Home

Kenwood BL650 Blender User Manual

1. 9 17 Test access port controller state 9 19 D code register TOI mal reat Sr REOR b HP audere EIER 9 22 Scan UMNO re O A 9 25 BRE ag 9 29 EmbeddedICE RT block diagram seen 9 34 Watchpoint control value and mask 9 35 Debug abortstalusregisier a na Age 9 38 Debug control register Tor Mati e iaa 9 39 Debug status register tomates 9 41 Debug control and status register structure 9 42 15 MRC and MCR bit 11 1 Rd format CAM read 11 4 Rd format CAM WHIT 11 4 Rd format RAM read uni adas 11 5 Rd format RAM WIE ee 11 5 Rd format CAM match RAM read 11 5 Data format read nn d oko Dee e i rb e be ena 11 5 Data format BAM Tead cocaina toda edd eer Dl exa dieit ed ed 11 5 Data format CAM match RAM read 11 6 Rd format write cache victim and lockdown base 11 6 Rd format write cache victim 11 6 Rd format CAM write and data format CAM read 11 10 Rd format 1 Write pe
2. 11 3 Summary of CP15 register c7 c9 and c15 operations 11 4 Write cache victim and lockdown operations 11 6 CAM RAM1 and RAM register c15 11 9 Register c2 c5 c8 c10 and c15 operations 11 9 CAM memory region SiZe ccccconoccccnnnnncnonnncccnnnnnnnncncnnnnnnnnnnannncnnnnnnnns 11 10 Access permission bit setting 11 11 Miss and Taulbeneoditig ioa eorr niter ar ne 11 11 RAM2 memory region SIZE uuueesssssnnnnnnnnnnsnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn 11 12 AMEA Interlace SIGMA Somali std bil A 1 Coprocessor interface signal descriptions A 2 JTAG and test signal descriptions e io toe E etiara A 3 Debugger signal A 4 ETM interface signal descriptions A 5 ATPG test signal descripti0NS coooococcccnnnccccccccoccnnnonanannnncnnnnnnnnancccnnnnnnnnns A 7 Miscellaneous signal descriptiONS ocooonnoccccccnnnncccccccnnccnnnnancccnnnnnnnnrnannnnnnns A 7 ARM720T CORE CPU MANUAL EPSON vii CONTENTS THIS PAGE IS BLANK viii EPSON ARM DDI 0229B Preface Preface Preface This preface introduces the ARM
3. Description Large Small Tiny 31 16 31 12 31 10 These bits form the corresponding bits of the physical address 15 12 9 6 Should Be Zero 11 4 11 4 5 4 Access permission bits Domain access control on page 7 17 and Fault checking sequence on page 7 19 show how to interpret the access permission bits 3 2 3 2 3 2 These bits C and B indicate whether the area of a memory mapped by this page is treated as cachable or noncachable and bufferable or nonbufferable The system is always write through 1 0 1 0 1 0 These bits indicate the page size and validity and are interpreted as shown in Table 7 8 The two least significant bits of the level two descriptor indicate the descriptor type as shown in Table 7 8 Table 7 8 Interpreting page table entry bits 1 0 Value Meaning Description 00 Invalid Generates a page translation fault 01 Large page Indicates that this is a 64KB page 10 Small page Indicates that this is a 4KB page 11 Tiny page Indicates that this is a 1KB page Note Tiny pages do not support subpage permissions and therefore only have one set of access permission bits ARM720T CORE CPU MANUAL EPSON 7 11 7 Memory Management Unit 7 3 9 Translating large page references Figure 7 10 shows the complete translation sequence for a 64KB large page Modified virtual address 31 20 19 16 15 12 11 0 L2 Table index table index Page index
4. 9 38 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 24 Debug control register The Debug Control Register is six bits wide Writes tothe Debug Control Register occur when a watchpoint unit register is written Reads of the Debug Control Register occur when a watchpoint unit register is read See Watchpoint unit registers on page 9 33 for more information Figure 9 15 shows the function of each bit in the Debug Control Register 5 4 3 2 1 0 EmbeddedICE RT Monitor mode disable enable SBZ RAZ INTDIS DBGRQ DBGACK Figure 9 15 Debug control register format The Debug Control Register bit assignments are shown in Table 9 9 Table 9 9 Debug control register bit assignments Bit Function 5 Used to disable the EmbeddedICE RT comparator outputs while the watchpoint and breakpoint registers are being programmed This bit can be read and written through JTAG Set bit 5 when programming breakpoint or watchpoint registers changing bit 4 of the Debug Control Register You must clear bit 5 after you have made the changes to re enable the EmbeddedICE RT logic and make the new breakpoints and watchpoints operational 4 Used to determine the behavior of the core when breakpoints or watchpoints are reached If clear the core enters debug state when a breakpoint or watchpoint is reached If set the core performs an abort exception when a breakpoint or watchpoint is reached This bi
5. When clear the core enters debug state Bit5 Embeddedl CE RT disable Use this when changing watchpoints and breakpoints When set this bit disables breakpoints and watchpoints enabling the breakpoint or watchpoint registers to be programmed with new values When dear the new breakpoint or watchpoint values become operational For more information see Debug control reg ster on page 9 39 Coprocessor register map A new register r2 in the coprocessor CP 14 register map indicates if the processor entered the Prefetch or Data Abort exception because of a real abort or because of a breakpoint or watchpoint For more details see Abort status register on page 9 38 For more details see Chapter 9 Debugging Your System 1 4 EPSON ARM720T CORE CPU MANUAL 1 Introduction 1 2 Coprocessors The ARM 720T processor has an internal coprocessor designated CP15 for internal control of the device see Chapter 3 Configuration The ARM 720T processor also includes a port for the connection of on chip external coprocessors This enables extension of the ARM 720T functionality in an architecturally consistent manner 1 3 About the instruction set The instruction set comprises ten basic instruction types Two types use the on chip arithmetic logic unit barrel shifter and multiplier to perform high speed operations on the data in a bank of 31 registers each 32 bits wide Three types of instruction control th
6. the opcode 2 and CRm fields Should Be Zero except when accessing registers 7 8 and 13 when the specified values must be used to select the desired cache TLB or process identifier operations 3 2 EPSON ARM720T CORE CPU MANUAL 3 Configuration 3 3 Registers The ARM 720T processor contains registers that control the cache and MMU operation You can access these registers using MCR and MRC instructions to CP 15 with the processor in privileged mode Table 3 1 shows a summary of valid CP 15 registers You must not attempt to read from or to write to an invalid register because it results in Unpredictable behavior Table 3 1 Cache and MMU Control Register Register Register reads Register writes 0 ID Register Reserved 1 Control Register Control Register B 2 Translation Table Base Register Translation Table Base Register 3 Domain Access Control Register Domain Access Control Register 4 Reserved Reserved 5 Fault Status Register Fault Status Register 6 Fault Address Register Fault Address Register 7 Reserved Cache Operations Register 8 Reserved TLB Operations Register 9 12 Reserved Reserved 13 Process Identifier Register Process Identifier Register 14 Reserved Reserved 15 Test Registers Test Registers 3 3 1 ID Register Reading from CP 15 Register O returns the value 0x41807204 Note The final nibble represents the core revision The CRm and opcode
7. Table 1 2 ARM instruction summary Operation Assembler Move Move MOV cond S Rd lt Oprnd2 gt Move NOT MVN cond S Rd lt Oprnd2 gt Move SPSR to register MRS cond Rd SPSR Move CPSR to register MRS cond Rd CPSR Move register to SPSR MSR cond SPSRffield Rm Move register to CPSR MSR cond CPSRffield Rm Move immediate to SPSR flags MSR cond SPSR f lt 32bit_Imm gt Move immediate to CPSR flags MSR cond CPSR f 32bit Imm Arithmetic Add ADD cond S Rd Rn lt Oprnd2 gt Add with carry ADC cond S Rd Rn lt Oprnd2 gt Subtract SUB cond S Rd Rn lt Oprnd2 gt Subtract with carry SBC cond S Rd Rn lt Oprnd2 gt Subtract reverse subtract RSB cond S Rd Rn lt Oprnd2 gt Subtract reverse subtract with carry RSC cond S Rd Rn lt Oprnd2 gt Multiply MUL cond S Rd Rm Rs Multiply accumulate MLA cond S Rd Rm Rs Rn Multiply unsigned long UMULL cond S lt RdLo gt lt RdHi gt Rm Rs Multiply unsigned accumulate long UMLAL cond S lt RdLo gt lt RdHi gt lt Rm gt lt Rs gt Multiply signed long SMULL cond S lt RdLo gt lt RdHi gt lt Rm gt lt Rs gt Multiply signed accumulate long SMLAL cond S lt RdLo gt lt RdHi gt lt Rm gt lt Rs gt Compare CMP cond Rd lt Oprnd2 gt
8. A slave has to provide valid data only when a transfer completes with an OKAY response on HRESP 1 0 SPLIT RETRY and ERROR responses do not require valid read data 6 6 3 It is essential that all modules are of the same endianness and also that any data routing or bridges are of the same endianness Endianness Dynamic endianness is not supported because in most embedded systems this leads to a significant silicon overhead that is redundant It is recommended that only modules that will be used in a wide variety of applications are madebi endian with either a configuration pin or internal control bit to select theendianness For more application specific blocks fixing the endianness to either little endian or big endian results in a smaller lower power higher performance interface Table 6 6 shows active byte lanes for little endian systems Table 6 6 Active byte lanes for a 32 bit little endian data bus Transfer size It DATA 31 24 DATA 23 16 DATA 15 8 DATA 7 0 Word 0 Y P d P Halfword 0 d d Halfword 2 d d Byte 0 d Byte 1 d Byte 2 d Byte 3 d ARM720T CORE CPU MANUAL EPSON 6 The Bus Interface Table 6 7 shows active byte lanes for big endian systems Table 6 7 Active byte lanes for a 32 bit big endian data bus Transfer size a DATA 31 24 DATA 23 16 DATA 15 8 DATA 7 0 wa wo lv w Halfword 0 d d Halfw
9. ARM720T CORE CPU MANUAL EPSON 2 5 2 Programmer s Model 2 6 2 Thumb state register set The Thumb state register set is a subset ofthe ARM state set You have direct access to e eight general registers 0 7 the PC a Stack Pointer SP register a Link Register LR the CPSR There are banked SPs LRs and Saved Program Status Registers SP SRs for each privileged mode This is shown in Figure 2 4 Thumb state general registers and program counter System and User FIQ Supervisor Abort IRQ Undefined ro ro ro ro ro ro r1 r1 r1 r1 r1 r1 r2 r2 r2 r2 r2 r2 r3 r3 r3 r3 r3 r3 r r r r r r r5 r5 r5 r5 r5 r5 r6 r6 r6 r6 r6 r6 r7 r7 r7 r7 r7 r7 SP SP fiq SP svc SP abt SP irq SP und LR b LR fiq N LR_svc b LR abt b LR irq b LR und PC PC PC PC PC PC Thumb state program status registers CPSR CPSR CPSR CPSR CPSR CPSR N SPSR fiq N SPSR svc N SPSR abt N SPSR irq SPSR und N banked register Figure 2 4 Register organization in Thumb state 2 6 EPSON ARM720T CORE CPU MANUAL 2 Programmer s Model 2 6 3 The relationship between ARM and Thumb state registers The Thumb state registers relate to the ARM state registers in the following ways Thumb state r0 r7 and ARM state rO r7 are identical Thumb state CPSR and SPSRs and ARM state CPSR and SPSRs are identical Thumb state SP ma
10. Table 9 7 on page 9 32 shows how DBGMOE and DBGBREAK vary according to the reason for entry to debug state Note DBGMOE and DBGBREAK must be read after entry into debug state and before any other accesses to scan chain 1 Table 9 7 Determining the cause of entry to debug state DBGMOE DBGBREAK Description 0 0 Breakpoint 0 1 Watchpoint 1 X Debug Request DBGRQ The calculation of the branch return address is as follows for normal breakpoint and watchpoint the branch is 4 N 35 for entry through debug request DBGRQ or watchpoint with exception the branch is 3 N 35 whereN is the number of debug speed instructions executed including the final branch and S is the number of system speed instructions executed 9 19 Priorities and exceptions When a breakpoint or a debug request occurs the normal flow of the program is interrupted Therefore debug can betreated as another type of exception The interaction of the debugger with other exceptions is described in 7he program counter during debug on page 9 30 This section covers the following priorities Breakpoint with Prefetch Abort Interrupts Data Aborts 9 19 1 Breakpoint with Prefetch Abort When a breakpointed instruction fetch causes a Prefetch Abort the abort is taken and the breakpoint is disregarded Normally Prefetch Aborts occur when for example an access is made to a virtual address that does not physic
11. Translation table base 31 14 13 Translation base y ME 31 14 13 2 Table index Level one descriptor 109 8 ENE 10 9 2 L2 table index b Level two descriptor 16 15 121110 9 8 7 6 5 4 3 2 1 BA Translation base U Coarse page table base address Coarse page table base address y Page base address I I Jo Physical address 1615 Page base address y Page index I Figure 7 10 Large page translation from a coarse page table Because the upper four bits of the page index and low order four bits of the coarse page table index overlap each coarse page table entry for a large page must be duplicated 16 times in consecutive memory locations in the coarse page table If a large page descriptor is included in a fine page table the high order six bits of the page index and low order six bits of the fine page table index overlap Each fine page table entry for a large page must therefore be duplicated 64 times 7 12 EPSON ARM720T CORE CPU MANUAL 7 3 10 Translating small page references 7 Memory Management Unit Figure 7 11 shows the complete translation sequence for a 4K B small page Modified virtual address 31 20 19 12 11 0 j Level 2 DEN Penn Translation table base 31 14 13 0 Translation base ER 78 31 14 13 210 Translation base Table index 0 11 Level one descriptor
12. ooooononnccccnnnnnncccccnnnnnncnonncccncnnnnnnncnnnnnnnnnnnnns 7 19 Figure 8 1 Coprocessor busy wait sequence 8 6 Figure 8 2 Coprocessor register transfer sequence 8 7 Figure 8 3 Coprocessor data operation sequence 8 7 Figure 8 4 Coprocessor load sequence 8 8 Figure 8 5 Example coprocessor connections 8 9 Figure 9 1 Typical debUG SVSIGITL he eau latin ru carb lass 9 2 Figure 9 2 ARM720T processor block 9 3 Figure 9 3 Deb g state see EE 9 5 iv EPSON ARM720T CORE CPU MANUAL Figure 9 4 Figure 9 5 Figure 9 6 Figure 9 7 Figure 9 8 Figure 9 9 Figure 9 10 Figure 9 11 Figure 9 12 Figure 9 13 Figure 9 14 Figure 9 15 Figure 9 16 Figure 9 17 Figure 11 1 Figure 11 2 Figure 11 3 Figure 11 4 Figure 11 5 Figure 11 6 Figure 11 7 Figure 11 8 Figure 11 9 Figure 11 10 Figure 11 11 Figure 11 12 Figure 11 13 Figure 11 14 Figure 11 15 Figure 11 16 CONTENTS Glock usina teens 9 8 The ARM720T core TAP controller and EmbeddedICE RT macrocell 9 10 Domain Access Control Register sse 9 14 ARM720T processor scan chain
13. read DAC register TheCP15 register c5 operations control the Fault Status Register F SR These operations are write FSR read FSR The CP15 register c6 operations control the Fau t Address Register FAR These operations are write FAR read FAR The CP15 register c8 operations control the TLB and are all write only These operations are invalidate TLB invalidate single entry using MVA The 15 register c10 operations control TLB lockdown These operations are read victim lockdown base and preserve bit write victim lockdown base and preserve bit 11 8 EPSON ARM720T CORE CPU MANUAL 11 Test Support The CP15 register c15 operations that operate on the CAM RAM 1 RAM2 are shown in Table 11 5 Table 11 5 CAM RAM1 and RAM register c15 operations Function Rd Data CAM read to C15 M SBZ Tag Size V P CAM write Tag Size V P RAM1 read to C15 M SBZ Protection RAM1 write Protection RAM2 read to C15 M SBZ PA Tag Size RAM2 write PA Tag Size PA Tag Size CAM match RAM1 read to C15 M MVA Fault Miss Protection Note For the CAM match RAM 1 read operation a TLB miss will not cause a page walk These register c15 operations are all issued as MCR which means that the read and match operations have to be latched into register CP 15 M in CP15 This is a 32 bit register that is read with the following CP 15 MRC instruction Read from register CP15 M Table 1
14. 0 MCR p15 2 r3 c15 c7 2 read CAM to C15 C MRC p15 3 r4 c15 c3 0 read C15 C to R4 BIC r4 r4 1 clear LFSR bit CMP r4 r2 BNE TEST_FAIL SUBS r8 r8 1 BNE loop1 B TEST_PASS RAM write read and check for segment 1 Write cache victim pointer with index 0 segment 1 MOV r0 0 ORR r1 r0 1 SHL 0x5 MCR p15 0 r1 c9 c1 0 Write pattern 0X5A5A5A5A in RAM line eight words LDR r0 20x5A5A5A5A MOV r8 8 MOV r2 0x10 write segment 1 word 0 MCR p15 3 r0 c15 c3 0 write RAM data in C15 C loopO MCR p15 2 r2 c15 c11 6 write RAM ADD r2 r2 40x04 next word SUBS r8 r8 1 BNE loopO ARM720T CORE CPU MANUAL EPSON 11 7 11 Test Support Now read and check MOV r8 8 MOV r2 0x10 MOV r1 0 loop1 MCR p15 3 r1 c15 c3 0 write C15 C to 0 MCR p15 2 r2 c15 c11 2 read RAM to C15 C MRC p15 3 r5 c15 c3 0 read C15 C to R4 ADD r2 r2 0x04 CMP r5 r0 BNE TEST_FAIL SUBS r8 r8 1 BNE loop1 B TEST_PASS 11 5 test registers and operations TheTLB is maintained using MCR and MRC instructions to CP 15 registers c2 C5 c6 and c10 defined by the ARM v4T programmer lt model The CP15 register c2 operations control the Translation Table Base TTB These operations are write Translation Table Base Registers read Translation Table Base Register The 15 register c3 operations control the Domain Access Control DAC register These operations are write DAC registers
15. 1 3 Figure 1 3 ARM instruction set formats cea een 1 7 Figure 1 4 Thumb instruction set exta tin ii sia 1 14 Figure 2 1 Big endian addresses of bytes with 2 2 Figure 2 2 Little endian addresses of bytes with words 2 3 Figure 2 3 Register organization in ARM 2 5 Figure 2 4 Register organization in Thumb state 2 6 Figure 2 5 Mapping of Thumb state registers onto ARM state registers 2 7 Figure 2 6 Program status register TO Maldicion aa 2 8 Figure 3 1 MRC MCR bit pattern oe Redes 3 2 Figure 3 2 ID Register ro Mi uA Roc dd aei dana as ue ag dee te eg eu 3 3 Figure 3 3 ID Register write TON TB cicatrix ocn 3 3 Figure 3 4 Control Register read TOMA usina tu iia 3 4 Figure 3 5 Control Register write format 3 4 Figure 3 6 Translation Table Base Register 3 5 Figure 3 7 Domain Access Control Register 3 6 Figure 3 8 Fault Status Register format business aa 3 6 Figure 3 9 Fault Address Register format 4 4444444400nnnnnnnnnnnnnnnnnnnnnnnnnnn 3 7 Figure 3 10 FOSGE PID Register
16. 31 10 9 8 543210 Coarse page table base address L2 table index blo 11 Level two descriptor 121110 9 8 7 6 5 4 3 2 1 Page base address Lo e il Physical address lr 12 11 0 a Page base address Page index Figure 7 11 Small page translation from a coarse page table If asmall page descriptor is included in a fine page table the upper two bits of the page index and low order two bits of the fine page table index overlap Each fine page table entry for a small page must therefore be duplicated four times ARM720T CORE CPU MANUAL EPSON 7 13 7 Memory Management Unit 7 3 11 Translating tiny page references Figure 7 12 shows the complete translation sequence for a 1KB tiny page Modified virtual address 31 20 19 10 9 0 Level 2 Table index table index Translation table base 31 14 13 0 Translation base y 31 14 13 210 Translation base Table index ll Level one descriptor 31 12 11 9 8 543210 Fine page table base address Domain x 1 31 J 12 11 210 Fine page table base address L2 table index ol il Level two descriptor 0 Page base address anio 1 il Physical address n Page base address Figure 7 12 Tiny page translation from a fine page table Page translation involves one additional step beyond that of a section translation The level one descriptor is the fine page table descriptor and this is used to point to th
17. A coarse pagetable descriptor provides the base address of a pagetablethat contains level two descriptors for either large page or small page accesses Coarse page tables have 256 entries splitting the 1MB that the table describes into 4K B blocks Figure 7 6 shows the format of a coarse page table descriptor 31 109 8 543210 Coarse page table base address SBZ Figure 7 6 Coarse page table descriptor Note If a coarse page table descriptor is returned from the level one fetch a level two fetch is initiated 7 8 EPSON ARM720T CORE CPU MANUAL 7 Memory Management Unit Coarse page table descriptor bit assignments are descri bed in Table 7 5 Table 7 5 Coarse page table descriptor bits Bits Description 31 10 These bits form the base for referencing the level two descriptor the coarse page table index for the entry is derived from the MVA 9 Always written as O 8 5 These bits specify one of the 16 possible domains held in the Domain Access Control Registers that contain the primary access controls 4 Always written as 1 3 2 Always written as 0 1 0 These bits must be 01 to indicate a coarse page table descriptor 7 3 6 Fine page table descriptor A fine page table descriptor provides the base address of a page table that contains level two descriptors for large page small page or tiny page accesses Fine page tables have 1024 entries splitting the 1MB that the table describes into 1
18. Compare negative CMN cond Rd lt Oprnd2 gt Logical Test TST cond Rn lt Oprnd2 gt Test equivalence TEQ cond Rn lt Oprnd2 gt AND AND cond S Rd Rn lt Oprnd2 gt EOR EOR cond S Rd Rn lt Oprnd2 gt ORR ORR cond S Rd Rn lt Oprnd2 gt Bit clear BIC cond S Rd Rn lt Oprnd2 gt Branch Branch B cond lt label gt Branch with link BL cond label Branch and exchange instruction BX cond Rn set 1 8 EPSON ARM720T CORE CPU MANUAL 1 Introduction Table 1 2 ARM instruction summary continued Operation Assembler Load Word LDR cond Rd lt a_mode2 gt Word with User Mode privilege LDR cond T Rd lt a_mode2P gt Byte LDR cond B Rd lt a_mode2 gt Byte with User Mode privilege LDR cond BT Rd lt a_mode2P gt Byte signed LDR cond SB Rd lt a_mode3 gt Halfword LDR cond H Rd lt a_mode3 gt Halfword signed LDR cond SH Rd a mode3 Multiple block Increment before LDM condg IB lt Rd gt lt reglist gt data operations Increment after LDM cond IA lt Rd gt lt reglist gt Decrement before LDM cond DB lt Rd gt lt reglist gt Decrement after LDM cond DA lt Rd gt lt reglist gt Stack operations LDM cond lt a_mode4L gt lt Rd gt lt reglist gt Stack operations and restore LDM cond lt a_mode4L gt l
19. ETMPROCID 31 0 Output Trace PROCID bus ETMPROCIDWR Output Trace PROCID write Indicates to the ETM7 that the Trace PROCID CP15 register c13 has been written ARM720T CORE CPU MANUAL EPSON A 5 A Signal Descriptions Table A 5 ETM interface signal descriptions continued Output name Type Description ETMTBIT Output Thumb state This signal when HIGH indicates that the processor is executing the THUMB instruction set When LOW the processor is executing the ARM instruction set ETMBIGEND Output Big endian format When this signal is HIGH the processor treats bytes in memory as being in big endian format When it is LOW memory is treated as little endian ETMEN Input The ETM7 enable signal ETMHIVECS Output When LOW this signal indicates that the exception vectors start at address 0x00000000 When HIGH the exception vectors start at address OxFFFFO0000 ETMSIZE 1 0 Output The memory access size bus driven by the ARM720T processor ETMRDATA 31 0 Output The processor read data bus ETMWDATA 31 0 Output The processor write data bus ETMINSTRVALID Output The instruction valid signal driven by the ARM720T processor When HIGH it indicates that the instruction in the Execute stage is valid and has not been flushed ETMnRW Output Not read write When HIGH indicates a processor write cycle When LOW indicates a processor read cycle
20. To disable the MMU clear bit in the control register The data cache must be disabled prior to or at the same time as the MMU is disabled by dearing bit 2 of the control register See Enabling the MMU regarding prefetch effects Note Ifthe MMU is enabled then disabled and subsequently re enabled the contents of theTLB are preserved If these are now invalid you must invalidatethe TL B before re enabling the MMU See 74 B Operations Register on page 3 7 ARM720T CORE CPU MANUAL EPSON 7 21 7 Memory Management Unit THIS PAGE IS BLANK 7 22 EPSON ARM720T CORE CPU MANUAL 8 Coprocessor Interface 8 Coprocessor Interface 8 GCoprocessor Interface This chapter describes the coprocessor interface on the ARM 720T processor It containsthe following sections 8 1 POUT COPOS Sas 8 1 8 2 Coprocessor interface Sinai ataca 8 3 8 3 Pipeline following signals iip od ye pay u 8 4 8 4 Coprocessor interface handshaking 8 5 8 5 Ge ga adis ofeo ooa fM 8 9 8 6 Not using an external COPrOCESSOr nunenenssennnnnennnennnnnnnnnnnnnnnnnnnnnnnnnnnnnnn nenn 8 10 8 7 STE Oper at ONE eines mee oe DEEP 8 10 8 8 Undefined instructions a een 8 10 8 9 Privileged ASEO Siria asi 8 10 8 1 About coprocessors The instruction set for the ARM 720T processor enables you to implement specialized additional instructions using coprocessors These are separate processing units that are tightly coup
21. DBGnTDOEN HBUSREQ DBGnTRST gt HLOCK DBGTCKEN gt HCLKEN DBGTDI gt EXTCPCLKEN DBGTDO EXTCPDIN 31 0 DBGTMS EXTCPDOUT 31 0 ETMEN gt EXTCPA ETMBIGEND gt Coprocessor EATGPH ETMHIVECS 5 interface CPnCPI ETMnMREQ 4 CPnOPC ARM720T processor ETMnOPC 4 CPTBIT ETMSEQ 4 CPnTRANS ETMnEXEC gt 4 CPnMREQ ETMINSTRVALID gt EXTCPDBE ETMnCPI gt COMMRX ETMADDR 31 0 gt 4 COMM TX ETMnRW EM interface 4 DBGACK ETMCLKEN gt Debug DBGEN ETMSIZE 1 0 5 interface DBGRQ ETMDBGACK DBGEXT 1 0 I ETMRDATA 31 0 4 DBGRNG 1 0 I ETMWDATA 31 0 gt DBGBREAK ETMABORT BIGENDOUT nFIQ ET M CPB Miscellaneous nIRQ ETMTBIT signals VINITHI I ETMPROCID 31 0 HRESETn ETMPROCIDWR gt HCLK lt SCANINO SCANIN6 ATPG ATPG TESTENABLE Signal Signals SCANENABLE lt SCANOUTO SCANOUT6 gt gna s Figure 1 2 ARM720T processor functional signals 1 1 1 EmbeddediCE RT logic The E mbeddedl CE RT logic provide
22. ETMCLKEN Output This signal is used to indicate to the ETM that the core is in a wait state It is not a true clock enable for the ETM A 6 EPSON ARM720T CORE CPU MANUAL A 6 ATPG test signals A Signal Descriptions ATPG test signals used by the ARM 720T processor are shown in Table A 6 Table A 6 ATPG test signal descriptions Name Type Description TESTENABLE Input This signal ensures the clocks are free running during scan test TESTENABLE must be tied HIGH throughout the duration of scan testing tied LOW during functional mode SCANENABLE Input This signal enables serial shifting of vectors through the scan chains You must control this signal using the I O pins It must be tied LOW during functional mode SCANINO SCANIN6 Inputs Processor core scan chain inputs SCANOUTO SCANOUT6 Outputs Processor core scan chain outputs HCLK Input System clock All signals are related to the rising edge of HCLK HCLKEN Input Synchronous enable for AHB transfers When HIGH indicates that the next rising edge of HCLK is also a rising edge for the AHB system that the ARM720T processor is embedded in Must be tied HIGH in systems where the AMBA bus and the core are intended to be the same frequency DBGTCKEN Input Synchronous enable for debug logic Must be tied HIGH during scan test HRESETn Input This is the active LOW reset signal for the system and bus DBGnTRST Input This is the active L
23. Operation Shift Rotate Table 1 12 Thumb instruction summary continued Logical shift left Assembler LSL Rd lt Rs gt lt 5bit_shift_imm gt LSL lt Rd gt lt Rs gt Logical shift right LSR Rd Rs bbit shift imm LSR Rd Rs Arithmetic shift right ASR Rd Rs bbit shift imm ASR Rd Hs Rotate right ROR Rd Rs Branch Conditional if Z set BEQ label if Z clear BNE lt label gt if C set BCS label if C clear BCC label if N set BMI lt label gt if N clear BPL label if V set BVS label if V clear BVC label if C set and Z clear BHI label if C clear and Z set BLS label if N set and V set or if N BGE label clear and V clear if N set and V clear or if BLT label N clear and V set if Z clear and N or V set BGT label or if Z clear and N or V clear if Z set or N set and V BLE label clear or N clear and V set Unconditional B label Long branch with link BL label Optional state change to address held in Lo reg BX Hs to address held in Hi reg BX Hs Load With immediate offset word LDR Ra lt Rb gt lt 7bit_offset gt halfword LDRH lt Rd gt lt Rb gt 6bit offset byte LDRB Ra lt Rb gt lt 5bit_offset gt EPSON ARM720T CORE CPU MA
24. Test Access Port SeeTAP Test data registers 9 22 Thumbinstruction set 1 14 Thumb state 2 1 register organization 2 6 Tiny page references translating 7 14 Transfer response AHB 6 10 Transitions TAP controller state 9 19 Translating page tables 7 5 Translation faults 7 15 7 20 Translation Table Base Register TTB 7 4 U Undefined instruction handling 8 10 trap 8 10 Undefined instruction trap 2 13 Undefined mode 2 4 UPDATE DR 9 20 UPDATE IR 9 23 User mode 2 4 W Watchpoint 9 5 9 6 9 10 9 24 9 30 9 43 aborted 9 31 coupling 9 43 Embeddedl CE RT 9 36 externally generated 9 5 programming 9 38 register 9 33 9 37 registers 9 33 programming and reading 9 33 unit 9 38 with exception 9 32 Watchpoint O 9 44 Watchpointed access 9 31 9 33 memory access 9 31 Watchpoints programming 9 38 WRITE 9 35 Write buffer bufferable bit 5 1 operation 5 2 bufferable write 5 2 read lock write 5 2 unbufferable write 5 2 Write data bus AHB 6 10 Index 4 EPSON ARM DDI 0229B EPSON International Sales Operations AMERICA EPSON ELECTRONICS AMERICA INC HEADQUARTERS 150 River Oaks Parkway San Jose CA 95134 U S A Phone 1 408 922 0200 Fax 1 408 922 0238 SALES OFFICES West 1960 E Grand Avenue El Segundo CA 90245 U S A Phone 1 310 955 5300 Fax 1 310 955 5400 Central 101 Virginia Street Suite 290 Crystal Lake IL 60014 U S A Phone 1 815 455
25. This signal causes the core to enter debug state after executing the current instruction This enables external hardware to force the core into debug state in addition to the debugging features provided by the EmbeddedICE RT Logic In most systems this input is tied LOW DBGRQ must be deasserted on the same clock that DBGACK is asserted DBGEXT 1 0 Input External condition These signals allow breakpoints and watchpoints to depend on an external condition A 4 EPSON ARM720T CORE CPU MANUAL A Signal Descriptions Table A 4 Debugger signal descriptions Name Type Description DBGRNG 1 0 Output Range out These signals indicate that the relevant EmbeddedICE RT watchpoint register has matched the conditions currently present on the address data and control buses These signals are independent of the state of the watchpoint enable control bits A 5 Embedded trace macrocell interface signals The ETM interface signals are shown in Table A 5 Table A 5 ETM interface signal descriptions Output name Type Description ETMnMREQ Output Not memory request When LOW indicates that the processor requires memory access during the following cycle ETMSEQ Output Sequential address When HIGH indicates that the address of the next memory cycle is related to that of the last memory cycle The new address is one of the following the same as the previous one four greater in ARM state two g
26. access is permitted if access is permitted and an off chip access is required the MMU outputs the appropriate physical address corresponding to the MVA if access is permitted and an off chip access is not required the cache services the access if access is not permitted the MMU signals the CPU coreto abort If the TLB misses it does not contain an entry for the VA thetranslation table walk hardware is invoked toretrievethetranslation information from a translation tablein physical memory When retrieved the translation information is written into the TLB possibly overwriting an existing value The entry to be written is chosen by cyding sequentially through the TLB locations When the MMU is turned off as happens on reset no address mapping occurs and all regions are marked as noncachable and nonbufferable 7 2 EPSON ARM720T CORE CPU MANUAL 7 Memory Management Unit 7 2 Table 7 1 lists the CP 15 registers that are used in conjunction with page table descriptors stored in memory to determine the operation of the MMU MMU program accessible registers Table 7 1 CP15 register functions Register Number Bits Register description Control register 1 A S Contains bits to enable the MMU M bit enable data address alignment checks A bit and to control the access protection scheme S bit and R bit Translation 2 31 14 Holds the physical address of the base of the translation Table
27. it must signal this by driving both EXTCPA and EXTCPB LOW Coprocessor busy busy wait If a coprocessor can accept an instruction but is currently unable to process that request it can stall the ARM 720T core by asserting busy wait This is signaled by driving EXTCPA LOW but leaving EXTCPB HIGH When the coprocessor is ready to start executing the instruction it signals this by driving EXTCPB LOW This is shown in Figure 8 1 HCLK Fetch stage _ ADD SUB CPDO TST SWINE Decode stage _ y ADD SUB KCPDO Y TST Y SWINE y Execute stage _ ADD SUB CPDO _TST_ swine CPnCPI from core EXTCPA from coprocessor EXTCPB from RDATA 31 0 Fetch Y I Fetch J I Fetch I Fetch Fetch X a l Fetch J Fetch ADD SUB CPDO TST SWINE gt coprocessor busy waiting Figure 8 1 Coprocessor busy wait sequence 8 4 4 Consequences of busy waiting A busy waited coprocessor instruction can be interrupted If a valid FIQ or IRQ occurs the appropriate bit is cleared in the CSPR the ARM 720T processor abandons the coprocessor instruction and signals this by taking CPnCPI HIGH A coprocessor that is capable of busy waiting must monitor CPnCPI to detect this condition When the ARM 720T core abandons a coprocessor instruction the copro
28. the current and previous mode in the CPSR and SPSR and the value of the PC When an exception has taken place you are given the choice of servicing the exception before debugging Entry todebug state when an exception has occurred causes the PC to beincremented by three instructions rather than four and this must be considered in return branch calculation when exiting debug state For example supposethat an abort occurs on a watchpointed access and ten instructions have been executed to determine this eventuality You can usethe following sequence to return to program execution E1A00000 MOV RO RO 1 1 00000 MOV RO RO 0 EAFFFFFO B 16 This code forces a branch back to the abort vector causing the instruction at that location to be refetched and executed Note After the abort service routine the instruction that caused the abort and watchpoint is refetched and executed This triggers the watchpoint again and the ARM 720T processor reenters debug state 9 18 4 Debug request Entry into debug state using a debug request is similar to a breakpoint However unlikea breakpoint the last instruction has completed execution and so must not be refetched on exit from debug state Therefore you can assume that entry to debug state adds three addresses tothe PC and every instruction executed in debug state adds one address For example suppose you have invoked a debug request and decide to return to program execution strai
29. 2 load and store operations 8 8 not using 8 10 CPnCPI 8 6 CPSR Current Processor Status Register 2 8 format of 2 8 CPU aborts 7 15 CP15 test registers 11 1 D Data abort 9 6 9 33 Data bus AHB 6 10 Data mask register 9 33 9 35 Data types 2 3 alignment 2 3 byte 2 3 halfword 2 3 word 2 3 Data value register 9 33 Debug actions 9 7 breakpoints 9 6 control register 9 39 core state 9 26 entry into debug state from breakpoint watch point 9 30 excepti ons 9 33 host 9 2 interface 9 9 interface signals 9 9 Multi I CE 9 8 priorities 9 33 request 9 5 9 7 9 30 9 31 state 9 7 state entry from a breakpoint 9 30 state exit from 9 30 status register 9 26 9 41 System state 9 26 target 9 2 watchpoint 9 6 Debugger signals A 4 Descriptor coarse page table 7 8 fine page table 7 9 level one 7 6 ARM DDI 0229B EPSON Index 1 Index level two 7 10 section 7 8 Device identification code 9 21 9 22 Disabling Embeddedl CE RT 9 11 Disabling the ETM interface 10 1 Domain 7 2 access control 7 17 faults 7 15 7 20 E Early termination definition 2 17 Embeddedl CE RT 1 3 9 3 breakpoints coupling with watchpoints 9 43 hardware 9 36 software 9 37 communications channel 9 14 control register 9 30 control registers 9 35 coupling breakpoints with watchpoints 9 43 debug status register 9 26 9 41 disabling 9 11 overview 9 10 programming 9 5 9 7 9 17 registers 9 33 software breakpoints 9 37 TAP
