consist of: an address cycle and a sequential cycle, as shown previously further sequential cycles to either: ? incrementing word addresses, that is, a, a+4, a+8 for example ? halfword addresses, that is, a, a+2, a+4 for example. figure 10-2 shows that after the initial address cycle, the address is pipelined by half a bus cycle from the data. note btran[1:0] is pipelined by a bus cycle from the data. if bwait is being used to stretch cycles, btran[1:0] no longer refers to the next bclk cycle, but rather to the next bus cycle. see bwait on page 10-10 for more information. figure 10-2 simple sequential access sequential bursts can occur on word or halfword accesses, and are always in the same direction, that is, read, bwrite low, or write, bwrite high. address address seq seq address address+4 data 1 data 2 bclk bd[31:0] ba[31:0] bwrite bsize[1:0] blok btran[1:0] idle cycle memory cycle memory cycle idle cycle
amba interface 10-6 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a a memory controller must always qualify the use of the address with btran[1:0] . there are circumstances in which a new address can be broadcast on the address bus, but btran[1:0] does not signal a sequential access. this only happens when an internal, protection unit generated, abort occurs. 10.3.3 bus accesses the minimum interval between bus accesses can occur after a buffered write. in this case, there might only be a single address cycle between two memory cycles to nonsequential addresses. this means that the address for the second access is broadcast on ba[31:0] during the high phase of the final memory cycle of the buffered write. this is shown in figure 10-3. figure 10-3 minimum interval between bus accesses this is the closest case of back-to-back cycles on the bus, and the memory controller must be designed to handle this case. in high-speed systems, one solution is to use bwait to increase the decode and access time available for the second access. note memory and peripheral strobes must not be direct decodes of the address bus. this can result in them changing during the last cycle of a write burst. address seq address write data idle cycle memory cycle idle cycle seq address 1 (buffered write) address 2 (read) memory cycle read data bclk ba[31:0] bwrite bsize[31:0] block bd[31:0] btran[1:0]
amba interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 10-7 10.4 addressing signals memory accesses can be read or write, and are differentiated by the signal bwrite . bwrite cannot change during a sequential access, so if a read from address a is followed immediately by a write to address (a+4), the write to address (a+4) is performed on the bus as a nonsequential access. in the same way, any memory access can be a word, a halfword, or a byte. these are differentiated by the signal bsize[1:0] . again, bsize[1:0] can not change during sequential accesses. it is not possible to perform sequential byte accesses. to reduce system power consumption, the addressing signals are left with their current values at the end of an access, until the next access occurs. after a buffered write, there might be only a single address cycle between the two memory cycles. in this case, the next nonsequential address is broadcast in the last cycle of the previous access. this is the worst case for address decoding, as shown in figure 10-3 on page 10-6.
amba interface 10-8 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 10.5 memory request signals the memory request signals, btran[1:0], are pipelined by one bus cycle, and refer to the next bus cycle. note you must take care when depipelining these signals if bwait is being used, as they always refer to the following bus cycle, rather than the following bclk cycle. bwait stretches the bus cycle by an integer number of bclk cycles. see bwait on page 10-10. table 10-1 lists btran[1:0] encoding table 10-1 btran[1:0] encoding btran[1:0] cycle type description remarks 00 address address transfer or idle cycle - 01 - reserved - 10 nonsequential nonsequential data transfer cycle this cycle can only occur as a result of the slave response signals. in normal operation, ARM720T does not generate this cycle type. 11 sequential sequential data transfer cycle -
amba interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 10-9 10.6 data signal timing during a read access, the data is sampled on the falling edge of bclk at the end of the sequential cycle. during a write access, the data on bd[31:0] is timed off the falling edge of bclk at the start of the memory cycle. if bwait is being used to stretch this cycle, the data is valid from the falling edge of bclk at the end of the previous cycle, when bwait was high. see bwait on page 10-10. note in a low-power system, you must ensure that the databus is not allowed to float to an undefined level. this causes power to be dissipated in the inputs of devices connected to the bus. this is particularly important when a system is put into a low-power sleep mode. it is recommended that one set of databus drivers in the system are left enabled during sleep to hold the bus at a defined level.
amba interface 10-10 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 10.7 slave response signals there are two main slave response signals: berror bwait other slave response combinations, including bus last and bus retract, are described in the amba specification . 10.7.1 berror the berror signal is sampled on the rising edge of bclk during a sequential cycle, on both read and write accesses. the effect of berror on the operation of the ARM720T is described in exceptions on page 2-16. berror can be flagged on any sequential cycle. however, it is ignored on buffered writes, which cannot be aborted. linefetches the effect of berror during linefetches is slightly different to that during other access. during a linefetch the ARM720T fetches four words of data, regardless of which words of data were requested by the arm core, and the rest of the words are fetched speculatively: if berror is asserted on a word that was requested by the arm core, the abort functions normally if the abort is signaled on a word that was not requested by the arm core, the access is not aborted, and program flow is not interrupted. regardless of which word was aborted, the line of data is not placed in the cache as it is assumed to contain invalid data. 10.7.2 bwait you can use the bwait pin to extend memory accesses in whole cycle increments. bwait is driven by the selected slave during the low phase of bclk . when a slave cannot complete an access in the current cycle, it drives bwait high to stall the ARM720T.
