View ARM946E-S_6965284.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c ARM946E-S ? revision: r1p1 technical reference manual
ii copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c ARM946E-S technical reference manual copyright ? 2001-2003 arm limited. all rights reserved. release information the following changes have been made to this document. proprietary notice words and logos marked with ? or ? are registered trademarks or trademarks of arm limited in the eu and other countries, except as otherwise stated below in this proprietary notice. other brands and names mentioned herein may be the trademarks of their respective owners. neither the whole nor any part of the information contained in, or the product described in, this document may be adapted or reproduced in any material form except with the prior written permission of the copyright holder. the product described in this document is subject to continuous developments and improvements. all particulars of the product and its use contained in this document are given by arm in good faith. however, all warranties implied or expressed, including but not limited to implied warranties of merchantability, or fitness for purpose, are excluded. this document is intended only to assist the reader in the use of the product. arm limited shall not be liable for any loss or damage arising from the use of any information in this document, or any error or omission in such information, or any incorrect use of the product. confidentiality status this document is open access. this document has no restriction on distribution. product status the information in this document is final, that is for a developed product. web address http://www.arm.com change history date issue change 16 february 2001 a first release 17 may 2002 b second release 15 may 2003 c third release
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. iii contents ARM946E-S technical reference manual preface about this document .................................................................................... xiv feedback ..................................................................................................... xix chapter 1 introduction 1.1 about the ARM946E-S processor ............................................................... 1-2 1.2 ARM946E-S block diagram ......................................................................... 1-3 1.3 differences between processor versions .................................................... 1-5 chapter 2 programmer?s model 2.1 about the ARM946E-S programmer ? s model .............................................. 2-2 2.2 about the arm9e-s programmer ? s model .................................................. 2-3 2.3 cp15 register map summary ...................................................................... 2-4 chapter 3 caches 3.1 about cache architecture ............................................................................ 3-2 3.2 instruction cache ......................................................................................... 3-6 3.3 data cache ................................................................................................. 3-8 3.4 cache lockdown ........................................................................................ 3-12 chapter 4 protection unit 4.1 about the protection unit ............................................................................. 4-2
contents iv copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 4.2 memory regions .......................................................................................... 4-3 4.3 overlapping regions ................................................................................... 4-6 chapter 5 tightly-coupled memory interface 5.1 ARM946E-S tcm interface description ...................................................... 5-2 5.2 using cp15 control register ..................................................................... 5-3 5.3 enabling the instruction tcm during soft reset .......................................... 5-7 5.4 data tcm accesses ................................................................................... 5-8 5.5 instruction tcm accesses .......................................................................... 5-9 chapter 6 bus interface unit and write buffer 6.1 about the biu and write buffer ................................................................... 6-2 6.2 ahb bus master interface ........................................................................... 6-3 6.3 noncached thumb instruction fetches ..................................................... 6-10 6.4 ahb clocking ............................................................................................ 6-11 6.5 the write buffer ......................................................................................... 6-14 chapter 7 coprocessor interface 7.1 about the coprocessor interface ................................................................. 7-2 7.2 coprocessor interface signals .................................................................... 7-3 7.3 ldc/stc .................................................................................................. 7-11 7.4 mcr/mrc ................................................................................................ 7-13 7.5 interlocked mcr ....................................................................................... 7-14 7.6 cdp .......................................................................................................... 7-15 7.7 privileged instructions ............................................................................... 7-16 7.8 busy-waiting and interrupts ...................................................................... 7-17 chapter 8 etm interface 8.1 about the etm interface ............................................................................. 8-2 8.2 enabling the etm interface ........................................................................ 8-3 8.3 ARM946E-S trace support features ............................................................ 8-4 chapter 9 debug support 9.1 about the debug interface .......................................................................... 9-2 9.2 debug systems ........................................................................................... 9-4 9.3 the jtag state machine ............................................................................ 9-7 9.4 scan chains .............................................................................................. 9-12 9.5 debug access to the caches .................................................................... 9-18 9.6 debug interface signals ............................................................................ 9-20 9.7 determining the core and system state .................................................... 9-25 9.8 overview of embeddedice-rt ................................................................ 9-26 9.9 disabling embeddedice-rt .................................................................... 9-28 9.10 the debug communication channel .......................................................... 9-29 9.11 monitor mode debugging .......................................................................... 9-33
contents arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. v chapter 10 test support 10.1 about the ARM946E-S processor test methodology ................................. 10-2 10.2 scan insertion and atpg ......................................................................... 10-3 10.3 bist of memory arrays ............................................................................. 10-5 appendix a ac parameters a.1 timing diagrams ......................................................................................... a-2 appendix b signal descriptions b.1 signal properties and requirements ............................................................ b-2 b.2 clock interface signals ................................................................................ b-3 b.3 tcm interface signals ................................................................................. b-4 b.4 ahb signals ................................................................................................ b-5 b.5 coprocessor interface signals ..................................................................... b-8 b.6 debug signals ........................................................................................... b-10 b.7 jtag signals ............................................................................................. b-12 b.8 miscellaneous signals ............................................................................... b-13 b.9 etm interface signals ............................................................................... b-14 b.10 intest wrapper signals ........................................................................... b-16 glossary
contents vi copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. vii list of tables ARM946E-S technical reference manual change history .............................................................................................................. i i table 1-1 location of block descriptions ................................................................................... 1-4 table 2-1 cp15 register map .................................................................................................... 2-5 table 2-2 cp15 terms and abbreviations .................................................................................. 2-6 table 2-3 register 0, id code ................................................................................................... 2-8 table 2-4 cache type register format ..................................................................................... 2-8 table 2-5 cache size encoding ................................................................................................. 2 -9 table 2-6 cache associativity encoding .................................................................................. 2-10 table 2-7 tightly-coupled memory size register ................................................................... 2-11 table 2-8 memory size field .................................................................................................... 2-11 table 2-9 register 1, control register .................................................................................... 2-12 table 2-10 programming instruction and data cachable bits .................................................... 2-16 table 2-11 programming data bufferable bits ........................................................................... 2-17 table 2-12 programming instruction and data access permission bits (extended) ................... 2-17 table 2-13 access permission encoding (extended) ............................................................... 2-18 table 2-14 instruction and data access permission bits (standard) .......................................... 2-19 table 2-15 access permission encoding (standard) ................................................................. 2-19 table 2-16 accessing protection region base and size registers .......................................... 2-20 table 2-17 protection region base and size register format .................................................. 2-21 table 2-18 region size encoding .............................................................................................. 2- 21 table 2-19 cache operations .................................................................................................... 2-23 table 2-20 index fields for supported cache sizes .................................................................... 2-24 table 2-21 lockdown register format ...................................................................................... 2-26
list of tables viii copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c table 2-22 tcm region register format .................................................................................. 2-27 table 2-23 tcm area size encoding ......................................................................................... 2-27 table 2-24 register 15, bist instructions ................................................................................ 2-30 table 2-25 register 15, implementation-specific bist instructions ......................................... 2-30 table 2-26 bist control register bit definitions ....................................................................... 2-31 table 2-27 bist size encodings examples ............................................................................... 2-31 table 2-28 test state register bit assignments ....................................................................... 2-32 table 2-29 additional operations .............................................................................................. 2 -33 table 2-30 index fields for supported cache sizes .................................................................... 2-34 table 2-31 trace control register ............................................................................................ 2- 35 table 2-32 trace control register bit assignments .................................................................. 2-36 table 3-1 tag and index fields for supported cache sizes ...................................................... 3-4 table 3-2 meaning of cd bit values .......................................................................................... 3-9 table 3-3 calculating index addresses ................................................................................... 3-11 table 4-1 protection register format ........................................................................................ 4-3 table 4-2 region size encoding ............................................................................................... 4- 4 table 6-1 ahb transfer types .................................................................................................... 6-4 table 6-2 supported burst types ............................................................................................... 6 -5 table 6-3 data write modes .................................................................................................... 6 -14 table 7-1 coprocessor interface signals .................................................................................. 7-3 table 7-2 handshake encoding ................................................................................................ 7-7 table 9-1 public instructions ................................................................................................... .. 9-8 table 9-2 ARM946E-S scan chain allocations ........................................................................ 9-12 table 9-3 scan chain 1 bits .................................................................................................... 9-12 table 9-4 scan chain 2 bits .................................................................................................... 9-13 table 9-5 scan chain 15 bits .................................................................................................. 9 -14 table 9-6 mapping of scan chain 15 address field to cp15 registers ..................................... 9-14 table 9-7 status bit mapping of scan chain 15 address field to cp15 registers ..................... 9-16 table 9-8 correlation between status bits and cache operations ........................................... 9-16 table 9-9 coprocessor 14 register map ................................................................................. 9-29 table 10-1 instruction bist address and general registers ................................................... 10-9 table 10-2 data bist address and general registers ............................................................ 10-9 table a-1 timing parameter definitions for clock, reset, and ahb enable ................................ a-3 table a-2 parameter definitions for ahb bus request and grant timing .................................... a-3 table a-3 parameter definitions for ahb bus master timing ..................................................... a-5 table a-4 parameter definitions for coprocessor interface timing ............................................. a-6 table a-5 parameter definitions for debug interface timing ...................................................... a-8 table a-6 parameter definitions for jtag interface timing ..................................................... a-10 table a-7 parameter definitions for dbgsdout to dbgtdo timing .................................... a-12 table a-8 parameter definitions for exception and configuration timing ................................. a-12 table a-9 parameter definitions for tcm interface timing ...................................................... a-14 table a-10 parameter definitions for etm interface timing ....................................................... a-16 table b-1 clock interface signals .............................................................................................. b-3 table b-2 tcm interface signals ............................................................................................... b -4 table b-3 ahb signals ........................................................................................................... ... b-5 table b-4 coprocessor interface signals .................................................................................. b-8 table b-5 debug signals ......................................................................................................... b-10
list of tables arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. ix table b-6 jtag signals .......................................................................................................... . b-12 table b-7 miscellaneous signals ............................................................................................. b-1 3 table b-8 etm interface signals .............................................................................................. b- 14
list of tables x copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. xi list of figures ARM946E-S technical reference manual key to timing diagram conventions ............................................................................ xvi figure 1-1 ARM946E-S block diagram ....................................................................................... 1-3 figure 2-1 cp15 mrc and mcr bit pattern ............................................................................... 2-7 figure 2-2 register 7, index and segment format .................................................................... 2-23 figure 2-3 instruction cache address format ............................................................................ 2-24 figure 2-4 process id format ................................................................................................... 2-29 figure 2-5 register 15, index and segment format .................................................................. 2-34 figure 2-6 data format tag read/write operations .................................................................. 2-34 figure 3-1 example 8kb cache .................................................................................................. 3 -3 figure 3-2 access address for a 4kb cache .............................................................................. 3-5 figure 3-3 register 7, rd format .............................................................................................. 3 -10 figure 4-1 protection unit ...................................................................................................... ..... 4-2 figure 4-2 overlapping memory regions .................................................................................... 4-6 figure 5-1 tcm read cycle ....................................................................................................... .. 5-2 figure 5-2 data write followed by data read of data tcm ......................................................... 5-8 figure 5-3 simultaneous instruction fetch and data read of instruction tcm ........................... 5-10 figure 5-4 data write followed by data read of instruction tcm .............................................. 5-10 figure 5-5 data write followed by instruction fetch of instruction tcm ..................................... 5-11 figure 5-6 data read followed by instruction fetch ................................................................... 5-12 figure 5-7 simultaneous instruction fetch and data write ......................................................... 5-12 figure 5-8 data write followed by simultaneous instruction fetch and data read ...................... 5-13 figure 6-1 linefetch transfer ................................................................................................... ... 6-6 figure 6-2 back-to-back line fetches .......................................................................................... 6 -7
list of figures xii copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure 6-3 nonsequential uncached accesses .......................................................................... 6-7 figure 6-4 data burst followed by instruction fetch .................................................................... 6-8 figure 6-5 crossing a 1kb boundary ......................................................................................... 6-8 figure 6-6 uncached ldc sequence ......................................................................................... 6-9 figure 6-7 ahb clock relationships .......................................................................................... 6-1 2 figure 6-8 ARM946E-S clk to ahb hclk sampling ............................................................. 6-13 figure 7-1 pipeline stages ...................................................................................................... ... 7-2 figure 7-2 connecting multiple coprocessors ............................................................................ 7-8 figure 7-3 example handshake logic blocks .............................................................................. 7-9 figure 7-4 driving the coprocessors data buses to logic 0 ...................................................... 7-10 figure 7-5 multiplexing the coprocessors data buses .............................................................. 7-10 figure 7-6 ldc/stc cycle timing ............................................................................................. 7-1 1 figure 7-7 mcr/mrc transfer timing with busy-wait ............................................................... 7-13 figure 7-8 interlocked mcr/mrc timing with busy-wait .......................................................... 7-14 figure 7-9 late canceled cdp ................................................................................................. 7- 15 figure 7-10 privileged instructions ............................................................................................. 7-16 figure 7-11 busy-waiting and interrupts .................................................................................... 7-17 figure 8-1 ARM946E-S etm interface ...................................................................................... 8-2 figure 9-1 clock synchronization ............................................................................................... 9-3 figure 9-2 typical debug system ............................................................................................... 9 -4 figure 9-3 arm9e-s block diagram .......................................................................................... 9-6 figure 9-4 tap controller state transitions ................................................................................. 9-7 figure 9-5 tag address format ............................................................................................... 9-1 8 figure 9-6 cache index register format .................................................................................. 9-19 figure 9-7 breakpoint timing .................................................................................................... 9-20 figure 9-8 watchpoint entry with data processing instruction .................................................. 9-22 figure 9-9 watchpoint entry with branch ................................................................................. 9-23 figure 9-10 the arm9e-s, tap controller, and embeddedice-rt ......................................... 9-26 figure 9-11 debug communication channel status register ................................................... 9-30 figure 10-1 test flow for bist .................................................................................................. . 10-7 figure a-1 clock, reset, and ahb enable timing ........................................................................ a-2 figure a-2 ahb bus request and grant related timing ................................................................ a-3 figure a-3 ahb bus master timing ............................................................................................. a- 4 figure a-4 coprocessor interface timing .................................................................................... a-6 figure a-5 debug interface timing .............................................................................................. a-8 figure a-6 jtag interface timing ............................................................................................. a- 10 figure a-7 dbgsdout to dbgtdo timing ............................................................................ a-11 figure a-8 exception and configuration timing ......................................................................... a-12 figure a-9 tcm interface timing ............................................................................................... a -13 figure a-10 etm interface timing ............................................................................................... a-15
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. xiii preface this preface introduces the ARM946E-S r1p1 technical reference manual . it contains the following sections: about this document on page xiv feedback on page xix.
preface xiv copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c about this document this document is a reference manual for the ARM946E-S processor. intended audience this document has been written for hardware and software engineers who want to design or develop products based on the ARM946E-S processor. it assumes no prior knowledge of arm products. using this manual this document is organized into the following chapters: chapter 1 introduction this chapter provides an introduction to the ARM946E-S processor. chapter 2 programmer?s model this chapter describes the programmer ? s model of the ARM946E-S processor and includes a summary of the ARM946E-S coprocessor registers. chapter 3 caches this chapter describes the ARM946E-S cache implementation. chapter 4 protection unit this chapter describes the ARM946E-S memory protection unit. chapter 5 tightly-coupled memory interface this chapter describes the requirements and operation of the tightly-coupled memory (tcm). chapter 6 bus interface unit and write buffer this chapter describes the operation of the bus interface unit and write buffer. chapter 7 coprocessor interface this chapter describes the coprocessor interface and the operation of common coprocessor instructions. chapter 8 etm interface this chapter describes the etm interface, including details of how to enable the interface.
preface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. xv chapter 9 debug support this chapter describes the debug support for the ARM946E-S processor and the embeddedice-rt logic. chapter 10 test support this chapter describes the test methodology used for the ARM946E-S synthesized logic and memory. appendix a ac parameters this appendix describes the timing parameters applicable to the ARM946E-S processor. appendix b signal descriptions this appendix describes the signals used in the ARM946E-S processor. product revision status the r n p n identifier indicates the revision status of the product described in this document, where: r n identifies the major revision of the product. p n identifies the minor revision or modification status of the product. typographical conventions the following typographical conventions are used in this document: bold highlights arm processor signal names within text, and interface elements such as menu names. can also be used for emphasis in descriptive lists where appropriate. italic highlights special terminology, cross-references and citations. monospace denotes text that can be entered at the keyboard, such as commands, file names and program names, and source code. mono space denotes a permitted abbreviation for a command or option. the underlined text can be entered instead of the full command or option name. monospace italic denotes arguments to commands or functions where the argument is to be replaced by a specific value. monospace bold denotes language keywords when used outside example code.
preface xvi copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c timing diagram conventions this manual contains a number of timing diagrams. the following key explains the components used in these diagrams. any variations are clearly labeled when they occur. therefore, no additional meaning must be attached unless specifically stated. key to timing diagram conventions shaded bus and signal areas are undefined, so the bus or signal can assume any value within the shaded area at that time. the actual level is unimportant and does not affect normal operation. other conventions this document uses other conventions. they are described in the following sections: signals on page xvii bits, bytes, and word lengths on page xvii numbers on page xvii register fields on page xvii. clock bus stable high to low transient bus to high impedance bus change high/low to high high impedance to stable bus valid (correct) sampling point
preface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. xvii signals when a signal is described as being asserted, the level depends on whether the signal is active high or active low. asserted means high for active high signals and low for active low signals: prefix n active low signals are prefixed by a lowercase n except in the case of ahb or apb reset signals. these are named hresetn and presetn respectively. prefix h ahb signals are prefixed by an upper case h. prefix p apb signals are prefixed by an upper case p. bits, bytes, and word lengths suffix b indicates bits. suffix b indicates bytes. byte eight bits. halfword two bytes (16 bits). word four bytes (32 bits). quadword 16 contiguous bytes (128 bits). numbers suffix k indicates 1000. suffix k indicates an amount of memory. it means 1024. suffix m when used to indicate an amount of memory means 1024 2 = 1048576. when used to indicate a frequency means 1000000. prefix 0x indicates hexadecimal. prefix b indicates binary. register fields all reserved or unused address locations must not be accessed as this can result in unpredictable behavior of the device. all reserved or unused bits of registers must be written as zero, and ignored on read unless otherwise stated in the relevant text.
preface xviii copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c all registers bits are reset to logic 0 by a system reset unless otherwise stated in the relevant text. unless otherwise stated in the relevant text, all registers support read and write accesses. a write updates the contents of the register and a read returns the contents of the register. all registers defined in this document can only be accessed using word reads and word writes, unless otherwise stated in the relevant text. further reading this section lists publications by arm limited, and by third parties. if you would like further information on arm products, or if you have questions not answered by this document, please contact info@arm.com or visit our web site at http://www.arm.com . arm publications this document contains information that is specific to the ARM946E-S processor. you can refer to the following documents for other relevant information: arm architecture reference manual (arm ddi 0100) arm9e-s technical reference manual (arm ddi 0165) amba specification (arm ihi 0011). other publications this section lists relevant documents published by third parties: ieee std. 1149.1-1990, standard test access port and boundary-scan architecture .
preface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. xix feedback arm limited welcomes feedback both on the ARM946E-S processor, and on the documentation. feedback on the ARM946E-S processor if you have any comments or suggestions about this product, contact your supplier giving: the product name a concise explanation of your comments. feedback on the document if you have any comments about this document, send email to errata@arm.com giving: the document title the document number the page number(s) to which your comments refer a concise explanation of your comments. general suggestions for additions and improvements are also welcome.
preface xx copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 1-1 chapter 1 introduction this chapter introduces the ARM946E-S processor. it contains the following sections: about the ARM946E-S processor on page 1-2 ARM946E-S block diagram on page 1-3 differences between processor versions on page 1-5.
introduction 1-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 1.1 about the ARM946E-S processor the ARM946E-S is a synthesizable processor combining an arm9e-s ? processor core with a configurable memory system. it is a member of the arm9e ? family of high-performance, 32-bit system-on-chip processor solutions. the ARM946E-S is a harvard architecture cached processor that provides a complete high-performance processor subsystem, including: an arm9e-s risc integer cpu core featuring: ? armv5te 32-bit instruction set that has improved arm/thumb code interworking and an enhanced multiplier designed for improved dsp performance ? arm debug architecture with additional support for real-time debug. this enables critical exception handlers to execute while debugging the system. support for external tightly-coupled memory (tcm). a tcm interface is provided for each of the external instruction and data memory blocks. the size of both the instruction and data tcm blocks are implementor-specific and can range from 0kb to 1mb. instruction and data caches. the design can be easily modified to enable any combination of caches from 0kb to 1mb. a protection unit that enables the memory to be protected in a simple manner, ideal for embedded control applications. an amba ahb bus interface. the ARM946E-S processor interfaces to the rest of the system are through use of unified address and data buses. this interface is compatible with the amba ahb bus standard. support for external coprocessors enabling floating point or other application specific hardware acceleration to be added. for coprocessor support, the instruction and data buses are exported along with simple handshaking signals. support for the use of a scan test methodology for the standard cell logic and built-in-self-test (bist) for the tcm and caches. an interface to an external embedded trace macrocell (etm) to support real-time tracing of instructions and data. providing this complete high-frequency subsystem frees the system-on-a-chip designer to concentrate on design issues unique to their system. the synthesizable nature of the device eases integration into asic technologies. the ARM946E-S processor is targeted at a wide range of embedded applications where high-performance, low system cost, small die size, and low power are all important.
introduction arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 1-3 1.2 ARM946E-S block diagram the ARM946E-S block diagram is shown in figure 1-1. figure 1-1 ARM946E-S block diagram tightly-coupled memory interface ahb bus interface unit and write buffer arm9e-s ahb peripherals instruction data addr dout addr din system control coprocessor (cp15) external coprocessor interface etm interface etm system controller memory protection unit instruction cache data cache instruction cache control data cache control ia da wdata rdata instr coprocessors
introduction 1-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c the blocks shown in figure 1-1 on page 1-3 are described in the locations listed in table 1-1. table 1-1 location of block descriptions block location of description arm9e-s (rev 1) arm9e-s (rev 1) technical reference manual ahb bus interface unit and write buffer chapter 6 bus interface unit and write buffer tightly-coupled memory interface chapter 5 tightly-coupled memory interface system control coprocessor (cp15) chapter 2 programmer?s model external coprocessor interface chapter 7 coprocessor interface etm interface chapter 8 etm interface system controller chapter 2 programmer?s model memory protection unit chapter 4 protection unit instruction cache chapter 3 caches data cache chapter 3 caches instruction cache control chapter 2 programmer?s model and chapter 3 caches data cache control chapter 2 programmer?s model and chapter 3 caches
introduction arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 1-5 1.3 differences between processor versions the differences between the current version of the processor and rev 0 are as follows: tightly coupled memories are external to the macrocell. refer to chapter 5 tightly-coupled memory interface . the ahb interface is changed to improve the input timing. refer to chapter 6 bus interface unit and write buffer . the ahb interface is changed to generate busy cycles during access types. refer to chapter 5 tightly-coupled memory interface .
introduction 1-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-1 chapter 2 programmer ? s model this chapter describes the programmer ? s model for the ARM946E-S processor. it contains the following sections: about the ARM946E-S programmer ? s model on page 2-2 about the arm9e-s programmer ? s model on page 2-3 cp15 register map summary on page 2-4.
programmer?s model 2-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 2.1 about the ARM946E-S programmer ? s model the programmer ? s model for the ARM946E-S processor primarily consists of the arm9e-s core programmer ? s model (see about the arm9e-s programmer ? s model on page 2-3). additions to this model are required to control the operation of the ARM946E-S internal coprocessors, and any coprocessor connected to the external coprocessor interface. there are two internal coprocessors within the ARM946E-S processor: cp14 within the arm9e-s core enables software access to the debug communication channel cp15 enables configuration of the caches, tightly-coupled memory (tcm), protection unit, write buffer, and other ARM946E-S system options such as big or little-endian operation. the registers defined in cp14 are accessible with mcr and mrc instructions, and are described in the debug communication channel on page 9-29. the registers defined in cp15 are accessible with mcr and mrc instructions, and are described in cp15 register map summary on page 2-4. these instructions permit conditional access using the optional {cond} field. registers and operations provided by any coprocessors attached to the external coprocessor interface are accessible with appropriate coprocessor instructions.
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-3 2.2 about the arm9e-s programmer ? s model the arm9e-s core implements the armv5te architecture, which includes the 32-bit arm instruction set and the 16-bit thumb instruction set. for a description of both instruction sets, see the arm architecture reference manual . 2.2.1 data abort model the arm9e-s implements the base restored data abort model , which differs from the base updated data abort model implemented by arm7tdmi. the difference in the data abort model affects only a very small section of operating system code, the data abort handler. it does not affect user code. with the base restored data abort model, when a data abort exception occurs during the execution of a memory access instruction, the base register is always restored by the processor hardware to the value the register contains before the instruction is executed. this removes the requirement for the data abort handler to repair any base register update that might have been specified by the aborted instruction. the base restored data abort model significantly simplifies the data abort handler software.
programmer ? s model 2-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 2.3 cp15 register map summary the ARM946E-S processor incorporates cp15 for system control. cp15 enables configuration of the caches, tightly-coupled memory (tcm), and protection unit. it also enables configuration of the ARM946E-S system options including big or little-endian operation. this section contains the following: accessing cp15 registers on page 2-6 register 0, id code register on page 2-7 register 0, cache type register on page 2-8 register 0, tightly-coupled memory size register on page 2-10 register 1, control register on page 2-12 register 2, cache configuration registers on page 2-16 register 3, write buffer control register on page 2-16 register 5, access permission registers on page 2-17 register 6, protection region base and size registers on page 2-20 register 7, cache operations register on page 2-22 register 9, cache lockdown registers on page 2-26 register 9, tightly-coupled memory region registers on page 2-26. register 13, trace process identifier register on page 2-29 register 15, bist control registers on page 2-29 register 15, test state register on page 2-32 register 15, cache debug index register on page 2-33 register 15, trace control register on page 2-35. the register map for cp15 is shown in table 2-1 on page 2-5.
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-5 table 2-1 cp15 register map register read write 0 id code a unpredictable 0 cache type a a. register location provides access to more than one register. the register accessed depends on the value of the opcode_2 or crm field. see the register description for details. unpredictable 0 tightly-coupled memory size a unpredictable 1 control control 2 cache configuration b cache configuration b 3 write buffer control write buffer control 4 unpredictable unpredictable 5 access permission b access permission b 6 protection region base and size a protection region base and size a 7 unpredictable cache operations a 8 unpredictable unpredictable 9 cache lockdown ab cache lockdown ab 9 tightly-coupled memory region ab tightly-coupled memory region ab 10 unpredictable unpredictable 11 unpredictable unpredictable 12 unpredictable unpredictable 13 trace process id trace process id 14 unpredictable unpredictable 15 bist control a bist control a 15 test state a test state a 15 cache debug index a cache debug index a 15 trace control a trace control a
programmer ? s model 2-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 2.3.1 accessing cp15 registers table 2-2 shows the terms and abbreviations used in this section. in all cases, reading from, or writing any data values to any cp15 registers, including those fields specified as unpredictable or should be zero, does not cause any permanent damage. all cp15 register bits that are defined and contain state are set to 0 by hresetn unless otherwise stated in this chapter. cp15 registers can only be accessed with mrc and mcr instructions in a privileged mode. the instruction bit pattern of the mcr and mrc instructions is shown in figure 2-1 on page 2-7. b. separate registers for instruction and data. see the register description for details. table 2-2 cp15 terms and abbreviations term abbreviation description unpredictable unp for reads, the data returned when reading from this location is unpredictable. it can have any value. for writes, writing to this location causes unpredictable behavior, or an unpredictable change in device configuration. undefined und an instruction that accesses cp15 in the manner indicated takes the undefined instruction trap. should be zero sbz when writing to this location, all bits of this field should be 0. should be one sbo when writing to this location, all bits of this field should be 1.