30. 3 Table 7 3 Interpreting level one descriptor bits 1 0 Value Meaning Description 00 Invalid Generates a section translation fault 0 1 Coarse page Indicates that this is a coarse page table table descriptor 10 Section Indicates that this is a section descriptor 11 Fine page table Indicates that this is a fine page table descriptor ARM720T CORE CPU MANUAL EPSON 7 7 7 Memory Management Unit 7 3 4 Section descriptor A section descriptor provides the base address of a 1MB block of memory Figure 7 5 shows the format of a section descriptor 20 19 1211109 8 543210 he Figure 7 5 Section descriptor Section descriptor bit assignments are described in Table 7 4 Table 7 4 Section descriptor bits Bits Description 31 20 Form the corresponding bits of the physical address for a section 19 12 Always written as 0 11 10 AP Specify the access permissions for this section 9 Always written as O 8 5 Specify one of the 16 possible domains held in the Domain Access Control Register that contain the primary access controls 4 Should be written as 1 for backward compatibility 3 2 These bits C and B indicate whether the area of memory mapped by this page is treated as cachable or noncachable and bufferable or nonbufferable The system is always write through 1 0 These bits must be b10 to indicate a section descriptor 7 39 5 Coarse page table descriptor
31. 5 HPROT 3 0 HPROT 3 0 is the protection control bus These signals provide additional information about a bus access and are primarily intended to enable a moduletoimplement an access permission scheme These signals indicate whether the transfer is an opcode fetch or data access a privileged mode access or User mode access For bus masters with a memory management unit these signals also indicate whether the current access is cachable or bufferable Table 6 4 shows the protection control encodings as produced from the ARM 720T core Table 6 4 Protection control encodings HPROT 3 HPROT 2 HPROT 1 HPROT O cachable bufferable privileged data opcode 0 Opcode fetch Description 1 Data access 0 User access 1 Privileged access 0 Not bufferable 1 Bufferable 0 Not cachable 1 Cachable Some bus masters are not capable of generating accurate protection information soit is recommended that slaves do not use the HPROT 3 0 signals unless strictly necessary 6 8 EPSON ARM720T CORE CPU MANUAL 6 The Bus Interface 6 5 Slave transfer response signals After a master has started a transfer the slave determines how thetransfer progresses No provision is made in the AHB specification for a bus master to cancel a transfer after it has begun Whenever a slave is accessed it must provide a response using the following signals HRESP 1
32. Address translation 7 4 Address mask register 9 33 9 35 Address value register 9 33 Alignment faults 7 15 AMBA interface signals A 1 Arbitration AHB 6 12 ARM instruction set 1 7 addressing mode five 1 12 four 1 11 three 1 11 two 1 10 two privileged 1 11 condition fields 1 13 fields 1 12 operand two 1 12 ARM state register organization 2 5 ARM 720T block diagram 1 2 description 1 1 ATPG test signals summary 11 2 A 7 B Banked registers 9 27 Big endian see memory format Boundary scan chain cells 9 19 interface 9 19 Breakpoint address mask 9 37 data dependent 9 37 entry into debug state 9 6 externall y generated 9 5 hardware 9 36 programming 9 36 Breakpoints programming 9 36 software 9 36 Bus interface transfer types 6 5 Bus request AHB 6 12 BYPASS instruction 9 21 Bypass register 9 21 9 22 Byte data type 2 3 C Cache test register 11 3 CAPTURE DR state 9 20 CHAIN bit 9 36 Clock domains 9 9 System 9 8 test 9 8 Coarse page table descriptor 7 8 Communications channel message transfer from the de bugger 9 16 Condition code flags 2 8 Configuration compatibility 3 1 description 3 1 notation 3 1 Connecting an ETM 7 macrocell 10 2 Control mask 9 33 9 35 Control mask register 9 33 9 35 Control value register 9 36 Control value register 9 33 9 35 Coprocessor 1 5 about 8 1 busy waiting 8 6 connecting 8 9 data operations 8 7 handshaking 8 5 interface handshaking 8 5 interface signals 8 3 A
33. CPTBIT The handshake signals are CPnCPI EXTCPA EXTCPB The data signals are EXTCPDIN 31 0 EXTCPDOUT 31 0 EXTCPDBE These signals and their use are described in Pipeline following signals on page 8 4 Coprocessor interface handshaking on page 8 5 Connecting coprocessors on page 8 9 Not using an external coprocessor on page 8 10 Undefined instructions on page 8 10 Privileged instructions on page 8 10 ARM720T CORE CPU MANUAL EPSON 8 3 8 Coprocessor Interface 8 3 Pipeline following signals E very coprocessor in the system must contain a pipeline follower to track the instructions executing in the ARM 720T processor pipeline The coprocessors connect to the ARM 720T processor input data bus EXTCPDOUT 31 0 over which instructions are fetched and to HCLK and EXTCPCLKEN It is essential that the two pipelines remain in step at all times When designing a pipeline follower for a coprocessor you must observe the following rules At reset HRESETn LOW the pipeline must either be marked as invalid or filled with instructions that do not decode to valid instructions for that coprocessor The coprocessor state must only change when EXTCPCLKEN is HIGH except for reset An instruction must be loaded into the pipeline on the rising edge of HCLK and only when CPnOPC CPnMREQ and CPTBIT were 3 LOW in the previous bus cyde These conditions indicatethat this cydeis an ARM state opcode
34. Fetch sothe new opcode must be sampled into the pipeline The pipeline must be advanced on the rising edge of HCLK when CPnOPC CPnMREQ and CPTBIT are all LOW in the current bus cycle These conditions indicate that the current instruction is about to complete execution because the first action of any instruction performing an instruction fetch is to refill the pipeline Any instructions that are flushed from the ARM 720T processor pipeline never signal on CPnCPI that they have entered E xecute so they are automatically flushed from the coprocessor pipeline by the prefetches required to refill the pipeline There are no coprocessor instructions in the Thumb instruction set so coprocessors must monitor thestateof the CPTBIT signal toensurethat they do not try to decode pairs of Thumb instructions as ARM instructions 8 4 EPSON ARM720T CORE CPU MANUAL 8 Coprocessor Interface 8 4 Coprocessor interface handshaking TheARM 720T core and any coprocessors in the system perform a handshakeusingthesignals shown in Table 8 2 Table 8 2 Handshaking signals Signal Direction Meaning CPnCPI ARM720T core coprocessor Not coprocessor instruction EXTCPA Coprocessor to ARM720T core Coprocessor absent EXTCPB Coprocessor to ARM720T core Coprocessor busy These signals are explained in more detail in Coprocessor signalingon page 8 6 8 4 1 The coprocessor The coprocessor decodes the instruction currently in
35. Figure 6 4 JfNoNsEQfY sea Xy SEQ Jy SEQ Xy ox2a YY oes y 0x2C XX XX X INCR Xy XX KX n E Data Data X X Data ooN Data KX 0x20 0x24 0x28 0x2C En V V i Ff V X y Data Data Data Datal 0x20 0x24 0x28 0x2C Figure 6 4 Transfer type examples The first transfer is the start of a burst and is therefore nonsequential The master performs the second transfer of the burst immediately The master performs thethird transfer of the burst immediately but this timethe slave is unable to complete and uses HREADY to insert a single wait state Thefinal transfer of the burst completes with zero wait states 6 6 EPSON ARM720T CORE CPU MANUAL 6 The Bus Interface 6 4 Address and control signals The address and control signals are described in the following sections HADDR 31 0 HWRITE HSIZE Z 0 HBURST 2 0 on page 6 8 HPROT 3 0 on page 6 8 6 4 1 HADDR 31 0 HADDR 31 0 is the 32 bit address bus that specifies the address for the transfer All addresses are byte addresses so a burst of word accesses results in the address bus incrementing by four for each cycle The address bus provides 4GB of linear addressing space This means that when a word access is signalled the memory system must ignore the bottom two bits HADDR 1 0 when a halfword access is sign
36. HIGH this response indicates that the transfer has completed successfully The OKAY response is also used for any additional cycles that are inserted with HREADY LOW prior to giving one of the three other responses b01 ERROR This response indicates that a transfer error has occurred and the transfer has been unsuccessful Typically this is used for a protection error such as an attempt to write to a read only memory location The error condition must be signalled to the bus master so that it is aware the transfer has been unsuccessful A two cycle response is required for an error condition b10 RETRY The RETRY response shows the transfer has not yet completed so the bus master should retry the transfer The master should continue to retry the transfer until it completes A two cycle RETRY response is required b11 SPLIT The transfer has not yet completed successfully The bus master must retry the transfer when it is next granted access to the bus The slave will request access to the bus on behalf of the master when the transfer can complete A two cycle SPLIT response is required For a full description of the slave transfer responses see the AMBA Specification Rev 2 0 6 6 Data buses Toenable you to implement an AH B system without the use of tristate drivers separate 32 bit read and write data buses are required 6 6 1 HWDATA 31 0 The write data bus is driven by the bus master during write tr
37. I Domain fault nC TLB miss nB Figure 11 14 Data format RAM1 read In Figure 11 14 bits 24 22 are only valid for a match operation I n this case the values shown in Table 11 9 apply Table 11 9 Miss and fault encoding Prot fault Domain fault TLB miss Function 0 0 0 Hit OK 0 1 0 Hit domain fault 1 0 0 Hit protection fault 1 1 0 Hit protection and domain fault 1 TLB miss Figure 11 15 shows the Rd format for RAM2 writes and the data format for RAM2 reads 31 25 24 00 a FCSE PID UNP SBZ Figure 11 15 Rd format RAM2 write and data format RAM2 read ARM720T CORE CPU MANUAL EPSON 11 11 11 Test Support In Figure 11 15 SIZE R2 sets the memory region size The allowed values of SIZE R2 are shown in Table 11 10 Table 11 10 RAM2 memory region size SIZE R2 3 0 Memory region size brooo MB b0100 64KB b0010 16KB b0000 4KB b0001 1KB Note The encoding for SIZE R2 is different from SIZE C 11 5 4 Addressing the CAM RAM1 and RAM2 For the CAM read or write RAM 1 read or write and RAM2 read or write operations you must specify the index The CAM and RAM 1 operations use the value in the victim pointer so you must write this before any CAM or RAM 1 operation RAM2 uses a pipelined version of the victim pointer used for the CAM or RAM 1 operation This means that to read from index N in the RAM2 array you must first perform an access to in
38. MMU are fetched using no address translation Enabling the MMU can be considered as a branch with delayed execution A similar situation occurs when the MMU is disabled The correct code sequence for enabling and disabling the MMU is given nteraction of the MMU and cache on page 7 21 Note When the MMU is disabled the Cache is disabled If the cache and write buffer are enabled when the MMU is not enabled the results are Unpredictable 3 3 3 Translation Table Base Register Reading from CP 15 Register 2 returns the pointer to the currently active first level translation table in bits 31 14 and an Unpredictable value in bits 13 0 The CRm and opcode 2 fields Should Be Zero when reading CP 15 Register 2 Writing to CP 15 Register 2 updates the pointer to the currently active first level translation table from the value bits 31 14 of the written value Bits 13 0 Should Be Zero The CRm and opcode 2 fields Should Be Zero when writing CP 15 Register 2 Translation Table Base Register format is shown in Figure 3 6 31 14 13 00 Translation base table UNP SBZ Figure 3 6 Translation Table Base Register format ARM720T CORE CPU MANUAL EPSON 3 5 3 Configuration 3 3 4 Domain Access Control Register Reading from CP15 Register 3 returns the value of the Domain Access Control Register Writing to CP15 Register 3 writes the value of the Domain Access Control Register The Domain Access Control Register consists of
39. Manual The Thumb instruction set formats are shown in Figure 1 4 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 Move shifted register 01 10 00 Op Offset5 Rs Rd Rn Add and subtract 02 0 01011 1 Rs Rd offset3 Move compare add and subtract 100 1 Op Rd Offset8 immediate ALU operation 04 0 1 Op Rs Rd High register operations and branch 05 110 0 01 Op H1H2 Rs Hs exchange PC relative load 06 0 1 0 1 Rd Word8 Load and store with relative offset 07 0 1 0 1 Ro Rb Rd Load and store sign extended byte and 08 100110111His 1 Ro Rb Rd halfword Load and store with immediate offset 09 0 1 1 Offset5 Rb Rd Load and store halfword 10 1 0 L Offset5 Rb Rd SP relative load and store 11 10011 Rd Word8 Load address 12 11 0 10 SP Rd Word8 Add offset to stack pointer 113 10 1 1 0 0 0 5 SWord7 Push and pop registers 14 1 0 1 1 110 Rlist Multiple load and store 15 1 1 0 0 L Rb Rlist Conditional branch 16 110 1 Cond Softset8 Software interrupt 17 1 1 01 1 1 1 1 Value8 Unconditional branch 18 1 1 1 0 0 Offset11 Long branch with link 19 1 1 1 1 H Offset 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 Figure 1 4 Thumb instruction set formats 1 14 EPSON ARM720T CORE CPU MANUAL The Thumb instruction set summary is shown
40. address field and the read write bit is set The data to be written is scanned into the 32 bit data field the address of the register is scanned into the 5 bit address field and the read write bit is set A register is read by shifting its address into the address field and by shifting a 0 into the read write bit The 32 bit data field is ignored The register addresses are shown in Table 9 1 on page 9 12 Note A read or write takes place when the TAP controller enters the UPDATE DR state 9 34 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 20 2 Using the data and address mask registers For each value register in a register pair there is a mask register of the same format Setting a bit to 1 in the mask register has the effect of making the corresponding bit in the value register disregarded in the comparison For example when a watchpoint is required on a particular memory location but the data valueis irrelevant the data mask register can be programmed to Oxffffffff all bits set to ignore the entire data bus field Note The mask is an XNOR mask rather than a conventional AND mask When a mask bit is set to 1 the comparator for that bit position always matches irrespective of the value register or the input value Clearing the mask bit means that the comparator matches only if the input value matches the value programmed into the value register 9 20 3 The watchpoint unit control registers The control
41. b0111 Valid causing abort Domain Section b1001 Valid MVA of access Page b1011 Valid causing abort Permission Section b1101 Valid MVA of access Page b1111 Valid causing abort Lowest External abort on noncachable Section b1000 Valid MVA of access nonbufferable access or Page b1010 Valid causing abort noncachable bufferable read Note Alignment faults can write either b0001 or b0011 into FS 3 0 Invalid values in domains 3 0 can occur because the fault is raised before a valid domain field has been read from a page table descriptor Any abort masked by the priority encoding can be regenerated by fixing the primary abort and restarting the instruction 7 16 EPSON ARM720T CORE CPU MANUAL 7 Memory Management Unit 7 6 Domain access control MMU accesses are primarily controlled through the use of domains There are 16 domains and each has a 2 bit field to define access to it Two types of user are supported clients and managers The domains are defined in the Domain Access Control Register Figure 7 13 shows how the 32 bits of the register are allocated to define the 16 2 bit domains 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 1615141312111098 7654321 0 V V V 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Figure 7 13 Domain Access Control Register format Table 7 10 defines how the bits within each domain are interpreted to specify the access permissions Table 7 10 Interpreting access control bits in Domain Access C
42. bits set Otherwise program the data mask register to 0x00000000 4 Program the control value register as follows PROT O Set HWRITE Clear for a read Set for a write SIZE 1 0 Program with the valuecorrespondingtothe appropriate data size 5 Program the control mask register as follows PROT O Clear HWRITE Clear Note You can set this bit if both reads and writes are to be watchpointed SI ZE 1 0 Clear Note Y ou can set these bits if data size accesses are to be watchpointed All other bits Set 6 If you haveto makethe distinction between User and non U ser mode data accesses program the PROT 1 bit in the control value and control mask registers accordingly 7 If required program the DBGEXT RANGE and CHAIN bits in the same way 9 23 Abort status register Only bit O of this 32 bit read write register is used It determines whether an abort exception entry was caused by a breakpoint a watchpoint or a real abort The format is shown in Figure 9 14 31 1 0 SBZ RAZ DbgAbt Figure 9 14 Debug abort status register Bit 015 set when the ARM 720T core takes a Prefetch or Data Abort as a result of a breakpoint or watchpoint If on a particular instruction or data fetch both the Debug Abort and the external Abort signal areasserted the external Abort takes priority and the DbgAbt bit is not set Once set DbgAbt remains set until reset by the user The register is accessed by MRC and MCR instructions
43. can use Automatic Test Pattern Generation ATPG tools to create the necessary scan patterns to test the logic outputs from all registers A summary of ARM 720T ATPG test signals is shown in Table 11 1 Table 11 1 Summary of ATPG test signals Test signals Direction Description TESTENABLE Input This signal ensures the clocks are free running during scan test TESTENABLE must be tied HIGH throughout the duration of scan testing tied LOW during functional mode SCANENABLE Input This signal enables serial shifting of vectors through the scan chains You must control this signal using the I O pins It must be tied LOW during functional mode SCANINO SCANIN6 Inputs Processor core scan chain inputs SCANOUTO SCANOUT6 Outputs Processor core scan chain outputs HCLK Input System clock All signals are related to the rising edge of HCLK HCLKEN Input Synchronous enable for AHB transfers When HIGH indicates that the next rising edge of HCLK is also a rising edge for the AHB system that the ARM720T processor is embedded in Must be tied HIGH in systems where the AMBA bus and the core are intended to be the same frequency DBGTCKEN Input Synchronous enable for debug logic Must be tied HIGH during scan test HRESETn Input This is the active LOW reset signal for the system and bus DBGnTRST Input This is the active LOW reset signal for the internal state This signal is a level sensitive asynchronous reset inpu
44. code that is self modifying See Hardware breakpointsfor more details Software breakpointsmonitor a particular bit pattern being fetched from any address One Embeddedl CE RT watchpoint can therefore be used to support any number of software breakpoints See Software breakpointsfor more details Software breakpoints can usually be set only in RAM because a special bit pattern chosen to cause a software breakpoint has to replace the instruction Hardware breakpoints To make a watchpoint unit cause hardware breakpoints on instruction fetches 1 2 Program its address value register with the address of the instruction to be breakpointed Program the breakpoint bits for each state as follows For an ARM state breakpoint Set bits 1 0 of the address mask register For a Thumb state breakpoint Set bit O of the address mask register In either case clear the remaining bits 9 36 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 3 Program the data value register only when you require a data dependent breakpoint that is onl y when you haveto match the actual instruction code fetched as well as the address If the data value is not required program the data mask register to OXFFFFFFFF all bits set Otherwise program it to 0x00000000 4 Program the control value register with PROT O 0 Program the control mask register with PROT 0 0 all other bits set When you have to make the distinction between User and non
45. controller 9 34 timing 9 44 watchpoint registers 9 33 9 36 watchpoints 9 36 ENABLE bit 9 36 Enabling the ETM interface 10 1 ETM interface docks and resets 10 3 connecting 10 2 enabling and disabling 10 1 signals A 5 Exception entering 2 10 entry and exit summary 2 11 leaving 2 11 priorities 2 14 restrictions 2 14 returning to THUMB state from 2 11 vectors 2 13 2 14 addresses 2 13 watchpoint 9 31 External aborts 7 21 2 15 Fault address register 7 16 domain 7 20 permission 7 20 status register 7 16 translation 7 20 FCSE relocation of low virtual ad dresses 2 15 F etch instruction 9 35 Fine page table descriptor 7 9 FIQ mode 2 4 definition 2 12 FIQ valid 8 6 FSR 7 16 G Grant signal AHB 6 12 H Halt mode 9 4 9 5 Hardware breakpoints 9 36 HBUSREQx 6 12 HGRANTx 6 12 High register accessing from THUMB state 2 7 description 2 7 HLOCKx 6 12 HRDATA 6 11 HRESP 6 10 HWDATA 6 10 ID register 9 19 9 21 9 22 IDC cachable bit 4 1 disable 4 2 enable 4 2 operation 4 1 read lock write 4 2 reset 4 2 validity 4 2 double mapped space 4 2 software I DC flush 4 2 IDCODE instruction 9 21 Identification register SeelD reg ister Instruction fetch 9 35 register 9 20 9 21 9 22 9 23 Instruction set 1 5 coprocessor 8 1 debug 9 9 J TAG 9 17 Internal coprocessor instructions 3 2 Interrupt mask enable 9 42 Interrupts 9 33 INTEST instruction 9 20 mode 9 24 wrapper 11 2 IRQ valid 8 6 IRQ m
46. doe t ose pen D CQ rao tha Mcd RE 9 12 9 10 The debug communications channel seseesseeeee 9 14 9 11 Scan chains and the JTAG interface 9 17 9412 The TAP Controller ee 9 19 9 13 Public JTAG IDSIFIOHOFLS an er 9 20 9 14 Test data TGUISIOL S oe He a Eas 9 22 9 150 Scan UMNO Lr 9 25 9 16 Examining the core and the system in debug state eenn 9 26 9 17 Exit from debug State coca 9 29 9 18 The program counter during debug 9 30 9 19 Priorities and exeeplions Ana a 9 32 9 20 Watch point unit register cra 9 33 9 21 Programming DreakpOIlnis ia 9 36 9 22 Programming watchpoints ara 9 38 9 23 vr an na en 9 38 9 24 Debug control register 44444000nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnannnnnnn 9 39 9 25 Debug Status register nenne anne 9 41 9 26 Coupling breakpoints and 9 43 9 27 EmbeddediGE R Timing a anal 9 44 ii EPSON ARM720T CORE CPU MANUAL CONTENTS 10 ETM Interface 10 1 10 2 10 3 10 4 10 5 10 6 About the ETM interface 0 cccccecceeeccecceccenceceecececeeececececceeaueeauecerecaes 10 1 Enabling and disabling the ETM7 interface 10 1 Connectio
47. extend C State bit T Zero Z FIQ disable F IRQ disable I Negative or less than N Figure 2 6 Program status register format 2 7 1 The condition code flags TheN Z C and V bits are the condition code flags These can be changed as a result of arithmetic and logical operations and tested to determine if an instruction must execute or not In ARM state all instructions can be executed conditionally In Thumb state only the Branch instruction is capable of conditional execution See the ARM Architecture Reference Manual for details 2 7 2 The control bits The bottom eight bits of a PSR incorporating 1 F T and M 4 0 are known collectively as the control bits These change when an exception arises If the processor is operating in a privileged mode they can also be mani pulated by software and F bits These arethe interrupt disable bits When set these disable the IRQ and FIQ interrupts respectively TheT bit This reflects the operating state When this bit is set the processor is executing in Thumb state otherwise it is executing in ARM state This is reflected on the CPTBIT external signal Software must never change the state of the CPTBIT in the CPSR If this happens the processor enters an Unpredictable state M 4 0 bits These arethe mode bits These determine the processor operating mode as shown in Table 2 2 on page 2 9 Not all combinations of the mode bits define a valid processor mod
48. format dues ee ede ep dtu 3 8 Figure 3 11 PROGID Register formal 3 8 Figure 6 1 Simple ABASTO occ een 6 2 Figure 6 2 AHB bus master interface eon tne edi e d eiu td ren rina aa 6 4 Figure 6 3 Simple memory cycle cocccccnnonocccccnnnnonccnccncnnnnnnnnnnnnnnnnnnnnnnnc cnn nn nnnnnnncnnnnnnnnanns 6 5 Figure 6 4 Transfer type examples iia 6 6 Figure 7 1 Translation Table Base 7 4 Figure 7 2 Translating page tables usais trolas 7 5 Figure 7 3 Accessing translation table level one descriptors 7 6 Figure 7 4 Level one A eek 7 6 Figure 7 5 sale Mo ee ee c 7 8 Figure 7 6 Coarse page table 7 8 Figure 7 7 Fine page table descriptor oomonncccccnnnccccccccnnccnnnnnncccconnnnnnannnnnnnnnnnnnnnnnnnos 7 9 Figure 7 8 Section translatorn irisse rr nenne 7 10 Figure 7 9 Level two descriptor aran a 7 10 Figure 7 10 Large page translation from a coarse page 7 12 Figure 7 11 Small page translation from a coarse page table 7 13 Figure 7 12 Tiny page translation from a fine page 7 14 Figure 7 13 Domain Access Control Register 7 17 Figure 7 14 Sequence for checking faults
49. gt RRX 1 10 EPSON ARM720T CORE CPU MANUAL 1 Introduction Addressing mode 2 privileged lt a_mode2P gt is shown in Table 1 4 Table 1 4 Addressing mode 2 privileged Operation Assembler Immediate offset lt Rn gt lt 12bit_Offset gt Register offset lt Rn gt lt Rm gt Scaled register offset lt Rn gt lt Rm gt LSL lt 5bit_shift_imm gt lt Rn gt lt Rm gt LSR lt 5bit_shift_imm gt lt Rn gt lt Rm gt ASR lt 5bit_shift_imm gt lt Rn gt lt Rm gt ROR lt 5bit_shift_imm gt lt Rn gt lt Rm gt RRX Post indexed immediate offset lt Rn gt lt 12bit_Offset gt Post indexed register offset lt Rn gt lt Rm gt Post indexed scaled register offset lt gt lt Rm gt LSL lt 5bit_shift_imm gt lt Rn gt lt Rm gt LSR lt 5bit_shift_imm gt lt Rn gt lt Rm gt ASR lt 5bit_shift_imm gt lt Rn gt lt Rm gt ROR lt 5bit_shift_imm gt lt Rn gt lt Rm gt RRX Addressing mode 3 signed byte and halfword data transfer lt a_mode3 gt is shown in Table 1 5 Table 1 5 Addressing mode 3 Operation Assembler Immediate offset lt Rn gt lt 8bit_Offset gt Pre indexed lt Rn gt lt 8bit_Offset gt Post indexed lt Rn gt lt 8bit_Offset gt Register lt Rn gt lt Rm gt Pre
50. is the serial data from an external scan chain It enables a single DBGTDO port to be used If an external scan chain is not connected this input must be tied LOW DBGTAPSN 3 0 Output Tap controller status These signals represent the current state of the TAP controller machine These signals change on the rising edge of XTCK and can be used to allow more scan chains to be added using the ARM720T processor TAP controller DBGCAPTURE Output CAPTURE state signal When HIGH this indicates that the TAP controller state machine is in a CAPTURE state see Figure 9 8 on page 9 19 DBGSHIFT Output SHIFT state signal When HIGH this indicates that the TAP controller state machine is in a SHIFT state see Figure 9 8 on page 9 19 DBGUPDATE Output UPDATE state signal When HIGH this indicates that the TAP controller state machine is in an UPDATE state see Figure 9 8 on page 9 19 DBGINTEST Output INTEST state signal DBGEXTEST Output EXTEST state signal DBGnTDOEN Output Test data out enable DBGnTRST Input Not test reset When LOW this signal resets the JTAG interface DBGTCKEN Input Test clock enable DBGTDI Input Test data in JTAG test data in signal ARM720T CORE CPU MANUAL EPSON A 3 A Signal Descriptions Table A 3 JTAG and test signal descriptions continued Name Type Description DBGTDO Output Test data out JTAG test data out signal DBGTMS
51. pages and small pages can be specified separately for each quarter of the page these quarters are called subpages 16 domains implemented hardware 64 entry TLB hardware page table walks round robin replacement algorithm also called cyclic invalidate whole TLB using CP 15 Register 8 e invalidate TLB entry selected by Modified Virtual Address MVA using CP15 Register 8 ARM720T CORE CPU MANUAL EPSON 7 1 7 Memory Management Unit 7 1 1 Access permissions and domains For large and small pages access permissions are defined for each subpage 4KB for small pages 16K B for large pages Sections and tiny pages have a single set of access permissions All regions of memory have an associated domain A domain is the primary access control mechanism for a region of memory It defines the conditions necessary for an access to proceed The domain determines if the access permissions are used to qualify the access the access is unconditionally allowed to proceed the access is unconditionally aborted In the latter two cases the access permission attributes are ignored There are 16 domains These are configured using the Domain Access Control Register 7 1 2 Translated entries TheTLB caches 64 translated entries During CPU memory accesses the TLB provides the protection information to the access control logic If the TLB contains a translated entry for the MVA the access control logic determines if
52. pointed instruction When a breakpointed conditional instruction reaches the Execute stage of the pipeline the breakpoint is always taken if the system is in halt mode The ARM 720T core enters debug state regardless of whether the instruction condition is met A breakpointed instruction does not cause the ARM 720T coreto enter debug state when A branch or a write to the PC precedes the breakpointed instruction In this case when the branch is executed the ARM 720T processor flushes the instruction pipeline so canceling the breakpoint An exception occurs causing the ARM 720T processor to flush the instruction pipeline and cancel the breakpoint In normal circumstances on exiting from an exception the ARM 720T core branches back to the instruction that would have been executed next before the exception occurred In this case the pipeline is refilled and the breakpoint is reflagged 9 3 2 Entry into debug state on watchpoint Watchpoints occur on data accesses In halt mode the core processing stops In monitor mode an abort exception is executed see Abort on page 2 12 A watchpoint is always taken but a core in halt mode might not enter debug state immediately because the current instruction always completes If the current instruction is a multiword load or store an LDM or STM many cycles can elapse before the watchpoint is taken On a watchpoint the following sequence occurs 1 Thecurrent instruction completes 2 A
53. that are sensitive to the number of memory accesses they must be led to believe that the ARM 720T processor is still in debug state You can dothis by programming the E mbeddedl CE RT control register toforcethe valueon DBGACK to be HIGH See Debug status reg ster on page 9 41 for more details 9 18 The program counter during debug The debugger must keep track of what happens to the PC so that the ARM 720T core can be forced to branch back to the place at which program flow was interrupted by debug Program flow can be interrupted by any of the following Breakpoints Watchpoints Watchpoint with another exception on page 9 31 Debug request on page 9 31 System speed access on page 9 31 9 18 1 Breakpoints Entry into debug state from a break point advances the PC by four addresses or 16 bytes Each instruction executed in debug state advances the PC by one address or 4 bytes The usual way to exit from debug state after a breakpoint is to remove the breakpoint and branch back to the previousl y breakpointed address For example if the ARM 720T processor entered debug state from a breakpoint set on a given address and two debug speed instructions were executed a branch of 7 addresses must occur 4 for debug entry plus 2 for the instructions plus 1 for the final branch The following sequence shows the data scanned into scan chain 1 most significant bit first The value of the first digit goes tothe DBGBREAK bit and
54. the instruction type Single data transfer instructions LDR STR write back modified base registers The Abort handler must be aware of this The swap instruction SWP is aborted as though it had not been executed Block data transfer instructions LDM STM complete If write back is set the base is updated If the instruction attempts to overwrite the base with data that is it has the base in the transfer list the overwriting is prevented All register overwriting is prevented after an abort is indicated This means in particular that r15 always the last register to be transferred is preserved in an aborted LDM instruction 2 12 EPSON ARM720T CORE CPU MANUAL 2 Programmer s Model After fixing the reason for the abort the handler must execute the following irrespective of the processor state ARM or Thumb SUBS PC r14 abt 4 for a Prefetch Abort SUBS PC r14 abt 8 for a Data Abort This restores both the PC and the CPSR and retries the aborted instruction Note There are restrictions on the use of the external abort signal See Externa aborts on page 7 21 2 8 7 Software interrupt The SWI instruction is used for entering Supervisor mode usually to request a particular supervisor function A SWI handler must return by executing the following irrespective of the state ARM or Thumb MOV PC 14 svc This restores the PC and CPSR and returns tothe instruction following the SWI 2 8 8 Undefi
55. the Decode stage of its pipeline and checks whether that instruction is a coprocessor instruction A coprocessor instruction has a coprocessor number that matches the coprocessor ID of the coprocessor If theinstruction currently in the Decode stage is a coprocessor instruction 1 The coprocessor attempts to execute the instruction 2 coprocessor signals back to the ARM 720T core using EXTCPA and EXTCPB 8 4 2 The ARM720T core Coprocessor instructions progress down the ARM 720T processor pipeline in step with the coprocessor pipeline A coprocessor instruction is executed if the following aretrue 1 Thecoprocessor instruction has reached the E xecute stage of the pipeline It might not if it was preceded by a branch 2 Theinstruction has passed its conditional execution tests 3 A coprocessor in the system has signalled on EXTCPA and EXTCPB that it is able to accept the instruction If all these requirements are met the ARM 720T processor signals by taking CPnCPI LOW This commits the coprocessor to the execution of the coprocessor instruction ARM720T CORE CPU MANUAL EPSON 8 5 8 Coprocessor Interface 8 4 3 signaling The coprocessor signals as follows Coprocessor absent If a coprocessor cannot accept the instruction currently in Decode it must leave EXTCPA and EXTCPB both HIGH Coprocessor present If a coprocessor can accept an instruction and can start that instruction immediately
56. the communications data write register and scan the data out b Theaction of reading this data register clears the W bit of the Domain Access Control Register At this point the communications process can begin again Receiving a message from the debugger Transferring a message from the debugger to the processor is similar to sending a message from the processor to the debugger In this case the debugger reads the R bit of the debug comms control register The sequence for receiving messages from the debugger is as follows 1 The debugger reads the bit of the Domain Access Control Register a IftheR bitis clear the data read register is free and data can be placed there for the processor to read b IftheR bit is set previously deposited data has not yet been collected so the debugger must wait 2 When the communications data read register is free data is written thereusingthe J TAG interface Theaction of this writesets theR bit in the Domain Access Control Register 3 processor reads the Domain Access Control Register a IftheR bit is set there is data that can be read using an MRC instruction to coprocessor 14 The action of this load clears the R bit in the debug comms control register b IftheR bitis clear this indicates that the data has been taken and the process can now be repeated 9 16 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 11 Scan chains and the JTAG interface There
57. the memory controller to arbitrate whether the ARM 720T core can have the bus in the next cyde If the bus is not available the ARM 720T processor might have its clock stalled indefinitely The only way to determine whether the memory access has completed is to examine the state of both HTRANS 1 0 and DBGACK When both are HIGH the access has completed The debugger usually uses E mbeddedl CE RT to control debugging and so the state of HTRANS 1 0 and DBGACK can be determined by reading the E mbeddedl CE RT status register See Debug status register on page 9 41 for more details The state of the system memory can be fed back tothe debug host by using system speed load multiples and debug speed store multiples There are restrictions on which instructions can have bit 33 set The valid instructions on which to set this bit are loads stores load multiple store multiple See also Exit from debug state on page 9 29 9 28 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System When the ARM 720T processor returns to debug state after a system speed access bit 33 of scan chain 1 is set HIGH The state of bit 33 gives the debugger information about why the core entered debug state the first time this scan chain is read 9 17 Exit from debug state Leaving debug state involves restoring the ARM 720T processor internal state causing the execution of a branch to the next instruction returning to normal operation Af
58. then the instruction data intothe remainder of scan chain 1 0 E0802000 ADD r2 rO rO 1 E1826001 ORR r6 r2 r1 0 EAFFFFFS B 7 2 s complement After the ARM 720T processor enters debug state it must execute a minimum of two instructions before the branch although these can both be NOPs MOV RO RO For small branches you can replace the final branch with a subtract with the PC as the destination SUB PC PC 28 in the above example 9 18 2 Watchpoints The return to program execution after entry to debug state from a watchpoint is made in the same way as the procedure described in Breakpornts Debug entry adds four addresses to the PC and every instruction adds one address The difference from breakpoint is that the instruction that caused the watchpoint has executed and the program must return to the next instruction 9 30 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 18 3 Watchpoint with another exception If a watchpointed access simultaneously causes a Data Abort the ARM 720T processor enters debug state in abort mode Entry into debugis held off until the core changes into abort mode and has fetched the instruction from the abort vector A similar sequence follows when an interrupt or any other exception occurs during a watchpoi nted memory access The ARM 720T processor enters debug state in the mode of the exception The debugger must check to see whether an exception has occurred by examining
59. trademarks of their respective companies Copyright 2001 2003 ARM Limited All rights reserved Preface B 1 Introduction 2 Programmer s Model 3 Configuration 4 Instruction and Data Cache 5 Write Buffer 6 The Bus Interface 7 Memory Management Unit 8 Coprocessor Interface 9 Debugging Your System 10 ETM Interface 11 Test Support A Signal Descriptions Glossary Index CONTENTS Contents Preface ADo tthis DOCU ai a xi 1 Introduction 1 1 About the ARMZ20T processor anne 1 1 1 2 OPO CSS SONS rada too eti 1 5 1 3 Aboutthe instruction sek ern oe ob cha ta ciet cta sette de edere 1 5 1 4 Silicon revisions zes seele 1 18 2 Programmer s Model 2 1 Processor operating states 2 1 2 2 Memory TOUMGIS dao 2 2 243 Jjnetticuob length s ensure 2 3 24 Dia captaron and atu E uice e a Bu 2 3 2 5 Operating MODOS carito l ads 2 4 2D A 2 4 2 7 PLOMO e ee the 2 8 28 TEXCONION Sin id tel lo lll al 2 10 2 9 Relocation of low virtual addresses by the FCSE PID 2 15 2 10 ISO ER E Lesers 2 16 2 11 Implementation defined behavior of 2 17 3 Configuration S T ZAbOUECODTIQUEIAUOTI e ep oat tede 3 1 3 2 Internal coprocessor instructions oooooococccccnnnnnccccccnonnnnnonancncnnnnnnnncncnnnnnnnnnns 3 2 3 9 O 3 3 4
60. value and control mask registers are mapped identically in thelower eight bits as shown in Figure 9 13 8 7 6 5 4 3 2 1 0 ENABLE RANGE CHAIN DBGEXT PROT 1 PROT 0 SIZE 1 SIZE 0 WRITE Figure 9 13 Watchpoint control value and mask format Bit 8 of the control valueregister is the ENABLE bit and cannot be masked The bits havethe following functions WRITE Compares against the write signal from the core in order to detect the direction of bus activity WRITE is O for a read cyde and 1 for a write cyde SIZE 1 0 Compares against the HSIZE 1 0 signal from the core in order to detect the size of bus activity The encoding is shown in Table 9 8 Table 9 8 SIZE 1 0 signal encoding bit 1 bit 0 Data size 0 0 Byte 0 1 Halfword 1 0 Word 1 1 Reserved PROT O Is used to detect whether the current cycle is an instruction fetch PROT O 0 or a data access PROT O 1 PROT 1 Is used to compare against the not translate signal from the corein order to distinguish between user mode PROT 1 0 and non U ser mode PROT 1 1 accesses ARM720T CORE CPU MANUAL EPSON 9 35 9 Debugging Your System DBGEXT 1 0 Is an external input to Embeddedl CE RT logic that enables the watchpoint to be dependent on some external condition The DBGEXT input for Watchpoint 0 is labeled DBGE XT O The DBGEXT input for Watchpoint 1 is labeled DBGEXT 1 CHAIN Can be conn
61. watchpoints ARM720T CORE CPU MANUAL EPSON 9 13 9 Debugging Your System 9 10 The debug communications channel TheARM 720T Embedded CE RT macrocell contains a Debug Communication Channel DCC for passing information between the target and the host debugger This is implemented as coprocessor 14 TheDCC comprises two registers as follows DCC Control Register A 32 bit register used for synchronized handshaking between the processor and the asynchronous debugger For more details see Domain Access Control Register DCC Data Register A 32 bit register used for data transfers between the debugger and the processor For more details see Communications through the DCC on page 9 16 These registers occupy fixed locations in the Embeddedl CE RT memory map as shown in Table 9 1 on page 9 12 They are accessed from the processor using MCR and MRC instructions to coprocessor 14 The registers are accessed as follows By the debugger Through scan chain 2 in the usual way By the processor Through coprocessor register transfer instructions 9 10 1 Domain Access Control Register The Domain Access Control Register is read only and enables synchronized handshaking between the processor and the debugger The register format is shown in Figure 9 6 31 28 27 210 SBO WIR L EmbeddedICE RT version number Figure 9 6 Domain Access Control Register 9 14 EPSON ARM720T CORE CPU MANUAL 9 Debugging Y
62. 0 Index SBZ Figure 11 10 Rd format write cache victim and lockdown base The write cache victim format for Rd is shown in Figure 11 11 31 26 25 7654 0 Index SBZ Seg SBZ Figure 11 11 Rd format write cache victim Ancther cachetest register C15 C is written with thecurrent victim of the addressed segment whenever an MCR CAM read is executed This is intended for usein debug to establish the value of the current victim pointer of each segment before reading the values of the CAM and RAM sothat the value can be restored afterwards 11 6 EPSON ARM720T CORE CPU MANUAL 11 Test Support Example 11 1 shows sample code for performing software test of the cache It contains typical operations with register C15 C Example 11 1 Cache test operations CAM write read and check for segment 2 Write cache victim pointer with index 0 segment 2 MOV r0 0 ORR r1 r0 2 SHL 0x5 MCR p15 0 r1 c9 c1 0 Write pattern in OxFFFFFFYE in all 64 CAM lines MVN r2 1 bit O should be 0 BIC r2 r2 0x20 write segment 2 MOV r8 64 loopO MCR 15 2 2 15 7 6 write CAM index auto incremented SUBS 18 r8 1 BNE loopO Now read and check Reset victim pointer to index 0 segment 2 MOV r0 0 ORR r1 r0 2 SHL 0x5 MCR p15 0 r1 c9 c1 0 MOV r8 64 MOV r3 0x40 read segment 2 BIC r2 r2 0x60 Clear bit 5 and 6 always read as 0 loop1 MCR p15 3 r0 c15 c3 0 write C15 C to
63. 0 Indicates the status of the transfer HREADY Used to extend thetransfer This signal worksin combination with HRESP 1 0 Theslave can complete the transfer in a number of ways It can complete the transfer immediately insert one or more wait states to enable time to complete the transfer signal an error to indicate that the transfer has failed delay the completion of the transfer but enable the master and slave to back off the bus leaving it available for other transfers 6 5 1 HREADY The HREADY signal is used to extend the data portion of an AHB transfer as follows HREADY LOW Indicates that the transfer data is to be extended It causes wait states to be inserted into the transfer and enables extra time for the slave to provide or sample data HREADY HIGH Indicates that the transfer can complete E very slave must have a predetermined maximum number of wait states that it inserts before it backs off the bus in order to enable the calculation of the latency of accessing the bus To prevent any single access locking the bus for a large number of clock cycles it is recommended that slaves do not insert more than 16 wait states ARM720T CORE CPU MANUAL EPSON 6 9 6 The Bus Interface 6 5 2 HRESP 1 0 HRESP 1 0 is used by the slave to show the status of a transfer The HRESP 1 0 encodings are shown in Table 6 5 Table 6 5 Response encodings HRESP 1 0 Response Description b00 OKAY When HREADY is
64. 1 13 11 Test Support THIS PAGE IS BLANK 11 14 EPSON ARM720T CORE CPU MANUAL Appendix A Signal Descriptions A Signal Descriptions A Signal Descriptions This chapter describes the interface signals of the ARM 720T processor It contains the following sections 1 AMBA interface de uisa roe Gerona eee eee 1 A 2 Coprocessor interface signals ecco cosa trn vt epe ee A 2 A 3 J TAG and best signals aa A 3 A 4 Debugger Signals han a A 4 A 5 Embedded trace macrocell interface A 5 A 6 ATPG testsigrnials c acm n ERE ora A 7 A 7 Miscellaneous ana ra RE A 7 A 1 AMBA interface signals The AMBA interface signals are shown in Table A 1 Table A 1 AMBA interface signals Signal name Type Description HCLK Input Bus clock This is the only clock on the ARM720T processor HADDRI 31 0 Output 32 bit system address bus HTRANS 1 0 Output Indicates type of current transfer HBURST 2 0 Output Indicates burst length of current transfer HWRITE Output Indicates direction of current transfer HSIZE 2 0 Output Indicates size of current transfer HPROT 3 0 Output Protection control signals HGRANT Input Bus transfer granted HREADY Input Indicates that the current transfer has finished HRESP 1 0 Input Indicates transfer status HWDATA 31 0 Output Write data bus HRDATA 31 0 Input Read data bus HBU
65. 1 2 RAM write from C15 C Seg Word MCR p15 2 Rd c15 c11 6 CAM match RAM read to C15 C Tag Seg Word MCR p15 2 Rd c15 c7 5 Write to register C15 C Data MCR p15 3 Rd c15 c3 0 Read from register C15 C Data read MRC p15 3 Rd c15 c3 0 The CAM read format for Rd is shown in Figure 11 2 31 7654 0 SBZ Seg SBZ Figure 11 2 Rd format CAM read The CAM write format for Rd is shown in Figure 11 3 31 76543210 MVA TAG Seg V l SBZ Figure 11 3 Rd format CAM write In Figure 11 3 bit labels have the following meanings V Valid De Dirty even words 3 0 Not used Do Dirty odd words 7 4 Not used WB Writeback Not used 11 4 EPSON ARM720T CORE CPU MANUAL 11 Test Support The RAM read format for Rd is shown in Figure 11 4 31 7654 210 SBZ Seg Word SBZ Figure 11 4 Rd format RAM read The RAM write format for Rd is shown in Figure 11 5 31 7654 210 SBZ Seg Word SBZ Figure 11 5 Rd format RAM write The CAM match RAM read format for Rd is shown in Figure 11 6 31 7654 210 MVA TAG Seg Word SBZ Figure 11 6 Rd format CAM match RAM read The CAM read format for data is shown in Figure 11 7 31 76543210 MVA TAG 22 Do WB LFSR 6 Figure 11 7 Data format CAM read The RAM read format f
66. 1 6 summarizes register C2 C3 C5 c6 c8 c10 and c15 operations Table 11 6 Register c2 c3 c5 c6 c8 c10 and c15 operations Function Rd Instruction s Read Translation Table Base Register TTB MRC p15 0 Rd c2 c0 0 Write Translation Table Base Register TTB MCR p15 0 Rd c2 0 Read domain 15 0 access control DAC MRC p15 0 Ra c0 0 Write domain 15 0 access control DAC MCR p15 0 Ra c3 c0 0 Read FSR FSR MRC p15 0 Rd c5 0 Write FSR FSR MCR p15 0 Rd c5 0 Read FAR FAR MRC p15 0 Rd c0 0 Write FAR FAR MCR p15 0 Rd 0 Invalidate TLB SBZ MCR p15 0 Rd c8 c5 0 MCR p15 0 Rd c8 c6 0 MCR p15 0 Rd c8 c7 0 Invalidate TLB single entry using MVA MVA format MCR p15 0 Rd c5 1 MCR p15 0 Rd c8 c6 1 MCR p15 0 Rd c8 c7 1 Read TLB lockdown TLB lockdown MRC p15 0 Rd c10 c0 0 Write TLB lockdown TLB lockdown MCR p15 0 Rd c10 c0 0 CAM read to C15 M SBZ MCR p15 4 Rd c15 c7 4 CAM write Tag Size V P MCR p15 4 Rad c15 c7 0 RAM read to C15 M SBZ MCR p15 4 Rd c15 c11 4 ARM720T CORE CPU MANUAL EPSON 11 9 11 Test Support Table 11 6 Register c2 c3 c5 c6 c8 c10 and c15 operations continued Function Rd Instruction s RAM1 write Protection MCR
67. 16 2 bit fields each of which defines the access permissions for one of the 16 domains D15 DO The CRm and opcode 2 fields Should Be Zero when reading or writing to CP 15 Register 3 Domain Access Control Register format is shown in Figure 3 7 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 esos fonlon ee e e e e e e Te Te e o Figure 3 7 Domain Access Control Register format 3 3 5 Fault Status Register Reading CP 15 Register 5 returns the value of the Fault Status Register FSR The FSR contains the source of the last fault Note Only the bottom 9 bits are returned The upper 23 bits are Unpredictable TheFSR indicates the domain and type of access being attempted when an abort occurred Bit 8 This is always read as zero Bit 8 is ignored on writes Bits 7 4 These specify which of the 16 domains D15 DO was being accessed when a fault occurred Bits 3 1 These indicate the type of access being attempted The encoding of these bits is shown in Fau t address and fault status registers on page 7 16 The FAR is only updated on data faults There is no update on prefetch faults Writing to CP 15 Register 5 sets the FSR tothe value of the data written This is useful when a debugger has to restore the value of the FSR The upper 24 bits written Should Be Zero The CRm and opcode 2 fields Should Be Zero when reading or writing CP 15 Register 5 Fault Status Register forma
68. 2 fields Should Be Zero when reading CP 15 register 0 ID Register read format is shown in Figure 3 2 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 0100 00011000 00000111001000000100 Figure 3 2 ID Register read format Writing to CP 15 register 0 is Unpredictable ID Register write format is shown in Figure 3 3 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 UNP Figure 3 3 ID Register write format ARM720T CORE CPU MANUAL EPSON 3 3 3 Configuration 3 3 2 Control Register Reading from CP 15 Register 1 reads the control bits The CRm and opcode 2 fields Should Be Zero when reading CP15 Register 1 Control Register read format is shown in Figure 3 4 31 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 ae Figure 3 4 Control Register read format WritingtoCP15 Register 1 sets the control bits The CRm and opcode 2 fields Should Be Zero when writing to CP 15 Register 1 Control Register write format is shown in Figure 3 5 31 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 E A Free psp EA Figure 3 5 Control Register write format With the exception of the V bit all defined control bits are set to zero on reset The control bits havethe following functions M Bit O MMU enable disable 0 MMU disabled 1 MMU enabled A Bit 1 Alignment fault enable disable 0 Address Alignment Fault Check
69. 3 11 Test Register The CP15 Register 15 is used for device specific test operations For more information see Chapter 11 7est Support ARM720T CORE CPU MANUAL EPSON 3 9 3 Configuration THIS PAGE IS BLANK 3 10 EPSON ARM720T CORE CPU MANUAL 4 Instruction and Data Cache 4 Instruction and Data Cache 4 Instruction and Data Cache This chapter describes the instruction and data cache It contains the following sections 4 1 About the instruction and data Cache occoococconnnoconacancnnccnnconnnnnncnnnnnnos 4 1 4 2 IDCivali di ty een nenne 4 2 4 3 DC enable disable and retail 4 2 4 1 About the instruction and data cache The cache only operates on a write through basis with a read miss allocation policy and a random replacement algorithm 4 1 1 IDC operation The ARM 720T contains an 8KB mixed nstruction and Data Cache lDC Thecache comprises four segments of 64 lines each each linecontaining eight words Thel DC is always reloaded alineat atime ThelDC is enabled or disabled using the ARM 720T Control Register and is disabled on HRESETn Note The MMU must never be disabled when the cache is on However you can enable the two devices simultaneously with a single write to the Control Register see Control Register on page 3 4 4 1 2 Cachable bit TheC bit determines if data being read can be placed in the IDC and used for subsequent read operations Typically main memory is marked as
70. 7207 Revision 4 AMBA AHB Bus Interface Version CORE CPU Manual lt contains the following sections About this document sireni san a E nnn nnn nna nennen xi About this document This document is a technical reference manual for the ARM 720T r4p2 processor Intended audience This document has been written for experienced hardware and software engineers who might or might not have experience of the architecture configuration integration and instruction sets with reference to the ARM product range it provides information to enable designers to integrate the processor into a target system as quickly as possible Using this manual This document is organized into the following chapters Chapter 1 ntroduction Read this chapter for an introduction to the ARM 720T processor Chapter 2 Programmer 5 Model Read this chapter for a description of the 32 bit ARM and 16 bit Thumb instruction sets Chapter 3 Configuration Read this chapter for a description of the ARM 1156F S control coprocessor CP 15 register configurations and programming details Chapter 4 nstruction and Data Cache Read this chapter for a description of the mixed instruction and data cache Chapter 5 Write Buffer Read this chapter for a description on how to enhance the system performance of the ARM 720T processor by using the write buffer Chapter 6 The Bus Interface Read this chapter for a description of the ARM 720T processor bus interface Chapt
71. 7630 Fax 1 815 455 7633 Northeast 301 Edgewater Place Suite 120 Wakefield MA 01880 U S A Phone 1 781 246 3600 Fax 1 781 246 5443 Southeast 3010 Royal Blvd South Suite 170 Alpharetta GA 30005 U S A Phone 1 877 EEA 0020 Fax 1 770 777 2637 EUROPE EPSON EUROPE ELECTRONICS GmbH HEADQUARTERS Riesstrasse 15 80992 Munich GERMANY Phone 49 0 89 14005 0 Fax 49 0 89 14005 110 D SSELDORF BRANCH OFFICE Altstadtstrasse 176 51379 Leverkusen GERMANY Phone 49 0 2171 5045 0 Fax 49 0 2171 5045 10 UK amp IRELAND BRANCH OFFICE Unit 2 4 Doncastle House Doncastle Road Bracknell Berkshire RG12 8PE ENGLAND Phone 44 0 1344 381700 Fax 44 0 1344 381701 FRENCH BRANCH OFFICE 1 Avenue de Atlantique LP 915 Les Conquerants Z A de Courtaboeuf 2 F 91976 Les Ulis Cedex FRANCE Phone 33 0 1 64862350 Fax 33 0 1 64862355 BARCELONA BRANCH OFFICE Barcelona Design Center Edificio Testa Adva Alcalde Barrils num 64 68 E 08190 Sant Cugat del Valles SPAIN Phone 34 93 544 2490 Fax 34 93 544 2491 Scotland Design Center Integration House The Alba Campus Livingston West Lothian EH54 7EG SCOTLAND Phone 44 1506 605040 Fax 44 1506 605041 ASIA EPSON CHINA CO LTD 23F Beijing Silver Tower 2 North RD DongSanHuan ChaoYang District Beijing CHINA Phone 64106655 Fax 64107319 SHANGHAI BRANCH 7F High Tech Bldg 900 Yishan Road Shanghai 200233 CHINA P
72. 8 10 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 Debugging Your System 9 Debugging Your System This chapter describes how to debug a system based on an ARM 720T processor It contains the following sections 9 1 About debugging your system aaa en ext cw eu eret 9 2 9 2 Controlling 9 3 9 3 Entry into debug state 9 5 9 4 POUCHES ae Bi 9 9 9 5 ARM 720T core dock domains 9 9 9 6 The Embedded CE RT macrocell 9 10 9 7 Disabling E mbeddedI CE RT are 9 11 9 8 Embedded CE RT register Map 9 12 9 9 Monitor mode debugging unten 9 12 9 10 The debug communications channel nmseesrereennnnnnnnnennnnnnnnnn nenn 9 14 9 11 Scan chains and the TAG 9 17 9 12 The TAP controller cio 9 19 9 13 Public TAG TASER UCGEOIS uico RR a een 9 20 9 14 Test data Fed SS ino DO XXE SQ e en ie ae da FUORI 9 22 AS a uto bn cerrar hate utu e b edu en PEUT 9 25 9 16 Examining the core and the system in debug state 9 26 917 CEXIC from debug State so pou Dur OQ c ren 9 29 9 18 The program counter during debug eee 9 30 9 19 Priorities and exceptions eer eene ene n eai 9 32 9 20 Watchpoint unit registers RR Es 9 33 9 21 Programming bre
73. ARM state 9 26 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 16 1 Determining the core state When the processor has entered debug state from Thumb state the simplest course of action is for the debugger to force the core back into ARM state The debugger can then execute the same sequence of instructions to determine the processor state To force the processor into ARM state execute the following sequence of Thumb instructions on the core STR RO RO Save RO before use MOV Copy PC into RO STR RO RO Now save the PC in RO BX PC Jump into ARM state MOV R8 R8 NOP MOV R8 R8 NOP Note Becauseall Thumb instructions areonly 16 bits long you can repeat theinstruction when shifting scan chain 1 F or example the encoding for BX RO is 0x4700 so when 0x47004700 shifts into scan chain 1 the debugger does not have to keep track of the half of the bus on which the processor expects to read the data You can use the sequences of ARM instructions below to determine the state of the processor With the processor in the ARM state the first instruction to execute is typically STM RO r0 r15 This instruction causes the contents of the registers to appear on the data bus You can then sample and shift out these values Note The use of as the base register for the STM is only for illustration any register can be used After you have determined the values in the current bank of regi
74. Base table maintained in main memory This base address must Register be on a 16KB boundary Domain Access 3 31 0 Comprises 16 2 bit fields Each field defines the access Control control attributes for one of 16 domains D15 DO Register Fault Status 5 7 0 Indicates the cause of a Data or Prefetch Abort and the Register domain number of the aborted access when an abort occurs Bits 7 4 specify which of the 16 domains 015 00 was being accessed when a fault occurred Bits 3 0 indicate the type of access being attempted The value of all other bits is Unpredictable The encoding of these bits is shown in Table 7 9 on page 7 16 Fault Address 6 31 0 Holds the MVA associated with the access that caused the Register abort See Table 7 9 on page 7 16 for details of the address stored for each type of fault You can use banked register c14 to determine the VA associated with a Prefetch Abort TLB Operations 8 31 0 You can write to this register to make the MMU perform Register TLB maintenance operations These are invalidating all the entries in the TLB invalidating a specific entry All the CP15 MMU registers except register c8 contain state You can read them using MRC instructions and write to them using MCR instructions Registers c5 and c6 are also written by the MMU during all aborts Writing to register c8 causes the MMU to perform a TLB operation to manipulate TLB entries This register cannot be read CP 15 is d
75. CP 15 Register 8 controls the Translation L ookaside Buffer TLB The ARM 720T processor implements a unified instruction and data TLB TwoTLB operations are defined Thefunction to be performed is selected by the opcode 2 and CRm fields in the MCR instruction used to write CP 15 Register 8 The TLB operations and the instructions that you can use are shown in Table 3 3 Table 3 3 TLB operations Function opcode 2 value CRm value Data Instruction Invalidate TLB 6000 b1000 SBZ MCR p15 0 Rd c8 c5 0 MCR p15 0 Rd c8 c6 0 MCR p15 0 Rd c8 c7 0 Invalidate TLB b001 b1000 Modified Virtual MCR p15 0 Rd c8 c5 1 single entry Address MCR p15 0 Ra 1 MCR p15 0 Rd c8 1 ARM720T CORE CPU MANUAL EPSON 3 7 3 Configuration In the instructions shown in Table 3 3 c7 isthe preferred valuefor the CRn field because it indicates a unified MMU Reading from CP 15 Register 8 is undefined Thelnvalidate TLB single entry function invalidates any TLB entry corresponding to the Modified Virtual Address MVA given in Rd 3 3 9 Process Identifier Registers You can access two independent process identifier registers using Register 13 Fast Context Switch Extension Process Identifier Register Trace Process Identifier Register on page 3 8 Fast Context Switch Extension Process Identifier Register Reading from CP 15 Register 13 with opcode 2 0 retu
76. Dnegtiolis sso aene o e nne En 8 9 Table 8 4 CPnTRANS signal meanings sur 8 10 Table 9 1 Function and mapping of EmbeddedICE RT registers 9 12 Table 9 2 Domain Access Control Register bit assignments 9 15 Table 9 3 Instruction encodings for scan chain 15 9 18 Table 9 4 Public instuctl lis eee de i odiis 9 20 Table 9 5 Scan chain number allocation essen 9 23 Table 9 6 ea E EUR 9 25 vi EPSON ARM720T CORE CPU MANUAL Table 9 7 Table 9 8 Table 9 9 Table 9 10 Table 9 11 Table 10 1 Table 11 1 Table 11 2 Table 11 3 Table 11 4 Table 11 5 Table 11 6 Table 11 7 Table 11 8 Table 11 9 Table 11 10 Table A 1 Table A 2 Table A 3 Table A 4 Table A 5 Table A 6 Table A 7 CONTENTS Determining the cause of entry to debug state 9 32 SIZE 1 0 signal encoding cap rice tasto o mo Prato te Pato a aen 9 35 Debug control register bit 9 39 Interrupt signal Control ae sans 9 40 Debug status register bit assignments 9 41 Connections between the ETM7 macrocell and the ARM720T 10 2 Summary of ATPG test Sion Sii baca 11 2 Test State Register
77. EPSON ca Cc oS a B ARM72OT Revision 4 AMBA AHB Bus Interface Version CORE CPU MANUAL OCL eE DENE SEIKO EPSON CORPORATION NOTICE No part of this material may be reproduced or duplicated in any form or by any means without the written permis sion of Seiko Epson Seiko Epson reserves the right to make changes to this material without notice Seiko Epson does not assume any liability of any kind arising out of any inaccuracies contained in this material or due to its application or use in any product or circuit and further there is no representation that this material is appli cable to products requiring high level reliability such as medical products Moreover no license to any intellec tual property rights is granted by implication or otherwise and there is no representation or warranty that anything made in accordance with this material will be free from any patent or copyright infringement of a third party This material or portions thereof may contain technology or the subject relating to strategic products under the control of the Foreign Exchange and Foreign Trade Law of Japan and may require an export license from the Ministry of International Trade and Industry or other approval from another government agency P is the registered trademark of ARM Limited CompactFlash is a registered trademark of Sandisk Corporation Names mentioned herein are trademarks and or registered
78. Il changes to the core state are made 3 Load data is written into the destination registers 4 Base write back is performed Note Watchpoints are similar to Data Aborts The difference is that when a Data Abort occurs although the instruction completes the ARM 720T core prevents all subsequent changes to the ARM 720T processor state This action enables the abort handler to cure the cause of the abort so the instruction can be re executed If a watchpoint occurs when an exception is pending the core enters debug state in the same mode as the exception 9 6 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 3 3 Entry into debug state on debug request An ARM 720T core in halt mode can be forced into debug state on debug request in either of the following ways through Embedded CE RT programming see Programming breakpoints on page 9 36 and Programming watchpoints on page 9 38 by asserting the DBGRQ pin DBGRQ must be deasserted on the same clock that DBGACK is asserted When the DBGRQ pin has been asserted the core normally enters debug state at the end of the current instruction However when the current instruction is a busy waiting access to a coprocessor the instruction terminates and the ARM 720T core enters debug state immediately This is similar to the action of ni RQ and nFIQ 9 3 4 Action of the ARM720T processor in debug state When the ARM 720T processor enters debug state the core forces HTRAN
79. Input Test mode select JTAG test mode select signal a Thesesignals are only active when scan chain O is selected A 4 Debugger signals The debugger signal descriptions are shown in Table A 4 Table A 4 Debugger signal descriptions Name Type Description DBGBREAK Input Breakpoint This signal enables external hardware to halt execution of the processor for debug purposes When HIGH this causes the current memory access to be breakpointed If memory access is an instruction Fetch the core enters debug state if the instruction reaches the Execute stage of the core pipeline If the memory access is for data the core enters the debug state after the current instruction completes execution This enables extension of the internal breakpoints provided by the EmbeddedICE RT module In most systems this input is tied LOW COMMRX Output Communication receive full When HIGH this signal denotes that the comms channel receive buffer contains data for the core to read COMMTX Output Communication transmit empty When HIGH this signal denotes that the comms channel transmit buffer is empty DBGACK Output Debug acknowledge When HIGH this signal denotes that the ARM is in debug state DBGEN Input Debug enable A static configuration signal that disables the debug features of the processor when held LOW This signal must be HIGH to allow the EmbeddedICE Logic to function DBGRQ Input Debug request
80. Instruction and Data Cache 4 1 About the instruction and data Cache 4 1 4 2 MV tc CTETUR 4 2 4 3 IDC enable disable and 4 2 5 Write Buffer 5 1 About the Write DUHEN E P PO ee 5 1 5 2 Write buffer operation uio retient tp epe 5 2 6 The Bus Interface 6 1 About the bus Interfabe nase iu 6 1 6 2 B s interface Sidhale ioci ette ernennt 6 3 O entre ond d Gata 6 5 6 4 Address and control signals oooninnnccccnnnninnnncccccnnnnnnnanncannnnnnnnnnnnccnnnnnnnnns 6 7 6 5 Slave transfer response signals 6 9 6 6 Datalbuses messer 6 10 O reinigen 6 12 6 87 BUS CLOCKING Eee et 6 13 ARM720T CORE CPU MANUAL EPSON i CONTENTS 6 9 A EEERIT HEERES TREUE 6 13 7 Memory Management Unit 7 1 About the MMU atta a 7 1 7 2 MMU program accessible registers oooonnnninncccncnnnnnnccccccccnncnnnanancnnnnnnns 7 3 7o Address WANS AMON untere 7 4 7 4 MMU faults and CPU abots oooocccnonnnccononaconacaninananinana naco 7 15 7 5 Fault address and fault status 7 16 7 6 Domain access control xiii cats arta p a rts PE rec bo ele 7 17 7 7 Fault checking sequence ets oes eis 7 19 9 E EAIA E1010 anidan aa A A E A 7 21 7 9 Interaction of th
81. KB blocks Figure 7 7 shows the format of a fine page table descriptor 31 12 11 98 543210 Fine page table base address Figure 7 7 Fine page table descriptor Note If a fine page table descriptor is returned from the level one fetch a level two fetch is initiated Fine page table descriptor bit assignments are described in Table 7 6 Table 7 6 Fine page table descriptor bits Bits Description 31 12 These bits form the base for referencing the level two descriptor the fine page table index for the entry is derived from the MVA 11 9 Always written as 0 8 5 These bits specify one of the 16 possible domains held in the Domain Access Control Registers that contain the primary access controls 4 Always written as 1 3 2 Always written as 0 1 0 These bits must be b11 to indicate a fine page table descriptor ARM720T CORE CPU MANUAL EPSON 7 9 7 Memory Management Unit 7 3 7 Translating section references Figure 7 8 shows the complete section translation sequence Modified virtual address 31 20 19 0 Translation table base 31 14 13 0 Translation base 31 y 1413 210 Translation base Table index ioo ll Section level one descriptor 31 20 19 12 1110 9 8 5432710 1 Physical address 31 20 19 0 Figure 7 8 Section translation Note Y ou must check access permissions contained in the level one descriptor before generating the physical address 7 3 8 Level tw
82. NUAL Operation 1 Introduction Table 1 12 Thumb instruction summary continued Assembler Load With register offset word LDR Ra lt Rb gt lt Ro gt halfword LDRH Ra lt Rb gt lt Ro gt signed halfword LDRSH lt Rd gt lt Rb gt lt Ro gt byte LDRB Ra lt Rb gt lt Ro gt signed byte LDRSB lt Rd gt lt Rb gt lt Ro gt PC relative LDR Ra PC lt 10bit_offset gt SP relative LDR lt Rd gt SP lt 10bit_offset gt Address using PC ADD lt Rd gt PC lt 10bit_offset gt using SP ADD lt Rd gt SP lt 10bit_offset gt Multiple Rb lt reglist gt Store With immediate offset word STR lt Rd gt lt Rb gt lt 7bit_offset gt halfword STRH Ra lt Rb gt lt 6bit_offset gt byte STRB lt Rd gt lt Rb gt lt 5bit_offset gt With register offset word STR Rd lt Rb gt lt Ro gt halfword STRH Ra lt Rb gt lt Ro gt byte STRB lt Rd gt lt Rb gt lt Ro gt SP relative STR lt Rd gt SP lt 10bit_offset gt Multiple STMIA lt Rb gt lt reglist gt Push Pop Push registers onto stack PUSH lt reglist gt Push LR and registers PUSH reglist LR onto stack Pop registers from stack POP lt reglist gt Pop registers and PC POP reglist PC from stack Software SWI 8bit Imm Interrupt Note All th
83. OW reset signal for the internal state This signal is a level sensitive asynchronous reset input A 7 Miscellaneous signals Miscellaneous signals used by the ARM 720T processor are shown in Table A 7 Name Type BIGENDOUT Output Table A 7 Miscellaneous signal descriptions Description Big endian format When this signal is HIGH the processor treats bytes in memory as being in big endian format When it is LOW memory is treated as little endian nFIQ Input ARM fast interrupt request signal nIRQ Input ARM interrupt request signal VINITHI Input Determines the state of the V bit in CP15 register c1 at reset When HIGH the V bit is set coming out of rest When LOW the V bit is clear coming out of reset ARM720T CORE CPU MANUAL EPSON A 7 A Signal Descriptions THIS PAGE IS BLANK A 8 EPSON ARM720T CORE CPU MANUAL Glossary Glossary Glossary This glossary describes some of theterms used in this manual Whereterms can have several meanings the meaning presented here is intended Abort Is caused by an illegal memory access Abort can be caused by the external memory system an external MMU or the Embeddedl CE RT logic Addressing modes A procedure shared by many different instructions for generating values used by theinstructions For four of the ARM addressing modes the values generated are memory addresses which is the traditional role of an addressing mo
84. RANT The grant signal is generated by the arbiter and indicates that the appropriate master is currently the highest priority master requesting the bus taking into account locked transfers and SPLIT transfers A master gains ownership of the address bus when HGRANT is HIGH and HREADY is HIGH at therising edge of HCLK 6 12 EPSON ARM720T CORE CPU MANUAL 6 The Bus Interface 6 8 Bus clocking There are two dock inputs on the ARM 720T processor bus interface 6 8 1 HCLK The bus is clocked by the system dock HCLK This dock times all bus transfers All signal timings are related tothe rising edge of HCLK 6 8 2 HCLKEN HCLK is enabled by the HCLKEN signal You can use HCLKEN toslow the bus transfer rate by dividing HCLK for the bus interface Note HCLKEN is not a dock enable for the CPU itself but only for the bus Use HREADY to insert wait states on the bus 6 9 Reset Thebusreset signal is HRESETn This signal is the global reset used toreset the system and the bus It can be asserted asynchronously but is deasserted synchronously after the rising edge of HCLK Complete system reset is achieved when DBGnTRST is asserted in the same way as HRESETn During reset all masters must ensure the following the address and control signals are at valid levels HTRANS 1 0 indicates IDLE HRESETn is the only active LOW signal in the AMBA AHB specification ARM720T CORE CPU MANUAL EPSON 6 13 6 The Bus Inte
85. S 1 0 to indicate internal cycles This action enables therest of the memory system toignorethe ARM 720T core and tofunction as normal Becausethe rest of the system continues to operate the ARM 720T core is forced to ignore aborts and interrupts Caution Do not reset the core while debugging otherwise the debugger loses track of the core Note The system must not change the ETMBIGEND signal during debug From the point of view of the programmer if ETMBIGEND changes the ARM 720T processor changes with the debugger unaware that the core has reset Y ou must also ensure that HRESETn is held stable during debug When the system applies reset to the ARM 720T processor that is HRESETn is driven LOW the ARM 720T processor state changes with the debugger unaware that the core has reset ARM720T CORE CPU MANUAL EPSON 9 7 9 Debugging Your System 9 3 5 Clocks The system and test clocks must be synchronized externally to the processor The ARM Multi I CE debug agent directly supports one or more cores within an ASIC design Synchronizing off chip debug clocking with the ARM 720T processor requires a three stage synchronizer The off chip device for example Multi I CE issues a TCK signal and waits for the RTCK Returned TCK signal to come back Synchronization is maintained because the off chip device does not progress to the next TCK until after RTCK is received Figure 9 4 shows this synchronization nTRST E DBGnTRST Reset
86. SREQ Output Bus transfer request HLOCK Output Indicates locked access HCLKEN Input Bus clock enable HRESETn Input Global reset ARM720T CORE CPU MANUAL EPSON A 1 A Signal Descriptions A 2 Coprocessor interface signals The coprocessor interface signals are shown in Table A 2 Name EXTCPA Table 2 Coprocessor interface signal descriptions Type Input Description External coprocessor absent This signal must be HIGH if no external coprocessor is present EXTCPB Input External coprocessor busy EXTCPCLKEN Output External coprocessor clock enable EXTCPDIN 31 0 Output External coprocessor data in EXTCPDOUTI31 0 Input External coprocessor data out CPnCPI Output Not coprocessor instruction When LOW this signal indicates that the ARM720T processor is executing a coprocessor instruction CPnOPC Output Not opcode fetch When LOW this signal indicates that the processor is fetching an instruction from memory When HIGH data if present is being transferred This signal is used by the coprocessor to track the ARM pipeline CPTBIT Output Thumb state This signal when HIGH indicates that the processor is executing the THUMB instruction set When LOW the processor is executing the ARM instruction set CPnTRANS Output Not coprocessor translate When HIGH the coprocessor interface is in a nonprivileged mode When LOW the coproc
87. T processor can be externally aborted by the AMBA bus This can be used to flag an error on an external memory access H owever not all accesses can be aborted in this way and the Bus nterface Unit BIU ignores external aborts that cannot be handled The following accesses can be aborted noncached reads unbuffered writes read lock write sequence to noncachable memory In the case of a read lock write SWP sequence if the read aborts the write is never attempted T 9 Interaction of the MMU and cache The MMU is enabled and disabled using bit O of the CP 15 Control Register cl as described in Enabling the MMU Disabling the MMU 7 9 1 Enabling the MMU To enable the MMU 1 Program the TTB and Domain Access Control Registers 2 Program level 1 and level 2 pagetables as required 3 Enable the MMU by setting bit O in the control register IH You must take care if the translated address differs from the untranslated address because several instructions following the enabling of the MMU might have been prefetched with the MMU off using physical VA flat translation In this case enabling the MMU can be considered as a branch with delayed execution A similar situation occurs when the MMU is disabled Consider the following code sequence MRC p15 0 r1 c1 c0 0 Read control register ORR R1 R1 40x01 MCR p15 0 r1 c1 c0 0 Enable MMUS Fetch Flat Fetch Flat Fetch Translated 7 9 2 Disabling the MMU
88. U ser mode instruction fetches program the PROT 1 value and mask bits appropriately 7 If required program the DBGEXT RANGE and CHAIN bits in the same way 8 Set the mask bits for all unused control values Note In monitor mode you must set the E mbeddedl CE RT disable bit bit 5 in the Debug Control Register before changing the register values and clear it on completion of the programming oa Ui 9 21 2 Software breakpoints To make a watchpoint unit cause software breakpoints on instruction fetches of a particular bit pattern 1 Program the address mask register of the watchpoint unit to OXFFFFFFFF all bits set so that the address is disregarded 2 Program the data value register with the particular bit pattern that has been chosen to represent a software breakpoint If you are programming a Thumb software breakpoint repeat the 16 bit pattern in both halves of the data value register For example if the bit pattern is OXDFFF program OxDFFFDFFF When a 16 bit instruction is fetched mbeddedl CE RT compares only the valid half of the data bus against the contents of the data value register n this way you can use a single watchpoint register to catch software breakpoints on both the upper and lower halves of the data bus Program the data mask register to 0x00000000 Program the control value register with PROT O O Program the control mask register with PROT O 0 and all other bits set B OU Buy If you want to
89. You must tie the external coprocessor data bus enable EXTCPDBE LOW 8 7 STC operations If you are using an external coprocessor you can perform STC operations in cachable regions with the cache enabled H owever the STC operation is treated as a series of nonsequential transfers on the AMBA bus 8 8 Undefined instructions The ARM 720T processor implements full ARM architecture v4T undefined instruction handling This means that any instruction defined in the ARM Architecture Reference Manual as UNDEFINED automatically causes the ARM 720T processor to take the undefined instruction trap Any coprocessor instructions that are not accepted by a coprocessor also result in the ARM 720T processor taking the undefined instruction trap 8 9 Privileged instructions The output signal CPnTRANS enables you to implement coprocessors or coprocessor instructions that can only be accessed from privileged modes Thesignal meanings are shown in Table 8 4 Table 8 4 CPnTRANS signal meanings LOW User mode instruction HIGH Privileged mode instruction The CPnTRANS signal is sampled at the sametime as theinstruction and is factored intothe coprocessor pipeline Decode stage Note If a User mode process CPNTRANS LOW tries to access a coprocessor instruction that can only be executed in a privileged mode the coprocessor must respond with EXTCPA and EXTCPB HIGH This causes the ARM 720T processor to take the undefined instruction trap
90. ach of these signal groups shares a common timing relationship to the bus interface cycle All signals in the ARM 720T processor bus interface are generated from or sampled by the rising edge of HCLK ARM720T CORE CPU MANUAL EPSON 6 3 6 The Bus Interface TheAHB bus master interface signals are shown in Figure 6 2 Arbiter grant HGRANT HBUSREQ gt Arbiter HLOCK Transfer HREADY HTRANS 1 0 Transfer type response HRESP 1 0 HADDR 31 0 Reset HRESETn AHB master HWRITE HSIZE 2 0 Address and control HCLK HBURST 2 0 Clock HCLKEN HPROT 3 0 gt Data HRDATA 31 0 HWDATA 31 0 gt Data Figure 6 2 AHB bus master interface 6 4 EPSON ARM720T CORE CPU MANUAL 6 The Bus Interface 6 3 Transfer types The ARM 720T processor bus interface is pipelined so the address class signals and the memory request signals are broadcast in the bus cycle ahead of the bus cydeto which they refer This gives the maximum time for a memory cycle to decode the address and respond to the access request A single memory cyde is shown in Figure 3 1 HCLK Address class signals Address TRANS 1 0 Cycle typ WDATA 31 0 SY Write data Y write RDATA 31 0 y read Read data Bus cycle Figure 6 3 Simple memory cycle Therearethreetypes of transfer The transfer type is indicated by the HTRANST 1 0 signal
91. addition to these the Current Program Status Register CPSR is used to store status information It contains condition code flags and the current mode bits 2 4 EPSON ARM720T CORE CPU MANUAL 2 Programmer s Model Interrupt modes FIQ mode has seven banked registers mapped to r8 14 r8 fiq r14 fig In ARM state many FIQ handlers can usethese banked registers to avoid having to save any registers onto a stack User IRQ Supervisor Abort and Undefined modes each have two banked registers mapped tor13 and r14 enabling each of these modes to have a private stack pointer and link registers ARM state general registers and program counter System and User FIQ Supervisor Abort IRQ Undefined ro ro ro ro ro ro r1 r1 r1 r1 r1 r1 r2 r2 r2 r2 r2 r2 r3 r3 r3 r3 r3 r3 r4 r4 r4 r4 r4 r4 r5 r5 r5 r5 r5 r5 r6 r6 r6 r6 r6 r6 r7 r7 r7 r7 r7 r7 r8 r8_fiq r8 r8 r8 r8 r9 r9_fiq r9 r9 r9 r9 r10 r10 fiq r10 r10 r10 r10 r11 r11 fiq r11 r11 r11 r11 r12 r12 fiq r12 r12 r12 r12 r13 r13 fiq r13_svc r13_abt r13 irq 13 und r14 r14_fiq NIA sve NIA abt r14 irq DN 14 und r15 PC r15 PC r15 PC r15 PC r15 PC r15 PC ARM state program status registers CPSR CPSR CPSR CPSR CPSR CPSR SPSR fiq SPSR svc SPSR abt SPSR irq SPSR und N banked register Figure 2 3 Register organization in ARM state
92. akpoint chained together The watchpoint address points to a known memory location containing the current process ID the watchpoint data points to the required process ID and the ENABLE bit is deared The address comparator output of the watchpoint is used to drive the write enable for the CHAINOUT latch Theinput tothe latch is the output of the data comparator from the same watchpoint The output of thelatch drives the CHAIN input of the breakpoint comparator The address Y Y Y is stored in the breakpoint register and when the CHAIN input is asserted the breakpoint address matches and the breakpoint triggers correctly ARM720T CORE CPU MANUAL EPSON 9 43 9 Debugging Your System 9 26 2 DBGRNG signal The DBGRNG signal is derived as follows DBGRNG Av 81 0 Cv 4 0 XNOR A 31 0 C 4 0 OR Am 31 0 Cm 4 0 OxFFFFFFFFF AND Dv 31 0 Cv 7 5 XNOR D 31 0 C 7 5 OR Dm 31 0 Cm 7 5 Ox7FFFFFFFF The DBGRNG output of watchpoint register 1 provides the RANGE input to watchpoint register 0 This RANGE input enables you to couple two breakpoints together to form range breakpoints Note Selectable ranges are restricted to being powers of 2 For example if a breakpoint is to occur when the address is in the first 256 bytes of memory but not in the first 32 bytes program the watchpoint registers as follows For Watchpoint 1 1 Program Watchpoint 1 with an address value of 0x00000000 and an addre
93. akpoints zn est e a REPE e P PR EUR 9 36 9 22 Programming Wath PONES 9 38 9 23 Abort status register uou ceo ah an D ERR ERR OUR add ated 9 38 924 Debug control rea rita 9 39 9 25 Debug st tus f egister nn 9 41 9 26 Coupling breakpoints and watchpoints 9 43 9 27 Embedded CE RT ass ae 9 44 ARM720T CORE CPU MANUAL EPSON 9 1 9 Debugging Your System 9 1 About debugging your system The advanced debugging features of the ARM 720T processor make it easier to develop application software operating systems and the hardware itself 9 1 1 A typical debug system The ARM 720T processor forms one component of a debug system that interfaces from the high level debugging that you perform to the low level interface supported by the ARM 720T processor Figure 9 1 shows a typical debug system Debug host host compiler running ARM or third party toolkit Protocol converter for example Multi ICE 4 Debug target development system containing ARM720T processor Figure 9 1 Typical debug system A debug system usually has three parts Debug host A computer that is running a software debugger such as the ARM Debugger for Windows ADW The debug host enables you to issue high level commands such as setting breakpoints or examining the contents of memory Protocol converter T
94. alled the memory system must ignorethe bottom bit HADDRIO 6 4 2 HWRITE HWRITE specdifies the direction of the transfer as follows I HWRITE HIGH Indicates an ARM 720T processor write cycle HWRITE LOW Indicates an ARM 720T processor read cycle A burst of S cydes is always either a read burst or a write burst The direction cannot be changed in the middle of a burst 6 4 3 HSIZE 2 0 The SI ZE 2 0 bus encodes the size of the transfer The ARM 720T processor can transfer word halfword and byte quantities This is encoded on SIZE 2 0 as shown Table 6 2 Note TousetheC compiler and the ARM debugtool chain your system must support the writing of arbitrary bytes and halfwords You must provide write enables down to the level of every individual byte to ensure support for all possible transfer sizes up tothe bus width Table 6 2 Transfer size encodings HSIZE 2 0 Size Transfer width b000 8 bits Byte b001 16 bits Halfword b010 32 bits Word ARM720T CORE CPU MANUAL EPSON 6 7 6 The Bus Interface 6 4 4 HBURST 2 0 HBURST 2 0 indicates the type of burst generated by the ARM 720T core as shown in Table 6 3 Table 6 3 Burst type encodings HBURST 2 0 Type Description b000 SINGLE Single transfer b001 INCR Incrementing burst of unspecified length b101 INCR8 8 beat incrementing burst For more details of burst operation see the AMBA Specification Rev 2 0 6 4
95. ally exist and the returned data is therefore invalid In such a case the normal action of the operating system is to swap in the page of memory and to return tothe previously invalid address This time when the instruction is fetched and providing the breakpoint is activated it can be data dependent the ARM 720T processor enters debug state The Prefetch Abort therefore takes higher priority than the breakpoint 9 32 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 19 2 Interrupts When the ARM 720T processor enters debug state interrupts are automatically disabled If an interrupt is pending during the instruction prior to entering debug state the ARM 720T processor enters debug state in the mode of the interrupt On entry to debug state the debugger cannot assume that the ARM 720T processor is in the mode expected by the program of the user The ARM 720T core must check the PC the CPSR and the SPSR to determine accurately the reason for the exception Debug therefore takes higher priority than the interrupt but the ARM 720T processor does remember that an interrupt has occurred 9 19 3 Data Aborts When a Data Abort occurs on a watchpointed access the ARM 720T processor enters debug state in abort mode The watchpoint therefore has higher priority than the abort but the ARM 720T processor remembers that the abort happened 9 20 Watchpoint unit registers There are two watchpoint units known as watc
96. ansfers If thetransfer is extended the bus master must hold the data valid until the transfer completes as indicated by HREADY HIGH All transfers must be aligned to the address boundary equal to the size of the transfer For example word transfers must be aligned to word address boundaries that is A 1 0 2500 and halfword transfers must be aligned to halfword address boundaries that is A 0 20 The bus master drives all byte lanes regardless of the size of the transfer For halfword transfers for example 0x1234 HWDATA 31 0 is driven with the value 0x12341234 regardless of endianness For byte transfers for example 0x12 HWDATA 31 0 is driven with the value 0x12121212 regardless of endianness 6 10 EPSON ARM720T CORE CPU MANUAL 6 The Bus Interface 6 6 2 HRDATA 31 0 Theread data bus is driven by theappropriate slave during read transfers If theslave extends the read transfer by holding HREADY LOW the slave has to provide valid data only at the end of the final cycle of the transfer as indicated by HREADY HIGH For transfers that are narrower than the width of the bus the slave only has to provide valid data on the active byte lanes The bus master is responsible for selecting the data from the correct byte lanes The following tables identify active byte lanes Table 6 6 on page 6 11 shows active byte lanes for little endian systems Table 6 7 on page 6 12 shows active byte lanes for big endian systems
97. are three TAG style scan chains within the ARM 720T processor These enable debugging E mbeddedl CE RT programming A J TAG style 7est Access Port TAP controller controls the scan chains For more details of the TAG specification see IEEE Standard 1149 1 1990 Standard Test Access Port and Boundary Scan Architecture 9 11 1 Scan chain implementation Thethree scan paths on the ARM 720T processor are referred to as scan chain 1 scan chain 2 and scan chain 15 They are shown in Figure 9 7 Debug scan chain 0 is not implemented in the ARM 720T processor but all the control signals are provided at the macrocell boundary This enables you to design your own boundary scan chain wrapper if required ARM72OT ARM720T processor EmbeddedICE RT System control processor Scan chain 15 ARM72OT TAP controller also provides scan chain 0 control signals B Figure 9 7 ARM720T processor scan chain arrangements Scan chain 1 Scan chain 2 Scan chain 1 Scan chain 1 provides serial access to the core data bus HRDATA HWDATA and the DBGBREAK signal There are 33 bits in this scan chain the order being from serial data in to out data bus bits O through 31 the DBGBREAK bit the first to be shifted out Scan chain 2 Scan chain 2 enables access to the E mbeddedl CE RT registers See Test data registers on page 9 22 for de
98. as shown in Table 6 1 Table 6 1 Transfer type encoding HTRANS 1 0 Transfer type Description b00 IDLE Indicates that no data transfer is required The IDLE transfer type is used when a bus master is granted the bus but does not wish to perform a data transfer Slaves must always provide a zero wait state OKAY response to IDLE transfers and the transfer must be ignored by the slave b10 NONSEQ Indicates the first transfer of a burst or a single transfer The address and control signals are unrelated to the previous transfer Single transfers on the bus are treated as bursts that comprise one transfer b11 SEQ In a burst all transfers apart from the first are SEQUENTIAL The address is related to the previous transfer The address is equal to the address of the previous transfer plus the size in bytes In the case of a wrapping burst the address of the transfer wraps at the address boundary equal to the size in bytes multiplied by the number of beats in the transfer either 4 8 or 16 The control information is identical to the previous transfer Note In the AMBA Specification Rev 2 0 HTRANS 1 0 601 indicates a BUSY cycle but these are never inserted by the ARM 720T processor ARM720T CORE CPU MANUAL EPSON 6 5 6 The Bus Interface Figure 6 4 shows some examples of different transfer types HCLK HTRANS 1 0 HADDR 31 0 HBURST 2 0 HWDATA 31 0 HREADY HRDATA 31 0 In
99. ased on the following instruction or data addresses external watchpoint conditioner DBGEXT 0 or DBGEXT 1 User or privileged mode access CPnTRANS read write access for watchpoints HWRITE access size watchpoints SI ZE 1 0 External breakpoints or watchpoints are not supported No support is provided to mix halt mode and monitor mode functionality The fact that an abort has been generated by the monitor mode is recorded in the abort status register in coprocessor 14 see Abort status register on page 9 38 The monitor mode enable bit does not put the ARM 720T processor into debug state For this reason it is necessary to change the contents of the watchpoint registers while external memory accesses are taking place rather than changing them when in debug state wherethe core is halted If thereis a possibility of false matches occurring during changes to the watchpoint registers caused by old data in some registers and new data in others you must 1 Disable the watchpoint unit by setting bit 5 in the Debug Control Register also known as the Embeddedl CE RT disable bit 2 Poll the Debug Control Register until the E mbeddedl CE RT disable bit is read back as set 3 Change the other registers 4 Re enable the watchpoint unit by clearing the Embeddedl CE RT disable bit in the Debug Control Register See Debug control register on page 9 39 for more information about controlling core behavior at breakpoints and
100. ata held in the coprocessor register bank No information is transferred between the ARM 720T core and the coprocessor as a result of this operation An example sequence is shown in Figure 8 3 HCLK Fetch stage ADD SUB CPDO TST SWwINE Y Decode stage ADD SUB SE TST SWINE Y y Execute stage ADD UB KcPDO Y TST YSWINEY CPnCPI from core EXTCPA from coprocessor EXTCPB from coprocessor HRDATA 31 0 JU Fetch I Fetch I Fetch J I Fetch J I Fetch I Fetch ADD SUB CPDO TST SWINE Figure 8 3 Coprocessor data operation sequence ARM720T CORE CPU MANUAL EPSON 8 7 8 Coprocessor Interface 8 4 7 Coprocessor load and store operations The coprocessor load and store instructions LDC and STC are used totransfer data between a coprocessor and memory They can be used to transfer either a single word of data or a number of the coprocessor registers Thereis limit to the number of words of data that can be transferred by a single LDC or STC instruction but by convention a coprocessor must not transfer more than 16 words of data in a single instruction An example sequence is shown in Figure 8 4 Note Theexternal coprocessor must not abort on LDC and STC instructions u
101. ate A condition that allows the monitoring and control of the execution of a processor Usually used to find errors in the application program flow A processor enters debug state from ha t modeand not from monitor mode Debugger A debugging system which includes a program used to detect locate and correct software faults together with custom hardware that supports software debugging EmbeddedICE The Embeddedl CE logic is controlled via the TAG test access port using a protocol converter such as Multil CE an extra piece of hardware that allows software tools to debug code running on a target processor SeealsolCE and TAG EmbeddedICE RT A version of Embeddedl CE logic that has improved support for real time debugging Exception modes Privileged modes that are entered when specific exceptions occur Exception Handles an event For example an exception could handle an external interrupt or an undefined instruction External abort An abort that is generated by the external memory system FIQ Fast interrupt Glossary 2 EPSON ARM720T CORE CPU MANUAL Glossary Halt mode One of two debugging modes When debugging is performed in halt mode the core stops when it encounters a watchpoint or breakpoint and is isolated from the rest of the system See also Monitor mode ICE Seeln circuit emulator Idempotent A mathematical quantity that when applied to itself under a given binary operation equals itself In circuit emul
102. ate from a breakpoint bit 33 LOW or from a watchpoint bit 33 HIGH Scan chain 2 Purpose Scan chain 2 provides access tothe E mbeddedl CE RT registers To do this scan chain 2 must be selected using the SCAN N TAP controller instruction and then the TAP controller must be put in INTEST mode Length 38 bits Scan chain order From DBGTDI to DBGTDO the read write bit the register address bits bits 4 to O then the data bits bits O to 31 No action occurs during CAPTURE DR 9 24 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System During SHIFT DR a data value is shifted into the serial register Bits 32 to 36 specify the address of the Embeddedl CE RT register to be accessed During UPDATE DR this register is either read or written depending on the value of bit 37 0 read 1 write See Figure 9 12 on page 9 34 for more details 9 15 Scan timing Figure 9 10 provides general scan timing information HCLK DBGTCKEN lt istcken C wo tintexen DBGTMS Y Y DBGTDI Fi pm j tinet DBGTDO Y E NS t ohtdo ovtdo Figure 9 10 Scan timing 9 15 1 Scan chain 1 cells The ARM 720T processor provides data for scan chain 1 cells as shown in Table 9 6 Table 9 6 Scan chain 1 cells Number Signal Type 1 DATA Input output 2 DATA 1 Input output 3 DATA 2 Input output 4 DATA 3 Input output 5 DATA 4 Input
103. ator An n Circuit Emulator ICE is a devicethat aids the debugging of hardware and software Debuggable ARM processors such as the ARM 720T processor have extra hardware to assist this process See also E mbeddedl CE RT IRQ Interrupt request Joint Test Action Group The name of the organization that developed standard IEEE 1149 1 This standard defines a boundary scan architecture used for in circuit testing of integrated circuit devices JTAG See oint Test Action Group Link register This register holds the address of the next instruction after a branch with link instruction Little endian memory Memory organization where the most significant byte of a word is at a higher address than the least significant byte LR SeeLink register Macrocell A complex logic block with a defined interface and behavior A typical VLSI system will comprise several macrocells such as an ARM 7TDMI S core an ETM7 and a memory block plus application specific logic Memory Management Unit Allows control of a memory system Most of the control is provided through translation tables held in memory MMU See Memory Management Unit ARM720T CORE CPU MANUAL EPSON Glossary 3 Glossary Monitor mode One of two debugging modes When debugging is performed in monitor mode the core does not stop when it encounters a watchpoint or breakpoint but enters an abort exception routine See also Ha t mode PC SeeProgram Counter Privil
104. bit first During the UPDATE DR state the value in theregister selects a scan chain to becomethe currently activescan chain All additional instructions such as INTEST then apply to that scan chain The currently selected scan chain changes only when a SCAN N instruction is executed or when a reset occurs On reset scan chain O is selected as the active scan chain Table 9 5 shows the scan chain number allocation Table 9 5 Scan chain number allocation Scan chain number Function 0 User implemented 1 Debug 2 EmbeddedIC E RT programming 3 Reserveda 4 Reserveda 8 Reserveda a When selected reserved scan chains scan out zeros ARM720T CORE CPU MANUAL EPSON 9 23 9 Debugging Your System 9 14 5 Scan chains 1 and 2 The scan chains enable serial access to the core logic and to the E mbeddedl CE RT hardware for programming purposes E ach scan chain cell is simple and comprises a serial register and a multiplexor The scan cells perform three basic functions capture shift update For input cells the capture stage involves copying the value of the system input to the core intotheserial register During shift this value is output serially The value applied to the core from an input cell is either the system input or the contents of the parallel register loads from the shift register after UPDATE DR state under multiplexor control For output cells capture involves
105. cachable to improve system performance and 1 0 space is marked as noncachable to stop the data being stored in the ARM 720T cache For example if the processor is polling a hardware flag in 1 0 space it is important that the processor is forced to read data from the external peripheral and not a copy of the initial data held in the cache The cachable bit can be configured for both pages and sections Cachable reads C 1 A linefetch of eight words is performed when a cache miss occurs in a cachable area of memory and it is randomly placed in a cache bank Note M emory aborts are not supported on cache line fetches and are ignored Uncachable reads Cz0 An external memory access is performed and the cache is not written ARM720T CORE CPU MANUAL EPSON 4 1 4 Instruction and Data Cache 4 1 3 Read lock write ThelDC treats the read lock write instruction as a special case Read phase Always forces a read of external memory regardless of whether the data is contained in the cache Write phase Is treated as a normal write operation If the data is already in the cache the cache is updated Externally the two phases are flagged as indivisible by asserting the HLOCK signal 4 2 IDC validity ThelDC operates with virtual addresses so you must ensure that its contents remain consistent with the virtual to physical mappings performed by the MMU If the memory mappings are changed the IDC validity must be ensured 4 2 1 So
106. ce Macrocell ETM tothe ARM 720T processor so that you can perform real time tracing of the code that the processor is executing In general little or no glue logic is required to connect the ETM 7 to the ARM 720T processor You program the ETM through aJ TAG interface The interface is an extension of the ARM TAP controller and is assigned scan chain 6 Note If you havemorethan one ARM processor in your system each processor must have its own dedicated ETM See the 7M 7 Rev 1 Technical Reference Manual for detailed information about integrating an 7 with an ARM 720T processor 10 2 Enabling and disabling the ETM7 interface Under the control of the ARM debugtools the ETM 7 PWRDOWN output is used to enable and disable the ETM When PWRDOWN is HIGH this indicates that the ETM is not currently enabled so you can stop the CLK input and hold the other ETM signals stable This enables you to reduce power consumption when you are not performing tracing When a TAP reset nTRST occurs PWRDOWN is forced HIGH until the ETM7 control register has been programmed see the Embedded Trace Macrocell Specification for details of this register PWRDOWN is automatically cleared at the start of a debug session On the ARM 720T processor the ETM interface pins are gated by the ETMEN input This means that if the ETMEN input is LOW all the output pins of the ETM interface remain stable You can control this ETMEN input by connecting it w
107. cessor also abandons the instruction and continues tracking the ARM 720T processor pipeline Caution lt is essential that any action taken by the coprocessor while it is busy waiting is idempotent The actions taken by the coprocessor must not corrupt the state of the coprocessor and must be repeatable with identical results The coprocessor can only change its own state after the instruction has been executed 8 6 EPSON ARM720T CORE CPU MANUAL 8 Coprocessor Interface 8 4 5 Coprocessor register transfer instructions The coprocessor register transfer instructions MCR and MRC transfer data between a register in the ARM 720T processor register bank and a register in the coprocessor register bank An example sequence for a coprocessor register transfer is shown in Figure 8 2 HCLK Fetch stage ADD SUB MCR Y TST SWINE y y Decode stage Y ADD SUB X TST SWINE Y i Execute stage y ADD UB IK MCR TST SWINE CPnCPI from core EXTCPA from coprocessor EXTCPB from coprocessor HRDATA 31 0 JIFetch I Fetch I Fetch Y I Fetch Fetch Y recn ADD SUB MCR TST SWINE HWDATA 31 0 Y Tx y A C Figure 8 2 Coprocessor register transfer sequence 8 4 6 Coprocessor data operations The coprocessor data processing instructions CDP perform processing operations on the d
108. circuit TDO DBGTDO DBGTCKEN RTCK TCK synchronizer o E B z c E N z 14 lt DBGTDI HCLK gt Input sample and hold Multi_ICE interface pads HCLK gt Figure 9 4 Clock synchronization Note All the D types shown in Figure 9 4 are reset by DBGnTRST 9 8 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 4 Debug interface The ARM 720T processor debug interface is based on IEEE Std 1149 1 1990 Standard Test Access Port and Boundary Scan Architecture Refer tothis standard for an explanation ofthe terms used in this chapter and for a description of the TAP controller states 9 4 1 Debug interface signals There are three primary external signals associated with the debug interface DBGBREAK and DBGRQ are system requests for the ARM 720T core to enter debug state Note Both DBGRQ and DBGBREAK must be LOW when the core has entered debug state If they are not these signals affect the use of the DBGBREAK flag on scan chain 1 which controls the way the core goes into and out of debug Theresult is that the core performs an unexpected series of debug and system speed accesses and the debugger loses control of the core DBGACK is used by the ARM 720T coretoflag back tothesystem that it is in debug state 9 5 ARM72OT core cloc
109. code is Ox7f1fOfOf Operating mode When the IDCODE instruction is current the ID register is selected as the serial path between DBGTDI and DBGTDO There is no parallel output from the D register The 32 bit device identification code is loaded into the ID register from its parallel inputs during the CAPTURE DR state 9 22 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 14 3 Instruction register Purpose Changes the current TAP instruction Length 4 bits Operating mode In the SHIFT IR state the instruction register is selected as the serial path between DBGTDI and DBGTDO During the CAPTURE IR state the binary value 0001 is loaded intothis register This valueis shifted out during SHIFT IR least significant bit first while a new instruction is shifted in least significant bit first Duringthe UPDATE IR state the value in the instruction register becomes the current instruction On reset IDCODE becomes the current instruction Thereis no parity bit 9 14 4 Scan path select register Purpose Changes the current active scan chain Length 4 bits Operating mode SCAN N asthe current instruction in the SHIFT DR state selects the scan path select register as the serial path between DBGTDI and DBGTDO During the CAPTURE DR state the value b1000 binary is loaded intothis register This valueis loaded out during SHIFT DR least significant bit first while a new value is loaded in least significant
110. de A fifth addressing mode generates values to be used as operands by data processing instructions Arithmetic Logic Unit ALU ARM state Big endian Banked registers Breakpoint CISC The part of a computer that performs all arithmetic computations such as addition and multiplication and all comparison operations SeeArithmetic Logic Unit A processor that is executing ARM 32 bit instructions is operating in ARM state M emory organization where the least significant byte of a word is at a higher address than the most significant byte Register numbers whose physical register is defined by the current processor mode The banked registers registers r8 to 14 or r13tor14 depending on the processor mode A location in the program If execution reaches this location the debugger halts execution of the code image See alsoWatchpoint See Complex Instruction Set Computer a ARM720T CORE CPU MANUAL EPSON Glossary 1 Glossary Complex Instruction Set Computer A microprocessor that recognizes a large number of instructions See alsoReduced Instruction Set Computer CPSR SeeProgram Status Register Control bits The bottom eight bits of a program status register The control bits change when an exception arises and can be altered by software only when the processor is in a privileged mode Current Program Status Register SeeProgram Status Register DCC Debug Communications Channel Debug st
111. de5 gt Software SWI 24bit Imm Interrupt Addressing mode 2 a mode2 is shown in Table 1 3 Table 1 3 Addressing mode 2 Operation Assembler Immediate offset lt Rn gt lt 12bit_Offset gt Register offset lt Rn gt lt Rm gt Scaled register offset lt Rn gt lt Rm gt LSL lt 5bit_shift_imm gt lt Rn gt lt Rm gt LSR lt 5bit_shift_imm gt lt Rn gt lt Rm gt ASR lt 5bit_shift_imm gt lt Rn gt lt Rm gt ROR lt 5bit_shift_imm gt lt Rn gt lt Rm gt RRX Pre indexed immediate offset lt Rn gt lt 12bit_Offset gt Pre indexed register offset lt Rn gt lt Rm gt Pre indexed scaled register offset lt Rn gt lt Rm gt LSL lt 5bit_shift_imms lt Rn gt lt Rm gt LSR lt 5bit_shift_imm gt lt Rn gt lt Rm gt ASR lt 5bit_shift_imm gt lt Rn gt lt Rm gt ROR 5bit shift imm lt Rn gt lt Rm gt RRX Post indexed immediate offset lt Rn gt lt 12bit_Offset gt Post indexed register offset lt Rn gt lt Rm gt Post indexed scaled register offset lt Rn gt lt Rm gt LSL lt 5bit_shift_imm gt lt Rn gt lt Rm gt LSR lt 5bit_shift_imm gt lt Rn gt lt Rm gt ASR lt 5bit_shift_imm gt lt Rn gt lt Rm gt ROR lt 5bit_shift_imm gt lt Rn gt lt Rm
112. dex N in either the CAM or RAM 1 The write TLB lockdown operation is MCR p15 0 lt Rd gt c10 c0 0 The write TLB lockdown format for Rd is shown in Figure 11 16 31 26 25 20 19 10 Base Victim SBZ P Figure 11 16 Rd format write TLB lockdown 11 12 EPSON ARM720T CORE CPU MANUAL 11 Test Support Example 11 2 shows sample code for performing software test of the MMU It contains typical operations with C15 M Example 11 2 MMU test operations MMU write read and check for CAM RAM1 and RAM2 Load victim pointer with O MOV r0 0 MCR p15 0 r0 c10 c0 0 Write pattern 0X5A5A5A50 in CAM Write pattern 0x0025A5A5 in RAM1 Write pattern OXFOFOFOCO in RAM2 LDR r2 20x5A5A5A50 LDR r3 20x0025A5A5 LDR r4 0xFOFOFOCO MOV r5 64 Write all 64 lines loopO MCR p15 4 r2 c15 c7 0 write CAM MCR p15 4 r3 c15 c11 0 write RAM1 MCR p15 4 r4 c15 c3 1 write RAM2 pointer auto incremented here SUBS r5 r5 1 BNE loopO Now read and check Reset victim pointer MOV r0 0 MCR p15 0 r0 c10 c0 0 MOV r8 64 loop1 MCR p15 4 r5 c15 c7 4 read CAM to C15 M MRC p15 4 r5 c15 c3 6 read C15 M to R5 MCR p15 4 r6 c15 c11 4 MRC p15 4 r6 c15 c3 6 read RAM1 to R6 BIC r5 r5 0x01c00000 mask fault miss bits MCR p15 4 r7 c15 c3 5 MRC p15 4 r7 c15 c3 6 read RAM2 to R7 CMP r5 r2 CMPEQ r6 r3 CMPEQ r7 r4 BNE TEST_FAIL SUBS r8 r8 1 BNE loop1 B TEST PASS ARM720T CORE CPU MANUAL EPSON 1
113. e Only those explicitly described can be used Note If you program any illegal value into the mode bits M 4 0 then the processor enters an unrecoverable state If this occurs apply reset 2 8 EPSON ARM720T CORE CPU MANUAL 2 7 3 Reserved bits 2 Programmer s Model Theremaining bits in the PSRs arereserved When changing flag or control bits of a PSR you must ensurethat these unused bits are not altered Also your program must not rely on them containing specific values because in future processors they might read as one or zero Table 2 2 PSR mode bit values M 4 0 Mode Visible Thumb state registers Visible ARM state registers b10000 User r7 to r14 to rO LR SP PC CPSR PC CPSR b10001 FIQ r7 to rO r7 to rO LR fiq SP fiq r14 fiq r8 fiq PC CPSR SPSR_fiq PC CPSR SPSR fiq b10010 IRQ r7 to rO r12 to r0 LR SP irq r14_irg r13 PC CPSR SPSR irq PC CPSR SPSR irq b10011 Supervisor r7 to r0 r12 to r0 LR svc SP svc r14 svc r13 svc PC CPSR SPSR svc PC CPSR SPSR svc b10111 Abort r7 to rO r12 to rO LR abt SP abt r14 abt r13 abt PC CPSR SPSR abt PC CPSR SPSR abt b11011 Undefined r7 to rO r12 to rO LR und SP und r14_und r13 und PC CPSR SPSR und PC CPSR SPSR und b11111 System r7 to rO r14 to rO LR SP PC CPSR PC CPSR ARM720T CORE CPU MANUAL EPSON 2 9 2 Programmer s Model 2 8 Exceptio
114. e dings unseren 6 7 Table 6 3 Burst type 6 8 6 4 Protection control encodings nn een 6 8 Table 6 5 Response 6 10 Table 6 6 Active byte lanes for a 32 bit little endian data bus 6 11 Table 6 7 Active byte lanes for a 32 bit big endian data bus 6 12 Table 7 1 CPT5 register TH CHOLS an area 7 3 Table 7 2 Level one descriptor bits oo er e ee 7 7 Table 7 3 Interpreting level one descriptor bits 1 0 7 7 Table 7 4 Section descriptor DIIS oue A 7 8 Table 7 5 Coarse page table descriptor bits 7 9 Table 7 6 Fine page table descriptor bitS occcccccccnnncncnnnnononononnnnnnnnnnnnnnnnnos 7 9 Table 7 7 Level two desenpl r DIIS yace 7 11 Table 7 8 Interpreting page table entry bits 1 0 7 11 Table 7 9 Priority encoding of fault status sacan 7 16 Table 7 10 Interpreting access control bits in Domain Access Control Register 7 17 Table 7 11 Interpreting access permission AP 7 18 Table 8 1 Coprocessor availability 8 2 Table 8 2 Handshaking Signals ee ee 8 5 Table 8 3 Handshake signal GO
115. e MMU and 7 21 8 Coprocessor Interface 8 1 ADOULCOPrOCESSONS 8 1 8 2 Coprocessor interface signals 8 3 8 3 Pipelide followinaj slgtale oa e en ara 8 4 8 4 Coprocessor interface handshaking ooooocccccnnnnnccccccnnccnncncocnccncnnnananannnnnnnns 8 5 8 5 Connecting COPrOCESSONS ion eco Dod tea arbe Rs 8 9 8 6 Notusing an external 8 10 MEME Eee ce DT 8 10 8 8 Undefined instructions coooonncccccnnnnnicococcccconnnnnnncnnnnnnnnnnnnnnnnnnnnnnncnnnnnn 8 10 8 9 Privileged instructions 44444400nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn 8 10 9 Debugging Your System 9 1 About debugging your system oocccccccncccccccccccnnnnonccnnnnncnnnannncnnncnnnnnnnccnnnnnn 9 2 92 Controlling debutar rr ir ex ene ine o ae Eno vers 9 3 9 3 Entry into deb g Stato seen 9 5 94 debug interface cione oh me ida 9 9 95 ARMZ2OT core clock dotrallts a 9 9 9 6 EmbeddedICE RT 9 10 9 7 Disabling 9 11 9 8 EmbeddedlCE RT register map 9 12 9 9 Monitor mode debugging
116. e data transfer between memory and the registers one optimized for flexibility of addressing one for rapid context switching one for swapping data Two instructions control the flow and privilege level of execution Threetypes are dedicated to the control of external coprocessors These enable you to extend the functionality of the instruction set off chip in an open and uniform Way TheARM instruction set is a good target for compilers of many different high level languages Where required for critical code segments assembly code programming is also straightforward ARM720T CORE CPU MANUAL EPSON 1 5 1 Introduction 1 3 1 Format summary This section provides a summary of the ARM and Thumb instruction sets ARM instruction set on page 1 7 Thumb instruction set on page 1 14 A key tothe instruction set tables is shown in Table 1 1 The ARM 7TDMI S core on the ARM 720T processor is an implementation of the ARM architecture v4T For a complete description of both instruction sets see the ARM Architecture Reference Manual Table 1 1 Key to tables Entry Description cond Refer to Table 1 11 on page 1 13 lt Oprnd2 gt Refer to Table 1 9 on page 1 12 field Refer to Table 1 10 on page 1 12 S Sets condition codes optional B Byte operation optional H Halfword operation optional T Forces address translation Cannot be used with pre indexed addresses lt a_mode2 gt Refer t
117. e level one descri ptor Note The domain specified in the level one description and access permissions specified in thelevel onedescription together determine whether the access has permissions to proceed See section Domain access control on page 7 17 for details 7 3 12 Subpages You can define access permissions for subpages of small and large pages If during a page walk a small or large page has a non identical subpage permission only the subpage being accessed is written into the TLB For example a 16KB large page subpage entry is written into the TLB if the subpage permission differs and a 64KB entry is put in the TLB if the subpage permissions are identical When you use subpage permissi ons and the page entry then has to be invalidated you must invalidate all four subpages separately 7 14 EPSON ARM720T CORE CPU MANUAL 7 Memory Management Unit 7 4 MMU faults and CPU aborts The MMU generates an abort on the following types of faults alignment faults data accesses only translation faults domain faults permission faults In addition an external abort can be raised by the external system This can happen only for access types that have the core synchronized to the external system noncachable loads nonbufferable writes Alignment fault checking is enabled by theA bit in CP15 register c1 Alignment fault checking is not affected by whether or not the MMU is enabled Translation domain and perm
118. ected to the chain output of another watchpoint in order to implement for example debugger requests of the form breakpoint on address YYY only when in process XXX In the ARM 720T processor Embedded CE RT macrocell the CHAINOUT output of Watchpoint 1 is connected to the CHAIN input of Watchpoint O The CHAINOUT output is derived from a register The address control field comparator drives the write enable for the register The input tothe register is the value of the data field comparator The CHAINOUT register is cleared when the control value register is written or when DBGnTRST is LOW RANGE In the ARM 720T processor E mbeddedl CE RT logic the DBGRNG output of Watchpoint 1 is connected to the RANGE input of Watchpoint 0 Connection enables the two watchpoints to be coupled for detecting conditions that occur simultaneously for example in range checking ENABLE When a watchpoint match occurs theinternal DBGBREAK signal is asserted only when the ENABLE bit is set This bit exists only in the value register It cannot be masked For each of the bits 7 0 in the control valueregister thereis a corresponding bit in the control mask register This removes the dependency on particular signals 9 21 Programming breakpoints Breakpoints are classified as hardware breakpoints or software breakpoints 9 21 1 Hardware breakpornts typically monitor the address value and can be set in any code even in codethat is in ROM or
119. ed The use of RANGE enables simple range checking to be performed by combining the outputs of both watchpoints 9 26 1 Breakpoint and watchpoint coupling example Let Av 31 0 Be the value in the address value register Am 31 0 Be the value the address mask register A 31 0 Bethe address bus from the ARM 720T processor Dv 31 0 Be the value in the data value register Dm 31 0 Be the valuein the data mask register D 31 0 Be the data bus from the ARM 720T processor Cv 8 0 Be the value the control value register Cm 7 0 Bethe value in the control mask register C 9 0 Bethe combined control bus from the ARM 720T core other watchpoint registers and the DBGEXT signal CHAINOUT signal The CHAINOUT signal is derived as follows WHEN Av 31 0 Cv 4 0 XNOR A 31 0 C 4 0 OR Am 31 0 Cm 4 0 OXFFFFFFFFF CHAINOUT Dv 31 0 Cv 6 4 XNOR D 31 0 C 7 5 OR Dm 31 0 Cm 7 5 Ox7FFFFFFFF The CHAINOUT output of watchpoint register 1 provides the CHAIN input to Watchpoint O This CHAIN input enables you to use quite complicated configurations of breakpoints and watchpoints Note Thereis no CHAIN input to Watchpoint 1 and no CHAIN output from Watchpoint 0 For example consider the request by a debugger to breakpoint on the instruction at location YYY when running process XXX in a multiprocess system If the current process ID is stored in memory you can implement the above function with a watchpoint and bre
120. eged mode Any processor mode other than User mode Memory systems typically check memory accesses from privileged modes against supervisor access permissions rather than the more restrictive user access permissions The use of some instructions is also restricted to privileged modes Processor Status Register SeeProgram Status Register Program Counter Register 15 the Program Counter is used in most instructions as a pointer to the instruction that is two instructions after the current instruction Program Status Register Contains some information about the current program and some information about the current processor Also referred to as Processor Status Register Also referred to as Current PSR CPSR to emphasize the distinction between it and the Saved PSR SPSR The SPSR holds the value the PSR had when the current function was called and which will be restored when control is returned PSR SeeProgram Status Register RAZ Read as zero Reduced Instruction Set Computer A type of microprocessor that recognizes a lower number of instructions in comparison with a Complex Instruction Set Computer The advantages of RISC architectures are they can execute their instructions very fast because the instructions are so simple they require fewer transistors this makes them cheaper to produce and more power efficient See also Complex Instruction Set Computer RISC See Reduced Instruction Set Computer Glos
121. er in which they are handled 1 OU amp UN 2 8 11 Reset highest priority Data Abort FIQ IRQ Prefetch Abort Undefined Instruction SWI lowest priority Exception restrictions Undefined Instruction and SWI are mutually exclusive because they each correspond to particular non overlapping decodings of the current instruction If a Data Abort occurs at the same time as an and FIQs are enabled the CPSR F flag is dear the ARM 720T processor enters the Data Abort handler and then immediately proceeds tothe FIQ vector A normal return from FIQ causes the Data Abort handler to resume execution Placing Data Abort at a higher priority than FIQ is necessary to ensure that the transfer error does not escape detection The time for this exception entry must be added to worst case FIQ latency calculations 2 14 EPSON ARM720T CORE CPU MANUAL 2 Programmer s Model 2 9 Relocation of low virtual addresses by the FCSE PID The ARM 720T processor provides a mechanism Fast Context Switch Extension F CSE to translate virtual addresses to physical addresses based on the current value of the FCSE Process Dentifier PID The virtual address produced by the processor core going to the IDC and MMU can be relocated if it lies in the bottom 32MB of the virtual address That is virtual address bits 31 25 250000000 by the substitution of the seven bits 31 25 of the FCSE PID register in the CP 15 coproces
122. er lt Rm gt Logical shift left Rm LSL Rs Logical shift right Rm LSR Rs Arithmetic shift right Rm ASR Rs Rotate right Rm ROR Rs Rotate right extended Rm RRX Fields field are shown in Table 1 10 Table 1 10 Fields Suffix Sets _ Control field mask bit bit 3 _f Flags field mask bit bit 0 _ Status field mask bit bit 1 x Extension field mask bit bit 2 1 12 EPSON ARM720T CORE CPU MANUAL 1 Introduction Condition fields cond are shown in Table 1 11 Table 1 11 Condition fields Suffix Description Condition s EQ Equal Z set NE Not equal Z clear CS Unsigned higher or same C set CC Unsigned lower C clear MI Negative N set PL Positive or zero N clear VS Overflow V set VC No overflow V clear HI Unsigned higher C set Z clear LS Unsigned lower orsame Cclear Z set GE Greater or equal N V N and V set or N and V clear LT Less than N lt gt V N set and V clear or N clear and V set GT Greater than Z clear N V N and V setor N and V clear LE Less than or equal Z set or N lt gt V N set and V clear or N clear and V set AL Always Always ARM720T CORE CPU MANUAL EPSON 1 13 1 Introduction 1 3 3 Thumb instruction set This section gives an overview ofthe Thumb instructions available For full details of these instructions seethe ARM Architecture Reference
123. er 7 Memory Management Unit Read this chapter for a description of the functions and how to use of the Memory Management Unit MMU ARM720T CORE CPU MANUAL EPSON xi Preface Chapter 8 Coprocessor Interface Read this chapter for a description on how to connect coprocessors to the ARM 1156F S coprocessor interface Chapter 9 Debugging Your System Read this chapter for a description of the hardware extensions and integrated on chip debug support for the ARM 720T processor Chapter 10 7M nterface Read this chapter for a description of the Embedded Trace Macrocell support for the ARM 720T processor Chapter 11 Test Support Readthis chapter for a description of how to perform device specific test operations Chapter Signal Descriptions Read this appendix for a list of all ARM 720T processor interface signals Typographical conventions The following typographical conventions are used in this document bold Highlights ARM processor signal names and interface elements such as menu names Also used for terms in descriptivelists where appropriate Italic Highlights special terminology cross references and citations monospace Denotes text that can be entered at the keyboard such as commands file names and program names and source code monospace Denotes a permitted abbreviation for a command or option The underlined text can be entered instead of the full command or option name monospace italic Denotes argument
124. es of the PC and CPSR intothem The value of the saved PC and SPSR is not defined Forces M 4 0 to b10011 Supervisor mode setsthel and F bitsin the CPSR and clears the CPSR T bit Forces the PC to fetch the next instruction from the reset exception vector Exception vectors are located at either high or low addresses depending on the state of the V bit in CP15 register 1 LOW low addresses HIGH high addresses Resumes execution in ARM state 2 16 EPSON ARM720T CORE CPU MANUAL 2 11 2 Programmer s Model Implementation defined behavior of instructions The ARM Architecture Reference Manual defines the instruction set of the ARM 720T processor 2 11 1 See ndexed addressing on a Data Abortfor the behavior of instructions that are identified as implementation defined in the ARM Architecture Reference Manual See Early termination for those features that define signed and unsigned early termination on the ARM 720T processor Indexed addressing on a Data Abort In the event of a Data Abort with pre indexed or post indexed addressing the value left in Rn is defined to be the updated base register value for the following instructions 2 11 2 LDC LDM LDR LDRB LDRBT LDRH LDRSB LDRSH LDRT SEG STM STR STRB STRBT STRH STRT Early termination On the ARM 720T early termination is defined as MLA MUL Signed early termination SMULL SMLAL Signed early termination UMULL UMLAL Unsigned earl
125. escribed in Chapter Configuration with details of register formats and the coprocessor instructions you can use to access them ARM720T CORE CPU MANUAL EPSON 7 3 7 Memory Management Unit 7 3 Address translation The MMU translates VAs generated by the CPU core and by CP 15 register c13 into physical addresses to access external memory It also derives and checks the access permission using the TLB TheMMU table walking hardware is used to add entries tothe TLB Thetranslation information that comprises both the address translation data and the access permission data resides a translation table located in physical memory The MMU provides the logic for you totraverse this translation table and load entries intothe TLB There are oneor two stages in the hardwaretable walking and permission checking process The number of stages depends on whether the address is marked as a section mapped access or a page mapped access There are three sizes of page mapped accesses and one size of section mapped access The page mapped accesses are for large pages small pages e tiny pages The translation process always starts out in the same way with a level one fetch A section mapped access requires only a level one fetch but a page mapped access requires a subsequent level two fetch 7 3 1 Translation Table Base Register Thehardwaretranslation process is initiated when the TL B does not contain a translation for the req
126. essor interface is in a privileged mode The coprocessor samples this signal on every cycle when determining the coprocessor response CPnMREQ Output Not coprocessor memory request EXTCPDBE Input External coprocessor data bus enable This signal when HIGH indicates that the coprocessor intends to drive the coprocessor data bus CPDATA If the coprocessor interface is not to be used then this signal must be tied LOW A 2 EPSON ARM720T CORE CPU MANUAL A Signal Descriptions A 3 JTAG and test signals J TAG and test signal descriptions are shown in Table A 3 Table A 3 JTAG and test signal descriptions Name Type Description DBGIR 3 0 Output TAP instruction register These signals reflect the current instruction loaded into the TAP controller instruction register The signals change on the falling edge of HCLK when the TAP state machine is in the UPDATE DR state You can use these signals to enable more scan chains to be added using the ARM720T processor TAP controller DBGSREGI 3 0 Output Scan chain register These signals reflect the ID number of the scan chain currently selected by the TAP controller These signals change on the falling edge of XTCK when the TAP state machine is in the UPDATE DR state DBGSDIN Output Boundary scan serial data in This signal is the serial data to be applied to an external scan chain DBGSDOUT Input Boundary scan serial data out This signal
127. ftware IDC flush Theentirel DC can be marked as invalid by writingtothe Cache Operations Register c7 The cache is flushed immediately the register is written but the following two instruction fetches can come from the cache before the register is written 4 2 2 Doubly mapped space Becausethe cache works with virtual addresses it is assumed that every virtual address maps to a different physical address If the same physical location is accessed by more than one virtual address the cache cannot maintain consistency E ach virtual address has a separate entry in the cache and only one entry can be updated on a processor write operation To avoid any cache inconsistencies both doubl y mapped virtual addresses must be marked as uncachable 4 3 IDC enable disable and reset TheIDC is automatically disabled and flushed on HRESETn When enabled cachable read accesses cause lines to be placed in the cache To enablethe IDC 1 Make sure that the MMU is enabled first by setting bit O in the Control Register 2 EnablethelDC by setting bit 2 in the Control Register The MMU and IDC can be enabled simultaneously with a single write to the Control Register To disable the DC 1 Clear bit 2 in the Control Register 2 Perform a flush by writing to the cache operations register 4 2 EPSON ARM720T CORE CPU MANUAL 5 Write Buffer 5 Write Buffer 5 Write Buffer This chapter describes the write buffer It contains the following sect
128. ge 10 3 b See Debug request wiringon page 10 3 See Enabling and disabling the ETM7 interfaceon page 10 1 d Leave this pin unconnected e See 7AP interface wiring on page 10 3 10 4 Clocks and resets The ARM 720T processor uses a single dock HCLK as both the main system clock and the J TAG clock You must connect the processor clock to both HCLK and TCK on the ETM You can then use TCKEN to control the TAG interface Totracethrough a warm reset of the ARM 720T processor use the TAP reset connect nTRST to DBGnTRST to reset the ETM 7 state For more information about ETM 7 clocks and resets see the 7M7 Technical Reference Manual 10 5 Debugrequest wiring It is recommended that you connect together the DBGRQ output of the ETM7tothe DBGRQ input of the ARM 720T processor If this input is already in use you can OR theDBGRQ inputs together See the 7M7 Technical Reference Manual for more details The ARM 720T processor does not provide a scan chain expansion input ARM Limited recommends that you connect the ARM 720T processor and the ETM7 TAP controllers in parallel For more details see the 77 Rev 1 Technical Reference Manual 10 6 TAP interface wiring E ARM720T CORE CPU MANUAL EPSON 10 3 10 ETM Interface THIS PAGE IS BLANK 10 4 EPSON ARM720T CORE CPU MANUAL 11 Test Support 11 Test Support 11 Test Support This chapter describes the test methodology and the CP 15 test registe
129. ght away You could usethe following sequence E1A00000 MOV RO RO 1 E1A00000 MOV RO RO 0 EAFFFFFA B 6 This code restores the PC and restarts the program from the next instruction 9 18 5 System speed access When a system speed access is performed during debug state the valueof the PC increases by three addresses System speed instructions access the memory system and so it is possible for aborts to take place If an abort occurs during a system speed memory access the ARM 720T processor enters abort mode before returning to debug state This scenario is similar to an aborted watchpoint but the problem is much harder to fix because the abort was not caused by an instruction in the main program and sothe PC does not point tothe instruction that caused the abort An abort handler usually looks at the PC to determine the instruction that caused the abort and also the abort address In this case the value of the PC is invalid but because the debugger can determine which location was being accessed the debugger can be written to help the abort handler fix the memory system ARM720T CORE CPU MANUAL EPSON 9 31 9 Debugging Your System 9 18 6 Summary of return address calculations To determine whether entry to debug state was dueto a breakpoint watchpoint or debug request DBGRQ bit 33 DBGBREAK of scan chain 1 must be consulted together with bit 12 DBGM OE of the debug status register register 1 of scan chain 2
130. hain O is selected by default The scan path select register is 4 bits long in this implementation although no finite length is specified 9 13 2 INTEST b1100 TheINTEST instruction places the selected scan chain in test mode The INTEST instruction connects the selected scan chain between DBGTDI and DBGTDO When the INTEST instruction is loaded into the instruction register all the scan cells are placed in their test mode of operation In the CAPTURE DR state the value of the data applied from the core logic to the output scan cells and the value of the data applied from the system logic to the input scan cells is captured In the SHIFT DR state the previously captured test data is shifted out of the scan chain through the DBGTDO pin while new test data is shifted in through the DBGTDI pin Single step operation of the coreis possible using the INTEST instruction 9 20 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 13 3 IDCODE b1110 ThelDCODE instruction connects the device identification code register or ID register between DBGTDI and DBGTDO The ID register is a 32 bit register that enables the manufacturer part number and version of a component to be read through the TAP See ARM 720T processor device identification ID code register on page 9 22 for the details of the ID register format When the DCODE instruction is loaded into the instruction register all the scan cells are placed
131. he recommended instruction for exiting the exception handler Table 2 3 Exception entry and exit Exception Return instruction Previous state ARM r14 x Thumb r14 x BLa MOV PC r14 PC 4 PC 2 SWla MOVS PC r14_svc PC 4 PC 2 UDEF MOVS PC r14_und PC 4 2 FIQb SUBS PC r14 fiq 4 4 4 IRQb SUBS PC r14 irq 4 4 4 SUBS r14 abt 4 PC 4 PC 4 DABT SUBS PC r14 abt 8 8 8 RESET4 NA a PC isthe address of the BL SWI Undefined Instruction or Fetch that had the Prefetch Abort b PCistheaddress of theinstruction that was not executed because the FIQ or IRQ took priority C PC is the address of the Load or Store instruction that generated the Data Abort d Thevalue saved in r14 svcupon reset is Unpredictable ARM720T CORE CPU MANUAL EPSON 2 11 2 Programmer s Model 2 8 4 Fast interrupt request The FIQ exception is used for most performance critical interrupts in a system In ARM state the processor has sufficient private registers to remove the necessity for register saving minimizing the overhead of context switching FIQ is amp xternally generated by taking the nFIQ input LOW nFIQ and nIRQ are considered asynchronous and a cydedelay for synchronization is incurred beforetheinterrupt can affect the processor flow Irrespective of whether the exception was entered from ARM or Thumb state a FIQ handler mus
132. he status of the B bit in the Control Register of the system control coprocessor See Control Register on page 3 4 for more information 2 2 1 Big endian format In big endian format the most significant byte of a word is stored at the lowest numbered byte and the least significant byte at the highest numbered byte Byte O of the memory system is therefore connected to data lines 31 to 24 Big endian format is shown in Figure 2 1 Word 31 24 23 16 15 8 7 0 address Higher address 8 9 10 11 8 4 5 6 7 4 Lower address 0 o ES N Figure 2 1 Big endian addresses of bytes with words Note Most significant byte is at lowest address Word is addressed by byte address of most significant byte 2 2 EPSON ARM720T CORE CPU MANUAL 2 Programmer s Model 2 2 2 Little endian format In little endian format the lowest numbered byte a word is considered the least significant byte of the word and the highest numbered byte the most significant Byte O of the memory system is therefore connected to data lines 7 to 0 Little endian format is shown in Figure 2 2 31 24 23 16 15 87 QU NEM address d 11 10 9 8 8 7 6 5 4 4 Lower address 3 2 1 0 0 Figure 2 2 Little endian addresses of bytes with words Note L east significant byte is at lowest address Word is addressed by byte address of least significant byte 2 3 Instruction length Instructio
133. his interfaces between the high level commands issued by the debug host and the low level commands of the ARM 720T processor J TAG interface Typically it interfaces to the host through an interface such as an enhanced parallel port Debug target The ARM 720T processor has hardware extensions that ease debugging at the lowest level These extensions enable you to halt program executi on examine and modify the internal state of the core examine the state of the memory system execute abort exceptions enabling real time monitoring of the core resume program execution The debug host and the protocol converter are system dependent 9 2 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 2 Controlling debugging The major blocks of the ARM 720T processor are ARM CPU core This has hardware support for debug Embeddedl CE RT macrocell A set of registers and comparators that you use to generate debug excepti ons such as breakpoints This unit is described in The Embedded macroce page 9 10 Controls the action of the scan chains using a J TAG serial interface For more details see The 7AP controller on page 9 19 These blocks are shown in Figure 9 2 TAP controller ARM720T ARM720T processor EmbeddedICE RT System control processor Scan chain 2 Scan chain 1 Scan chain 15 ARM72OT TAP control
134. hone 86 21 5423 5577 Fax 86 21 5423 4677 EPSON HONG KONG LTD 20 F Harbour Centre 25 Harbour Road Wanchai Hong Kong Phone 852 2585 4600 Telex 65542 EPSCO HX Fax 852 2827 4346 EPSON TAIWAN TECHNOLOGY amp TRADING LTD 14F No 7 Song Ren Road Taipei 110 Phone 02 8786 6688 Fax 02 8786 6660 HSINCHU OFFICE No 99 Jiangong Rd Hsinchu City 300 Phone 886 3 573 9900 Fax 886 3 573 9169 EPSON SINGAPORE PTE LTD 401 Commonwealth Drive 07 01 Haw Par Technocentre SINGAPORE 149598 Phone 65 6586 3100 Fax 65 6472 4291 SEIKO EPSON CORPORATION KOREA OFFICE 50F KLI 63 Bldg 60 Yoido dong Youngdeungpo Ku Seoul 150 763 KOREA Phone 02 784 6027 Fax 02 767 3677 GUMI OFFICE 6F Good Morning Securities Bldg 56 Songjeong Dong Gumi City 730 090 KOREA Phone 054 454 6027 Fax 054 454 6093 SEIKO EPSON CORPORATION ELECTRONIC DEVICES MARKETING DIVISION ED International Marketing Department 421 8 Hino Hino shi Tokyo 191 8501 JAPAN Phone 81 0 42 587 5814 Fax 81 0 42 587 5117 ARM720T Revision 4 AMBA AHB Bus Interface Version CORE CPU MANUAL SEIKO EPSON CORPORATION E EPSON Electronic Devices Website Document code 405003400 Issue April 2004 Printed in Japan OA
135. hpoint Oand watchpoint I You can configure either to be a watchpoint monitoring data accesses or a breakpoint monitoring instruction fetches You can make watchpoints and breakpoints data dependent Each watchpoint unit contains three pairs of registers address value and address mask data value and data mask control value and control mask Each register is independently programmable and has a unique address The function and mapping of the watchpoint unit register is shown in Table 9 1 on page 9 12 9 20 1 Programming and reading watchpoint registers A watchpoint register is programmed by shifting data into the Embeddedl CE RT scan chain scan chain 2 The scan chain is a 38 bit shift register comprising a 32 bit data field B a 5 bit address field a read write bit This setup is shown in Figure 9 12 ARM720T CORE CPU MANUAL EPSON 9 33 9 Debugging Your System Scan chain register Update read write Address Address decoder UU y Value Mask Comparator gt gt Breakpoint condition HADDR 31 0 gt DATA 31 0 gt Control gt Watchpoint registers and comparators DBGTDI DBGTDO Figure 9 12 EmbeddedICE RT block diagram The data to be written is shifted intothe 32 bit data field the address of the register is shifted intothe 5 bit
136. in Table 1 12 Table 1 12 Thumb instruction summary 1 Introduction Operation Assembler Move Immediate MOV lt Rd gt lt 8bit_Imm gt High to Low MOV lt Rd gt lt Hs gt Low to High MOV lt Hd gt lt Rs gt High to High MOV lt Hd gt lt Hs gt Arithmetic Add ADD Rd lt Rs gt 3bit Imm Add Low and Low ADD Rd Rs Rn Add High to Low ADD Rd Hs Add Low to High ADD Hd Rs Add High to High ADD Hd Hs Add Immediate ADD lt Rd gt Z 8bit Imm Add Value to SP ADD SP lt 7bit_lmm gt ADD SP 7bit Imm Add with carry ADC Rd Rs Subtract SUB Rd Rs Rn SUB Rd Rs 3bit Imm Subtract Immediate SUB lt Rd gt lt 8bit_Imm gt Subtract with carry SBC Rd Rs Negate NEG Rd Rs Multiply MUL Rd lt Rs gt Compare Low and Low CMP Rd Rs Compare Low and High Rd Hs Compare High and Low CMP Hd Rs Compare High and High CMP Hd Hs Compare Negative CMN Ra lt Rs gt Compare Immediate CMP Ra lt 8bit_Imm gt Logical AND AND lt Rd gt lt Rs gt EOR EOR lt Rd gt lt Rs gt OR ORR lt Rd gt lt Rs gt Bit clear BIC lt Rd gt lt Rs gt Move NOT MVN lt Rd gt lt Rs gt Test bits TST lt Rd gt lt Rs gt ARM720T CORE CPU MANUAL EPSON 1 Introduction
137. in their normal system mode of operation In the CAPTURE DR state the device identification code is captured by the ID register IntheSHIFT DR state the previously captured device identification codeis shifted out of the ID register through the DBGTDO pin while data is shifted intothelD register through the DBGTDI pin In the UPDATE DR state the ID register is unaffected 9 13 4 BYPASS b1111 TheBYPASS instruction connects a 1 bit shift register the bypass register between DBGTDI and DBGTDO When the BYPASS instruction is loaded into the instruction register all the scan cells assume their normal system mode of operation The BYPASS instruction has no effect on the system pins In the CAPTURE DR state a logic O is captured the bypass register IntheSHIFT DR state test data is shifted into the bypass register through DBGTDI and shifted out on DBGTDO after a delay of one HCLK cycle Thefirst bit to shift out is a zero The bypass register is not affected in the UPDATE DR state All unused instruction codes default to the BYPASS instruction 9 13 5 RESTART b0100 The RESTART instruction restarts the processor on exit from debug state The RESTART instruction connects the bypass register between DBGTDI and DBGTDO The TAP controller behaves as if the BY PASS instruction had been loaded The processor exits debug state when the RUN TEST IDLE state is entered For more information see Exit from debug state o
138. indexed lt Rn gt lt Rm gt Post indexed lt Rn gt lt Rm gt Addressing mode 4 load lt a_mode4L gt is shown in Table 1 6 Table 1 6 Addressing mode 4 load Addressing mode Stack type IA Increment after FD Full descending IB Increment before ED Empty descending DA Decrement after FA Full ascending DB Decrement before EA Empty ascending ARM720T CORE CPU MANUAL EPSON 1 11 1 Introduction Addressing mode 4 store lt a_mode4S gt is shown in Table 1 7 Table 1 7 Addressing mode 4 store Addressing mode Stack type IA Increment after EA Empty ascending IB Increment before FA Full ascending DA Decrement after ED Empty descending DB Decrement before FD Full descending Addressing mode 5 coprocessor data transfer a mode5 is shown in Table 1 8 Table 1 8 Addressing mode 5 Operation Assembler Immediate offset lt Rn gt lt 8bit_Offset 4 gt Pre indexed lt Rn gt lt 8bit_Offset 4 gt Post indexed lt Rn gt lt 8bit_Offset 4 gt Operand 2 lt Oprnd2 gt is shown in Table 1 9 Table 1 9 Operand 2 Operation Assembler Immediate value lt 32bit_Imm gt Logical shift left lt Rm gt LSL lt 5bit_Imm gt Logical shift right Rm LSR lt 5bit_Imm gt Arithmetic shift right Rm ASR lt 5bit_Imm gt Rotate right Rm ROR lt 5bit_Imm gt Regist
139. ing disabled 1 Address Alignment Fault Checking enabled C Bit 2 Cache enable disable 0 Instruction and or Data Cache I DC disabled 1 Instruction and or Data Cache I DC enabled W Bit 3 Write buffer enable disable 0 Write Buffer disabled 1 Write Buffer enabled P Bit 4 When read returns 1 When written is ignored D Bit 5 When read returns 1 When written is ignored L Bit6 When read returns 1 When written is ignored B Bit 7 Big endian little endian 0 Littleendian operation 1 Big endian operation S Bit 8 System protection M odifies the MMU protection system R Bit 9 ROM protection Modifies the MMU protection system 3 4 EPSON ARM720T CORE CPU MANUAL 3 Configuration Bits 12 10 When read this returns an Unpredictable value When written it Should BeZero or a value read from these bits on the same processor Note Using a read write modify sequence when modifying this register provides the greatest future compatibility V Bit 13 Location of exception vectors O low addresses 1 high addresses The value of the V bit reflects the state of the VINITHI external input sampled while HRESETn is LOW Bits 31 14 When read this returns an Unpredictable value When written it Should Be Zero or a value read from these bits on the same processor Enabling the MMU You must take care if the translated address differs from the untranslated address because the instructions following the enabling of the
140. instructions 9 20 H Range 9 36 9 37 9 38 9 43 9 44 RANGE bit 9 36 Read data bus AHB 6 11 Register cache test 11 3 control value 9 36 debug status 9 42 fault address 7 16 fault status 7 16 MMU test 11 8 test 11 1 test state 11 3 translation table base 7 4 Registers 3 3 ARM 2 4 interrupt modes 2 5 Cache Operations Register 3 7 Control Register 3 4 debug communications chan nel 9 14 debug control DBGACK 9 40 DBGRQ 9 40 Domain Access Control Regis ter 3 6 Fault Address Register 3 7 Fault Status Register 3 6 ID Register 3 3 instruction 9 20 9 21 9 22 9 23 Invalidate TLB 3 7 Invalidate TLB Single Entry 3 7 Process Identifier Registers 3 8 register 13 process identifier register changing FCSE PID 3 8 FCSE PID 3 8 relationship between ARM and Thumb 2 7 Test Registers 3 9 Thumb 2 6 TLB Operations Register 3 7 Translation Table Base Regis ter 3 5 7 4 watchpoint 9 33 programming and reading 9 33 Registers debug address mask 9 37 BYPASS 9 21 bypass 9 22 control mask 9 33 9 35 control value 9 33 9 35 data mask 9 33 data value 9 33 Embeddedl CE RT 9 24 accessing 9 17 9 24 debug status 9 26 ID 9 22 instruction 9 20 9 21 9 22 9 23 scan path select 9 22 9 23 scan path select register 9 20 status 9 41 status register 9 26 test data 9 22 watchpoint address mask 9 33 watchpoint address value 9 33 Reset action of processor on 2 16 Response encoding 6 10 RESTART on exit from debug 9 21 RESTART ins
141. ions 5 1 About the write buffer ee une 5 1 5 2 Write buffer Operador ee 5 2 5 1 About the write buffer The write buffer of the ARM 720T processor is provided to improve system performance It can buffer up to eight words of data eight independent addresses You can enable and disablethe write buffer using the W bit bit 3 in the Control Register The buffer is disabled and flushed on reset Theoperation of the write buffer is further controlled by the Zufferable B bit which is stored in the MMU page tables For this reason the MMU must be enabled before using the write buffer The two functions can however be enabled simultaneously with a single writetothe Control Register For a write to use the write buffer both the W bit in the Control Register and the B bit in the corresponding page table must be set Note It is not possible to abort buffered writes externally The error response on HRESP 1 0 isignored Areas of memory that can generate aborts must be marked as unbufferable in the MMU page tables 5 1 1 Bufferable bit This bit controls whether a write operation uses or does not use the write buffer Typically main memory is bufferable and 1 0 space unbufferable The B bit can be configured for both pages and sections ARM720T CORE CPU MANUAL EPSON 5 1 5 Write Buffer 5 2 Write buffer operation You control the operation of the write buffer with CP15 register 1 the Control Register see Control Regi
142. ions and pages The Fault checking sequence 7 Memory Management Unit sequence for both types of access is shown in Figure 7 14 Modified virtual address y Check address alignment gt N Section translation C Invalid bz Get level one descriptor fault Section Page Page Invalid translation table entry fault Section y Page No access 00 No access 00 domain E 9 Check domain status en 10 domain fault fault Section Page Client 01 Manager 11 Y Section Check Check Page permission access access permission fault permissions permissions fault Loy d Physical address Figure 7 14 Sequence for checking faults The conditions that generate each of the faults are described in Alignment fault on page 7 19 Translation fault on page 7 20 Domain fault on page 7 20 Permission fault on page 7 20 7 7 1 If alignment fault is enabled A bit in 15 register cl set the MMU generates an alignment fault on any data word access if the address is not word aligned or on any halfword access if the address is not halfword aligned irrespective of whether the MMU is enabled or not An alignment fault is not generated on any instruction fetch nor on any byte access Note Alignment fault If the access genera
143. ission faults are only generated when the MMU is enabled The access control mechanisms of the MMU detect the conditions that produce these faults If a fault is detected as a result of a memory access the MMU aborts the access and signals the fault condition tothe CPU core TReMMU retains status and address information about faults generated by the data accesses in the Fault Status Register and Fault Address Register see Fault address and fault status registers on page 7 16 An access violation for a given memory access inhibits any corresponding external access with an abort returned to the CPU core ARM720T CORE CPU MANUAL EPSON 7 15 7 Memory Management Unit 7 5 Fault address and fault status registers On an abort the MMU places an encoded 4 bit value FS 3 0 along with the 4 bit encoded domain number in the data FSR and the MVA associated with the abort is latched into the FAR If an access violation simultaneously generates more than one source of abort they are encoded in the priority given in Table 7 9 7 5 1 Fault Status Table 7 9 describes the various access permissions and controls supported by the data MMU and details how these are interpreted to generate faults Table 7 9 Priority encoding of fault status Priority Source Size Status Domain FAR Highest Alignment b00x1 Invalid MVA of access causing abort Translation Section b0101 Invalid MVA of access Page
144. ite sequence SWP instruction is treated as an unbuffered write even if it is marked as buffered 5 2 4 Reading from a noncachable area If the CPU performs a read from a noncachable area the write buffer is drained and the processor is stalled 5 2 5 Draining the write buffer You can force a drain of the write buffer by performing a read from a noncachable location 5 2 6 Multi word writes All accesses aretreated as nonsequential which meansthat writes require an address slot and a data slot for each word For this reason buffered STM accesses could be less efficient than unbuffered STM accesses You are advised to disable the write buffer by clearing bit CP15 register 1 before moving large blocks of data 5 2 EPSON ARM720T CORE CPU MANUAL 6 The Bus Interface 6 The Bus Interface 6 The Bus Interface This chapter describes thesignals on the bus interface of the ARM 720T processor It contains the following sections 6 1 About thebpusdhter abes ders Sects ce erre te jo nde te repaso iin 6 1 6 2 B sinterfacssrgils ect edel 6 3 6 3 Transfer ACY DOS ca 105282 eier 6 5 6 4 Address and control Signals nenn 6 7 6 5 Slave transfer response signals eese 6 9 6 6 Data DUSESE L o EA a RE 6 10 6 7 Ar Dit ratio are HL E TER 6 12 6 8 BUSCO ae 6 13 6 9 Did E 6 13 6 1 About the bus interface The ARM 720T processor is an Advanced High perfor
145. ith either of the following the ETMEN output on the ETM7 the inverted PWRDOWN output on the ETM7 ARM720T CORE CPU MANUAL EPSON 10 1 10 ETM Interface 10 3 Connections between the ETM7 macrocell and the ARM720T processor Table 10 1 shows the connections that you must make between the ETM 7 macrocell and the ARM 720T processor Table 10 1 Connections between the ETM7 macrocell and the ARM720T processor ETM7 macrocell signal name ARM720T processor signal name A 31 0 ETMADDR 31 0 ABORT ETMABORT ARMTDO DBGTDO BIGEND ETMBIGEND CLKa HCLK2 CLKEN ETMCLKEN CPA ETMCPA CPB ETMCPB DBGACK ETMDBGACK DBGRQ DBGRQ nMREQ ETMnMREQ SEQ ETMSEQ MAS 1 0 ETMSIZE 1 0 nCPI ETMnCPI nEXEC ETMnEXEC nOPC ETMnOPC nRESET HRESETn nRW ETMnRW nTRST DBGnTRST PROCID 31 0 ETMPROCID 31 0 PROCIDWR ETMPROCIDWR ETMEN or inverted PWRDOWN ETMEN ETMHIVECS RANGEOUTIO DBGRNG 0 RANGEOUT 1 DBGRNG 1 RDATA 31 0 ETMRDATA 31 0 TBIT ETMTBIT TCKa HCLKa TCKEN DBGTCKEN 10 2 EPSON ARM720T CORE CPU MANUAL 10 ETM Interface Table 10 1 Connections between the ETM7 macrocell and the ARM720T processor continued ETM7 macrocell signal name ARM720T processor signal name TDI DBGTDI DBGTDO TMS DBGTMS WDATA 31 0 ETMWDATA 31 0 INSTRVALID ETMINSTRVALID a See Clocks and resets on pa
146. k domains The ARM 720T processor has a single dock HCLK that is qualified by two dock enables HCLKEN controls access to the memory system DBGTCKEN controls debug operations When the ARM 720T processor is in debug state DBGTCKEN conditions HCLK to clock the core ARM720T CORE CPU MANUAL EPSON 9 9 9 Debugging Your System 9 6 The EmbeddedICE RT macrocell The ARM 720T processor Embeddedl CE RT macrocell module provides integrated on chip debug support for the ARM 720T core The Embeddedl CE RT module is connected directly to the core and therefore functions on the virtual address of the processor before relocation by the FCSE PID You program the E mbeddedl CE RT macrocell serially using the ARM 720T processor TAP controller Figure 9 5 shows the relationship between the core Embeddedl CE RT and the TAP controller showing only the signals that are pertinent to Embeddedl CE RT 4 DBGEXT 1 0 cOMMRX COMMTX ARM720 T EmbeddedICE RT DBGRNG 1 0 Rev 4 core macrocell ag DBGACK gt 4 DBGBREAK DBGRQ 4 DBGEN 4 DBGTCKEN 4 DBGTMS DBGnTRST gt TAP 4 DBGTDI DBGTDO A HCLK Figure 9 5 The ARM720T core TAP controller and EmbeddedICE RT macrocell The Embeddedl CE RT logic comprises the following Two real time watchpoint units You can program one or both
147. lect between alternate halfwords 2 1 1 Switching between processor states Transition between processor states does not affect the processor mode or the contents of the registers Entering Thumb state Entry into Thumb state can be achieved by executing a BX instruction with the state bit bit 0 set in the operand register Transition to Thumb state also occurs automatically on return from an exception for example Interrupt ReQuest Fast Interrupt reQuest FI Q UNDEF ABORT and SoftWare Interrupt SWI if the exception was entered with the processor in Thumb state Entering ARM state Entry into ARM state happens On execution of the BX instruction with the state bit clear in the operand register On the processor taking an exception for example IRQ FIQ RESET UNDEF ABORT and SWI In this case the PC is placed in thelink register of the exception mode and execution starts at the vector address of the exception ARM720T CORE CPU MANUAL EPSON 2 1 2 Programmer s Model 2 2 Memory formats TheARM 720T processor views memory as a linear collection of bytes numbered upwards from zero as follows Bytes Holdthefirst stored word Bytes 4 to 7 Hold the second stored word Bytes 8to 11 Hold the third stored word Words are stored in memory as big or little endian as described in the following sections Big endian format Little endian format on page 2 3 The endianness used depends on t
148. led to the ARM 720T processor A typical coprocessor contains an instruction pipeline instruction decoding logic handshake logic a register bank special processing logic with its own data path A coprocessor is connected to the same data bus as the ARM 720T processor in the system and tracks the pipeline in the ARM 720T core This means that the coprocessor can decode the instructions in the instruction stream and execute those that it supports E ach instruction progresses down both the ARM 720T processor pipeline and the coprocessor pipeline at the same time The execution of instructions is shared between the ARM 720T core and the coprocessor as follows The ARM 720T core 1 Evaluates the condition codes to determine whether the instruction must be executed by the coprocessor then signals this to any coprocessors in the system using 2 Generates any addresses that are required by theinstruction induding prefetching the next instruction to refill the pipeline 3 Takestheundefined instruction trap if no coprocessor accepts the instruction ARM720T CORE CPU MANUAL EPSON 8 1 8 Coprocessor Interface The coprocessor 1 Decodes instructions to determine whether it can accept the instruction 2 Indicates whether it can accept the instruction by signaling on EXTCPA and EXTCPB 3 Fetches any values required from its own register bank 4 Performs the operation required by the ins
149. ler also provides scan chain 0 control signals Figure 9 2 ARM720T processor block diagram ARM720T CORE CPU MANUAL EPSON 9 Debugging Your System 9 2 1 Debug modes You can perform debugging in either of the following modes Halt mode When the system is in halt mode the core enters debug statewhen it encounters a breakpoint or a watchpoint In debug state the core is stopped and isolated from the rest of the system When debug has completed the debug host restores the core and system state and program execution resumes For more information see Entry into debug stateon page 9 5 Monitor mode When the system is in monitor mode the core does not enter debug state on a breakpoint or watchpoint nstead an Instruction Abort or Data Abort is generated and the core continues to receive and service interrupts as normal You can usethe abort status register to establish whether the exception was due to a breakpoint or watchpoint or to a genuine memory abort For more information see Monitor mode debugging on page 9 12 9 2 2 Examining system state during debugging In both halt mode and monitor mode the TAG style serial interface enables you to examine the internal state of the core and the external state of the system while system activity continues In halt mode this enables instructions to be inserted serially intothe core pipeline without usingthe external data bus For example when in debug state a S
150. make the distinction between User and non U ser mode instruction fetches program the PROT 1 bit in the control value register and control mask register accordingly 7 If required program the DBGEXT RANGE and CHAIN bits in the same way Note Y ou do not have to program the address value register Setting the breakpoint To set the software break point 1 Read the instruction at the desired address and store it 2 Writethe special bit pattern representing a software breakpoint at the address Clearing the breakpoint To dear the software breakpoint restore the instruction to the address ARM720T CORE CPU MANUAL EPSON 9 37 9 Debugging Your System 9 22 Programming watchpoints This section contains examples of how to program the watchpoint unit to generate breakpoints and watchpoints M any other ways of programming the watchpoint unit registers are possi ble For example simple range breakpoints can be provided by setting one or more of the address mask bits To make a watchpoint unit cause watchpoints on data accesses 1 Program its address value register with the address of the data access to be watchpointed 2 Program the address mask register to 0x00000000 3 Program the data value register only if you require a data dependent watchpoint that is only if you haveto match the actual data value read or written as well as the address If the data value is irrelevant program the data mask register to OxFFFFFFFF all
151. mance Bus AH B bus master To ensure reuse of your design with other ARM processors including different revisions it is strongly recommended that you use fully AMBA compliant peripherals and interfaces early in your design cycle The AHB timings described in this chapter are examples only and do not provide a complete list of all possible accesses For more details on AMBA interface and integration see the AMBA specification 6 1 1 Summary of the AHB transfer mechanism An AHB transfer comprises the following Address phase This lasts only a single cyde The address cannot be extended so all slaves must sample the address during the address phase Data phase This phase can be extended using the HREADY signal When LOW HREADY causes wait states to be inserted into the transfer and enables extra time for a slave to provide or sample data A write data bus is used to move data from the master to a slave A read data bus is used to move data from a slave to the master ARM720T CORE CPU MANUAL EPSON 6 1 6 The Bus Interface Figure 6 1 shows a transfer with no wait states this is the simplest type of transfer Address Data phase phase HCLK HADDR 31 0 KX A KX Control XX Control Xy HWDATA 31 0 XY OY Data Jy A HREADY yy u HRDATA 31 0 Data A Figure 6 1 Simple AHB transfer A granted bus master starts an AHB transfer by driving the addres
152. mediate Move register o cond 0 0 O 1 O R 1 0 Mask SBO SBZ 0 Rm Branehoxchene cond 0 0 0 1 0 0 1 0 SBO SBO so 0 0 0 1 Rm Loadistore immediate cond 01 0 PJU BIWIL Rn Rd immediate Load store register offset cond Rd shift immediate shift O Rm cond o o o Pp u 1 wIL Rn Rd High offset 1 S H 1 Low offset pe cond 0 O O P lU O W L Rn Rd SBZ 1 S H 1 Rm Swap swap byte cond 0 0 0 1 0 B 0 0 Rn Rd SBZ 110011 Rm Load store multiple cond 10 0 PIUSWIL Rn Register list en cond 1111110 op1 CRn CRd cp num op2 0 CRm ond 1 1 1 0 1 L ERA Rd cp num op2 1 Coprocessor load and cond 1 1 0 P UIN WIL Rn CRd cp num 8 bit offset Branch and branch with cona O 24 bit offset Software interrupt cond 111 11 1 swi_number Undefined cond 01 1 X X X X X X X X X X xX Xx X X X xX X dl X XIX Xx 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 Figure 1 3 ARM instruction set formats Note Some instruction codes are not defined but do not cause the Undefined instructi on trap to be taken for example a multiply instruction with bit 6 set You must not use these instructions because their action might change in future ARM implementations ARM720T CORE CPU MANUAL EPSON 1 7 1 Introduction The ARM instruction set summary is shown in Table 1 2
153. ments This makes it ideal for portable applications where low power consumption is essential The ARM 720T processor architecture is based on Reduced Instruction Set Computer RISC principles Theinstruction set and related decode mechanism are greatly simplified compared with microprogrammed Complex Instruction Set Computers CISCs ARM720T CORE CPU MANUAL EPSON 1 1 1 Introduction A block diagram of the ARM 720T processor is shown in Figure 1 1 Virtual address bus JTAG debug interface MMU 8KB cache ARM720T core ETM interface pM Coprocessor interface Internal data bus Data and address buffers Control and System control clocking logic coprocessor AMBA interface AMBA AHB bus interface Figure 1 1 720T Block diagram 1 2 EPSON ARM720T CORE CPU MANUAL The functional signals on the ARM 720T processor are shown in Figure 1 2 lt HADDR 31 0 4 MHTRANS 1 0 HBURST 2 0 DBGIR 3 0 gt DBGSREG 3 0 gt DBGSDIN 1 Introduction HWRITE DBGSDOUT 4 HSIZE 2 0 DBGTAPSM 3 0 HPROT 3 0 DBGCAPTURE gt AMBA HGRANT DBGSHIFT gt interface HREADY DBGUPDATE gt JTAG HRESP 1 0 DBGINTEST gt interface lt HWDATA 31 0 HRDATA 31 0 DBGEXTEST
154. n page 9 29 ARM720T CORE CPU MANUAL EPSON 9 21 9 Debugging Your System 9 14 Test data registers Thesix test data registers that can connect between DBGTDI and DBGTDO are described in the following sections Bypass register e ARM 720T processor device identification ID code register Instruction register on page 9 23 Scan path select register on page 9 23 Scan chain 1 on page 9 17 Scan chain 2on page 9 17 In the following descriptions data is shifted during every HCLK cycle when DBGTCKEN enableisHIGH 9 14 1 Bypass register Purpose Bypasses the device during scan testing by providing a path between DBGTDI and DBGTDO Length 1 bit Operating mode When the BY PASS instruction is the current instruction in the instruction register serial data is transferred from DBGTDI to DBGTDO in the SHIFT DR state with a delay of one HCLK cyde enabled by DBGTCKEN Thereis no parallel output from the bypass register A logicO is loaded from the parallel input of the bypass register in the CAPTURE DR state 9 14 2 ARM720T processor device identification ID code register Purpose Reads the 32 bit device identification code No programmable supplementary identification code is provided Length 32 bits The format of the I D code register is as shown in Figure 9 9 31 28 27 12 11 10 Version Part number Manufacturer identity 1 Figure 9 9 ID code register format The default device identification
155. n register described in nstruction register on page 9 23 Theloading of instructions is controlled by the Test Access Port TAP controller For more information about the TAP controller see The TAP controller on page 9 19 9 18 EPSON ARM720T CORE CPU MANUAL 9 12 The TAP controller 9 Debugging Your System The TAP controller is a state machine that determines the state of the boundary scan test signals DBGTDI and DBGTDO Figure 9 8 shows the state transitions that occur in the TAP controller er tms 1 Seat tms 0 Test Logic Reset x tms 0 Run Test Idle OxC tms 1 Select DR Scan 0x7 tms 1 tms 0 tms 1 Capture DR Ox6 tms 0 m tms 0 tms 1 tms 0 Pause DR 0x3 ims 1 tms 0 Exit2 DR 0x0 tms 0 tms 1 Update DR 0x5 tms 1 tms 0 Select IR Scan 0x4 tms 1 tms 0 tms 1 Capture IR OxE tms 0 tms 1 tms 1 tms 0 Pause IR 0xB tms 0 tms 1 Exit2 IR 0x8 tms 0 tms 1 Update IR 0xD tms 1 4 tms 0 Figure 9 8 Test access port controller state transitions From IEEE Std 1149 1 1990 Copyright 2001 IEEE All rights reserved 9 12 1 Resetting the TAP controller Toforcethe TAP controller into the correct state after power up you must apply a reset pulse tothe DBGnTRST signal When the boundary scan interface is to be used DBGnTRST must be driven LOW and then HIGH again When the bounda
156. ned instruction When the ARM 720T processor encounters an instruction that it cannot handle it takes the Undefined Instruction trap This mechanism can be used to extend either the Thumb or ARM instruction set by software emulation After emulating the failed instruction the trap handler must execute the following irrespective of the state ARM or Thumb MOVS PC r14 und This restores the CPSR and returns to the instruction following the Undefined Instruction 2 8 9 Exception vectors The ARM 720T processor can have exception vectors mapped to either low or high addresses controlled by the V bit in the Control Register of the system control coprocessor See Contro Register on page 3 4 Table 2 4 shows the exception vector addresses Table 2 4 Exception vector addresses Note High address Low address Exception Mode on entry OxFFFFOOOO 0x00000000 Reset Supervisor OxFFFF0004 0x00000004 Undefined instruction Undefined OxFFFF0008 0x00000008 Software interrupt Supervisor OxFFFFOOOC 0x0000000C Abort prefetch Abort OxFFFF0010 0x00000010 Abort data Abort OxFFFF0014 0x00000014 Reserved Reserved OxFFFF0018 0x00000018 IRQ IRQ OxFFFFOOIC 0x0000001C FIQ FIQ The low addresses arethe defaults ARM720T CORE CPU MANUAL EPSON 2 13 2 Programmer s Model 2 8 10 Exception priorities When multiple exceptions arise at the sametime a fixed priority system determines the ord
157. nerated breakpoints and watchpoints Data must always be valid around the rising edge of HCLK When this data is an instruction to be breakpointed the DBGBREAK signal must be HIGH around the rising edge of HCLK Similarly when the data is for a load or store asserting DBGBREAK around the rising edge of HCLK marks the data as watchpointed When a breakpoint or watchpoint is generated there might be a delay before the ARM 720T core enters debug state When it enters debug state the DBGACK signal is asserted The timing for an externally generated breakpoint is shown in Figure 9 3 HCLK HADDR 31 0 y Y y y DATA 31 0 e o Gena 1 DBGBREAK jj DBGACK pany HTRANS 1 0 Memory cycles y Internal cycles Figure 9 3 Debug state entry ARM720T CORE CPU MANUAL EPSON 9 5 9 Debugging Your System 9 3 1 Entry into debug state on breakpoint The ARM 720T processor marks instructions as being breakpointed as they enter the instruction pipeline but the core does not enter debug state until the instruction reaches the E xecute stage Breakpointed instructions are not executed nstead the ARM 720T core enters debug state When you examine the internal state you seethe state before the breakpointed instruction When your examination is complete removethe breakpoint Program execution restarts from the previously break
158. nless they can be decoded as a CP15 operations otherwise dead lock occurs on busy waiting If you transfer morethan 16 words of data in a single instruction the worst case interrupt latency of the ARM 720T processor increases HCLK Sage MEX ADD Loc Y Y SWINE Y n 4 Decode MN Y ADD Y sus toc Y TST SWINE Y Y et ADD BUB LDC X TST SWINE CPnCPI from core Mo een EXTCPB from coprocessor 7 Jr Fetch Y I Fetch I Fetch Y I Fetch Y 1 Fetch CP dataJ CP data CP data CP data Fetch HRDATA 31 0 ADD SUB CPDO TST SWINE Figure 8 4 Coprocessor load sequence 8 8 EPSON ARM720T CORE CPU MANUAL 8 Coprocessor Interface 8 5 Connecting coprocessors A coprocessor in a system based on an ARM 720T processor must have 32 bit connections to transfer data from memory instruction stream and LDC write data from the ARM 720T processor MCR read data to the ARM 720T processor MRC 8 5 1 Connecting a single coprocessor Y ou can connect a single coprocessor directly to the coprocessor interface of the ARM 720T processor without any additional logic as shown in Figure 8 5 EXTCPDBE must be driven HIGH by the external coprocessor when it drives data on EXTCPDOUT CPDOUT ARM720T Rev 4 processor A Memory AMBA interface CPDIN External coprocessor Figure 8 5 Example coprocessor connectio
159. ns Exceptions arise whenever the normal flow of a program has to be halted temporarily for example to service an interrupt from a peripheral Before an exception can be handled the current processor stateis preserved sothat theoriginal program can resume when thehandler routine has finished Several exceptions can arise at the sametime If this happens they are dealt with in a fixed order See Exception priorities on page 2 14 Exception behavior is described in the following sections Action on entering exception Action on leaving an exception on page 2 11 Exception entry and exit summary on page 2 11 Fast interrupt request on page 2 12 Interrupt request on page 2 12 Abort on page 2 12 Software interrupt on page 2 13 Undefined instruction on page 2 13 Exception vectors on page 2 13 Exception priorities on page 2 14 Exception restrictions on page 2 14 2 8 1 Action on entering an exception When handling an exception the ARM 720T processor behaves as follows 1 It preserves the address of the next instruction in the appropriate LR a Ifthe exception has been entered from ARM state the address of the next instruction is copied intothe LR that is current PC44 or PC 8 depending on the exception See Table 2 3 on page 2 11 for details b Ifthe exception has been entered from Thumb state the value written intothe LR isthe current PC offset by a value sothat the program resumes from the correct place
160. ns Note If you are building a system with an ETM7 and an ARM 720T core you must directly connect the following buses ETM7 input RDATA 31 0 to the ARM 720T processor output ETMRDATA 31 0 ETM7 input WDATA 31 0 to the ARM 720T processor output ETMWDATA 31 0 This enables the ETM to correctly trace coprocessor instructions 8 5 2 Connecting multiple coprocessors If you have multiple coprocessors in your system connect the handshake signals as shown in Table 8 3 Table 8 3 Handshake signal connections Signal Connection CPnCPI Connect this signal to all coprocessors present in the system CPA and CPB The individual CPA and CPB outputs from each coprocessor must be ANDed together and connected to the EXTCPA and EXTCPB inputs on the ARM720T processor You must also multiplex the output data from the coprocessors ARM720T CORE CPU MANUAL EPSON 8 Coprocessor Interface 8 6 Not using an external coprocessor If you are implementing a system that does not include any external coprocessors you must tieboth EXTCPA and EXTCPB HIGH This indicates that no external coprocessors are present in the system If any coprocessor instructions are received they take the undefined instruction trap sothat they can be emulated in software if required The coprocessor specific outputs from the ARM 720T core can be left unconnected CPnMREQ CPnTRANS CPnOPC CPnCPI CPTBIT You must tie off EXTCPDOUT
161. ns are 32 bits longin ARM state 16 bits long in Thumb state 2 4 Data types The ARM 720T processor supports the following data types byte 8 bit halfword 16 bit word 32 bit You must align these as follows word quantities to 4 byte boundaries halfwords quantities to 2 byte boundaries byte quantities can be placed on any byte boundary ARM720T CORE CPU MANUAL EPSON 2 3 2 Programmer s Model 2 5 Operating modes The ARM 720T processor supports seven modes of operation as shown in Table 2 1 Table 2 1 ARM720T modes of operation Mode Type Description User usr The normal ARM program execution mode FIQ fiq Used for most performance critical interrupts in a system IRQ irq Used for general purpose interrupt handling Supervisor svc Protected mode for the operating system Abort mode abt Entered after a Data Abort or instruction Prefetch Abort System sys A privileged User mode for the operating system Undefined und Entered when an Undefined Instruction is executed 2 5 1 Changing operating modes Mode changes can be made under software control by external interrupts or during exception processing Most application programs execute in User mode The non U ser modes known as privileged modes are entered in order to service interrupts or exceptions or to access protected resources 2 6 Registers The ARM 720T processor has a total of 37 registers 31 general p
162. ns between the ETM7 macrocell and the 11 Test Support 11 1 11 2 11 3 11 4 11 5 A Signal Descriptions Glossary Index ARMAZ2OT Processor udi oe rere dpi tare ro eb edged ade ete ato 10 2 Glocks and Tesista ir cent 10 3 Debug request WIKIO uii rte een 10 3 interface wiring edo rr Re rote enden 10 3 About the ARM720T test registers 11 1 Automatic Test Pattern Generation ATPG 11 2 Test State Register us rod od lesen 11 3 Cache test registers and 11 3 MMU test registers and 11 8 AMBA interface signals oooooononnccnnnnnnnnncccccccnnnnnnnanccnnnnnnnnnncnncnnnnnnnnnncnnnn A 1 Coprocessor interface signals A 2 JTAG anddestsigrals canes tma eee i tasa nee A 3 Debudger signals die 4 Embedded trace macrocell interface A 5 E e S s oic ER d dd MU ME A tM A 7 Miscellaneous 7 ARM720T CORE CPU MANUAL EPSON iii CONTENTS List of Figures Figure 1 1 7201 Block diagram tc uii aia 1 2 Figure 1 2 ARM720T processor functional
163. o Table 1 3 on page 1 10 lt a_mode2P gt Refer to Table 1 4 on page 1 11 lt a_mode3 gt Refer to Table 1 5 on page 1 11 lt a_mode4L gt Refer to Table 1 6 on page 1 11 lt a_mode4S gt Refer to Table 1 7 on page 1 12 lt a_mode5 gt Refer to Table 1 8 on page 1 12 lt 32bit_lmm gt A 32 bit constant formed by right rotating an 8 bit value by an even number of bits lt reglist gt A comma separated list of registers enclosed in braces and 1 6 EPSON ARM720T CORE CPU MANUAL 1 Introduction 1 3 2 ARM instruction set This section gives an overview of the ARM instructions available For full details of these instructions see the ARM Architecture Reference Manual The ARM instruction set formats are shown in Figure 1 3 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 Data processing mand 01011 op S Rn Rd rotate immediate Data processing cond 0 0 0 opcode S Rn Rd shift immediate shift 0 Rm Data processing register cond 0100 opcode S Rh Rd Rs 0 shift 1 Rm Multiply cond 010100 10 10 5 Rd Rn Rs 1001 Rm Multiply long cond 01010101110 5 Rn 100 1 Rm Move from status register cond 0 0 0 1 0 R 0 0 SBO Rd SBZ Move immediate and 00 4 10 R 1 6 Mask SBO rotate im
164. o descriptor If the level one fetch returns either a coarse page table descriptor or a fine page table descri ptor this provides the base address of the page table to be used The page table is then accessed and a level two descriptor is returned Figure 7 9 shows the format of level two descri ptor s 31 16 15 1211109 87654 3210 Small page base address ap3 ap2 ap1 EE Small page Tiny page base address Figure 7 9 Level two descriptor 7 10 EPSON ARM720T CORE CPU MANUAL 7 Memory Management Unit A level two descriptor defines a tiny a small or a large page descriptor or is invalid a large page descriptor provides the base address of a 64KB block of memory a small page descriptor provides the base address of a 4KB block of memory a tiny page descriptor provides the base address of a IKB block of memory Coarse page tables provide base addresses for either small or large pages Large page descriptors must be repeated in 16 consecutive entries Small page descriptors must be repeated in each consecutive entry Fine page tables provide base addresses for large small or tiny pages Large page descriptors must be repeated in 64 consecutive entries Small page descriptors must be repeated in four consecutive entries and tiny page descriptors must be repeated in each consecutive entry Level two descriptor bit assignments are described in Table 7 7 Table 7 7 Level two descriptor bits Bits
165. o the destination register Rd Note The Thumb instruction set does not contain coprocessor instructions so it is recommended that these are accessed using SWI instructions when in Thumb state ARM720T CORE CPU MANUAL EPSON 9 15 9 Debugging Your System 9 10 2 Communications through the DCC Messages can be sent and received through the DCC Sending a message to the debugger Messages are sent from the processor to the debugger as follows 1 When the processor wishes to send a message to E mbeddedl CE RT it first checks that the communications data write register is free for use The processor does this by reading the Domain Access Control Register to check the status of the W bit a IftheW bit is dear the DCC data write register is empty and a message is written by a register transfer to the coprocessor b IftheW bit is set this implies that previously written data has not been read by the debugger The processor must repeatedly read the Domain Access Control Register until the W bit is clear 2 When the W bit is clear a message is written by a register transfer to coprocessor 14 The data transfer occurs from the processor to the DCC data write register so the W bit is set in the Domain Access Control Register 3 When the debugger reads the Domain Access Control Register through the TAG interface it sees a synchronized version of both the R and W bits a When the debugger sees that the W bit is set it can read
166. ode 2 4 definition 2 12 J JTAG BYPASS 9 21 IDCODE 9 21 9 23 interface 9 3 9 17 INTEST 9 20 publicinstructions summary 9 20 RESTART 9 21 SCAN N 9 20 J TAG signals A 3 L Large pagereferences translating 7 12 Level one descriptor 7 6 descriptor accessing 7 6 fetch 7 6 L evel two descriptor 7 10 Little endian seememory format Lock signal AHB 6 12 Low registers 2 7 M Mask enable interrupt 9 42 Memory access from debugging state 9 28 9 29 M emory formats big endian description 2 2 little endian description 2 3 Memory management unit 7 1 Miscellaneous signals A 7 MMU 7 1 E ARM 1 7 enabling 3 5 Thumb 1 14 enabling and disabling 7 21 FAR 7 16 Instruction types 1 5 faults 7 15 Fast Context Switch Extension Interface registers 7 3 Index 2 EPSON ARM DDI 0229B test registers 11 8 Modes privileged 8 10 Monitor mode 9 4 9 12 9 13 Multi ICE 9 8 O Operating modes Abort mode 2 4 changing 2 4 FIQ 2 4 IRQ mode 2 4 Supervisor mode 2 4 System mode 2 4 Undefined mode 2 4 User mode 2 4 Operating state ARM 2 1 switching 2 1 to ARM 2 1 to THUMB 2 1 THUMB 2 1 P Page tables 7 5 Permission faults 7 15 7 20 Pipeline follower 8 4 Privileged instructions 8 10 Privileged modes 8 10 Processor state 9 27 Program status registers control bits 2 8 mode bit values 2 9 reser ved bits 2 9 Programming E mbeddedl CE RT 9 7 Programming watchpoints 9 38 PROT bits 9 35 Protocol converter 9 2 Public
167. oint 1 data value b10011 32 Watchpoint 1 data mask b10100 9 Watchpoint 1 control value b10101 8 Watchpoint 1 control mask 9 9 Monitor mode debugging The ARM 720T processor contains logic that enables the debugging of a system without stopping the core entirely This means that critical interrupt routines continue to be serviced whilethe coreis being interrogated by the debugger 9 9 1 Enabling monitor mode The debugging mode is controlled by bit 4 of the Debug Control Register described in Debug control register on page 9 39 Bit 4 of this register is also known as the monitor mode enable bit Bit 4 set Enables the monitor mode features of the ARM 720T processor When this bit is set the Embeddedl CE RT logic is configured so that a breakpoint or watchpoint causes the ARM 720T coreto enter abort mode taking the Prefetch or Data Abort vectors respectively Bit 4 dear Monitor mode debugging is disabled and the system is placed into halt mode In halt mode the core enters debug state when it encounters a breakpoint or watchpoint 9 12 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 9 2 Restrictions on monitor mode debugging There are several restrictions you must be aware of when the ARM coreis configured for monitor mode debugging Breakpoints and watchpoints cannot be data dependent in monitor mode No support is provided for use of the range functionality Breakpoints and watchpoints can only be b
168. on return from the exception This means that the excepti on handler does not have to determine which state the exception was entered from For example in the case of SWI MOVS PC 14 svc always returns tothe next instruction regardless of whether the SWI was executed in ARM or Thumb state 2 It copies the CPSR intothe appropriate SPSR 3 It forces the CPSR mode bits to a value that depends on the exception 4 It forces the PC to fetch the next instruction from the relevant exception vector It can also set the interrupt disable flags to prevent otherwise unmanageable nestings of excepti ons If the processor is in Thumb state when an exception occurs it automatically switches into ARM state when the PC is loaded with the exception vector address 2 10 EPSON ARM720T CORE CPU MANUAL 2 Programmer s Model 2 8 2 Action on leaving an exception On completion the exception handler 1 Moves the LR minus an offset where appropriate to the PC The offset varies depending on the type of exception 2 Copies the SPSR back tothe CPSR 3 Clears theinterrupt disable flags if they were set on entry Note An explicit switch back to Thumb state is never necessary because restoring the CPSR from the SPSR automatically sets the T bit tothe value it held immediately prior to the exception 2 8 3 Exception entry and exit summary Table 2 3 summarizes the PC value preserved in the relevant r14 register on exception entry and t
169. one descriptor A section descriptor provides the base address of a 1MB block of memory The page table descriptors provide the base address of a page table that contains level two descriptors There are two sizes of page table coarse page tables have 256 entries splitting the 1MB that the table describes into 4KB blocks fine page tables have 1024 entries splitting the IMB that the table describes into 1KB blocks 7 6 EPSON ARM720T CORE CPU MANUAL 7 Memory Management Unit Level one descriptor bit assignments are shown in Table 7 2 Table 7 2 Level one descriptor bits Bits Description Section Coarse Fine 31 20 31 10 31 12 These bits form the corresponding bits of the physical address 19 12 Should Be Zero 11 10 Access permission bits Domain access control on page 7 17 and Fault checking sequence on page 7 19 show how to interpret the access permission bits 9 9 11 9 Should Be Zero 8 5 8 5 8 5 Domain control bits 4 4 4 Must be 1 3 2 These bits C and B indicate whether the area of memory mapped by this page is treated as cachable or noncachable and bufferable or nonbufferable The system is always write through 3 2 3 2 Should Be Zero 1 0 1 0 1 0 These bits indicate the page size and validity and are interpreted as shown in Table 7 3 Thetwo least significant bits of thelevel one descriptor indicate the descriptor type as shown in Table 7
170. ontrol Register Value Meaning Description b00 No access Any access generates a domain fault b01 Client Accesses are checked against the access permission bits in the section or page descriptor b10 Reserved Reserved Currently behaves like the no access mode b11 Manager Accesses are not checked against the access permission bits so a permission fault cannot be generated ARM720T CORE CPU MANUAL EPSON 7 17 7 Memory Management Unit Table 7 10 shows how to interpret the Access Permission AP bits and how their interpretation is dependent on the S and R bits control register bits 8 and 9 Table 7 11 Interpreting access permission AP bits Supervisor AP R SINE User permissions Description permissions b00 0 No access No access Any access generates a permission fault b00 0 Read only No access Only Supervisor read permitted 1 Read only Read only Any write generates a permission fault b00 1 Reserved b01 x Read write No access Access allowed only in Supervisor mode b10 x Read write Read only Writes in User mode cause permission fault b11 x Read write Read write All access types permitted in both modes bxx 1 Reserved a Do not use this encoding S R b11 generates a fault for any access 7 18 EPSON ARM720T CORE CPU MANUAL 7 7 The sequence the MMU uses to check for access faults is different for sect
171. or data is shown in Figure 11 8 31 0 RAM data word 31 0 Figure 11 8 Data format RAM read ARM720T CORE CPU MANUAL EPSON 11 5 11 Test Support TheCAM match RAM read format for data is shown in Figure 11 9 31 30 29 0 N 11 4 1 Addressing the CAM and RAM For the CAM read or write and RAM read or write operations you must specify the segment index and word for the RAM operations The CAM and RAM operations usethe valuein the victim pointer for that segment so you must ensurethat the value is written in the victim pointer before any CAM or RAM operation If the MCR write victim and lockdown base is used then the victim pointer is incremented after every CAM read or write and every RAM read or write If the MCR write victimis used then the victim pointer is only incremented after every CAM read or write This enables efficient reading or writing of the CAM and RAM for an entire segment The write cache victim and lockdown operations are shown in Table 11 4 RAM data word 29 0 Figure 11 9 Data format CAM match RAM read Table 11 4 Write cache victim and lockdown operations Operation Instructions Write cache victim and lockdown base MCR p15 0 Rd c9 c0 0 MCR p15 0 Rd c9 1 Write cache victim MCR p15 0 Rd c9 c1 0 MCR p15 0 Rd C9 c1 1 The write cache victim and lockdown base format for Rd is shown in Figure 11 10 31 26 25
172. ord 2 d a Byte 0 d Byte 1 d Byte 2 d Byte 3 d 6 7 Arbitration The arbitration mechanism is described fully in the AMBA Specification Rev 2 0 This mechanism is used to ensure that only one master has access to the bus at any onetime The arbiter performs this function by observing a number of different requests to use the bus and deciding which is currently the highest priority master requesting the bus The arbiter also recei ves requests from slaves that want to complete SPLIT transfers Any slaves that are not capable of performing SPLIT transfers do not have to be aware of the arbitration process except that they need to observe the fact that a burst of transfers might not complete if the ownership of the bus is changed 6 7 1 HBUSREQ The bus request signal is used by a bus master to request access to the bus E ach bus master has its own HBUSREQ signal to the arbiter and there can be up to 16 separate bus masters in any system 6 7 2 HLOCK Thelock signal is asserted by a master at the same time as the bus request signal This indicates tothearbiter that the master is performing a number of indivisibletransfers and the arbiter must not grant any other bus master access to the bus once the first transfer of the locked transfers has commenced HL OCK must be asserted at least a cycle before the address to which it refers to prevent the arbiter from changing the grant signals 6 7 3 HG
173. our System The Domain Access Control Register bit assignments are shown in Table 9 2 Table 9 2 Domain Access Control Register bit assignments Bit Function 31 28 Contain a fixed pattern that denotes the EmbeddedICE RT version number This must be b0111 when using MRC operation to read it b0100 when using scan operation to read it 27 2 SBZ 1 The write control bit If this bit is clear the DCC data write register is ready to accept data from the processor If this bit is set there is data in the DCC data write register and the debugger can scan it out 0 The read control bit If this bit is clear the DCC data read register is ready to accept data from the debugger If this bit is set the DCC data read register contains new data that has not been read by the processor and the debugger must wait Note If execution is halted bit O might remain asserted The debugger can clear it by writing to the Domain Access Control Register Writing to this register is rarely necessary because in normal operation the processor clears bit O after reading it Instructions The following instructions must be used MRC CP14 0 Rd CO CO Returns the value from the Domain Access Control Register into the destination register Rd MCR CP14 0 Rn C1 CO Writes the value in the source register Rn tothe DCC data write register MRC CP14 0 Rd C1 CO B Returns the value from the DCC data read register int
174. output 6 DATA 5 Input output 7 DATA 6 Input output 8 DATA T Input output 9 DATA 8 Input output 10 DATA 9 Input output 11 DATA 10 Input output 12 DATA 11 Input output 13 DATA 12 Input output 14 DATA 13 Input output ARM720T CORE CPU MANUAL EPSON 9 25 9 Debugging Your System Table 9 6 Scan chain 1 cells continued 9 16 Number Signal Type 15 DATA 14 Input output 16 DATA 15 Input output 17 DATA 16 Input output 18 DATA 17 Input output 19 DATA 18 Input output 20 DATA 19 Input output 21 DATA 20 Input output 22 DATA 21 Input output 23 DATA 22 Input output 24 DATA 23 Input output 25 DATA 24 Input output 26 DATA 25 Input output 27 DATA 26 Input output 28 DATA 27 Input output 29 DATA 28 Input output 30 DATA 29 Input output 31 DATA 30 Input output 32 DATA 31 Input output 33 DBGBREAK Input Examining the core and the system in debug state When the ARM 720T processor is in debug state you can examinethe core and system state by forcing the load and store multiples into the instruction pipeline Before you can examinethe core and system state the debugger must determine whether the processor entered debug state from Thumb state or ARM state by examining bit 4 of the Embedded CE RT debug status register as follows Bit 4 HIGH Bit 4 LOW The core has entered debug from Thumb state The core has entered debug from
175. p in all the processors it can be applied to them simultaneously by entering the RUN TEST IDLE state 9 24 3 Forcing DBGACK Figure 9 17 on page 9 42 shows that the value of the internal signal DBGACKI from the core is ORed with the value held in bit O of the Debug Control Register to generate the external value of DBGACK seen at the periphery of the ARM 720T core This enables the debug system tosignal totherest of the system that the coreis still being debugged even when system speed accesses are being performed when the internal DBGACK signal from the core is LOW 9 40 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 25 Debug status register The debug status register is 13 bits wide If it is accessed for a write with the read write bit set the status bits are written If it is accessed for a read with the read write bit clear the status bits are read The format of the debug status register is shown in Figure 9 16 12 11 5 4 3 2 1 0 DBGMOE TBIT TRANS 1 IFEN DBGRQ DBGACK Figure 9 16 Debug status register format The function of each bit in this register is shown in Table 9 11 Table 9 11 Debug status register bit assignments Bit Function 12 Enables the debugger to determine whether the core has entered debug state due to the assertion of DBGRO 4 Enables TBIT to be read This enables the debugger to determine what state the processor is in and which instructions to exec
176. p15 4 Rd c15 c11 0 read to C15 M SBZ MCR p15 4 Rd 15 c3 5 RAM write PA Tag Size MCR p15 4 Rd c15 c3 1 CAM match RAM1 read to C15 M MVA MCR p15 4 Rd c15 c13 4 Read C15 M Data MRC p15 4 Rd c15 c3 0 Figure 11 12 shows the format of Rd for CAM writes and data for CAM reads 31 10 9 6543210 MVA TAG SIZEC VIP SBZ Figure 11 12 Rd format CAM write and data format CAM read In Figure 11 12 on page 11 10 V isthe Valid bit P is the Preserve bit and SIZE C sets the memory region size The allowed values of SIZE C are shown in Table 11 7 Table 11 7 CAM memory region size SIZE C 3 0 Memory region size b1111 1MB b0111 64KB 60011 16KB b0001 4KB b0000 1KB Figure 11 13 shows the format of Rd for RAM 1 writes 31 22 21 6543 0 SBZ DOMAIN one hot encoding AP D15 DO um nC Figure 11 13 Rd format RAM1 write 11 10 EPSON ARM720T CORE CPU MANUAL 11 Test Support In Figure 11 13 AP 3 0 determines the setting of the access permission bits for a memory region The allowed values are shown in Table 11 8 Table 11 8 Access permission bit setting AP 3 0 Access permission bits b1000 b11 b0100 b10 b0010 b01 b0001 b00 Figure 11 14 shows the data format for RAM1 reads 31 25 24 23 22 21 6543 0 SBZ DOMAIN one hot encoding AP D15 DO Prot d T
177. placing the value of a core output into the serial register During shift this value is serially output as before The value applied to the system from an output cell is either the core output or the contents of the serial register All the control signals for the scan cells are generated internally by the TAP controller The action of the TAP controller is determined by current instruction and thestate of the TAP state machine Scan chain 1 Purpose Scan chain 1 is used for communication between the debugger and the ARM 720T core It is used to read and write data and to scan instructions intothe pipeline The SCAN_N TAP instruction can be used to select scan chain 1 Length 33 bits 32 bits a for the data value and 1 bit for the scan cell on the DBGBREAK core input Scan chain order From DBGTDI to DBGTDO theARM 720T processor data bits bits O to 31 then the 33rd bit the DBGBREAK scan cell Scan chain 1 bit 33 serves three purposes Under normal INTEST test conditions it enables a known value to be scanned into the DBGBREAK input While debugging the value placed in the 33rd bit determines whether the ARM 720T core synchronizes back to system speed before executing the instruction See System speed access on page 9 31 for more details After the ARM 720T core has entered debug state the value of the 33rd bit on the first occasion that it is captured and scanned out tells the debugger whether the core entered debug st
178. ps onto ARM state r13 Thumb state LR maps onto ARM state r14 Thumb state PC maps onto ARM state PC r15 This relationship is shown in Figure 2 5 Thumb state ARM state Low registers High registers Figure 2 5 Mapping of Thumb state registers onto ARM state registers 2 6 4 Accessing high registers in Thumb state In Thumb state ARM registers r8 r15 the high registers are not part of the standard register set However the assembly language programmer has limited access tothem and can use them for fast temporary storage A value can be transferred from a register in the range r0 r7 a low register to a high register and from a high register to a low register using special variants of the MOV instruction High register values can also be compared against or added to low register values with the CMP and ADD instructions Seethe ARM Architecture Reference Manual for details on high register operations ARM720T CORE CPU MANUAL EPSON 2 7 2 Programmer s Model 2 7 Program status registers The ARM 720T processor contains a CPSR and five SPSRs for use by exception handlers These registers e hold information about the most recently performed ALU operation control the enabling and disabling of interrupts set the processor operating mode The arrangement of bits is shown in Figure 2 6 Condition code flags Control bits 31 30 29 28 27 87 6 Overflow V Mode bits M 4 0 Carry or borrow or
179. re compatible with the ARM processor family The on chip mixed data and instruction cache together with the write buffer substantially raise the average executi on speed and reduce the average amount of memory bandwidth required by the processor This enables the external memory to support additional processors or Direct Memory Access DMA channels with minimal performance loss TheMMU supports a conventional two level page table structure and several extensions that make it ideal for running high end embedded applications and sophisticated operating systems The allocation of virtual addresses with different task 105 improves performance in task switching operations with the cache enabled These relocated virtual addresses are monitored by the Embeddedl CE RT block The memory interface enables the performance potential to be realized without incurring high Costs in the memory system Speed critical control signals are pipelined to allow system control functions to beimplemented in standard low power logic These control signals permit the exploitation of paged mode access offered by industry standard DRAMs TheARM 720T processor is provided with an Embedded Trace ETM interface that brings out the required signals fromthe ARM coretothe periphery of the ARM 720T processor This enables you to connect a standard 7 macrocell The ARM 720T processor is a fully static part and has been designed to minimize power require
180. reater in Thumb state This signal can be used with the low order address lines to indicate that the next cycle can use a fast memory mode and bypass the address translation system ETMnEXEC Output Not executed When HIGH indicates that the instruction in the execution unit is not being executed For example it might have failed the condition check code ETMnCPI Output Not coprocessor instruction When the ARM720T processor executes a coprocessor instruction it takes the ETMnCPI LOW and waits for a response from the coprocessor The actions taken depend on this response which the coprocessor signals on the CPA and CPB inputs ETMADDR S1 0 Output Addresses This is the retimed internal address bus ETMnOPC Output Not opcode fetch When LOW indicates that the processor is fetching an instruction from memory When HIGH indicates that data if present is being transferred ETMDBGACK Output Debug acknowledge When HIGH indicates that the processor is in debug state When LOW indicates that the processor is in normal system state ETMABORT Output Memory abort or bus error Indicates that a requested access has been disallowed ETMCPA Output Coprocessor absent handshake The coprocessor absent signal It is a buffered version of the coprocessor absent signal ETMCPB Output Coprocessor busy handshake The coprocessor busy signal It is a buffered version of the coprocessor absent signal
181. ress bits 11 0 Tiny page base Indexed by modified virtual address bits 9 0 Figure 7 2 Translating page tables Section 1MB Large page 16 KB subpage 16 KB subpage 16 KB subpage 16 KB subpage 64 KB Small page 1 KB subpage 1 KB subpage 1 KB subpage 1 KB subpage AKB Tiny page 1KB ARM720T CORE CPU MANUAL EPSON 7 5 7 Memory Management Unit 7 3 2 Level one fetch Bits 31 14 of the Translation Table Base Register are concatenated with bits 31 20 of the MVA to produce a 30 bit address as shown in Figure 7 3 Modified virtual address 31 20 19 0 Translation table base 31 14 13 0 Translation base 3 14 13 1 210 Translation base Table index ioo 31 J 0 Level one descriptor Figure 7 3 Accessing translation table level one descriptors This address selects a 4 byte translation table entry This is a level one descriptor for either a section or a page table 7 3 3 Level one descriptor Thelevel one descriptor returned is either a section descriptor a coarse page table descri ptor or a fine page table descriptor or is invalid Figure 7 4 shows the format of a level one descri ptor 31 20 19 1211 10 9 8 5432 4 Coarse page table base address Fault Coarse page table Section Fi table base add Domain 1 1 4 Fee Ine page table base a ress omain page table Figure 7 4 Level
182. rface THIS PAGE IS BLANK 6 14 EPSON ARM720T CORE CPU MANUAL 7 Memory Management Unit 7 Memory Management Unit 7 Memory Management Unit This chapter describes the Memory Management Unit MMU It contains the following sections 7 1 About this MM U sive rette rica 7 1 7 2 MMU program accessible registers esee 7 3 7 3 Address translation uttter a 7 4 7 4 MMU faults and CPU ab Bin aa 7 15 7 5 Fault address and fault status 7 16 7 6 Domain access control oec tert TE d Ed cos ded re e pret ut dde 7 17 7 7 Fault checking SOUR CS an en en 7 19 7 8 External ADOS s ea dvds eed aie nennen 7 21 7 9 Interaction of the MMU and 7 21 7 1 About the MMU The ARM 720T processor implements an enhanced ARM architecture v4 MMU to provide translation and access permission checks for the instruction and data address ports of the core TReMMU is controlled from a single set of two level page tables stored in main memory that are enabled by the M bit in CP 15 register 1 providing a single address translation and protection scheme TheMMU features are standard ARM v4 MMU mapping sizes domains and access protection scheme mapping sizes are 1MB sections 64K B large pages 4K B small pages and IKB tiny pages access permissions for sections access permissions for large
183. rite rk ete de coole reet dbi pr e 11 10 Data format RAM1 read 11 11 Rd format RAM2 write and data format RAMe read 11 11 Rd format write TLB lockdown eeeeeeeen nnn 11 12 ARM720T CORE CPU MANUAL EPSON V CONTENTS List of Tables Table 1 1 Key 10 tables Ares CPI 1 6 Table 1 2 ARM instruction summary iaa 1 8 Table 1 3 Addressing mode Arta 1 10 Table 1 4 Addressing mode 2 privileged uses 1 11 Table 1 5 Addressing mode 3 casio ee ee 1 11 Table 1 6 Addressing mode 4 load nun ni 1 11 Table 1 7 Addressing mode 4 nnn 1 12 Table 1 8 Addressing mode DS 1 12 Table 1 9 2 oscar ee A 1 12 Table 1 10 ulcer 1 12 Table 1 11 Condition 5 cuc educ ib 1 13 Table 1 12 Thumb instruction SUMMA a id cada 1 15 Table 2 1 ARM720T modes of operation cooooonoccccnnnccnnonccccccnnnnnnncncnnnnnnnnanancnnnnnno 2 4 Table 2 2 PSR mode bit Vallas M RE 2 9 Table 2 3 Exception entry and 2 11 Table 2 4 Exception vector addresses cisco ici inta Fun eos exp 2 13 Table 3 1 Cache and MMU Control Register 3 3 Table 3 2 eee a ada das 3 7 Table 3 3 TEBrOBerallans rc 3 7 Table 6 1 Transfer type encoding 6 5 Table 6 2 Transfer size en
184. rns the value of the Fast Context Switch Extension F CSE Process Dentifier PI D FCSCE PID Register format is shown in Figure 3 10 31 25 24 00 FCSE PID UNP SBZ Figure 3 10 FCSCE PID Register format Note Only bits 31 25 are returned The remaining 25 bits are Unpredictable Writing to CP 15 Register 13 with opcode 2 0 updates the FCSE PID from the value in bits 31 25 Bits 24 0 Should Be Zero The FCSE PID is set to b0000000 on Reset The CRm and opcode 2 Should Be Zero when reading or writing the FCSE PID Changing FCSE PID You must take care when changing the FCSE PID because the following instructions have been fetched with the previous FCSE PID In this way changing the FCSE PID has similarities with a branch with delayed execution See Relocation of low virtual addresses by the FCSE PID on page 2 15 Trace Process Identifier Register A 32 bit read write register is provided to hold a Trace PROCess Dentifier PROCID up to 32 bits in length visible to the ETM7 This is achieved by reading from or writing to the PROCI D Register with opcode 2 set to 1 PROCID Register format is shown in Figure 3 11 31 00 Trace PROCID Figure 3 11 PROCID Register format The PROCIDWR signal is exported to notify the ETM7 that the Trace PROCID has been written 3 8 EPSON ARM720T CORE CPU MANUAL 3 Configuration 3 3 10 Register 14 reserved Accessing this register is undefined Writing to Register 14 is Undefined 3
185. rocessor Refer to the following documents for other relevant information ARM Architecture Reference Manual ARM DDI 0100 AMBA Specification Rev 2 0 ARM 0011 ETM7 Rev 1 Technical Reference Manual ARM DDI 0158 ARM 7TDMI S Rev 4 Technical Reference Manual ARM DDI 0234 Other publications This section lists relevant documents published by third parties Standard Test Access Port and Boundary Scan Architecture lEEE Std 1149 1 1990 Figure 9 8 on page 9 19 is printed with permission IEEE Std 1149 1 1990 IEEE Standard Test Access Port and Boundary Scan Architecture Copyright 2001 by IEEE ThelEEE disclaims any responsibility or liability resulting from the placement and use the described manner ARM720T CORE CPU MANUAL EPSON xiii Preface THIS PAGE IS BLANK xiv EPSON ARM720T CORE CPU MANUAL 1 Introduction 1 Introduction 1 Introduction This chapter provides an introduction to the ARM 720T processor It contains the following sections 1 1 About the ARM 720T processor css seele 1 1 1 2 CODI OCOSSOLS toes ata dense rca N 1 5 1 3 About theinstruction St na T o aunts 1 5 1 4 Silico E 1 16 1 1 About the ARM720T processor The ARM 720T processor is a general purpose 32 bit microprocessor with 8K B cache enlarged write buffer and Memory Management Unit MMU combined in a single chip The ARM 720T processor uses the ARM 7TDMI S CPU and is softwa
186. rs for the ARM 720T processor synthesized logic and TCM It contains the following sections 11 1 About the ARM 720T test 11 1 11 2 Automatic Test Pattern Generation 11 2 11 3 Test State Register 11 3 11 4 Cachetest registers and 11 3 11 5 test registers and 11 8 11 1 About the ARM720T test registers Coprocessor 15 register c15 of the ARM 720T processor is used to provide device specific test operations You can use it to access and control the following Test State Register on page 11 3 Cache test registers and operations on page 11 3 MMU test registers and operations on page 11 8 You must only use these operations for test The ARM Architecture Reference Manual describes this register as implementation defined The format of the CP 15 test operations is MCR MRC p15 opcode 1 Rd c15 lt CRm gt opcode 2 31 14 13 12 10 09 08 07 06 05 04 03 02 01 00 Figure 11 1 CP15 MRC and MCR bit pattern TheL bit distinguishes between an MCR L set to 1 and an MRC L set to 0 ARM720T CORE CPU MANUAL EPSON 11 1 11 Test Support 11 2 Automatic Test Pattern Generation ATPG Scan insertion is already performed and fixed for the ARM 720T processor You
187. ry scan interface is not to be used you can tiethe DBGnTRST input L OW The action of reset is as follows System mode is selected This means that the boundary scan cells do not intercept any of the signals passing between the external system and the core ThelDCODE instruction is selected When theTAP controller is put intothe SHIFT DR state and HCLK is pulsed while enabled by DBGTCKEN the contents of the ID register are clocked out of DBGTDO 1 2 ARM720T CORE CPU MANUAL EPSON 9 19 9 Debugging Your System 9 13 Public JTAG instructions Table 9 4 shows the public TAG instructions Table 9 4 Public instructions Instruction Binary code SCAN_N b0010 INTEST b1100 IDCODE b1110 BYPASS b1111 RESTART b0100 In thefollowing descriptions theARM 720T processor samples DBGTDI and DBGTMS on the rising edge of HCLK with DBGTCKEN HIGH The TAP controller states are shown in Figure 9 8 on page 9 19 9 13 1 60010 TheSCAN N instruction connects the scan path select register between DBGTDI and DBGTDO In the CAPTURE DR state the fixed value b1000 is loaded into the register IntheSHIFT DR state the ID number of the desired scan path is shifted into the scan path select register In theUPDATE DR state the scan register of the selected scan chain is connected between DBGTDI and DBGTDO and remains connected until a subsequent SCAN N instruction is issued On reset scan c
188. s LOW DBGBREAK and DBGRQ are ignored by the core Note DBGACK is forced LOW by the ARM 720T core interrupts pass through to the processor uninhibited the Embedded CE RT logic enters low power mode Caution Hard wiringthe DBGEN input LOW permanently disables debug state information However you must not rely on this for system security control register on page 9 39 Bit 5 is also known as the Embeddedl CE RT disable bit You must set bit 5 before doing either of the following Temporarily By setting bit 5 in the Debug Control Register described in Debug B programming breakpoint or watchpoint registers changing bit 4 of the Debug Control Register ARM720T CORE CPU MANUAL EPSON 9 11 9 Debugging Your System 9 8 EmbeddediCE RT register map The locations of the Embeddedl RT registers are shown in Table 9 1 Table 9 1 Function and mapping of EmbeddedICE RT registers Address Width Function b00000 6 Debug control b00001 5 Debug status b00100 32 Debug Communications Channel DCC control register b00101 32 Debug Communications Channel DCC data register b01000 32 Watchpoint 0 address value b01001 32 Watchpoint 0 address mask b01010 32 Watchpoint O data value b01011 32 Watchpoint O data mask b01100 9 Watchpoint 0 control value b01101 8 Watchpoint O control mask b10000 32 Watchpoint 1address value b10001 32 Watchpoint 1 address mask b10010 32 Watchp
189. s and control signals These signals provide the following information about the transfer address direction width of the transfer whether the transfer forms part of a burst the type of burst A burst is a series of transfers The ARM720T processor performs the following types of burst Incrementing burst of unspecified length 8 beat incrementing burst only used during linefill Incrementing bursts do not wrap at address boundaries The address of each transfer in the burst is an increment of the address of the previous transfer in the burst For more information see Address and control signals on page 6 7 For a complete description of the AHB transfer mechanism seethe AMBA Specification Rev 2 0 6 2 EPSON ARM720T CORE CPU MANUAL 6 The Bus Interface 6 2 Bus interface signals The signals in the ARM 720T processor bus interface can be grouped into the following categories Transfer type Address and control HTRANS 1 0 See Transfer types on page 6 5 HADDR 31 0 HWRITE HSIZE 2 0 HBURST 2 0 HPROT 3 0 See Address and control signals on page 6 7 Slave transfer response Data Arbitration Clock Reset HREADY HRESP 1 0 See S ave transfer response signals on page 6 9 HRDATA 31 0 B HWDATA 31 0 See Data buses on page 6 10 HBUSREQ HGRANT HLOCK See Arbitration on page 6 12 HCLK HCLKEN See Bus Clocking on page 6 13 HRESETn See Reset on page 6 13 E
190. s are combined with those using registers c7 and c9 to enable testing of the cache entirely in software CP 15 register c7 is write only and provides only one function invalidate cache The CP15 register c9 operations are read and write The operations available are write victim and lockdown base write victim The CP15 register c15 operations are write to register C15 C read from register C15 C CAM read to C15 C CAM write RAM read to C15 C RAM write from C15 C CAM match RAM read to C15 C Note For the CAM Match RAM Read operation the respective MMU does not perform a lookup and a cache miss does not cause a linefill Theregister c15 operations are all issued as MCR The Rd field defines the address for the operation Therefore the data is either supplied from or latched into CP15 C in CP 15 These 32 bit registers are accessed with CP15 MCR and MRC instructions ARM720T CORE CPU MANUAL EPSON 11 3 11 Test Support Table 11 3 summarizes register c7 c9 and c15 operations Table 11 8 Summary of CP15 register c7 c9 and c15 operations Function Rd Instruction Write cache victim and lockdown base Victim Base MCR p15 0 Ra c9 c0 0 Write cache victim Victim Seg MCR p15 0 Ra c9 c1 0 CAM read to C15 C Seg MCR p15 2 Rd c15 c7 2 CAM write Tag Seg Dirty MCR p15 2 Rd c15 c7 6 RAM read to C15 C Seg Word MCR p15 2 Rd c15 c1
191. s integrated on chip debug support for the ARM 720T core It enables you to program the conditions under which a breakpoint or watchpoint can occur The Embeddedl CE RT logic is an enhanced implementation of Embeddedl CE and enables you to perform debugging in monitor mode In monitor mode the core takes an exception on a breakpoint or watchpoint rather than entering debug state as it does in halt mode If the core does not enter debug state when it encounters a watchpoint or breakpoint it can continue to service hardware interrupt requests as normal Debugging in monitor mode is useful if the core forms part of the feedback loop of a mechanical system where stopping the core can potentially lead to system failure The Embeddedl CE RT logic contains a Debug Communications Channel DCC The DCC is used to pass information between the target and the host debugger The E mbeddedl CE RT logic is controlled through the oint Test Action Group Y TAG test access port ARM720T CORE CPU MANUAL EPSON 1 3 1 Introduction Changes to the programmer s model To provide support for the Embeddedl CE RT macrocell thefollowing changes have been made to the programmer s model for the ARM 720T processor Debug Control Register There aretwo new bits in the Debug Control Register Bit 4 Monitor mode enable Usethis to control how the device reacts on a breakpoint or watchpoint When set the core takes the instruction or data abort exception
192. s to commands or functions where the argument is to be replaced by a specific value monospace bold Denotes language keywords when used outside example code Product revision status The rnpn identifier indicates the revision status of the product described in this document where rn Identifies the major revision of the product pn Identifies the minor revision or modification status of the product xii EPSON ARM720T CORE CPU MANUAL Preface Timing diagram conventions components used in these diagrams Any variations are clearly labeled when they occur This manual contains one or more timing diagrams The following key explains the Therefore no additional meaning must be attached unless specifically stated Clock HIGH to LOW Transient Y HIGH LOW to HIGH dg Bus stable Bus to high impedance Y Bus change Y y High impedance to stable bus Key to timing diagram conventions Shaded bus and signal areas are undefined sothe bus or signal can assume any value within the shaded area at that time The actual level is unimportant and does not affect normal operation Further reading This section lists publications by ARM Limited and by third parties ARM periodically provides updates and corrections to its documentation See http www arm com for current errata sheets addenda and ARM Frequently Asked Questions ARM publications This document contains information that is specific to the ARM 720T p
193. sary 4 EPSON ARM720T CORE CPU MANUAL Glossary Saved Program Status Register The Saved Program Status Register which is associated with the current processor mode and is undefined if there is such Saved Program Status Register as in User mode or System mode See alsoProgram Status Register SBO SeeShould Be One fields SBZ SeeShould Be Zero fields Should Be One fields Should be written as one or all ones for bit fields by software Values other than one produces Unpredictable results See alsoShould Be Zero fields Should Be Zero fields Should be written as zero or all Os for bit fields by software Values other than zero produce U npredictable results See alsoShould Be One fields Software Interrupt Instruction This instruction SWI enters Supervisor mode to request a particular operating system function SPSR SeeSaved Program Status Register Stack pointer A register or variable pointing tothetop of a stack If the stack is full stack the SP points to the most recently pushed item else if the stack is empty the SP points to the first empty location where the next item will be pushed Status registers SeeProgram Status Register SP SeeStack pointer SWI See Software Interrupt Instruction TAP See Test access port m ARM720T CORE CPU MANUAL EPSON Glossary 5 Glossary Test Access Port The collection of four mandatory and one optional terminals that form the input output and control in
194. sor A changetothe FCSE PID exhibits similar behavior to a delayed branch if the two instructions fetched immediately following an instruction to change the FCSE PID are fetched with a relocation to the previous FCSE PID the addresses of the instructions being fetched lie within the range of addresses to be relocated On reset the FCSE PID register bits 31 25 are set to b0000000 disabling all relocation For this reason the low address reset exception vector is effectively never relocated by this mechanism Note AIl addresses produced by the processor core undergothis translation if they liein the appropriate address range This indudes the exception vectors if they are configured to lie in the bottom of the virtual memory map This configuration is determined by the V bit in the CP15 Control Register cl ARM720T CORE CPU MANUAL EPSON 2 15 2 Programmer s Model 2 10 Reset When the HRESETn signal goes LOW the ARM 720T processor U AUNE Abandons the executing instruction Flushes the cache and Translation Lookaside Buffer TLB Disables the Write Buffer WB cache and MMU Resets the FCSE PID Continues to fetch instructions from incrementing word addresses When HRESETn is LOW the processor samples the VINITHI external input and stores the result in the V bit in CP15 register 1 When HRESETn goes HIGH again the ARM 720T processor 1 2 Overwrites r14 svc and SPSR_svc by copying the current valu
195. ss mask of 0x0000001 F 2 Clear the ENABLE bit 3 Program all other Watchpoint 1 registers as normal for a breakpoint An address within the first 32 bytes causes the RANGE output to go HIGH but does not trigger the breakpoint For Watchpoint 0 1 Program Watchpoint O with an address value of 0x00000000 and an address mask of 0x000000FF 2 Set the ENABLE bit 3 Program the RANGE bit to match a O 4 Program all other Watchpoint O registers as normal for a breakpoint If Watchpoint O matches but Watchpoint 1 does not that is the RANGE input to Watchpoint 0 is 0 the breakpoint is triggered 9 27 EmbeddedlCE RT timing Embedded CE RT samples the DBGEXT 1 and DBGE XT 0 inputs on the rising edge of HCLK 9 44 EPSON ARM720T CORE CPU MANUAL 10 ETM Interface 10 ETM Interface 10 ETM Interface This chapter describes the ETM interface that is provided on the ARM 720T processor It contains the following sections 10 1 JAbout the ESM Inte sence rei Sal 10 1 10 2 Enabling and disabling the ETM 7 10 1 10 3 Connections between the ETM 7 macrocell and the ARM 720T processor 10 2 TOA Clocks and cera ae fretus 10 3 10 5 Debug request metre stets 10 3 10 6 TAP interface WINING SA edocet oes de m ren ia pets 10 3 10 1 About the ETM interface You can connect an external Embedded Tra
196. ssions are checked as follows Section If thelevel one descriptor defines a section mapped access the AP bits of the descriptor define whether or not the access is allowed according to Table 7 11 on page 7 18 Their interpretation is dependent on the setting of the S and R bits control register bits 8 and 9 If the access is not allowed a section permission fault is generated Large page or small page If thelevel one descriptor defines a page mapped access and the level two descriptor is for a large or small page four access permission fields AP3 APO are specified each corresponding to one quarter of the page F or small pages ap3 is selected by the top 1KB of the page and apO is selected by the bottom 1K B of the page For large pages ap3 is selected by thetop 16K B of the page and is selected by the bottom 16K B of the page Theselected AP bits are then interpreted in exactly the same way as for a section see Table 7 11 on page 7 18 The only differenceis that the fault generated is a page permission fault Tiny page If thelevel one descriptor defines a page mapped access and the level two descriptor is for a tiny page the AP bits of the level one descriptor define whether or not the access is allowed in the same way as for a section Thefault generated is a page permission fault 7 20 EPSON ARM720T CORE CPU MANUAL 7 Memory Management Unit 7 8 External aborts In addition tothe MMU generated aborts the ARM 720
197. ster on page 3 4 When the CPU performs a write operation the translation entry for that address is inspected and the state of the B bit determines the subsequent action If the write buffer is disabled using the Control Register buffered writes aretreated in the same way as unbuffered writes To enable the write buffer 1 Ensure that the MMU is enabled by setting bit O in the Control Register 2 Enablethe write buffer by setting bit 3 in the Control Register You can enabletheMMU and write buffer simultaneously with a single writetothe Control Register To disablethe write buffer clear bit 3 in the Control Register Any writes already in the write buffer complete normally The write buffer attempts a write operation as long as thereis data present 5 2 1 Bufferable write If the write buffer is enabled and the processor performs a writeto a bufferable area the data is placed the write buffer at the speed of HCLK and the CPU continues execution The write buffer then performs the external write in parallel If the write buffer is full the processor is stalled until there is an empty line in the buffer 5 2 2 Unbufferable write If the write buffer is disabled or the CPU performs a write to an unbufferable area the processor is stalled until the write buffer empties and the write completes externally This might require synchronization and several external clock cycles 5 2 3 Read lock write The write phase of a read lock wr
198. sters you might wish to access the banked registers To do this you must change mode Normally a mode change can occur only if the core is already in a privileged mode H owever while in debug state a mode change from one mode into any other mode can occur The debugger must restore the original mode before exiting debug state For example if the debugger was requested to return the state of the U ser mode registers and FIQ mode registers and debug state was entered in Supervisor mode the instruction sequence might be STM RO r0 r15 Save current registers MRS RO CPSR STR RO RO Save CPSR to determine current mode BIC RO 0x1F Clear mode bits ORR RO 0x10 Select user mode MSR CPSR RO Enter USER mode STM RO r13 r14 Save register not previously visible ORR RO 0x01 Select FIQ mode MSR CPSR RO Enter FIQ mode STM RO r8 r14 Save banked FIQ registers ARM720T CORE CPU MANUAL EPSON 9 27 9 Debugging Your System All these instructions execute at debug speed Debug speed is much slower than system speed This is because between each core clock 33 clocks occur in order to shift in an instruction or shift out data Executing instructions this slowly is acceptable for accessing the core state because the ARM 720T processor is fully static However you cannot use this method for determining the state of the rest of the system While in debug state only the following instructions can be scanned into
199. t In ATPG mode the HRESETn DBGnTRST and TESTENABLE signals are constrained to 1 TheTESTENABLE signal only goes insidethe internal clock module and ensures that all scan flip flops in the design are using the same phase There are no lock up latches between two functional dock domains 11 2 1 ARM720T processor INTEST EXTEST wrapper In addition to the auto inserted scan chains the ARM 720T processor includes all the signals for an optional INTEST EXTEST scan chain scan chain O ATPG Seven balanced scan chains are provided for ATPG along with a test enable and a single scan enable 11 2 EPSON ARM720T CORE CPU MANUAL 11 Test Support 11 3 Test State Register The test state register contains only one bit bit 0 Bit O set Enable MMU and cache test Bit O clear Disable MMU and cache test At reset HRESETn LOW bit 0 is cleared The test state register operations are shown in Table 11 2 Table 11 2 Test State Register operations Erz A Write test register MCR p15 7 Rd c15 c15 7 Read test register MRC p15 7 Rd c15 c15 7 Note Cache and MMU test operations are only supported when the Test State Register is on 11 4 Cache test registers and operations The cache is maintained using MCR and MRC instructions to CP 15 registers c7 and c9 defined by the ARM v4T programmer s model Additional operations are available using MCR and MRC instructions to CP 15 register c15 These operation
200. t Rd gt lt reglist pc gt CPSR User registers LDM cond lt a_mode4L gt Rd lt reglist gt Store Word STR cond Rd a mode2 Word with User Mode privilege STR cond T Rd a mode2P Byte STR cond B Rd a mode2 Byte with User Mode privilege STR cond BT Rd a mode2P Halfword STR cond H Rd a mode3 Multiple block Increment before STM cond IB lt Rd gt lt reglist gt data operations Increment after STM cond IA lt Rd gt lt reglist gt Decrement before STM cond DB lt Rd gt lt reglist gt Decrement after STM cond DA lt Rd gt reglist Stack operations STM cond lt a_mode4S gt lt Rd gt lt reglist gt User registers STM cond lt a_mode4S gt lt Rd gt lt reglist gt Swap Word SWPfcond Rd Rm lt Rn gt Byte SWPfcond B Rd Rm lt Rn gt ARM720T CORE CPU MANUAL EPSON 1 9 1 Introduction Table 1 2 ARM instruction summary continued Operation Assembler Coprocessors Data operations CDP cond p lt cpnum gt lt op1 gt lt CRd gt lt CRn gt lt CRm gt lt op2 gt Move to ARM reg from coproc MRC cond p lt cpnum gt lt op1 gt Rd lt CRn gt lt CRm gt lt op2 gt Move to coproc from ARM reg MCR cond p cpnums lt op1 gt Rd lt CRn gt lt CRm gt lt op2 gt Load LDC cond p lt cpnum gt lt CRd gt lt a_mode5 gt Store STC cond p lt cpnum gt lt CRd gt lt a_mo
201. t can be read and written from JTAG 3 This bit must be clear 2 Used to disable interrupts If set the interrupt enable signal of the core IFEN is forced LOW The IFEN signal is driven as shown in Table 9 10 If clear interrupts are enabled 1 Used to force the value on DBGRQ 0 Used to force the value on DBGACK ARM720T CORE CPU MANUAL EPSON 9 39 9 Debugging Your System 9 24 4 Disabling interrupts IRQs and FIQs are disabled under the following conditions during debugging DBGACK HIGH when the INTDIS bit is set The interrupt enable signal IFEN is driven as shown in Table 9 10 Table 9 10 Interrupt signal control DBGACK INTDIS IFEN Interrupts 0 0 1 Permitted 1 X 0 Inhibited x 1 0 Inhibited 9 24 2 Forcing DBGRQ Figure 9 17 on page 9 42 shows that the value stored in bit 1 of the Debug Control Register is synchronized and then ORed with the external DBGRQ before being applied tothe processor The output of this OR gate is the signal DBGRQI which is brought out externally from the macrocell The synchronization between Debug Control Register bit 1 and DBGRQI assists multiprocessor environments The synchronization latch only opens when the TAP controller state machine is in the RUN TEST IDLE state This enables an enter debug condition to be set up in all the processors in the system while they are still running When the condition is set u
202. t is shown in Figure 3 8 3130 09 08 07 06 04 03 00 Figure 3 8 Fault Status Register format 3 6 EPSON ARM720T CORE CPU MANUAL 3 Configuration 3 3 6 Fault Address Register Reading CP15 Register 6 returns the value of the Fau t Address Register FAR The FAR holds the virtual address of the access that was attempted when a fault occurred The FAR is only updated on data faults There is no update on prefetch faults Writing to CP 15 Register 6 sets the FAR tothe value of the data written This is useful when a debugger has torestore the value of the FAR The CRm and opcode 2 fields Should Be Zero when reading or writing CP 15 Register 6 Fault Address Register format is shown in Figure 3 9 31 00 Fault address Figure 3 9 Fault Address Register format Note Register 6 contains a modified virtual address if the FCSE PID register is nonzero 3 3 7 Cache Operations Register Writing to CP 15 Register 7 manages the unified instruction and data cache of the ARM 720T Only one cache operation is defined using the following opcode 2 and CRm fields the MCR instruction that writes the CP 15 Register 7 Caution ThelnvalidatelD cache function invalidates all cache data Use this with caution Register 7 is shown in Table 3 2 Table 3 2 Cache operation Invalidate ID MCR p15 0 Rd 0 cache Reading from CP 15 Register 7 is undefined 3 3 8 Operations Register Writing to
203. t leave the interrupt by executing SUBS PC r14 fiq 4 FIQ can be disabled by setting the F flag in the CPSR Note This is not possible from U ser mode If theF flag is clear the ARM 720T processor checks for a LOW level on the output of the FIQ synchronizer at the end of each instruction 2 8 5 Interrupt request TheIRQ exception is a normal interrupt caused by a LOW level on the nI RQ input IRQ has a lower priority than and is masked out when a FIQ sequence is entered It can be disabled at any time by setting thel bit in the CPSR though this can only be done from a privileged non U ser mode Irrespective of whether the exception was entered from ARM or Thumb state an IRQ handler must return from the interrupt by executing SUBS PC r14 4 2 8 6 Abort An abort indicates that the current memory access cannot be completed It can be signaled either by the protection unit or by the HRESP bus The ARM 720T processor checks for the abort exception during memory access cydes There are two types of abort as follows Prefetch Abort This occurs during an instruction prefetch The prefetched instruction is marked as invalid but the exception is not taken until the instruction reaches the head of the pipeline If the instruction is not executed for example because a branch occurs while it is in the pipeline the abort does not take place Data Abort This occurs during a data access The action taken depends on
204. tails ARM720T CORE CPU MANUAL EPSON 9 17 9 Debugging Your System Scan chain 15 Scan chain 15 is dedicated to the system control coprocessor registers the CP15 registers There are 37 bits in scan chain 15 From DBGTDI to DBGTDO the order of the bits is read write bit instruction encoding bits 3 0 see Table 9 3 data bus bits 31 through 0 Bit O of the data field is the first bit to be scanned in and the first to be scanned out The 4 bit instruction encodings for scan chain 15 are shown in Table 9 3 Table 9 3 Instruction encodings for scan chain 15 Encoding Instruction b0000 ID register access read only b0001 Control register access read write b0010 Translation Table Base Register access read write b0011 DAC register access read write b0100 FSR register access read write b0101 FAR register access read write b0110 FCSE PID register access read write b0111 TRACE PROCID register access read write b1000 Invalidate cache write only b1001 Invalidate TLB write only b1010 Invalidate TLB single entry write only Note Theinstructions shown in Table 9 3 areonly executed during update To perform a read the processor must return to capture state and then shift the result out In the capture stage the instruction field of scan chain 15 is RAZ 9 11 2 Controlling the JTAG interface The TAG interface is driven by the currently loaded instruction in the instructio
205. ted instruction and two other instructions that have been prefetched On entry to debug statethe pi pelineis flushed On exit from debug state the pipeline must therefore revert to its previous state Because of the debugging process more memory accesses occur than are expected normally DBGACK can inhibit any system peripheral that might be sensitive to the number of memory accesses F or example a peripheral that counts the number of memory cydes must return the same answer after a program has been run with and without debugging Figure 9 11 shows the behavior of the ARM 720T processor on exit from the debug state HCLK HTRANS Internal cycles Ss Y HADDR 31 0 Ab Ab 4 Ab 8y Y PATA TO Op a DBGACK Figure 9 11 Debug exit sequence ARM720T CORE CPU MANUAL EPSON 9 29 9 Debugging Your System Figure 9 3 on page 9 5 shows that the final memory access occurs in the cyde after DBGACK goes HIGH This is the point at which the cycle counter must be disabled Figure 9 11 on page 9 29 shows that the first memory access that the cycle counter has not previously seen occurs in the cycle after DBGACK goes LOW This is the point at which to reenable the counter Note When a system speed access from debug state occurs the ARM 720T processor temporarily drops out of debug state so DBGACK can go LOW If there are peripherals
206. ter restoring the internal state a branch instruction must be loaded into the pipeline See The program counter during debug on page 9 30 for details on calculating the branch Bit 33 of scan chain 1 forces the ARM 720T processor to resynchronize back to H CLKEN clock enable The penultimate instruction of the debug sequenceis scanned in with bit 33 set HIGH Thefinal instruction of the debug sequence is the branch which is scanned in with bit 33 LOW The is then clocked to load the branch instruction into the pipeline and the RESTART instruction is selected in the TAP controller When the state machine enters the RUN TEST I DLE state the scan chain reverts back to System mode The ARM 720T processor then resumes normal operation fetching instructions from memory This delay until the state machineis in the RUN TEST IDLE state enables conditions to be set up in other devices in a multiprocessor system without taking immediate effect When the state machine enters the RUN TEST I DLE state all the processors resume operation simultaneously DBGACK informs therest of the system when the ARM 720T processor is in debug state This information can be used to inhibit peripherals such as watchdog ti mers that have real time characteristics DBGACK can also mask out memory accesses caused by the debugging process For example when the ARM 720T processor enters debug state after a breakpoint the instruction pipeline contains the breakpoin
207. terface to a J TAG boundary scan architecture The mandatory terminals are TDI TDO TMS and TCK The optional terminal is nTRST Thumb instruction Thumb state UND Undefined UNP Unpredictable A halfword which specifies an operation for an ARM processor in Thumb state to perform Thumb instructions must be halfword aligned A processor that is executing Thumb 16 bit instructions is operating in Thumb state SeeUndefined Indicates an instruction that generates an undefined instruction trap SeeUnpredictable Means the result of an instruction cannot be relied upon Unpredictable instructions must not halt or hang the processor or any parts of the system Unpredictable fields Watchpoint Do not contain valid data and a value can vary from moment to moment instruction to instruction and implementation to implementation A location in theimagethat is monitored If the valuestored there changes the debugger halts execution of the image See alsoBreakpoint Glossary 6 EPSON ARM720T CORE CPU MANUAL Index Index Index Theitems in this index arelisted in alphabetical order with symbols and numerics appearing at the end The references given are to page numbers A Abort Data 9 6 9 31 handler 9 6 mode 2 4 Prefetch 9 32 vector 9 31 Abort status register 9 38 Aborted watchpoint 9 31 Aborts Data 2 12 indexed addressing 2 17 prefetch 2 12 types 2 12 Access permission 7 2 bits 7 18
208. tes an alignment fault the access sequence aborts without reference to more permission checks ARM720T CORE CPU MANUAL EPSON 7 19 7 Memory Management Unit 7 7 2 Translation fault There aretwotypes of translation fault Section A section translation fault is generated ifthelevel one descriptor is marked as invalid This happens if bits 1 0 of the descriptor are both 0 Page A page translation fault is generated if the level two descriptor is marked as invalid This happens if bits 1 0 of the descriptor are both 0 7 7 3 Domain fault There aretwo types of domain fault Section Thelevel one descriptor holds the 4 bit domain field which selects one of the 16 2 bit domains in the Domain Access Control Register Thetwo bits of the specified domain are then checked for access permissions as described in Table 7 11 on page 7 18 The domain is checked when the level one descriptor is returned Page Thelevel one descriptor holds the 4 bit domain field which selects one of the 16 2 bit domains in the Domain Access Control Register Thetwo bits of the specified domain are then checked for access permissions as described in Table 7 11 on page 7 18 The domain is checked when the level one descriptor is returned If the specified access is either no access b00 or reserved b10 then either a section domain fault or page domain fault occurs 7 7 4 Permission fault If the 2 bit domain field returns 01 dient then access permi
209. the instruction pi peline for execution all data processing operations all load store load multiple and store multiple instructions MSR and MRS 9 16 2 Determining system state To meet the dynamic timing requirements of the memory system any attempt to access system state must occur with the clock qualified by HCLKEN To perform a memory access HCLKEN must used to force the ARM 720T processor torun in normal operating mode This is controlled by bit 33 of scan chain 1 An instruction placed in scan chain 1 with bit 33 the DBGBREAK bit LOW executes at debug speed To execute an instruction at system speed the instruction prior to it must be scanned into scan chain 1 with bit 33 set HIGH After the system speed instruction has scanned intothe data bus and clocked intothe pipeline the RESTART instruction must be loaded into the TAP controller RESTART causes the ARM 720T processor to 1 Switch automatically to HCLKEN control 2 Execute the instruction at system speed 3 Reenter debug state When the instruction has completed DBGACK is HIGH and the core revertstoDBGTCKEN control It is now possible to select INTEST in the TAP controller and resume debugging The debugger must look at both DBGACK and HTRANS 1 0 to determine whether a system speed instruction has completed To access memory the ARM 720T core drives both bits of HTRANS 1 0 LOW after it has synchronized back to system speed This transition is used by
210. tore Multiple STM can be inserted into the instruction pipeline to export the contents of the ARM 720T processor registers This data can be serially shifted out without affecting the rest of the system For more information see Examining the core and the system in debug state on page 9 26 In monitor mode the TAG interface is used to transfer data between the debugger and simple monitor program running on the ARM 720T core For detailed information about the scan chains and the TAG interface see Scan chains and the TAG interface on page 9 17 9 4 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 3 Entry into debug state If the system is in halt mode any of the following types of interrupt force the processor into debug state a breakpoint a given instruction fetch a watchpoint a data access an external debug request Note In monitor mode the processor continues to execute instructions in real time and will take an abort exception The abort status register enables you to establish whether the exception was due to a breakpoint or watchpoint or to a genuine memory abort You can use the Embeddedl CE RT logic to program the conditions under which a breakpoint or watchpoint can occur Alternatively you can usethe DBGBREAK signal to enable external logicto flag breakpoints or watchpoints and monitor the following address bus data bus s control signals Thetiming is the same for externally ge
211. truction If a coprocessor cannot execute an instruction the instruction takes the undefined instruction trap You can choose whether to emulate coprocessor functions in software or to design a dedicated coprocessor 8 1 1 Coprocessor availability You can connect up to 16 coprocessors into a system each with a unique coprocessor ID number Some coprocessor numbers are reserved F or example you cannot assign external coprocessors to coprocessor numbers 14 and 15 because these are internal to the ARM 720T processor CP14 is the communications channel coprocessor 15 is the system control coprocessor for cache and MMU functions Coprocessor availability is shown in Table 8 1 Table 8 1 Coprocessor availability Coprocessor Allocation 15 System control 14 Debug controller 13 8 Reserved 7 4 Available to users 3 0 Reserved Note If you intend to design a coprocessor send an E mail with coprocessor in the subject linetoinfo arm com for up to date information on coprocessor numbers that have already been allocated 8 2 EPSON ARM720T CORE CPU MANUAL 8 Coprocessor Interface 8 2 Coprocessor interface signals The signals used to interface the ARM 720T core to a coprocessor are grouped into four categories The dock and clock control signals include the main processor dock and bus reset HCLK EXTCPCLKEN HRESETn The pipeline following signals are CPnMREQ CPnTRANS CPnOPC
212. truction 9 21 9 28 Index 9 29 Return address calculation 9 32 Returned TCK SeeRTCK RTCK 9 8 RUN TEST IDLE state 9 21 9 29 S Scan input cells 9 20 output cells 9 20 path 9 20 paths 9 17 Scan cells 9 21 9 24 Scan chain selected 9 20 Scan chain 1 9 17 9 24 9 25 9 27 9 28 9 29 9 30 Scan chain 1 cells 9 25 Scan chain 2 9 17 9 24 9 33 Scan chains 9 17 number allocation 9 23 Scan path select register 9 20 9 22 9 23 SCAN_N 9 20 9 23 9 24 Section descriptor 7 8 references translating 7 10 SHIFT DR 9 19 9 20 9 21 9 25 SHIFT IR 9 23 Signals AMBA interface A 1 coprocessor interface A 2 debugger A 4 ETM interface A 5 J TAG A 3 miscellaneous A 7 Single step core operation 9 20 SIZE 6 7 SIZE bits 9 35 Slave transfer response 6 9 Small pagereferences translating 7 13 Software break points 9 36 9 37 dearing 9 37 programming 9 37 setting 9 37 Software Interrupt 2 13 Software interrupt 2 13 SPSR Saved Processor Status Register 2 8 format of 2 8 State CAPTURE DR 9 20 9 21 processor 9 27 SHIFT DR 9 19 9 20 9 21 9 22 UPDATE DR 9 20 9 21 UPDATE IR 9 23 Subpages 7 14 Supervisor mode 2 4 ARM DDI 0229B EPSON Index 3 Index SWI 2 13 System mode 2 4 System speed instruction 9 28 9 31 System state determining 9 28 T T bit in CPSR 2 8 TAP controller 9 3 9 10 9 19 controller state transitions 9 19 instruction 9 23 state 9 24 Test registers 11 1 state register 11 3
213. uested MVA The Translation Table Baseregister points to the base address of a table in physical memory that contains section or page descriptors or both The 14 low order bits of the Translation Table Base Register are set to zero on a read and the table must reside on a 16K B boundary Figure 7 1 shows the format of the Translation Table Base Register 31 14 13 0 Figure 7 1 Translation Table Base Register 7 4 EPSON ARM720T CORE CPU MANUAL 7 Memory Management Unit Thetranslation table has up to 4096 x 32 bit entries each describing 1MB of virtual memory This enables up to 4GB of virtual memory to be addressed Figure 7 2 shows the table walk process Level one fetch TTB base Indexed by modified virtual address bits 31 20 Translation table 00 10 01 11 4096 entries Invalid Level two fetch Section base Indexed by modified virtual address bits 19 0 Coarse page table base Indexed by modified virtual address bits 19 12 Fine page table base Indexed by modified virtual address bits 19 10 Coarse page tab 00 01 10 11 256 entries Fine page table 00 01 10 11 1024 entries Invalid Invalid Large page base Indexed by modified virtual address bits 15 0 Small page base Indexed by modified virtual add
214. umb fetches are done as 32 bit bus transactions using the 32 bit thumb prefetch buffer ARM720T CORE CPU MANUAL EPSON 1 Introduction 1 4 Silicon revisions This manual is for revision r4p2 of the ARM 720T macrocell See Product revision status page xii for details of revision numbering There are no functional differences from previous revisions 1 18 EPSON ARM720T CORE CPU MANUAL 2 Programmer s Model 2 Programmer s Model 2 Programmer s Model This chapter describes the programmer lt model for the ARM 720T processor It contains the following sections 2 1 Processor operating SE BS audi 2 1 2 2 Memory dicm 2 2 2 3 instr etion enga o 1 DIL 2 3 2 4 DB Fe e Rd ccc e aR 2 3 2 5 Operating Modes Dee ae 2 4 2 6 PRIESTS rt Pe EE 2 4 2 7 Program status dup ro og er ces POCO 2 8 2 8 EXC p 2 10 2 9 Relocation of low virtual addresses by the FCSE PID 2 15 2 10 2 ion endet b nodal btc Dent d D re ica 2 16 2 11 Implementation defined behavior of 2 17 2 1 Processor operating states Fromthe point of view of the programmer the ARM 720T processor can bein one of two states ARM state This executes 32 bit word aligned ARM instructions Thumb state This operates with 16 bit halfword aligned Thumb instructions In this state the PC uses bit 1 to se
215. urpose 32 bit registers six program status registers These registers cannot all be seen at once The processor state and operating mode dictate which registers are available to the programmer at any one time 2 6 1 The ARM state register set In ARM state 16 general registers one or two status registers are visible at any one time In privileged non U ser modes mode specific banked registers are switched in Figure 2 3 on page 2 5 shows which registers are available each mode The banked registers are marked with a shaded triangle The ARM state register set contains 16 directly accessible registers rO to r15 All of these except r15 are general purpose and can be used to hold either data or address values Registers r14 and r15 also have special roles as follows Register r14 This register is used asthe subroutine Link Register This receives a copy of r15 when a Branch and Link BL code instruction is executed At all other times it can be treated as a general purpose register The corresponding banked registers r14 svc r14 r14 fig r14 abt andr14 undaresimilarly used tohold thereturn values of r15 when interrupts and exceptions arise or when BL instructions are executed within interrupt or exception routines Register r15 This register holds the Program Counter PC In ARM state bits 1 0 of r15 are zero and bits 31 2 contain the PC In Thumb state bit O is zero and bits 31 1 contain the PC In
216. ute 3 Enables the state of the HTRANS 1 signal from the core to be read This enables the debugger to determine whether a memory access from the debug state has completed 2 Enables the state of the core interrupt enable signal IFEN to be read 1 Enables the values on the synchronized version of DBGRA to be read 0 Enables the values on the synchronized versions of DBGACK to be read ARM720T CORE CPU MANUAL EPSON 9 41 9 Debugging Your System The structure of the debug control and status registers is shown in Figure 9 17 Debug Debug control status register register TBIT gt Bit4 from core TRANS 1 gt from core DBGACKI Interrupt mask enable from core to core Bit 2 O Bit 2 gt i m Bit 1 gt DBGRQI gt to core DBGRQ gt from ARM720T input Bit 0 gt DBGACK gt lt to ARM720T processor output DBGACKI gt from core Figure 9 17 Debug control and status register structure 9 42 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System 9 26 Coupling breakpoints and watchpoints You can couple watchpoint units 1 and O together using the CHAIN and RANGE inputs The use of CHAIN enables Watchpoint O to be triggered only if Watchpoint 1 has previously match
217. value If specified for writes writing to this location causes unpredictable behavior or change in device configuration Should Be Zero SBZ When writing tothis location all bits of this field should be zero ARM720T CORE CPU MANUAL EPSON 3 1 3 Configuration 3 2 Internal coprocessor instructions Theinstruction set for the ARM 720T processor enables you to implement specialized additional instructions using coprocessors These are separate processing units that are coupled to the ARM 720T processor although CP15 is built into the ARM 720T processor Note The CP15 register map might change in future ARM processors Y ou are strongly recommended to structure software so that any code accessing CP 15 is contained in a single module enabling it to be easily updated You can only access CP 15 registers with MRC and MCR instructions in a privileged mode The instruction bit pattern of the MRC and MCR instructions is shown in Figure 3 1 31 141312 1009 08 07 06 05 04 03 02 01 00 EIPIRIRI CIR M Figure 3 1 MRC and MCR bit pattern CDP LDC and STC instructions as well as unprivileged MRC and MCR instructions to CP 15 cause the Undefined Instruction trap to be taken TheCRn field of MRC and MCR instructions specifies the coprocessor register to access The CRm field and opcode 2 fields specify a particular action when addressing some registers In all instructions accessing CP 15 the opcode 1 field Should Be Zero SBZ
218. watchpoint units to halt the execution of instructions by the core Execution halts when the values programmed into the E mbeddedl CE RT logic match the values currently appearing on the address bus data bus and various control signals You can mask any bit sothat its value does not affect the comparison You can configure each watchpoint unit to be either a watchpoint monitoring data accesses or a breakpoint monitoring instruction fetches Watchpoints and breakpoints can be data dependent For more details see Watchpoint unit registers on page 9 33 9 10 EPSON ARM720T CORE CPU MANUAL 9 Debugging Your System Abort status register This register identifies whether an abort exception entry was caused by a breakpoint a watchpoint or areal abort For more information see Abort status register on page 9 38 Debug Communications Channel DCC The DCC passes information between the target and the host debugger For more information see The debug communications channel on page 9 14 In addition two independent registers provide overall control of Embeddedl CE RT operation These are described in the following sections Debug control register on page 9 39 Debug status register on page 9 41 The locations of the Embedded CE RT registers are given in Embedaea CE RT timing on page 9 44 9 7 Disabling EmbeddedICE RT You can disable Embeddedl CE RT in two ways Permanently By wiring the DBGEN input LOW When DBGEN i
219. y termination ARM720T CORE CPU MANUAL EPSON 2 17 2 Programmer s Model THIS PAGE IS BLANK 2 18 EPSON ARM720T CORE CPU MANUAL 3 Configuration 3 Configuration 3 Configuration This chapter describes the configuration of the ARM 720T processor It contains the following sections 3 1 ABDUE CORHQUFAH on een 3 1 3 2 Internal coprocessor Instructions tenir ann 3 2 3 3 Register MP 3 3 3 1 About configuration The operation and configuration of ARM 720T is controlled directly using coprocessor instructions to CP 15 the system control coprocessor indirectly using the MMU page tables The coprocessor instructions manipulate a number of on chip registers that control the configuration of the following cache write buffer MMU other configuration options 3 1 1 Compatibility To ensure backwards compatibility of future CPUs all reserved or unused bits in registers and coprocessor instructions must be programmed to 0 invalid registers must not be read or written the following bits must be programmed to 0 Register 1 bits 31 14 and bits 12 10 Register 2 bits 13 0 Register 5 bits 31 9 Register 7 bits 31 0 Register 13 FCSE PID bits 24 01 3 1 2 Notation Throughout this section the following terms and abbreviations are used Unpredictable UNP If specified for reads the data returned when reading from this location is unpredictable It can have any

Kenwood BL650 Blender User Manual

Contents

Download Pdf Manuals

Related Search

Related Contents