amba interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 10-11 bwait does not prevent changes in btran[1:0] and write data on bd[31:0] during the cycle in which it was asserted high. changes in these signals are then prevented until the bclk high phase after bwait was taken low. the addressing signals do not change from the rising bclk edge when bwait goes high, until the next bclk high phase after bwait returns low. in figure 10-4, the heavy bars indicate the cycle for which signals are stable as a result of asserting bwait . figure 10-4 use of the bwait pin to stop ARM720T for 1 bclk cycle the signal btran[1:0] is pipelined by one bus cycle. this pipelining must be taken into account when these signals are being decoded. the value of btran[1:0] indicates whether the next bus cycle is a data cycle or an address cycle. as bus cycles are stretched by bwait , the boundary between bus cycles is determined by the falling edge of bclk when bwait was sampled as low on the rising edge of bclk . a useful general rule is to sample the value of btran[1:0] on the falling edge of bclk only when bwait was low on the previous rising edge of bclk . when bwait is used to stretch a sequential cycle, btran[1:0] returns to signaling address during the first phase of the sequential cycle if a single word access is occurring. in this case, it is important that the memory controller does not interpret that an address cycle is signaled when it is a stretched memory cycle. address seq address address bclk bd[31:0] write btran[1:0] bwait ba[31:0] bwrite bsize[31:0] blok bd[31:0] read data idle cycle memory cycle idle cycle data
amba interface 10-12 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 10.8 maximum sequential length the ARM720T can perform sequential memory accesses whenever the cycle is of the same type as the previous cycle (for example, read/write), and the addresses are consecutive. however, sequential accesses are interrupted on a 256-word boundary. if a sequential access is performed over a 256-word boundary, the access to word 256 is turned into a nonsequential access, and further accesses continue sequentially as before. this simplifies the design of the memory controller. provided that peripherals and areas of memory are aligned to 256-word boundaries, sequential bursts are always local to one peripheral or memory device. this means that all accesses to a device always start with a nonsequential access. a dram controller can take advantage of the fact that sequential cycles are always within a dram page, provided the page size is greater than 256.
amba interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 10-13 10.9 read-lock-write the read-lock-write sequence is generated by a swp instruction. the blok signal indicates that the two accesses must be treated as an atomic unit. a memory controller must ensure that no other bus activity is allowed to happen between the accesses when blok is asserted. when the ARM720T has started a read-lock-write sequence, it cannot be interrupted until it has completed. on the bus, the sequence consists of: a read access a write access to the same address. this sequence is differentiated by the blok signal. blok : goes high in the high phase of bclk at the start of the read access always goes low at the end of the write access. the read cycle is always performed as a single, nonsequential, external read cycle, regardless of the contents of the cache. the write is forced to be unbuffered, so that it can be aborted if necessary. the cache is updated on the write.
amba interface 10-14 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 10.10 little-endian and big-endian operation the ARM720T treats words in memory as being stored in big-endian or little-endian format depending on the value of the bigend bit in the control register (see memory formats on page 2-3). load and store are the only instructions affected by the endianness. refer to the arm architecture reference manual for details of the ldr and str instructions. 10.10.1 little-endian format in little-endian format: the lowest-numbered byte in a word is considered to be the least significant the highest-numbered byte is the most significant. byte zero of the memory system must be connected to data lines seven to zero ( bd[7:0] ) in this format. little-endian format is shown in figure 10-5. figure 10-5 little-endian addresses of bytes within words 10.10.2 big-endian format in big-endian format: the most significant byte of a word is stored at the lowest-numbered byte the least significant byte is stored at the highest-numbered byte. byte zero of the memory system must therefore be connected to data lines 31 to 24 ( bd[31:24] ). higher address 8 4 0 31 24 23 word address 16 15 8 7 0 lower address least significant byte is at lowest address word is addressed by byte address of least significant byte 7 10 6 9 5 8 4 11 3 2 1 0
amba interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 10-15 big-endian format is shown in figure 10-6. figure 10-6 big-endian addresses of bytes within words 10.10.3 word operations all word operations expect the data to be presented on data bus inputs 31 to 0. the external memory system ignores the bottom two bits of the address if a word operation is indicated. 10.10.4 halfword operations a halfword store, strh repeats the bottom 16 bits of the source register twice across data bus outputs 31 to 0. the external memory system must activate the appropriate byte subsystems to store the data. little-endian operation a halfword load, ldrh , expects the data on data bus inputs 15 to 0 if the supplied address is on a word boundary, or on data bus inputs 31 to 16 if it is a word address plus two bytes. the selected halfword is placed in the bottom 16 bits of the destination register. the other two bytes on the databus are ignored (see figure 10-5 on page 10-14). big-endian operation a halfword load, ldrh , expects the data on data bus inputs 31 to 16 if the supplied address is on a word boundary, or on data bus inputs 15 to 0 if it is a word address plus two bytes. the selected halfword is placed in the bottom 16 bits of the destination register. the other two bytes on the databus are ignored, see figure 10-6 on page 10-15. higher address 8 4 0 31 24 23 word address 16 15 8 7 0 most significant byte is at lowest address word is addressed by byte address of most significant byte lower address 4 9 5 10 6 11 7 8 0 1 2 3
amba interface 10-16 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 10.10.5 byte operations a byte store, strb , repeats the bottom eight bits of the source register four times across data bus outputs 31 to 0. the external memory system activates the appropriate byte subsystem to store the data. because ARM720T duplicates the byte to be written across the databus and internally rotates bytes after reading them from the databus, a 32-bit memory system only requires to have control logic to enable the appropriate byte. you do not have to rotate or shift the data externally. to ensure that all of the databus is driven during a byte read, it is valid to read a word back from the memory. little-endian operation a byte load, ldrb , expects the data on data bus inputs seven to zero if the supplied address is on a word boundary, on data bus inputs 15 to 8 if it is a word address plus one byte, and so on. the selected byte is placed in the bottom eight bits of the destination register. the other three bytes on the databus are ignored (see figure 10-5 on page 10-14). big-endian operation a byte load, ldrb , expects the data on data bus inputs 31 to 24 if the supplied address is on a word boundary, on data bus inputs 23 through 16 if it is a word address plus one byte, and so on. the selected byte is placed in the bottom eight bits of the destination register. the other three bytes on the databus are ignored (see figure 10-6 on page 10-15).
amba interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 10-17 10.11 multi-master operation the amba bus specification supports multiple bus masters on the high performance asb. a simple two wire request and grant mechanism is implemented between the arbiter and each bus master. the arbiter ensures that only one bus master is active on the bus and also ensures that when no masters are requesting the bus, a default master is granted. the specification also supports a shared lock signal. this allows bus masters to indicate that the current transfer is indivisible from the following transfer and prevents other bus masters from gaining access to the bus until the locked transfers have completed. 10.11.1 arbitration efficient arbitration is important to reduce dead-time between successive masters being active on the bus. the bus protocol supports pipelined arbitration, so that arbitration for the next transfer is performed during the current transfer. the arbitration protocol is defined, but the prioritization is flexible and left to the application. typically, the test interface is given the highest priority to ensure test access under all conditions. every system must also include a default bus master, which is granted the bus when no bus masters are requesting it. the request signal, areq , from each bus master to the arbiter indicates that the bus master requires the bus. the grant signal from the arbiter to the bus master, agnt , indicates that the bus master is currently the highest priority master requesting the bus. the bus master: must drive the btran signals during bclk high when agnt is high is granted when agnt is high and bwait is low on a rising edge of bclk . the shared bus lock signal, blok , indicates to the arbiter that the following transfer is indivisible from the current transfer and no other bus master can be given access to the bus. a bus master must always drive a valid level on the blok signal when granted the bus to ensure the arbitration process can continue, even if the bus master is not performing any transfers. the arbiter functions are: 1. bus masters assert areq during the high phase of bclk . 2. the arbiter samples all areq signals on the falling edge of bclk .