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-7 figure 2-1 cp15 mrc and mcr bit pattern the assembler for these instructions is: mcr/mrc{cond} p15,opcode_1,rd,crn,crm,opcode_2 instructions cdp , ldc , and stc , along with unprivileged mrc and mcr instructions to cp15, cause the undefined instruction trap to be taken. the crn field of mrc and mcr instructions specifies the coprocessor register to access. the crm field and opcode_2 field specify a particular action when addressing registers. attempting to read from a nonreadable register, or writing to a nonwritable register causes unpredictable results. the opcode_1 , opcode_2 , and crm fields should be zero, except when the values specified are used to select the desired operations, in all instructions that access cp15. using other values results in unpredictable behavior. 2.3.2 register 0, id code register this is a read-only register that returns a 32-bit device id code. the id code register is accessed by reading cp15 register 0 with the opcode_2 field set to any value other than 1 or 2. for example: mrc p15, 0, rd, c0, c0, {0,3-7}; returns id register crm opcode_2 rd crn opcode_1 cond l 31 28 27 24 23 21 20 19 16 15 12 11 87 5 43 0 1 1 11 1 1110
programmer ? s model 2-8 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c the contents of the id code are shown in table 2-3. 2.3.3 register 0, cache type register this is a read-only register that contains information about the size and architecture of the instruction cache and data cache, enabling operating systems to establish how to perform operations such as cache cleaning and lockdown. future arm cached processors will contain this register, enabling rtos vendors to produce future-proof versions of their operating systems. the cache type register is accessed by reading cp15 register 0 with the opcode_2 field set to 1. for example: mcr p15,0,rd,c0,c0,1; returns cache details the format of the register is shown in table 2-4. table 2-3 register 0, id code register bits function value [31:24] implementor 0x41 [23:20] variant (reserved) 0x0 [19:16] arm architecture 5te 0x5 [15:4] primary part number 0x946 [3: 0] revision (major product revision) 0x1 table 2-4 cache type register format register bits function value [31:29] reserved b000 [28:25] cache type b0111 [24] harvard/unified b1 (defines harvard cache) [23:22] reserved b00 [21:18] data cache size implementation-specific [17:15] data cache associativity implementation-specific [14] data cache absent implementation-specific
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-9 bits [28:25] indicate which major cache class the implementation falls into. b0111 means that the cache provides: cache-clean-step operation cache-flush-step operation lock-down facilities. bits [21:18] give the data cache size. bits [9:6] give the instruction cache size. table 2-5 lists the meaning of values used for cache size encoding. [13:12] data cache words per line b10 (defines 8 words per line) [11:10] reserved b00 [9:6] instruction cache size implementation-specific [5:3] instruction cache associativity implementation-specific [2] instruction cache absent implementation-specific [1:0] instruction cache words per line b10 (defines 8 words per line) table 2-5 cache size encoding bits [21:18] and bits[9:6] cache size b0000 0kb b0011 4kb b0100 8kb b0101 16kb b0110 32kb b0111 64kb b1000 128kb b1001 256kb b1010 512kb b1011 1mb table 2-4 cache type register format (continued) register bits function value
programmer ? s model 2-10 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c bits [17:15] give the data cache associativity. bits [5:3] give the instruction cache associativity. table 2-6 lists the meaning of values used for cache associativity encoding. the cache associativity fields in the cache type register are implementation-specific (implementor-defined). therefore, if the implementation has an instruction or data cache, the associativity for that cache is set to b010 to indicate a four-way set associative cache. if either cache is not included in a specific implementation, then the associativity field for that cache is set to b000 to indicate that the cache is absent. bit 14 gives the data cache base size and bit 2 gives the instruction cache base size. the base size bits are implementation-specific. if the implementation has an instruction or data cache, the base size bit for that cache is set to 0, indicating that the cache type parameters are valid. if either cache is not included for a specific implementation, the relevant base size is set to 1, indicating that the cache is absent. the cache base size and cache size fields are generated within the cache blocks to avoid having to resynthesize the design for different cache sizes. 2.3.4 register 0, tightly-coupled memory size register this is a read-only register that returns the size of the instruction and data tightly-coupled memory (tcm) integrated with the ARM946E-S processor. the register contents reflect the state of input signals phyitcmsize[3:0] and phydtcmsize[3:0] . the tightly-coupled memory size register is accessed by reading cp15 register 0 with the opcode_2 field set to 2. for example: mrc p15, 0, rd, c0, c0, 2; returns tightly-coupled memory size register table 2-6 cache associativity encoding bits [17:15] and bits [5:3] associativity b000 direct mapped b010 4
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-11 the register contains information about the size of the instruction tcm and data tcm. the format of the register is shown in table 2-7. the memory size parameters are implementation-specific. the values used are generated within the memory blocks. this enables the memory size to be changed without having to re-synthesize the full design. bits [21:18] define the data tcm size. bits [9:6] define the instruction tcm size. table 2-8 shows the memory size field definitions for instruction and data tcm sizes. table 2-7 tightly-coupled memory size register register bits meaning value [31:22 ] reserved b0000000000 [21:18 ] data tcm size implementation-specific [17:15] reserved b000 [14 ] data tcm absent implementation-specific [13:10] reserved b0000 [9:6] instruction tcm size implementation-specific [5:3] reserved b000 [2] instruction tcm absent implementation-specific [1:0] reserved b00 table 2-8 memory size field bits [21:18] and bits [9:6] tcm size b0000 0kb b0011 4kb b0100 8kb b0101 16kb b0110 32kb b0111 64kb b1000 128kb
programmer ? s model 2-12 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c if the tcm is absent, then the relevant tcm absent bit (bit 14 or bit 2) in the tightly-coupled memory size register must be one. if tcm is present within the design, the relevant tcm absent bit should be zero. 2.3.5 register 1, control register this register contains the control bits of the ARM946E-S processor. all reserved bits must either be written with zero or one, as indicated, or written using read-modify-write. the reserved bits have an unpredictable value when read. to read and write this register: mrc p15, 0, rd, c1, c0, 0; read control register mcr p15, 0, rd, c1, c0, 0; write control register table 2-9 lists the functions controlled by register 1. b1001 256kb b1010 512kb b1011 1mb table 2-8 memory size field (continued) bits [21:18] and bits [9:6] tcm size table 2-9 register 1, control register register bits function [31:20] reserved (sbz) [19] instruction tcm load mode [18] instruction tcm enable [17] data tcm load mode [16] data tcm enable [15] disable loading tbit [14] round-robin replacement [13] alternate vector select [12] instruction cache enable [11:8] reserved (sbz)
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-13 the bits in the control register are described in this section. bit 19, instruction tcm load mode this bit controls the operation of the instruction tcm load mode. you can use the instruction tcm load mode for initializing the instruction tcm. the instruction tcm load mode enables you to load data into the ARM946E-S processor from either data cache or main memory, and then write to the same address but within the instruction tcm. this enables you to copy boot code from memory located at address 0x0 into the instruction tcm which, when enabled, also exists at address 0x0 . the operation of the load mode is described in initializing the instruction tcm on page 5-3. at reset this bit is cleared. bit 18, instruction tcm enable this bit controls operation of the instruction tcm. when the instruction tcm is enabled, all instruction and data accesses to the instruction tcm address range access the instruction tcm. at reset this bit takes the value of the input pin initram . bit 17, data tcm load mode this bit controls the operation of the data tcm load mode.you can use the data tcm load mode for initializing the data tcm. the data tcm load mode enables you to load data into arm registers from either data cache or main memory, and then write to the same address but within the data tcm. the operation of the load mode is described in initializing the data tcm on page 5-5. at reset this bit is cleared. [7] big-endian [6:3] reserved (sbo) [2] data cache enable [1] reserved (sbz) [0] protection unit enable table 2-9 register 1, control register (continued) register bits function
programmer ? s model 2-14 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c bit 16, data tcm enable this bit controls operation of the data tcm. when the data tcm is enabled, it takes precedence over the data cache and ahb for data accesses. at reset this bit is cleared. bit 15, disable loading tbit this bit controls the behavior of load pc instructions. when clear the armv5te-specific behavior is enabled, and bit 0 of the loaded data is used to control the entry into thumb state when the pc (r15) is the destination register. when set, this armv5te behavior is disabled. at reset this bit is cleared. bit 14, round-robin replacement this bit controls the cache replacement algorithm. when set, round-robin replacement is used. when clear, a pseudo-random replacement algorithm is used. at reset this bit is cleared. bit 13, alternate vectors select this bit controls the base address used for the exception vectors. when clear, the base address for the exception vectors is 0x00000000 . when set, the base address is 0xffff0000 . note this bit is initialized either set or clear during system reset, depending on the value of the input pin, vinithi . this enables you to define the exception vector location during reset to suit the boot mechanism of the application. you can then reprogram this bit as required following system reset.
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-15 bit 12, instruction cache enable caution you must not enable the instruction cache if your implementation is configured with zero size cache. enabling the instruction cache when no cache is present can lead to unpredictable behavior. controls the behavior of the instruction cache. to use the instruction cache, both the protection unit enable bit (bit 0) and the instruction cache enable bit must be set. this can be done with a single write to register 1. at reset this bit is cleared. bit 7, endian configuration selects the endian configuration of the ARM946E-S processor. when this bit is set, big-endian configuration is selected. when clear, little-endian configuration is selected. at reset this bit is cleared. bit 2, data cache enable caution you must not enable the data cache if your implementation is configured with zero size cache. enabling the data cache when no cache is present can lead to unpredictable behavior. this bit controls the behavior of the data cache. to use the data cache, both the protection unit enable bit (bit 0) and the data cache enable bit must be set. this can be done with a single write to register 1. at reset this bit is cleared. bit 0, protection unit enable this bit controls the operation of the ARM946E-S protection unit. at reset this bit is cleared. this disables the protection unit, and as a result disables the instruction and data caches and the write buffer. at least one protection region (see register 6, protection region base and size registers on page 2-20 and chapter 4 protection unit ) must be programmed before the protection unit is enabled.
programmer ? s model 2-16 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 2.3.6 register 2, cache configuration registers these registers contain the cachable attributes for the eight areas of memory. individual control is provided for the instruction and data caches. if the opcode_2 field is 0, then the data cache bits are programmed. if the opcode_2 field is 1, then the instruction cache bits are programmed. to read and write these registers: mrc p15, 0, rd, c2, c0, 0; read data cachable bits mrc p15, 0, rd, c2, c0, 1; read instruction cachable bits mcr p15, 0, rd, c2, c0, 0; write data cachable bits mcr p15, 0, rd, c2, c0, 1; write instruction cachable bits the format for the cachable bits in data and instruction areas is the same, and is given in table 2-10. 2.3.7 register 3, write buffer control register this register contains the write buffer control (bufferable) attribute for the eight areas of memory. note this register only applies to data accesses. to read and write the write buffer control register: mcr p15, 0, rd, c3, c0, 0; write data bufferable bits mrc p15, 0, rd, c3, c0, 0; read data bufferable bits table 2-10 programming instruction and data cachable bits register bits function [7] cachable bit (c_7) for area 7 [6] cachable bit (c_6) for area 6 [5] cachable bit (c_5) for area 5 [4] cachable bit (c_4) for area 4 [3] cachable bit (c_3) for area 3 [2] cachable bit (c_2) for area 2 [1] cachable bit (c_1) for area 1 [0] cachable bit (c_0) for area 0
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-17 the format for the bufferable bits in the data areas is given in table 2-11. 2.3.8 register 5, access permission registers there are four access permission registers. these contain the access permission bits for the instruction and data protection regions. the opcode_2 field of the mcr / mrc instruction determines whether the standard or extended registers are accessed, and if the instruction or data access permissions are accessed. to read and write the extended registers: mrc p15, 0, rd, c5, c0, 2; read data access permission bits mrc p15, 0, rd, c5, c0, 3; read instruction access permission bits mcr p15, 0, rd, c5, c0, 2; write data access permission bits mcr p15, 0, rd, c5, c0, 3; write instruction access permission bits the format for the access permission bits in instruction and data areas is the same, and is given in table 2-12. table 2-11 programming data bufferable bits register bits function [7] bufferable bit (b_7) for data area 7 [6] bufferable bit (b_6) for data area 6 [5] bufferable bit (b_5) for data area 5 [4] bufferable bit (b_4) for data area 4 [3] bufferable bit (b_3) for data area 3 [2] bufferable bit (b_2) for data area 2 [1] bufferable bit (b_1) for data area 1 [0] bufferable bit (b_0) for data area 0 table 2-12 programming instruction and data access permission bits (extended) register bits function [31:28] ap7[3:0] bits for area 7 [27:24] ap6[3:0] bits for area 6 [23:20] ap5[3:0] bits for area 5 [19:16] ap4[3:0] bits for area 4
programmer ? s model 2-18 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c the values of the iapn[3:0] and dapn[3:0] bits define the access permission for each area of memory, n. the encoding is shown in table 2-13. the following instructions are supported for backwards compatibility with existing arm processors with memory protection, and access the standard registers: mrc p15, 0, rd, c5, c0, 0; read data access permission bits mrc p15, 0, rd, c5, c0, 1; read instruction access permission bits mcr p15, 0, rd, c5, c0, 0; write data access permission bits mcr p15, 0, rd, c5, c0, 1; write instruction access permission bits [15:12] ap3[3:0] bits for area 3 [11:8] ap2[3:0] bits for area 2 [7:4] ap1[3:0] bits for area 1 [3:0] ap0[3:0] bits for area 0 table 2-13 access permission encoding (extended) i/dapn[3:0] access permission privileged user b0000 no access no access b0001 read/write access no access b0010 read/write access read-only b0011 read/write access read/write access b0100 unp unp b0101 read-only no access b0110 read-only read-only b0111 unp unp b1xxx unp unp table 2-12 programming instruction and data access permission bits (extended) register bits function
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-19 the data format for these registers is shown in table 2-14. the values of the iapn[1:0] and dapn[1:0] bits define the access permission for each area of memory, n. the encoding is shown in table 2-15. note on reset, the values of iapn and dapn bits are undefined. however, because on reset the protection unit is disabled, this is as though all areas are set to privileged mode read/write access and user read/write access. therefore, you must program the access permission registers before you enable the protection unit. table 2-14 instruction and data access permission bits (standard) register bits function [15:14] ap7[1:0] bits for area 7 [13:12] ap6[1:0] bits for area 6 [11:10] ap5[1:0] bits for area 5 [9:8] ap4[1:0] bits for area 4 [7:6] ap3[1:0] bits for area 3 [5:4] ap2[1:0] bits for area 2 [3:2] ap1[1:0] bits for area 1 [1:0] ap0[1:0] bits for area 0 table 2-15 access permission encoding (standard) i/dapn[1:0] access permission privileged user b00 no access no access b01 read/write access no access b10 read/write access read-only b11 read/write access read/write access
programmer ? s model 2-20 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c if the access permissions are initially programmed using the extended access permissions (see table 2-13 on page 2-18), and then reprogrammed using the standard access permissions (see table 2-15 on page 2-19), the access permissions applied are as if apn[3:2] are programmed to b00 in table 2-13 on page 2-18. 2.3.9 register 6, protection region base and size registers these registers define the protection region base address and size. you can define eight programmable regions using these registers. the values are ignored when the protection unit is disabled, and on reset only the region enable bit for each region is reset to 0. all other bits are undefined. you must program at least one memory region before you enable the protection unit. the instructions used to access the eight protection region base and size registers are listed in table 2-16. table 2-16 accessing protection region base and size registers arm instruction protection region base and size register mcr/mrc p15, 0, rd, c6, c7, 0 memory region 7 mcr/mrc p15, 0, rd, c6, c6, 0 memory region 6 mcr/mrc p15, 0, rd, c6, c5, 0 memory region 5 mcr/mrc p15, 0, rd, c6, c4, 0 memory region 4 mcr/mrc p15, 0, rd, c6, c3, 0 memory region 3 mcr/mrc p15, 0, rd, c6, c2, 0 memory region 2 mcr/mrc p15, 0, rd, c6, c1, 0 memory region 1 mcr/mrc p15, 0, rd, c6, c0, 0 memory region 0
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-21 each protection region base and size register has the format shown in table 2-17. you must align the region base to a region size boundary, where the region size is defined in its respective protection region register. the behavior is unpredictable if this is not done. region sizes are encoded as shown in table 2-18. table 2-17 protection region base and size register format register bits function [31:12] region base address [5:1] region size [0] 1 = region enable 0 = region disable reset to 0 table 2-18 region size encoding bit encoding region size b00000 to b01010 reserved (unp) b01011 4kb b01100 8kb b01101 16kb b01110 32kb b01111 64kb b10000 128kb b10001 256kb b10010 512kb b10011 1mb b10100 2mb b10101 4mb b10110 8mb
programmer ? s model 2-22 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c example base setting an 8kb size region aligned to an 8kb boundary at 0x00002000 (covering the address range 0x00002000 - 0x00003fff ) is programmed as 0x00002019 . the following instruction is supported for backward compatibility with other arm processors using a memory protection unit: mrc p15, 0, rd, c6, crm, 1; returns protection region register this instruction enables the protection region registers to be read. you must not write to the protection region base and size registers with opcode_2 set to 1 because the behavior is unpredictable. 2.3.10 register 7, cache operations register you can use a write to this register to perform the following operations: flush instruction cache and data cache prefetch an instruction cache line wait for interrupt drain the write buffer clean and flush the data cache. b10111 16mb b11000 32mb b11001 64mb b11010 128mb b11011 256mb b11100 512mb b11101 1gb b11110 2gb b11111 4gb table 2-18 region size encoding (continued) bit encoding region size
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-23 the ARM946E-S processor uses a subset of the arm architecture v4 functions (defined in the arm architecture reference manual ). the available operations are summarized in table 2-19. the data format for index and segment operations is shown in figure 2-2. figure 2-2 register 7, index and segment format table 2-19 cache operations arm instruction function value mcr p15, 0, rd, c7, c5, 0 flush instruction cache sbz a a. the value transferred in rd should be zero. mcr p15, 0, rd, c7, c5, 1 flush instruction cache single entry address mcr p15, 0, rd, c7, c13, 1 prefetch instruction cache line address mcr p15, 0, rd, c7, c6, 0 flush data cache sbz a mcr p15, 0, rd, c7, c6, 1 flush data cache single entry address mcr p15, 0, rd, c7, c10, 1 clean data cache entry address mcr p15, 0, rd, c7, c14, 1 clean and flush data cache entry address mcr p15, 0, rd, c7, c10, 2 clean data cache entry index and segment mcr p15, 0, rd, c7, c14, 2 clean and flush data cache entry index and segment segment should be zero index sbz n+1 n 54 0 31 30 29
programmer ? s model 2-24 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c the size of the index (n:5) varies depending on the implemented cache size. table 2-20 shows how the index size changes for the cache sizes supported by the ARM946E-S processor. for the instruction cache prefetch operation, the data format is shown in figure 2-3. figure 2-3 instruction cache address format cache clean and flush operations cache clean and flush operations can occur during instruction and data linefetches. in such circumstances the linefetch completes before the clean or flush operation is executed. drain write buffer this operation stalls instruction execution until the write buffer is emptied. this is useful in real-time applications where the processor must be sure that a write to a peripheral has completed before program execution continues. an example is where a table 2-20 index fields for supported cache sizes cache size index 4kb [9:5] 8kb [10:5] 16kb [11:5] 32kb [12:5] 64kb [13:5] 128kb [14:5] 256kb [15:5] 512kb [16:5] 1mb [17:5] sbz address 54 0 31
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-25 peripheral in a bufferable region is the source of an interrupt. when the interrupt has been serviced, the request must be removed before interrupts can be re-enabled. this is ensured if a drain write buffer operation separates the store to the peripheral and the enable interrupt functions. the drain write buffer operation is invoked by a write to register 7 using the following arm instruction: mcr p15, 0, rd, c7, c10, 4; drain write buffer this stalls the processor core until any outstanding accesses in the write buffer are completed, that is, until all data is written to external memory. wait for interrupt this operation enables the ARM946E-S processor to enter a low-power standby mode. when you invoke this operation, the processor core is halted and the cache and tcms are placed in a low-power state until either an interrupt or a debug request occurs. this function is invoked by a write to register 7. the following arm instruction causes this to occur: mcr p15, 0, rd, c7, c0, 4; wait for interrupt this is the preferred encoding for new software. for compatibility with existing software, the ARM946E-S processor also supports the following arm instruction that has the same affect: mcr p15, 0, rd, c15, c8, 2; wait for interrupt this stalls the processor from the time that this instruction is executed until either nfiq , nirq , or edbgrq are asserted. also, if the debugger sets the debug request bit in the embeddedice-rt logic control register then this causes the wait for interrupt condition to terminate. in the case of nfiq and nirq , the processor operation continues regardless of whether the interrupts are enabled or disabled (that is, independent of the i and f bits in the processor cpsr). dbgen must be set (debug enabled) if this operation of edbgrq or of the debug request bit is required. if interrupts are enabled, the arm9e-s core is guaranteed to take the interrupt before executing the instruction after the wait for interrupt . if debug request is used to wake up the system, the processor enters debug state before executing any more instructions. the write buffer continues to drain until empty while the wait for interrupt operation is executing.
programmer ? s model 2-26 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 2.3.11 register 9, cache lockdown registers these registers enable you to lock down regions of the cache. to read and write these registers: mcr p15, 0, rd, c9, c0, 0; write data lockdown control mrc p15, 0, rd, c9, c0, 0; read data lockdown control mcr p15, 0, rd, c9, c0, 1; write instruction lockdown control mrc p15, 0, rd, c9, c0, 1; read instruction lockdown control the format of the register, rd , transferred during this operation is shown in table 2-21. lockdown is described in cache lockdown on page 3-12. 2.3.12 register 9, tightly-coupled memory region registers these registers enable you to modify the visible size of the tcms. you can either increase or decrease the size of the tcms from the physical sizes described in register 0 (see register 0, tightly-coupled memory size register on page 2-10). increasing the visible size of the tcms above the physical size enables aliasing within the tcm space. this feature is useful for debugging multitasking systems. there is a memory region register for each of the tcms: mrc p15, 0, rd, c9, c1, 0; read data tightly-coupled memory mcr p15, 0, rd, c9, c1, 0; write data tightly-coupled memory mrc p15, 0, rd, c9, c1, 1; read instruction tightly-coupled memory mcr p15, 0, rd, c9, c1, 1; write instruction tightly-coupled memory table 2-21 lockdown register format register bits function [31] load bit, dl/il [30:2] unp/sbz [1:0] cache segment, dindex, iindex
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-27 each tcm region register has the format shown in table 2-22. for a given number of aliases for the physical memory size (set in register 0), the area size is calculated in the following way: number of required aliases = x (where x is a power of 2) n = log 2 x (or 2 n = x) area size = physical size + n the encodings for the supported tcm area sizes are shown in table 2-23. table 2-22 tcm region register format register bits function [31:12] region base [5:1] area size minimum size = 4kb maximum size = 4gb (see table 2-23). [0] sbz table 2-23 tcm area size encoding bit encoding tcm area size b00011 4kb b00100 8kb b00101 16kb b00110 32kb b00111 64kb b01000 128kb b01001 256kb b01010 512kb b01011 1mb b01100 2mb b01101 4mb
programmer ? s model 2-28 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c you must align the region base to an area size boundary. the behavior is unpredictable if this is not done. the instruction tcm base address is fixed at 0x00000 . for the instruction tcm, the region base returns the value 0x00000 when read. when writing to the instruction tcm, you must set the region base to 0x00000 . writes with the region base set to any other value are unpredictable. at reset, the region base for both the instruction and data tcm region registers are cleared to 0x00000 . at reset, the area size for the instruction and data tcm region registers takes the value defined in the tcm size register (see register 0, tightly-coupled memory size register on page 2-10). you must program the data tcm region registers before you set the data tcm enable bit (bit 16) in register 1 (see register 1, control register on page 2-12). if this is not done, the data tcm resides at the same location resulting in unpredictable behavior. b01110 8mb b01111 16mb b10000 32mb b10001 64mb b10010 128mb b10011 256mb b10100 512mb b10101 1gb b10110 2gb b10111 4gb table 2-23 tcm area size encoding (continued) bit encoding tcm area size
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-29 note if the data tcm is located at the same address as the instruction tcm, then the instruction memory takes precedence for data accesses. if the data tcm is located at the same address as the instruction tcm, and the instruction tcm is in load mode, data accesses read from the data tcm and write to the instruction tcm. 2.3.13 register 13, trace process identifier register this register enables you to identify the currently executing process in multi-tasking environments using the real-time trace tools. the contents of this register are replicated on the etmprocid pins of the ARM946E-S processor. the following arm instructions are used for accessing the process id register: mrc p15, 0, rd, c13, c0, 1; read process id register mcr p15, 0, rd, c13, c0, 1; write process id register to support software written for other arm processors, the following instructions are also supported: mrc p15, 0, rd, c13, c1, 1; read process id register mcr p15, 0, rd, c13, c1, 1; write process id register the format of the register, rd , transferred during these operations is shown in figure 2-4. figure 2-4 process id format 2.3.14 register 15, bist control registers register 15 gives you access to the test features included within the ARM946E-S processor. memory bist operations are initiated by writes to this register. bist results and status are evaluated by reading this register. the formats of the tag bist control register, tcm bist control register, and the cache ram bist control register are the same. trace process identifier 0 31
programmer ? s model 2-30 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c the register map for cp15 register 15 bist-related instructions is shown in table 2-24. table 2-25 lists cp15 register 15 implementation-specific bist instructions. note it is recommended that you do not write application code that relies on the presence of the bist address and general registers. support for these registers in future versions of the ARM946E-S processor is not guaranteed. table 2-24 register 15, bist instructions register read write tag bist control register mrc p15, 0, rd, c15, c0, 1 mcr p15, 0, rd, c15, c0, 1 tcm bist control register mrc p15, 1, rd, c15, c0, 1 mcr p15, 1, rd, c15, c0, 1 cache ram bist control register mrc p15, 2, rd, c15, c0, 1 mcr p15, 2, rd, c15, c0, 1 table 2-25 register 15, implementation-specific bist instructions register read write instruction tag bist address register mrc p15, 0, rd, c15, c0, 2 mcr p15, 0, rd, c15, c0, 2 instruction tag bist general register mrc p15, 0, rd, c15, c0, 3 mcr p15, 0, rd, c15, c0, 3 data tag bist address register mrc p15, 0, rd, c15, c0, 6 mcr p15, 0, rd, c15, c0, 6 data tag bist general register mrc p15, 0, rd, c15, c0, 7 mcr p15, 0, rd, c15, c0, 7 instruction tcm bist address register mrc p15, 1, rd, c15, c0, 2 mcr p15, 1, rd, c15, c0, 2 instruction tcm bist general register mrc p15, 1, rd, c15, c0, 3 mcr p15, 1, rd, c15, c0, 3 data tcm bist address register mrc p15, 1, rd, c15, c0, 6 mcr p15, 1, rd, c15, c0, 6 data tcm bist general register mrc p15, 1, rd, c15, c0, 7 mcr p15, 1, rd, c15, c0, 7 instruction cache ram bist address register mrc p15, 2, rd, c15, c0, 2 mcr p15, 2, rd, c15, c0, 2 instruction cache ram bist general register mrc p15, 2, rd, c15, c0, 3 mcr p15, 2, rd, c15, c0, 3 data cache ram bist address register mrc p15, 2, rd, c15, c0, 6 mcr p15, 2, rd, c15, c0, 6 data cache ram bist general register mrc p15, 2, rd, c15, c0, 7 mcr p15, 2, rd, c15, c0, 7
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-31 the format of the bist control register is shown in table 2-26. note the pause and size bits of this register are not supported in all implementations. the bist size field determines the size of the bist operation. the value written to this field, n, is decoded as follows: bist size in bytes = 2 n+2 some examples are shown in table 2-27. table 2-26 bist control register bit definitions register bit meaning when written meaning when read [31: 21] instruction bist size instruction bist size [20] reserved (sbz) instruction bist complete flag [19] reserved (sbz) instruction bist fail flag [18] instruction bist enable instruction bist enable [17] instruction bist pause instruction bist pause [16] instruction bist run strobe instruction bist running flag [15: 5] data bist size data bist size [4] reserved (sbz) data bist complete flag [3] reserved (sbz) data bist fail flag [2] data bist enable data bist enable [1] data bist pause data bist pause [0] data bist run strobe data bist running flag table 2-27 bist size encodings examples instruction ram bist size [31:21] n size of test b000000 00001 (minimum) 1 8 bytes b000000 00100 4 64 bytes b000000 00111 7 512 bytes
programmer ? s model 2-32 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 2.3.15 register 15, test state register the register is accessed by: mcr p15, 0, rd, c15, c0, 0; write test state register mrc p15, 0, rd, c15, c0, 0; read test state register the bit assignments of the test state access register are shown in table 2-28. reading the test state register returns bits [12:0] in the least significant bits. the value returned in bits [31:13] is unpredictable. writing the test state register updates only bits [12:9]. in debug you must be able to execute code without causing linefills to update the caches, primarily to load new code into memory. this means that str instructions, if they hit the cache, must update the memory and the cache, and that for ldr instructions or instruction prefetches that miss, a linefill is not performed. bits [10:9] when set prevent the respective cache from performing a linefill on a cache miss. the memory mapping, as seen by the arm9e-s or by the programmer, is unchanged. this improves the performance of single-stepping when in debug. b000000 01000 8 1 kb b000000 01010 10 4 kb b000000 01111 15 128 kb b000000 11000 (maximum) 24 64 mb table 2-27 bist size encodings examples (continued) instruction ram bist size [31:21] n size of test table 2-28 test state register bit assignments register bits function [31:13] unpredictable (sbz) [12] disable data cache streaming [11] disable instruction cache streaming [10] disable data cache linefill [9] disable instruction cache linefill [8:0] reserved (sbz)
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-33 bits [12:11] when set prevent the respective cache from streaming data to the arm9e-s while the linefill is performed to the cache. the linefill still occurs, but the prefetched instruction or load data is returned to the core at the end of a linefill. 2.3.16 register 15, cache debug index register additional instructions and operations are required to support debug operations within the cache. instructions for the additional operations are listed in table 2-29. with the cache debug index register, you can access any location within the instruction or data cache. you must program this register before using any of the tag or cache read/write operations. the cache debug index register provides an index into the cache memories. the format of the index and segment data is shown in figure 2-5 on page 2-34. table 2-29 additional operations function data instruction write cp15 cache debug index register index and segment mcr p15, 3, rd, c15, c0, 0 read cp15 cache debug index register index and segment mrc p15, 3, rd, c15, c0, 0 instruction tag write data mcr p15, 3, rd, c15, c1, 0 instruction tag read data mrc p15, 3, rd, c15, c1, 0 data tag write data mcr p15, 3, rd, c15, c2, 0 data tag read data mrc p15, 3, rd, c15, c2, 0 instruction cache write data mcr p15, 3, rd, c15, c3, 0 instruction cache read data mrc p15, 3, rd, c15, c3, 0 data cache write data mcr p15, 3, rd, c15, c4, 0 data cache read data mrc p15, 3, rd, c15, c4, 0
programmer ? s model 2-34 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure 2-5 register 15, index and segment format the number of bits used in the index field varies depending on the implemented cache size. table 2-20 on page 2-24 shows how the index address field size changes for the cache sizes supported by the ARM946E-S processor. note for tag operations, the word address field in the cache debug register is ignored. the data format for the tag read/write operations is shown in figure 2-6. figure 2-6 data format tag read/write operations the number of bits used in the index and tag address fields vary depending on the implemented cache size. table 2-30 shows how the index and tag address field sizes change for the cache sizes supported by the ARM946E-S processor. 31 30 29 segment should be zero n+1 n index word address sbz 5 4 210 tag address index set dirty bits valid n+1 n 5 4 3 2 1 0 31 table 2-30 index fields for supported cache sizes cache size tag index 4kb [31:10] [9:5] 8kb [31:11] [10:5] 16kb [31:12] [11:5]
programmer ? s model arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 2-35 2.3.17 register 15, trace control register this register enables masking of etmfifofull during interrupts in the ARM946E-S processor. it enables you to determine whether nirq or nfiq interrupts take priority over etmfifofull to prevent the core being stalled if an interrupt is received when etmfifofull is asserted. access instructions for register 15 are shown in table 2-31 the bit assignments for this register are shown in table 2-32 on page 2-36. if bit 1 is 1, nirq interrupts do not re-enable the ARM946E-S processor if etmfifofull is asserted. if bit 2 is 1, nfiq interrupts do not re-enable the ARM946E-S processor if 32kb [31:13] [12:5] 64kb [31:14] [13:5] 128kb [31:15] [14:5] 256kb [31:16] [15:5] 512kb [31:17] [16:5] 1mb [31:18] [17:5] table 2-30 index fields for supported cache sizes (continued) cache size tag index table 2-31 trace control register register read write trace control register mrc p15, 1, rd, c15, c1, 0 mcr p15, 1, rd, c15, c1, 0
programmer ? s model 2-36 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c etmfifofull is asserted. when these bits are set to 0, etmfifofull does not stall the core during interrupts. bits [2:1] of this register are reset to 0 when hresetn is asserted. table 2-32 trace control register bit assignments register bits content [31:3] reserved (should be zero) [2] 1 = mask nfiq interrupts during trace 0 = do not mask nfiq interrupts during trace [1] 1 = mask nirq interrupts during trace 0 = do not mask nirq interrupts during trace [0] reserved (should be zero)
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 3-1 chapter 3 caches to reduce the effective memory access time, the ARM946E-S processor uses a cache controller, an instruction cache, and a data cache. this chapter describes the features and behavior of each of these blocks. it contains the following sections: about cache architecture on page 3-2 instruction cache on page 3-6 data cache on page 3-8 cache lockdown on page 3-12.
caches 3-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 3.1 about cache architecture the ARM946E-S processor incorporates instruction cache and data cache. you can tailor the size of these to suit individual applications. a range of different cache sizes is supported: 0kb 4kb 8kb 16kb 32kb 64kb 128kb 256kb 512kb 1mb. you can select the instruction cache and data cache sizes independently. the instruction cache and data cache are formed from synchronous sram, and have similar architectures. an example 8k cache is shown in figure 3-1 on page 3-3.
caches arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 3-3 figure 3-1 example 8kb cache the instruction cache and data cache are four-way set associative, with a cache line length of 8 words (32 bytes). each cache supports single-cycle read access. rdata 32 addr [31:0] addr [31:11] addr [10:5] addr [4:2] wdata 32 0 1 2 r o w s e t 3 s e t 2 s e t 0 w o r d w o r d w o r d w o r d w o r d w o r d w o r d w o r d 0 1 7 2 3 4 5 6 a d d r e s s t a g s e t 0 s e t 1 r a m 6 3
caches 3-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c each cache segment consists of a tag ram for storing the cache line address and a data ram for storing the instructions or data. during a cache access, all tag rams are accessed for the first nonsequential access, and the tag address is compared with the access address. if a match (or hit) occurs, the data from the segment is selected for return to the arm9e-s core. if none of the tags match (a miss), then external memory must be accessed. if the access is a buffered write then the write buffer is used. if a read access from a cachable memory region misses, new data is loaded into one of the four segments. this is an allocate on read-miss replacement policy. selection of the segment is performed by a segment counter that can be clocked in a pseudo-random manner, or in a predictable manner based on the replacement algorithm selected. critical or frequently accessed instructions or data can be locked into the cache by restricting the range of the replacement counter. you cannot replace locked lines. they remain in the cache until they are unlocked or flushed. note flushing the entire cache also flushes any locked-down code. if you want to preserve locked-down code, you must flush lines individually, avoiding the locked-down lines. the access address from the arm9e-s core can be split into four distinct segments: byte address (addr[1:0]) word address (addr[4:2]) index (cache line) address tag. table 3-1 shows how the number of bits in the index and tag fields change for the cache sizes supported by the ARM946E-S processor. table 3-1 tag and index fields for supported cache sizes cache size index tag 4kb addr[9:5] addr[31:10] 8kb addr[10:5] addr[31:11] 16kb addr[11:5] addr[31:12] 32kb addr[12:5] addr[31:13] 64kb addr[13:5] addr[31:14]
caches arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 3-5 for example, the access address is broken down as shown in figure 3-2 for a 4kb cache. figure 3-2 access address for a 4kb cache three additional bits are associated with each tag entry: valid bit this is set when the cache line has been written with valid data. only a valid line can return a hit during a cache lookup. on reset, all the valid bits are cleared. dirty bits these are associated with write operations in the data cache and are used to indicate that a cache line contains data that differs from data stored at the address in external memory. one bit is allocated for each half cache line. data can only be marked as dirty if it resides in a write-back protection region. 128kb addr[14:5] addr[31:15] 256kb addr[15:5] addr[31:16] 512kb addr[16:5] addr[31:17] 1mb addr[17:5] addr[31:18] table 3-1 tag and index fields for supported cache sizes (continued) cache size index tag byte word index tag 10 9 5 4 2 1 0 31
caches 3-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 3.2 instruction cache the ARM946E-S processor has a four-way set-associative instruction cache. you can choose the size of the instruction cache from any of the supported cache sizes. the instruction cache uses the physical address generated by the processor core. it uses a policy of allocate on read-miss , and is always reloaded one cache line (eight words) at a time, through the external interface. 3.2.1 enabling and disabling the instruction cache caution you must not enable the instruction cache if your implementation is configured with zero size instruction cache. enabling the instruction cache when no cache is present can lead to unpredictable behavior. you can enable the instruction cache by setting bit 12 of the cp15 control register. the cache is only enabled if the protection unit is already enabled, or if they are enabled simultaneously. when the instruction cache is enabled, a cachable read-miss places lines in the instruction cache. you can enable the instruction cache and protection unit simultaneously with a single write to the cp15 control register, although you must program at least one protection region before you enable the protection unit. you can lock critical or frequently accessed instructions into the instruction cache. 3.2.2 instruction cache operation when enabled, the instruction cache operation is additionally controlled by the cachable instruction (ci) bit stored in the protection unit. this selectively enables or disables caching for different memory regions. the ci bit affects instruction cache operation as follows: successful cache read data is returned to the core only if the ci bit is 1. unsuccessful cache read if the ci bit is 1, a linefetch of eight words is performed. the linefetch starts with the requested address aligned to an eight-word boundary (that is, the linefetch starts with word 0). if the ci bit is 0, a single-word external access is performed to fetch the requested instruction. the cache is not updated.
caches arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 3-7 you can disable the instruction cache by clearing bit 12 of the cp15 control register. this prevents all instruction cache look-ups and line fills, and forces all instruction fetches to be performed as single external accesses. 3.2.3 instruction cache validity the ARM946E-S processor does not support external memory snooping. therefore if you write self-modifying code, the instructions in the instruction cache can become incoherent with external memory. similarly, if you reprogram the protection regions, code might exist in the cache that should be in a noncachable region. in either of these cases you must flush the instruction cache. you can flush the entire instruction cache by software in one operation, or you can flush individual cache lines by writing to the cp15 cache operations register (register 7). the instruction cache is automatically flushed during reset. the instruction cache never has to be cleaned because its only source of data is from external memory. the arm9e-s core cannot write to the instruction cache, except using the cache debug index register. flushing the entire cache as shown in table 2-19 on page 2-23, you can flush the entire instruction cache using an mcr instruction. in this case, the contents of the arm register transferred to cp15 should be zero. you can use the following code segment to do this: mov r0, #0 ; clear r0 mcr p15, 0, r0, c7, c5, 0; flush entire icache note the use of r0 is arbitrary. flushing the entire cache also flushes any locked-down code. if you want to preserve locked down code, you must flush lines individually, avoiding the locked down lines. flushing a single cache line you can flush single cache lines. to do this, you must specify in rd the address to be flushed from the cache. you can use the following code segment to do this: ldr r0, =flushaddress ; load r0 with address flushaddress mcr p15, 0, r0, c7, c5, 1 ; flush single cache line
caches 3-8 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 3.3 data cache the ARM946E-S processor has a four-way set-associative data cache. you can choose the size of the data cache from any of the supported cache sizes. the data cache uses the physical address generated by the processor core. it uses an allocate on read-miss policy, and is always reloaded one cache line (eight words) at a time, through the external interface. the data cache supports both write-back and write-through modes. for data stores that hit in the data cache, in write-back mode the cache line is updated and the dirty bit associated with the half cache line updated is set. this indicates that the internal version of the data differs from that in external memory. in write-through mode, a store that hits in the data cache causes the cache line to be updated but not marked as dirty, because the data store is also written to the write buffer to keep the external memory consistent. in both write-back and write-through modes, a store that misses in the cache is sent to the write buffer. when a linefetch causes a cache line to be evicted from the data cache, the dirty bit for each half of the victim line is read and, if the half-line contains valid and dirty data, it is written back to the write buffer before the linefill replaces it. the cachable data (cd) and bufferable data (bd) bits control the behavior of the data cache. for this reason the protection unit must be enabled when the data cache is enabled. 3.3.1 enabling and disabling the data cache caution you must not enable the data cache if your implementation is configured with zero size data cache. enabling the data cache when no cache is present can lead to unpredictable behavior. you can enable the data cache by setting bit 2 of the cp15 control register. the cache is only enabled if the protection unit is already enabled, or is enabled simultaneously, although you must program at least one protection region before you enable the protection unit. you can disable the data cache by clearing bit 2 of the cp15 control register. the data cache is automatically disabled and flushed on reset. when the data cache is disabled, cache searches are prevented. this marks all data accesses as noncachable, forcing the ARM946E-S processor to perform external accesses. the write buffer control is still decoded from the bd and cd bits. the cd bit is forced to 0 (noncachable).
caches arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 3-9 3.3.2 operation of the bd and cd bits the cd bit determines whether data being read must be placed in the data cache and used for subsequent reads. typically, main memory is marked as cachable to reduce memory access time and therefore increase system performance. it is usual to mark input/output space as noncachable. for example, if a processor is polling a memory-mapped register in input/output space, it is important that the processor is forced to read data direct from the peripheral, and not a copy of initial data held in the data cache. the bd and cd bits affect writes that both hit and miss in the data cache. if the bd and cd bits are both 1, the area of memory is marked as write-back, and stores that hit in the data cache only update the cache, not external memory. if the bd bit is 0 and the cd bit is 1, the area of memory is marked as write-through, and stores that hit in the data cache update both the cache and external memory. 3.3.3 data cache operation when the data cache is enabled, it is searched when the processor performs a load or store. if the cache hits on a load, data is returned from the cache if the cd bit is 1. if the cache read-misses, the cd bit is examined. the meaning of the values of the cd bit are shown in table 3-2. stores that hit in the cache update the cache line if the cd bit is 1. stores that miss the cache use the cd and bd bits to determine whether the write is buffered. a write miss is not loaded into the cache as a result of that miss. load and store multiples are broken up on 4kb boundaries (the minimum protection region size), enabling a protection check to be performed in case the load multiple ( ldm ) or store multiple ( stm ) crosses into a region with different protection properties. table 3-2 meaning of cd bit values cd bit value meaning 1 cachable data area and protection unit enabled. a linefill of eight words is performed and the data is written into the data cache. 0 a single or multiple external access is performed and the cache is not updated.
caches 3-10 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 3.3.4 data cache validity the ARM946E-S processor does not support memory translation so you can always consider the data in the data cache as valid within the context of the ARM946E-S processor. however, if you use external memory translation, and the mappings are changed, the data cache is no longer consistent with external memory, and you must flush it. the ARM946E-S processor does not support external memory snooping. any shared data memory space therefore, must not be cachable. additionally, if you reprogram the data protection regions, data already in the cache might now be in a noncachable region, and you must flush it. 3.3.5 data cache clean and flush the data cache has flexible cleaning and flushing utilities that enable the following operations: you can invalidate the whole data cache ( flush data cache ) in one operation without writing back dirty data. you can invalidate individual lines without writing back any dirty data ( flush data cache single entry ). you can perform cleaning on a line-by-line basis. the data is only written back through the write buffer when a dirty line is encountered, and the cleaned line remains in the cache ( clean data cache single entry ). you can clean cache lines using either their index within the data cache, or their address within memory. you can clean and flush individual lines in one operation, using either their index within the data cache, or their address within memory. you perform the cleaning and flushing operations using cp15 register 7, in a similar way to the instruction cache. the format of rd transferred to cp15 for all register 7 operations is shown in figure 3-3. figure 3-3 register 7, rd format segment should be zero index sbz n+1 n 54 0 31 30 29
caches arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 3-11 the value of n is dependent on the cache size, as shown in table 3-3. the value of n is derived from the following equation: where the number of sets x the line length in bytes is 128. it is usual to clean the cache before flushing it, so that external memory is updated with any dirty data. the following code segment shows how you can clean and flush the entire cache (assuming a 4kb data cache): mov r1, #0 ; initialize segment counter outer_loop mov r0, #0 ; initialize line counter inner_loop orr r2, r1, r0 ; generate segment and line address mcr p15, 0, r2, c7, c14, 2 ; clean and flush the line add r0, r0, #0x20 ; increment to next line cmpr0, #0x400 ; complete all entries in one segment? bne inner_loop ; if not branch back to inner_loop add r1, r1, #0x40000000 ; increment segment counter cmpr1, #0x0 ; complete all segments bne outer_loop ; if not branch back to outer_loop ; end of routine table 3-3 calculating index addresses cache size value of n 4kb 9 8kb 10 16kb 11 32kb 12 64kb 13 128kb 14 256kb 15 512kb 16 1mb 17 number of sets x line length in by tes cache size +4 n=log 2 ()
caches 3-12 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 3.4 cache lockdown to provide predictable code behavior in embedded systems, a mechanism is provided for locking code into the caches. for example, you can use this feature to hold high-priority interrupt routines where there is a hard real-time constraint, or to hold the coefficients of a dsp filter routine to reduce external bus traffic. you can lock down a region of the instruction cache or data cache by executing a short software routine, taking note of these requirements: the program must be held in a noncachable area of memory the cache must be enabled and interrupts must be disabled software must ensure that the code or data to be locked down is not already in the cache if the caches have been used after the last reset, the software must ensure that the cache in question is cleaned, if appropriate, and then flushed. you can carry out lockdown in the data cache using cp15 register 9. instruction cache lockdown uses both cp15 registers 7 and 9. as described in about cache architecture on page 3-2, the ARM946E-S instruction cache and data cache each comprise four segments. you can perform lockdown with a granularity of one segment. lockdown starts at segment zero, and can continue until three of the four segments are locked. 3.4.1 locking down the caches the procedures for locking down a segment in the instruction cache and data cache are slightly different. in both cases you must: 1. put the cache into lockdown mode by programming register 9. 2. force a linefill. 3. lock the corresponding data in the cache. data cache lockdown for the data cache: 1. write to cp15 register 9, setting dl to 1 (dl is bit 31, the load bit) and dindex to 0 (dindex are bits 1:0, the cache segment bits). 2. initialize the pointer to the first of the words to be locked into the cache.
caches arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 3-13 3. execute an ldr from that location. this forces a linefill from that location and the resulting eight words are captured in the cache. 4. increment the pointer by 32 (number of bytes in a cache line). 5. execute an ldr from that location. the resulting linefill is captured in the cache. 6. repeat steps 4 and 5 until all words are loaded in the cache, or one quarter of the cache has been loaded. 7. write to cp15 register 9, setting dl to 0 and dindex to 1. if there is more data to lockdown, at the final step, the dl bit must be left set and the process repeated. the dl bit must only be cleared when all the lockdown data has been loaded. the dindex bits must be set to the next available segment. note the write to cp15 register 9 must not be executed until the linefill has completed. this is achieved by aligning the ldr to the last address of the line. instruction cache lockdown for the instruction cache: 1. write to cp15 register 9, setting il to 1 (the load bit) and iindex to 0 (the cache segment bits). 2. initialize the pointer to the first of the words to be locked into the cache. 3. force a linefill from that location by writing to cp15 register 7 (instruction cache preload). 4. increment the pointer by 32 (number of bytes in a cache line). 5. force a linefill from that location by writing to cp15 register 7. the resulting linefill is captured in the instruction cache. 6. repeat steps 4 and 5 until all words are loaded in the cache, or one quarter of the cache has been loaded. 7. write to cp15 register 9, setting il to 0 and iindex to 1. if there are more instructions to lockdown, at the final step, the il bit must be left set and the process repeated. the il bit must only be cleared when all the lockdown instructions have been loaded. the iindex bits must be set to the next available segment.
caches 3-14 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c the only significant difference between the sequence of operations for the data cache and instruction cache is that an mcr instruction must be used to force the linefill in the instruction cache, instead of an ldr . the rest of the sequence is the same as for data cache lockdown. the mcr to perform the instruction cache fetch is a cp15 register 7 operation: mcr p15, 0, rd, c7, c13, 1 example instruction cache lockdown subroutine a subroutine that you can use to lock down code in the instruction cache is: ; subroutine lock_i_cache ; r1 contains the start address ; r2 contains the end address ; assumes that r2 - r1 fits within one cache set ; the subroutine performs a lockdown of instructions in the ; icache ; it first reads the current lock_down index and then locks ; down the number of sets required ; note - this subroutine must be located in a noncachable ; region of memory ; - interrupts must be disabled ; - subroutine must be called using the bl instruction ; - r1-r3 can be corrupted in line with arm/thumb ; procedure call standards (atpcs) ; - returns final icache lockdown index in r0 if successful ; - returns 0xffffffff in r0 if an error occurred lock_i_cache bic r1, r1, #0x7f ;align address to cache line mrc p15, 0, r3, c9, c0, 1 ;get current icache index and r3, r3, #0x3 ;mask unwanted bits cmpr3, #0x3 ;check for available set beq error ;if no sets available, ;generate an error orr r3, r3, #0x8000000 ;set the lockdown bit mcr p15, 0, r3, c9, c0, 1 ;write lockdown register lock_loop mcr p15, 0, r1, c7, c13, 1 ;force an instruction fetch ;from address r1 add r1, r1, #0x20 ;increment address by a ;cache line length cmpr2, r1 ;reached our end address yet? blt lock_loop ;if not, repeat loop add r3, r3, #0x1 ;increment icache index bic r0, r3, #0x8000000 ;clear lockdown bit and
caches arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 3-15 ;write index into r0 mcr p15, 0, r3, c9, c0, 1 ;write lockdown register mov pc, lr ;return from subroutine error mvn r0, #0 ;move 0xffffffff into r0 mov pc, lr ;return from subroutine
caches 3-16 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 4-1 chapter 4 protection unit this chapter describes the ARM946E-S protection unit. it contains the following sections: about the protection unit on page 4-2 memory regions on page 4-3 overlapping regions on page 4-6.
protection unit 4-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 4.1 about the protection unit the protection unit enables you to partition memory and set individual protection attributes for each protection region. you can divide the address space into eight regions of variable size. figure 4-1 shows a simplified block diagram of the protection unit. figure 4-1 protection unit the protection unit is programmed using cp15 registers 1, 2, 3, 5, and 6 (see accessing cp15 registers on page 2-6). 4.1.1 enabling the protection unit before the protection unit is enabled, you must program at least one valid protection region. if you do not do this the ARM946E-S processor can enter a state that is recoverable only by reset. setting bit 0 of the cp15 register 1, the control register, enables the protection unit. when the protection unit is disabled, all instruction fetches are noncachable and all data accesses are noncachable and nonbufferable. address comparators hit priority encoder attribute registers attributes abort address from arm9e-s
protection unit arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 4-3 4.2 memory regions you can partition the address space into a maximum of eight regions. each region is specified by the following: region base address region size cache and write buffer configuration read and write access permissions. the arm architecture uses constants known as inline literals to perform address calculations. these constants are automatically generated by the assembler and compiler and are stored inline with the instruction code. to ensure correct operation, you must define an area of memory, from where code is to be executed, that enables both data and instruction accesses. the base address and size properties are programmed using cp15 register 6. the format for this is shown in table 4-1. 4.2.1 region base address the base address defines the start of the memory region. you must align this to a region-sized boundary. for example, if a region size of 8kb is programmed for a given region, the base address must be a multiple of 8kb. note if the region is not aligned correctly, this results in unpredictable behavior. table 4-1 protection register format register bits function [31:12] region base address [11:6] unused [5:1] region size [0] region enable reset to disable (0).
protection unit 4-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 4.2.2 region size the region size is specified as a five-bit value, encoding a range of values from 4kb to 4gb. the encoding is shown in table 4-2. table 4-2 region size encoding bit encoding area size b00000 to b01010 reserved b01011 4kb b01100 8kb b01101 16kb b01110 32kb b01111 64kb b10000 128kb b10001 256kb b10010 512kb b10011 1mb b10100 2mb b10101 4mb b10110 8mb b10111 16mb b11000 32mb b11001 64mb b11010 128mb b11011 256mb b11100 512mb b11101 1gb b11110 2gb b11111 4gb
protection unit arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 4-5 note any value less than b01011 programmed in cp15 register 6 bits [5:1] results in unpredictable behavior. 4.2.3 partition attributes each region has a number of attributes associated with it. these control how a memory access is performed when the processor core issues an address that falls within a given region. the attributes are: cachable bufferable (for data regions only) read/write permissions. you specify this information by programming cp15 registers 2, 3, and 5 (see chapter 2 programmer ? s model ). if an access fails its protection check (for example, if a user mode application attempts to access a privileged mode access only region), a memory abort occurs. the processor enters the abort exception mode, branching to the data abort or prefetch abort vector accordingly. the cachable and bufferable bits in cp15 registers 2 and 3 are used together to select one of four cache and write buffer configurations. these are described in chapter 6 bus interface unit and write buffer , and specifically in the write buffer on page 6-14.
protection unit 4-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 4.3 overlapping regions you can program the protection unit with two or more overlapping regions. when overlapping regions are programmed, a fixed priority scheme is applied to determine the overlapping region attribute that is applied to the memory access (attributes for region 7 take highest priority, those for region 0 take lowest priority). for example: region 2 is programmed to be 4kb in size, starting from address 0x3000 with dapn[3:0] set to b0010. (privileged mode full access, user mode read only.) region 1 is programmed to be 16kb in size, starting from address 0x0000 with dapn[3:0] set to b0001. (privileged mode access only.) when the processor performs a data write to address 0x3010 while in user mode, the address falls into both region 1 and region 2, as shown in figure 4-2. because there is a clash, the attributes associated with region 2 are applied. because you are only enabled to perform reads from this region, a data abort occurs. figure 4-2 overlapping memory regions 4.3.1 background regions overlapping regions increase the flexibility of how the eight regions can be mapped onto physical memory devices in the system. you can also use the overlapping properties to specify a background region. for example, you might have a number of physical memory areas sparsely distributed across the 4gb address space. if a programming error occurs therefore, it might be possible for the processor to issue an address that does not fall into any defined region. region 2 region 1 0x4000 0x0000 0x3000 0x3010
protection unit arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 4-7 if the address issued by the processor falls outside any of the defined regions, the ARM946E-S protection unit is hard-wired to abort the access. you can override this behavior by programming region 0 to be a 4gb background region. in this way, if the address does not fall into any of the other seven regions, the access is controlled by the attributes you have specified for region 0.
protection unit 4-8 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 5-1 chapter 5 tightly-coupled memory interface this chapter describes the tightly-coupled memory (tcm) interface in the ARM946E-S processor. it contains the following sections: ARM946E-S tcm interface description on page 5-2 using cp15 control register on page 5-3 enabling the instruction tcm during soft reset on page 5-7 data tcm accesses on page 5-8 instruction tcm accesses on page 5-9. for details of the arm9e-s interface signals referenced in this chapter, see the arm9e-s technical reference manual .
tightly-coupled memory interface 5-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 5.1 ARM946E-S tcm interface description the instruction and data tightly-coupled memories (tcms) are placed outside the ARM946E-S processor boundary. this enables greater flexibility in the memory attached to the ARM946E-S processor. the memories used must support single-cycle accesses from the ARM946E-S processor. they must be capable of returning data to the arm9e-s core in a single cycle. this requirement applies to both the instruction tcm and data tcm. they are normally realized using synchronous sram.the instruction tcm and data tcm can both be of any size from 0 bytes to 1mb, although to ease implementation the size must be an integer power of two. the minimum size for a tcm when present is 4kb. the instruction tcm and data tcm can have different sizes. to enable the instruction tcm to be initialized, and for access to literal tables during execution, the data interface of the arm9e-s core must be able to access the instruction tcm. this means that the ARM946E-S processor must multiplex the instruction and data addresses before entering the instruction tcm. it also means that the instruction data is routed to both the instruction and data interfaces of the core. see instruction tcm accesses on page 5-9 for details of this data and address multiplexing. figure 5-1 shows a typical tcm read cycle. the enable signal, tcmen , is either itcmen or dtcmen , depending on whether instruction or data memory is being accessed. the tcm interface signals are described in tcm interface signals on page b-4. figure 5-1 tcm read cycle the instruction tcm is located at address 0x00000000 in the memory map. this simplifies the implementation of the design by removing the requirement for complex address comparators on both the instruction and data interfaces of the arm9e-s core to generate the chip select logic for the instruction tcm. d00 tcmrdata[31:0] addr 0 tcmadrs[17:0] tcmen clk sram access time
tightly-coupled memory interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 5-3 5.2 using cp15 control register when out of reset, the behavior of the tcm is controlled by the state of the cp15 control register. 5.2.1 enabling the instruction tcm you can enable the instruction tcm by setting bit 18 of the cp15 control register. you must use read-modify-write to access this register to preserve the contents of the bits not being modified. see register 1, control register on page 2-12 for details of how to read and write the cp15 control register. when you have enabled the instruction tcm, all future arm9e-s instruction fetches and data accesses to the instruction tcm address space cause the instruction tcm to be accessed. enabling the instruction tcm greatly increases the performance of the ARM946E-S processor because the majority of accesses to it can be performed with no stall cycles. accessing the ahb however, can cause several stall cycles for each access.you must take care to ensure that the instruction tcm is appropriately initialized before it is enabled and used to supply instructions to the arm9e-s core. if the core tries to execute instructions from uninitialized instruction tcm, the behavior is unpredictable. 5.2.2 disabling the instruction tcm you can disable the instruction tcm by clearing bit 18 of the cp15 control register. see register 1, control register on page 2-12 for details of how to read and write the cp15 control register. when you have disabled the instruction tcm, all future arm9e-s instruction fetches access the ahb.the contents of the memory are preserved when it is disabled. if it is re-enabled, accesses to previously initialized memory locations return the preserved data. 5.2.3 defining the physical and visible size of the instruction tcm you can determine the physical size of the instruction tcm by using cp15 register 0. see register 0, tightly-coupled memory size register on page 2-10 for more details. you can determine the visible size of the instruction tcm by using cp15 register 9. see register 9, tightly-coupled memory region registers on page 2-26 for more details. 5.2.4 initializing the instruction tcm you must initialize the instruction tcm with the required code image before execution from the instruction tcm. you can initialize the instruction tcm by writing to the memory from the arm9e-s core data interface.
tightly-coupled memory interface 5-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c the instruction tcm load mode enables this to be done in an efficient manner. using the load mode enables you to copy from an address in the data cache or external memory into the same address within the instruction tcm. the instruction tcm load mode bit of cp15 register 1 inhibits reads from the instruction tcm, forcing reads from addresses that are within the instruction tcm address range to access either main memory, or the data cache. writes to addresses that are within the instruction tcm range are not affected by the instruction tcm load mode bit. the procedure for initializing the instruction tcm using the load tcm mode is: 1. enable the instruction tcm and instruction load mode. 2. load arm registers from main memory, data cache, or data tcm. 3. store arm registers into instruction tcm. 4. increment address pointers and repeat load/store steps until the code image has been copied. a suggested assembler code sequence for this procedure is: mov r0, #0 ; initialize pointer ldr r1, =imagetop ; define end of code image mrc p15, 0, r2, c1, c0, 0 ; read control register orr r2, r2, #&c0000 mcr p15, 0, r2, c1, c0, 0 ; enable instruction tcm and load mode copyloop ldmia r0, {r2 - r9} ; load 8 registers from main memory stmia r0!, {r2 - r9} ; store 8 regs into instruction tcm cmp r1, r0 ; check if limit reached bgt copyloop ; repeat if more to do swp and swpb operations to the instruction tcm when it is in load mode have unpredictable results. this is because the read accesses external memory or the data cache, and the write updates the instruction tcm. swp and swpb operations must not be performed to addresses in the instruction tcm space when it is in load mode. 5.2.5 enabling the data tcm you can enable the data tcm by setting bit 16 of the cp15 control register. see cp15 register map summary on page 2-4 for details of how to read and write this register. when you have enabled the data tcm all future read and write accesses to the data tcm address space cause the data tcm to be accessed.
tightly-coupled memory interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 5-5 5.2.6 disabling the data tcm you can disable the data tcm by clearing bit 16 of the cp15 control register. when you have disabled the data tcm all future reads and writes to the data tcm address space access the ahb. read and write accesses to instruction tcm address space either use the instruction tcm or access the ahb depending on whether instruction tcm is enabled or not. 5.2.7 defining the physical and visible size of the data tcm you can determine the physical size of the data tcm by using cp15 register 0. see register 0, tightly-coupled memory size register on page 2-10 for more details. you can determine the visible size of the data tcm by using cp15 register 9. see register 9, tightly-coupled memory region registers on page 2-26 for more details. using cp15 register 9, you must ensure the base address of the data tcm is a value other than 0x0 . 5.2.8 initializing the data tcm you must initialize the data tcm with the required data image before use. you can initialize the data tcm by writing to the memory from the arm9e-s core data interface. the data tcm load mode enables this to be done in an efficient manner. using the load mode enables you to copy from an address in the data cache or external memory into the same address within the data tcm. the data tcm load mode bit of cp15 register 1 inhibits reads from the data tcm, forcing reads from addresses that are within the data tcm address range to access either main memory or the data cache. writes to addresses that are within the data tcm range are not affected by the data tcm load mode bit. to initialize the data tcm using the load mode: 1. enable the data tcm and data tcm load mode. 2. load arm registers from main memory or data cache. 3. store arm registers into data ram. 4. increment address pointers and repeat the load and store steps until the data image has been copied. a suggested assembler code sequence for this procedure is:
tightly-coupled memory interface 5-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c ldr r0, #imagestart ; initialize pointer ldr r1, =imagetop ; define end of data space mrc p15, 0, r2, c1, c0, 0 ; read control register orr r2, r2, #&30000 mcr p15, 0, r2, c1, c0, 0 ; enable data tcm and load mode copyloop ldmia r0, {r2 - r9} ; load 8 registers from main memory stmia r0!, {r2 - r9} ; store 8 regs into data tcm cmp r1, r0 ; check if limit reached bgt copyloop ; repeat if more to do swp and swpb operations to the data tcm while it is in load mode have unpredictable results. this is because the read accesses external memory or the data cache, and the write updates the data tcm. swp and swpb operations must not be performed to addresses in the data tcm space while it is in load mode.
tightly-coupled memory interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 5-7 5.3 enabling the instruction tcm during soft reset following a soft reset, you can use the instruction tcm for the reset vector. this is achieved by using the initram signal. if asserted this signal enables the instruction tcm at reset. the address space allocated for the instruction tcm defaults to the physical size of the instruction tcm. to use the reset vector in the instruction tcm, the memory contents must be preserved during reset. the vinithi signal must be de-asserted so that the reset vector is located at address 0x00000000 .the initram signal does not affect the data tcm, which is disabled at reset.
tightly-coupled memory interface 5-8 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 5.4 data tcm accesses accesses to the data tcm do not incur stall cycles unless a write to the data tcm is completing. this access is shown in figure 5-2. figure 5-2 data write followed by data read of data tcm clk dnmreq dnrw da clken dtcmadrs dtcmrdata dtcmwdata dtcmen d0 d1 d0 d1 data 0 d(d1) data 0
tightly-coupled memory interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 5-9 5.5 instruction tcm accesses the instruction tcm provides deterministic behavior for time-critical operations, and is located at address 0x00000000 within the processor memory map.the instruction tcm is implemented using single port synchronous compiled memory. the protection unit does not have to be enabled for the instruction tcm to be used. if the protection unit is enabled then the access permissions programmed into the protection unit are applied to accesses to the instruction tcm. the instruction tcm can be accessed for either instruction fetches or data accesses (read and write) from the ARM946E-S processor. 5.5.1 instruction accesses to instruction tcm instruction accesses to the instruction tcm are single-cycle read accesses. no stall cycles are required for instruction accesses to the instruction tcm unless there is a data access completing. 5.5.2 data accesses to instruction tcm data accesses to the instruction tcm can either be reads or writes. data access to the instruction tcm can introduce stall cycles to the ARM946E-S processor. 5.5.3 stall cycles for instruction tcm accesses simultaneous instruction fetch and data reads of the instruction tcm incur a single stall cycle. this is because the instruction tcm is a single port memory, which can only return a single word of memory per clock cycle. this is shown in figure 5-3 on page 5-10.
tightly-coupled memory interface 5-10 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure 5-3 simultaneous instruction fetch and data read of instruction tcm a data write to the instruction tcm followed by a data read from the instruction tcm incurs a single stall cycle. this is because the memory requires that the write address is pipelined to be in-line with the write data. the read address cannot then be applied until the next cycle, so requiring the stall. this sequence is shown in figure 5-4. figure 5-4 data write followed by data read of instruction tcm clk dnmreq dnrw da clken itcmadrs itcmrdata d0 d1 i0 d0 d(i0) d(d0) inmreq ia i0 i1 clk dnmreq dnrw da clken itcmadrs itcmrdata itcmwdata itcmen d0 d1 d0 d1 data 0 d(d1) data 0
tightly-coupled memory interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 5-11 similarly, a data write operation followed by an instruction fetch incurs a stall cycle, as shown in figure 5-5. figure 5-5 data write followed by instruction fetch of instruction tcm a data read followed by an instruction fetch also requires a stall cycle. this stall is incurred as a result of the multiplexor switching being controlled by registered versions of the arm9e-s data memory interface. the stall is therefore inserted for the data read cycle rather than the instruction read. the sequence is shown in figure 5-6 on page 5-12. clk dnmreq dnrw da clken itcmadrs itcmrdata itcmwdata itcmen d0 d0 i1 data 0 d(i1) data 0 inmreq ia i1
tightly-coupled memory interface 5-12 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure 5-6 data read followed by instruction fetch simultaneous instruction fetch and data write incurs a single stall cycle because of the pipelining of the data access to the data address. the sequence is shown in figure 5-7. figure 5-7 simultaneous instruction fetch and data write clk dnmreq dnrw da clken itcmadrs itcmrdata itcmwdata itcmen d0 d0 i0 d(i0) inmreq ia i0 data 0 clk dnmreq dnrw da clken itcmadrs itcmrdata itcmwdata itcmen d0 i0 d0 data 0 inmreq ia i0 d(i0) data 0
tightly-coupled memory interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 5-13 a data write followed by a simultaneous instruction fetch and data read incurs two stall cycles. the first stall is caused by the write still being active when the instruction fetch begins. the second stall is caused by the two reads required. this is shown in figure 5-8. figure 5-8 data write followed by simultaneous instruction fetch and data read clk dnmreq dnrw da clken itcmadrs itcmrdata itcmwdata itcmen d0 d1 d0 i0 d1 d(i0) data 0 inmreq ia i0 data 0 d(d1)
tightly-coupled memory interface 5-14 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 6-1 chapter 6 bus interface unit and write buffer this chapter describes the ARM946E-S bus interface unit (biu) and write buffer. it contains the following sections: about the biu and write buffer on page 6-2 ahb bus master interface on page 6-3 noncached thumb instruction fetches on page 6-10 ahb clocking on page 6-11 the write buffer on page 6-14.
bus interface unit and write buffer 6-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 6.1 about the biu and write buffer the ARM946E-S processor supports the advanced microprocessor bus architecture (amba) advanced high-performance bus (ahb) interface. the ahb is a new generation of amba interface that addresses the requirements of high-performance synthesizable designs, including: single clock edge operation (rising edge) unidirectional (nontristate) buses burst transfers split transactions single-cycle bus master handover. see the amba rev 2.0 ahb specification for full details of this bus architecture. the ARM946E-S biu implements a fully-compliant ahb bus master interface and incorporates a write buffer to increase system performance. the biu is the link between the arm9e-s core with the caches and tightly-coupled memory (tcm) and the external ahb memory. the ahb memory must be accessed for cache linefills and for initializing the tcms, and to access code and data that are not within the cachable or tcm address regions. when an ahb access is performed, the biu and system controller handshake to ensure that the arm9e-s core is stalled until the access has been performed. if you are using the write buffer, you might be able to enable the core to continue program execution. the biu controls the write buffer and related stall behavior.
bus interface unit and write buffer arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 6-3 6.2 ahb bus master interface the ARM946E-S processor implements a fully compliant ahb bus master interface as defined in the amba rev 2.0 specification . see this document for a detailed description of the ahb protocol. note in all timing diagrams in this section, it is assumed that hclk is the same frequency as clk . 6.2.1 about ahb the ahb architecture is based on separate cycles for address and data (rather than separate clock phases, as in asb). the address and control for an access are broadcast from the rising edge of hclk in the cycle before the data is expected to be read or written. during this data cycle, the address and control for the next transfer are driven out. this leads to a fully pipelined address architecture. when an access is in its data cycle, a slave can extend an access by driving the hready signal low. this stretches the current data cycle, and therefore the pipelined address and control for the next transfer is also stretched. this provides a system where all ahb masters and slaves sample hready on the rising edge of hclk to determine whether an access has completed and a new address can be sampled or driven out.
bus interface unit and write buffer 6-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 6.2.2 transfer type table 6-1 shows the transfer types that can be generated by the ARM946E-S processor from the htrans[1:0] signal. note busy transfers are inserted between certain sequences of nonseq and seq transfers. examples of transfers that can cause busy transfers include multiple data reads during debug and coprocessor operations to uncachable areas of memory. ldm accesses to uncachable areas of memory might also cause busy transfers depending on the start address of the burst. system designers must ensure that any ahb peripherals can handle busy transfers as defined in the amba specification. table 6-1 ahb transfer types transfer type htrans[1:0] description idle b00 indicates that no data transfer is required. the idle transfer is used when a bus master is granted the bus, but does not want to perform a data transfer. slaves must always provide a zero wait state okay response to idle transfers and the transfer must be ignored by the slave. busy b10 the busy transfer enables bus masters to insert idle cycles in the middle of bursts of transfers. this transfer indicates that the bus master is continuing with a burst of transfers, but the next transfer cannot take place immediately. when a master uses the busy transfer the address and control signals must reflect the next transfer in the burst. the transfer must be ignored by the slave. slaves must always provide a zero wait state okay response, in the same way that they respond to idle transfers. examples of where the ARM946E-S uses busy cycles are: during debug and coprocessor operations to uncachable areas of memory ldm accesses to uncachable areas of memory depending on the start address of the burst. nonseq b01 indicates the first transfer of a burst or a single transfer. the address and control signals are unrelated to the previous transfer. single transfers on the bus are treated as bursts of one and therefore the transfer type is nonsequential. seq b11 the remaining transfers in a burst are sequential and the address is related to the previous transfer. the control information is identical to the previous transfer. the address is equal to the address of the previous transfer plus the size (in bytes).
bus interface unit and write buffer arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 6-5 6.2.3 burst sizes the ARM946E-S processor supports the burst types listed in table 6-2. incrementing bursts have an address increment of four (that is, word increment). 6.2.4 linefetch transfers the ARM946E-S processor is optimized to run with the instruction cache and data cache enabled. if a memory request (either instruction or data) to a cachable area misses in the cache the ARM946E-S processor performs a linefetch. a linefetch transfer is shown in figure 6-1 on page 6-6. table 6-2 supported burst types burst type hburst[2:0] encoding use single b000 single writes ( str / strh / strb ) uncached single reads uncached instruction fetches incr b001 store multiple ( stm ) uncached burst reads ( ldm ) incr4 b011 dirty half-cache line write-back incr8 b101 dirty cache line write-back cache linefetches
bus interface unit and write buffer 6-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure 6-1 linefetch transfer a linefetch is a fixed length burst of eight words. the start address of a linefetch is aligned to an eight-word boundary. the ARM946E-S processor asserts the bus request hbusreq until the arbiter grants the ahb bus ( hgrant asserted). the bus request is then negated. this enables optimum system performance because the arbiter can accurately predict the end of the defined length burst. 6.2.5 back to back linefetches the ARM946E-S processor supports streaming of data and instructions (core execution is advanced during the linefetch). to enable for cache look-ups when crossing a cache line boundary the ARM946E-S processor must insert idle cycles onto the ahb bus. the effect of this is shown in figure 6-2 on page 6-7. clk htrans haddr hburst hrdata hready hbusreq hgrant idle idle nseq seq seq seq seq seq seq a a+0x4 a+0x8 a+0xc a+0x10 a+0x14 a+0x18 incr8 seq a+0x1c
bus interface unit and write buffer arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 6-7 figure 6-2 back-to-back line fetches 6.2.6 uncached transfers if a memory request is made to an uncachable region, or the ARM946E-S cache is not enabled, the memory requests are serviced by the ahb interface. sequential instruction fetches are treated as nonsequential reads. figure 6-3 shows uncached instruction fetches. nonsequential uncached data operations exhibit similar bus timings. figure 6-3 nonsequential uncached accesses 6.2.7 burst accesses uncached burst operations ( stm / ldm instructions) are performed as incrementing bursts of undefined length on the ahb. clk htrans haddr hburst hrdata hready hbusreq hgrant seq seq idle idle idle idle idle idle nseq a a+0x4 b incr 8 incr 8 clk htrans haddr hburst hbusreq hgrant idle idle nseq idle idle idle idle idle nseq idle a single b single
bus interface unit and write buffer 6-8 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure 6-4 shows a data burst followed by an uncached instruction fetch. figure 6-4 data burst followed by instruction fetch 6.2.8 bursts crossing 1kb boundary the ahb specification requires that bursts must not continue across a 1kb boundary. linefetches and cache line write-backs cannot cross a 1kb boundary because the start address is aligned to either a four or eight-word boundary, and the burst length is fixed. uncached data bursts can cross a 1kb boundary. an example of this is shown in figure 6-5. the burst is restarted by inserting a nonsequential transfer as the boundary is crossed. figure 6-5 crossing a 1kb boundary 6.2.9 uncached ldc operations coprocessor loads to its registers from memory are shown in figure 6-6 on page 6-9. dnmreq , dmore , clken , and rdata are internal ARM946E-S signals. please see the arm9e-s technical reference manual for more information about these signals. the sequence assumes that the ARM946E-S processor has already been granted bus ownership. clk htrans haddr nseq seq seq seq seq idle idle idle nseq idle a b a+0x4 a+0x8 a+0xc a+0x10 clk htrans haddr idle 0x404 0x3fc 0x400 seq 0x3f0 0x3f4 0x3f8 nseq seq seq seq nseq
bus interface unit and write buffer arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 6-9 figure 6-6 uncached ldc sequence clk dnmreq da dmore hgrant htrans haddr hburst hwrite hrdata rdata a0 a1 a2 a3 idle nseq busy seq busy seq busy seq idle a0 a1 a2 a3 incr clken d0 d1 d2 d3 d0 d1 d2 d3
bus interface unit and write buffer 6-10 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 6.3 noncached thumb instruction fetches thumb instruction fetches are performed as 32-bit accesses on the ahb interface. to minimize bus loading, ahb transfers are only performed for nonsequential addresses and for sequential addresses that cross a word boundary. the word returned from main memory is latched so that both halfwords are available for the processor core.
bus interface unit and write buffer arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 6-11 6.4 ahb clocking the ARM946E-S processor design uses a single rising-edge clock clk to time all internal activity. in many systems in which the ARM946E-S processor is embedded, you might prefer to run the ahb at a lower rate. to support this requirement, the ARM946E-S processor requires a clock enable, hclken , to time ahb transfers. the hclken input is driven high around a rising edge of the ARM946E-S processor clk to indicate that this rising-edge is also a rising-edge of hclk so must be synchronous to the ARM946E-S processor clk . when the arm9e-s is running from tightly-coupled memory (tcm) or performing writes using the write buffer, the ARM946E-S processor hclken and hready inputs are not used to generate the sysclken core stall signal. the core is only stalled by tcm stall cycles or if the write buffer overflows. this means that the arm9e-s is executing instructions at the faster clk rate and is effectively decoupled from the hclk domain ahb system. if, however, you want to perform an ahb read access or unbuffered write, the core is stalled until the ahb transfer has completed. when the ahb system is being clocked by the lower rate hclk , hclken is examined to detect when to drive out the ahb address and control to start an ahb transfer. hclken is then required to detect the following rising edges of hclk so that the biu knows the access has completed. if the slave being accessed at the hclk rate has a multi-cycle response, the hready input to the ARM946E-S processor is driven low until the data is ready to be returned. the biu must therefore perform a logical and on the hready response with hclken to detect that the ahb transfer has completed. when this is the case, the arm9e-s core is enabled by reasserting sysclken . note when an ahb access is required, the core is stalled until the next hclken pulse is received, before it can start the access, and then until the access has completed. this stall before the start of the access is a synchronization penalty and the worst case can be expressed in clk cycles as the hclk to clk ratio minus 1. 6.4.1 clk to hclk skew the ARM946E-S processor drives out the ahb address on the rising edge of clk when the hclken input is high. the ahb outputs therefore have output hold and delay values relative to clk . however, these outputs are used in the ahb system where transfers are timed using hclk . similarly, inputs to the ARM946E-S processor are timed relative to hclk but are sampled within the ARM946E-S processor with
bus interface unit and write buffer 6-12 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c clk . this leads to hold time issues, from clk to hclk on outputs, and from hclk to clk on inputs. to minimize this effect you must minimize the skew between hclk and clk . figure 6-7 shows the ahb clock relationships. figure 6-7 ahb clock relationships clock tree insertion at top level considering the skew issue in more detail, the ARM946E-S processor requires a clock tree to be inserted to enable an evenly distributed clock to be driven to all the registers in the design. the registers that drive out ahb outputs and sample ahb inputs are therefore relative to clk , at the bottom of the inserted clock tree and subject to the clock tree insertion delay. to maximize performance, when the ARM946E-S processor is embedded in an ahb system, the clock generation logic to produce hclk must be constrained so that it matches the insertion delay of the clock tree within the ARM946E-S processor. you can achieve this using a clock tree insertion tool, if the clock tree is inserted for the ARM946E-S processor and the embedded system at the same time (top level insertion). figure 6-8 on page 6-13 shows an example of an ahb slave connected to the ARM946E-S processor. clk hclken hclk ahb outputs from ARM946E-S ahb inputs to ARM946E-S skew between clk and hclk
bus interface unit and write buffer arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 6-13 figure 6-8 ARM946E-S clk to ahb hclk sampling in figure 6-8, the slave peripheral has an input setup and hold, and an output hold and valid time relative to hclk . the ARM946E-S processor has an input setup and hold, and an output hold and valid time relative to clk? , the clock at the bottom of the clock tree. you can use clock tree insertion to position hclk to match clk? for optimal performance. hierarchical clock tree insertion if you perform clock tree insertion on the ARM946E-S processor before it is embedded, you can add buffers on input data to match the clock tree so that the setup and hold is relative to the top-level clk . this is guaranteed to be safe at the expense of extra buffers in the data input path. the hclk domain ahb peripherals must still meet the ARM946E-S processor input setup and hold requirements. because the ARM946E-S processor inputs and outputs are now relative to clk , the outputs appear comparatively later by the value of the insertion delay. this ultimately leads to lower ahb performance. ARM946E-S clk' ... clk clock tree hrdata[31:0] ahb slave mux divided by n hclken hclk ahb slave haddr[31:0]
bus interface unit and write buffer 6-14 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 6.5 the write buffer the ARM946E-S processor provides a write buffer to improve system performance. the write buffer has a 16-entry fifo. each entry can be either address or data. the type of entry is determined by the setting of an address/data flag. each address entry is tagged with the size of transfer, as indicated by the arm9e-s core (byte, halfword, or word). write buffer behavior is controlled by the protection region attributes of the store being performed and the data cache and protection unit enable status. this control is represented by the data cachable bit (cd) and the write buffer control bit (bd) from the protection unit. these control bits are generated as follows: cd bit this is generated from the cachable attribute of the protection region and the data cache enable and the protection unit enable. bd bit this is generated from the bufferable attribute for the protection region and the protection unit enable. all accesses are initially noncachable and nonbufferable until you have programmed and enabled the protection unit. therefore, you cannot use the write buffer while the protection unit is disabled. on reset, all entries in the write buffer are invalidated. 6.5.1 write buffer operation the write buffer is used when the data cache hits and/or misses, depending on the mode of operation. table 6-3 shows how the cd and bd bits control the behavior of the write buffer. ncnb data reads and writes are not cached, and can be externally aborted. writes are not buffered, so the processor is stalled until the external access is performed. ncnb reads bypass the write buffer. table 6-3 data write modes cd bd access mode 0 0 ncnb (noncachable, nonbufferable) 0 1 ncb (noncachable, bufferable) 1 0 wt (write-through) 1 1 wb (write-back)
bus interface unit and write buffer arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 6-15 ncb data reads and writes are not cached. writes are buffered, and so cannot be externally aborted. reads can be externally aborted. reads cause the write buffer to drain. if the data cache hits for this type of access, there has been a programming error. data cache hits are ignored and the data cache line is not updated for a read. swap instructions operating on data in an ncb region are made to perform ncnb type accesses and are not buffered. wt searches the data cache for reads and writes. reads that miss in the data cache cause a line fill. reads that hit in the data cache do not perform an external access. all writes are buffered, regardless of whether they hit or miss in the data cache. writes that hit in the data cache update the cache but do not mark the cache line as dirty, because the write is also sent to the write buffer. writes cannot be externally aborted. data cache linefills cause the write buffer to drain before the linefill starts. wb searches the data cache for reads and writes. reads that miss in the data cache cause a line fill. reads that hit in the data cache do not perform an external access. writes that miss in the data cache are buffered. writes that hit in the data cache update the cache line, mark it as dirty, and do not send the data to the write buffer. data cache write-backs are buffered. writes (write-miss and write-back) cannot be externally aborted. data cache linefills cause the write buffer to drain before the linefill starts. 6.5.2 enabling and disabling the write buffer you cannot directly enable or disable the write buffer. however, you can prevent the write buffer being used by setting the properties of a memory region to be ncnb, or by disabling the protection unit. 6.5.3 self-modifying code instruction fetches and ncnb reads bypass the write buffer. if you write self-modifying code to a bufferable or cachable region, then it is essential that you drain the write buffer before fetching instructions from these addresses.
bus interface unit and write buffer 6-16 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 7-1 chapter 7 coprocessor interface this chapter describes the ARM946E-S pipelined coprocessor interface. it contains the following sections: about the coprocessor interface on page 7-2 coprocessor interface signals on page 7-3 ldc/stc on page 7-11 mcr/mrc on page 7-13 interlocked mcr on page 7-14 cdp on page 7-15 privileged instructions on page 7-16 busy-waiting and interrupts on page 7-17.
coprocessor interface 7-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 7.1 about the coprocessor interface the ARM946E-S processor fully supports the connection of on-chip coprocessors through the external coprocessor interface and supports all classes of coprocessor instructions. the interface differs from the basic arm9e-s coprocessor interface. to ease integration of an external coprocessor, the interface from the ARM946E-S processor to the coprocessor has been pipelined by a single clock cycle as shown in figure 7-1. figure 7-1 pipeline stages this ensures that ARM946E-S interface outputs, which otherwise arrive late in the clock cycle, are driven out directly from registers to the external coprocessor. this significantly eases the implementation task for an external coprocessor. arm9e-s coprocessor writeback memory execute decode fetch writeback memory execute decode fetch
coprocessor interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 7-3 7.2 coprocessor interface signals table 7-1 describes the ARM946E-S coprocessor interface signals. table 7-1 coprocessor interface signals name direction with respect to ARM946E-S processor description cpclken coprocessor clock enable output synchronous enable for coprocessor pipeline follower. when high on the rising edge of clk the pipeline follower logic is able to advance. cpinstr[31:0] coprocessor instruction data output the 32-bit coprocessor instruction bus over which instructions are transferred to the coprocessor pipeline follower. cpdout[31:0] coprocessor read data output the 32-bit coprocessor read data bus for transferring data to the coprocessor. cpdin[31:0] coprocessor write data input the 32-bit coprocessor write data bus for transferring data from the coprocessor. cppass output indicates that there is a coprocessor instruction in the execute stage of the pipeline, and it must be executed. cplatecancel output if high during the first memory cycle of a coprocessor instruction, then the coprocessor must cancel the instruction without changing any internal state. this signal is only asserted in cycles where the previous instruction caused a data abort to occur. chsde[1:0] coprocessor handshake decode input the handshake signals from the decode stage of the coprocessors pipeline follower. indicates: b10 = absent b00 = wait b01 = go b11 = last.
coprocessor interface 7-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 7.2.1 synchronizing the external coprocessor pipeline a coprocessor connected to the ARM946E-S processor determines which instructions it needs to execute by implementing a pipeline follower in the coprocessor. each instruction that enters the arm9e-s pipeline also enters the coprocessor pipeline one clock cycle later. the interface to the coprocessor is pipelined and so the coprocessor pipeline follower operates one cycle behind the arm9e-s core, sampling the cpinstr[31:0] output bus from the ARM946E-S coprocessor interface. to hide the pipeline delay, a mechanism inside the interface block stalls the arm9e-s core for a cycle by internally modifying the coprocessor handshake signals whenever an external coprocessor instruction is decoded. this enables the external coprocessor to catch up with the arm9e-s core. chsex[1:0] coprocessor handshake execute input the handshake signals from the execute stage of the coprocessors pipeline follower. indicates: b10 = absent b00 = wait b01 = go b11 = last. cptbit coprocessor instruction thumb bit output when high indicates that the ARM946E-S processor is in thumb state. when low indicates that the ARM946E-S processor is in arm state. sampled by the coprocessor pipeline follower. ncpmreq not coprocessor instruction request output when low on the rising edge of clk and cpclken is high, the instruction on cpinstr must enter the coprocessor pipeline. ncptrans not coprocessor memory translate output when low indicates that the ARM946E-S processor is in user mode. when high indicates that the ARM946E-S processor is in privileged mode. sampled by the coprocessor pipeline follower. table 7-1 coprocessor interface signals (continued) name direction with respect to ARM946E-S processor description
coprocessor interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 7-5 after this initial stall cycle, the two pipelines can be considered synchronized. the arm9e-s core then informs the coprocessor when instructions move from decode into execute, and whether the instruction has passed its condition codes and is to be executed. note because the ARM946E-S processor hides the synchronization of the coprocessor pipeline follower, its coprocessor handshake interface is similar to that of the native arm9e-s core. this implies that an arm9e-s core designed pipeline follower can interface to the ARM946E-S processor without modification. the data path of the coprocessor differs however, because of the ARM946E-S pipelined output data cpdout[31:0] . 7.2.2 external coprocessor clocking the coprocessor data processing ( cdp ) instruction is used for coprocessor instructions that do not operate on values in arm registers or in main memory. one example is a floating-point multiply instruction for a floating-point accelerator processor. to enable coprocessors to continue execution of cdp instructions while the arm9e-s core pipeline is stalled (for instance while waiting for an ahb transfer to complete), the coprocessor receives the free-running system clock clk , and a clock enable signal cpclken . if cpclken is low around the rising edge of clk then the arm9e-s core pipeline is stalled and the coprocessor pipeline follower must not advance. this prevents any new instructions entering execute within the coprocessor but enables a cdp instruction in execute to continue execution. the coprocessor is only stalled when the current instruction leaves execute and new instructions are required from the ARM946E-S interface.this goes some way towards decoupling the external coprocessor from the arm9e-s memory interface. there are three classes of coprocessor instructions: ldc/stc mcr/mrc cdp . examples of how a coprocessor executes these instruction classes are given in the following sections: ldc/stc on page 7-11 mcr/mrc on page 7-13 cdp on page 7-15.
coprocessor interface 7-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 7.2.3 coprocessor handshake states the handshake signals encode one of four states: absent if there is no coprocessor attached that can execute the coprocessor instruction, the handshake signals indicate the absent state. in this case, the arm9e-s core takes the undefined instruction trap. wa i t if there is a coprocessor attached that can handle the instruction, but not immediately, the coprocessor handshake signals are driven to indicate that the arm9e-s processor core must stall until the coprocessor can catch up. this is known as the busy-wait condition. in this case, the arm9e-s processor core loops in an idle state waiting for chsex[1:0] to be driven to another state, or for an interrupt to occur. if chsex[1:0] changes to absent, the undefined instruction trap is taken. if chsex[1:0] changes to go or last, the instruction proceeds as described here. if an interrupt occurs, the arm9e-s processor is forced out of the busy-wait state. this is indicated to the coprocessor by the cppass signal going low. the instruction is restarted later and so the coprocessor must not commit to the instruction (it must not change any coprocessor state) until cppass is asserted high, when the handshake signals indicate the go or last condition. go the go state indicates that the coprocessor can execute the instruction immediately, and that it requires at least another cycle of execution. both the arm9e-s processor core and the coprocessor must also consider the state of the cppass signal before actually committing to the instruction. for an ldc / stc instruction, the coprocessor instruction drives the handshake signals with go when two or more words still have to be transferred. when only one more word is to be transferred, the coprocessor drives the handshake signals with last. during the execute stage, the arm9e-s processor core outputs the address for the ldc / stc instruction. also in this cycle, dnmreq is driven low, indicating to the ARM946E-S memory system that a memory access is required at the data end of the device. the timing for the data on cpdout and cpdin is shown in figure 7-6 on page 7-11. last an ldc or stc instruction can be used for more than one item of data. if this is the case, possibly after busy waiting, the coprocessor drives the coprocessor handshake signals with a number of go states, and in the penultimate cycle last (last indicating that the next transfer is the final one). if there is only one transfer, the sequence is [wait,[wait,...]],last. last is also usually driven for cdp instructions.
coprocessor interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 7-7 7.2.4 coprocessor handshake encoding table 7-2 shows how the handshake signals chsde[1:0] and chsex[1:0] are encoded. note if an external coprocessor is not attached in the ARM946E-S embedded system, the chsde[1:0] and chsex[1:0] handshake inputs must be tied off to indicate absent. 7.2.5 multiple external coprocessors figure 7-2 on page 7-8 shows an example where vfp9 and two other coprocessors are connected to the ARM946E-S processor using the coprocessor interface logic block. table 7-2 handshake encoding [1:0] meaning b10 absent b00 wait b01 go b11 last
coprocessor interface 7-8 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure 7-2 connecting multiple coprocessors the handshaking signals from the coprocessors can be combined by anding bit 1, and oring bit 0. in the case of coprocessors that have handshaking signals chsdecp1 , chsexcp1 , chsdecp2 , chsexcp2 , and chsdevfp9 , chsexvfp9 use: chsde[1] = chsdecp1[1] and chsdecp2[1] and chsdevfp9[1] chsde[0] = chsdecp1[0] or chsdecp2[0] or chsdevfp9[0] chsex[1] = chsexcp1[1] and chsexcp2[1] and chsexvfp9[1] chsex[0] = chsexcp1[0] or chsexcp2[0] or chsexvfp9[0] figure 7-3 on page 7-9 shows example components of the handshaking logic in the coprocessor interface logic block. coprocessor 1 ARM946E-S processor coprocessor instructions, data and control signals from ARM946E-S core vfp9 coprocessor coprocessor 2 coprocessor interface block handshaking logic data interface logic vfp9 coprocessor signals coprocessor 1 signals coprocessor 2 signals chsex[1:0] chsde[1:0] cpdin[31:0]
coprocessor interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 7-9 figure 7-3 example handshake logic blocks for connecting to the cpdin[31:0] signals, there are two options for interfacing the coprocessor data buses to the ARM946E-S processor: the coprocessor drives its data bus to logic 0 when not selected. this enables a simple or connection scheme as shown in figure 7-4 on page 7-10. this is the recommended method of coprocessor data bus interfacing. ARM946E-S processor cpdout[31:0] coprocessor 1 coprocessor 2 cpdin[31:0] vfp9 coprocessor cpinstr[31:0] cpdcp2[31:0] cpdcp1[31:0] cpdvfp9[31:0]
coprocessor interface 7-10 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure 7-4 driving the coprocessors data buses to logic 0 multiplexing the coprocessor data bus. for coprocessors that do not drive data buses to logic 0 a multiplexor circuit is required. multiplexor control is determined by the coprocessor decoding the coprocessor number field bits [11:7] in the mrc / stc instruction in the correct pipeline stage. figure 7-5 multiplexing the coprocessors data buses ARM946E-S processor cpdout[31:0] coprocessor 1 coprocessor 2 cpdin[31:0] vfp9 coprocessor cpinstr[31:0] cpdcp2[31:0] cpdcp1[31:0] cpdinvfp9[31:0] ARM946E-S processor cpdout[31:0] coprocessor 1 coprocessor 2 cpdin[31:0] vfp9 coprocessor cpinstr[31:0] cpdcp2[31:0] cpdcp1[31:0] cpdvfp9[31:0]
coprocessor interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 7-11 7.3 ldc/stc the ldc and stc instructions are used respectively to transfer data to and from external coprocessor registers and memory. in the case of the ARM946E-S processor, the memory can be either cache, tightly-coupled memory (tcm) or ahb depending on the address range of the access and the protection unit settings. the cycle timing for these operations is shown in figure 7-6. figure 7-6 ldc/stc cycle timing in this example, four words of data are transferred. the number of words transferred is determined by how the coprocessor drives the chsde[1:0] and chsex[1:0] buses. as with all other instructions, the arm9e-s core performs the main decode off the rising edge of the clock during the decode stage. from this, the core commits to executing the instruction and so performs an instruction fetch. the coprocessor instruction pipeline keeps in step with the arm9e-s core by monitoring ncpmreq . this is a registered version of the arm9e-s core instruction memory request signal inmreq . at the rising edge of clk , if cpclken is high, and ncpmreq is low, an instruction fetch is taking place, and cpinstr[31:0] contains the fetched instruction on the next rising edge of the clock, when cpclken is high. clk cpinstr[31:0] ncpmreq cppass cplatecancel chsde[1:0] chsex[1:0] cpdin[31:0], stc cpdout[31:0], ldc ldc/stc go go go last ignored coprocessor pipeline fetch decode execute (go) execute (go) execute (go) execute (last) memory write
coprocessor interface 7-12 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c this means that: the last instruction fetched must enter the decode stage of the coprocessor pipeline the instruction in the decode stage of the coprocessor pipeline must enter its execute stage the fetched instruction must be sampled. in all other cases, the arm9e-s pipeline is stalled, and the coprocessor pipeline must not advance. during the execute stage, the condition codes are compared with the flags to determine whether the instruction really executes or not. the output cppass is asserted, high, if the instruction in the execute stage of the coprocessor pipeline: is a coprocessor instruction has passed its condition codes. if a coprocessor instruction busy-waits, cppass is asserted on every cycle until the coprocessor instruction is executed. if an interrupt occurs during busy-waiting, cppass is driven low, and the coprocessor stops execution of the coprocessor instruction. another output, cplatecancel , cancels a coprocessor instruction when the instruction preceding it caused a data abort. this is valid on the rising edge of clk on the cycle that follows the first execute cycle of any coprocessor instruction. this is the only cycle in which cplatecancel can be asserted. on the rising edge of the clock, the arm9e-s processor examines the coprocessor handshake signals chsde[1:0] or chsex[1:0] : if a new instruction is entering the execute stage in the next cycle, it examines chsde[1:0] . if the currently executing coprocessor instruction requires another execute cycle, it examines chsex[1:0] .
coprocessor interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 7-13 7.4 mcr/mrc these cycles look very similar to stc / ldc . an example, with a busy-wait state, is shown in figure 7-7. first ncpmreq is driven low to denote that the instruction on cpinstr[31:0] is entering the decode stage of the pipeline. this causes the coprocessor to decode the new instruction and drive chsde[1:0] . in the next cycle ncpmreq is driven low to denote that the instruction has now been issued to the execute stage. if the condition codes pass, and the instruction is to be executed, the cppass signal is driven high and the chsde[1:0] handshake bus is examined (it is ignored in all other cases). figure 7-7 mcr/mrc transfer timing with busy-wait for any successive execute cycles the chsex[1:0] handshake bus is examined. when the last condition is observed, the instruction is committed. in the case of a mcr , the cpdout[31:0] bus is driven with the registered data. in the case of a mrc , cpdin[31:0] is sampled at the end of the arm9e-s core memory stage and written to the destination register during the next cycle. clk cpinstr[31:0] ncpmreq cppass cplatecancel chsde[1:0] chsex[1:0] cpdin[31:0], mrc cpdout[31:0], mcr mcr/mrc wait last ignored coprocessor pipeline fetch decode execute (wait) execute (last) memory write coprocessor to arm arm to coprocessor
coprocessor interface 7-14 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 7.5 interlocked mcr if the data for a mcr operation is not available inside the arm9e-s core pipeline during its first decode cycle, then the arm9e-s core pipeline interlocks for one or more cycles until the data is available. an example of this is where the register being transferred is the destination from a preceding ldr instruction. in this situation the mcr instruction enters the decode stage of the coprocessor pipeline, and then remains there for a number of cycles before entering the execute stage. figure 7-8 gives an example of an interlocked mcr that also has a busy-wait state. figure 7-8 interlocked mcr/mrc timing with busy-wait clk cpinstr[31:0] ncpmreq cppass cplatecancel chsde[1:0] chsex[1:0] cpdin[31:0], mrc cpdout[31:0], mcr mcr/mrc wait last ignored coprocessor pipeline fetch decode (interlock) decode execute (wait) execute (last) write memory wait coprocessor to arm arm to coprocessor
coprocessor interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 7-15 7.6 cdp cdp instructions normally execute in a single cycle. like all the previous examples, ncpmreq is driven low to signal when an instruction is entering the decode and then the execute stage of the pipeline: if the instruction really is to be executed, the cppass signal is driven high during the execute cycle if the coprocessor can execute the instruction immediately it drives chsde[1:0] with last if the instruction requires a busy-wait cycle, the coprocessor drives chsde[1:0] with wait and then chsex[1:0] with last. figure 7-9 shows a canceled cdp because of the previous instruction causing a data abort. figure 7-9 late canceled cdp the cdp instruction enters the execute stage of the pipeline and is signaled to execute by cpass . in the following cycle cplatecancel is asserted. this causes the coprocessor to terminate execution of the cdp instruction and no state changes are made to the coprocessor. clk cpinstr[31:0] ncpmreq cppass cplatecancel chsde[1:0] chsex[1:0] cprt last ignored coprocessor pipeline fetch decode execute memory (late canceled) instruction aborted
coprocessor interface 7-16 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 7.7 privileged instructions the coprocessor restricts certain instructions for use in privileged modes only. to do this, the coprocessor tracks the ncptrans output. figure 7-10 shows how ncptrans changes after a mode change. figure 7-10 privileged instructions the first two chsde[1:0] responses are ignored by the arm9e-s core because it is only the final chsde[1:0] response, as the instruction moves from decode into execute, that counts. this enables the coprocessor to change its response when ncptrans changes. clk cpinstr[31:0] ncpmreq cppass cplatecancel chsde[1:0] chsex[1:0] cprt ignored ignored coprocessor pipeline fetch decode decode decode execute write memory ignored ncptrans old mode new mode last
coprocessor interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 7-17 7.8 busy-waiting and interrupts the coprocessor is permitted to stall, or busy-wait, the processor during the execution of a coprocessor instruction if, for example, it is still busy with an earlier coprocessor instruction. to do so, the coprocessor associated with the decode stage drives wait onto chsde[1:0] . when the instruction concerned enters the execute stage of the pipeline, the coprocessor drives wait onto chsex[1:0] for as many cycles as necessary to keep the instruction in the busy-wait loop. for interrupt latency reasons the coprocessor might be interrupted while busy-waiting, causing the instruction to be abandoned. abandoning execution is done through cppass . the coprocessor must monitor the state of cppass during every busy-wait cycle. if it is high, the instruction must still be executed. if it is low, the instruction must be abandoned. figure 7-11 shows a busy-waited coprocessor instruction being abandoned because of an interrupt. cplatecancel is also asserted as a result of the execute interruption. figure 7-11 busy-waiting and interrupts clk cpinstr[31:0] ncpmreq cppass cplatecancel chsde[1:0] chsex[1:0] instr wait wait coprocessor pipeline fetch decode execute (wait) execute (wait) execute (wait) aband- oned execute (wait) ignored wait wait
coprocessor interface 7-18 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 8-1 chapter 8 etm interface this chapter describes the ARM946E-S embedded trace macrocell (etm) interface. it contains the following sections: about the etm interface on page 8-2 enabling the etm interface on page 8-3 ARM946E-S trace support features on page 8-4.
etm interface 8-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 8.1 about the etm interface the ARM946E-S processor supports the connection of an optional external embedded trace macrocell (etm) to provide real-time tracing of ARM946E-S instructions and data in an embedded system. the etm interface is primarily one way. to provide code tracing, the etm block must be able to monitor various arm9e-s inputs and outputs. the required arm9e-s inputs and outputs are collected and driven out from the ARM946E-S processor from the etm interface registers, as shown in figure 8-1. the etm interface outputs are pipelined by a single clock cycle to provide early output timing and to isolate any etm input load from the critical ARM946E-S processor signals. the latency of the pipelined outputs does not affect etm trace behavior, because all outputs are delayed by the same amount. figure 8-1 ARM946E-S etm interface arm processor etm9 pwrdown etmen etmfifofull
etm interface arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 8-3 8.2 enabling the etm interface the etm interface on the ARM946E-S processor is enabled by the top-level pin etmen . when this input is high, the etm interface is enabled and the outputs are driven so that an external etm can begin code tracing. when the etmen input is driven low, the etm interface outputs are held at their last value before the interface was disabled. the etmen input is usually driven by the etm, and driven high when the etm is programmed using its tap controller. it is recommended that the etmen input is connected to the pwrdown output of the etm9 macrocell through an inverter as shown in figure 8-1 on page 8-2. note if an etm is not used in an embedded ARM946E-S design, the etmen input must be tied low to save power.
etm interface 8-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 8.3 ARM946E-S trace support features the ARM946E-S processor includes the following trace support features: etmfifofull register 15, trace control register register 13, trace process identifier register . 8.3.1 etmfifofull the signal, etmfifofull , is an input to the ARM946E-S processor driven by the etm9. whenever the programmed upper watermark of the etm fifo is reached, etmfifofull is asserted. the ARM946E-S processor uses etmfifofull to stall the arm9e-s core, preventing trace loss. the arm9e-s core remains stalled until etmfifofull is deasserted. the ARM946E-S processor can only stall on instruction boundaries enabling any current ahb transfers to complete. you must take this into consideration when programming the etm fifo watermark. if the current instruction is either an ldm or an stm , the fifo might have to accept up to 16 words after the assertion of etmfifofull . note using etmfifofull to stall the ARM946E-S processor affects real-time operating performance. 8.3.2 register 15, trace control register the trace control register enables nirq and nfiq interrupt priority over etmfifofull to be programmed. the operation of this register is described in register 15, trace control register on page 2-35. 8.3.3 register 13, trace process identifier register the ARM946E-S processor contains a trace process identifier register that enables real-time trace tools to identify the currently executing process in multi-tasking environments. the operation of this register is described in register 13, trace process identifier register on page 2-29.
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-1 chapter 9 debug support this chapter describes the ARM946E-S debug interface. it contains the following sections: about the debug interface on page 9-2 debug systems on page 9-4 the jtag state machine on page 9-7 scan chains on page 9-12 debug access to the caches on page 9-18 debug interface signals on page 9-20 determining the core and system state on page 9-25. the arm9e-s embeddedice-rt logic is also discussed in this chapter including: overview of embeddedice-rt on page 9-26 disabling embeddedice-rt on page 9-28 the debug communication channel on page 9-29 monitor mode debugging on page 9-33.
debug support 9-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 9.1 about the debug interface debug support is implemented using the arm9e-s core embedded within the ARM946E-S processor. the ARM946E-S processor debug interface is based on ieee std. 1149.1-1990, standard test access port and boundary-scan architecture . see this standard for an explanation of the terms used in this chapter and for a description of the tap controller states. the arm9e-s core within the ARM946E-S processor contains hardware extensions for advanced debugging features. these make it easier to develop application software, operating systems, and the hardware itself. the arm9e-s core supports two debug modes: halt mode monitor mode . 9.1.1 halt mode the debug extensions enable you to force the core to be stopped and placed in debug state by: a given instruction fetch (breakpoint) a data access (watchpoint) an external debug request. in debug state, the core and ARM946E-S processor memory system are effectively stopped, and isolated from the rest of the system. this is known as halt mode operation and enables you to examine the internal state of the arm9e-s core, ARM946E-S processor, and external ahb state, while all other system activity continues as normal. when debug has been completed, the arm9e-s restores the core and system state, and resumes program execution. the examination of the internal state of the ARM946E-S processor uses a jtag-style interface, that enables you to serially insert instructions into the instruction pipeline. this exports the contents of the arm9e-s core registers. the exported data is serially shifted out without affecting the rest of the system. 9.1.2 monitor mode the arm9e-s also supports monitor mode where on a breakpoint or watchpoint, an internal instruction abort or data abort is generated. when used in conjunction with a debug monitor program activated by the abort exception entry, you can debug the ARM946E-S processor while the execution of critical interrupt service routines continues.
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-3 the debug monitor program typically communicates with the debug host over the ARM946E-S debug communication channel. real-time debug is described in monitor mode debugging on page 9-33. 9.1.3 debug clocks you must synchronize the system and test clocks externally to the ARM946E-S processor. the arm multi-ice debug agent directly supports one or more cores within an asic design. to synchronize off-chip debug clocking with the ARM946E-S processor you must use a three-stage synchronizer. the off-chip device (for example, multi-ice) issues a tck signal, and waits for the rtck (returned tck ) signal to come back. synchronization is maintained because the off-chip device does not progress to the next tck until after rtck is received. figure 9-1 shows this synchronization. figure 9-1 clock synchronization multi-ice interface pads arm processor tdo rtck tck tms tdi dbgtdo clk dbgtdi dbgtms dbgtcken dbgntrst input sample and hold tck synchronizer clk clk dq dq dq dq dq
debug support 9-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 9.2 debug systems the ARM946E-S processor forms one component of a debug system that interfaces from the high-level debugging performed by the user to the low-level interface supported by the ARM946E-S processor. figure 9-2 shows a typical debug system. figure 9-2 typical debug system a debug system typically has three parts: the debug host the protocol converter on page 9-5 ARM946E-S debug target on page 9-5. the debug host and the protocol converter are system-dependent. 9.2.1 the debug host the debug host is a computer that is running a software debugger, such as armsd . the debug host enables you to issue high-level commands such as setting breakpoints or examining the contents of memory. debug host protocol converter debug target host computer running arm or third party toolkit for example, multi-ice development system containing ARM946E-S
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-5 9.2.2 the protocol converter an interface, such as a parallel port, connects the debug host to the ARM946E-S processor development system. the messages broadcast over this connection must be converted to the interface signals of the ARM946E-S processor. the protocol converter performs the conversion. 9.2.3 ARM946E-S debug target the arm9e-s core within the ARM946E-S processor has hardware extensions that ease debugging at the lowest level. the debug extensions: enable you to stall the core from program execution examine the core internal state examine the state of the memory system resume program execution. the following major blocks of the arm9e-s are shown in the arm9e-s block diagram on page 9-6. arm9e-s cpu core this includes hardware support for debug. embeddedice-rt logic this is a set of registers and comparators used to generate debug exceptions (such as breakpoints). this unit is described in overview of embeddedice-rt on page 9-26. tap controller this controls the action of the scan chains using a jtag serial interface.
debug support 9-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure 9-3 arm9e-s block diagram the arm9e-s debug model is extended within the ARM946E-S processor by the addition of scan chain 15. this is used for debug access to the cp15 register bank, to enable you to configure the system state within the ARM946E-S processor while in debug state, for instance to enable or disable the tcm before performing a debug load or store. arm9e-s scan chain 1 scan chain 2 tap controller main processor logic embeddedice-rt
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-7 9.3 the jtag state machine the process of serial test and debug is best explained in conjunction with the jtag state machine. figure 9-4 shows the state transitions that occur in the tap controller, with the state names and their numbers. state numbers are output from the ARM946E-S processor on dbgtapsm[3:0] . figure 9-4 tap controller state transitions 1 1. from ieee std 1149.1-1990. copyright 1999ieee. all rights reserved. tms=1 tms=0 tms=1 tms=1 tms=1 tms=0 tms=1 tms=0 tms=1 tms=1 tms=0 run-test/idle 0xc test-logic-reset 0xf select-ir-scan 0x4 tms=1 capture-dr 0x6 tms=0 tms=0 tms=0 capture-ir 0xe tms=0 shift-ir 0xa exit1-ir 0x9 tms=1 pause-ir 0xb tms=0 exit2-ir 0x8 tms=1 update-ir 0x9 tms=1 tms=0 shift-dr 0x2 exit1-dr 0x1 tms=1 pause-dr 0x3 tms=0 exit2-dr 0x0 tms=1 update-dr 0x5 tms=1 tms=0 tms=0 tms=1 tms=0 tms=0 tms=1 tms=0 select-dr-scan 0x7
debug support 9-8 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 9.3.1 reset the jtag interface includes a state-machine controller (the tap controller). to force the tap controller into the correct state after first applying power to the device you must apply a reset pulse to the dbgntrst signal, or you must cycle the jtag state machine through the test-logic-reset state. if you do not intend using the jtag interface, you can tie the dbgntrst input permanently low. note a clock on tck is not necessary to reset the device. the action of reset is as follows: 1. forces exit from debug state. the boundary scan chain cells do not intercept any of the signals passing between the external system and the core. 2. the idcode instruction is selected. if the tap controller is put into the shift-dr state and tck is pulsed, the contents of the id register are clocked out of tdo . 9.3.2 instruction register the instruction register is four bits in length. there is no parity bit. the fixed value loaded into the instruction register during the capture-ir controller state is b0001. 9.3.3 public instructions table 9-1 lists the public instructions that are supported. table 9-1 public instructions instruction binary code extest b0000 scan_n b0010 intest b1100 idcode b1110 bypass b1111 sample/preload b0011 restart b0100
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-9 in this section it is assumed that tdi and tms are sampled on the rising edge of tck and all output transitions on tdo occur as a result of the falling edge of tck . extest (b0000) the selected scan chain is placed in test mode by the extest instruction. the extest instruction connects the selected scan chain between tdi and tdo . when the instruction register is loaded with the extest instruction, all the scan cells are placed in their test mode of operation. in the capture-dr state, inputs from the system logic and outputs from the output scan cells to the system are captured by the scan cells. in the shift-dr state, the previously captured test data is shifted out of the scan chain on tdo , while new test data is shifted in on the tdi input. this data is applied immediately to the system logic and system pins. scan_n (b0010) this instruction connects the scan path select register between tdi and tdo . during the capture-dr state, the fixed value b10000 is loaded into the register. during the shift-dr state, the id number of the desired scan path is shifted into the scan path select register. in the update-dr state, the scan register of the selected scan chain is connected between tdi and tdo , and remains connected until a subsequent scan_n instruction is issued. on reset, scan chain 3 is selected by default. the scan path select register is five bits long in this implementation, although no finite length is specified. intest (b1100) the selected scan chain is placed in test mode by the intest instruction. the intest instruction connects the selected scan chain between tdi and tdo . when the instruction register is loaded with the intest instruction, all the scan cells are placed in their test mode of operation. in the capture-dr state, the value of the data applied from the core logic to the output scan cells, and the value of the data applied from the system logic to the input scan cells is captured. in the shift-dr state, the previously captured test data is shifted out of the scan chain on the tdo signal pin, while new test data is shifted in on the tdi signal pin.
debug support 9-10 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c idcode (b1110) the idcode instruction connects the device identification register (or id register) between tdi and tdo . the id register is a 32-bit register that enables the manufacturer, part number, and version of a component to be determined through the tap. the id register is loaded from the tapid[31:0] input bus. this must be tied to a constant value that represents the unique jtag idcode for the device. when the instruction register is loaded with the idcode instruction, all the scan cells are placed in their normal (system) mode of operation. in the capture-dr state, the device identification code is captured by the id register. in the shift-dr state, the previously captured device identification code is shifted out of the id register on the tdo signal pin, while data is shifted in on the tdi signal pin into the id register. in the update-dr state, the id register is unaffected. bypass (b1111) the bypass instruction connects a 1-bit shift register (the bypass register) between tdi and tdo . when the bypass instruction is loaded into the instruction register, all the scan cells are placed in their normal (system) mode of operation. this instruction has no effect on the system pins. in the capture-dr state, a 0 is captured by the bypass register. in the shift-dr state, test data is shifted into the bypass register on tdi and out on tdo after a delay of one tck cycle. the first bit shifted out is a 0. the bypass register is not affected in the update-dr state. note all unused instruction codes default to the bypass instruction. sample/preload (b0011) when the instruction register is loaded with the sample/preload instruction, all the scan cells of the selected scan chain are placed in the normal mode of operation. in the capture-dr state, a snapshot of the signals of the boundary scan is taken on the rising edge of tck . normal system operation is unaffected.
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-11 in the shift-dr state, the sampled test data is shifted out of the boundary scan on the tdo signal pin, while new data is shifted in on the tdi signal pin to preload the boundary scan parallel input latch. this data is not applied to the system logic or system pins while the sample/preload instruction is active. you must use this instruction to preload the boundary scan register with known data prior to selecting intest or extest instructions. restart (b0100) this instruction restarts the processor on exit from debug state. the restart instruction connects the bypass register between tdi and tdo and the tap controller behaves as if the bypass instruction is loaded. the processor resynchronizes back to the memory system when the run-test/idle state is entered.
debug support 9-12 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 9.4 scan chains the ARM946E-S processor supports 32 scan chains. three scan chains are used inside the ARM946E-S processor. these enable testing, debugging, and programming of the embeddedice-rt watchpoint units. the supported scan chains are listed in table 9-2. 9.4.1 scan chain 1 this scan chain is primarily used for debugging and provides access to the core instruction and data buses. these are arranged as shown in table 9-3. the three control bits are: sysspeed wptandbkpt a reserved bit. table 9-2 ARM946E-S scan chain allocations scan chain number function 16-31 unassigned 15 control coprocessor 4-14 reserved 3 external boundary scan 2 embeddedice-rt logic programming 1debug 0 reserved table 9-3 scan chain 1 bits bits function [66:35] data values [34:32] control bits [31:0] instruction values
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-13 while debugging, the value placed in the sysspeed control bit determines if the arm9e-s core executes the instruction at system speed. after the ARM946E-S processor has entered debug state, the first time sysspeed is captured and scanned out tells the debugger whether the core has entered debug state because of a breakpoint (sysspeed clear) or a watchpoint (sysspeed set). a watchpoint and a breakpoint can occur simultaneously. when a watchpoint condition occurs, the wptandbkpt bit must be examined by the debugger to determine whether the instruction currently in the execute stage of the pipeline is breakpointed. if it is, wptandbkpt is set, otherwise it is clear. 9.4.2 scan chain 2 scan chain 2 enables access to the embeddedice-rt logic registers. the order of the scan chain from the dbgtdi input to the dbgtdo output is shown in table 9-4. no action occurs during capture-dr. during shift-dr, a data value is shifted into the serial register. bits 36:32 specify the address of the embeddedice-rt register to be accessed. during update-dr, this register is either read or written depending on the value of bit 37 (0 = read, 1 = write). 9.4.3 scan chain 15 scan chain 15 enables debug access to the cp15 register bank and enables the cache to be interrogated. scan chain 15 is 39 bits long. table 9-4 scan chain 2 bits bits function [37] read = 0, write = 1 [36:32] register address [31:0] data value
debug support 9-14 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c the order of scan chain 15 from the dbgtdi input to the dbgtdo output is shown in table 9-5. the mapping of the cp15 register address field of scan chain 15 to cp15 registers is shown in table 9-6. table 9-5 scan chain 15 bits bits contents [38] read = 0, write = 1 [37:32] cp15 register address [31:0] cp15 data value table 9-6 mapping of scan chain 15 address field to cp15 registers address [37] [36:33] [32] register number register name register type 0 b0000 0 c0.id id register read 0 b0000 1 c0.c cache type read 0 b0001 0 c1 control read/write 0 b0010 0 c2.d data cachable bits read/write 0 b0010 1 c2.i instruction cachable bits read/write 0 b0011 0 c3 write buffer control read/write 0 b0100 0 c0.m tightly-coupled memory size read 0 b0101 0 c5.d data space access permissions read/write 0 b0101 1 c5.i instruction address access permissions read/write 1 a 0 c6.[7:0] memory region protection read/write 0 b0111 0 c7.fd flush data cache read/write 0 b0111 1 c7.fi flush instruction cache read/write 0 b1110 0 c7.fd.s flush data cache single (uses c15.c.ind) read/write 0 b1110 1 c7.fi.s flush instruction cache single (uses c15.c.ind) read/write 1 b1010 1 c7.cd.s clean data cache single (uses c15.c.ind) read/write
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-15 in the shift-dr state of the tap state machine, the read/write bit, the register address and the register value for writing, are shifted in. for a write, the register value is updated when the update-dr state is reached. for reading, return to shift-dr through capture-dr to shift out the register value. 9.4.4 scan chain debug status register in situations where the ahb clock frequency is significantly less than the debugger clock frequency, cache maintenance operations initialized by the debug scan chain (scan chain 15) might not be registered by the ARM946E-S processor. this situation can be prevented by providing status information to the debugger. cache maintenance operations (cache flush and cache clean) are read/write accesses. by reading back from the same scan chain register address that initiated the maintenance 0 b1001 0 c9.d data cache lock-down read/write 0 b1001 1 c9.i instruction cache lock-down read/write 1 b1000 1 c9.dram data tcm size/location read/write 1 b1001 1 c9.iram instruction tcm size/location read/write 0 b1101 1 c13.tpid trace process identifier read/write 0 b1111 0 c15.state test state read/write 0 b1111 1 c15.tag tag bist control read/write 1 b1111 1 c15.ram cache ram bist control read/write 1 b1101 0 c15.c.ind cache index (address/segment) read/write 0 b1010 0 c15.dc data cache read/write (uses c15.c.ind) read/write 0 b1010 1 c15.ic instruction cache read/write (uses c15.c.ind) read/write 0 b1011 0 c15.dt data tag read/write (uses c15.c.ind) read/write 0 b1011 1 c15.it instruction tag read/write (uses c15.c.ind) read/write 1 b1110 1 c15.mem tcm bist control read/write a. for cp15 register 6, crm corresponds to the region number (b0000 to b0111). table 9-6 mapping of scan chain 15 address field to cp15 registers (continued) address [37] [36:33] [32] register number register name register type
debug support 9-16 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c operation, a status bit is returned to the debugger. if the bit is set, the operation has been completed and the debug sequence can continue. if the bit is cleared, the requested operation has not been completed. the status bit is implemented for the debug scan chain operations shown in table 9-7. the complete list of operations that can be initiated from the debug scan chain are shown in table 9-7. the status bit associated with each cache maintenance operation is shown in table 9-8. table 9-7 status bit mapping of scan chain 15 address field to cp15 registers address [37] [36:33] [32] register number register name register type 0 b0111 0 c7.fd flush data cache read/write 0 b0111 1 c7.fi flush instruction cache read/write 0 b1110 0 c7.fd.s flush data cache single (uses c15.c.ind) read/write 0 b1110 1 c7.fi.s flush instruction cache single (uses c15.c.ind) read/write 1 b1010 1 c7.cd.s clean data cache single (uses c15.c.ind) read/write 0 b1011 1 c15.it instruction tag read/write (uses c15.c.ind) read/write 1 b1110 1 c15.mem tcm bist control read/write table 9-8 correlation between status bits and cache operations status bits cache maintenance operation [31:19] unpredictable [18] flush instruction cache busy [17] flush instruction cache single busy [16:11] unpredictable [10] flush data cache busy [9] flush data cache single busy
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-17 [8] unpredictable [7] clean data cache single busy [6:0] unpredictable table 9-8 correlation between status bits and cache operations (continued) status bits cache maintenance operation
debug support 9-18 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 9.5 debug access to the caches it is desirable for the debugger to examine the contents of the instruction and data caches during debug operations. this is achieved in two steps: 1. the debugger determines if valid addresses are stored in the cache and forms tag addresses from the tag contents and the tag index. 2. the debugger uses the generated addresses to either access main memory, or to read individual entries using the cp15 scan chain. 9.5.1 debug access to the caches, step 1 this is done by reading the instruction cache and data cache tag arrays using scan chain 15. the debugger must do this for each entry set within the cache. the format of the data returned is shown in figure 9-5. figure 9-5 tag address format the tag address is formed from the tag contents and the tag index used to interrogate the tag. this ensures that the data format returned is consistent regardless of cache size. 9.5.2 debug access to the caches, step 2 reading individual entries using the cp15 scan chain can be useful where an entry has been marked as dirty, because this indicates that there is an inconsistency between the cache contents and main memory. for the data cache, the debugger can execute system speed accesses that hit in the cache and, therefore, return the cache contents. writes to the data cache from the processor core by this method result in the dirty bits being set for write-back regions, and main memory is updated for write-through regions. 0 1 2 3 4 5 31 tag address valid dirty2 dirty1 set1 set0
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-19 if the cp15 scan chain is used for updating the data cache, only the cache contents are updated. writes are not made to main memory. for this method you must first program the index/set register with the required cache index, set, and word values. the format of the cache index register is shown in figure 9-6. figure 9-6 cache index register format note although 27 bits are specified for the tag address, only those bits required for the tag implemented are used. the cache index register is also used for writing to the instruction cache. this is useful for setting software breakpoints within code already in the cache. this means that you do not have to flush the cache and reload the entry. note there is no mechanism for detecting that the instruction cache has been updated in this way. the debugger must restore the original cache contents after executing the breakpoint. sbz word address index sbz segment 31 30 29 n + 1 n 5 4 2 1 0
debug support 9-20 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 9.6 debug interface signals there are four primary external signals associated with the debug interface: dbgiebkpt , dbgdewpt , and edbgrq are system requests for the ARM946E-S processor to enter debug state dbgack flag is used by the ARM946E-S processor to inform the system that it is in debug state. 9.6.1 entry into debug state on breakpoint any instruction being fetched from memory is sampled at the end of a cycle. to apply a breakpoint to that instruction, you must assert the breakpoint signal by the end of the same cycle. this is shown in figure 9-7. figure 9-7 breakpoint timing you can build external logic, such as additional breakpoint comparators, to extend the breakpoint functionality of the embeddedice-rt logic. the output from the external logic must be applied to the dbgiebkpt input. this signal is logically ored with the internally-generated breakpoint signal before being applied to the arm9e-s core control logic. the timing of the input makes it unlikely that data-dependent external breakpoints are possible. a breakpointed instruction is enabled to enter the execute stage of the pipeline, but any state change as a result of the instruction is prevented. all writes from previous instructions complete as normal. the decode cycle of the debug entry sequence occurs during the execute cycle of the breakpointed instruction. the latched breakpoint signal forces the processor to start the debug sequence. clk ia[31:0] instr[31:0] dbgiebkpt dbgack 1 2 b 3 4 f1 d1 f2 e1 d2 fb m1 e2 db ddebug w1 m2 (eb) edebug1 w2 (mb) edebug2 (wb)
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-21 9.6.2 breakpoints and exceptions a breakpointed instruction can have a prefetch abort associated with it. if so, the prefetch abort takes priority and the breakpoint is ignored. this is because, if there is a prefetch abort, instruction data might be invalid, the breakpoint might have been data-dependent, and as the data might be incorrect, the breakpoint might have been triggered incorrectly. swi and undefined instructions are treated in the same way as any other instruction that might have a breakpoint set on it. therefore, the breakpoint takes priority over the swi or undefined instruction. on an instruction boundary, if there is a breakpointed instruction and an interrupt ( nirq or nfiq ), the interrupt is taken and the breakpointed instruction is discarded. when the interrupt has been serviced, the execution flow is returned to the original program. where the previously breakpointed instruction is fetched again, and if the breakpoint is still set, the processor enters debug state when the instruction reaches the execute stage of the pipeline. when the processor has entered halt mode debug state, it is important that additional interrupts do not affect the instructions executed. for this reason, as soon as the processor enters halt mode, interrupts are disabled, although the state of the i and f bits in the program status register (psr) are not affected 9.6.3 watchpoints entry into debug state following a watchpointed memory access is imprecise, because of the nature of the pipeline. you can build external logic, such as external watchpoint comparators, to extend the functionality of the embeddedice-rt logic. the output of the external logic must be applied to the dbgdewpt input. this signal is logically ored with the internally-generated watchpoint signal before being applied to the arm9e-s core control logic. the timing of the input makes it unlikely that data-dependent external watchpoints can be implemented. after a watchpointed access, the next instruction in the processor pipeline is always enabled to complete execution. where this instruction is a single-cycle data-processing instruction, entry into debug state is delayed for one cycle while the instruction completes. the timing of debug entry following a watchpointed load in this case is shown in figure 9-8 on page 9-22.
debug support 9-22 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure 9-8 watchpoint entry with data processing instruction note although instruction 5 enters the execute stage, it is not executed, and there is no state update as a result of this instruction. when the debugging session is complete, normal continuation involves a return to instruction 5, the next instruction in the code sequence that has not yet been executed. the instruction following the instruction that generated the watchpoint might modify the program counter (pc) . if this happens, you cannot determine the instruction that caused the watchpoint. figure 9-9 on page 9-23 shows the timing for debug entry after a watchpoint, where the next instruction is a branch. when the processor has entered debug state, you can interrogate the arm9e-s core to determine its state. in the case of a watchpoint, the pc contains a value that is five instructions on from the address of the next instruction to be executed. therefore, if on entry to debug state, in arm state, the instruction sub pc, pc, #20 is scanned in and the processor restarted, execution flow returns to the next instruction in the code sequence. clk inmreq instr[31:0] da[31:0] wdata[31:0] 1 2 ldr dp 5 f1 d1 f2 e1 d2 fldr m1 e2 dldr fdp w1 m2 eldr ddp f5 w2 mldr edp d5 wldr mdp e5 rdata[31:0] dbgdewpt dbgack wdp m5 w5 ddebug edebug1 edebug2 6 7 8
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-23 figure 9-9 watchpoint entry with branch 9.6.4 watchpoints and exceptions if a watchpointed data access also causes an abort, the watchpoint condition is registered and the exception entry sequence performed, and then the processor enters debug state. if there is an interrupt pending, the arm9e-s core enables the exception entry sequence to occur and then enters debug state. 9.6.5 debug request a debug request can take place through the embeddedice-rt logic or by asserting the edbgrq signal. the request is synchronized and passed to the processor. debug request takes priority over any pending interrupt. following synchronization, the core enters debug state when the instruction at the execution stage of the pipeline has completely finished executing (when memory and write stages of the pipeline have completed). while waiting for the instruction to finish executing, no more instructions are issued to the execute stage of the pipeline. clk inmreq instr[31:0] da[31:0] wdata[31:0] ldr b x x t fldr dldr fb eldr db mldr eb wldr mb ft wb dt et rdata[31:0] dbgdewpt dbgack ddebug edebug1 edebug2 t+4 t+8 t+c ia[31:0]
debug support 9-24 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c note if edbgrq is asserted while the processor is operating in monitor mode, the processor enters debug state as if operating in halt mode. 9.6.6 actions of the arm9e-s in debug state when the arm9e-s core is in debug state, both memory interfaces indicate internal cycles. this ensures that the tightly-coupled memory within the ARM946E-S processor, and the ahb interface, are both at a steady state, enabling the rest of the ahb system to ignore the arm9e-s core and function as normal. because the rest of the system continues operation, the arm9e-s core ignores aborts and interrupts. the hresetn signal must be held stable during debug. this is because if the system applies a reset ( hresetn is driven low) to the ARM946E-S processor, the state of the arm9e-s core changes without the knowledge of the debugger.
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-25 9.7 determining the core and system state when the ARM946E-S processor is in debug state, you can examine the core and system state by forcing load or store multiple instructions into the instruction pipeline. before you can examine the core and system state, the debugger must determine whether the processor entered debug from thumb state or arm state, by examining bit 4 of the embeddedice-rt debug status register. when bit 4 is set, the core has entered debug from thumb state.
debug support 9-26 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 9.8 overview of embeddedice-rt the arm9e-s embeddedice-rt logic provides integrated on-chip debug support for the arm9e-s core within the ARM946E-S processor. embeddedice-rt is programmed serially using the arm9e-s tap controller. figure 9-10 illustrates the relationship between the core, embeddedice-rt, and the tap controller, showing only the signals that are pertinent to embeddedice-rt. figure 9-10 the arm9e-s, tap controller, and embeddedice-rt the embeddedice-rt logic comprises: two real-time watchpoint units two independent registers: ? the debug control register ? the debug status register debug communication channel. tap embeddedice-rt arm9e-s dbgtcken dbgtms dbgtdi dbgtdo clk dbgiebkpt edbgrq dbgack dbgen dbgrng[1:0] dbgext[1:0] dbgcommrx dbgcommtx dbgdewpt dbgntrst
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-27 the debug control register and the debug status register provide overall control of embeddedice-rt operation. you can program one or both watchpoint units to halt the execution of instructions by the core. execution halts when the values programmed into embeddedice-rt match the values currently appearing on the address bus, data bus, and various control signals. note you can mask bits so that their values do not affect the comparison. you can configure each watchpoint unit to be either a watchpoint (monitoring data accesses) or a breakpoint (monitoring instruction fetches). watchpoints and breakpoints can be data-dependent in halt mode debug.
debug support 9-28 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 9.9 disabling embeddedice-rt you can disable embeddedice-rt by setting the dbgen input low. caution hard wiring the dbgen input low permanently disables debug access. when dbgen is low, it inhibits dbgdewpt , dbgiebkpt , and edbgrq to the core, and dbgack from the ARM946E-S processor is always low.
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-29 9.10 the debug communication channel the arm9e-s embeddedice-rt logic contains a communication channel for passing information between the target and the host debugger. this is implemented as coprocessor 14. the communication channel comprises: a 32-bit communication data read register a 32-bit wide communication data write register a 6-bit wide communication channel status register for synchronized handshaking between the processor and the asynchronous debugger. these registers are located in fixed locations in the embeddedice-rt logic register map and are accessed from the processor using mcr and mrc instructions to coprocessor 14. in addition to the communication channel registers, the processor can access one bit of the 32-bit debug status register for use in the real-time debug configuration. 9.10.1 debug communication channel registers cp14 contains 4 registers. these have the register allocations listed in table 9-9. 9.10.2 debug communication channel status register the debug communication channel status register is read-only. it controls synchronized handshaking between the processor and the debugger. the debug communication channel status register is shown in figure 9-11 on page 9-30. table 9-9 coprocessor 14 register map register name register number notes communication channel status c0 read-only communication channel data read c1 for reads communication channel data write c1 for writes debug status c2 read/write
debug support 9-30 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure 9-11 debug communication channel status register each register bit functions as follows: bits [31:28] contain a fixed pattern that denotes the embeddedice-rt version number (in this case b0101). bits [27:2] are reserved. bit 1 denotes whether the communication channel data write register is available (from the point of view of the processor). if, from the point of view of the processor, the communication channel data write register is free (w is 0), new data can be written. if the register is not free (w is 1), the processor must poll until w is 0. from the point of view of the debugger, when w is 1, some new data has been written that can then be scanned out. bit 0 denotes whether there is new data in the communication channel data read register. if r is 1, there is new data that can be read using an mrc instruction. from the point of view of the debugger, if r is 0, the communication channel data read register is free, and new data can be placed there through the scan chain. if r is 1, this denotes that data previously placed there through the scan chain has not been collected by the processor, and so the debugger must wait. from the point of view of the debugger, the registers are accessed using the scan chain in the usual way. from the point of view of the processor, these registers are accessed using coprocessor register transfer instructions as follows: mrc p14, 0, rd, c0, c0 this returns the debug communication channel status register into rd . mcr p14, 0, rn, c1, c0 this writes the value in rn to the communication channel data write register. 31 30 29 28 27 0 01 1 should be zero w r 21 0
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-31 mrc p14, 0, rd, c1, c0 this returns the debug data read register into rd . you are advised to access this data using swi instructions when in thumb state because the thumb instruction set does not contain coprocessor instructions. 9.10.3 communications using the communication channel you can send and receive messages using the communication channel. sending a message to the debugger when the processor has to send a message to the debugger, it must check the communication channel data write register is free for use by reading the w bit of the debug communication channel status register: if the w bit is clear, the communication channel data write register is clear. if the w bit is set, previously written data has not been read by the debugger. the processor must continue to poll the control register until the w bit is clear. when the w bit is clear, a message can be sent by a register transfer to coprocessor 14. while the data transfer occurs from the processor to the communication channel data write register, the w bit is set in the debug communication channel status register. the debugger sees both the r and w bits when it polls the debug communication channel status register through the jtag interface. when the debugger sees that the w bit is set, it can read the communication channel data write register, and scan the data out. the action of reading this data register clears the debug communication channel status register w bit. at this point, the communications process can begin again. receiving a message from the debugger transferring a message from the debugger to the processor is similar to sending a message to the debugger. in this case, the debugger polls the r bit of the debug communication channel status register: if the r bit is clear, the communication channel data read register is free, and data can be placed there for the processor to read if the r bit is set, previously deposited data has not yet been collected, so the debugger must wait.
debug support 9-32 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c when the communication channel data read register is free, data can be written to it using the jtag interface. this sets the r bit in the debug communication channel status register. the processor polls the debug communication channel status register. if the r bit is set, there is data that can be read using an mrc instruction to coprocessor 14. reading the communication channel data register clears the r bit in the debug communication channel status register. when the debugger polls this register and sees that the r bit is clear, the data has been taken, and the process can now be repeated.
debug support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 9-33 9.11 monitor mode debugging the arm9e-s within ARM946E-S processor contains logic that enables you to debug a system without stopping the core entirely. this enables the continued servicing of critical interrupt routines while the core is being interrogated by the debugger. setting bit 4 of the debug control register enables the real-time debug features of arm9e-s. when this bit is set, the embeddedice-rt logic is configured so that a breakpoint or watchpoint causes the arm to enter abort mode, taking the prefetch abort or data abort vectors respectively. you must be aware of a number of restrictions when the arm is configured for monitor mode debugging: breakpoints/watchpoints cannot be data-dependent. no support is provided for the range and chain functionality. breakpoints/watchpoints can only be based on: ? instruction/data addresses ? external watchpoint conditioner ( dbgext ) ? user/privileged mode access ? read/write access (watchpoints) ? access size (breakpoints). the single-step hardware is not enabled. external breakpoints/watchpoints are not supported. you can use the vector catching hardware, but must not configure it to catch the prefetch or data abort exceptions. no support is provided to mix halt mode/monitor mode debug functionality. when the core is configured into the monitor mode, asserting the external edbgrq signal results in unpredictable behavior. setting the internal edbgrq bit results in unpredictable behavior. the fact that an abort has been generated by the monitor mode is recorded in the abort status register in coprocessor 14 (see scan chain debug status register on page 9-15). the monitor mode enable bit does not put the ARM946E-S processor into debug state. for this reason, it is necessary to change the contents of the watchpoint registers while external memory accesses are taking place, rather than changing them when in debug state where the core is halted. if there is a possibility of false matches occurring during changes to the watchpoint registers (caused by old data in some registers and new data in others) you must: 1. disable the watchpoint unit by setting embeddedice-rt disable, bit 5 in the debug control register. 2. change the other registers.
debug support 9-34 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 3. re-enable the watchpoint unit by clearing the embeddedice-rt disable bit in the debug control register. 9.11.1 debug in depth a more detailed description of the arm9e-s debug features and jtag interface are provided in the arm9e-s technical reference manual, appendix d debug in depth.
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 10-1 chapter 10 test support this chapter describes the test methodology used for the ARM946E-S processor synthesized logic and memory. it contains the following sections: about the ARM946E-S processor test methodology on page 10-2 scan insertion and atpg on page 10-3 bist of memory arrays on page 10-5.
test support 10-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 10.1 about the ARM946E-S processor test methodology to achieve a high level of fault coverage, you can use scan insertion and atpg techniques on the arm9e-s core and ARM946E-S processor control logic as part of the synthesis flow. you can use built-in self test (bist) to provide high fault coverage of the compiled rams (cache and tcm).
test support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 10-3 10.2 scan insertion and atpg this technique is covered in detail in the ARM946E-S implementation guide . scan insertion requires that all register elements are replaced by scannable versions that are then connected up into a number of large scan chains. these scan chains are used to set up data patterns on the combinatorial logic between the registers, and capture the logic outputs. the logic outputs are then scanned out while the next data pattern is scanned in. you can use automatic test pattern generation (atpg) tools to create the necessary scan patterns to test the logic, after the scan insertion has been performed. with this technique you can achieve very high fault coverage for the standard cell combinatorial logic, typically in the 95-99% range. scan insertion does have an impact on the area and performance of the synthesized design, because of the larger scan register elements and the serial routing between them. however, to minimize these effects, the scan insertion is performed early in the synthesis cycle and the design re-optimized with the scan elements in place. 10.2.1 ARM946E-S intest wrapper in addition to the auto-inserted scan chains, the ARM946E-S processor optionally includes a dual-purpose intest scan chain wrapper. this facilitates atpg and provides an additional method for activating bist of the compiled ram. atpg you can use the intest scan chain to enable an atpg tool to access the ARM946E-S processor top-level inputs and outputs in an embedded design. this wrapper adds a scan source for each ARM946E-S processor input and a capture cell for each output. the atpg tools use this scan chain in addition to the ones created by scan insertion, to test the logic from a given input pin to any register that it connects to, and from any registers whose outputs end up at a pin. note the order of this scan chain is predetermined and must be maintained through synthesis and place and route of the macrocell. bist activation to enable the bist hardware to be activated by scan means, the intest wrapper has a second operational mode. when the serialen input is true, serialized mcr instructions to initiate bist operation are scanned in through this scan chain. the instructions target the cp15 bist register. after a predetermined number of clock
test support 10-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c cycles (depending on the size of the test), the appropriate mrc instruction is scanned in to read the bist control register to check the test result. the intest wrapper enables the full range of bist operations to be applied as detailed in bist of memory arrays on page 10-5. the flow for generating the serialized patterns from arm assembler source is supplied with the ARM946E-S implementation scripts. testmode this signal is used to prevent the cache from being inadvertently flushed when scan patterns are shifted through the scan chains. it must only be asserted during scan test of the ARM946E-S processor.
test support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 10-5 10.3 bist of memory arrays caution code for running the bist must not be placed in the instruction tcm or in a cacheable location, because this can cause invalid or dirty data to be introduced into program execution. also, caches must be flushed after running the bist. adding a simple memory test controller enables you to perform an exhaustive test of the memory arrays. you can activate bist operation using an mcr to the cp15 bist control register. when you perform a bist operation on compiled ram, the functional enable for all rams is automatically disabled, forcing all memory accesses to all tcm and cache address ranges to go to the ahb. this enables you to run bist operations in the background (for instance the instruction tcm can be have bist applied, while code is executed over the ahb). serial scan access to the cp15 bist operations is also provided for production test purposes, using a special mode of operation of the intest wrapper. see ARM946E-S intest wrapper on page 10-3. you can also perform limited bist in debug state by using scan chain 15 to access the cp15 bist control register. this is not necessarily recommended as the bist operation corrupts the contents of the tcm being tested. you can achieve full programmer control over the bist mechanism through five registers that are mapped to cp15 register 15 address space. for details of the mcr/mrc instructions used to access these registers, see register 15, bist control registers on page 2-29. 10.3.1 bist algorithm the bist test algorithm is a 6n test. the test flow is shown in figure 10-1 on page 10-7. the first pass starts from the bottom of the memory to be tested. a fixed value is written into each memory address to be tested and the address is incremented until the top of memory is reached. the second pass starts from the bottom of the memory to be tested. in the second pass the fixed pattern is checked. if the pattern match fails then the bist fail flags are set and the test fails. if the pattern match is successful then the inverse pattern is written to each memory address. if the pattern match fails then the bist fail flags are set and the test fails. the address is incremented until the top of memory is reached.
test support 10-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c the third pass starts from the top of memory. the inverse pattern is checked, a fixed value is written into each memory address to be tested. the pattern is then checked. if the pattern match fails on either check, then the bist fail flags are set and the test fails. the address is decremented until the bottom of the area of memory under test is reached.
test support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 10-7 figure 10-1 test flow for bist increment pointer no no yes no top of memory? reset pointer to bottom of memory yes start initialise pointer at bottom of memory top of memory? yes pattern correct? yes no yes no bottom of memory? pattern correct? pattern correct? stop write fixed pattern check fixed pattern write inverse pattern increment pointer check inverse pattern write fixed pattern read fixed pattern decrement pointer bist fail no
test support 10-8 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c 10.3.2 bist control register the cp15 register 15 bist control register controls the operation of the compiled ram memory bist. before initiating a bist operation, an mcr is first performed to the bist control register to set up the size of the test and enable the ram to be tested. an additional mcr is required to initiate the test. you can access the current status of a bist operation and the result of a completed test by performing an mrc to the bist control register. this returns flags to indicate that a test is: running paused failed completed. when the test result has been read you can return the memory to functional operation. you must first clear the bist enable by writing to the bist control register. you must then re-enable the memory array by writing to cp15 register 1. note clearing the functional memory array enable when bist is enabled prevents you from trying to run from cache or tcm following a bist operation, without having first flushed the cache memory and reprogrammed the ram. this is necessary because the bist algorithm corrupts all tested memory locations. 10.3.3 bist address and general registers the bist control register enables you to perform standard bist operations on each ram block and to optionally specify the size of the test. additional registers are required, however, to provide the following functionality: testing of the bist hardware changing the seed data for bist providing a nonzero starting address for bist peek and poke of the ram returning an address location for a failed bist. this additional functionality is most useful for debugging faulty silicon during production test. the exception to this is the start address for a bist operation. it is possible to perform periodic bist operations on ram during the execution of a program rather than in one go. this requires a start address that is incremented by the size of the test each time a test is activated.
test support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 10-9 note it is recommended that you do not write application code that relies on the presence of the bist address and general registers. arm limited. does not guarantee to support these registers in future versions of the ARM946E-S processor. table 10-1 and table 10-2 show how the registers are used. the pause bits from the bist control register provide extra decode of these registers. 10.3.4 pause modes it is recommended that you use the following production test sequence for the compiled ram: 1. test each ram using a full test. 2. test the bist hardware for each ram. table 10-1 instruction bist address and general registers bist register ibist pause read write ibist address register 0 ibist fail address ibist start address ibist address register 1 ibist fail address ibist peek/poke address ibist general register 0 ibist fail data ibist seed data ibist general register 1 ibist peek data ibist poke data table 10-2 data bist address and general registers bist register dbist pause read write dbist address register 0 dbist fail address dbist start address dbist address register 1 dbist fail address dbist peek/poke address dbist general register 0 dbist fail data dbist seed data dbist general register 1 dbist peek data dbist poke data
test support 10-10 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c to enable testing of the bist hardware, it is necessary to deliberately corrupt data in the ram. this can be done by the atpg tool if it recognizes the ram parameters. alternatively a pause mechanism enables you to halt the bist test, enabling you to corrupt data within the ram. the sequence for this is: 1. use an mcr instruction to write the address for the location to be corrupted to the relevant bist address register. 2. use an mcr instruction to write the corrupted data to the bist general register. you can restart the test using an mcr instruction to the bist control register and then check to see that the corrupted data causes the test to fail. you can read the address at which the bist operation failed and data from the bist address and general registers. in addition to controlling the addressing within the address and general registers, the pause bit also controls the progression of the bist algorithm as described in auto pause . note it is recommended that you do not write application code that relies on the presence of the bist pause mode. arm limited does not guarantee to support this feature in future versions of the ARM946E-S processor. auto pause if you set the pause bit in the bist control register before you activate the test, the test runs in auto pause mode, where the bist operation pauses at a predetermined point in the bist algorithm. the test pauses after the first pass through ram. you can poll the bist control register to detect when a test has paused (the running flag is clear). you can then corrupt the data, as described in pause modes on page 10-9, before you restart the bist test. note auto pause only operates after the first pass of the bist operation. 10.3.5 running a test to start a test, perform the following: 1. write to the bist control register with relevant pause bit and start strobe bits cleared, enable bits set, and a suitable size value. the tcm is disabled for normal core accesses from this time onwards.
test support arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. 10-11 2. write suitable values to the bist start address and pattern data registers. 3. write the bist control register with the bist start strobe bit set, and the pause bit cleared (for normal mode) or set (for auto pause mode). the test runs, and the bist running flag is set. if a failure occurs, the test hardware stores the failed address and data, and then goes to the idle state. at this point the running flag is cleared, the completion flag is set, and the fail flag set. if the test completes without failures, the bist running flag is cleared and the completion flag is set. if the test is paused using auto pause, the bist running flag is cleared, and is set again when the test is restarted. note the completion and fail flags retain their state between test invocations. they are only reset when a new test is started.
test support 10-12 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. a-1 appendix a ac parameters this appendix lists the ac timing parameters for the ARM946E-S processor. it contains the following sections: timing diagrams on page a-2.
ac parameters a-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c a.1 timing diagrams the timing diagrams in this section are: clock, reset, and ahb enable timing ahb bus request and grant related timing on page a-3 ahb bus master timing on page a-4 coprocessor interface timing on page a-6 debug interface timing on page a-8 jtag interface timing on page a-10 dbgsdout to dbgtdo timing on page a-11 exception and configuration timing on page a-12 tcm interface timing on page a-13 etm interface timing on page a-15. each timing diagram is followed by a table showing timing parameters. all figures are expressed as percentages of the clk period at maximum operating frequency. note the figures quoted are relative to the rising clock edge after the clock skew for internal buffering has been added. inputs given a 0% hold figure therefore require a positive hold relative to the top-level clock input. the amount of hold required is equivalent to the internal clock skew. clock, reset, and ahb enable timing parameters are shown in figure a-1. figure a-1 clock, reset, and ahb enable timing t cyc t ihhen clk hclken hresetn t ihrst t ishen t isrst
ac parameters arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. a-3 table a-1 shows timing parameter definitions for clock, reset, and ahb enable. ahb bus request and grant related timing parameters are shown in figure a-2. figure a-2 ahb bus request and grant related timing table a-2 shows parameter definitions for ahb bus request and grant timing. table a-1 timing parameter definitions for clock, reset, and ahb enable symbol parameter min max t cyc clk cycle time 100% - t ishen hclken input setup to rising clk 85% - t ihhen hclken input hold from rising clk 0% - t isrst hresetn de-assertion input setup to rising clk 90% - t ihrst hresetn de-assertion input hold from rising clk 0% - t ohlck t ohreq clk hbusreq hlock t ovreq t isgnt hgrant t ihgnt t ovlck table a-2 parameter definitions for ahb bus request and grant timing symbol parameter min max t ovreq rising clk to hbusreq valid - 30% t ohreq hbusreq hold time from rising clk 0% - t ovlck rising clk to hlock valid - 30%
ac parameters a-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c ahb bus master timing parameters are shown in figure a-3. figure a-3 ahb bus master timing t ohlck hlock hold time from rising clk 0% - t isgnt hgrant input setup to rising clk 50% - t ihgnt hgrant input hold from rising clk 0% - table a-2 parameter definitions for ahb bus request and grant timing (continued) symbol parameter min max t isrd t isrsp t oha t ohtr clk htrans[1:0] haddr[31:0] t ovtr t isrdy t ova hwrite hsize[2:0] hburst[2:0] hprot[3:0] hwdata[31:0] hready hresp[1:0] hrdata[31:0] nonseq a t ohctl t ovctl control t ohwd t ovwd write data (a) t ihrdy okay okay t ihrsp read data (a) t ihrd
ac parameters arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. a-5 table a-3 shows parameter definitions for ahb bus master timing. coprocessor interface timing parameters are shown in figure a-4 on page a-6. table a-3 parameter definitions for ahb bus master timing symbol parameter min max t ovtr rising clk to htrans[1:0] valid - 30% t ohtr htrans[1:0] hold time from rising clk 0% - t ova rising clk to haddr[31:0] valid - 30% t oha haddr[31:0] hold time from rising clk 0% - t ovctl rising clk to ahb control signals valid - 30% t ohctl ahb control signals hold time from rising clk 0% - t ovwd rising clk to hwdata[31:0] valid - 30% t ohwd hwdata[31:0] hold time from rising clk 0% - t isrdy hready input setup to rising clk 50% - t ihrdy hready input hold from rising clk 0% - t isrsp hresp[1:0] input setup to rising clk 50% - t ihrsp hresp[1:0] input hold from rising clk 0% - t isrd hrdata[31:0] input setup to rising clk 40% - t ihrd hrdata[31:0] input hold from rising clk 0% -
ac parameters a-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure a-4 coprocessor interface timing table a-4 shows parameter definitions for coprocessor interface timing. t ohcprd t ovcprd t ovcplc t iscphs t ohcpid t ohcpen clk cpclken cpinstr[31:0] t ovcpen t ovcpid ncpmreq ncptrans cptbit chsde[1:0] chsex[1:0] cplatecancel cppass cpdout[31:0] t ohcpctl t ovcpctl wait/go last/absent t ihcphs t ohcplc t ovcpps t ohcpps cpdin[31:0] stc/mrc data t ihcpwr t iscpwr table a-4 parameter definitions for coprocessor interface timing symbol parameter min max t ovcpen rising clk to cpclken valid - 30% t ohcpen cpclken hold time from rising clk 0% - t ovcpid rising clk to cpinstr[31:0] valid - 30% t ohcpid cpinstr[31:0] hold time from rising clk 0% - t ovcpctl rising clk to transaction control valid - 30% t ohcpctl transaction control hold time from rising clk 0% - t iscphs coprocessor handshake input setup to rising clk 50% -
ac parameters arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. a-7 debug interface timing parameters are shown in figure a-5 on page a-8. t ihcphs coprocessor handshake input hold from rising clk 0% - t ovcplc rising clk to cplatecancel valid - 30% t ohcplc cplatecancel hold time from rising clk 0% - t ovcpps rising clk to cppass valid - 30% t ohcpps cppass hold time from rising clk 0% - t ovcprd rising clk to cpdout[31:0] valid - 30% t ohcprd cpdout[31:0] hold time from rising clk 0% - t iscpwr cpdin[31:0] input setup to rising clk 50% - t ihcpwr cpdin[31:0] input hold from rising clk 0% - table a-4 parameter definitions for coprocessor interface timing (continued) symbol parameter min max
ac parameters a-8 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure a-5 debug interface timing table a-5 shows parameter definitions for debug interface timing. t isdbgext t ohdbgack clk dbgack dbgrng[1:0] t ovdbgack dbgrqi dbginstrexec commrx commtx dbgext[1:0] dbgiebkpt dbgdewpt t ohdbgrng t ovdbgrng t ohdbgrqi t ovdbgrqi t ohdbgstat t ovdbgstat t ohdbgcomm t ovdbgcomm t ihdbgext t isiebkpt t ihiebkpt t isdewpt t ihdewpt t isedbgrq edbgrq t ihedbgrq t isdbgen dbgen t ihdbgen table a-5 parameter definitions for debug interface timing symbol parameter min max t ovdbgack rising clk to dbgack valid - 60% t ohdbgack dbgack hold time from rising clk 0% - t ovdbgrng rising clk to dbgrng[1:0] valid - 80% t ohdbgrng dbgrng[1:0] hold time from rising clk 0% -
ac parameters arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. a-9 jtag interface timing parameters are shown in figure a-6 on page a-10. t ovdbgrqi rising clk to dbgrqi valid - 45% t ohdbgrqi dbgrqi hold time from rising clk 0% - t ovdbgstat rising clk to dbginstrexec valid - 30% t ohdbgstat clk hold time from rising dbginstrexec 0% - t ovdbgcomm rising clk to communication channel outputs valid - 60% t ohdbgcomm communication channel outputs hold time from rising clk 0% - t isdbgen dbgen input setup to rising clk 35% - t ihdbgen dbgen input hold from rising clk 0% - t isedbgrq edbrq input setup to rising clk 20% - t ihedbgrq edbrq input hold from rising clk 0% - t isdbgext dbgext input setup to rising clk 15% - t ihdbgext dbgext input hold from rising clk 0% - t isiebkpt dbgiebkpt input setup to rising clk 50% - t ihiebkpt dbgiebkpt input hold from rising clk 0% - t isdewpt dbgdewpt input setup to rising clk 50% - t ihdewpt dbgdewpt input hold from rising clk 0% - table a-5 parameter definitions for debug interface timing (continued) symbol parameter min max
ac parameters a-10 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c figure a-6 jtag interface timing table a-6 shows parameter definitions for jtag interface timing. t ihntrst t istdi t ohdbgsm clk dbgscreg[4:0] dbgtapsm[3:0] dbgntdoen t ovdbgsm dbgsdin dbgtdo dbgntrst dbgtdi dbgtms dbgtcken tapid[3:0] t ohtdoen t ovtdoen t ohsdin t ovsdin t ohtdo t ovtdo t ihtdi t istcken t ihtcken t istapid t ihtapid t isntrst t ohir dbgir[3:0] t ovgir table a-6 parameter definitions for jtag interface timing symbol parameter min max t ovir rising clk to dbgir[3:0] valid - 25% t ohir dbgir[3:0] hold time from rising clk 0% - t ovdbgsm rising clk to debug state valid - 30% t ohdbgsm debug state hold time from rising clk 0% - t ovtdoen rising clk to dbgntdoen valid - 40%
ac parameters arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. a-11 a combinatorial path timing parameter exists from the dbgsdout input to dbgtdo output. this is shown in figure a-7. figure a-7 dbgsdout to dbgtdo timing t ohtdoen dbgntdoen hold time from rising clk 0% - t ovsdin rising clk to dbgsdin valid - 20% t ohsdin dbgsdin hold time from rising clk 0% - t ovtdo rising clk to dbgtdo valid - 65% t ohtdo dbgtdo hold time from rising clk 0% - t isntrst dbgntrst de-asserted input setup to rising clk 25% - t ihntrst dbgntrst input hold from rising clk 0% - t istdi tap state control input setup to rising clk 25% - t ihtdi tap state control input hold from rising clk 0% - t istcken dbgtcken input setup to rising clk 50% - t ihtcken dbgtcken input hold from rising clk 0% - t istapid tapid[3 :0] input setup to rising clk 35% - t ihtapid tapid[3 :0] input hold from rising clk 0% - table a-6 parameter definitions for jtag interface timing (continued) symbol parameter min max dbgsdout dbgtdo t tdsd t tdsh
ac parameters a-12 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c table a-7 shows parameter definitions for dbgsdout to dbgtdo timing. exception and configuration timing parameters are shown in figure a-8. figure a-8 exception and configuration timing table a-8 shows parameter definitions for exception and configuration timing. table a-7 parameter definitions for dbgsdout to dbgtdo timing symbol parameter min max t tdsd dbgtdo delay from dbgsdoutbs changing - 30% t tdsh dbgtdo hold time from dbgsdoutbs changing 0% - t isint t ohbigend clk bigendout t ovbigend nfiq nirq vinithi initram t ihint t ishivecs t ihhivecs t isinitram t ihinitram table a-8 parameter definitions for exception and configuration timing symbol parameter min max t ovbigend rising clk to bigendout valid - 30% t ohbigend bigendout hold time from rising clk 0% - t isint interrupt input setup to rising clk 15% - t ihint interrupt input hold from rising clk 0% - t ishivecs vinithi input setup to rising clk 90% -
ac parameters arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. a-13 note the vinthi and initram signals are specified as 90% of the cycle because it is for input configuration during reset and can be considered static. the tcm interface timing parameters are shown in figure a-9. figure a-9 tcm interface timing t ihhivecs vinithi input hold from rising clk 0% - t isinitram initram input setup to rising clk 90% - t ihinitram initram input hold from rising clk 0% - table a-8 parameter definitions for exception and configuration timing (continued) symbol parameter min max t ihtcmrd t ovtcmwd t ovtcmctl t oventcm t ovatcm clk tcmadrs[17:0] a a tcmen t ohatcm t ohentcm tcmwen t ohtcmctl tcmwdata[31:0] a t ohtcmwd tcmrdata[31:0] read data (a) t istcmrd a a a
ac parameters a-14 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c table a-9 shows parameter definitions for tcm interface timing. the etm interface timing parameters are shown in figure a-10 on page a-15. table a-9 parameter definitions for tcm interface timing symbol parameter min max t ovatcm rising clk to tcmadrs[17:0] valid - 90% t ohatcm tcmadrs[17:0] hold time from rising clk 0% - t oventcm rising clk to tcmen valid - 90% t ohentcm tcmen hold time from rising clk 0% - t ovtcmctl rising clk to tcm control signals valid - 90% t ohtcmctl tcm control signals hold time from rising clk 0% t istcmrd tcmrdata[31:0] input setup to rising clk 30% - t ihtcmrd tcmrdata[31:0] input hold from rising clk 0% - t ovtcmwd rising clk to tcmwdata[31:0] valid - 90% t ohtcmwd tcmwdata[31:0] hold time from rising clk 0% -
ac parameters arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. a-15 figure a-10 etm interface timing t isetmen t ohetminst clk etmia[31:1] etmid31to25[31:25] etmid15to11[15:11] t ovetminst etmen t ihetmen etminmreq etmiseq etmitbit etmiabort t ohetmictl t ovetmictl etminstrexec t ohetmstat t ovetmstat etmda[31:0] etmrdata[31:0] etmwdata[31:0] etmdmas[31:0] t ohetmdata t ovetmdata etmnwait t ohetmnwait t ovetmnwait t ohetmdctl etmdmore etmdnmreq etmdnrw etmdabort t ovetmdctl etmbigend etmhivecs t ohetmcfg t ovetmcfg etmchsd[1:0] etmchse[1:0] etmpass etmlatecancel t ohetmcpif t ovetmcpif etmdbgack etmrngout[1:0] t ohetmdbg t ovetmdbg t isfifofull fifofull t ihfifofull
ac parameters a-16 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c table a-10 shows parameter definitions for etm interface timing. table a-10 parameter definitions for etm interface timing symbol parameter min max t ovetminst rising clk to etm instruction interface valid - 30% t ohetminst etm instruction interface hold time from rising clk 0% - t ovetmictl rising clk to etm instruction control valid - 30% t ohetmictl etm instruction control hold time from rising clk 0% - t ovetmstat rising clk to instrexec valid - 30% t ohetmstat instrexec hold time from rising clk 0% - t ovetmdata rising clk to etm data interface valid - 30% t ohetmdata etm data interface hold time from rising clk 0% - t ovetmnwait rising clk to nwait valid - 30% t ohetmnwait nwait hold time from rising clk 0% - t ovetmdctl rising clk to etm data control valid - 30% t ohetmdctl etm data control hold time from rising clk 0% - t ovetmcfg rising clk to etm configuration valid - 30% t ohetmcfg etm configuration hold time from rising clk 0% - t ovetmcpif rising clk to etm coprocessor signals valid - 30% t ohetmcpif etm coprocessor signals hold time from rising clk 0% - t ovetmdbg rising clk to etm debug signals valid - 30% t ohetmdbg etm debug signals hold time from rising clk 0% - t isetmen en input setup to rising clk 50% - t ihetmen en input hold from rising clk 0% - t isfifofull etmfifofull input setup to rising clk 50% - t ihfifofull etmfifofull input hold from rising clk 0% -
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. b-1 appendix b signal descriptions this appendix describes the interfaces to the ARM946E-S processor. it contains the following sections: signal properties and requirements on page b-2 clock interface signals on page b-3 tcm interface signals on page b-4 ahb signals on page b-5 coprocessor interface signals on page b-8 debug signals on page b-10 jtag signals on page b-12 miscellaneous signals on page b-13 etm interface signals on page b-14 intest wrapper signals on page b-16.
signal descriptions b-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c b.1 signal properties and requirements to ensure ease of integration of the ARM946E-S processor into embedded applications and to simplify synthesis flow, the following design techniques have been used: a single rising edge clock times all activity all signals and buses are unidirectional all inputs are required to be synchronous to the single clock. these techniques simplify the definition of the top-level ARM946E-S processor signals because all outputs change from the rising edge and all inputs are sampled with the rising edge of the clock. in addition, all signals are either input or output only, because bidirectional signals are not used. note you must use external logic to synchronize asynchronous signals (for example interrupt sources) before applying them to the ARM946E-S processor.
signal descriptions arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. b-3 b.2 clock interface signals table b-1 describes the ARM946E-S clock interface signals. table b-1 clock interface signals name direction description clk system clock input this clock times all operations in the ARM946E-S processor design. all outputs change from the rising edge and all inputs are sampled on the rising edge. the clock can be stretched in either phase. using the hclken signal, this clock also times ahb operations. using the dbgtcken signal, this clock also times debug operations. hclken input synchronous enable for ahb transfers. when high indicates that the next rising edge of clk is also a rising edge of hclk in the ahb system that the ARM946E-S processor is embedded in. must be tied high in systems where clk and hclk are intended to be the same frequency. dbgtcken input synchronous enable for debug logic accessed using the jtag interface. when high on the rising edge of clk the debug logic can advance. gatetheclk output clock control signal for wait for interrupt. when asserted, the clk input can be stopped to minimize power. note when clk is disabled, generating a debug request within the ARM946E-S processor does not re-enable the core. ungatedclk input free-running clock that is only used to wake-up the processor from the power-saving mode.
signal descriptions b-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c b.3 tcm interface signals table b-2 describes the ARM946E-S tcm interface signals. table b-2 tcm interface signals signal direction description dtcmadrs[17:0] output data tcm address. this is a word address. dtcmwdata[31:0] output write data to the tcm. dtcmrdata[31:0] input read data from the tcm. dtcmen output data tcm enable. dtcmwen[3:0] output data tcm write enables. there is one write enable for each byte. phydtcmsize[3:0] input encoded size of the data tcm. the encoding for these signals is given in table 2-8 on page 2-11. itcmadrs[17:0] output instruction tcm address. this is a word address. itcmwdata[31:0] output write data to the instruction tcm. itcmrdata[31:0] input read data from the instruction tcm. itcmen output instruction tcm enable. itcmwen[3:0] output instruction tcm write enables. there is one write enable for each byte. phyitcmsize[3:0] input encoded size of the instruction tcm. the encoding for these signals is given in table 2-8 on page 2-11.
signal descriptions arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. b-5 b.4 ahb signals table b-3 describes the ARM946E-S ahb signals. table b-3 ahb signals name direction description haddr[31:0] address bus output the 32-bit ahb system address bus. hburst[2:0] burst type output indicates if the transfer forms part of a burst. the ARM946E-S processor supports: single transfer cycle (b000) incremental burst cycles: ? incr(b001) ? incr4(b011) ? incr8(b101). hbusreq bus request output indicates that the ARM946E-S processor requires the bus. hgrant bus grant input indicates that the ARM946E-S processor is currently the highest priority master. ownership of the address/control signals changes at the end of a transfer when hready is high, so the ARM946E-S processor gets access to the bus when both hready and hgrant are high. hlock request locked transfers output when high, indicates that the ARM946E-S processor requires locked access to the bus and no other master must be granted until this signal has gone low. asserted by the ARM946E-S processor when executing swp instructions to ahb address space.
signal descriptions b-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c hprot[3:0] protection control output indicates that the ARM946E-S processor transfer is an: opcode fetch (b---0) data access (b---1). indicates if the transfer is: user mode access (b--0-) supervisor mode access (b--1-). indicates that an access is: nonbufferable (b-0--) bufferable (b-1--). indicates that an access is: noncachable (b0---) cachable (b1---) hrdata[31:0] read data bus input the 32-bit read data bus transfers data from a selected bus slave to the ARM946E-S processor during read operations. hready transfer done input when high indicates that a transfer has finished on the bus. this signal can be driven low by the selected bus slave to extend a transfer. hresetn not reset input this is the active low reset signal for initializing the ARM946E-S processor system state. this signal can be asserted asynchronously but must be deasserted synchronously. hresp[1:0] transfer response input the transfer response from the selected slave provides additional information on the status of the transfer. the response can be: okay (b00) error (b01) retry (b10) split (b11). hsize[2:0] transfer size output indicates the size of an ARM946E-S processor transfer. this can be: byte (b000) halfword (b001) word (b010). bit 2 is tied low. table b-3 ahb signals (continued) name direction description
signal descriptions arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. b-7 htrans[1:0] transfer type output indicates the type of ARM946E-S processor transfer. this can be: idle (b00) busy (b01) nonseq (b10) seq (b11). hwdata[31:0] write data bus output the 32-bit write data bus transfers data from the ARM946E-S processor to a selected bus slave during write operations. hwrite transfer direction output when high indicates a write transfer. when low indicates a read transfer. table b-3 ahb signals (continued) name direction description
signal descriptions b-8 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c b.5 coprocessor interface signals table b-4 describes the ARM946E-S coprocessor interface signals. table b-4 coprocessor interface signals name direction description cpclken coprocessor clock enable output synchronous enable for coprocessor pipeline follower. when high on the rising edge of clk the pipeline follower logic can advance. cpinstr[31:0] coprocessor instruction data output the 32-bit coprocessor instruction bus used to transfer instructions to the coprocessor pipeline follower. cpdout[31:0] coprocessor read data output the 32-bit coprocessor read data bus for transferring data to the coprocessor. cpdin[31:0] coprocessor write data input the 32-bit coprocessor write data bus for transferring data from the coprocessor. cppass output indicates that there is a coprocessor instruction in the execute stage of the pipeline, that must be executed. cplatecancel output if high during the first memory cycle of a coprocessor instruction, then the coprocessor must cancel the instruction without changing any internal state. this signal is only asserted in cycles where the previous instruction causes a data abort to occur. chsde[1:0] coprocessor handshake decode input the handshake signals from the decode stage of the coprocessor pipeline follower. indicates: absent (b10) wait (b00) go (b01) last (b11). chsex[1:0] coprocessor handshake execute input the handshake signals from the execute stage of the coprocessor pipeline follower. indicates: absent (b10) wait (b00) go (b01) last (b11).
signal descriptions arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. b-9 cptbit coprocessor instruction thumb bit output when high indicates that the ARM946E-S processor is in thumb state. when low indicates that the ARM946E-S processor is in arm state. sampled by the coprocessor pipeline follower. ncpmreq not coprocessor instruction request output when low on the rising edge of clk and cpclken is high, the instruction on cpinstr must enter the coprocessor pipeline. ncptrans not coprocessor memory translate output when low indicates that the ARM946E-S processor is in user mode. when high indicates that the ARM946E-S processor is in privileged mode. sampled by the coprocessor pipeline follower. table b-4 coprocessor interface signals (continued) name direction description
signal descriptions b-10 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c b.6 debug signals table b-5 describes the ARM946E-S debug signals. table b-5 debug signals name direction description commrx communication channel receive output when high denotes that the communication channel receive buffer contains valid data waiting to be read. commtx communication channel transmit output when high, denotes that the communication channel transmit buffer is empty waiting for data to be written. dbgack debug acknowledge output when high indicates that the processor is in debug state. dbgdewpt data watchpoint input asserted by external hardware to halt execution of the processor for debug purposes. if high at the end of a data memory request cycle, it causes the ARM946E-S processor to enter debug state. dbgen debug enable input this signal enables the debug features of the arm9e-s core. if you intend to use the arm9e-s debug features, tie this signal high. drive this signal low only when debugging is not required. dbgext[1:0] embeddedice-rt external input input input to the embeddedice-rt logic enables breakpoints/watchpoints to be dependent on external conditions. dbgiebkpt instruction breakpoint input asserted by external hardware to halt execution of the processor for debug purposes. if high at the end of an instruction fetch, it causes the ARM946E-S processor to enter debug state if that instruction reaches the execute stage of the processor pipeline. dbginstrexec instruction executed output indicates that the instruction in the execute stage of the processors pipeline has been executed.
signal descriptions arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. b-11 dbgrng[1:0] embeddedice-rt rangeout output indicates that the corresponding embeddedice-rt watchpoint register has matched the conditions currently present on the address, data, and control buses. this signal is independent of the state of the watchpoint enable control bit. dbgrqi internal debug request output represents the debug request signal that is presented to the core debug logic. this is a combination of edbgrq and bit 1 of the debug control register. edbgrq external debug request input an external debugger can force the processor into debug state by asserting this signal. table b-5 debug signals (continued) name direction description
signal descriptions b-12 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c b.7 jtag signals table b-6 describes the ARM946E-S jtag signals. table b-6 jtag signals name direction description dbgir[3:0] tap controller instruction register output these four bits reflect the current instruction loaded into the tap controller instruction register. these bits change when the tap controller is in the update-ir state. dbgntrst not test reset input this is the active low reset signal for the embeddedice internal state. this signal can be asserted asynchronously but must be deasserted synchronously. dbgntdoen not dbgtdo enable output when low, the serial data is being driven out of the dbgtdo output. normally used as an output enable for a dbgtdo signal pin in a packaged part. dbgscreg[4:0] output these five bits reflect the id number of the scan chain currently selected by the tap controller. these bits change when the tap controller is in the update-dr state. dbgsdin external scan chain serial input data output contains the serial data to be applied to an external scan chain. dbgsdout external scan chain serial data output input contains the serial data out of an external scan chain. when an external scan chain is not connected, this signal must be tied low. dbgtapsm[3:0] tap controller state machine output this bus reflects the current state of the tap controller state machine. dbgtdi input test data input for debug logic. dbgtdo output test data output from debug logic. dbgtms input test mode select for tap controller. tapid[31:0] boundary scan id code input specifies the id code value shifted out on dbgtdo when the idcode instruction is entered into the tap controller.
signal descriptions arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. b-13 b.8 miscellaneous signals table b-7 describes the miscellaneous signals on the ARM946E-S processor. table b-7 miscellaneous signals name direction description bigendout output when high, the ARM946E-S processor treats bytes in memory as being in big-endian format. when low, memory is treated as little-endian. nfiq not fast interrupt request input this is the fast interrupt request signal. this signal must be synchronous to clk . nirq not interrupt request input this is the interrupt request signal. this signal must be synchronous to clk . vinithi exception vector location at reset input determines the reset location of the exception vectors. when low, the vectors are located at 0x00000000 . when high, the vectors are located at 0xffff0000 . testmode input prevents the cache from being inadvertently flushed when scan patterns are shifted through the scan chains. must only be asserted during scan test of the ARM946E-S processor. initram input determines if the instruction tcm is enabled at reset. if high, it is enabled, if low, it is disabled. dcachesize[3:0] input encoded size of the data cache. the encoding for these signals is given in table 2-5 on page 2-9. icachesize[3:0] input encoded size of the instruction cache. the encoding for these signals is given in table 2-5 on page 2-9.
signal descriptions b-14 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c b.9 etm interface signals table b-8 describes the ARM946E-S etm interface signals. table b-8 etm interface signals name direction description etmen input synchronous etm interface enable. this signal must be tied low if an etm is not used. etmfifofull input indication that the etm fifo is full, and that trace data might be lost. the ARM946E-S stalls on the next instruction boundary. this signal must be tied low if an etm is not used. etmbigend output big-endian configuration indication for the etm. etmhivecs output exception vectors configuration for the etm. etmia[31:1] output instruction address for the etm. etminmreq output instruction memory request for the etm. etmiseq output sequential instruction access for the etm. etmitbit output thumb state indication for the etm. etmiabort output instruction abort for the etm. etmda[31:0] output data address for the etm. etmdmas[1:0] output data size indication for the etm. etmdmore output more sequential data indication for the etm. etmdnmreq output data memory request for the etm. etmdnrw output data not read/write for the etm. etmdseq output sequential data indication for the etm. etmrdata[31:0] output read data for the etm. etmwdata[31:0] output write data for the etm. etmdabort output data abort for the etm. etmnwait output arm9e-s stalled indication for the etm. etmdbgack output debug state indication for the etm.
signal descriptions arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. b-15 etminstrexec output instruction execute indication for the etm. etmrngout[1:0] output watchpoint register match indication for the etm. etmid31to25[31:25] output instruction data field for the etm. etmid15to11[15:11] output instruction data field for the etm. etmchsd[1:0] output coprocessor handshake decode signals for the etm. etmchse[1:0] output coprocessor handshake execute signals for the etm. etmpass output coprocessor instruction execute indication for the etm. etmlatecancel output coprocessor late cancel indication for the etm. etmprocid[31:0] output process identifier for the etm. etmprocidwr output etmprocid write strobe. etminstrvalid output instruction valid indication for the etm. table b-8 etm interface signals (continued) name direction description
signal descriptions b-16 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c b.10 intest wrapper signals the intest wrapper is optionally added as part of the synthesis process. that is, it does not form part of the source rtl. the signals associated with this wrapper are therefore redundant but remain for backward compatibility with ARM946E-S rev 0. the signals, si , so , scanen , testen , serialen , and innotextest are therefore unconnected and have no function.
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. glossary-1 glossary this glossary describes some of the terms used in this manual. where terms can have several meanings, the meaning presented here is intended. abort a mechanism that indicates to a core that it must halt execution of an attempted illegal memory access. an abort can be caused by the external or internal memory system as a result of attempting to access invalid instruction or data memory. an abort is classified as a prefetch abort, a data abort, or an external abort. see also data abort, external abort, and prefetch abort. abort model an abort model is the defined behavior of an arm processor in response to a data abort exception. different abort models behave differently with regard to load and store instructions that specify base register write-back. advanced high-performance bus (ahb) the amba advanced high-performance bus system connects embedded processors such as an arm core to high-performance peripherals, dma controllers, on-chip memory, and interfaces. it is a high-speed, high-bandwidth bus that supports multi-master bus management to maximize system performance. see also advanced microcontroller bus architecture.
glossary glossary-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c advanced microcontroller bus architecture(amba) amba is the arm open standard for multi-master on-chip buses, capable of running with multiple masters and slaves. it is an on-chip bus specification that details a strategy for the interconnection and management of functional blocks that make up a system-on-chip (soc). it aids in the development of embedded processors with one or more cpus or signal processors and multiple peripherals. amba complements a reusable design methodology by defining a common backbone for soc modules. ahb conforms to this standard. see also advanced high-performance bus. aligned refers to data items stored so that their address is divisible by the highest power of two that divides their size. aligned words and halfwords therefore have addresses that are divisible by four and two respectively. the terms word-aligned and halfword-aligned therefore refer to addresses that are divisible by four and two respectively. the terms byte-aligned and doubleword-aligned are defined similarly. amba see advanced microcontroller bus architecture. architecture the organization of hardware and/or software that characterizes a processor and its attached components, and enables devices with similar characteristics to be grouped together when describing their behavior, for example, harvard architecture, instruction set architecture, armv6 architecture. arm state a processor that is executing arm (32-bit) instructions is operating in arm state. see also thumb state. base register a register specified by a load or store instruction that is used to hold the base value for the address calculation for the instruction. depending on the instruction and its addressing mode, an offset can be added to or subtracted from the base register value to form the virtual address that is sent to memory. base register write-back updating the contents of the base register used in an instruction target address calculation so that the modified address is changed to the next higher or lower sequential address in memory. this means that it is not necessary to fetch the target address for successive instruction transfers and enables faster burst accesses to sequential memory. big-endian memory organization in which the least significant byte of a word is at a higher address than the most significant byte. see also little-endian and endianness.
glossary arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. glossary-3 block address an address that comprises a tag, an index, and a word field. the tag bits identify the way that contains the matching cache entry for a cache hit. the index bits identify the set being addressed. the word field contains the word address that can be used to identify specific words, halfwords, or bytes within the cache entry. breakpoint a breakpoint is a mechanism provided by debuggers to identify an instruction at which program execution is halted unconditionally. breakpoints are inserted by programmers to allow inspection of register contents, memory locations, and/or variable values at fixed points in the program execution to test that the program is operating correctly. breakpoints are removed after the program is successfully tested. see also watchpoint. burst a group of transfers to consecutive addresses. because the addresses are consecutive, there is no requirement to supply an address for any of the transfers after the first one. this increases the speed at which the group of transfers can occur. bursts over ahb buses are controlled using the hburst signals to specify if transfers are single, four-beat, eight-beat, or 16-beat bursts, and to specify how the addresses are incremented. cache a block of on-chip or off-chip fast access memory locations, situated between the processor and main memory, used for storing and retrieving copies of often used instructions and/or data. this is done to increase the average speed of memory accesses and therefore to increase processor performance. cache hit a memory access that can be processed at high speed because the instruction or data that it addresses is already held in the cache. cache line the basic unit of storage in a cache. it is always a power of two words in size (usually 4 or 8 words), and is required to be aligned to a suitable memory boundary. see also cache terminology. cache lockdown to fix a line in cache memory so that it cannot be overwritten. cache lockdown enables critical instructions and/or data to be loaded into the cache so that the cache lines containing them are not subsequently reallocated. this ensures that all subsequent accesses to the instructions or data concerned are cache hits, and therefore complete as quickly as possible. cache miss a memory access that cannot be processed at high speed because the instruction or data it addresses is not in the cache and a main memory access is required. cache set a cache set is a group of cache lines (or blocks). a set contains all the ways that can be addressed with the same index. the number of cache sets is always a power of two. cast out see victim. central processing unit (cpu) the part of a processor that contains the alu, the registers, and the instruction decode logic and control circuitry. also commonly known as the processor core.
glossary glossary-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c clean a cache line that has not been modified while it is in the cache is said to be clean. to clean a cache is to write dirty cache entries into main memory. if a cache line is clean, it is not written on a cache miss because the next level of memory contains the same data as the cache. see also dirty. coprocessor a processor that supplements the main cpu. it carries out additional functions that the main cpu cannot perform. usually used for floating-point math calculations, signal processing, or memory management. cpu see central processing unit. data abort an indication from a memory system to a core that it must halt execution of an attempted illegal memory access. a data abort is attempting to access invalid data memory. see also abort, external abort, and prefetch abort. data cache (dcache) a block of on-chip fast access memory locations, situated between the processor and main memory, used for storing and retrieving copies of often used data. this is done to greatly increase the average speed of memory accesses and therefore to increase processor performance. dcache see data cache. debug communications channel the hardware used for communicating between the software running on the processor, and an external host, using the debug interface. when this communication is for debug purposes, it is called the debug communications channel. debugger a debugging system that includes a program, used to detect, locate, and correct software faults, together with custom hardware that supports software debugging. an application that monitors and controls the operation of a second application. usually used to find errors in the application program flow. dirty a cache line in a write-back cache that has been modified while it is in the cache is said to be dirty. a cache line is marked as dirty by setting the dirty bit. if a cache line is dirty, it must be written to memory on a cache miss because the next level of memory contains data that has not been updated. the process of writing dirty data to main memory is called cache cleaning. see also clean. embeddedice-rt the jtag-based hardware provided by debuggable arm processors to aid debugging in real-time.
glossary arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. glossary-5 embedded trace macrocell (etm) a hardware macrocell that outputs instruction and data trace information on a trace port. endianness byte ordering. the scheme that determines the order in which successive bytes of a data word are stored in memory. see also little-endian and big-endian. etm see embedded trace macrocell. exception an event that occurs during program operation that makes continued normal operation inadvisable or impossible, and so makes it necessary to change the flow of control in a program. exceptions can be caused by error conditions in hardware or software. the processor can respond to exceptions by running appropriate exception handler code that attempts to remedy the error condition, and either restarts normal execution or ends the program in a controlled way. exception vector one of a number of fixed addresses in low memory, or in high memory if high vectors are configured, that contains the first instruction of the corresponding interrupt service routine. external abort an indication from an external memory system to a core that it must halt execution of an attempted illegal memory access. an external abort is caused by the external memory system as a result of attempting to access invalid memory. see also abort, data abort, and prefetch abort. halt mode one of two mutually exclusive debug modes. in halt mode all processor execution halts when a breakpoint or watchpoint is encountered. all processor state, coprocessor state, memory and input/output locations can be examined and altered by the jtag interface. see also monitor mode. high vectors alternative locations for exception vectors. the high vector address range is near the top of the address space, rather than at the bottom. host a computer that provides data and other services to another computer. especially, a computer providing debugging services to a target being debugged. icache see instruction cache. index register a register specified in some load or store instructions. the value of this register is used as an offset to be added to or subtracted from the base register value to form the virtual address, which is sent to memory. some addressing modes optionally enable the index register value to be shifted prior to the addition or subtraction.
glossary glossary-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c instruction cache (icache) a block of on-chip fast access memory locations, situated between the processor and main memory, used for storing and retrieving copies of often used instructions. this is done to increase the average speed of memory accesses and therefore to increase processor performance. invalidate to mark a cache line as being not valid by clearing the valid bit. this must be done whenever the line does not contain a valid cache entry. for example, after a cache flush all lines are invalid. little-endian memory organization where the least significant byte of a word is at a lower address than the most significant byte. see also big-endian and endianness. load/store architecture a processor architecture where data-processing operations only operate on register contents, not directly on memory contents. macrocell a complex logic block with a defined interface and behavior. a typical vlsi system comprises several macrocells (such as an arm processor, an embedded trace macrocell, and a memory block) plus application-specific logic. monitor mode one of two mutually exclusive debug modes. in monitor mode the arm1136jf-s processor enables a software abort handler provided by the debug monitor or operating system debug task. when a breakpoint or watchpoint is encountered, this enables vital system interrupts to continue to be serviced while normal program execution is suspended. see also halt mode. prefetching in pipelined processors, the process of fetching instructions from memory to fill up the pipeline before the preceding instructions have finished executing. prefetching an instruction does not mean that the instruction has to be executed. prefetch abort an indication from a memory system to a core that it must halt execution of an attempted illegal memory access. a prefetch abort can be caused by the external or internal memory system as a result of attempting to access invalid instruction memory. see also data abort, external abort and abort processor a contraction of microprocessor. a processor includes the cpu or core, plus additional components such as memory, and interfaces. these are combined as a single macrocell, that can be fabricated on an integrated circuit. read reads are defined as memory operations that have the semantics of a load. that is, the arm instructions ldm, ldrd, ldc, ldr, ldrt, ldrsh, ldrh, ldrsb, ldrb, ldrbt, ldrex, rfe, strex, swp, and swpb, and the thumb instructions ldm,
glossary arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. glossary-7 ldr, ldrsh, ldrh, ldrsb, ldrb, and pop. java instructions that are accelerated by hardware can cause a number of reads to occur, according to the state of the java stack and the implementation of the java hardware acceleration. region a partition of instruction or data memory space. register a temporary storage location used to hold binary data until it is ready to be used. reserved a field in a control register or instruction format is reserved if the field is to be defined by the implementation, or produces unpredictable results if the contents of the field are not zero. these fields are reserved for use in future extensions of the architecture or are implementation-specific. all reserved bits not used by the implementation must be written as zero and are read as zero. sbo see should be one. sbz see should be zero. sbzp see should be zero or preserved. scan chain a scan chain is made up of serially-connected devices that implement boundary scan technology using a standard jtag tap interface. each device contains at least one tap controller containing shift registers that form the chain connected between tdi and tdo , through which test data is shifted. processors can contain several shift registers to enable you to access selected parts of the device. should be one (sbo) should be written as 1 (or all 1s for bit fields) by software. writing a 0 produces unpredictable results. should be zero (sbz) should be written as 0 (or all 0s for bit fields) by software. writing a 1 produces unpredictable results. should be zero or preserved (sbzp) should be written as 0 (or all 0s for bit fields) by software, or preserved by writing the same value back that has been previously read from the same field on the same processor. tag the upper portion of a block address used to identify a cache line within a cache. the block address from the cpu is compared with each tag in a set in parallel to determine if the corresponding line is in the cache. if it is, it is said to be a cache hit and the line can be fetched from cache. if the block address does not correspond to any of the tags it is said to be a cache miss and the line must be fetched from the next level of memory. ta p see test access port.
glossary glossary-8 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c test access port (tap) the collection of four mandatory terminals and one optional terminal that form the input/output and control interface to a jtag boundary-scan architecture. the mandatory terminals are tdi , tdo , tms , and tck . the optional terminal is trst . thumb instruction a halfword that specifies an operation for an arm processor in thumb state to perform. thumb instructions must be halfword-aligned. thumb state a processor that is executing thumb (16-bit) halfword aligned instructions is operating in thumb state. unaligned memory accesses that are not appropriately word-aligned or halfword-aligned. see also aligned. undefined indicates an instruction that generates an undefined instruction trap. see the arm architecture reference manual for more information on arm exceptions. unpredictable for reads, the data returned when reading from this location is unpredictable. it can have any value. for writes, writing to this location causes unpredictable behavior, or an unpredictable change in device configuration. unpredictable instructions must not halt or hang the processor, or any part of the system. vector operation an operation involving more than one destination register, perhaps involving different source registers in the generation of the result for each destination. victim a cache line, selected to be discarded to make room for a replacement cache line that is required as a result of a cache miss. the way in which the victim is selected for eviction is processor-specific. a victim is also known as a cast out. watchpoint a watchpoint is a mechanism provided by debuggers to halt program execution when the data contained by a particular memory address is changed. watchpoints are inserted by the programmer to enable inspection of register contents, memory locations, and variable values when memory is written to test that the program is operating correctly. watchpoints are removed after the program is successfully tested. see also breakpoint. wb see write-back. write writes are defined as operations that have the semantics of a store. that is, the arm instructions srs, stm, strd, stc, strt, strh, strb, strbt, strex, swp, and swpb, and the thumb instructions stm, str, strh, strb, and push. java instructions that are accelerated by hardware can cause a number of writes to occur, according to the state of the java stack and the implementation of the java hardware acceleration. write-back(wb) in a write-back cache, data is only written to main memory when it is forced out of the cache on line replacement following a cache miss. otherwise, writes by the processor only update the cache. (also known as copyback).
glossary arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. glossary-9 write buffer a block of high-speed memory, arranged as a fifo buffer, between the data cache and main memory, whose purpose is to optimize stores to main memory. each entry in the write buffer can contain the address of a data item to be stored to main memory, the data for that item, and a sequential bit that indicates if the next store is sequential or not. write-through (wt) in a write-through cache, data is written to main memory at the same time as the cache is updated. wt see write-through.
glossary glossary-10 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c
arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. index-1 index the items in this index are listed in alphabetical order, with symbols and numerics appearing at the end. the references given are to page numbers. a absent 7-6 ac parameters, timing diagrams a-2 access permission encoding 2-18 registers 2-17 ahb bus master interface 6-3 clock relationships 6-12 clocking 6-11 signals b-5 ahb signals b-5 alternate vectors select bit 2-14 area size encoding 2-27 arm9e-s 1-2 ARM946E-S block diagram 1-3 clk to ahb hclk sampling 6-13 processor test methodology 10-2 tcm interface description 5-2 trace support features 8-4 atpg and scan insertion 10-3 auto pause 10-10 automatic test pattern generation 10-3 b background regions 4-6 base setting, example 2-22 bd bit 3-9, 6-14 big-endian, configuration 2-15 bigendout b-13 bist activation 10-3 address register 10-9 control register 10-8 general register 10-9 instructions, register 15 2-30 of tightly-coupled sram 10-5 test flow 10-7 tightly-coupled memory 10-5 bit pattern mcr 2-7 mrc 2-7 breakpoints 9-20 debug state 9-20 exceptions 9-21 instruction boundary 9-21 prefetch abort 9-21 timing 9-20 burst access 6-7 crossing 1k boundary 6-8 sizes 6-5 bus interface unit 6-2 bus master interface, ahb 6-3 busy-wait 7-12 abandoned 7-17 defined 7-6 interrupts 7-17 bypass, public instructions within debug 9-10 c cachable bits 2-16
index index-2 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c cache architecture 3-5 associativity 2-10 configuration registers 2-16 example 8k 3-3 operations register 2-22 cache associativity encoding 2-10 cache debug index register, register 15 2-33 cache lockdown registers, register 9 2-26 cache operations register, register 7 2-22 cache size encoding 2-9 index 2-34 tag 2-34 cd bit 3-9 cdp instructions 7-15 changes from ARM946E-S rev0 manual 1-5 chsde b-8 chsex b-8 clk b-3 clk to hclk, skew 6-11 clock external coprocessor 7-5 interface signals b-3 relationships 6-12 synchronization 9-3 clock interface b-3 clock tree insertion 6-12 hierarchical 6-13 clocking, ahb 6-11 clocks, debug 9-3 commrx b-10 commtx b-10 communications channel debug 9-29, 9-31 channel registers debug 9-29 channel status register debug 9-29 control register debug 9-29 data read register debug 9-29 data write register 9-29 configuration endian bit 2-15 registers cache 2-16 configure disable loading tbit 2-14 control register 2-12 control register (continued) debug 9-26 write buffer 2-16 conventions numbers xvii registers xvii signals xvii word length xvii coprocessor decoupling 7-5 handshake signals 7-12 handshake states 7-6 interface 7-1 interface privileged instructions 7-16 interface signals b-3, b-4, b-8 pipeline 7-4 synchronizing 7-5 coprocessor interface b-8 coprocessor states absent 7-3, 7-4, 7-6 go 7-6 last 7-6 wait 7-6 coprocessors instruction, busy-wait 7-6, 7-12 cpclken b-8 cpdin b-8 cpdout b-8 cpinstr b-8 cplatecancel b-8 cppass b-8 cptbit b-9 cp15 control register 5-3 register map 2-5 register map summary 2-4 d data abort model 2-3 base restored 2-3 data accesses to instruction tcm 5-9 data bufferable bits 6-14 data cache bd and cd bits 3-9 clean and flush 3-10 disabling 3-8 data cache (continued) enable bit 2-15 enabling 3-8 lockdown 3-12 operation 3-9 validity 3-10 data read followed by instruction fetch 5-12 data tcm 2-13, 5-4, 5-5, 5-8 accesses 5-8 data write followed by data read of 5-8 disabling 5-4 enable bit 2-14 enabling 5-4 load mode 5-5 load mode bit 2-13 data write followed by data read of data tcm 5-8 data read of instruction tcm 5-10 instruction fetch of instruction tcm 5-11 simultaneous instruction fetch and data read 5-13 data write modes 6-14 dbgack b-10 dbgdewpt b-10 dbgdwpt b-10 dbgen b-10 dbgext b-10 dbgiebkpt b-10 dbginstrexec b-10 dbgir b-12 dbgntdoen b-12 dbgntrst b-12 dbgrng b-11 dbgrqi b-11 dbgscreg b-12 dbgsdin b-12 dbgsdout b-12 dbgtapsm b-12 dbgtcken b-3 dbgtdi b-12 dbgtdo b-12 dbgtms b-12 dcachesize b-13 debug 9-29, b-10 access to the caches 9-18 clocks 9-3
index arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. index-3 debug (continued) communication channel 9-29, 9-31 communications channel status register 9-29 communications control register 9-29 communications data read register 9-29 communications data write register 9-29 control register 9-26 core and system state 9-25 embeddedice-rt 9-26 host 9-4 instruction register 9-8 interface signals 9-20 interfaces 9-2 message transfer 9-31 monitor mode 9-33 multi-ice 9-3 public instructions 9-8 real-time 9-33 request 9-23 reset 9-8 signals b-10 status register 9-26 support 9-1 systems 9-4 target 9-5 debug communications data write, register 9-29 debug state 9-24 actions of arm9tdmi 9-24 breakpoints 9-20 watchpoints 9-21 defining the physical and visible size of the data tcm 5-5 the instruction tcm 5-3 determining core state 9-25 system state 9-25 dirty bits 3-5 drain write buffer 2-24 dtcmadrs b-4 dtcmen b-4 dtcmrdata b-4 dtcmwdata b-4 dtcmwen b-4 e edbgrq b-11 embeddedice-rt 9-5, 9-28 disabling 9-28 overview 9-26 enable bit data cache 2-15 data tcm 2-14 instruction cache 2-15 instruction tcm 2-13 protection unit 2-15 encoding 2-9 standard access permission 2-19 endian bit configuration 2-15 configuration big-endian 2-15 configuration little-endian 2-15 etm interface 8-2, b-14 signals b-14 etmbigend b-14 etmchsd b-15 etmchse b-15 etmda b-14 etmdabort b-14 etmdgack b-14 etmdmas b-14 etmdmore b-14 etmdnmreq b-14 etmdnrw b-14 etmdseq b-14 etmen b-14 etmfifofull b-14 etmhivecs b-14 etmia b-14 etmiabort b-14 etmid31to25 b-15 etmid5to11 b-15 etminmreq b-14 etminstrexec b-15 etminstrvalid b-15 etmiseq b-14 etmitbit b-14 etmlatecancel b-15 etmnwait b-14 etmpass b-15 etmprocid b-15 etmprocidwr b-15 etmrdata b-14 etmrngout b-15 etmwdata b-14 example 8kb cache 3-3 exceptions breakpoints 9-21 watchpoints 9-23 external coprocessor clock 7-5 vfp9 7-7 extes, public instructions within debug 9-9 f field, memory size 2-11 flushing entire instruction cache 3-7 single instruction cache line 3-7 format, index and segment operations 2-23 g gatetheclk b-3 go arm9e-s 7-6 coprocessor state 7-6 h haddr b-5 hburst b-5 hbusreq b-5 hclken b-3 hgrant b-5 hlock b-5 host, debug 9-4 hprot b-6 hrdata b-6 hready b-6 hresetn b-6 hresp b-6 hsize b-6 htrans b-7 hwdata b-7 hwrite b-7
index index-4 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c i icachesize b-13 idcode public instructions within debug 9-10 implementation-specific bist instructions register 15 2-30 index and segment operations, format 2-23 index field, supported cache sizes 2-24 index, cache size 2-34 initializing instruction tcm procedure 5-4 initializing the data tcm 5-5 initializing the instruction tcm 5-3 initram b-13 instruction accesses to instruction tcm 5-9 instruction and data access permission register bit (extended) 2-17 permission (standard) register bits 2-19 instruction boundary, breakpoints 9-21 instruction cache 3-6 address format 2-24 disabling 3-6 enable bit 2-15 enabling 3-6 flushing 3-7 lockdown 3-13 operation 3-6 validity 3-7 instruction register, debug 9-8 instruction tcm 5-3 accesses 5-9 data write followed by data read of 5-10 data write followed by instruction fetch of 5-11 disabling 5-3 during soft reset 5-7 enable bit 2-13 load mode 5-3 load mode bit 2-13 memory map 5-2 instructions cdp 7-15 mcr/mrc 7-13 interface signals, debug 9-20 interfaces, debug 9-2 interface,tightly-coupled memory 5-1 interlocked mcr 7-14 intest wrapper 10-3 wrapper signals b-16 itcmadrssignals itcmadrs b-4 itcmen b-4 itcmrdata b-4 itcmwdata b-4 itcwen b-4 j jtag b-12 signals b-12 state machine 9-7 l last, coprocessor states 7-6 ldc/stc, instructions 7-11 linefetch back to back 6-6 transfer 6-5 little-endian, configuration 2-15 load mode 2-13 data tcm 5-5 instruction tcm 5-3 load mode bit, instruction tcm 2-13 location of block descriptions 1-4 lockdown cache 3-12 data cache 3-12 example subroutine 3-14 instruction cache 3-13 m mcr bit pattern 2-7 interlocked 7-14 mcr/mrc, instructions 7-13 memory map, instruction tcm 5-2 memory size, field 2-11 message transfer, debug 9-31 miscellaneous signals b-13 model base restored data abort 2-3 data abort 2-3 monitor mode debugging 9-33 mrc, bit pattern 2-7 multi-ice, debug 9-3 n ncb 6-15 ncnb, swap instructions 6-15 ncpmreq b-9 ncptrans b-9 nfiq b-13 nirq b-13 noncachable, bufferable 6-15 noncached thumb instruction fetch 6-10 number conventions xvii o overlapping regions 4-7 overview, embeddedice-rt 9-26 p phydtcmsize b-4 phyitcmsize b-4 pipeline arm9e-s 7-4 coprocessor 7-4 stages 7-2 prefetch abort, breakpoints 9-21 process id format 2-29 processor test methodology 10-2
index arm ddi 0201c copyright ? 2001-2003 arm limited. all rights reserved. index-5 programmer ? s model arm9e-s 2-3 ARM946E-S 2-2 protection region base and size register 2-20 register bits 2-21 protection unit 4-2 enable bit 2-15 enabling 4-2 memory regions 4-3 overlapping regions 4-6 protocol converter 9-5 public instructions within debug 9-9 bypass 9-10 extest 9-9 idcode 9-10 intest 9-9 scan_n 9-9 r real-time debug 9-33 region register, tightly-coupled memory 2-26 region, overlapping 4-7 register 2-29 access permission 2-17 bist address 10-9 bist control 10-8 bist general 10-9 cache lockdown 2-26 cache operations 2-22 control 2-12 debug communications channel 9-29 debug communications channel status 9-29 debug communications control 9-29 debug communications data read 9-29 debug communications data write 9-29 debug status 9-26 protection region base and size 2-20 trace process identifier 2-29 register bit (extended) instruction and data access permission 2-17 register bits instruction and data access permission (standard) 2-19 protection region base and size 2-21 test state 2-32 trace control 2-36 write data buffer control 2-17 register conventions xvii register map, cp15 2-5 register 15 bist instructions 2-30 cache debug index register 2-33 implementation-specific bist instructions 2-30 test state 2-32 trace control register 2-35 request, debug 9-23 reset, debug 9-8 round-robin replacement bit 2-14 s scan chains 9-12 scan insertion 10-3 scan_n, public instructions within debug 9-9 serialen b-16 signal conventions xvii signal descriptions b-2 signal properties and requirements b-2 signal types, coprocessor interface 7-3 signals ahb b-5 clock interface b-3 coprocessor interface b-8 coprocessor interface b-8 debug b-10 gatetheclk b-3 jtag b-12 miscellaneous b-13 tcm interface b-4 simultaneous instruction fetch and data read data write followed by 5-13 simultaneous instruction fetch and data read of instruction tcm 5-10 simultaneous instruction fetch and data write 5-12 skew, clk to hclk 6-11 stall cycles for instruction tcm accesses 5-9 state machine, jtag 9-7 summary, cp15 register map 2-4 supported cache sizes, index field 2-24 swap instructions, ncnb 6-15 swp and swpb operations 5-4 synchronization, coprocessor interface 7-5 system state, determining 9-25 systems, debug 9-4 t t bit 2-14 tag ram 3-4 tag, cache size 2-34 tap controller 9-5, 9-7 tapid b-12 target, debug 9-5 tcm 5-2 area size encoding 2-27 interface signals b-4 memory interface description 5-2 read cycle 5-2 tcm interface signals b-4 test flow for bist 10-7 methodology, ARM946E-S 10-2 state register bits 2-32 state register 15 2-32 testmode b-13 thumb instruction fetch, noncached 6-10 tightly-coupled memory area size encoding 2-27 bist 10-5 interface 5-1 region register 2-26 size register 2-10 timing breakpoints 9-20 diagrams a-2 parameters a-2 watchpoints 9-21 trace control register register bits 2-36
index index-6 copyright ? 2001-2003 arm limited. all rights reserved. arm ddi 0201c trace control register (continued) register 15 2-35 trace process identifier register, register 13 2-29 transfer 6-4 linefetch 6-5 uncached 6-7 transfer type 6-4 u uncached transfers 6-7 ungatedclk b-3 v vinithi b-13 w wait arm9e-s 7-6 coprocessor states 7-6 wait for interrupt 2-25 watchpoints debug state 9-21 exceptions 9-23 timing 9-21 wb 6-15 word length conventions xvii write back 6-15 write buffer 6-2, 6-15 control bit 6-14 control register 2-16 disabling 6-15 enabling 6-15 operation 6-14 write data buffer control register bits 2-17 write through 6-15 wt 6-15

▲Up To Search▲

Price & Availability of ARM946E-S

	To Download ARM946E-S Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .