ARM720T Revision 4 (AMBA AHB Bus Interface Version) CORE CPU MANUAL ARM720T Revision 4 (AMBA AHB Bus Interface Version) CORE CPU MANUAL ARM720T Revision 4 (AMBA AHB Bus Interface Version) CORE CPU MANUAL ELECTRONIC DEVICES MARKETING DIVISION EPSON Electronic Devices Website http://www.epsondevice.
ARM720T_E_ 表 2.fm 1 ページ ２００４年４月２０日 火曜日 午後６時３１分 NOTICE No part of this material may be reproduced or duplicated in any form or by any means without the written permission of Seiko Epson. Seiko Epson reserves the right to make changes to this material without notice.
Preface 1 Introduction 2 Programmer’s Model 3 Configuration 4 Instruction and Data Cache 5 Write Buffer 6 The Bus Interface 7 Memory Management Unit 8 Coprocessor Interface 9 Debugging Your System 10 ETM Interface 11 Test Support A Signal Descriptions Glossary Index
CONTENTS Contents Preface About this document................................................................................................xi 1 Introduction 1.1 1.2 1.3 1.4 2 Programmer’s Model 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 2.11 3 About the instruction and data cache ........................................................ 4-1 IDC validity ................................................................................................ 4-2 IDC enable, disable, and reset ..................
CONTENTS 6.9 7 Memory Management Unit 7.1 7.2 7.3 7.4 7.5 7.6 7.7 7.8 7.9 8 About coprocessors ................................................................................... 8-1 Coprocessor interface signals ................................................................... 8-3 Pipeline-following signals........................................................................... 8-4 Coprocessor interface handshaking ..........................................................
CONTENTS 10 ETM Interface 10.1 10.2 10.3 10.4 10.5 10.6 About the ETM interface .......................................................................... 10-1 Enabling and disabling the ETM7 interface ............................................. 10-1 Connections between the ETM7 macrocell and the ARM720T processor................................................................................ 10-2 Clocks and resets ....................................................................................
CONTENTS List of Figures Figure 1-1 Figure 1-2 Figure 1-3 Figure 1-4 Figure 2-1 Figure 2-2 Figure 2-3 Figure 2-4 Figure 2-5 Figure 2-6 Figure 3-1 Figure 3-2 Figure 3-3 Figure 3-4 Figure 3-5 Figure 3-6 Figure 3-7 Figure 3-8 Figure 3-9 Figure 3-10 Figure 3-11 Figure 6-1 Figure 6-2 Figure 6-3 Figure 6-4 Figure 7-1 Figure 7-2 Figure 7-3 Figure 7-4 Figure 7-5 Figure 7-6 Figure 7-7 Figure 7-8 Figure 7-9 Figure 7-10 Figure 7-11 Figure 7-12 Figure 7-13 Figure 7-14 Figure 8-1 Figure 8-2 Figure 8-3 Figure 8-4 Figure
CONTENTS Figure 9-4 Figure 9-5 Figure 9-6 Figure 9-7 Figure 9-8 Figure 9-9 Figure 9-10 Figure 9-11 Figure 9-12 Figure 9-13 Figure 9-14 Figure 9-15 Figure 9-16 Figure 9-17 Figure 11-1 Figure 11-2 Figure 11-3 Figure 11-4 Figure 11-5 Figure 11-6 Figure 11-7 Figure 11-8 Figure 11-9 Figure 11-10 Figure 11-11 Figure 11-12 Figure 11-13 Figure 11-14 Figure 11-15 Figure 11-16 Clock synchronization .................................................................................
CONTENTS List of Tables Table 1-1 Table 1-2 Table 1-3 Table 1-4 Table 1-5 Table 1-6 Table 1-7 Table 1-8 Table 1-9 Table 1-10 Table 1-11 Table 1-12 Table 2-1 Table 2-2 Table 2-3 Table 2-4 Table 3-1 Table 3-2 Table 3-3 Table 6-1 Table 6-2 Table 6-3 Table 6-4 Table 6-5 Table 6-6 Table 6-7 Table 7-1 Table 7-2 Table 7-3 Table 7-4 Table 7-5 Table 7-6 Table 7-7 Table 7-8 Table 7-9 Table 7-10 Table 7-11 Table 8-1 Table 8-2 Table 8-3 Table 8-4 Table 9-1 Table 9-2 Table 9-3 Table 9-4 Table 9-5 Table 9-6 vi Key to t
CONTENTS Table 9-7 Table 9-8 Table 9-9 Table 9-10 Table 9-11 Table 10-1 Table 11-1 Table 11-2 Table 11-3 Table 11-4 Table 11-5 Table 11-6 Table 11-7 Table 11-8 Table 11-9 Table 11-10 Table A-1 Table A-2 Table A-3 Table A-4 Table A-5 Table A-6 Table A-7 Determining the cause of entry to debug state ......................................... 9-32 SIZE[1:0] signal encoding ......................................................................... 9-35 Debug control register bit assignments.....................
CONTENTS THIS PAGE IS BLANK.
Preface
Preface Preface This preface introduces the ARM720T Revision 4 (AMBA AHB Bus Interface Version) CORE CPU Manual. It contains the following sections: About this document ................................................................................................. xi About this document This document is a technical reference manual for the ARM720T r4p2 processor.
Preface Chapter 8 Coprocessor Interface Read this chapter for a description on how to connect coprocessors to the ARM1156F-S coprocessor interface. Chapter 9 Debugging Your System Read this chapter for a description of the hardware extensions and integrated on-chip debug support for the ARM720T processor. Chapter 10 ETM Interface Read this chapter for a description of the Embedded Trace Macrocell support for the ARM720T processor.
Preface Timing diagram conventions This manual contains one or more timing diagrams. The following key explains the components used in these diagrams. Any variations are clearly labeled when they occur. Therefore, no additional meaning must be attached unless specifically stated.
Preface THIS PAGE IS BLANK.
1 Introduction
1: Introduction 1 Introduction This chapter provides an introduction to the ARM720T processor. It contains the following sections: 1.1 1.2 1.3 1.4 1.1 About the ARM720T processor .................................................................. 1-1 Coprocessors ............................................................................................... 1-5 About the instruction set ........................................................................... 1-5 Silicon revisions.....................
1: Introduction A block diagram of the ARM720T processor is shown in Figure 1-1.
1: Introduction The functional signals on the ARM720T processor are shown in Figure 1-2.
1: Introduction Changes to the programmer’s model To provide support for the EmbeddedICE-RT macrocell, the following changes have been made to the programmer’s model for the ARM720T processor: Debug Control Register There are two new bits in the Debug Control Register: Bit 4 Bit 5 Monitor mode enable. Use this to control how the device reacts on a breakpoint or watchpoint: • When set, the core takes the instruction or data abort exception. • When clear, the core enters debug state.
1: Introduction 1.2 Coprocessors The ARM720T processor has an internal coprocessor designated CP15 for internal control of the device (see Chapter 3 Configuration). The ARM720T processor also includes a port for the connection of on-chip external coprocessors. This enables extension of the ARM720T functionality in an architecturally-consistent manner. 1.
1: Introduction 1.3.1 Format summary This section provides a summary of the ARM and Thumb instruction sets: • • ARM instruction set on page 1-7 Thumb instruction set on page 1-14 A key to the instruction set tables is shown in Table 1-1. The ARM7TDMI-S core on the ARM720T processor is an implementation of the ARM architecture v4T. For a complete description of both instruction sets, see the ARM Architecture Reference Manual.
1: Introduction 1.3.2 ARM instruction set This section gives an overview of the ARM instructions available. For full details of these instructions, see the ARM Architecture Reference Manual. The ARM instruction set formats are shown in Figure 1-3.
1: Introduction The ARM instruction set summary is shown in Table 1-2.
1: Introduction Table 1-2 ARM instruction summary (continued) Operation Load Multiple block data operations Store Multiple block data operations Swap Assembler Word LDR{cond} , Word with User Mode privilege LDR{cond}T , Byte LDR{cond}B , Byte with User Mode privilege LDR{cond}BT , Byte signed LDR{cond}SB , Halfword LDR{cond}H , Halfword signed LDR{cond}SH , Increment before LDM{cond}IB
1: Introduction Table 1-2 ARM instruction summary (continued) Operation Assembler Coprocessors Data operations CDP{cond} p, , , , , Move to ARM reg from coproc MRC{cond} p, , , , , Move to coproc from ARM reg MCR{cond} p, , , , , Load LDC{cond} p, , Store STC{cond} p, , Software Interrupt SWI <24bit_Imm> Addressing mode 2, , is shown in Table 1
1: Introduction Addressing mode 2 (privileged), , is shown in Table 1-4.
1: Introduction Addressing mode 4 (store), , is shown in Table 1-7. Table 1-7 Addressing mode 4 (store) Addressing mode Stack type IA Increment after EA Empty ascending IB Increment before FA Full ascending DA Decrement after ED Empty descending DB Decrement before FD Full descending Addressing mode 5 (coprocessor data transfer), , is shown in Table 1-8.
1: Introduction Condition fields, {cond}, are shown in Table 1-11.
1: Introduction 1.3.3 Thumb instruction set This section gives an overview of the Thumb instructions available. For full details of these instructions, see the ARM Architecture Reference Manual. The Thumb instruction set formats are shown in Figure 1-4.
1: Introduction The Thumb instruction set summary is shown in Table 1-12.
1: Introduction Table 1-12 Thumb instruction summary (continued) Operation Assembler Shift/Rotate Branch Logical shift left LSL , , #<5bit_shift_imm> LSL , Logical shift right LSR , , #<5bit_shift_imm> LSR , Arithmetic shift right ASR , , #<5bit_shift_imm> ASR , Rotate right ROR , if Z set BEQ
1: Introduction Table 1-12 Thumb instruction summary (continued) Operation Load Assembler With register offset word LDR , [, ] halfword LDRH , [, ] signed halfword LDRSH , [, ] byte LDRB , [, ] signed byte LDRSB , [, ] PC-relative LDR , [PC, #<10bit_offset>] SP-relative LDR , [SP, #<10bit_offset>] using PC ADD , PC, #<10bit_offset> using SP ADD , SP, #<10bit_offset> Multiple LDMIA Rb!, Address Store
1: Introduction 1.4 Silicon revisions This manual is for revision r4p2 of the ARM720T macrocell. See Product revision status on page xii for details of revision numbering. There are no functional differences from previous revisions.
2 Programmer’s Model
2: Programmer’s Model 2 Programmer’s Model This chapter describes the programmer’s model for the ARM720T processor. It contains the following sections: 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 2.11 2.1 Processor operating states ......................................................................... 2-1 Memory formats ......................................................................................... 2-2 Instruction length ........................................................................
2: Programmer’s Model 2.2 Memory formats The ARM720T processor views memory as a linear collection of bytes numbered upwards from zero, as follows: Bytes 0 to 3 Hold the first stored word. Bytes 4 to 7 Hold the second stored word. Bytes 8 to 11 Hold the third stored word. Words are stored in memory as big or little-endian, as described in the following sections: • • Big-endian format Little-endian format on page 2-3.
2: Programmer’s Model 2.2.2 Little-endian format In little-endian format, the lowest numbered byte in a word is considered the least significant byte of the word, and the highest numbered byte the most significant. Byte 0 of the memory system is therefore connected to data lines 7 to 0. Little-endian format is shown in Figure 2-2.
2: Programmer’s Model 2.5 Operating modes The ARM720T processor supports seven modes of operation, as shown in Table 2-1. Table 2-1 ARM720T modes of operation 2.5.
2: Programmer’s Model Interrupt modes FIQ mode has seven banked registers mapped to r8-14 (r8_fiq-r14_fiq). In ARM state, many FIQ handlers can use these banked registers to avoid having to save any registers onto a stack. User, IRQ, Supervisor, Abort, and Undefined modes each have two banked registers, mapped to r13 and r14, enabling each of these modes to have a private stack pointer and link registers.
2: Programmer’s Model 2.6.2 The Thumb state register set The Thumb state register set is a subset of the ARM state set. You have direct access to: • eight general registers, (r0–r7) • the PC • a Stack Pointer (SP) register • a Link Register (LR) • the CPSR. There are banked SPs, LRs, and Saved Program Status Registers (SPSRs) for each privileged mode. This is shown in Figure 2-4.
2: Programmer’s Model 2.6.3 The relationship between ARM and Thumb state registers The Thumb state registers relate to the ARM state registers in the following ways: • Thumb state r0–r7, and ARM state r0–r7 are identical • Thumb state CPSR and SPSRs, and ARM state CPSR and SPSRs are identical • Thumb state SP maps onto ARM state r13 • Thumb state LR maps onto ARM state r14 • Thumb state PC maps onto ARM state PC (r15). This relationship is shown in Figure 2-5.
2: Programmer’s Model 2.7 Program status registers The ARM720T processor contains a CPSR, and five SPSRs for use by exception handlers. These registers: • hold information about the most recently performed ALU operation • control the enabling and disabling of interrupts • set the processor operating mode. The arrangement of bits is shown in Figure 2-6.
2: Programmer’s Model 2.7.3 Reserved bits The remaining bits in the PSRs are reserved. When changing flag or control bits of a PSR, you must ensure that these unused bits are not altered. Also, your program must not rely on them containing specific values, because in future processors they might read as one or zero.
2: Programmer’s Model 2.8 Exceptions Exceptions arise whenever the normal flow of a program has to be halted temporarily, for example to service an interrupt from a peripheral. Before an exception can be handled, the current processor state is preserved so that the original program can resume when the handler routine has finished. Several exceptions can arise at the same time. If this happens, they are dealt with in a fixed order. See Exception priorities on page 2-14.
2: Programmer’s Model 2.8.2 Action on leaving an exception On completion, the exception handler: 1 Moves the LR, minus an offset where appropriate, to the PC. The offset varies depending on the type of exception. 2 Copies the SPSR back to the CPSR. 3 Clears the interrupt disable flags, if they were set on entry.
2: Programmer’s Model 2.8.4 Fast interrupt request The FIQ exception is used for most performance-critical interrupts in a system. In ARM state the processor has sufficient private registers to remove the necessity for register saving, minimizing the overhead of context switching. FIQ is externally generated by taking the nFIQ input LOW. nFIQ and nIRQ are considered asynchronous, and a cycle delay for synchronization is incurred before the interrupt can affect the processor flow.
2: Programmer’s Model After fixing the reason for the abort, the handler must execute the following irrespective of the processor state (ARM or Thumb): SUBS PC, r14_abt, #4 for a Prefetch Abort SUBS PC, r14_abt, #8 for a Data Abort This restores both the PC and the CPSR, and retries the aborted instruction. Note: There are restrictions on the use of the external abort signal. See External aborts on page 7-21. 2.8.
2: Programmer’s Model 2.8.10 Exception priorities When multiple exceptions arise at the same time, a fixed priority system determines the order in which they are handled: 1 Reset (highest priority). 2 Data Abort. 3 FIQ. 4 IRQ. 5 Prefetch Abort. 6 Undefined Instruction, SWI (lowest priority). 2.8.11 Exception restrictions Undefined Instruction and SWI are mutually exclusive, because they each correspond to particular (non-overlapping) decodings of the current instruction.
2: Programmer’s Model 2.9 Relocation of low virtual addresses by the FCSE PID The ARM720T processor provides a mechanism, Fast Context Switch Extension (FCSE), to translate virtual addresses to physical addresses based on the current value of the FCSE Process IDentifier (PID). The virtual address produced by the processor core going to the IDC and MMU can be relocated if it lies in the bottom 32MB of the virtual address.
2: Programmer’s Model 2.10 Reset When the HRESETn signal goes LOW, the ARM720T processor: 1 Abandons the executing instruction. 2 Flushes the cache and Translation Lookaside Buffer (TLB). 3 Disables the Write Buffer (WB), cache, and MMU. 4 Resets the FCSE PID. 5 Continues to fetch instructions from incrementing word addresses. When HRESETn is LOW, the processor samples the VINITHI external input and stores the result in the V bit in CP15 register 1.
2: Programmer’s Model 2.11 Implementation-defined behavior of instructions The ARM Architecture Reference Manual defines the instruction set of the ARM720T processor: • See Indexed addressing on a Data Abort for the behavior of instructions that are identified as implementation-defined in the ARM Architecture Reference Manual. • See Early termination for those features that define signed and unsigned early termination on the ARM720T processor. 2.11.
2: Programmer’s Model THIS PAGE IS BLANK.
3 Configuration
3: Configuration 3 Configuration This chapter describes the configuration of the ARM720T processor. It contains the following sections. 3.1 3.2 3.3 3.1 About configuration.................................................................................... 3-1 Internal coprocessor instructions .............................................................. 3-2 Registers .....................................................................................................
3: Configuration 3.2 Internal coprocessor instructions The instruction set for the ARM720T processor enables you to implement specialized additional instructions using coprocessors. These are separate processing units that are coupled to the ARM720T processor, although CP15 is built into the ARM720T processor. Note: The CP15 register map might change in future ARM processors.
3: Configuration 3.3 Registers The ARM720T processor contains registers that control the cache and MMU operation. You can access these registers using MCR and MRC instructions to CP15 with the processor in a privileged mode. Table 3-1 shows a summary of valid CP15 registers. You must not attempt to read from, or to write to, an invalid register because it results in Unpredictable behavior. Table 3-1 Cache and MMU Control Register 3.3.
3: Configuration 3.3.2 Control Register Reading from CP15 Register 1 reads the control bits. The CRm and opcode_2 fields Should Be Zero when reading CP15 Register 1. Control Register read format is shown in Figure 3-4. 31 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 UNP V UNP R S B L D P W C A M Figure 3-4 Control Register read format Writing to CP15 Register 1 sets the control bits. The CRm and opcode_2 fields Should Be Zero when writing to CP15 Register 1.
3: Configuration Bits 12:10 Note: When read, this returns an Unpredictable value. When written, it Should Be Zero, or a value read from these bits on the same processor. Using a read-write-modify sequence when modifying this register provides the greatest future compatibility. V Bit 13 Location of exception vectors: 0 = low addresses 1 = high addresses. The value of the V bit reflects the state of the VINITHI external input, sampled while HRESETn is LOW.
3: Configuration 3.3.4 Domain Access Control Register Reading from CP15 Register 3 returns the value of the Domain Access Control Register. Writing to CP15 Register 3 writes the value of the Domain Access Control Register. The Domain Access Control Register consists of 16 2-bit fields, each of which defines the access permissions for one of the 16 domains (D15-D0). The CRm and opcode_2 fields Should Be Zero when reading or writing to CP15 Register 3.
3: Configuration 3.3.6 Fault Address Register Reading CP15 Register 6 returns the value of the Fault Address Register (FAR). The FAR holds the virtual address of the access that was attempted when a fault occurred. The FAR is only updated on data faults. There is no update on prefetch faults. Writing to CP15 Register 6 sets the FAR to the value of the data written. This is useful when a debugger has to restore the value of the FAR.
3: Configuration In the instructions shown in Table 3-3, c7 is the preferred value for the CRn field, because it indicates a unified MMU. Reading from CP15 Register 8 is undefined. The Invalidate TLB single entry function invalidates any TLB entry corresponding to the Modified Virtual Address (MVA) given in Rd. 3.3.
3: Configuration 3.3.10 Register 14, reserved Accessing this register is undefined. Writing to Register 14 is Undefined. 3.3.11 Test Register The CP15 Register 15 is used for device-specific test operations. For more information, see Chapter 11 Test Support.
3: Configuration THIS PAGE IS BLANK.
4 Instruction and Data Cache
4: Instruction and Data Cache 4 Instruction and Data Cache This chapter describes the instruction and data cache. It contains the following sections: 4.1 4.2 4.3 4.1 About the instruction and data cache ....................................................... 4-1 IDC validity ................................................................................................ 4-2 IDC enable, disable, and reset...................................................................
4: Instruction and Data Cache 4.1.3 Read-lock-write The IDC treats the read-lock-write instruction as a special case: Read phase Always forces a read of external memory, regardless of whether the data is contained in the cache. Write phase Is treated as a normal write operation. If the data is already in the cache, the cache is updated. Externally, the two phases are flagged as indivisible by asserting the HLOCK signal. 4.
5 Write Buffer
5: Write Buffer 5 Write Buffer This chapter describes the write buffer. It contains the following sections: 5.1 5.2 5.1 About the write buffer................................................................................ 5-1 Write buffer operation................................................................................ 5-2 About the write buffer The write buffer of the ARM720T processor is provided to improve system performance.
5: Write Buffer 5.2 Write buffer operation You control the operation of the write buffer with CP15 register 1, the Control Register (see Control Register on page 3-4). When the CPU performs a write operation, the translation entry for that address is inspected and the state of the B bit determines the subsequent action. If the write buffer is disabled using the Control Register, buffered writes are treated in the same way as unbuffered writes.
6 The Bus Interface
6: The Bus Interface 6 The Bus Interface This chapter describes the signals on the bus interface of the ARM720T processor. It contains the following sections: 6.1 6.2 6.3 6.4 6.5 6.6 6.7 6.8 6.9 6.1 About the bus interface.............................................................................. 6-1 Bus interface signals .................................................................................. 6-3 Transfer types...............................................................................
6: The Bus Interface Figure 6-1 shows a transfer with no wait states (this is the simplest type of transfer). Address phase Data phase HCLK HADDR[31:0] Control A Control HWDATA[31:0] Data (A) HREADY HRDATA[31:0] Data (A) Figure 6-1 Simple AHB transfer A granted bus master starts an AHB transfer by driving the address and control signals.
6: The Bus Interface 6.2 Bus interface signals The signals in the ARM720T processor bus interface can be grouped into the following categories: Transfer type HTRANS[1:0] See Transfer types on page 6-5. Address and control HADDR[31:0] HWRITE HSIZE[2:0] HBURST[2:0] HPROT[3:0] See Address and control signals on page 6-7. Slave transfer response HREADY HRESP[1:0] See Slave transfer response signals on page 6-9. Data HRDATA[31:0] HWDATA[31:0] See Data buses on page 6-10.
6: The Bus Interface The AHB bus master interface signals are shown in Figure 6-2.
6: The Bus Interface 6.3 Transfer types The ARM720T processor bus interface is pipelined, so the address-class signals and the memory request signals are broadcast in the bus cycle ahead of the bus cycle to which they refer. This gives the maximum time for a memory cycle to decode the address and respond to the access request. A single memory cycle is shown in Figure 3-1.
6: The Bus Interface Figure 6-4 shows some examples of different transfer types. HCLK HTRANS[1:0] NONSEQ SEQ SEQ SEQ HADDR[31:0] 0x20 0x24 0x28 0x2C HBURST[2:0] HWDATA[31:0] INCR Data Data Data Data 0x20 0x24 0x28 0x2C HREADY HRDATA[31:0] Data Data Data Data 0x20 0x24 0x28 0x2C Figure 6-4 Transfer type examples In Figure 6-4: 6-6 • The first transfer is the start of a burst and is therefore nonsequential. • The master performs the second transfer of the burst immediately.
6: The Bus Interface 6.4 Address and control signals The address and control signals are described in the following sections: • • • • • 6.4.1 HADDR[31:0] HWRITE HSIZE[2:0] HBURST[2:0] on page 6-8 HPROT[3:0] on page 6-8. HADDR[31:0] HADDR[31:0] is the 32-bit address bus that specifies the address for the transfer. All addresses are byte addresses, so a burst of word accesses results in the address bus incrementing by four for each cycle. The address bus provides 4GB of linear addressing space.
6: The Bus Interface 6.4.4 HBURST[2:0] HBURST[2:0] indicates the type of burst generated by the ARM720T core, as shown in Table 6-3. Table 6-3 Burst type encodings HBURST[2:0] Type Description b000 SINGLE Single transfer b001 INCR Incrementing burst of unspecified length b101 INCR8 8-beat incrementing burst For more details of burst operation, see the AMBA Specification (Rev 2.0). 6.4.5 HPROT[3:0] HPROT[3:0] is the protection control bus.
6: The Bus Interface 6.5 Slave transfer response signals After a master has started a transfer, the slave determines how the transfer progresses. No provision is made in the AHB specification for a bus master to cancel a transfer after it has begun. Whenever a slave is accessed it must provide a response using the following signals: HRESP[1:0] Indicates the status of the transfer. HREADY Used to extend the transfer. This signal works in combination with HRESP[1:0].
6: The Bus Interface 6.5.2 HRESP[1:0] HRESP[1:0] is used by the slave to show the status of a transfer. The HRESP[1:0] encodings are shown in Table 6-5. Table 6-5 Response encodings HRESP[1:0] Response Description b00 OKAY When HREADY is HIGH, this response indicates that the transfer has completed successfully. The OKAY response is also used for any additional cycles that are inserted, with HREADY LOW, prior to giving one of the three other responses.
6: The Bus Interface 6.6.2 HRDATA[31:0] The read data bus is driven by the appropriate slave during read transfers. If the slave extends the read transfer by holding HREADY LOW, the slave has to provide valid data only at the end of the final cycle of the transfer, as indicated by HREADY HIGH. For transfers that are narrower than the width of the bus, the slave only has to provide valid data on the active byte lanes. The bus master is responsible for selecting the data from the correct byte lanes.
6: The Bus Interface Table 6-7 shows active byte lanes for big-endian systems. Table 6-7 Active byte lanes for a 32-bit big-endian data bus 6.7 Transfer size Address offset Word 0 Halfword 0 Halfword 2 Byte 0 Byte 1 - Byte 2 - - Byte 3 - - DATA[31:24] - DATA[23:16] DATA[15:8] DATA[7:0] - - - - - - - - Arbitration The arbitration mechanism is described fully in the AMBA Specification (Rev 2.0).
6: The Bus Interface 6.8 Bus clocking There are two clock inputs on the ARM720T processor bus interface. 6.8.1 HCLK The bus is clocked by the system clock, HCLK. This clock times all bus transfers. All signal timings are related to the rising edge of HCLK. 6.8.2 HCLKEN HCLK is enabled by the HCLKEN signal. You can use HCLKEN to slow the bus transfer rate by dividing HCLK for the bus interface. Note: HCLKEN is not a clock enable for the CPU itself, but only for the bus.
6: The Bus Interface THIS PAGE IS BLANK.
7 Memory Management Unit
7: Memory Management Unit 7 Memory Management Unit This chapter describes the Memory Management Unit (MMU). It contains the following sections: 7.1 7.2 7.3 7.4 7.5 7.6 7.7 7.8 7.9 7.1 About the MMU.......................................................................................... 7-1 MMU program-accessible registers........................................................... 7-3 Address translation....................................................................................
7: Memory Management Unit 7.1.1 Access permissions and domains For large and small pages, access permissions are defined for each subpage (4KB for small pages, 16KB for large pages). Sections and tiny pages have a single set of access permissions. All regions of memory have an associated domain. A domain is the primary access control mechanism for a region of memory. It defines the conditions necessary for an access to proceed.
7: Memory Management Unit 7.2 MMU program-accessible registers Table 7-1 lists the CP15 registers that are used in conjunction with page table descriptors stored in memory to determine the operation of the MMU. Table 7-1 CP15 register functions Register Number Bits Register description Control register 1 M, A, S, R Contains bits to enable the MMU (M bit), enable data address alignment checks (A bit), and to control the access protection scheme (S bit and R bit).
7: Memory Management Unit 7.3 Address translation The MMU translates VAs generated by the CPU core, and by CP15 register c13, into physical addresses to access external memory. It also derives and checks the access permission, using the TLB. The MMU table walking hardware is used to add entries to the TLB. The translation information, that comprises both the address translation data and the access permission data, resides in a translation table located in physical memory.
7: Memory Management Unit The translation table has up to 4096 x 32-bit entries, each describing 1MB of virtual memory. This enables up to 4GB of virtual memory to be addressed. Figure 7-2 shows the table walk process.
7: Memory Management Unit 7.3.2 Level one fetch Bits [31:14] of the Translation Table Base Register are concatenated with bits [31:20] of the MVA to produce a 30-bit address as shown in Figure 7-3. Modified virtual address 31 20 19 0 Table index Translation table base 31 14 13 0 14 13 2 1 0 Translation base 31 Translation base Table index 0 0 31 0 Level one descriptor Figure 7-3 Accessing translation table level one descriptors This address selects a 4-byte translation table entry.
7: Memory Management Unit Level one descriptor bit assignments are shown in Table 7-2. Table 7-2 Level one descriptor bits Bits Description Section Coarse Fine 31:20 31:10 31:12 These bits form the corresponding bits of the physical address 19:12 - - Should Be Zero 11:10 - - Access permission bits.
7: Memory Management Unit 7.3.4 Section descriptor A section descriptor provides the base address of a 1MB block of memory. Figure 7-5 shows the format of a section descriptor. 31 20 19 Section base address 12 11 10 9 8 SBZ AP 5 4 3 2 1 0 Domain 1 C B 1 0 SBZ Figure 7-5 Section descriptor Section descriptor bit assignments are described in Table 7-4. Table 7-4 Section descriptor bits 7.3.
7: Memory Management Unit Coarse page table descriptor bit assignments are described in Table 7-5. Table 7-5 Coarse page table descriptor bits 7.3.
7: Memory Management Unit 7.3.7 Translating section references Figure 7-8 shows the complete section translation sequence.
7: Memory Management Unit A level two descriptor defines a tiny, a small, or a large page descriptor, or is invalid: • a large page descriptor provides the base address of a 64KB block of memory • a small page descriptor provides the base address of a 4KB block of memory • a tiny page descriptor provides the base address of a 1KB block of memory. Coarse page tables provide base addresses for either small or large pages. Large page descriptors must be repeated in 16 consecutive entries.
7: Memory Management Unit 7.3.9 Translating large page references Figure 7-10 shows the complete translation sequence for a 64KB large page.
7: Memory Management Unit 7.3.10 Translating small page references Figure 7-11 shows the complete translation sequence for a 4KB small page.
7: Memory Management Unit 7.3.11 Translating tiny page references Figure 7-12 shows the complete translation sequence for a 1KB tiny page.
7: Memory Management Unit 7.4 MMU faults and CPU aborts The MMU generates an abort on the following types of faults: • alignment faults (data accesses only) • translation faults • domain faults • permission faults. In addition, an external abort can be raised by the external system. This can happen only for access types that have the core synchronized to the external system: • noncachable loads • nonbufferable writes. Alignment fault checking is enabled by the A bit in CP15 register c1.
7: Memory Management Unit 7.5 Fault address and fault status registers On an abort, the MMU places an encoded 4-bit value, FS[3:0], along with the 4-bit encoded domain number, in the data FSR, and the MVA associated with the abort is latched into the FAR. If an access violation simultaneously generates more than one source of abort, they are encoded in the priority given in Table 7-9. 7.5.
7: Memory Management Unit 7.6 Domain access control MMU accesses are primarily controlled through the use of domains. There are 16 domains and each has a 2-bit field to define access to it. Two types of user are supported, clients and managers. The domains are defined in the Domain Access Control Register. Figure 7-13 shows how the 32 bits of the register are allocated to define the 16 2-bit domains.
7: Memory Management Unit Table 7-10 shows how to interpret the Access Permission (AP) bits and how their interpretation is dependent on the S and R bits (control register bits 8 and 9).
7: Memory Management Unit 7.7 Fault checking sequence The sequence the MMU uses to check for access faults is different for sections and pages. The sequence for both types of access is shown in Figure 7-14.
7: Memory Management Unit 7.7.2 Translation fault There are two types of translation fault: Section A section translation fault is generated if the level one descriptor is marked as invalid. This happens if bits [1:0] of the descriptor are both 0. Page A page translation fault is generated if the level two descriptor is marked as invalid. This happens if bits [1:0] of the descriptor are both 0. 7.7.
7: Memory Management Unit 7.8 External aborts In addition to the MMU-generated aborts, the ARM720T processor can be externally aborted by the AMBA bus. This can be used to flag an error on an external memory access. However, not all accesses can be aborted in this way and the Bus Interface Unit (BIU) ignores external aborts that cannot be handled. The following accesses can be aborted: • noncached reads • unbuffered writes • read-lock-write sequence, to noncachable memory.
7: Memory Management Unit THIS PAGE IS BLANK.
8 Coprocessor Interface
8: Coprocessor Interface 8 Coprocessor Interface This chapter describes the coprocessor interface on the ARM720T processor. It contains the following sections: 8.1 8.2 8.3 8.4 8.5 8.6 8.7 8.8 8.9 8.1 About coprocessors ..................................................................................... 8-1 Coprocessor interface signals .................................................................... 8-3 Pipeline-following signals ....................................................................
8: Coprocessor Interface The coprocessor: 1 Decodes instructions to determine whether it can accept the instruction. 2 Indicates whether it can accept the instruction (by signaling on EXTCPA and EXTCPB). 3 Fetches any values required from its own register bank. 4 Performs the operation required by the instruction. If a coprocessor cannot execute an instruction, the instruction takes the undefined instruction trap.
8: Coprocessor Interface 8.2 Coprocessor interface signals The signals used to interface the ARM720T core to a coprocessor are grouped into four categories. The clock and clock control signals include the main processor clock and bus reset: • HCLK • EXTCPCLKEN • HRESETn. The pipeline-following signals are: • CPnMREQ • CPnTRANS • CPnOPC • CPTBIT. The handshake signals are: • CPnCPI • EXTCPA • EXTCPB. The data signals are: • EXTCPDIN[31:0] • EXTCPDOUT[31:0] • EXTCPDBE.
8: Coprocessor Interface 8.3 Pipeline-following signals Every coprocessor in the system must contain a pipeline follower to track the instructions executing in the ARM720T processor pipeline. The coprocessors connect to the ARM720T processor input data bus, EXTCPDOUT[31:0], over which instructions are fetched, and to HCLK and EXTCPCLKEN. It is essential that the two pipelines remain in step at all times.
8: Coprocessor Interface 8.4 Coprocessor interface handshaking The ARM720T core and any coprocessors in the system perform a handshake using the signals shown in Table 8-2. Table 8-2 Handshaking signals Signal Direction Meaning CPnCPI ARM720T core to coprocessor Not coprocessor instruction EXTCPA Coprocessor to ARM720T core Coprocessor absent EXTCPB Coprocessor to ARM720T core Coprocessor busy These signals are explained in more detail in Coprocessor signaling on page 8-6. 8.4.
8: Coprocessor Interface 8.4.3 Coprocessor signaling The coprocessor signals as follows: Coprocessor absent If a coprocessor cannot accept the instruction currently in Decode it must leave EXTCPA and EXTCPB both HIGH. Coprocessor present If a coprocessor can accept an instruction, and can start that instruction immediately, it must signal this by driving both EXTCPA and EXTCPB LOW.
8: Coprocessor Interface 8.4.5 Coprocessor register transfer instructions The coprocessor register transfer instructions, MCR and MRC, transfer data between a register in the ARM720T processor register bank and a register in the coprocessor register bank. An example sequence for a coprocessor register transfer is shown in Figure 8-2.
8: Coprocessor Interface 8.4.7 Coprocessor load and store operations The coprocessor load and store instructions, LDC and STC, are used to transfer data between a coprocessor and memory. They can be used to transfer either a single word of data or a number of the coprocessor registers. There is no limit to the number of words of data that can be transferred by a single LDC or STC instruction, but by convention a coprocessor must not transfer more than 16 words of data in a single instruction.
8: Coprocessor Interface 8.5 Connecting coprocessors A coprocessor in a system based on an ARM720T processor must have 32-bit connections to: • transfer data from memory (instruction stream and LDC) • write data from the ARM720T processor (MCR) • read data to the ARM720T processor (MRC). 8.5.
8: Coprocessor Interface 8.6 Not using an external coprocessor If you are implementing a system that does not include any external coprocessors, you must tie both EXTCPA and EXTCPB HIGH. This indicates that no external coprocessors are present in the system. If any coprocessor instructions are received, they take the undefined instruction trap so that they can be emulated in software if required.
9 Debugging Your System
9: Debugging Your System 9 Debugging Your System This chapter describes how to debug a system based on an ARM720T processor. It contains the following sections: 9.1 9.2 9.3 9.4 9.5 9.6 9.7 9.8 9.9 9.10 9.11 9.12 9.13 9.14 9.15 9.16 9.17 9.18 9.19 9.20 9.21 9.22 9.23 9.24 9.25 9.26 9.27 About debugging your system ................................................................... 9-2 Controlling debugging................................................................................
9: Debugging Your System 9.1 About debugging your system The advanced debugging features of the ARM720T processor make it easier to develop application software, operating systems, and the hardware itself. 9.1.1 A typical debug system The ARM720T processor forms one component of a debug system that interfaces from the high-level debugging that you perform to the low-level interface supported by the ARM720T processor. Figure 9-1 shows a typical debug system.
9: Debugging Your System 9.2 Controlling debugging The major blocks of the ARM720T processor are: ARM CPU core This has hardware support for debug. EmbeddedICE-RT macrocell A set of registers and comparators that you use to generate debug exceptions (such as breakpoints). This unit is described in The EmbeddedICE-RT macrocell on page 9-10. TAP controller Controls the action of the scan chains using a JTAG serial interface. For more details, see The TAP controller on page 9-19.
9: Debugging Your System 9.2.1 Debug modes You can perform debugging in either of the following modes: Halt mode When the system is in halt mode, the core enters debug state when it encounters a breakpoint or a watchpoint. In debug state, the core is stopped and isolated from the rest of the system. When debug has completed, the debug host restores the core and system state, and program execution resumes. For more information, see Entry into debug state on page 9-5.
9: Debugging Your System 9.3 Entry into debug state If the system is in halt mode, any of the following types of interrupt force the processor into debug state: • a breakpoint (a given instruction fetch) • a watchpoint (a data access) • an external debug request. Note: In monitor mode, the processor continues to execute instructions in real time, and will take an abort exception.
9: Debugging Your System 9.3.1 Entry into debug state on breakpoint The ARM720T processor marks instructions as being breakpointed as they enter the instruction pipeline, but the core does not enter debug state until the instruction reaches the Execute stage. Breakpointed instructions are not executed. Instead, the ARM720T core enters debug state. When you examine the internal state, you see the state before the breakpointed instruction. When your examination is complete, remove the breakpoint.
9: Debugging Your System 9.3.3 Entry into debug state on debug request An ARM720T core in halt mode can be forced into debug state on debug request in either of the following ways: • through EmbeddedICE-RT programming (see Programming breakpoints on page 9-36, and Programming watchpoints on page 9-38.) • by asserting the DBGRQ pin. DBGRQ must be deasserted on the same clock that DBGACK is asserted.
9: Debugging Your System 9.3.5 Clocks The system and test clocks must be synchronized externally to the processor. The ARM Multi-ICE debug agent directly supports one or more cores within an ASIC design. Synchronizing off-chip debug clocking with the ARM720T processor requires a three-stage synchronizer. The off-chip device (for example, Multi-ICE) issues a TCK signal and waits for the RTCK (Returned TCK) signal to come back.
9: Debugging Your System 9.4 Debug interface The ARM720T processor debug interface is based on IEEE Std. 1149.1- 1990, Standard Test Access Port and Boundary-Scan Architecture. Refer to this standard for an explanation of the terms used in this chapter, and for a description of the TAP controller states. 9.4.1 Debug interface signals There are three primary external signals associated with the debug interface: • Note: • 9.
9: Debugging Your System 9.6 The EmbeddedICE-RT macrocell The ARM720T processor EmbeddedICE-RT macrocell module provides integrated on-chip debug support for the ARM720T core. The EmbeddedICE-RT module is connected directly to the core and therefore functions on the virtual address of the processor before relocation by the FCSE PID. You program the EmbeddedICE-RT macrocell serially using the ARM720T processor TAP controller.
9: Debugging Your System Abort status register This register identifies whether an abort exception entry was caused by a breakpoint, a watchpoint, or a real abort. For more information, see Abort status register on page 9-38. Debug Communications Channel (DCC) The DCC passes information between the target and the host debugger. For more information, see The debug communications channel on page 9-14. In addition, two independent registers provide overall control of EmbeddedICE-RT operation.
9: Debugging Your System 9.8 EmbeddedICE-RT register map The locations of the EmbeddedICE-RT registers are shown in Table 9-1. Table 9-1 Function and mapping of EmbeddedICE-RT registers 9.
9: Debugging Your System 9.9.2 Restrictions on monitor-mode debugging There are several restrictions you must be aware of when the ARM core is configured for monitor-mode debugging: • Breakpoints and watchpoints cannot be data-dependent in monitor mode. No support is provided for use of the range functionality.
9: Debugging Your System 9.10 The debug communications channel The ARM720T EmbeddedICE-RT macrocell contains a Debug Communication Channel (DCC) for passing information between the target and the host debugger. This is implemented as coprocessor 14. The DCC comprises two registers, as follows: DCC Control Register A 32-bit register, used for synchronized handshaking between the processor and the asynchronous debugger. For more details, see Domain Access Control Register.
9: Debugging Your System The Domain Access Control Register bit assignments are shown in Table 9-2. Table 9-2 Domain Access Control Register bit assignments Bit Function 31:28 Contain a fixed pattern that denotes the EmbeddedICE-RT version number. This must be: • b0111 when using MRC operation to read it • b0100 when using scan operation to read it. 27:2 SBZ 1 The write control bit. If this bit is clear, the DCC data write register is ready to accept data from the processor.
9: Debugging Your System 9.10.2 Communications through the DCC Messages can be sent and received through the DCC. Sending a message to the debugger Messages are sent from the processor to the debugger as follows: 1 When the processor wishes to send a message to EmbeddedICE-RT, it first checks that the communications data write register is free for use. The processor does this by reading the Domain Access Control Register to check the status of the W bit: a.
9: Debugging Your System 9.11 Scan chains and the JTAG interface There are three JTAG-style scan chains within the ARM720T processor. These enable debugging and EmbeddedICE-RT programming. A JTAG-style Test Access Port (TAP) controller controls the scan chains. For more details of the JTAG specification, see IEEE Standard 1149.1 - 1990 Standard Test Access Port and Boundary-Scan Architecture. 9.11.
9: Debugging Your System Scan chain 15 Scan chain 15 is dedicated to the system control coprocessor registers (the CP15 registers). There are 37 bits in scan chain 15. From DBGTDI to DBGTDO, the order of the bits is: • read/write bit • instruction encoding bits [3:0] (see Table 9-3) • data bus bits 31 through 0. Bit 0 of the data field is the first bit to be scanned in and the first to be scanned out. The 4-bit instruction encodings for scan chain 15 are shown in Table 9-3.
9: Debugging Your System 9.12 The TAP controller The TAP controller is a state machine that determines the state of the boundary-scan test signals DBGTDI and DBGTDO. Figure 9-8 shows the state transitions that occur in the TAP controller.
9: Debugging Your System 9.13 Public JTAG instructions Table 9-4 shows the public JTAG instructions. Table 9-4 Public instructions Instruction Binary code SCAN_N b0010 INTEST b1100 IDCODE b1110 BYPASS b1111 RESTART b0100 In the following descriptions, the ARM720T processor samples DBGTDI and DBGTMS on the rising edge of HCLK with DBGTCKEN HIGH. The TAP controller states are shown in Figure 9-8 on page 9-19. 9.13.
9: Debugging Your System 9.13.3 IDCODE (b1110) The IDCODE instruction connects the device identification code register (or ID register) between DBGTDI and DBGTDO. The ID register is a 32-bit register that enables the manufacturer, part number, and version of a component to be read through the TAP. See ARM720T processor device identification (ID) code register on page 9-22 for the details of the ID register format.
9: Debugging Your System 9.14 Test data registers The six test data registers that can connect between DBGTDI and DBGTDO are described in the following sections: • • • • • • Bypass register ARM720T processor device identification (ID) code register Instruction register on page 9-23 Scan path select register on page 9-23 Scan chain 1 on page 9-17 Scan chain 2 on page 9-17. In the following descriptions, data is shifted during every HCLK cycle when DBGTCKEN enable is HIGH. 9.14.
9: Debugging Your System 9.14.3 Instruction register Purpose Changes the current TAP instruction. Length 4 bits. Operating mode In the SHIFT-IR state, the instruction register is selected as the serial path between DBGTDI, and DBGTDO. During the CAPTURE-IR state, the binary value 0001 is loaded into this register. This value is shifted out during SHIFT-IR (least significant bit first), while a new instruction is shifted in (least significant bit first).
9: Debugging Your System 9.14.5 Scan chains 1 and 2 The scan chains enable serial access to the core logic, and to the EmbeddedICE-RT hardware for programming purposes. Each scan chain cell is simple and comprises a serial register and a multiplexor. The scan cells perform three basic functions: • capture • shift • update. For input cells, the capture stage involves copying the value of the system input to the core into the serial register. During shift, this value is output serially.
9: Debugging Your System During SHIFT-DR, a data value is shifted into the serial register. Bits 32 to 36 specify the address of the EmbeddedICE-RT register to be accessed. During UPDATE-DR, this register is either read or written depending on the value of bit 37 (0 = read, 1 = write). See Figure 9-12 on page 9-34 for more details. 9.15 Scan timing Figure 9-10 provides general scan timing information.
9: Debugging Your System Table 9-6 Scan chain 1 cells (continued) 9.
9: Debugging Your System 9.16.1 Determining the core state When the processor has entered debug state from Thumb state, the simplest course of action is for the debugger to force the core back into ARM state. The debugger can then execute the same sequence of instructions to determine the processor state.
9: Debugging Your System All these instructions execute at debug speed. Debug speed is much slower than system speed. This is because between each core clock, 33 clocks occur in order to shift in an instruction, or shift out data. Executing instructions this slowly is acceptable for accessing the core state because the ARM720T processor is fully static. However, you cannot use this method for determining the state of the rest of the system.
9: Debugging Your System When the ARM720T processor returns to debug state after a system speed access, bit 33 of scan chain 1 is set HIGH. The state of bit 33 gives the debugger information about why the core entered debug state the first time this scan chain is read. 9.17 Exit from debug state Leaving debug state involves: • restoring the ARM720T processor internal state • causing the execution of a branch to the next instruction • returning to normal operation.
9: Debugging Your System Figure 9-3 on page 9-5 shows that the final memory access occurs in the cycle after DBGACK goes HIGH. This is the point at which the cycle counter must be disabled. Figure 9-11 on page 9-29 shows that the first memory access that the cycle counter has not previously seen occurs in the cycle after DBGACK goes LOW. This is the point at which to re-enable the counter.
9: Debugging Your System 9.18.3 Watchpoint with another exception If a watchpointed access simultaneously causes a Data Abort, the ARM720T processor enters debug state in abort mode. Entry into debug is held off until the core changes into abort mode and has fetched the instruction from the abort vector. A similar sequence follows when an interrupt, or any other exception, occurs during a watchpointed memory access. The ARM720T processor enters debug state in the mode of the exception.
9: Debugging Your System 9.18.6 Summary of return address calculations To determine whether entry to debug state was due to a breakpoint, watchpoint, or debug request (DBGRQ), bit 33 (DBGBREAK) of scan chain 1 must be consulted together with bit 12 (DBGMOE) of the debug status register (register 1 of scan chain 2). Table 9-7 on page 9-32 shows how DBGMOE and DBGBREAK vary according to the reason for entry to debug state.
9: Debugging Your System 9.19.2 Interrupts When the ARM720T processor enters debug state, interrupts are automatically disabled. If an interrupt is pending during the instruction prior to entering debug state, the ARM720T processor enters debug state in the mode of the interrupt. On entry to debug state, the debugger cannot assume that the ARM720T processor is in the mode expected by the program of the user.
9: Debugging Your System Scan chain register Update read/write 4 Address Address decoder 0 31 32 Value Data Mask Comparator + Breakpoint condition HADDR[31:0] DATA[31:0] Control Watchpoint registers and comparators 0 DBGTDI DBGTDO Figure 9-12 EmbeddedICE-RT block diagram The data to be written is shifted into the 32-bit data field, the address of the register is shifted into the 5-bit address field, and the read/write bit is set.
9: Debugging Your System 9.20.2 Using the data, and address mask registers For each value register in a register pair, there is a mask register of the same format. Setting a bit to 1 in the mask register has the effect of making the corresponding bit in the value register disregarded in the comparison.
9: Debugging Your System DBGEXT[1:0] Is an external input to EmbeddedICE-RT logic that enables the watchpoint to be dependent on some external condition. The DBGEXT input for Watchpoint 0 is labeled DBGEXT[0]. The DBGEXT input for Watchpoint 1 is labeled DBGEXT[1]. CHAIN Can be connected to the chain output of another watchpoint in order to implement, for example, debugger requests of the form breakpoint on address YYY only when in process XXX.
9: Debugging Your System 3 Program the data value register only when you require a data-dependent breakpoint, that is only when you have to match the actual instruction code fetched as well as the address. If the data value is not required, program the data mask register to 0xFFFFFFFF (all bits set). Otherwise program it to 0x00000000. 4 Program the control value register with PROT[0] = 0. 5 Program the control mask register with PROT[0]= 0, all other bits set.
9: Debugging Your System 9.22 Programming watchpoints This section contains examples of how to program the watchpoint unit to generate breakpoints and watchpoints. Many other ways of programming the watchpoint unit registers are possible. For example, simple range breakpoints can be provided by setting one or more of the address mask bits. To make a watchpoint unit cause watchpoints (on data accesses): 1 Program its address value register with the address of the data access to be watchpointed.
9: Debugging Your System 9.24 Debug control register The Debug Control Register is six bits wide. Writes to the Debug Control Register occur when a watchpoint unit register is written. Reads of the Debug Control Register occur when a watchpoint unit register is read. See Watchpoint unit registers on page 9-33 for more information. Figure 9-15 shows the function of each bit in the Debug Control Register.
9: Debugging Your System 9.24.1 Disabling interrupts IRQs and FIQs are disabled under the following conditions: • during debugging (DBGACK HIGH) • when the INTDIS bit is set. The core interrupt enable signal, IFEN, is driven as shown in Table 9-10. Table 9-10 Interrupt signal control 9.24.
9: Debugging Your System 9.25 Debug status register The debug status register is 13 bits wide. If it is accessed for a write (with the read/write bit set), the status bits are written. If it is accessed for a read (with the read/write bit clear), the status bits are read. The format of the debug status register is shown in Figure 9-16.
9: Debugging Your System The structure of the debug control and status registers is shown in Figure 9-17.
9: Debugging Your System 9.26 Coupling breakpoints and watchpoints You can couple watchpoint units 1 and 0 together using the CHAIN and RANGE inputs. The use of CHAIN enables Watchpoint 0 to be triggered only if Watchpoint 1 has previously matched. The use of RANGE enables simple range checking to be performed by combining the outputs of both watchpoints. 9.26.
9: Debugging Your System 9.26.2 DBGRNG signal The DBGRNG signal is derived as follows: DBGRNG = ((({Av[31:0],Cv[4:0]} XNOR {A[31:0],C[4:0]}) OR {Am[31:0],Cm[4:0]}) == 0xFFFFFFFFF) AND ((({Dv[31:0],Cv[7:5]} XNOR {D[31:0],C[7:5]}) OR Dm[31:0],Cm[7:5]}) == 0x7FFFFFFFF) The DBGRNG output of watchpoint register 1 provides the RANGE input to watchpoint register 0. This RANGE input enables you to couple two breakpoints together to form range breakpoints.
10 ETM Interface
10: ETM Interface 10 ETM Interface This chapter describes the ETM interface that is provided on the ARM720T processor. It contains the following sections: 10.1 10.2 10.3 10.4 10.5 10.6 10.1 About the ETM interface ......................................................................... 10-1 Enabling and disabling the ETM7 interface........................................... 10-1 Connections between the ETM7 macrocell and the ARM720T processor......... 10-2 Clocks and resets..............................
10: ETM Interface 10.3 Connections between the ETM7 macrocell and the ARM720T processor Table 10-1 shows the connections that you must make between the ETM7 macrocell and the ARM720T processor.
10: ETM Interface Table 10-1 Connections between the ETM7 macrocell and the ARM720T processor (continued) 10.4 ETM7 macrocell signal name ARM720T processor signal name TDI DBGTDI TDOe DBGTDO TMS DBGTMS WDATA[31:0] ETMWDATA[31:0] INSTRVALID ETMINSTRVALID a. See Clocks and resets on page 10-3. b. See Debug request wiring on page 10-3. c. See Enabling and disabling the ETM7 interface on page 10-1. d. Leave this pin unconnected. e. See TAP interface wiring on page 10-3.
10: ETM Interface THIS PAGE IS BLANK.
11 Test Support
11: Test Support 11 Test Support This chapter describes the test methodology and the CP15 test registers for the ARM720T processor synthesized logic and TCM. It contains the following sections: 11.1 11.2 11.3 11.4 11.5 11.1 About the ARM720T test registers...........................................................11-1 Automatic Test Pattern Generation (ATPG)............................................11-2 Test State Register ................................................................................
11: Test Support 11.2 Automatic Test Pattern Generation (ATPG) Scan insertion is already performed and fixed for the ARM720T processor. You can use Automatic Test Pattern Generation (ATPG) tools to create the necessary scan patterns to test the logic outputs from all registers. A summary of ARM720T ATPG test signals is shown in Table 11-1. Table 11-1 Summary of ATPG test signals Test signals Direction Description TESTENABLE Input This signal ensures the clocks are free-running during scan test.
11: Test Support 11.3 Test State Register The test state register contains only one bit, bit 0: Bit 0 set Enable MMU and cache test. Bit 0 clear Disable MMU and cache test. At reset (HRESETn LOW), bit 0 is cleared. The test state register operations are shown in Table 11-2.
11: Test Support Table 11-3 summarizes register c7, c9, and c15 operations. Table 11-3 Summary of CP15 register c7, c9, and c15 operations Function Rd Instruction Invalidate cache SBZ MCR p15, 0, , c7, c7, 0 Write cache victim and lockdown base Victim=Base MCR p15, 0, , c9, c0, 0 Write cache victim Victim, Seg MCR p15, 0, , c9, c1, 0 CAM read to C15.C Seg MCR p15, 2, , c15, c7, 2 CAM write Tag, Seg, Dirty MCR p15, 2, , c15, c7, 6 RAM read to C15.
11: Test Support The RAM read format for Rd is shown in Figure 11-4. 31 7 6 5 4 SBZ Seg 2 1 0 Word SBZ Figure 11-4 Rd format, RAM read The RAM write format for Rd is shown in Figure 11-5. 31 7 6 5 4 SBZ Seg 2 1 0 Word SBZ Figure 11-5 Rd format, RAM write The CAM match, RAM read format for Rd is shown in Figure 11-6. 31 7 6 5 4 MVA TAG Seg 2 1 0 Word SBZ Figure 11-6 Rd format, CAM match RAM read The CAM read format for data is shown in Figure 11-7.
11: Test Support The CAM match, RAM read format for data is shown in Figure 11-9. 31 30 29 0 RAM data word [29:0] Hit Miss Figure 11-9 Data format, CAM match RAM read 11.4.1 Addressing the CAM and RAM For the CAM read or write, and RAM read or write operations you must specify the segment, index, and word (for the RAM operations).
11: Test Support Example 11-1 shows sample code for performing software test of the cache. It contains typical operations with register C15.C.
11: Test Support ; Now read and check MOV r8,#8 MOV r2,#0x10 MOV r1,#0 MCR p15,3,r1,c15,c3,0 MCR p15,2,r2,c15,c11,2 MRC p15,3,r5,c15,c3,0 ADD r2,r2,#0x04 CMP r5,r0 BNE TEST_FAIL SUBS r8,r8,#1 BNE loop1 B TEST_PASS loop1 11.5 ; write C15.C to ‘0’ ; read RAM to C15.C ; read C15.C to R4 MMU test registers and operations The TLB is maintained using MCR and MRC instructions to CP15 registers c2, c3, c5, c6, c8, and c10, defined by the ARM v4T programmer’s model.
11: Test Support The CP15 register c15 operations that operate on the CAM, RAM1, and RAM2 are shown in Table 11-5. Table 11-5 CAM, RAM1, and RAM2 register c15 operations Note: Function Rd Data CAM read to C15.M SBZ Tag, Size, V, P CAM write Tag, Size, V, P RAM1 read to C15.M SBZ RAM1 write Protection RAM2 read to C15.M SBZ PA Tag, Size RAM2 write PA Tag, Size PA Tag, Size CAM match RAM1 read to C15.
11: Test Support Table 11-6 Register c2, c3, c5, c6, c8, c10, and c15 operations (continued) Function Rd Instruction(s) RAM1 write Protection MCR p15, 4, , c15, c11, 0 RAM2 read to C15.M SBZ MCR p15, 4, , c15, c3, 5 RAM2 write PA Tag, Size MCR p15, 4, , c15, c3, 1 CAM match, RAM1 read to C15.M MVA MCR p15, 4, , c15, c13, 4 Read C15.M Data MRC p15, 4, , c15, c3, 0 Figure 11-12 shows the format of Rd for CAM writes and data for CAM reads.
11: Test Support In Figure 11-13, AP[3:0] determines the setting of the access permission bits for a memory region. The allowed values are shown in Table 11-8. Table 11-8 Access permission bit setting AP[3:0] Access permission bits b1000 b11 b0100 b10 b0010 b01 b0001 b00 Figure 11-14 shows the data format for RAM1 reads.
11: Test Support In Figure 11-15, SIZE_R2 sets the memory region size. The allowed values of SIZE_R2 are shown in Table 11-10. Table 11-10 RAM2 memory region size SIZE_R2[3:0] Memory region size b1000 1MB b0100 64KB b0010 16KB b0000 4KB b0001 1KB Note: The encoding for SIZE_R2 is different from SIZE_C. 11.5.1 Addressing the CAM, RAM1, and RAM2 For the CAM read or write, RAM1 read or write, and RAM2 read or write operations, you must specify the index.
11: Test Support Example 11-2 shows sample code for performing software test of the MMU. It contains typical operations with C15.M.
11: Test Support THIS PAGE IS BLANK.
Appendix A Signal Descriptions
A: Signal Descriptions A Signal Descriptions This chapter describes the interface signals of the ARM720T processor. It contains the following sections: A.1 A.2 A.3 A.4 A.5 A.6 A.7 A.1 AMBA interface signals .............................................................................A-1 Coprocessor interface signals ....................................................................A-2 JTAG and test signals ................................................................................
A: Signal Descriptions A.2 Coprocessor interface signals The coprocessor interface signals are shown in Table A-2. Table A-2 Coprocessor interface signal descriptions Name Type Description EXTCPA Input External coprocessor absent. This signal must be HIGH if no external coprocessor is present. EXTCPB Input External coprocessor busy. EXTCPCLKEN Output External coprocessor clock enable. EXTCPDIN[31:0] Output External coprocessor data in. EXTCPDOUT[31:0] Input External coprocessor data out.
A: Signal Descriptions A.3 JTAG and test signals JTAG and test signal descriptions are shown in Table A-3. Table A-3 JTAG and test signal descriptions Name Type Description DBGIR[3:0] Output TAP instruction register. These signals reflect the current instruction loaded into the TAP controller instruction register. The signals change on the falling edge of HCLK when the TAP state machine is in the UPDATE-DR state.
A: Signal Descriptions Table A-3 JTAG and test signal descriptions (continued) Name Type Description DBGTDO Output Test data out. JTAG test data out signal. DBGTMS Input Test mode select. JTAG test mode select signal. a. A.4 These signals are only active when scan chain 0 is selected. Debugger signals The debugger signal descriptions are shown in Table A-4. Table A-4 Debugger signal descriptions Name Type Description DBGBREAK Input Breakpoint.
A: Signal Descriptions Table A-4 Debugger signal descriptions Name Type Description DBGRNG[1:0] Output Range out. These signals indicate that the relevant EmbeddedICE-RT watchpoint register has matched the conditions currently present on the address, data, and control buses. These signals are independent of the state of the watchpoint enable control bits. A.5 Embedded trace macrocell interface signals The ETM interface signals are shown in Table A-5.
A: Signal Descriptions Table A-5 ETM interface signal descriptions (continued) Output name Type Description ETMTBIT Output Thumb state. This signal, when HIGH, indicates that the processor is executing the THUMB instruction set. When LOW, the processor is executing the ARM instruction set. ETMBIGEND Output Big-endian format. When this signal is HIGH, the processor treats bytes in memory as being in big-endian format. When it is LOW, memory is treated as little-endian.
A: Signal Descriptions A.6 ATPG test signals ATPG test signals used by the ARM720T processor are shown in Table A-6. Table A-6 ATPG test signal descriptions Name Type Description TESTENABLE Input This signal ensures the clocks are free-running during scan test. TESTENABLE must be: • tied HIGH throughout the duration of scan testing • tied LOW during functional mode. SCANENABLE Input This signal enables serial shifting of vectors through the scan chains.
A: Signal Descriptions THIS PAGE IS BLANK.
Glossary
Glossary Glossary This glossary describes some of the terms used in this manual. Where terms can have several meanings, the meaning presented here is intended. Abort Is caused by an illegal memory access. Abort can be caused by the external memory system, an external MMU, or the EmbeddedICE-RT logic. Addressing modes A procedure shared by many different instructions, for generating values used by the instructions.
Glossary Complex Instruction Set Computer A microprocessor that recognizes a large number of instructions. See also Reduced Instruction Set Computer. CPSR See Program Status Register. Control bits The bottom eight bits of a program status register. The control bits change when an exception arises and can be altered by software only when the processor is in a privileged mode. Current Program Status Register See Program Status Register. DCC Debug Communications Channel.
Glossary Halt mode One of two debugging modes. When debugging is performed in halt mode, the core stops when it encounters a watchpoint or breakpoint, and is isolated from the rest of the system. See also Monitor mode. ICE See In-circuit emulator. Idempotent A mathematical quantity that when applied to itself under a given binary operation equals itself. In-circuit emulator An In-Circuit Emulator (ICE), is a device that aids the debugging of hardware and software.
Glossary Monitor mode One of two debugging modes. When debugging is performed in monitor mode, the core does not stop when it encounters a watchpoint or breakpoint, but enters an abort exception routine. See also Halt mode. PC See Program Counter. Privileged mode Any processor mode other than User mode. Memory systems typically check memory accesses from privileged modes against supervisor access permissions rather than the more restrictive user access permissions.
Glossary Saved Program Status Register The Saved Program Status Register which is associated with the current processor mode and is undefined if there is no such Saved Program Status Register, as in User mode or System mode. See also Program Status Register. SBO See Should Be One fields. SBZ See Should Be Zero fields. Should Be One fields Should be written as one (or all ones for bit fields) by software. Values other than one produces Unpredictable results. See also Should Be Zero fields.
Glossary Test Access Port The collection of four mandatory and one optional terminals that form the input/output and control interface to a JTAG boundary-scan architecture. The mandatory terminals are TDI, TDO, TMS, and TCK. The optional terminal is nTRST. Thumb instruction A halfword which specifies an operation for an ARM processor in Thumb state to perform. Thumb instructions must be halfword-aligned. Thumb state A processor that is executing Thumb (16-bit) instructions is operating in Thumb state.
Index
Index Index The items in this index are listed in alphabetical order, with symbols and numerics appearing at the end. The references given are to page numbers.
Index level two 7-10 section 7-8 Device identification code 9-21, 9-22 Disabling EmbeddedICE-RT 9-11 Disabling the ETM interface 10-1 Domain 7-2 access control 7-17 faults 7-15, 7-20 E Early termination definition 2-17 EmbeddedICE-RT 1-3, 9-3 breakpoints coupling with watchpoints 9-43 hardware 9-36 software 9-37 communications channel 9-14 control register 9-30 control registers 9-35 coupling breakpoints with watchpoints 9-43 debug status register 9-26, 9-41 disabling 9-11 overview 9-10 programming 9-5, 9
Index test registers 11-8 Modes, privileged 8-10 Monitor mode 9-4, 9-12, 9-13 Multi-ICE 9-8 O Operating modes Abort mode 2-4 changing 2-4 FIQ 2-4 IRQ mode 2-4 Supervisor mode 2-4 System mode 2-4 Undefined mode 2-4 User mode 2-4 Operating state ARM 2-1 switching 2-1 to ARM 2-1 to THUMB 2-1 THUMB 2-1 P Page tables 7-5 Permission faults 7-15, 7-20 Pipeline follower 8-4 Privileged instructions 8-10 Privileged modes 8-10 Processor state 9-27 Program status registers control bits 2-8 mode bit values 2-9 reserv
Index SWI 2-13 System mode 2-4 System speed instruction 9-28, 9-31 System state determining 9-28 T T bit (in CPSR) 2-8 TAP controller 9-3, 9-10, 9-19 controller state transitions 9-19 instruction 9-23 state 9-24 Test registers 11-1 state register 11-3 Test Access Port,See TAP Test data registers 9-22 Thumb instruction set 1-14 Thumb state 2-1 register organization 2-6 Tiny page references, translating 7-14 Transfer response AHB 6-10 Transitions TAP controller state 9-19 Translating page tables 7-5 Transla
International Sales Operations AMERICA ASIA EPSON ELECTRONICS AMERICA, INC. - HEADQUARTERS - EPSON (CHINA) CO., LTD. 150 River Oaks Parkway San Jose, CA 95134, U.S.A. Phone: +1-408-922-0200 23F, Beijing Silver Tower 2# North RD DongSanHuan ChaoYang District, Beijing, CHINA Phone: 64106655 Fax: 64107319 Fax: +1-408-922-0238 SHANGHAI BRANCH - SALES OFFICES West 1960 E. Grand Avenue EI Segundo, CA 90245, U.S.A. Phone: +1-310-955-5300 Fax: +1-310-955-5400 7F, High-Tech Bldg.
ARM720T Revision 4 (AMBA AHB Bus Interface Version) CORE CPU MANUAL ARM720T Revision 4 (AMBA AHB Bus Interface Version) CORE CPU MANUAL ARM720T Revision 4 (AMBA AHB Bus Interface Version) CORE CPU MANUAL ELECTRONIC DEVICES MARKETING DIVISION EPSON Electronic Devices Website http://www.epsondevice.