amba interface 10-18 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 3. during the low phase of bclk , the arbiter also samples the blok signal and then asserts the appropriate agnt signal: a. if blok is low, the arbiter grants the highest priority bus master b. if blok is high, the arbiter keeps the same bus master granted. the arbiter can update the grant signals every bus cycle. however, a new bus master can only become granted and start driving the bus when the current transfer completes, as indicated by bwait being low. therefore, it is possible for the potential next bus master to change during waited transfers. the blok signal is ignored by the arbiter during the single cycle of handover between two different bus masters. if no bus masters are requesting the bus, the arbiter must grant the default bus master. the arbitration protocol is defined, but the prioritization is flexible and left to the application. a simple fixed-priority scheme can be used. alternatively, a more complex scheme can be implemented if required by the application.
amba interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 10-19 10.12 bus master handover bus master handover occurs when a bus master, which is not currently granted the bus, becomes the new granted bus master. a bus master becomes granted when agnt is high and bwait is low. agnt high indicates the bus master is currently the highest priority master requesting the bus and bwait low indicates the previous transfer has completed. figure 10-7 shows the bus master handover process. figure 10-7 bus master handover 1. when agnt is asserted, a bus master must drive the btran signals during bclk high. this can continue for many cycles if the previous transfer is waited. 2. prior to handover, btran must indicate an address-only cycle as the new bus master must commence with an address-only cycle to allow for bus turnaround. 3. when the previous transfer completes, the new bus master is granted. 4. in the last clock high phase of the previous transfer, the address bus stops being driven by the previous bus master. 5. the new bus master starts to drive the address bus and control signals during the clock low phase. a-tran address previous transfer address a-tran wait c0 c1 c2 c3 c4 a-tran s-tran previous transfer data bclk bd[31:0] btran[1:0] areq agnt ba[31:0] data berror blast bwait wait done done done last transfer completes decoder drives response slave drives response previous transfer new master granted
amba interface 10-20 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 6. the first transfer can then commence in the following bus cycle. during a waited transfer, bus master handover can be delayed and it is possible that the agnt to a particular bus master might be asserted and then negated, if another higher priority bus master then requests the bus before the current transfer has completed.
amba interface arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 10-21 10.13 default bus master every system must be designed with a single default bus master, which is granted when no other bus master is requesting the bus. the default bus master is responsible for driving the following signals to ensure the bus remains active: btran must be driven to indicate address-only transfer blok must be driven low. note if the ARM720T is to be the default bus master then the areq signal from the ARM720T must not be used.
amba interface 10-22 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 11-1 chapter 11 amba test this chapter describes the amba test features of the ARM720T. it contains the following sections: slave operation, test mode on page 11-2 ARM720T test mode on page 11-3 arm7tdm core test mode on page 11-5 ram test mode on page 11-6 tag test mode on page 11-8 test register mapping on page 11-11.
amba test 11-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 11.1 slave operation, test mode when the block is selected as a slave, you can write and read test vectors to the core using the amba test methodology. the ARM720T provides four test modes for this purpose: ARM720T test mode on page 11-3 arm7tdm core test mode on page 11-5 ram test mode on page 11-6 tag test mode on page 11-8. to apply test vectors to the ARM720T, the ARM720T block must have been deselected as a master ( agnt goes low). the test interface controller (tic) becomes the bus master, and the ARM720T is selected as a slave using the signal dsel . this places the ARM720T into test mode, and allows access to the test registers. the tests are sequenced by the test state machine in the amba interface. this generates the appropriate control signals for the test modes. a sample test sequence is shown in figure 11-1. figure 11-1 running a test vector on the processor core ctrl in bclk ctrl inputs bd[31:0] treqa treqb slave state mclkenable one test cycle data in status address ctrl in ctrl-in data-in stat-out addr-out turnaround ctrl-in eclk
amba test arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 11-3 11.2 ARM720T test mode the ARM720T test mode tests the functionality of the: cache control logic write buffer protection unit cache. to perform this test control/stimuli are applied to the control register (see table 11-4 on page 11-13). data packets are read or written as appropriate and the address and status are read back (see table 11-3 on page 11-11). the sequencing for this test mode is shown in figure 11-2. this is the default test mode, and is selected when bits [31:29] of the control register are set low (see table 11-4 on page 11-13). figure 11-2 state machine for ARM720T and arm7tdmi test inactive control data out data in stat out addr out turnaround reset
amba test 11-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a mclkenable is an internal signal that controls the clocking of the ARM720T and is asserted only in the datain and dataout status.
amba test arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 11-5 11.3 arm7tdm core test mode the arm7tdmi test places the ARM720T into a test mode so that the signals of the arm7tdm are visible to the amba interface. in this mode, the rest of ARM720T is held in reset. the ARM720T is placed in the mode by setting bit 31 of the control register (see table 11-4 on page 11-13).
amba test 11-6 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 11.4 ram test mode the ram test mode performs an intensive test of the ram arrays, to provide full coverage of bit faults. in this test mode, the rest of the ARM720T is held in reset and direct access is provided to the data, address, and control signals of the ram. to accommodate this, an alternative test sequence is used as shown in figure 11-3. figure 11-3 .state machine for ram test mode in this test mode, the ram control signals are derived from unused address bits, as shown in table 11-1. inactive control address turnaround reset data out data in table 11-1 ram test mode address packet bit positions address packet bit ram signal description [24:23] mas[1:0] ram access size 22 rseq ram sequential signal 21 immed immediate write signal, controls write pipeline, and selects between ramsel[3:0] and setsel[3:0]
amba test arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 11-7 to enter ram test mode, bits 29 and 28 of the control packet must be set. this places the ARM720T into ram test mode, and forces the ram to be clocked from the fclk input. 20 write ram write strobe 19 read ram read strobe [18:15] ramsel[3:0] ram bank select signal, used when immed is low [14:11] setsel[3:0] ram bank select signal, used when immed is high [10:0] addr[10:0] ram address table 11-1 ram test mode address packet bit positions address packet bit ram signal description
amba test 11-8 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 11.5 tag test mode the tag test mode performs an intensive test of all of the cells of the tag array, and tests the tag comparators. in this test mode, the rest of the ARM720T is held in reset and direct access is provided to the data, address, and control signals of the ram as shown in figure 11-4. in this test mode the tag control signals are derived from the tag ctl packet as listed in table 11-2 on page 11-9. to enter tag test mode, you must set bits 30 and 28 of the control packet. this places the ARM720T into tag test mode, and forces the tag to be clocked from the fclk input. figure 11-4 state machine for tag test mode inactive control address status reset tag ctl turnaround
amba test arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 11-9 table 11-2 tag test mode tag ctl packet bit positions tag ctl packet bit tag signal description [11:8] flush[3:0] when asserted each bit flushes the appropriate tag arrays [7:4] tagsel[3:0] tag select signal, each bit selects a tag array 2 write tag write strobe 1 read tag read strobe 0 valid valid input, the value on valid is written into the valid cell in the array on a write.
amba test 11-10 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 11.6 mmu test mode the mmu test mode performs an intensive test of all the cells in the tlb array, and tests the protection mechanism. in this test mode the rest of the ARM720T is held in reset and direct access is provided to the data, control, and translated address of the mmu as shown in figure 11-5. in this test mode, the mmu control signals are derived from the mmu cm packet. to enter mmu test mode, you must set bits 28 and 27 of the control packet. this places the ARM720T into mmu test mode and forces the mmu to be clocked from the fclk input. figure 11-5 state machine for mmu test mode inactive control mmu control mmu status reset mmu data turnaround
amba test arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 11-11 11.7 test register mapping the test registers are defined in the following tables: table 11-3 table 11-4 on page 11-13. table 11-3 status packet bit positions bits [31:0] bit arm7tdmi test ARM720T test 31 busdis bus disable - 30 screg[3] scan chain register screg[3] scan chain register 29 screg[2] scan chain register screg[2] scan chain register 28 screg[1] scan chain register screg[1] scan chain register 27 screg[0] scan chain register screg[0] scan chain register 26 highz highz instruction in tap controller highz highz instruction in tap controller 25 ntdoen not tdo enable ntdoen not xtdo enable 24 dbgrqi internal debug request dbgrqi internal debug request 23 rangeout0 icebreaker rangeout0 rangeout0 icebreaker rangeout0 22 rangeout1 icebreaker rangeout1 rangeout1 icebreaker rangeout1 21 commrx communications channel receive commrx communications channel receive 20 commtx communications channel transmit commtx communications channel transmit 19 dbgack debug acknowledge dbgack debug acknowledge
amba test 11-12 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 18 tdo test data out xtdo test data out 17 nenout a not enable output nenout not enable output 16 nenouti b not enable output protwatch[3] protection unit test output 15 tbit thumb state protwatch[2] protection unit test output 14 ncpi not coprocessor instruction - 13 nm[4] not processor mode camwatch[2] replacement test output 12 nm[3] not processor mode camwatch[1] replacement test output 11 nm[2] not processor mode camwatch[0] replacement test output 10 nm[1] not processor mode idcwatch[3] cache test output 9 nm[0] not processor mode idcwatch[2] cache test output 8 ntrans not memory translate idcwatch[1] cache test output 7 nexec not executed idcwatch[0] cache test output 6 lock locked operation lock locked operation 5 mas[1] memory access size mas[1] memory access size 4 mas[0] memory access size mas[0] memory access size 3 nopc not op-code fetch nendout not enable output table 11-3 status packet bit positions bits [31:0] (continued) bit arm7tdmi test ARM720T test
amba test arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 11-13 2 nrw not read/write nrw not read/write 1 nmreq not memory request nmreq not memory request 0 seq sequential address seq sequential address a. nenout is only valid during the data access cycle, so mclkenable is used to clock a transparent latch that captures the correct state. b. nenouti as nenout. table 11-4 control packet bit positions bits [31:0] bit arm7tdmi input ARM720T input 31 testcpu arm7tdmi test enable testcpu arm7tdmi test enable 30 - tagtest tag test mode enable 29 - ramtest ram test mode enable 28 nenin not enable input forcefclk clock select override 27 sdoutbs boundary scan serial output data mmutest mmu test mode enable 26 tbe test bus enable - 25 ape address pipeline enable - 24 bl[3] a byte latch control - 23 bl[2] a byte latch control - table 11-3 status packet bit positions bits [31:0] (continued) bit arm7tdmi test ARM720T test
amba test 11-14 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 22 bl[1] a byte latch control - 21 bl[0] a byte latch control - 20 tms test mode select xtms test mode select 19 tdi test data in xtdi test data in 18 tck b test clock xtck test clock 17 ntrst not test reset. xntrst not test reset 16 extern1 external input 1 extern1 external input 1 15 extern0 external input 0 extern0 external input 0 14 dbgrq debug request dbgrq debug request 13 breakpt breakpoint breakpoint breakpoint 12 dbgen debug enable dbgen debug enable 11 isync synchronous interrupts - 10 bigend big endian configuration wince en wince enhancements enable 9 cpa coprocessor absent cpa coprocessor absent 8 cpb coprocessor busy cpb coprocessor busy 7 abe c address bus enable xsna clock configuration table 11-4 control packet bit positions bits [31:0] (continued) bit arm7tdmi input ARM720T input
amba test arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 11-15 6 ale address latch enable ale address latch enable 5 dbe d data bus enable xfastbus clock configuration 4 nfiq not fast interrupt request. nfiq not fast interrupt request 3 nirq not interrupt request nirq not interrupt request 2 abort memory abort abort memory abort 1 nwait e not wait nwait not wait 0 nreset not reset nreset not reset a.anded with mclkenable , so is only valid during data access cycle. b.anded with mclkenable and bclk. c.this must normally be set high, because if the bus is tristated, with abe low, then it is not possible to read address values. d. dbe to the arm7dmt is anded with the state machine generated dbe and bclk to prevent bus conflict e.anded with mclkenable , so that the core state can only change during the data access cycle. table 11-4 control packet bit positions bits [31:0] (continued) bit arm7tdmi input ARM720T input
amba test 11-16 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 12-1 chapter 12 trace interface port this chapter describes the etm support for the ARM720T. it contains the following sections. about the etm on page 12-2 etm interface on page 12-3.
trace interface port 12-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 12.1 about the etm the etm provides instruction and data trace for the arm family of processors. the etm comprises two parts: a trace port a trace protocol has been developed to provide a real time trace capability for arm processor cores that are embedded in large application-specific integrated circuits (asics). because the asic usually contains on-chip memory and other circuitry, it is not possible for you to determine processor core operation by observing the asic pins. the trace port is necessary for you to understand processor operation. triggering facilities a specification has been developed that allows you to specify the exact set of trigger resources necessary for a particular application. resources include address and data comparators, counters, and sequencers. a software debugger provides you with the interface to the etm. the debugger allows all of the etm facilities to be configured through a jtag interface. if a trace port has been implemented then the debugger displays the captured trace information in an easily understandable format. you can use the jtag interface for other debugging functions, such as downloading code or single-stepping through a program. the etm compresses the trace information and exports it through the trace port. an external trace port analyzer (tpa) is used to capture the trace information. when you have captured the trace then the debugger extracts compressed information from the tpa and decompresses it to provide a full disassembly of the executed code. the debugger can also link this to the original high level code to provide you with information on how the code was executed on the target system.
trace interface port arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. 12-3 12.2 etm interface the ARM720T trace interface port enables connection of an arm7 etm (etm7) rev 1 to an ARM720T rev 3. this interface does not exist on ARM720T rev 0 to rev 2. the etm7 provides instruction and data trace for the arm7 family of processors. the interface is made up as follows: etmclk is a clock signal output from the ARM720T to use in the etm7 to provide synchronization with the clock in the ARM720T core. the internal clock signal used is cpclk which is inverted to form the etmclk output. etmclken etmclk is gated when it enters the etm7 by exporting another signal ( etmclken ) from the ARM720T. this signal is based on the cpnwait signal. etm outputs to the etm7. the etm7 is reset by xntrst , no extra signal is used to achieve this. the etmclk output is used by the etm7 to register the etm outputs on the rising edge of etmclk . the etm interface ( etm ) timings are shown in figure 12-1. these signals all change in the low phase of etmclk . figure 12-1 etm interface signal timing the ARM720T etm descriptions are provided in embedded trace macrocell interface signals on page a-10. the etm7 technical reference manual describes how to integrate an etm7 with the arm7 family of processors. etmclk ARM720T outputs set up hold
trace interface port 12-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a 12.2.1 etmclk gating for power saving for lowest power operation, it is essential that the clock provided to the etm7 is gated off when the etm7 is powered down. you must insert a clock gate between ARM720T and etm7 for this purpose. this is shown in figure 12-2. figure 12-2 etmclk power saving note you must take care during implementation to minimize the delay caused by insertion of this gate. ARM720T pwrdwn etm7 etmclk clk
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. a-1 appendix a signal descriptions this chapter describes the interface signals of the ARM720T. it contains the following sections: amba interface signals on page a-2 coprocessor interface signals on page a-5 jtag signals on page a-7 debugger signals on page a-9 embedded trace macrocell interface signals on page a-10 miscellaneous signals on page a-12.
signal descriptions a-2 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a a.1 amba interface signals the amba interface signals are listed in table a-1. table a-1 amba signal descriptions name type source or destination description agnt in arbiter access grant. this signal from the bus arbiter indicates that the ARM720T is currently the highest priority master requesting the bus. if agnt is asserted at the end of a transfer ( bwait low), the master is granted the bus. agnt changes during the low phase of bclk and remains valid through the high phase. areq out arbiter access request. this signal indicates that the master requires the bus. it changes during the high phase of bclk . this signal is intended for use where the ARM720T is not the lowest priority or default bus master. ba[31:0] out current bus master bus address. this is the system address bus. bclk in system (bus) clock. this clock times all bus transfers. bd[31:0] in/out bus master bidirectional system data bus. this data bus is driven by the current bus master during write cycles, and by the appropriate bus slave during read cycles. berror in/out system decoder and current bus master bus error. this signal indicates a transfer error by the selected bus slave using the berror signal. when berror is high, a transfer error has occurred. when berror is low, the transfer is successful. this signal is also used in combination with the blast signal to indicate a bus retract operation.
signal descriptions arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. a-3 blast in/out system decoder and current bus master bus class. this signal is driven by the selected slave to indicate if the current transfer must be the last of a burst sequence. when blast is high, the next bus transfer must allow sufficient time for address decoding. when blast is low, the next transfer can continue as a burst sequence. this signal is also used in combination with the berror signal to indicate a bus retract operation. blok out arbiter bus lock. when high, this signal indicates that the following bus transfer is to be indivisible and no other bus master must be given access to the bus. bnres in reset state machine bus reset. this signal indicates the reset status of the bus. bprot[1:0] out system decoder bus protections. these signals provide additional information about the transfer being performed. all write cycles are indicated as being supervisor accesses. these signals have the same timing as the ba signals. bsize[1:0] out current bus master bus size. these signals indicate the size of the transfer, which can be byte, halfword, or word. these signals have the same timing as the address bus. btran[1:0] out bus master bus transaction type. these signals indicate the type of the next transaction which can be address-only, nonsequential, or sequential. these signals are driven when agnt is asserted, and are valid during the high phase of bclk before the transfer to which they refer. table a-1 amba signal descriptions (continued) name type source or destination description
signal descriptions a-4 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a bwait in/out system decoder and current bus master bus wait. this signal is driven by the selected slave to indicate if the current transfer can complete. if bwait is high, a further bus cycle is required. if bwait is low, the current transfer can complete in the current bus cycle. bwrite in/out current bus master bus write. when high, this signal indicates a bus write cycle and when low, a read cycle. this signal has the same timing as the address bus. dsel in system decoder slave select. this signal puts the arm core into a test mode so that vectors can be written in and out of the core. table a-1 amba signal descriptions (continued) name type source or destination description
signal descriptions arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. a-5 a.2 coprocessor interface signals the coprocessor interface signals are listed in table a-2. table a-2 coprocessor interface signal descriptions name type description cpclk out coprocessor clock. this clock controls the operation of the coprocessor interface. cpdata[31:0] in/out coprocessor data bus. data is transferred to and from the coprocessor using this bus. data is valid on the falling edge of cpclk . cpdbe in coprocessor data bus enable. this signal when high, indicates that the coprocessor intends to drive the coprocessor data bus, cpdata. if the coprocessor interface is not to be used then this signal must be tied low. cpnwait out coprocessor not wait. the coprocessor clock cpclk is qualified by cpnwait to allow the ARM720T to control the transfer of data on the coprocessor interface. cptestread in coprocessor test read. this signal can be used for test of a coprocessor, if attached, and must only be used with the ARM720T held in reset. when high, it enables data bus (db) to be driven on to cpdata , and must be held low. it must never be asserted at the same time as cptestwrite . cptestwrite in coprocessor test write. this signal can be used for test of a coprocessor, if attached, and must only be used with the ARM720T held in reset. when high, it enables db to be driven on to cpdata , and must be held low. it must never be asserted at the same time as cptestread . extcpa in external coprocessor absent. a coprocessor that is capable of performing the operation that ARM720T is requesting, by asserting ncpi takes extcpa low immediately. if extcpa is high at the end of the low phase of the cycle in which ncpi went low, ARM720T aborts the coprocessor instruction and takes the undefined instruction trap. if extcpa is low and remains low, ARM720T busy-waits until extcpb is low, and then completes the coprocessor instruction. extcpb in external coprocessor busy. a coprocessor that is capable of performing the operation that ARM720T is requesting, by asserting ncpi , but cannot commit to starting it immediately, indicates this by driving extcpb high. when the coprocessor is ready to start it takes extcpb low. ARM720T samples extcpb at the low phases of each cycle in which ncpi is low.
signal descriptions a-6 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a nopc out not opcode fetch. when low, this signal indicates that the processor is fetching an instruction from memory. when high, data, if present, is being transferred. this signal is used by the coprocessor to track the arm pipeline. ncpi out not coprocessor instruction. when low, this signal indicates that the ARM720T is executing a coprocessor instruction. nuser out not user mode. when low, this signal indicates that the processor is in user mode. it is used by a coprocessor to qualify instructions. tbit out thumb state. this signal, when high, indicates that the processor is executing the thumb instruction set. when low, the processor is executing the arm instruction set. table a-2 coprocessor interface signal descriptions (continued) name type description
signal descriptions arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. a-7 a.3 jtag signals jtag signal descriptions are listed in table a-3. table a-3 jtag signal descriptions name type description highz out this signal denotes that the highz instruction has been loaded into the tap controller. ir[3:0] out tap instruction register. these signals reflect the current instruction loaded into the tap controller instruction register. the signals change on the falling edge of xtck when the tap state machine is in the update-dr state. you can use these signals to allow more scan chains to be added using the ARM720T tap controller. rstclkbs out reset boundary scan clock. this signal denotes that either the tap controller state machine is in the reset state or that xntrst has been asserted. you can use this to reset boundary scan cells outside the ARM720T. screg[3:0] out scan chain register. these signals reflect the id number of the scan chain currently selected by the tap controller. these signals change on the falling edge of xtck when the tap state machine is in the update-dr state. sdinbs out boundary scan serial data in. this signal is the serial data to be applied to an external scan chain. sdoutbs in boundary scan serial data out. this signal is the serial data from an external scan chain. it allows a single xtdo port to be used. if an external scan chain is not connected, this input must be tied low. tapsm[3:0] out tap controller status. these signals represent the current state of the tap controller machine. these signals change on the rising edge of xtck and can be used to allow more scan chains to be added using the ARM720T tap controller. tck1 out test clock one. this clock represents the high phase of xtck . tck1 is high when xtck is high. this signal can be used to allow more scan chains to be added using the ARM720T tap controller. tck2 out test clock two. this clock represents the low phase of xtck . tck2 is high when xtck is low. you can use this signal to allow more scan chains to be added using the ARM720T tap controller. tck2 is the non-overlapping complement of tck1 . xntdoen out not test data out output enable. when low, this signal denotes that serial data is being driven out on the xtdo output.
signal descriptions a-8 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a xntrst in not test reset. when low, this signal resets the jtag interface. xtck in test clock. this signal is the jtag test clock. xtdi in test data in. jtag test data in signal. xtdo out test data out. jtag test data out signal. xtms in test mode select. jtag test mode select signal. table a-3 jtag signal descriptions (continued) name type description
signal descriptions arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. a-9 a.4 debugger signals the debugger signal descriptions are listed in table a-4. table a-4 debugger signal descriptions name type description breakpoint in breakpoint. this signal allows external hardware to halt execution of the processor for debug purposes. when high, this causes the current memory access to be breakpointed. if memory access is an instruction fetch, the core enters debug state if the instruction reaches the execute stage of the core pipeline. if the memory access is for data, the core enters the debug state after the current instruction completes execution. this allows extension of the internal breakpoints provided by the embeddedice module. commrx out communication receive full. when high, this signal denotes that the comms channel receive buffer contains data for the core to read. commtx out communication transmit empty. when high, this signal denotes that the comms channel transmit buffer is empty. dbgack out debug acknowledge. when high, this signal denotes that the arm is in debug state. dbgen in debug enable. this signal allows the debug features of ARM720T to be disabled. when dbgen is low, it inhibits breakpoint and dbgrq to the core, dbgack from the ARM720T is always low. dbgrq in debug request. this signal causes the core to enter debug state after executing the current instruction. this allows external hardware to force the core into debug state, in addition to the debugging features provided by the embeddedice logic. extern [1:0] in external condition. these signals allow breakpoints and watchpoints to depend on an external condition. rangeout[1:0] out range out. these signals indicate that the relevant embeddedice watchpoint register has matched the conditions currently present on the address, data, and control buses. these signals are independent of the state of the watchpoint enable control bits.
signal descriptions a-10 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a a.5 embedded trace macrocell interface signals the etm interface signals are listed in table a-5. table a-5 etm interface signal descriptions output name type description etmnmreq out not memory request. when low, indicates that the processor requires memory access during the following cycle. etmseq out sequential address. when high, indicates that the address of the next memory cycle is related to that of the last memory cycle. the new address is one of the following: the same as the previous one four greater in arm state two greater in thumb state. this signal can be used, with the low order address lines, to indicate that the next cycle can use a fast memory mode and bypass the address translation system. etmnexec out not executed. when high, indicates that the instruction in the execution unit is not being executed. for example it might have failed the condition check code. etmncpi out not coprocessor instruction. when the ARM720T executes a coprocessor instruction, it takes the etmncpi low and waits for a response from the coprocessor. the actions taken depend on this response, which the coprocessor signals on the cpa and cpb inputs. etma[31:0] out addresses. this is the retimed internal address bus. etmnopc out not opcode fetch. when low, indicates that the processor is fetching an instruction from memory. when high, indicates that data, if present, is being transferred. etmnrw out not read/write. when high, indicates a processor write cycle. when low, indicates a processor read cycle. etmclk out etm clock. exported clock signal for use in etm. internal signal is inverted version of cpclk . see table a-2 on page a-5 for a description of cpclk .
signal descriptions arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. a-11 note the signal tbit is also used as an etm interface signal. for a description of tbit , see table a-2 on page a-5. the signal bigend is also used as an etm interface signal. for a description of bigend , see table a-6 on page a-12. etmclken out etm clock enable. exported signal used to gate etmclk . internal signal is based on the cpnwait signal that is first phase two latched by cpclk . this ensures that it changes at the start of phase two, the high phase of cpclk . it is held throughout the next phase, that is phase one, the low phase of cpclk. see table a-2 on page a-5 for a description of cpnwait . etmmas[1:0] out memory access size. indicates the width of the bus transaction to the current address, this signal can take the following values: 00 = 8-bit 01 = 16-bit 10 = 32-bit 11 is reserved. the above values are valid for both read and write cycles. etmdbgack out debug acknowledge. when high, indicates that the processor is in debug state. when low, indicates that the processor is in normal system state. etmd[31:0] out coprocessor data bus. this is the retimed internal data bus. etmabort out memory abort or bus error. indicates that a requested access has been disallowed. etmcpa out coprocessor absent handshake. the coprocessor absent signal. it is a buffered version of the coprocessor absent signal. etmcpb out coprocessor busy handshake. the coprocessor busy signal. it is a buffered version of the coprocessor absent signal. procid[31:0] out trace procid bus. procidwr out trace procid write. indicates to etm7 that the trace procid, cp15 register 13, has been written. table a-5 etm interface signal descriptions (continued) output name type description
signal descriptions a-12 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a a.6 miscellaneous signals ? miscellaneous signals used by the ARM720T are listed in table a-6. table a-6 miscellaneous signal descriptions name type source or destination description bigend out configuration output big-endian format. when this signal is high, the processor treats bytes in memory as being in big-endian format. when it is low, memory is treated as little-endian. cachedis a in configuration input disable cache. this signal is used to disable the idc for use in certain applications. see idc disable for secure applications on page 4-6 for a description of this signal. fclk in external clock source fast clock input. this clock is used to clock the arm core when xfastbus is low. during testing, the signal allows efficient testing of the ram, tag, and mmu blocks. xfastbus in configuration input bus clocking mode configuration signal. when high, the ARM720T operates from a single clock, bclk . when low, selects standard mode operating from two clocks, bclk and fclk . xnfiq in interrupt controller arm fast interrupt request signal. xnirq in interrupt controller arm interrupt request signal. the interrupt controller mixes several interrupt sources, and produces xnirq . xsna in configuration input synchronous and not asynchronous configuration pin. in standard arm bus mode this signal determines the bus interface mode and must be wired high or low depending on the desired relationship between fclk and bclk . see standard mode on page 9-5. this pin is ignored when operating xfastbus is high. a.arm does not support the use of this feature.
signal descriptions arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. a-13 a.7 additional signal outputs three additional signal outputs are provided to aid the interface of amba signals to input and output pads when building an arm test chip. these signals are: babe wden bden . note arm advises that these signals are not used.
signal descriptions a-14 copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a
arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. index-i index the items in this index are listed in alphabetic order, with symbols and numerics appearing at the end. the references given are to page numbers. a abort mode 2-7 aborts cpu 6-18 data 2-19, 7-34 indexed addressing 2-24 external buffered writes 6-25 cachable reads 6-25 prefetch 2-18 types 2-18 access faults checking 6-22 accessing banked registers 7-26 addressing signals 10-7 amba interface about 10-2 signals a-2 arm instruction set 1-6 addressing mode five 1-14 four 1-13 three 1-12 two 1-11 two, privileged 1-12 condition fields 1-15 fields 1-14 operand two 1-14 arm state register organization 2-9 ARM720T block diagram 1-3 description 1-2 scan chain arrangement 7-5 asb bus interface 10-3 b banked registers accessing 7-26 big endian format 10-14 big endian operation 10-14 big endian. see memory format breakpoints clearing 8-10 entering debug state from 7-30 programming 8-9 hardware 8-9 software 8-9 setting 8-10 with prefetch abort 7-34 bus interface 9-2 asynchronous mode 9-6 fastbus extension 9-2 standard mode 9-2 synchronous mode 9-7
index index-ii copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a bus master default 10-21 bus master handover 10-19 bypass public instruction 7-13 bypass register 7-16 byte (data type) 2-6 byte operations 10-16 c clamp public instruction 7-14 clampz public instruction 7-15 clock switching debug state 7-23 communications channel message transfer 8-21 using 8-20 condition code flags 2-13 configuration compatibility 3-2 description 3-2 notation 3-2 control coprocessor state determining 7-28 control registers registers control 8-6 coprocessor 1-4 coprocessor interface signals a-5 core clocks 7-23 core state accessing banked registers 7-25 determining 7-25 moving to arm state 7-25 cpsr (current processor status register) 2-13 format of 2-13 cpu aborts 6-18 cycle types bus interface 10-4 d data signal timing 10-9 data types 2-6 alignment 2-6 byte 2-6 halfword 2-6 word 2-6 debug host 7-4 program counter 7-30 protocol converter 7-4 reset 7-11 systems 7-4 debug extensions 7-2 debug state 7-2 internal state 7-2 debug interface definition 7-2 debug request entering debug state via 7-32 debug state entering 7-7 entering on breakpoint 7-7 entering on debug-request 7-8 entering on watchpoint 7-7 exiting from 7-28 switching clock state 7-23 debugger signals a-9 device identification code register 7-16 domain access control 6-21 domain access control register format 6-21 interpreting access bits 6-21 e early termination definition 2-24 embeddedice about 8-2 breakpoints 8-9 coupling 8-17 breakpt signal 8-2 communications channel 8-19 control registers 8-6 debug control register 8-13 debug status register 8-15 definition 8-2 disabling 8-3 tap controller 8-2, 8-6 timing 8-3 etm about 12-2 interface 12-3 etm interface signals a-10 exception entering 2-16 entry and exit summary 2-17 leaving 2-17 priorities 2-21 restrictions 2-21 returning to thumb state from 2-17 vectors 2-20, 2-21 addresses 2-20 external aborts aborts external 6-25 buffered writes 6-25 cachable reads 6-25 extest public instruction 7-12 f fast context switch extension 2-22 fastbus extension 9-3 fault address register 6-19 fault checking 6-22 fault status register 6-19 faults alignment 6-23 domain 6-23 permission 6-24 section 6-24 subpage 6-24 translation 6-23 fcse relocation of low virtual addresses 2-22 fiq mode 2-7 definition 2-18 h halfword operations 10-15 high register accessing from thumb state 2-11 description 2-11 highz public instruction 7-14 i idc cacheable bit 4-2 disable 4-5 disable for secure applications 4-6 enable 4-5 interaction with mmu and write buffer 6-26 operation 4-2 read-lock-write 4-3 reset 4-5 validity 4-4 double-mapped space 4-4 software idc flush 4-4 idcode public instruction 7-13
index arm ddi 0192a copyright ? arm limited 1997, 1998, 2000. all rights reserved. index-iii instruction register 7-17 instruction set 1-5 arm 1-6 thumb 1-15 instruction types 1-5 internal coprocessor instructions 3-3 interrupts 7-34 intest public instruction 7-12 irq mode 2-7 definition 2-18 j jtag signals a-7 jtag state machine 7-10 l large page references translating 6-16 level 1 descriptor 6-7 fetch 6-6 level 2 descriptor 6-12 little endian format 10-14 operation 10-14 little endian. see memory format low registers 2-12 m memory access use of the bwait pin 10-10 memory format big endian description 2-3 little endian description 2-4 memory request signals 10-7, 10-8 miscellaneous signals a-12 mmu description 6-2 disabling 6-27 domains 6-2 effect of reset 6-3 enabling 3-6, 6-26 faults 6-18 interaction with idc and write buffer 6-26 memory accesses 6-2 program accessible registers 6-4 tlb 6-2 multi master operation 10-17 n nwait pin use of 10-10 o operating modes abort mode 2-7 changing 2-7 fiq 2-7 irq mode 2-7 supervisor mode 2-7 system mode 2-7 undefined mode 2-7 user mode 2-7 operating state arm 2-2 reading 2-14 switching 2-2 to arm 2-2 to thumb 2-2 thumb 2-2 p page table descriptor bits 6-8 program status registers control bits 2-13 mode bit values 2-14 reserved bits 2-14 programming watchpoints 8-11 public instructions 7-12 bypass 7-13 clamp 7-14 clampz 7-15 extest 7-12 highz 7-14 idcode 7-13 intest 7-12 restart 7-15 sample/preload 7-15 scan_n 7-12 r read-lock-write 10-13 registers 3-4 arm 2-8 interrupt modes 2-9 bypass 7-16 debug communications channel 8-19 debug control dbgack 8-13 dbgrq 8-13 intdis 8-14 debug status 8-15 device id 7-16 fault address 6-19 fault status 6-19 instruction 7-17 mmu 6-4 register 0, id register 3-4 register 1, control register 3-5 register 13, process identifier register 3-10 changing fcse pid 3-11 fcse pid 3-11 register 2, translation table base register 3-7 register 3, domain access control register 3-7 register 4, reserved 3-8 register 5, fault status register 3-8 register 6, fault address register 3-9 register 7, cache operations register 3-9 register 8, translation lookaside buffer register 3-9 register 9-12, reserved 3-10 relationship between arm and thumb 2-11 scan chain select 7-17 test data types 7-16 thumb 2-10 watchpoint 8-4 programming and reading 8-5 reset action of processor on 2-23 restart public instruction 7-15 return address calculations 7-33 s sample/preload public instruction 7-15 scan and debug signals used by etm 7-42 scan chain 0 7-20 scan chain 1 7-21 scan chain 15 7-22 scan chain 2 7-22 scan chain select register 7-17 scan chains 7-18 scan interface timing 7-35 scan limitations 7-9 scan_n public instruction 7-12 section descriptor 6-9
index index-iv copyright ? arm limited 1997, 1998, 2000. all rights reserved. arm ddi 0192a sequential memory accesses memory accesses sequential 10-12 signals amba interface a-2 coprocessor interface a-5 debugger a-9 etm interface a-10 jtag a-7 miscellaneous a-12 slave operation, test mode 11-2 slave response signals 10-10 small page references translating 6-14 software interrupt 2-19 software interrupt 2-19 spsr (saved processor status register) 2-13 format of 2-13 standard mode 9-5 supervisor mode 2-7 swi 2-19 system mode 2-7 system speed access during debug state 7-32 system state determining 7-27 t t bit (in cpsr) 2-14 test data register types 7-16 thumb instruction set 1-15 thumb state 2-2 register organization 2-10 translating references 6-5 translating section references 6-11 translation table base 6-5 u undefined instruction trap 2-20 undefined mode 2-7 user mode 2-7 w watchpoint registers 8-4 programming and reading 8-5 watchpoints entering debug state from 7-31 programming 8-11 programming restriction 8-12 with another exception 7-31 word operations 10-15 write buffer bufferable bit 5-2 definition 5-2 interaction with mmu and idc 6-26 operation 5-3 bufferable write 5-3 read-lock-write 5-4 unbufferable write 5-3

▲Up To Search▲

Price & Availability of ARM720T

	To Download ARM720T Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .