View ARM946E-S_6965285.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

ARM946E-S microprocessor core with cache june 2001 technical manual
ii copyright 2000?001 by lsi logic corporation. all rights reserved. document db14-000104-00, first edition (june 2001) this document describes rev 0a of the lsi logic corporation ARM946E-S and will remain the of?ial reference source for all revisions/releases of this product until rescinded by an update. to receive product literature, visit us at http://www.lsilogic.com. lsi logic corporation reserves the right to make changes to any products herein at any time without notice. lsi logic does not assume any responsibility or liability arising out of the application or use of any product described herein, except as expressly agreed to in writing by lsi logic; nor does the purchase or use of a product from lsi logic convey a license under any patent rights, copyrights, trademark rights, or any other of the intellectual property rights of lsi logic or third parties. copyright 2000?001 by lsi logic corporation. all rights reserved. trademark acknowledgment the lsi logic logo design, coreware, and right-first-time are registered trademarks or trademarks of lsi logic corporation. arm is a registered trademark of arm limited, used under license. all other brand and product names may be trademarks of their respective companies. bm
ARM946E-S microprocessor core with cache technical manual iii copyright 2000?001 by lsi logic corporation. all rights reserved. preface this book is the primary reference and technical reference manual for the ARM946E-S. it contains a complete functional description for the product and includes complete physical and electrical speci?ations for this product. audience this document assumes that you have some familiarity with microprocessors and related support devices. the people who bene? from this book are: ? engineers and managers who are evaluating the processor for possible use in a system ? engineers who are designing the processor into a system organization this document has the following chapters and appendixes: chapter 1, introduction , provides an introduction to the ARM946E-S. chapter 2, signal descriptions , describes the signals used in the ARM946E-S. chapter 3, programmers model , describes the programmers model of the ARM946E-S and includes a summary of the ARM946E-S coprocessor registers. chapter 4, caches , describes the ARM946E-S cache implementation. chapter 5, protection unit , describes the ARM946E-S protection unit.
iv preface copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 6, tightly coupled sram , describes the requirements and operation of the tightly coupled sram. chapter 7, bus interface unit and write buffer , describes the operation of the bus interface unit and write buffer. chapter 8, external coprocessor interface , describes the coprocessor interface and the operation of common coprocessor instructions. chapter 9, debug interface , describes the debug support for the ARM946E-S and the embeddedice-rt logic. chapter 10, etm interface , describes the etm interface, including details of how to enable the interface. chapter 11, test support , describes the test methodology used for the ARM946E-S synthesized logic and tightly coupled sram. appendix a, ac parameters , describes the timing parameters applicable to the ARM946E-S. related publications arm architecture reference manual available from arm ltd. as document no. arm ddi 0100. arm9e-s technical reference manual available from arm ltd. as document no.arm ddi 0165. amba speci?ation (rev 2.0) available from arm ltd. as document no. arm ihi 0011. embedded trace macrocell speci?ation (rev 1.0) available from arm ltd. as document number ihi 0014e. standard test access port and boundary-scan architecture , ieee std. 1149.1-1990 conventions used in this manual the ?st time a word or phrase is de?ed in this manual, it is italicized.
preface v copyright 2000?001 by lsi logic corporation. all rights reserved. the word assert means to drive a signal true or active. the word deassert means to drive a signal false or inactive. signals that are active low end in an ?. hexadecimal numbers are indicated by the pre? ?xfor example, 0x32cf. binary numbers are indicated by the pre? ?bfor example, 0b0011.0010.1100.1111.
vi preface copyright 2000?001 by lsi logic corporation. all rights reserved.
ARM946E-S microprocessor core with cache technical manual vii copyright 2000?001 by lsi logic corporation. all rights reserved. contents chapter 1 introduction 1.1 about the ARM946E-S 1-1 1.2 microprocessor block diagram 1-2 1.2.1 arm9e-s processor core 1-4 1.2.2 system controller 1-4 1.2.3 cp15 system control coprocessor 1-4 1.2.4 data and instruction caches and control 1-5 1.2.5 protection unit 1-5 1.2.6 instruction and data srams 1-5 1.2.7 ahb interface unit and write buffer 1-5 1.2.8 external coprocessor interface 1-6 1.2.9 jtag and debug interface port 1-6 1.2.10 embedded trace module interface 1-6 1.3 coreware program 1-6 chapter 2 signal descriptions 2.1 signal properties and requirements 2-1 2.2 clock interface signals 2-5 2.3 ahb signals 2-5 2.4 instruction ram signals 2-8 2.5 data ram signals 2-10 2.6 instruction cache signals 2-11 2.7 data cache signals 2-15 2.8 coprocessor interface signals 2-20 2.9 debug signals 2-22 2.10 jtag signals 2-24 2.11 miscellaneous signals 2-25 2.12 etm interface signals 2-25 2.13 atpg scan control signals 2-30
viii contents copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 3 programmers model 3.1 about the ARM946E-S programmers model 3-1 3.2 about the arm9e-s programmers model 3-2 3.3 cp15 registers 3-2 3.3.1 accessing cp15 registers 3-4 3.3.2 id code register (0) 3-5 3.3.3 cache type register (0) 3-6 3.3.4 tightly coupled memory size register (0) 3-9 3.3.5 control register (1) 3-11 3.3.6 cache con?uration registers (2) 3-13 3.3.7 write buffer control register (3) 3-14 3.3.8 access permission registers (5) 3-15 3.3.9 protection region/base size (pr/bs) registers (6) 3-19 3.3.10 cache operations register (7) 3-22 3.3.11 cache lockdown registers (9) 3-25 3.3.12 tightly coupled memory region registers (9) 3-26 3.3.13 trace process identi?r register (13) 3-29 3.3.14 cache debug index register (15) 3-31 3.4 cp14 registers 3-34 3.4.1 debug comms channel status register (c0) 3-34 3.4.2 debug status register (c2) 3-35 chapter 4 caches 4.1 cache architecture 4-1 4.2 i-cache 4-5 4.2.1 enabling and disabling the i-cache 4-5 4.2.2 i-cache operation 4-5 4.2.3 i-cache validity 4-6 4.2.4 i-cache flush 4-6 4.3 d-cache 4-7 4.3.1 enabling and disabling the d-cache 4-7 4.3.2 d-cache operation 4-7 4.3.3 d-cache validity 4-9 4.3.4 d-cache clean and flush 4-9 4.4 cache lockdown 4-11 4.4.1 locking down the caches 4-12
contents ix copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 5 protection unit 5.1 about the protection unit 5-1 5.2 enabling the protection unit 5-2 5.3 memory regions 5-2 5.3.1 region base address 5-2 5.3.2 region size 5-3 5.3.3 partition attributes 5-3 5.4 overlapping regions 5-3 5.5 background regions 5-4 chapter 6 tightly coupled sram 6.1 ARM946E-S sram requirements 6-1 6.2 using cp15 control register 6-2 6.2.1 enabling the i-sram 6-2 6.2.2 disabling the i-sram 6-3 6.2.3 i-sram load mode 6-3 6.2.4 enabling and disabling the d-sram 6-4 6.2.5 d-sram load mode 6-4 chapter 7 bus interface unit and write buffer 7.1 about the biu and write buffer 7-1 7.2 ahb bus master interface 7-2 7.2.1 about the ahb 7-2 7.2.2 ARM946E-S transfer descriptions 7-3 7.2.3 burst sizes 7-3 7.2.4 line fetch transfers 7-3 7.2.5 back-to-back line fetches 7-4 7.2.6 uncached transfers 7-5 7.2.7 burst accesses 7-5 7.2.8 bursts crossing 1 kbyte boundary 7-6 7.3 noncached thumb instruction fetches 7-6 7.4 ahb clocking 7-7 7.4.1 clk-to-hclk skew 7-8 7.5 write buffer 7-10 7.5.1 write buffer operation 7-11 7.5.2 enabling and disabling the write buffer 7-12 7.5.3 using self-modifying code 7-12
x contents copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 8 external coprocessor interface 8.1 about the external coprocessor interface 8-1 8.2 coprocessor instructions 8-2 8.3 ldc/stc instructions 8-3 8.3.1 coprocessor handshake states 8-5 8.3.2 coprocessor handshake encoding 8-6 8.3.3 multiple external coprocessors 8-6 8.4 mcr/mrc instructions 8-7 8.5 interlocked mcr instructions 8-8 8.6 cdp instructions 8-9 8.7 privileged instructions 8-10 8.8 busy-waiting and interrupts 8-10 chapter 9 debug interface 9.1 debug systems 9-1 9.1.1 debug host 9-2 9.1.2 protocol converter 9-2 9.1.3 ARM946E-S debug target 9-3 9.2 debug operations overview 9-4 9.3 debug using the serial interface and tap controller 9-5 9.3.1 serial registers 9-5 9.3.2 tap controller state machine 9-6 9.3.3 scan chains 9-12 9.3.4 debug access to the caches 9-17 9.4 debug using the embeddedice-rt 9-18 9.4.1 disabling embeddedice-rt 9-20 9.4.2 debug communications channel 9-20 9.4.3 debug comms channel registers 9-21 9.4.4 communications using the comms channel 9-21 9.5 breakpoints, watchpoints, and debug requests 9-22 9.5.1 entry into debug state on breakpoint 9-23 9.5.2 breakpoints and exceptions 9-24 9.5.3 watchpoints 9-24 9.5.4 watchpoints and exceptions 9-26 9.5.5 debug request 9-27 9.5.6 actions of the arm9e-s in debug state 9-27
contents xi copyright 2000?001 by lsi logic corporation. all rights reserved. 9.6 determining the core and system state 9-27 9.7 real-time debug 9-28 9.8 arm9e-s clock domains 9-29 9.9 synchronizing debug clocks 9-29 chapter 10 etm interface 10.1 about the etm 10-1 10.1.1 trace port 10-1 10.1.2 triggering facilities 10-2 10.2 etm interface 10-2 10.3 enabling the etm interface 10-3 chapter 11 test support 11.1 about the ARM946E-S test methodology 11-1 11.2 scan insertion and atpg 11-1 11.3 bist of memory arrays 11-2 appendix a ac parameters a.1 timing diagrams 11-1 a.2 ac timing parameter de?itions 11-10 index customer feedback figures 1.1 ARM946E-S block diagram 1-3 2.1 ARM946E-S signal diagram 2-3 3.1 mrc and mcr instruction format 3-4 3.2 id code register 3-5 3.3 cache type register 3-6 3.4 tightly coupled memory size register 3-9 3.5 control register 3-11 3.6 instruction/data cacheable bits register 3-14 3.7 write buffer control register 3-15
xii contents copyright 2000?001 by lsi logic corporation. all rights reserved. 3.8 instruction/data access permission (i/dap) register (extended) 3-16 3.9 instruction/data access permission (i/dap) register (standard) 3-18 3.10 pr/bs register 3-20 3.11 index and set format 3-23 3.12 address format 3-24 3.13 cache lockdown register 3-26 3.14 tightly coupled memory region register format 3-27 3.15 trace process id register 3-29 3.16 test state register 3-30 3.17 cache debug index register - index/set format 3-32 3.18 data format for tag read/write operations 3-32 3.19 debug comms channel status register 3-34 3.20 coprocessor 14 debug status register 3-36 4.1 example 8 kbyte cache 4-2 4.2 access address for a 4 kbyte cache 4-3 4.3 register 7, rd format 4-10 5.1 ARM946E-S protection unit 5-1 5.2 overlapping memory regions 5-4 6.1 sram read cycle 6-2 7.1 line fetch transfer 7-4 7.2 back-to-back line fetches 7-5 7.3 nonsequential uncached accesses 7-5 7.4 data burst followed by instruction fetch 7-6 7.5 crossing a 1 kbyte boundary 7-6 7.6 ahb clock relationships 7-8 7.7 ARM946E-S clk to ahb hclk sampling 7-9 8.1 coprocessor clocking 8-2 8.2 ldc/stc cycle timing 8-3 8.3 mcr/mrc transfer timing with busy-wait 8-7 8.4 interlocked mcr timing with busy-wait 8-8 8.5 late cancelled cdp instruction 8-9 8.6 privileged instructions 8-10 8.7 busy-waiting and interrupts 8-11 9.1 typical debug system 9-2 9.2 arm9e-s processor and debug logic 9-3 9.3 tap controller state diagram 9-7
contents xiii copyright 2000?001 by lsi logic corporation. all rights reserved. 9.4 tag address format 9-17 9.5 cache index register format 9-18 9.6 the arm9e-s, tap controller, and embeddedice-rt 9-19 9.7 breakpoint timing 9-23 9.8 watchpoint entry with data processing instruction 9-25 9.9 watchpoint entry with branch 9-26 9.10 clock synchronization logic 9-30 10.1 ARM946E-S etm interface 10-3 a.1 clock, reset, and ahb enable timing 11-2 a.2 ahb bus request and grant related timing 11-2 a.3 ahb bus master timing 11-3 a.4 coprocessor interface timing 11-4 a.5 debug interface timing 11-5 a.6 jtag interface timing 11-6 a.7 dbgsdout to dbgtdo timing 11-7 a.8 exception and con?uration timing 11-7 a.9 intest wrapper timing 11-8 a.10 etm interface timing 11-9 tables 3.1 cp15 register map 3-3 3.2 cp15 abbreviations 3-4 3.3 accessing pr/bs registers 3-20 3.4 cache operations 3-22 3.5 index fields for supported cache sizes 3-23 3.6 cache debug operations 3-31 3.7 tag and index fields for supported cache sizes 3-33 3.8 coprocessor 14 register map 3-34 4.1 tag and index fields for supported cache sizes 4-4 4.2 cd bit function 4-8 4.3 calculating index addresses 4-10 7.1 supported burst types 7-3 7.2 data write modes 7-11 8.1 coprocessor handshake states 8-5 8.2 handshake encoding 8-6 9.1 test access port instruction descriptions 9-10 9.2 ARM946E-S scan chain functions 9-12
xiv contents copyright 2000?001 by lsi logic corporation. all rights reserved. 9.3 scan chain 1 bit allocation 9-13 9.4 scan chain 2 bit allocation 9-14 9.5 scan chain 15 bit allocation 9-15 9.6 mapping of scan chain 15 address field to cp15 registers 9-15 9.7 coprocessor 14 register map 9-21 a.1 timing parameter de?itions 11-10
ARM946E-S microprocessor core with cache technical manual 1-1 copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 1 introduction this chapter introduces the ARM946E-S microprocessor core. it contains the following sections: ? section 1.1, ?bout the ARM946E-S ? section 1.2, ?icroprocessor block diagram ? section 1.3, ?oreware program 1.1 about the ARM946E-S the ARM946E-S is a synthesizable macrocell that includes an arm processor. the arm9e-s processor is a member of the arm9 thumb family of high-performance, 32-bit system-on-a-chip processor solutions. the ARM946E-S has a tightly coupled sram memory, and both instruction and data caches. it is targeted for a wide range of embedded applications where high performance, low system cost, small die size, and low power are all important. the ARM946E-S macrocell is a harvard architecture, cached processor that provides a complete high-performance subsystem. the arm946e- s includes: ? arm9e-s risc integer processor core: the processor uses the armv5texp 32-bit instruction set with improved arm/thumb code interworking and an enhanced multiplier designed for improved dsp performance. the processor has an arm debug architecture with additional support for real-time debug. this capability allows critical exception handlers to execute while debugging the system.
1-2 introduction copyright 2000?001 by lsi logic corporation. all rights reserved. ? tightly coupled instruction and data sram interfaces. you can con?ure the size of the instruction and data srams to suit the needs of your design implementation. ? instruction and data caches. you can easily modify your design to allow any combination of caches from 4 kbytes to 1 mbyte. ? protection unit. this unit allows you to segment and protect memory in a simple manner. this feature is ideal for embedded control applications. ? amba ahb bus interface. ARM946E-S uses uni?d address and data buses to interface to the rest of the system. this interface is compatible with the amba ahb bus standard. ? external coprocessor support. this capability allows the addition of ?ating-point or other application-speci? hardware accelerators. for coprocessor support, the instruction and data buses are exported along with simple handshaking signals. ? scan testing and built-in self-test (bist) support. this feature provides scan test capability for the standard cell logic and bist for the tightly coupled sram and caches. ? interface to an external embedded trace macrocell (etm). the etm provides support for real-time tracing of instructions and data. providing this complete high-frequency subsystem allows system-on- a-chip designers to concentrate on design issues unique to their system. the synthesizable nature of the device eases integration into asic technologies. 1.2 microprocessor block diagram the ARM946E-S block diagram is shown in figure 1.1 .abrief description of each block follows the diagram.
microprocessor block diagram 1-3 copyright 2000?001 by lsi logic corporation. all rights reserved. figure 1.1 ARM946E-S block diagram ahb bus interface unit and write buffer instruction sram external coprocessor interface etm interface instruction cache memory protection unit din din instruction cache control system control coprocessor (cp15) data cache data cache control system controller data sram ia arm9e-s instr rdata da core wdata
1-4 introduction copyright 2000?001 by lsi logic corporation. all rights reserved. 1.2.1 arm9e-s processor core the arm9e-s processor core has a harvard bus architecture with separate instruction and data interfaces. this design allows concurrent instruction and data accesses, and greatly reduces the cycles per instruction of the processor. for optimal performance, single-cycle memory accesses for both interfaces are required, although the core can be stalled for nonsequential accesses or slower memory systems. the processor is implemented using a ve-stage pipeline: ? instruction fetch (f) ? instruction decode (d) ? execute (e) ? data memory access (m) ? register write (w) arm implementations are fully interlocked, so that software functions identically across different implementations without concern for pipeline effects. refer to the arm9e-s technical reference manual for more information about the processor core . 1.2.2 system controller the system controller oversees the interactions between the instruction ram, data ram, and the bus interface unit. it controls internal arbitration between the blocks and stalls the appropriate blocks when required. 1.2.3 cp15 system control coprocessor the processor core uses a set of registers in the cp15 coprocessor to control the functionality of the rams and the write buffer. these registers are accessed using the coprocessor instructions mcr and mrc. refer to chapter 3 for more information about cp15.
microprocessor block diagram 1-5 copyright 2000?001 by lsi logic corporation. all rights reserved. 1.2.4 data and instruction caches and control the ARM946E-S has separate data and instruction caches. each cache is direct mapped, or either 2-way or 4-way set associative. the d-cache and i-cache use a physical address from the processor core, and have a cache update policy of allocate on a read miss . the d-cache and i-cache are reloaded one cache line (eight words) at a time through the external interface. refer to chapter 4 for more information about the data and instruction caches. 1.2.5 protection unit the protection unit makes it possible to partition memory into eight regions of variable size and to set individual attributes for each memory region. refer to chapter 5 for more information about the protection unit. 1.2.6 instruction and data srams the ARM946E-S incorporates internal instruction and data memories to allow high-speed operation without incurring the performance penalties of accessing the system bus. the instruction and data rams each consist of blocks of asic library compiled ram. the ram sizes can be of any size up to 1 mbyte. the instruction and data memories can have different sizes. refer to chapter 6 for more information about the instruction and data rams. 1.2.7 ahb interface unit and write buffer the advanced high-performance bus (ahb) is a new generation of amba bus, which meets the requirements of high-performance synthesizable designs. the ahb interface unit arbitrates between the sources of external bus transactions within the ARM946E-S. it stalls all other accesses until the current request has been completed. the write buffer is a 16-entry fifo. it increases system performance.
1-6 introduction copyright 2000?001 by lsi logic corporation. all rights reserved. refer to chapter 7 for more information about the ahb interface and write buffer. 1.2.8 external coprocessor interface the ARM946E-S supports the connection of coprocessors through the external coprocessor interface. all types of arm coprocessor instructions are supported. coprocessors determine the instructions they need to execute using a pipeline follower in the coprocessor. refer to chapter 8 for more information about the external coprocessor interface. 1.2.9 jtag and debug interface port the jtag and debug interface (not shown in figure 1.1 ) is based on ieee standard 1149.1-1990. the interface makes it possible to stop the processor core on a given instruction fetch (breakpoint), data access (watchpoint), or external debug request. the jtag interface allows serial insertion of instructions into the pipeline of the core without using the external data bus. refer to chapter 9 for more information about the jtag and debug interface. 1.2.10 embedded trace module interface this interface connects to an external embedded trace module (etm). the etm provides a high-speed port for tracing the processor core in real time. refer to chapter 10 for more information about the etm interface. 1.3 coreware program the coreware program consists of three main elements: 1. a library of cores 2. a design development and simulation package 3. expert applications support
coreware program 1-7 copyright 2000?001 by lsi logic corporation. all rights reserved. the coreware library contains a wide range of complex cores based on accepted and emerging industry standards from high-speed interconnect and digital video to dsp and microprocessors. lsi logic provides a complete framework for device and system development and simulation. lsi logic has advanced asic technologies that consistently produce right-first-time silicon. the lsi logic in-house experts provide design support from system architecture de?ition through chip layout and test vector generation.
1-8 introduction copyright 2000?001 by lsi logic corporation. all rights reserved.
ARM946E-S microprocessor core with cache technical manual 2-1 copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 2 signal descriptions this chapter describes the ARM946E-S microprocessor signals. it contains the following sections: ? section 2.1, ?ignal properties and requirements ? section 2.2, ?lock interface signals ? section 2.3, ?hb signals ? section 2.4, ?nstruction ram signals ? section 2.5, ?ata ram signals ? section 2.6, ?nstruction cache signals ? section 2.7, ?ata cache signals ? section 2.8, ?oprocessor interface signals ? section 2.9, ?ebug signals ? section 2.10, ?tag signals ? section 2.11, ?iscellaneous signals ? section 2.12, ?tm interface signals ? section 2.13, ?tpg scan control signals 2.1 signal properties and requirements the following design features ensure easier integration of the ARM946E-S into embedded applications and simplify synthesis ?w: ? a single rising edge clock times all activity ? all signals and buses are unidirectional ? all inputs are required to be synchronous to the single clock
2-2 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. these features simplify the de?ition of the top-level ARM946E-S signals, because all outputs change from the rising edge and all inputs are sampled on the rising edge of the clock. in addition, all signals are either input or output only; bidirectional signals are not used. note: you must use external logic to synchronize asynchronous signals (for example, interrupt sources) before applying them to the ARM946E-S macrocell.
signal properties and requirements 2-3 copyright 2000?001 by lsi logic corporation. all rights reserved. figure 2.1 ARM946E-S signal diagram haddr[31:0] hburst[2:0] hbusreq hgrant hlock hprot[3:0] hrdata[31:0] hready hresetn hresp[1:0] hsize[2:0] htrans[1:0] hwdata[31:0] hwrite ahb coprocessor interface chsde[1:0] chsex[1:0] cpclken cpdin[31:0] cpdout[31:0] cpinstr[31:0] cplatecancel cppass cptbit ncpmreq ncptrans instruction ram iaddr[19:3] ienableeven irdataeven[31:0] iwdata[31:0] iweeven[3:0] iweodd[3:0] commrx commtx dbgack dbgdewpt dbgen dbgext[1:0] dbgiebkpt dbginstrexec dbgrng[1:0] dbgrqi dbgtcken edbgrq debug clk hclken clock ARM946E-S interface clken ienableodd iramsize[3:0] irdataodd[31:0] cmflushiadrs cmflushiall cmwriictag icacheadrs[15:0] icacheassoc[1:0] icachedata[32:0] icachesize[3:0] ihit[3:0] iindexdly[12:0] irepiindex irepipntr[1:0] iset[0:3}data[31:0] iset{0:3}en iset[0:3]tag[21:0] iset[0:3]we itagadrs[12:0] itagdata[21:0] itagset[0:3]en itagset[0:3]we ivalid[3:0] ivalidset ivalidwe pcdbgwdata4_2[4:2] i-cache scanen si so atpg scan control bigendout nfiq nirq vinithi misc daddr[19:2] denable drdata[31:0] dwdata[31:0] dwe[3:0] data ram dramsize[3:0]
2-4 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. figure 2.1 ARM946E-S signal diagram (cont.) dbgir[3:0 dbfntrst dbgntdoen dbgscreg[4:0] dbgsdin dbgsdout dbgtapsm[3:0] dbgtcken dbgtdi dbgtdo dbgtms tapid[31:0] etmbigend etmchsd[1:0] etmchse[1:0] etmda[31:0] etmdabort etmdbgack etmdmas[1:0] etmdmore etmdnmreq etmdnrw etmdseq etmen etmhivecs etmia[31:1] etmid31to24[31:24] etmid15to8{15:8] etminmreq etminstrexec etmiseq etmitbit etmlatecancel etmnwait etmpass etmrdata[31:0] etmprocid[31:0] etmprocidwr tapid[31:0] etm interface ARM946E-S capturedirtyhi capturedirtylo cleardirty cmcleardirty cmflushdadrs cmflushdall cmflushdindex cmwrdctag dcacheadrsl[14:0] dcacheadrsu[14:0] dcacheassoc[1:0] dcachedata[32:0] dcachesize[3:0] dhit[3:0] dindexdly[12:0] dreplindex dreplpntr[1:0] dset[0:3]enl dset[0:3]enu dset[0:3]ldata[31:0] dset[0:3]tag[31:0] dset[0:3]udata[31:0] dset[0:3]we0l dset[0:3]we1l dset[0:3]we2l dset[0:3]we3l dset[0:3]we0u dset[0:3]we1u dset[0:3]we2u dset[0:3]we3u dtagadrs[12:0] dtagdata[21:0] dtagset[0:3]en dtagset[0:3]we dvalid[3:0] dvalidset dvalidwe repldirtyhi repldirtylo wrhitbable wrhitbufadrs[17:4] wrhitramwe wrhitset[3:0] d-cache etmiabort etminstrvalid etmrngout etmwdata[31:0] jtag
clock interface signals 2-5 copyright 2000?001 by lsi logic corporation. all rights reserved. 2.2 clock interface signals the following information describes the ARM946E-S clock interface signals. clk system clock input this clock times all operations in the ARM946E-S core. all outputs change from the rising edge, and all inputs are sampled on the rising edge. the clock can be stretched in either phase. when hclken is high, clk also times ahb operations. when dbgtcken is high, clk also times debug operations. clken system clock enable output clken is the ARM946E-S system clock enable. clken goes low to indicate a stall condition. dbgtcken jtag debug logic enable input this signal provides a synchronous enable for debug logic accessed using the jtag interface. when dbgtcken is high, the debug logic can advance on the rising edge of clk. hclken ahb clock enable input this signal provides a synchronous enable for ahb transfers. when high, it indicates that the next rising edge of clk is also a rising edge of hclk in the ahb system where the ARM946E-S is embedded. hclken must be tied high in systems where clk and hclk are the same frequency. 2.3 ahb signals the following information describes the ARM946E-S ahb signals. haddr[31:0] address bus output haddr[31:0] is the 32-bit ahb system address bus.
2-6 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. hburst[2:0] burst type output this output indicates whether or not the transfer forms part of a burst. both four beat and eight beat bursts are supported, where a beat is a clock tick. the ARM946E-S generates only incrementing bursts, because cache ?ls are zero-word ?st. hbusreq bus request output when asserted, this signal indicates that the ARM946E-S requires the bus. hgrant bus grant input when asserted, this signal indicates that the ARM946E-S is currently the highest priority master. ownership of the address/control signals changes at the end of a transfer when hready is high. when both hready and hgrant are high, the ARM946E-S gets access to the bus. hlock request locked transfers output when high, this signal indicates that the ARM946E-S requires locked access to the bus and no other master should be granted access until this signal has gone low. the ARM946E-S asserts hlock when executing swp instructions to ahb address space. hprot[3:0] protection control output this output provides information about a bus access that is useful to modules that implement some level of protection. hburst[2:0] burst type description 000 single single transfer 001 incr incrementing burst of unspeci?d length 011 incr4 4-beat incrementing burst 101 incr8 8-beat incrementing burst
ahb signals 2-7 copyright 2000?001 by lsi logic corporation. all rights reserved. the hprot[3:0] signals provide the information shown below. hrdata[31:0] read data bus input during read operations, this 32-bit bus transfers data from a selected bus slave to the ARM946E-S. hready transfer done input when high, this signal indicates that a bus transfer has ?ished. a selected bus slave can drive this signal low to extend a transfer. hresetn not reset input this signal must be asynchronously asserted low to initialize the ARM946E-S system state. it must be deasserted synchronously. hresp[1:0] transfer response input these signals contain a transfer response from the selected slave. they provide additional status transfer information. the responses are shown below: hprot3 cacheable hprot2 bufferable hprot1 supervisor hprot0 data/opcode description 0 opcode fetch 1 data access 0 user access 1 supervisor access 0 not bufferable 1 bufferable 0 not cacheable 1 cacheable hresp[1:0] description 0b00 okay 0b01 error 0b10 retry 0b11 split
2-8 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. hsize[2:0] transfer size output these signals indicate the size of an ARM946E-S transfer. bit 2 is tied low. the transfer sizes are: htrans[1:0] transfer type output these signals indicate the ARM946E-S transfer type. the transfer types are: hwdata[31:0] write data bus output this 32-bit bus transfers data from the ARM946E-S to a selected bus slave during write operations. hwrite transfer direction output when hwrite is high, it indicates this is a write transfer. when the signal is low, it indicates this is a read transfer. 2.4 instruction ram signals the instruction ram is split into two banks, even and odd. both banks get the same address and write data, but they have separate write enables so only one bank is written at a time. the muxing of the data read from the rams is performed inside the core. iaddr[19:3] instruction ram address output this 17-bit bus contains the instruction ram address and handles address for a 1 mbyte address range. addressing is performed on word boundaries, so bits 0 and 1 are not needed. bit 2 is replaced by the even and odd select signals. hsize[2:0] transfer size 0b000 byte 0b001 halfword 0b010 word htrans[1:0] transfer type 0b00 idle 0b01 nonsequential 0b10 sequential
instruction ram signals 2-9 copyright 2000?001 by lsi logic corporation. all rights reserved. ienableeven word-based instruction chip enable even output driving this signal low disables the clock on the even instruction ram and saves power. the rams do not have to connect to this pin. the function is not changed if the rams ignore the enable and clock every cycle. ienableodd word-based instruction chip enable odd output driving this signal low disables the clock on the odd instruction ram. iramsize[3:0] instruction ram size input these signals specify the size of the instruction ram. irdataeven[31:0] instruction ram read data even input this 32-bit bus contains data read from the even instruction ram. irdataodd[31:0] instruction ram read data odd input this 32-bit bus contains data read from the odd instruction ram. iwdata[31:0] instruction ram write data output this 32-bit bus contains write data for the instruction ram. iramsize [3:0] ram size 0b0000 0 kbyte 0b0011 4 kbytes 0b0100 8 kbytes 0b0101 16 kbytes 0b0110 32 kbytes 0b0111 64 kbytes 0b1000 128 kbytes 0b1001 256 kbytes 0b1010 512 kbytes 0b1011 1 mbyte
2-10 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. iweeven[3:0] byte-based instruction write enable even output these signals are byte write enables. asserting any one of the iweeven[3:0] signals high enables a write to the corresponding data byte in the even instruction ram. iweodd[3:0] byte-based instruction write enable odd output these signals are byte write enables. asserting one of the iweodd[3:0] signals high enables a write to the corresponding data byte in the odd instruction ram. 2.5 data ram signals the data ram is one logical bank of memory. daddr[19:2] data ram address output this 18-bit bus contains the data ram address. addressing is performed on word boundaries, so bits 0 and 1 are not needed. bits [19:2] address a 1 mbyte address space. denable word-based data chip enable output driving this signal low disables the data ram clock and saves power. the rams do not have to connect to this pin. the function is not changed if the rams ignore the enable and clock every cycle. iweeven enables data bits 3 31:24 2 23:16 1 15:8 0 7:0 iweodd enables data bits 3 31:24 2 23:16 1 15:8 0 7:0
instruction cache signals 2-11 copyright 2000?001 by lsi logic corporation. all rights reserved. dramsize[3:0] data ram size input these signals specify the data ram size. drdata[31:0] data ram read data input this 32-bit bus contains data read from the data ram. dwdata[31:0] data ram write data output this 32-bit bus contains write data for the data ram. dwe[3:0] byte-based data write enable output these bits are byte write enable signals. asserting one of these signals high enables writes to the corresponding bits in the data ram. 2.6 instruction cache signals the instruction cache signals support 1, 2, or 4 sets of rams. each set has an instruction ram that contains the instructions and a tag ram that dramsize [3:0] 0b0000 0 kbyte 0b0011 4 kbytes 0b0100 8 kbytes 0b0101 16 kbytes 0b0110 32 kbytes 0b0111 64 kbytes 0b1000 128 kbytes 0b1001 256 kbytes 0b1010 512 kbytes 0b1011 1 mbyte dwe enable write to data bits 3 31:24 2 23:16 1 15:8 0 7:0
2-12 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. holds the address information needed for hit detection. there are also signal connections to the a946esivalid module, which contains the valid bits for the instruction cache. cmflushiadrs cache maintenance flush inst. cache adrs. output asserting this signal high resets the valid bit associated with the instruciton cache address if the address presented by the cpu is a hit. cmflushiall cache maintenance flush all inst. cache output asserting this signal high synchronously resets all the instruction cache valid bits. cmwrictag cache maintenance write inst. cache tag output asserting this signal high writes the value in bit 4 of the pcdbgwdata4_2 signal into the valid bit selected by the iindexdly and ireplpntr signals. icacheadrs[15:0] instruction cache address output these 16 bits hold the instruction ram address, which is a word address that allows using rams that hold up to 256 kbytes. icacheassoc[1:0] instruction cache associativity input these bits specify the associativity of the instruction cache. icachedata[32:0] instruction cache data output this bus contains data to be written to the instruction set rams. icacheassoc[ 1:0] encoding 00 direct mapped 01 two way 10 four way
instruction cache signals 2-13 copyright 2000?001 by lsi logic corporation. all rights reserved. icachesize[3:0] instruction cache size input these bits specify the size of the instruction cache. ihit[3:0] instruction cache hit output each ihit[3:0] bit corresponds to instruction cache set [3:0]. when there is a hit on an instruction cache set, the corresponding ihit[3:0] bit is driven high. iindexdly[12:0] instruction cache index delayed output these bits are a delayed version of the index used to select valid bits. ireplindex instruction cache replacement index output this bit is the index of a line that is being replaced. ireplpntr[1:0] instruction cache replacement pointer output these bits point to the instruction cache set that will be affected when a cache maintenance operation uses the index/set addressing mode. iset0data[31:0], iset1data[31:0], iset2data[31:0], iset3data[31:0] instruction set 0, 1, 2, 3 data input this 32-bit bus contains data read from the instruction cache set 0, 1, 2, or 3 ram. iset0en, iset1en, iset2en, iset3en instruction set 0, 1, 2, 3 enable output driving this signal high enables the clock on the set 0, 1, 2, or 3 instruction ram. driving it low disables the icachesize [3:0] encoding 0b0000 0 kbyte 0b0011 4 kbytes 0b0100 8 kbytes 0b0101 16 kbytes 0b0110 32 kbytes 0b0111 64 kbytes 0b1000 128 kbytes 0b1001 256 kbytes 0b1010 512 kbytes 0b1011 1 mbyte
2-14 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. clock, which saves power. the rams do not have to connect to this pin. the function is not changed if the rams ignore the enable and clock every cycle. iset0tag[21:0] , iset1tag[21:0], iset2tag[21:0], iset3tag[21:0] instruction set 0, 1, 2, 3 tag input these bits contains data read from the instruction cache set 0, 1, 2, or 3 tag ram. iset0we, iset1we, iset2we, iset3we instruction set 0, 1, 2, 3 write enable output asserting this signal high enables word writes to the set 0, 1, 2, or 3 instruction ram. itagadrs[12:0] instruction cache tag address output this 13-bit bus contains the address for the instruction tag rams. itagdata[21:0] instruction cache tag data output this bus contains write data for the instruction tag rams. itagset0en, itagset1en, itagset2en, itagset3en instruction tag set 0, 1, 2, 3 enable output driving this signal high enables the clock on the set 0, 1, 2, or 3 tag ram. driving it low disables the clock, which saves power. the rams do not have to connect to this pin. the function is not changed if the rams ignore the enable and clock every cycle. itagset0we, itagset1we, itagset2we, itagset3we instruction tag set 0, 1, 2, 3 word write enable output asserting this signal high enables word writes to the set 0, 1, 2, or 3 tag ram. ivalid[3:0] instruction cache valid bits input these bits are the instruction cache valid bits. there is one valid bit for each instruction cache set. individual valid bits are selected by the index portion of the cache address.
data cache signals 2-15 copyright 2000?001 by lsi logic corporation. all rights reserved. ivalidset instruction cache valid set output this signal is driven high to set the selected valid bit, and it is driven low to clear the valid bit. it is used when a new line is loaded into the instruction cache. ivalidwe instruction cache valid write enable output this signal is the write enable for the valid bits. it is used when a new line is loaded into the instruction cache. pcdbgwdata4_2[4:2] prot/cp15 to cache debug write data output these bits write the valid bit on the instruction cache and the valid and dirty bits on the data cache during a cache maintenance operation. 2.7 data cache signals the data cache signals support 1, 2, or 4 ram sets. each set has an upper and lower data ram and one tag ram. the data rams hold data, and the tag rams hold the address information needed for a hit detection. in addition, there are signals that provide an interface to the a946esdvalid and a946esddirty modules. these modules contain the data cache valid and dirty bits, respectively. capturedirtyhi capture dirty bit high input this is the repldirtyhi signal delayed by one clock. the cache maintenance state machine uses this signal. capturedirtylo capture dirty bit low input this is the repldirtylo signal delayed by one clock. the cache maintenance state machine uses this signal. cleardirty clear dirty bit output asserting this signal clears the dirty bits for a line after a new line replaces it. cmcleardirty cache maintenance clear dirty bit output this signal is a one-cycle pulse that clears the dirty bits in the addressed line.
2-16 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. cmflushdadrs cache maintenance flush data cache adrs output asserting this signal high resets a valid bit if the address presented by the cpu is a hit. cmflushdall cache maintenance flush all data cache output asserting this signal high synchronously resets all the data cache valid bits. cmflushdindex cache maintenance flush data cache index output asserting this signal high resets the valid bit pointed to by the index. cmwrdctag cache maintenance write data cache tag output asserting this signal high sets the valid bit pointed to by the index. dcacheadrsl[14:0] data cache address lower output these bits contain the word address for the lower data set rams. this word address range allows the use of rams that are up to 128 kbytes in size. dcacheadrsu[14:0] data cache address upper output these bits contain the word address for the upper data set rams. this word address range allows the use of rams that are up to 128 kbytes in size. dcacheassoc[1:0] data cache associativity input these bits specify the associativity of the data cache. dcachedata[32:0] data cache data output this bus contains data to be written to the data set rams. dcacheassoc[ 1:0] encoding 0b00 direct mapped 0b01 two way 0b10 four way
data cache signals 2-17 copyright 2000?001 by lsi logic corporation. all rights reserved. dcachesize[3:0] data cache size input these bits specify the size of the data cache. dhit[3:0] data cache hit output each dhit[3:0] bit corresponds to data cache set [3:0]. when there is a hit on an data cache set, the corresponding dhit[3:0] bit is driven high. dindexdly[12:0] data cache index delayed output these bits are a delayed version of the index used to select valid bits. dreplindex data cache replacement index output this bit is the index of the line being replaced. dreplpntr[1:0] data cache replacement pointer output these bits point to the data cache set that is affected when a cache maintenance operation uses the index/set addressing mode. dset0enl, dset1enl, dset2enl, dset3enl data set 0, 1, 2, 3 lower enable output driving this signal high enables the clock on the set 0, 1, 2, or 3 lower ram. driving it low disables the clock, which saves power. the rams do not have to connect to this pin. the function is not changed if the rams ignore the enable and clock every cycle. dcachesize [3:0] encoding 0b0000 0 kbyte 0b0011 4 kbytes 0b0100 8 kbytes 0b0101 16 kbytes 0b0110 32 kbytes 0b0111 64 kbytes 0b1000 128 kbytes 0b1001 256 kbytes 0b1010 512 kbytes 0b1011 1 kbytes
2-18 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. dset0enu, dset1enu, dset2enu, dset3enu data set 0, 1, 2, 3 upper enable output driving this signal high enables the clock on the set 0, 1, 2, or 3 upper ram. driving it low disables the clock, which saves power. the rams do not have to connect to this pin. the function is not changed if the rams ignore the enable and clock every cycle. dset0ldata[31:0], dset1ldata[31:0], dset2ldata[31:0], dset3ldata[31:0] data set 0, 1, 2, 3 lower data input this 32-bit bus contains data read from the lower data cache set 0, 1, 2, or 3 ram. dset0tag[31:0],dset1tag[31:0], dset2tag[31:0], dset3tag[31:0] data set 0, 1, 2, or 3 tag input this 32-bit bus contains data read from the data cache set 0, 1, 2, or 3 tag ram. dset0udata[31:0], dset1udata[31:0], dset2udata[31:0], dset3udata[31:0] data set 0, 1, 2, 3 upper data input this 32-bit bus contains data read from the upper data cache set 0, 1, 2. or 3 ram. dset0we0l, dset1we0l, dset2we0l, dset3we0l data set 0, 1, 2, 3 write enable byte 0, lower output asserting this signal high enables writing to data bits [7:0] in the lower ram of data set 0, 1, 2, or 3. dset0we1l, dset1we1l, dset2we1l, dset3we1l data set 0, 1, 2, 3 write enable byte 1, lower output asserting this signal high enables writing to data bits [15:8] in the lower ram of data set 0, 1, 2, or 3. dset0we2l, dset1we2l, dset2we2l, dset3we2l data set 0, 1, 2, 3 write enable byte 2, lower output asserting this signal high enables writing to data bits [23:16] in the lower ram of data set 0, 1, 2, or 3. dset0we3l, dset1we3l, dset2we3l, dset3we3l data set 0, 1, 2, 3 write enable byte 3, lower output asserting this signal high enables writing to data bits [31:24] in the lower ram of data set 0, 1, 2, or 3.
data cache signals 2-19 copyright 2000?001 by lsi logic corporation. all rights reserved. dset0we0u, dset1we0u, dset2we0u, dset3we0u data set 0, 1, 2, 3 write enable byte 0, upper output asserting this signal high enables writing to data bits [7:0] in the upper ram of data set 0, 1, 2, or 3. dset0we1u, dset1we1u, dset2we1u, dset3we1u data set 0, 1, 2, 3 write enable byte 1, upper output asserting this signal high enables writing to data bits [15:8] in the upper ram of data set 0, 1, 2, or 3. dset0we2u, dset1we2u, dset2we2u, dset3we2u data set 0, 1, 2, 3 write enable byte 2, upper output asserting this signal high enables writing to data bits [23:16] in the upper ram of data set 0, 1, 2, or 3. dset0we3u, dset1we3u, dset2we3u, dset3we3u data set 0, 1, 2, 3 write enable byte 3, upper output asserting this signal high enables writing to data bits [31:24] in the upper ram of data set 0, 1, 2, or 3. dtagadrs[12:0] data cache tag address output this bus contains the address for the data tag rams. dtagdata[21:0] data cache tag data output this bus contains data to be written to the data tag rams. dtagset0en, dtagset1en, dtagset2en, dtagset3en, data set 0, 1, 2, 3 tag enable output driving this signal high enables the clock on the set 0, 1, 2, or 3 tag ram. driving it low disables the clock, which saves power. the rams do not have to connect to this pin. the function is not changed if the rams ignore the enable and clock every cycle. dtagset0we, dtagset1we, dtagset2we, dtagset3we, data set 0, 1, 2, 3 tag write enable output asserting this signal high enables writing to the set 0, 1, 2, or 3 tag ram. dvalid[3:0] data cache valid bits input these bits are the data cache valid bits. there is one valid bit for each data cache set. individual valid bits are selected by the index portion of the cache address.
2-20 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. dvalidset data cache valid set output driving this signal high sets the selected valid bit, and driving it low clears the valid bit. it is used when a new line is loaded into cache. dvalidwe data cache valid write enable output this signal is the valid bit write enable. it is used when a new line is loaded into the data cache. repldirtyhi replacement dirty bit high input this signal controls the dirty bit for the upper half of the line being replaced. repldirtylo replacement dirty bit low input this signal controls the dirty bit for the lower half of the line being replaced. wrhitbable write hit bufferable output this signal is driven high for write back, and it is driven low for write through. the dirty bits are set in write back mode only. wrhitbufadrs[17:4] write hit buffer address output these bits contain the address of the write hit buffer. wrhitramwe write hit ram write enable output this signal is driven high for a data cache write. note that the dirty bits are set on a write hit. wrhitset[3:0] write hit set output each wrhitset[3:0] bit corresponds to a data cache set. when one of these bits is high, the associated data cache dirty bit will set on a write hit. 2.8 coprocessor interface signals this section describes the ARM946E-S coprocessor interface signals.
coprocessor interface signals 2-21 copyright 2000?001 by lsi logic corporation. all rights reserved. chsde[1:0] coprocessor handshake decode input these inputs are the handshake signals from the decode stage of the coprocessor pipeline follower. chsex[1:0] coprocessor handshake execute input these inputs are the handshake signals from the execute stage of the coprocessor pipeline follower. cpclken coprocessor clock enable output this signal provides a synchronous enable for the coprocessor pipeline follower. when cpclken is high, the pipeline follower logic advances on the rising edge of clk. cpdin[31:0] coprocessor write data input this 32-bit bus is the coprocessor write data bus for transferring data from the coprocessor. cpdout[31:0] coprocessor read data output this 32-bit bus is the coprocessor read data bus for transferring data to the coprocessor. cpinstr[31:0] coprocessor instruction data output this 32-bit bus is the coprocessor instruction data bus for transferring instructions to the coprocessor pipeline follower. cplatecancel output if this signal is high during the ?st memory cycle of a coprocessor instruction, the coprocessor must cancel the chsde[1:0] encoding 00 wait 01 go 10 absent 11 last chsex[1:0] encoding 00 wait 01 go 10 absent 11 last
2-22 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. instruction without changing any internal state. this signal is only asserted in cycles when the previous instruction caused a data abort. cppass coprocessor pass output when high, this signal indicates that there is a coprocessor instruction in the execute stage of the pipeline that must be executed. cptbit coprocessor instruction thumb bit output when cptbit is high, the ARM946E-S is in the thumb state. when this signal is low, the ARM946E-S is in the arm state. the coprocessor pipeline follower samples this signal. ncpmreq not coprocessor instruction request output when this signal is low and cpclken is high on the rising edge of clk, then the instruction on the cpinstr[31:0] data bus must enter the coprocessor pipeline. ncptrans not coprocessor memory translate output when this signal is low, the ARM946E-S is in user mode. when the signal is high, the ARM946E-S is in privileged mode. the coprocessor pipeline follower samples this signal. 2.9 debug signals the following information describes the ARM946E-S debug signals. commrx communications channel receive output when high, this signal indicates that the communications channel receive buffer contains valid data that is waiting to be read. commtx communications channel transmit output when high, this signal indicates that the communications channel transmit buffer is empty. dbgack debug acknowledge output when high, this signal indicates that the processor is in debug state.
debug signals 2-23 copyright 2000?001 by lsi logic corporation. all rights reserved. dbgdewpt data watchpoint input external hardware asserts this signal to halt execution of the processor for debug purposes. if this signal is high at the end of a data memory request cycle, it causes the ARM946E-S to enter debug state. dbgen debug enable input when high, this signal enables the debug features of the processor. tie this signal low if debug is not required. dbgext[1:0] embeddedice-rt external input input these inputs to the embeddedice-rt logic make breakpoints/watchpoints dependent on external conditions. dbgiebkpt instruction breakpoint input external hardware asserts this signal to halt execution of the processor for debug purposes. if this signal is high at the end of an instruction fetch, it causes the ARM946E-S to enter the debug state when the instruction reaches the execute stage of the processor pipeline. dbginstrexec instruction executed output when this signal is high, it indicates the processor executed the instruction in the execute stage of the processor pipeline. dbgrng[1:0] embeddedice-rt range out output these signals indicate that the corresponding embeddedice-rt watchpoint register matches the conditions currently present on the address, data, and control buses. these signals are independent of the state of the watchpoint enable control bit. dbgrqi internal debug request output this signal is the debug request that is presented to the core debug logic. it is a combination of edbgrq and bit 1 of the debug control register. edbgrq external debug request input an external debugger asserts this signal to force the processor to enter the debug state.
2-24 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. 2.10 jtag signals the following information describes the ARM946E-S jtag signals. dbgir[3:0] tap controller instruction register output these four bits re?ct the current instruction loaded in the tap controller instruction register. they change when the tap controller is in the update-ir state. dbgntrst not test reset input this active-low input is the internally synchronized reset signal for the embeddedice-rt internal state. dbgntdoen not dbgtdo enable output when low, this signal indicates that there is serial data on the dbgtdo output. normally, this signal is used as an output enable for a dbgtdo pin in a packaged part. dbgscreg[4:0] scan chain id output these ?e bits re?ct the id number of the scan chain currently selected by the tap controller. they change when the tap controller is in the update-dr state. dbgsdin external scan chain serial input data output this output contains the serial data for an external scan chain. dbgsdout external scan chain serial data output input dbgsdout contains serial data from an external scan chain. tie this signal low when an external scan chain is not connected. dbgtapsm[3:0] tap controller state machine output this bus re?cts the current state of the tap controller state machine. dbgtcken test clock enable input this signal is the synchronous enable test clock. dbgtdi test data in input this signal is the test data input to the debug logic.
miscellaneous signals 2-25 copyright 2000?001 by lsi logic corporation. all rights reserved. dbgtdo test data out output this signal is the test data output from the debug logic. dbgtms test mode select input this signal is the tap controller test mode select. tapid[31:0] boundary scan id code input these signals specify the id code value shifted out on dbgtdo when the idcode instruction is entered in the tap controller. 2.11 miscellaneous signals this section describes miscellaneous ARM946E-S signals. bigendout big endian output when this signal is high, the ARM946E-S handles memory data bytes using the big-endian format. when low, memory data is handled as little endian. nfiq not fast interrupt request input when an external source drives this signal low, it causes a fast interrupt request (fiq) exception in the processor. nfiq must be synchronous with clk. nirq not interrupt request input when an external source drives this signal low, it causes a normal interrupt request (irq) exception in the processor. nirq must be synchronous with clk. vinithi exception vector location at reset input this signal determines the reset location of the exception vectors. when vinithi is low, the vectors are located at 0x00000000. when it is high, the vectors are located at 0xffff0000. 2.12 etm interface signals this section describes the ARM946E-S etm interface signals.
2-26 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. etmbigend endian mode output this output indicates the endian mode for the etm. when this signal is high, the mode is big endian; when etmbigend is low, the mode is little endian. etmchsd[1:0] etm coprocessor handshake decode output these outputs are the handshake signals from the decode stage of the coprocessors pipeline follower. etmchse[1:0] etm coprocessor handshake execute output these outputs are the handshake signals from the execute stage of the coprocessors pipeline follower. etmda[31:0] etm data address output this 32-bit bus contains the etm data address. etmdabort etm data abort output assertion of this signal indicates a data abort to the arm9e-s core. etmdbgack etm debug mode indication output when high, this signal indicates that the processor is in debug state. etmchsd[1:0] encoding 10 absent 00 wait 01 go 11 last etmchse[1:0] encoding 10 absent 00 wait 01 go 11 last
etm interface signals 2-27 copyright 2000?001 by lsi logic corporation. all rights reserved. etmdmas[1:0] etm data size indicator output these signals indicate the data size of the etm. they become valid in the same cycle as the data address bus. etmdmore etm sequential data indication output the etmdmore signal is active during load and store multiple instructions and only goes high when etmdnmreq is low. this signal effectively gives the same information as etmdseq, but one cycle ahead. this information allows external logic more time to decode sequential cycles. etmdnmreq etm data memory request output this signal is asserted high when the ARM946E-S is making a request to etm data memory. etmdnrw etm data r/w output if this signal is low at the end of the cycle, then any data memory access in the following cycle is a read; if this signal is high, then the access is a write. etmdseq etm sequential data indication output if this signal is high at the end of the cycle, then any data memory access in the following cycle is sequential from the last data memory access. etmen etm enable input when this signal is high, the etm is enabled and the arm9e-s interface signals are driven out of this module, pipelined by one clock stage. etmhivecs exception vector location output when this output is low, the arm9e-s exception vectors start at address 0x0000.0000. when this signal is high, the arm9e-s exception vectors start at address 0xffff.0000. this output is a static con?uration signal. etmdmas[1:0] transfer size 00 byte 01 halfword 10 word 11 reserved
2-28 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. etmia[31:1] etm instruction address bus output this 31-bit bus contains the address for the etm. etmiabort etm instruction abort output this signal is asserted high to abort an etm instruction. etmid31to24[31:24] bits [31:24] of the tapid register output these outputs re?ct the status of bits [31:24] of the device identi?ation (id) code test data register. etmid15to8[15:8] bits [15:8] of the tapid register output these outputs re?ct the status of bits [15:8] of the device identi?ation (id) code test data register. etminmreq etm instruction memory request output the ARM946E-S drives this output low to indicate that an instruction fetch will take place. etminstrexec etm instruction execute indicator output assertion high of this output indicates that the instruction in the execute stage of the processor pipeline has been executed. etminstrvalid etm valid instruction output this signal is the valid instruction indication for the etm. etmiseq etm sequential instruction output the etmiseq signal indicates whether the fetch is sequential (high) or nonsequential (low) to the previous access. etmitbit etm thumb indication output when this signal is low, the processor is in arm state, and 32-bit instructions are fetched. when etmitbit is high, the processor is in thumb state, and 16-bit instructions are fetched. etmlatecancel etm coprocessor late cancel indicator output if this output is high during the ?st memory cycle of a coprocessor instruction, then the coprocessor should cancel the instruction without changing any internal state.
etm interface signals 2-29 copyright 2000?001 by lsi logic corporation. all rights reserved. this signal is only asserted in cycles where the previous instruction accessed memory and a data abort occurred. etmnwait etm clock stall output when this output is low, it indicates the processor is stalled. etmpass etm coprocessor instruction execute indicator output a high on this signal indicates that there is a coprocessor instruction in the execute stage of the pipeline, which must be executed. etmprocid[31:0] etm process id output these signals are the process identi?r for the etm. etmprocidwr etm process id write strobe output this signal is the etmprocid write strobe. etmrdata[31:0] etm read data output this 32-bit bus contains etm read data. etmrngout etm watchpoint register match output this output indicates that the corresponding embeddedice watchpoint register has matched the conditions currently present on the address, data, and control buses. this signal is independent of the state of the watchpoints enable control bit. etmwdata[31:0] etm write data output this 32-bit bus contains etm write data. tapid[31:0] boundary scan id code input this bus speci?s the id code value shifted out on dbgtdo when the idcode instruction is entered into the tap controller.
2-30 signal descriptions copyright 2000?001 by lsi logic corporation. all rights reserved. 2.13 atpg scan control signals scanen scan enable input asserting this signal high enables scanning data through the scan chain. si scan chain in input si is the input for the serial scan chain. there is one si pin for each scan chain. so scan chain out output so is the output of the serial scan chain. there is one so pin for each scan chain.
ARM946E-S microprocessor core with cache technical manual 3-1 copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 3 programmers model this chapter describes the programmers model for the ARM946E-S. it contains the following sections: ? section 3.1, ?bout the ARM946E-S programmers model ? section 3.2, ?bout the arm9e-s programmers model ? section 3.3, ?p15 registers ? section 3.4, ?p14 registers 3.1 about the ARM946E-S programmers model the programmers model for the ARM946E-S primarily consists of the arm9e-s core programmers model (see section 3.2, ?bout the arm9e-s programmers model, on page 3-2 ). additions to this model are required to control the operation of the ARM946E-S internal coprocessors and any coprocessor connected to the external coprocessor interface. there are two internal coprocessors within the ARM946E-S: ? cp14 cp14, which is located within the arm9e-s core, allows software access to the debug communications channel. the registers de?ed in cp14 are accessible with mcr and mrc instructions, and are described in section 3.4, ?p14 registers on page 3-34 . ? cp15 cp15 allows con?uration of the caches, tightly coupled sram, protection unit, write buffer, and other ARM946E-S system options. the registers de?ed in cp15 are accessible with mcr and mrc
3-2 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. instructions, and are described in section 3.3, ?p15 registers, on page 3-2 . registers and operations provided by any coprocessors attached to the external coprocessor interface are accessible with appropriate coprocessor instructions. 3.2 about the arm9e-s programmers model the arm9e-s processor core implements the armv5texp architecture, which includes the 32-bit arm instruction set and the 16-bit thumb instruction set. for a description of both instruction sets, see the arm architecture reference manual . contact arm for complete descriptions of both instruction sets. the arm9e-s uses the base restored data abort model , which differs from the base updated data abort model implemented by arm7tdmi. the difference in the arm9e-s data abort model affects only a very small section of operating system code, the data abort handler. it does not affect user code. with the base restored data abort model , when a data abort exception occurs during the execution of a memory access instruction, the processor hardware always restores the base register to the value it had before the instruction was executed. this action eliminates the requirement that the data abort handler unwind any base register update the aborted instruction might have caused. the base restored data abort model signi?antly simpli?s the data abort handler software. 3.3 cp15 registers the ARM946E-S incorporates cp15 for system control. cp15 allows con?uration of the caches, tightly coupled sram, protection unit, write buffer, and other ARM946E-S system options?uch as big- or little-endian operation. table 3.1 shows the cp15 register map.
cp15 registers 3-3 copyright 2000?001 by lsi logic corporation. all rights reserved. table 3.1 cp15 register map register read write 0 id code 1 1. register location provides access to more than one register. the register accessed depends on the value of the opcode_2 or crm ?ld. see the register description for details. unpredictable 0 cache type 1 unpredictable 0 tightly coupled memory size 1 unpredictable 1 control control 2 cache con?uration 2 2. separate registers for instruction and data. see the register description for details. cache con?uration 2 3 write buffer control write buffer control 4 unpredictable unpredictable 5 access permission 2 access permission 2 6 protection region base and size 1 protection region base and size 1 7 unpredictable cache operations 8 unpredictable unpredictable 9 cache lockdown 2 cache lockdown 2 9 tightly coupled memory region 2 tightly coupled memory region 2 10 unpredictable unpredictable 11 unpredictable unpredictable 12 unpredictable unpredictable 13 process id process id 14 unpredictable unpredictable 15 test state 1 test state 1 15 cache debug index 1 cache debug index 1
3-4 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. 3.3.1 accessing cp15 registers table 3.2 de?es some of abbreviations and terms used in the register descriptions. reading from or writing any data values to the cp15 registers, including those ?lds speci?d as unpredictable or rwz/rwo , does not cause any permanent damage. hresetn clears to 0 all cp15 register bits that are de?ed and contain state, except avs (bit 13) in register 1. when hresetn is asserted low, the the vinithi core input pin drives the avs bit high or low. the two tightly coupled memory region registers indicate the physical size of the instruction and data srams. you must be in privileged mode to access the cp15 registers with the mrc and mcr instructions. figure 3.1 shows the mrc and mcr instruction format. figure 3.1 mrc and mcr instruction format the assembler syntax for these instructions is: table 3.2 cp15 abbreviations abbreviation term description unp unpredictable for reads, the data returned when reading from this location is unpredictable. it can have any value. for writes, writing to this location causes unpredictable behavior, or an unpredictable change in device con?uration. und unde?ed an instruction that accesses cp15 in the manner indicated takes the unde?ed instruction trap. rwz reserved write zero these bits are reserved. write zeros to all bits in this ?ld. rwo reserved write one these bits are reserved. write ones to all bits in this ?ld. 31 28 27 24 23 21 20 19 16 15 12 11 8 7 5 4 3 0 cond 1110 opcode_1 l crn rd 1111 opcode_2 1 crm
cp15 registers 3-5 copyright 2000?001 by lsi logic corporation. all rights reserved. mcr/mrc{cond} p15, opcode_1, rd, crn, crm, opcode_2 the processor takes an unde?ed instruction trap if any of the following instructions attempt to access cp15: cdp, ldc, and stc, or unprivileged mrc and mcr instructions. the crn ?ld of the mrc and mcr instructions speci?s which coprocessor register to access. the crm ?ld and opcode_2 ?ld specify a particular action when addressing registers. attempting to read from a nonreadable register or writing to a nonwritable register causes unpredictable results. for all instructions that access cp15, the opcode_1, opcode_2, and crm ?lds should be 0, except when the values speci?d are used to select an operation. using other values results in unpredictable behavior. 3.3.2 id code register (0) this is a read-only register that returns a 32-bit device id code. the id code register is accessed by reading cp15 register 0 with the opcode_2 ?ld set to any value other than 1 or 2. for example: mrc p15, 0, rd, c0, c0, {0,3?}; returns id register figure 3.2 shows the id code register format. figure 3.2 id code register i implementor [31:24] this ?ld speci?s the implementor and has a value of 0x41. r reserved [23:20] this ?ld is reserved and has a value of 0x00. ar architecture revision [19:16] this ?ld identi?s the revision level of the architecture. 31 24 23 20 19 16 15 4 3 0 i r ar pn v
3-6 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. pn part number [15:4] this ?ld speci?s the part number. in this case, the part number is 0x946. v version [3:0] this ?ld contains the hardware version number, which is implementation speci?. 3.3.3 cache type register (0) this is a read-only register that contains information about the size and architecture of the instruction cache (i-cache) and data cache (d-cache). it also allows operating systems to establish how to perform operations, such as cache cleaning and lockdown. future arm cached processors will contain this register, allowing rtos vendors to produce future-proof versions of their operating systems. the cache type register is accessed by reading cp15 register 0 with the opcode_2 ?ld set to 1. for example: mrc p15, 0, rd, c0, c0, 1; returns cache details figure 3.3 shows the register format. figure 3.3 cache type register r reserved [31:29], [23:22], [11:10] these ?lds are reserved and have a value 0. ct cache type [28:25] this ?ld speci?s the cache type and has a value of 0b0111. this value means the cache provides: h harvard/uni?d 24 this bit speci?s the cache architecture. this value is 1, because the ARM946E-S uses a harvard architecture. 31 2928 2524232221 1817 1514131211109 65 3210 r ct h r dcs dca db dw r ics ica ib iw - cache clean-step operation - cache ?sh-step operation - lockdown capability
cp15 registers 3-7 copyright 2000?001 by lsi logic corporation. all rights reserved. dcs data cache size [21:18] this ?ld indicates the data cache size. the actual value is implementation dependent. the encoding for the cache size bits is shown below. dca data cache associativity [17:15] this ?ld indicates the data cache associativity. the encoding is shown below. the actual value depends on the implementation and is de?ed by the implementor. if the design has a data cache, the associativity for that cache is set to 0b010 to indicate a 4-way set associative cache. db data cache base size 14 this bit indicates the data cache base size. the value is implementation dependent. if there is a data cache, this bit is cleared to 0 to indicate that the cache type parameters are valid. if there is no data cache, this bit is set to 1 to indicate the data cache is not present. dw data cache words per line [13:12] this ?ld speci?s the data cache words per line. the value is 0b10, which speci?s 8 words per line. value of bits [21:18] cache size 0b0000 0 kbytes 0b0011 4 kbytes 0b0100 8 kbytes 0b0101 16 kbytes 0b0110 32 kbytes 0b0111 64 kbytes 0b1000 128 kbytes 0b1001 256 kbytes 0b1010 512 kbytes 0b1011 1 mbyte value associativity 0b000 direct mapped 0b001 2-way set associative 0b010 4-way set associative
3-8 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. ics instruction cache size [9:6] this ?ld indicates the instruction cache size, and the value is implementation dependent. the bit encoding is shown below. ica instruction cache associativity [5:3] this ?ld indicates the instruction cache associativity. the encoding is shown below. the actual value depends on the implementation and is de?ed by the implementor. if the design has an instruction cache, the associativity for that cache is set to 0b010 to indicate a 4-way set associative cache. ib instruction cache base size 2 this bit speci?s the instruction cache base size. the value is implementation dependent. if there is an instruction cache, this bit is cleared to 0 to indicate that the cache type parameters are valid. if there is no instruction cache, this bit is set to 1 to indicate the instruction cache is not present. value of bits [9:6] cache size 0b0000 0 kbytes 0b0011 4 kbytes 0b0100 8 kbytes 0b0101 16 kbytes 0b0110 32 kbytes 0b0111 64 kbytes 0b1000 128 kbytes 0b1001 256 kbytes 0b1010 512 kbytes 0b1011 1 mbyte value associativity 0b000 direct mapped 0b001 2-way set associative 0b010 4-way set associative
cp15 registers 3-9 copyright 2000?001 by lsi logic corporation. all rights reserved. iw instruction cache word per line [1:0] this ?ld speci?s the instruction cache words per line. the value is 0b10, which is 8 words per line. note: the cache base size and cache size ?lds are generated within the cache block so designs with different cache sizes do not have to be resynthesized. 3.3.4 tightly coupled memory size register (0) this is a read-only register that returns the size of the tightly coupled instruction and data rams included within the ARM946E-S. to access the tightly coupled memory size register, read cp15 register 0 with the opcode_2 ?ld set to 2. for example: mrc p15, 0, rd, c0, c0, 2; returns tightly coupled memory size register figure 3.4 shows the register format. figure 3.4 tightly coupled memory size register r reserved [31:22], [17:15], [13:10]. [5:3], [1:0] these ?lds are reserved and have a value 0. drs data ram size [21:18] this ?ld speci?s the data ram size. it is implementation speci?. the values are generated within the memory blocks, which allows changing the memory size without resynthesizing the full design. the bit encoding is shown below. 31 2221 1817 151413 109 65 3210 r drs r da r irs r ia r
3-10 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. da data ram absent 14 if this bit is set. the data ram is not present. if it is clear, the data ram is present. irs instruction ram size [9:6] this ?ld speci?s the instruction ram size. it is implementation speci?. the values are generated within the memory blocks, which allows changing the memory size without resynthesizing the full design. the bit encoding is shown below. value of bits [21:18] data ram size 0b0000 0 kbytes 0b0011 4 kbytes 0b0100 8 kbytes 0b0101 16 kbytes 0b0110 32 kbytes 0b0111 64 kbytes 0b1000 128 kbytes 0b1001 256 kbytes 0b1010 512 kbytes 0b1011 1 mbyte value of bits [9:6] instruction ram size 0b0000 0 kbytes 0b0011 4 kbytes 0b0100 8 kbytes 0b0101 16 kbytes 0b0110 32 kbytes 0b0111 64 kbytes 0b1000 128 kbytes 0b1001 256 kbytes 0b1010 512 kbytes 0b1011 1 mbyte
cp15 registers 3-11 copyright 2000?001 by lsi logic corporation. all rights reserved. ia instruction ram absent 2 if this bit is set, the instruction ram is not present. if it is clear, the instruction ram is present. 3.3.5 control register (1) this register contains the ARM946E-S control bits. all reserved bits must be written with either 0 or 1, as indicated below, or written using read-modify-write. the reserved bits have an unpredictable value when read. to read and write this register: mrc p15, 0, rd, c1, c0, 0; read control register mcr p15, 0, rd, c1, c0, 0; write control register figure 3.5 shows the register format. figure 3.5 control register rwz reserved - write zero [31:20], [11:8], 1 these bits are reserved. write zeros to these bits. ilm instruction ram load mode 19 when this bit is set to 1, you can use the instruction ram load mode to initialize the instruction ram. this mode allows you to load data into arm registers from either data cache or main memory, and then write to the same address but within the tightly coupled instruction ram. this capability allows you to copy boot code from memory located at address 0x0 into the instruction ram which, when enabled, also exists at address 0x0. the operation of the load mode is described in section 6.2.3, ?-sram load mode, on page 6-3 . at reset, this bit is cleared. ire instruction ram enable 18 when this bit is set to 1, the instruction ram is enabled, and all instruction and data accesses to the instruction ram address range access the instruction ram. at reset, this bit is cleared. 31 20 19 18 17 16 15 14 13 12 11 8 7 6 3 2 1 0 rwz ilm ire dlm dre cdl rr avs ie rwz edn rwo de r wz pe
3-12 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. dlm data ram load mode 17 when this bit is set to 1, you can use the data ram load mode for initializing the data ram. first, do a load data into arm registers from either the data cache or main memory. then store the data from the arm registers into the tightly coupled data ram using the same address from which the data originated. the operation of the load mode is described in section 6.2.3, ?-sram load mode, on page 6-3 . at reset, this bit is cleared. dre data ram enable 16 when this bit is set to 1, the data ram is enabled. then the data ram takes precedence over the data cache and ahb for data accesses. at reset, this bit is cleared. cdl con?ure disable loading tbit 15 this bit controls the behavior of load pc instructions. when cleared to 0, the armv5texp-speci? behavior is enabled, and bit 0 of the loaded data controls the entry into the thumb state when the pc (r15) is the destination register. when set to 1, this armv5texp behavior is disabled. at reset, this bit is cleared. rr round-robin replacement 14 this bit controls the cache replacement algorithm. when set to 1, round-robin replacement is used. when cleared to 0, a pseudo-random replacement algorithm is used. at reset, this bit is cleared. avs alternate vectors select 13 this bit controls the base address used for the exception vectors. when cleared to 0, the base address for the exception vectors is 0x00000000. when set to 1, the base address is 0xffff0000. note: this bit is initialized to either 1 or 0 during system reset, depending on the value of the input pin, vinithi. this allows you to de?e the exception vector location during reset to suit the boot mechanism of the application. you can then reprogram this bit as required following system reset.
cp15 registers 3-13 copyright 2000?001 by lsi logic corporation. all rights reserved. ie i-cache enable 12 this bits controls i-cache behavior. to use the instruction cache, both the protection unit enable bit (bit 0) and the i-cache enable bit must be set to 1. you can do this with a single write to register 1. at reset, this bit is cleared. edn endian 7 this bit selects the endian con?uration of the ARM946E-S. when this bit is set to 1, the big-endian con?uration is selected. when cleared to 0, the little-endian con?uration is selected. at reset, this bit is cleared. rwo reserved - write ones [6:3] this ?ld is reserved. write ones to these bits. de d-cache enable 2 this bit controls the behavior of the d-cache. to use the data cache, both the protection unit enable bit (bit 0) and the d-cache enable bit must be set to 1. this can be done with a single write to register 1. at reset, this bit is cleared. pe protection unit enable 0 this bit controls the operation of the ARM946E-S protection unit. at reset, this bit is cleared, which disables the protection unit. it also disables the instruction cache, data cache, and the write buffer. at least one protection region must be programmed before the protection unit is enabled. see section 3.3.9, ?rotection region/base size (pr/bs) registers (6), on page 3-19 and chapter 3, ?rogrammers model. 3.3.6 cache con?uration registers (2) these registers contain the cacheable attributes for the eight memory regions. individual control is provided for the i and d caches. if the opcode_2 ?ld = 0, then the data cache bits are programmed. if the opcode_2 ?ld = 1, then the instruction cache bits are programmed. to read and write these registers:
3-14 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. mrc p15, 0, rd, c2, c0, 0; read data cacheable bits mrc p15, 0, rd, c2, c0, 1; read instruction cacheable bits mcr p15, 0, rd, c2, c0, 0; write data cacheable bits mcr p15, 0, rd, c2, c0, 1; write instruction cacheable bits the format for the cacheable bits in the data and instruction areas is the same. figure 3.6 shows the register format. figure 3.6 instruction/data cacheable bits register c_n cacheable bits for memory region 7:0 [7:0] these bits allow you to individually enable or disable the cacheable attribute for each memory region. setting a bit to 1 makes the corresponding memory region cacheable; clearing the bit makes that memory region uncacheable. 3.3.7 write buffer control register (3) this register contains the write buffer control (bufferable) attribute for the eight memory regions. note: this register only applies to data accesses. to read and write the write buffer control register: mcr p15, 0, rd, c3, c0, 0; write data bufferable bits mrc p15, 0, rd, c3, c0, 0; read data bufferable bits figure 3.7 shows the register format. 76543210 c_7 c_6 c_5 c_4 c_3 c_2 c_1 c_0 bit corresponds to memory region c_7 7 c_6 6 c_5 5 c_4 4 c_3 3 c_2 2 c_1 1 c_0 0
cp15 registers 3-15 copyright 2000?001 by lsi logic corporation. all rights reserved. figure 3.7 write buffer control register b_n bufferable bits for memory area 7:0 [7:0] these bits allow you to individually enable or disable the bufferable attribute for each memory region. setting a bit to 1 makes the corresponding memory area bufferable; clearing the bit makes that memory region not bufferable. 3.3.8 access permission registers (5) there are four access permission registers: ? instruction access permission (extended) ? data access permission (extended) ? instruction access permission (standard) ? data access permission (standard) these registers contain the access permission bits for the instruction and data protection regions. the opcode_2 ?ld of the mcr / mrc instruction determines whether to access the standard or extended instruction or data access permission registers. 3.3.8.1 extended instruction/data access permission registers to read and write the extended registers: 76543210 b_7 b_6 b_5 b_4 b_3 b_2 b_1 b_0 bit corresponds to memory data region b_7 7 b_6 6 b_5 5 b_4 4 b_3 3 b_2 2 b_1 1 b_0 0
3-16 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. mrc p15, 0, rd, c5, c0, 2; read data access permission bits mrc p15, 0, rd, c5, c0, 3; read instruction access permission bits mcr p15, 0, rd, c5, c0, 2; write data access permission bits mcr p15, 0, rd, c5, c0, 3; write instruction access permission bits figure 3.8 shows the extended instruction/data register format. the same format applies to both the instruction and data access permission areas. figure 3.8 instruction/data access permission (i/dap) register (extended) i/dap7[3:0] instruction/data access permission 7 [31:28] this ?ld contains the access permission bits for area 7. the bit encoding is shown below. i/dap6[3:0] instruction/data access permission 6 [27:24] this ?ld contains the access permission bits for area 6. the bit encoding for these bits is the same as i/dap7[3:0]. i/dap5[3:0] instruction/data access permission 5 [23:20] this ?ld contains the access permission bits for area 5. the bit encoding for these bits is the same as i/dap7[3:0]. 31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 i/dap7[3:0] i/dap6[3:0] i/dap5[3:0] i/dap4[3:0] i/dap3[3:0] i/dap2[3:0] i/dap1[3:0] i/dap0[3:0] i/dap7[3:0] access permission privileged user 0b0000 no access no access 0b0001 read/write access no access 0b0010 read/write access read-only 0b0011 read/write access read/write access 0b0100 unpredictable unpredictable 0b0101 read-only no access 0b0110 read-only read-only 0b0111 unpredictable unpredictable 0b1xxx unpredictable unpredictable
cp15 registers 3-17 copyright 2000?001 by lsi logic corporation. all rights reserved. i/dap4[3:0] instruction/data access permission 4 [19:16] this ?ld contains the access permission bits for area 4. the bit encoding for these bits is the same as i/dap7[3:0]. i/dap3[3:0] instruction/data access permission 3 [15:12] this ?ld contains the access permission bits for area 3. the bit encoding for these bits is the same as ap7[3:0]. i/dap2[3:0] instruction/data access permission 2 [11:8] this ?ld contains the access permission bits for area 2. the bit encoding for these bits is the same as i/dap7[3:0]. i/dap1[3:0] instruction/data access permission 1 [7:4] this ?ld contains the access permission bits for area 1. the bit encoding for these bits is the same as i/dap7[3:0]. i/dap0[3:0] instruction/data access permission 0 [3:0] this ?ld contains the access permission bits for area 0. the bit encoding for these bits is the same as i/dap7[3:0]. 3.3.8.2 standard instruction/data access permission registers the following instructions are supported for backward compatibility with existing arm processors with memory protection, and they access the standard registers: mrc p15, 0, rd, c5, c0, 0; read data access permission bits mrc p15, 0, rd, c5, c0, 1; read instruction access permission bits mcr p15, 0, rd, c5, c0, 0; write data access permission bits mcr p15, 0, rd, c5, c0, 1; write instruction access permission bits figure 3.9 shows the extended instruction/data register format. the same format applies to both the instruction and data access permission registers.
3-18 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. figure 3.9 instruction/data access permission (i/dap) register (standard) i/dap7[1:0] instruction/data access permission 7 [15:14] this ?ld contains the access permission bits for area 7. the bit encoding is shown below. i/dap6[1:0] instruction/data access permission 6 [13:12] this ?ld contains the access permission bits for area 6. the bit encoding for these bits is the same as i/dap7[1:0]. i/dap5[1:0] instruction/data access permission 5 [11:10] this ?ld contains the access permission bits for area 5. the bit encoding for these bits is the same as i/dap7[1:0]. i/dap4[1:0] instruction/data access permission 4 [9:8] this ?ld contains the access permission bits for area 4. the bit encoding for these bits is the same as i/dap7[1:0]. i/dap3[1:0] instruction/data access permission 3 [7:6] this ?ld contains the access permission bits for area 3. the bit encoding for these bits is the same as i/dap7[1:0]. i/dap2[1:0] instruction/data access permission 2 [5:4] this ?ld contains the access permission bits for area 2. the bit encoding for these bits is the same as i/dap7[1:0]. 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 i/dap7[1:0] i/dap6[1:0] i/dap5[1:0] i/dap4[1:0] i/dap3[1:0] i/dap2[1:0] i/dap1[1:0] i/dap0[1:0] i/dap7[1:0] access permission privileged user 0b00 no access no access 0b01 read/write access no access 0b10 read/write access read-only 0b11 read/write access read/write access
cp15 registers 3-19 copyright 2000?001 by lsi logic corporation. all rights reserved. i/dap1[1:0] instruction/data access permission 1 [3:2] this ?ld contains the access permission bits for area 1. the bit encoding for these bits is the same as i/dap7[1:0]. i/dap0[1:0] instruction/data access permission 0 [1:0] this ?ld contains the access permission bits for area 0. the bit encoding for these bits is the same as i/dap7[1:0]. 3.3.8.3 programming the access permission registers at reset, the value of the i/dapn bits is unde?ed. however, because the protection unit is disabled on reset, in effect all areas are set to privileged mode with user read/write access. therefore, you must program the access permission registers before you enable the protection unit. if the access permissions are initially programmed using the extended access permissions and then reprogrammed using the standard access permissions, the access permissions are applied as if i/dapn[3:2] are 0b00. 3.3.9 protection region/base size (pr/bs) registers (6) there are eight protection region/base size registers. you can de?e eight programmable regions using these registers. the values are ignored when the protection unit is disabled, and on reset only the region enable bit for each region is reset to 0. all other bits are unde?ed. you must program at least one memory region before you enable the protection unit. the instructions that access the eight protection region/base size registers are listed in table 3.3 .
3-20 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. figure 3.10 shows the pr/bs register format. figure 3.10 pr/bs register rb region base [31:12] this ?ld speci?s the region base. u unde?ed [11:6] these bits are unde?ed. as area size [5:1] this ?ld determines the area size. the bit encoding is shown below. table 3.3 accessing pr/bs registers arm instruction pr/bs register memory region mcr/mrc p15, 0, rd, c6, c7, 0 7 7 mcr/mrc p15, 0, rd, c6, c6, 0 6 6 mcr/mrc p15, 0, rd, c6, c5, 0 5 5 mcr/mrc p15, 0, rd, c6, c4, 0 4 4 mcr/mrc p15, 0, rd, c6, c3, 0 3 3 mcr/mrc p15, 0, rd, c6, c2, 0 2 2 mcr/mrc p15, 0, rd, c6, c1, 0 1 1 mcr/mrc p15, 0, rd, c6, c0, 0 0 0 31 12 11 6 5 1 0 rb unde?ed as re bit encoding 1 area size 0b00000 to 01010 reserved (unp) 0b01011 4 kbytes 0b01100 8 kbytes 0b01101 16 kbytes 0b01110 32 kbytes 0b01111 64 kbytes
cp15 registers 3-21 copyright 2000?001 by lsi logic corporation. all rights reserved. re region enable 0 when this bit is set, it enables the memory region associated with this register. when cleared, it disables the memory region. you must align the region base to an area size boundary, where the area size is de?ed in its respective protection region register. if this is not done, the behavior is unpredictable. 3.3.9.1 example base setting an 8 kbyte-size region aligned to an 8 kbyte boundary at 0x0000.2000 (covering the address range 0x0000.2000 to 0x0000.3fff) is programmed as 0x0000.2019. the following instruction allows the protection region registers to be read, and it provides backward compatibility with other arm processors that use a memory protection unit. 0b10000 128 kbytes 0b10001 256 kbytes 0b10010 512 kbytes 0b10011 1 mbyte 0b10100 2 mbytes 0b10101 4 mbytes 0b10110 8 mbytes 0b10111 16 mbytes 0b11000 32 mbytes 0b11001 64 mbytes 0b11010 128 mbytes 0b11011 256 mbytes 0b11100 512 mbytes 0b11101 1 gbyte 0b11110 2 gbytes 0b11111 4 gbytes 1. using any value less than 0b01011 causes unpredictable behavior. bit encoding 1 area size
3-22 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. mrc p15, 0, rd, c6, crm, 1; returns protection region register writes to the protection region/base size registers with opcode_2 set to 1 are unpredictable. 3.3.10 cache operations register (7) you can perform the following cache operations by writing to the cache operations register: ? flush i-cache and d-cache ? prefetch an i-cache line ? clean and ?sh the d-cache ? drain the write buffer ? wait for interrupt the ARM946E-S uses a subset of the arm architecture v4 functions that are de?ed in the arm architecture reference manual. table 3.4 summarizes the ARM946E-S cache operations. table 3.4 cache operations arm instruction cache operation written to register 7 mcr p15, 0, rd, c7, c5, 0 flush i-cache zero 1 mcr p15, 0, rd, c7, c5, 1 flush i-cache single entry address mcr p15, 0, rd, c7, c13, 1 prefetch i-cache line address mcr p15, 0, rd, c7, c6, 0 flush d-cache zero 1 mcr p15, 0, rd, c7, c6, 1 flush d-cache single entry address mcr p15, 0, rd, c7, c10, 1 clean d-cache entry address mcr p15, 0, rd, c7, c14, 1 clean and ?sh d-cache entry address mcr p15, 0, rd, c7, c10, 2 clean d-cache entry index/set mcr p15, 0, rd, c7, c14, 2 clean and ?sh d-cache entry index/set 1. the rd value transferred to register 7 should be 0.
cp15 registers 3-23 copyright 2000?001 by lsi logic corporation. all rights reserved. figure 3.11 shows the format for operations that transfer index/set information to the cache operations register. figure 3.11 index and set format set set [31:30] this ?ld speci?s the cache set. rwz reserved - write zero [29:n+1] these bits are reserved. write zeros to these bits. idx index [n:5] this ?ld speci?s the cache index. the size of the index varies depending on the implemented cache size. table 3.5 shows how the index size changes for the cache sizes supported by the ARM946E-S. table 3.5 assumes a 4-way set associative cache. as associativity decreases the cache needs more address bits. for a 2-way cache, each index address entry in the table requires one additional address bit. for a direct-mapped cache, two additional bits are required. 31 30 29 n+1 n 5 4 0 set rwz idx rwz table 3.5 index fields for supported cache sizes cache size index 4 kbytes addr[9:5] 8 kbytes addr[10:5] 16 kbytes addr[11:5] 32 kbytes addr[12:5] 64 kbytes addr[13:5] 128 kbytes addr[14:5] 256 kbytes addr[15:5] 512 kbytes addr[16:5] 1 mbyte addr[17:5]
3-24 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. for cache operations that write an address to register 7 (see table 3.4 ), figure 3.12 shows the register format. figure 3.12 address format 3.3.10.1 cache clean and flush operations cache clean and ?sh operations can occur during instruction and data line fetches. in these circumstances, the line fetch completes before the clean or ?sh operation is executed. 3.3.10.2 noncache operations writing to the cache operations register is also used for two noncache operations: ? drain write buffer ? wait for interrupt drain write buffer this operation stalls instruction execution until the write buffer is emptied. stalling is useful in real-time applications where the processor must be sure that a write to a peripheral has ?ished before program execution continues. for example, if a peripheral in a bufferable region is the source of an interrupt, then after the interrupt is serviced, the request must be removed before interrupts are enabled again. this requirement is ensured if there is a drain write buffer operation between the store to the peripheral and the interrupt enable. writing to register 7 invokes the drain write buffer operation. use the following arm instruction: mcr cp15, 0, rd, c7, c10, 4; drain write buffer this write transfer stalls the processor core until all outstanding accesses in the write buffer are completed. in other words, it stalls the processor until all data in the buffer is written to external memory. wait for interrupt this operation allows the ARM946E-S to enter a low-power standby mode. when you invoke the operation, the clken 31 54 0 cache line address rwz
cp15 registers 3-25 copyright 2000?001 by lsi logic corporation. all rights reserved. signal to the processor core is negated and the cache and tightly coupled memories are placed in a low-power state until either an interrupt or a debug request occurs. this wait for interrupt operation is invoked by writing to register 7 using the following arm instruction: mcr p15, 0, rd, c7, c0, 4; wait for interrupt this encoding is preferred for new software. for compatibility with existing software, ARM946E-S also supports the following arm instruction, which has the same effect: mcr p15, 0, rd, c15, c8, 2; wait for interrupt this instruction stalls the processor from the time that the instruction is executed until either nfiq, nirq, or edbgrq are asserted. if the debugger sets the debug request bit in the embeddedice-rt logic control register, it causes the wait for interrupt condition to terminate. in the case of nfiq and nirq, the processor core wakes up regardless of whether the interrupts are enabled or disabled (that is, independent of the i and f bits in the processor cpsr). the debug related wake up only occurs if dbgen is high, that is, only when debug is enabled. if interrupts are enabled, the arm9e-s core is guaranteed to take the interrupt before executing the instruction after the wait for interrupt operation. if a debug request is used to wake up the system, the processor enters the debug state before executing any more instructions. the write buffer continues to drain until empty while the wait for interrupt operation is executing. 3.3.11 cache lockdown registers (9) the cache lockdown registers allow you to lock down regions of the cache. there are separate registers for the instruction and data cache. to read and write the registers: mcr p15, 0, rd, c9, c0, 0; write data lockdown control mrc p15, 0, rd, c9, c0, 0; read data lockdown control mcr p15, 0, rd, c9, c0, 1; write instruction lockdown control mrc p15, 0, rd, c9, c0, 1; read instruction lockdown control figure 3.12 shows the register format.
3-26 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. figure 3.13 cache lockdown register ld load 31 when this bit is set to 1, it indicates this is a lockdown load operation. unp/wz unpredictable - write zero [30:2] these bits are unpredictable, so write all zeros to them. idx index field [1:0] this ?ld speci?s the cache set. for a description of lockdown, refer to section 4.4, ?ache lockdown. 3.3.12 tightly coupled memory region registers (9) these registers allow you to modify the visible size of the instruction and data tightly coupled memories. you can either increase or decrease the size of the tightly coupled memories from the physical sizes speci?d in register 0. (see section 3.3.4, ?ightly coupled memory size register (0), on page 3-9 .) increasing the visible size of the tightly coupled memories above the physical size allows aliasing within the tightly coupled memory space. this feature is useful for debugging multitasking systems. there are two memory region registers, one for each of the tightly coupled memories: mrc p15, 0, rd, c9, c1, 0; read data tightly coupled memory mcr p15, 0, rd, c9, c1, 0; write data tightly coupled memory mrc p15, 0, rd, c9, c1, 1; read instruction tightly coupled memory mcr p15, 0, rd, c9, c1, 1; write instruction tightly coupled memory figure 3.12 shows the register format. 31 30 210 ld unp/wz idx
cp15 registers 3-27 copyright 2000?001 by lsi logic corporation. all rights reserved. figure 3.14 tightly coupled memory region register format rb region base address [31:12] this ?ld contains the region base address. und unde?ed [11:6] these bits are unde?ed. rs region size [5:1] this ?ld speci?s the region size, which can range from 4 kbytes (minimum) to 4 gbytes (maximum). the bit encodings are shown below. 31 12 11 6 5 1 0 rb und rs rw z bit encoding tightly coupled memory region size 0b00011 4 kbytes 0b00100 8 kbytes 0b00101 16 kbytes 0b00110 32 kbytes 0b00111 64 kbytes 0b01000 128 kbytes 0b01001 256 kbytes 0b01010 512 kbytes 0b01011 1mbyte 0b01100 2 mbytes 0b01101 4 mbytes 0b01110 8 mbytes 0b01111 16 mbytes 0b10000 32 mbytes 0b10001 64 mbytes
3-28 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. rwz reserved - write zero 0 this bit is reserved. write a zero to this bit. for a given number of aliases for the physical memory size, use the following function: area size = physical size + n where 2 n is the required number of aliases. you must align the region base to an area size boundary, where the area size is de?ed in its respective protection region register. the behavior is unpredictable if this is not done. the instruction tightly coupled memory base address is ?ed at 0x00000. for the instruction tightly coupled memory, the region base returns the value 0x00000 when read. when writing to the instruction tightly coupled memory, you must set the region base to 0x00000. writes with the region base set to any other value are unpredictable. at reset, the region base for both the instruction and data tightly coupled memory region registers is cleared to 0x00000. at reset, the area size for the instruction and data tightly coupled memory region registers takes the value de?ed in the tightly coupled memory size register. (see section 3.3.4, ?ightly coupled memory size register (0), on page 3-9 .) you must program the data tightly coupled memory region registers before you set the data ram enable bit (bit 16) in register 1. (see section 3.3.5, ?ontrol register (1), on page 3-11 .) if this is not done, 0b10010 128 mbytes 0b10011 256 mbytes 0b10100 512 mbytes 0b10101 1 gbyte 0b10110 2 gbytes 0b10111 4 gbytes bit encoding tightly coupled memory region size
cp15 registers 3-29 copyright 2000?001 by lsi logic corporation. all rights reserved. the data tightly coupled memory resides at the same location, which causes unpredictable behavior. note: if the data tightly coupled memory is located at the same address as the instruction tightly coupled memory, then the instruction memory takes precedence for data accesses. if the data tightly coupled memory is located at the same address as the instruction tightly coupled memory, and the instruction ram is in load mode, data accesses are read from the data ram and written to the instruction ram. 3.3.13 trace process identi?r register (13) this register allows you to identify the currently executing process in multitasking environments using the real-time trace tools. the contents of this register are output on the etmprocid pins of the ARM946E-S. the following arm instructions are used for accessing the process id register: mrc p15, 0, rd, c13, c1, 1; read process id register mcr p15, 0, rd, c13, c1, 1; write process id register figure 3.15 shows the register format. figure 3.15 trace process id register 3.3.13.1 register 15, test state register register 15 gives you access to the test features included within the ARM946E-S. use these instructions to access the register: mcr {cond} p15, 0, rd, c15, c0, 0; write test state register mrc {cond} p15, 0, rd, c15, c0, 0; read test state register figure 3.15 shows the register format. 31 0 trace process identi?r
3-30 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. figure 3.16 test state register unp unpredictable [31:13] when read, these bits return unpredictable data. writing to these bits can cause unpredictable behavior or changes to device con?uration. dds disable data cache streaming 12 when this bit is 1, it prevent the data cache from streaming data to the arm9e-s during a cache line ?l. when the bit is 0, data cache streaming is permitted. dis disable instruction cache streaming 11 when this bit is 1, it prevents the instruction cache from streaming data to the arm9e-s during a cache line ?l. when the bit is 0, instruction cache streaming is permitted. ddl disable data cache line fill 10 when this bit is 1, it prevents the data cache from doing a line ?l on a cache miss. when the bit is 0, line ?ls are permitted. dil disable instruction cache line fill 9 when this bit is 1, it prevents the data cache from doing a line ?l on a cache miss. when the bit is 0, line ?ls are permitted. r reserved [8:0] these bits are reserved. reading the test state register returns bits [12:0] in the least signi?ant bits. the 19 most signi?ant bits are unpredictable. writing the test state register updates only bits [12:9]. in debug mode, you must be able to execute code without causing line ?ls to update the caches, primarily to load new code into memory. this means that strs, if they hit the cache, must update the memory and the cache, and that for ldrs or instruction prefetches that miss, a line ?l is not performed. when set, bits [10:9] prevent the respective cache from performing a line ?l on a cache miss. the memory mapping, as seen by 31 13 12 11 10 9 8 0 unp dds dis ddl dil r
cp15 registers 3-31 copyright 2000?001 by lsi logic corporation. all rights reserved. the arm9e-s or by the programmer, is unchanged. this feature improves the performance of single-stepping when in debug mode. there is one side effect from this capability. for cached accesses, the biu returns aborts from the ahb. however, when line ?ls are disabled, the access on the ahb is treated as uncacheable, so aborts may return that otherwise would have been blocked. when set, bits [12:11] prevent the respective cache from streaming data to the arm9e-s while the line ?l is performed to the cache. the line ?l still occurs, but the prefetched instruction or load data is returned to the processor at the end of a line ?l. 3.3.14 cache debug index register (15) the cache debug index register allows access to any location within the instruction or data cache for debugging purposes. table 3.6 lists cache debugging operations that use this register. 1. you must program the cache debug index register before using any of the tag or cache read/write operations. table 3.6 cache debug operations instruction operation data mcr p15, 3, rd, c15, c0, 0 write cp15 cache debug index register index/set mrc p15, 3, rd, c15, c0, 0 read cp15 cache debug index register index/set mcr p15, 3, rd, c15, c1, 0 instruction tag write 1 data mrc p15, 3, rd, c15, c1, 0 instruction tag read 1 data mcr p15, 3, rd, c15, c2, 0 data tag write 1 data mrc p15, 3, rd, c15, c2, 0 data tag read 1 data mcr p15, 3, rd, c15, c3, 0 instruction cache write 1 data mrc p15, 3, rd, c15, c3, 0 instruction cache read 1 data mcr p15, 3, rd, c15, c4, 0 data cache write 1 data mrc p15, 3, rd, c15, c4, 0 data cache read 1 data
3-32 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. the cache debug index register provides an index into the cache memories and uses the format shown in figure 3.17 . figure 3.17 cache debug index register - index/set format set set [31:30] this ?ld speci?s which one of the four cache sets to access. rwz reserved - write zero [29:n+1], [1,0] these bits are reserved. write zeros to these bits. index index [n:5] this ?ld speci?s which cache index to access during a cache debug operation. the size of the index varies depending on the implemented cache size. table 3.7 on page 3-33 shows how much the index address ?ld size differs for each cache size the ARM946E-S supports. note that the table is for a 4-way set associative cache and the index value must be adjusted for 2-way and direct-mapped caches. word word address [4:2] this ?ld speci?s which cache word to access in a cache debug operation. note: for tag operations, the word address ?ld in the cache debug index register is ignored. figure 3.18 shows the data format for tag read/write operations. figure 3.18 data format for tag read/write operations tag addr tag address [31:n+1] this ?ld contains the tag address to be read from or written into the cache tag ram. the size of the tag address varies according to the implemented cache size (see table 3.7 ). 31 30 29 n+1 n 5 4 2 1 0 set rwz index word rwz 31 n+1 n 5 4 3 2 1 0 tag addr idx addr v dirty s
cp15 registers 3-33 copyright 2000?001 by lsi logic corporation. all rights reserved. idx addr index address [n:5] this ?ld contains the index address to be read from or written to the cache tag ram. the size of the index varies according to the implemented cache size (see table 3.7 ). v valid bit 4 this bit is the validity bit associated with a given tag location. when set, it indicates the cache data associated with this tag location holds valid data. dirty dirty bits [3:2] when set, these bits indicate the data associated with a given tag location differs from external memory. s set [1:0] this ?ld indicates which data or instruction cache set to access. table 3.7 shows how the index and tag address ?ld sizes differ for each cache size the ARM946E-S supports. the values shown in table 3.7 are for a 4-way set associative cache. the index must be increased by 1 and the tag decreased by 1 for a 2-way set associative cache. for a direct-mapped cache, the tag and index must be adjusted by 2. table 3.7 tag and index fields for supported cache sizes cache size tag index 4 kbytes addr[31:10] addr[9:5] 8 kbytes addr[31:11] addr[10:5] 16 kbytes addr[31:12] addr[11:5] 32 kbytes addr[31:13] addr[12:5] 64 kbytes addr[31:14] addr[13:5] 128 kbytes addr[31:15] addr[14:5] 256 kbytes addr[31:16] addr[15:5] 512 kbytes addr[31:17] addr[16:5] 1 mbyte addr[31:18] addr[17:5]
3-34 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. 3.4 cp14 registers cp14 contains four registers, which are listed in table 3.8 . 3.4.1 debug comms channel status register (c0) the debug comms channel status register is read-only. it controls synchronized handshaking between the processor and the debugger. figure 3.19 shows the register format. figure 3.19 debug comms channel status register each register bit functions as follows: ver version number [31:28] this ?ld contains a xed pattern that denotes the embeddedice-rt version number (in this case 0b0011). rwz reserved - write zero [27:2] these bits are reserved. write zeros to these bits. w write register 1 this bit indicates whether or not the comms data write register is available to the processor. if the bit is 0, the register is available and the processor can write new data to it. if the bit is 1, the register is not free and the processor must poll until w = 0. from the point of view of the debugger, when w = 1, new data has been written that can then be scanned out. table 3.8 coprocessor 14 register map register name register number notes comms channel status c0 read-only comms channel data read c1 for reads comms channel data write c1 for writes debug status c2 read/write 31 28 27 210 ver rwz w r
cp14 registers 3-35 copyright 2000?001 by lsi logic corporation. all rights reserved. r read register 0 this bit indicates whether or not there is new data in the comms data read register. if this bit is 1, from the processors viewpoint there is new data that can be read using an mrc instruction. if this bit is 0, from the debuggers viewpoint the comms data read register is free, and new data can be placed there through the scan chain. when this bit is 1, data previously placed there through the scan chain has not been collected by the processor yet, so the debugger must wait. from the viewpoint of the debugger, the registers are accessed using the scan chain. from the viewpoint of the processor, the registers are accessed using the coprocessor register transfer instructions. it is recommended that you use the following instructions: 1. this instruction returns the debug comms control register into rd: mrc p14, 0, rd, c0, c0 2. this instruction writes the value in rn to the comms data write register: mcr p14, 0, rn, c1, c0 3. this instruction returns the debug data read register into rd: mrc p14, 0, rd, c1, c0 access this data using swi instructions when in the thumb state, because the thumb instruction set does not contain coprocessor instructions. 3.4.2 debug status register (c2) a debug monitor can use the cp14 debug status register when the arm9e-s is in real-time debug mode. the cp14 debug status register is essentially a one-bit read/write register with the format shown in figure 3.20 .
3-36 programmers model copyright 2000?001 by lsi logic corporation. all rights reserved. figure 3.20 coprocessor 14 debug status register rwz reserved - write zero [31:1] these bits are reserved. write zeros to these bits. dbgabt debug abort 0 this bit indicates whether the processor took a prefetch or data abort in the past because of a breakpoint or watchpoint. this bit is set to 1 if the arm9e-s core takes a prefetch abort as a result of a breakpoint or watchpoint. if on a particular instruction or data fetch, both the debug abort and external abort signals are asserted, the external abort takes priority and the dbgabt bit is not set. you can read/write the dbgabt bit using mrc/mcr instructions. a typical use of this bit is by a real-time debug-aware abort handler. this handler examines the dbgabt bit to determine whether the abort has been externally or internally generated. if the dbgabt bit is set, the abort handler initiates communication with the debugger over the comms channel. 31 10 rwz dbgabt
ARM946E-S microprocessor core with cache technical manual 4-1 copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 4 caches this chapter describes the features and behavior of each of these blocks. it contains the following sections: ? section 4.1, ?ache architecture ? section 4.2, ?-cache ? section 4.3, ?-cache ? section 4.4, ?ache lockdown 4.1 cache architecture the ARM946E-S uses an instruction cache (i-cache) and a data cache (d-cache) to reduce the effective memory access time. you can tailor the cache size to suit your individual application, and you can set the i-cache and d-cache sizes independently. the ARM946E-S supports the following cache sizes: ? 0 kbytes ? 4 kbytes ? 8 kbytes ? 16 kbytes ? 32 kbytes ? 64 kbytes ? 128 kbytes ? 256 kbytes ? 512 kbytes ? 1 mbyte
4-2 caches copyright 2000?001 by lsi logic corporation. all rights reserved. the i-cache and d-cache are formed from synchronous sram, and have similar architectures. figure 4.1 shows an example 8 kbyte cache. figure 4.1 example 8 kbyte cache rdata addr [31:0] wdata 32 0 1 2 63 row addr [10:5] addr [31:11] set 0 set 1 set 2 set 3 word 7 word 6 word 5 word 4 word 3 word 2 word 1 word 0 address ta g set0 addr [4:2] ram
cache architecture 4-3 copyright 2000?001 by lsi logic corporation. all rights reserved. the i-cache and d-cache can be direct mapped, or they can be 2-way or 4-way set associative with a cache line length of 8 words (32 bytes). each cache supports single-cycle read access. each cache set includes a tag ram for storing the cache line address and a data ram for storing the instructions or data. during a cache access, all tag rams are accessed, and the tag address is compared with the access address. if a match (or cache hit) occurs, the data from that set is selected for return to the arm9e-s core. if none of the tags match (a cache miss), then external memory must be accessed, unless the write buffer is enabled and this access is a buffered write. if a read access from a cacheable memory region misses, new data is loaded into one of the sets. this method is an allocate on read miss replacement policy. selection of the set is performed by a set counter that can be clocked in a pseudo-random manner, or in a predictable manner based on the replacement algorithm selected. critical or frequently accessed instructions or data can be locked into the cache by restricting the range of the replacement counter. you cannot replace locked lines. they remain in the cache until they are unlocked or ?shed. the cache cannot be locked if it is direct mapped. the cache access address from the arm9e-s core has four parts: ? byte address (addr[1:0]) ? word address (addr[4:2]) ? index address (addr[n:5]) ? tag address (addr[31:n+1]) for example, for a 4 kbyte, 4-way set associative cache, the cache access address is as shown in figure 4.2 . figure 4.2 access address for a 4 kbyte cache 31 10 9 5 4 2 1 0 tag address index address word byte
4-4 caches copyright 2000?001 by lsi logic corporation. all rights reserved. the size of the index and address tags vary depending on the cache size. table 4.1 shows how the index and tag sizes change for the cache sizes supported by the ARM946E-S. table 4.1 is for a 4-way set associative cache. a direct-mapped cache requires two more address bits for the index and two less for the tag. a 2-way set associative cache uses one more bit for the index and one less for the tag. each entry in the tag ram contains an index and tag address (or cache line address) plus three additional bits that indicate the status or validity of the cache data associated with a given tag address. the three bits are: ? valid bit (bit 4) the valid bit is set when a cache line is written with valid data. only a valid line can return a hit during a cache lookup. upon reset, all valid bits are cleared. ? dirty bits (bits [3:2]) the two dirty bits are associated with write operations in the d-cache. they indicate whether or not the data in a cache line differs from the data in external memory. table 4.1 tag and index fields for supported cache sizes cache size tag index 4 kbytes addr[31:10] addr[9:5] 8 kbytes addr[31:11] addr[10:5] 16 kbytes addr[31:12] addr[11:5] 32 kbytes addr[31:13] addr[12:5] 64 kbytes addr[31:14] addr[13:5] 128 kbytes addr[31:15] addr[14:5] 256 kbytes addr[31:16] addr[15:5] 512 kbytes addr[31:17] addr[16:5] 1 mbyte addr[31:18] addr[17:5]
i-cache 4-5 copyright 2000?001 by lsi logic corporation. all rights reserved. note: data can be marked as dirty only if it resides in a write back protection region. 4.2 i-cache the ARM946E-S has a direct-mapped, 2-way, or 4-way set-associative i-cache. you can choose the size of the i-cache from any of the supported cache sizes. the i-cache uses the physical address generated by the processor core. it uses a policy of allocate on read-miss , and is always reloaded one cache line (eight words) at a time, through the external interface. 4.2.1 enabling and disabling the i-cache to enable the i-cache, set bit 12 of the cp15 control register. the cache is only enabled if the protection unit is already enabled, or if they are enabled simultaneously. when the i-cache is enabled, a cacheable read- miss places lines in the i-cache. you can enable the i-cache and protection unit simultaneously with a single write to the cp15 control register, although you must program at least one protection region before you enable the protection unit. you can lock critical or frequently accessed instructions into the i-cache. 4.2.2 i-cache operation when enabled, the i-cache operation is also controlled by the cacheable instruction (ci) bit, which is stored in the protection unit. this bit selectively enables or disables caching for different memory regions. the ci bit affects i-cache operation as follows: successful cache read data is returned to the core only if the ci bit is 1. unsuccessful cache read if the ci bit is 1, a line fetch of eight words is performed. the line fetch starts with the requested address aligned to an eight-word boundary (that is, the line fetch starts with word 0). if the ci bit is 0, a single-word external access is performed to fetch the requested instruction. the cache is not updated.
4-6 caches copyright 2000?001 by lsi logic corporation. all rights reserved. clearing bit 12 of the cp15 control register disables the i-cache. this action prevents all i-cache look ups and line ?ls, and forces all instruction fetches to be performed as single external accesses. 4.2.3 i-cache validity the ARM946E-S does not support external memory snooping. therefore, if you write self-modifying code, the instructions in the i-cache can become incoherent with external memory. similarly, if you reprogram the protection regions, code might exist in the cache that should be in a noncacheable region. in either of these cases, you must ?sh the i-cache. 4.2.4 i-cache flush you can ?sh the entire i-cache by software in one operation, or you can ?sh individual cache lines by writing to the cp15 cache operations register (register 7). the i-cache is automatically ?shed during reset. the i-cache never has to be cleaned because its only source of data is from external memory. (the arm9e-s processor only performs reads from the i-cache, except during debug operations.) flushing the entire cache as shown in table 3.4 on page 3-22 ,you can ?sh the entire i-cache using an mcr instruction. in this case, the contents of the arm register transferred to cp15 must be 0. you can use the following code to do this: mov r0, #0 ; clear r0 mcr p15, r0, c7, c5, 0; flush entire instruction cache note: the use of r0 is arbitrary. flushing the entire cache also ?shes any locked-down code. if you want to preserve locked-down code, you must ?sh cache lines individually and avoid the locked-down lines. flushing a single cache line you can ?sh single cache lines. to do this, you must specify in rd the address to be ?shed from the cache. you can use the following code to do this: ldr r0, = flushaddress; load r0 with address flushaddress mcr p15, r0, c7, c5, 1; flush single cache line
d-cache 4-7 copyright 2000?001 by lsi logic corporation. all rights reserved. 4.3 d-cache the ARM946E-S has a direct mapped, 2-way, or 4-way set-associative d-cache. you can choose the size of the d-cache from any of the supported cache sizes. the d-cache uses the physical address generated by the processor core. it uses an allocate on read-miss policy, and is always reloaded one cache line (eight words) at a time, through the external memory interface. the cacheable data (cd) and bufferable data (bd) bits, which reside in the protection unit, control the behavior of the d-cache. for this reason, the protection unit must be enabled when the d-cache is enabled. 4.3.1 enabling and disabling the d-cache you can enable the d-cache by setting bit 2 of the cp15 control register. the cache is only enabled if the protection unit is already enabled, or is enabled simultaneously. you can enable the d-cache and protection unit simultaneously with a single write to the cp15 control register, although you must program at least one protection region before you enable the protection unit. to disable the d-cache, clear bit 2 of the cp15 control register. the d-cache is automatically disabled and ?shed on reset. when the d-cache is disabled, cache searches are prevented. this marks all data accesses as noncacheable, forcing the ARM946E-S to perform external accesses. the write buffer control is still decoded from the bd and cd bits. the cd bit is forced to 0 (noncacheable). 4.3.2 d-cache operation when the d-cache is enabled, it is searched when the processor performs a load or store. the d-cache supports both write back (wb) and write through (wt) modes. for data stores that hit in the d-cache in wb mode, the cache line is updated and the dirty bit is set for the associated cache half line. setting the dirty bit indicates that the cache version of the data differs from external memory. in wt mode, a store that hits in the d-cache
4-8 caches copyright 2000?001 by lsi logic corporation. all rights reserved. causes the cache line to be updated. but the cache line is not marked as dirty, because the data store is also written to external memory (through the write buffer). this action keeps external memory consistent with the cache. in both wb and wt modes, a store that misses in the cache is sent to the write buffer. when a line fetch causes a cache line to be evicted from the d-cache, the dirty bit for each half of the line is read, and, if the half line contains valid and dirty data, it is written back to the write buffer before the line ?l replaces it. 4.3.2.1 cd bit - cache loads and stores the cd bit determines whether data being read must be placed in the d-cache and used for subsequent reads. typically, main memory is marked as cacheable to reduce memory access time and therefore increase system performance. it is usual to mark input/output space as noncacheable. for example, if a processor is polling a memory-mapped register in input/output space, it is important that the processor is forced to read data direct from the peripheral, and not a copy of initial data held in the d-cache. if the cache hits on a load, data is returned to the cache if the cd bit is 1. if the cache read misses, the cd bit is examined. table 4.2 shows the function of the cd bit. stores that hit in the cache update the cache line if the cd bit is 1. stores that miss the cache use the cd and bd bits to determine whether the write is buffered. a write miss is not loaded into the cache as a result of that miss. table 4.2 cd bit function cd bit value function 1 cacheable data area and protection unit enabled. a line ?l of eight words is performed, and the data is written into a randomly chosen segment of the d-cache. 0 a single or multiple external access is performed and the cache is not updated.
d-cache 4-9 copyright 2000?001 by lsi logic corporation. all rights reserved. 4.3.2.2 cd and bd bits - cache stores the bd and cd bits affect writes that both hit and miss in the d-cache. if the bd and cd bits are both 1, the area of memory is marked as write back, and stores that hit in the d-cache only update the cache, not external memory. if the bd bit is 0 and the cd bit is 1, the area of memory is marked as write through, and stores that hit in the d-cache update both the cache and external memory. 4.3.2.3 load and store multiples load and store multiples are divided at 4 kbyte boundaries (the minimum protection region size), allowing a protection check to be performed in case the load multiple (ldm) or store multiple (stm) crosses into a region with different protection properties. 4.3.3 d-cache validity the ARM946E-S does not support memory translation, so you can always consider the data in the d-cache as valid within the context of the ARM946E-S. however, if you use external memory translation and the mappings are changed, the d-cache is no longer consistent with external memory, and you must ?sh it. the ARM946E-S does not support external memory snooping. any shared data memory space, therefore, must not be cacheable. additionally, if you reprogram the data protection regions, data already in the cache might now be in a noncacheable region, and you must ?sh it. 4.3.4 d-cache clean and flush the d-cache has ?xible cleaning and ?shing utilities that allow the following operations: ? you can invalidate the whole d-cache ( ?sh d-cache )inone operation without writing back dirty data. ? you can invalidate individual lines without writing back any dirty data ( ?sh d-cache single entry ). ? you can perform cleaning on a line-by-line basis. the data is only written back through the write buffer when a dirty line is encountered, and the cleaned line remains in the cache ( clean d-cache single
4-10 caches copyright 2000?001 by lsi logic corporation. all rights reserved. entry ). you can clean cache lines using either their index within the d-cache or their address within memory. ? you can clean and ?sh individual lines in one operation ( clean and ?sh d-cache entry ). you can clean and ?sh individual lines using either their index within the d-cache or their address within memory. you perform the cleaning and ?shing operations using cp15 register 7, in a similar way to the i-cache. the format of rd transferred to cp15 for all register 7 operations is shown in figure 4.3 . figure 4.3 register 7, rd format the value of n is dependent on the cache size, as shown in table 4.3 . the value of n is derived from the following equation: 31 30 29 n+1 n 5 4 0 set rwz index rwz table 4.3 calculating index addresses cache size value of n 4 kbytes 9 8 kbytes 10 16 kbytes 11 32 kbytes 12 64 kbytes 13 128 kbytes 14 256 kbytes 15 512 kbytes 16 1 mbyte 17 n 2 log cache size number of sets line length in bytes ----------------------------------------------------------------------------------------------- ?? ?? 4 + =
cache lockdown 4-11 copyright 2000?001 by lsi logic corporation. all rights reserved. where the number of sets multiplied by the line length in bytes is 128 for a 4-way associative cache. this would be 64 for a 2-way associative cache and 32 for a direct-mapped cache. the table above is correct for a 4-way associative cache. a direct-mapped or 2-way cache would have larger values for n. it is usual to clean the cache before ?shing it, so that external memory is updated with any dirty data. the following code shows how you can clean and ?sh the entire cache (assuming a 4 kbyte d-cache). mov r1, #0 ; initialize set counter outer_loop mov r0, #0 ; initialize line counter inner_loop orr r2, r1, r0 ; generate set and line address mcr p15, 0, r2, c7, c14, 2 ; clean and flush the line add r0, r0, #0x20 ; increment to next line cmp r0, #0x400 ; complete all entries in one set? bne inner_loop ; if not branch back to inner_loop add r1, r1, #0x40000000 ; increment set counter cmp r1, #0x0 ; complete all sets bne outer_loop ; if not branch back to outer_loop 4.4 cache lockdown to provide predictable code behavior in embedded systems, a mechanism is provided for locking code into the i-cache and d-cache. for example, you can use this feature to hold high-priority interrupt routines where there is a hard real-time constraint, or to hold the coef?ients of a dsp ?ter routine in order to reduce external bus traf?. you can lockdown a region of the i-cache or d-cache by executing a short software routine, taking note of these requirements: ? the program must be held in a noncacheable area of memory. ? the cache must be enabled and interrupts must be disabled. ? software must ensure that the code or data to be locked down is not already in the cache. ? if the caches have been used after the last reset, the software must ensure that the cache in question is cleaned, if appropriate, and then ?shed.
4-12 caches copyright 2000?001 by lsi logic corporation. all rights reserved. you can carry out lockdown in the d-cache using cp15 register 9. i-cache lockdown uses both cp15 registers 7 and 9. as described in section 4.1, ?ache architecture, page 4-1 , the ARM946E-S i-cache and d-cache each consist of from one to four sets. you can perform lockdown with a granularity of one set. the smallest space that you can lockdown is one set (one quarter of cache size). lockdown starts at set zero, and can continue until only one set is left unlocked. at least one set must always be unlocked, so lockdown is not available for direct-mapped caches. 4.4.1 locking down the caches the procedures for locking down a set in the i-cache and d-cache are slightly different. in both cases you must: 1. put the cache into lockdown mode by programming register 9. 2. force a line ?l. 3. lock the corresponding data in the cache. 4.4.1.1 d-cache lockdown for the d-cache, the lockdown procedure is as follows: 1. write to cp15 register 9, setting ld = 1 (ld is bit 31, the load bit) and idx[1:0] = 0 (idx bits specify the cache set). 2. initialize the pointer to the ?st of the words to be locked into the cache. 3. execute an ldr from that location. this forces a line ?l from that location, and the resulting eight words are captured in the cache. 4. increment the pointer by 32 (number of bytes in a cache line). 5. execute an ldr from that location. the resulting line ?l is captured in the cache. 6. repeat steps 4 and 5 until all words are loaded in the cache or one quarter of the cache has been loaded. 7. write to cp15 register 9, setting ld = 0 and idx[1:0] = 1. if there is more data to lockdown, at the ?al step, the ld bit must remain set and the process repeated. the ld bit must only be cleared when all
cache lockdown 4-13 copyright 2000?001 by lsi logic corporation. all rights reserved. the lockdown data has been loaded. the idx[1:0] bits must be set to the next available set. note: the write to cp15 register 9 must not be executed until the line ?l has completed. this is achieved by aligning the ldr to the last address of the line. 4.4.1.2 i-cache lockdown for the i-cache, the lockdown procedure is as follows: 1. write to cp15 register 9, setting ld = 1 (the load bit) and idx[1:0] = 0 (the cache set bits). 2. initialize the pointer to the ?st of the words to be locked into the cache. 3. force a line ?l from that location by writing to cp15 register 7 (i-cache preload). 4. increment the pointer by 32 (number of bytes in a cache line). 5. force a line ?l from that location by writing to cp15 register 7. the resulting line ?l is captured in the i-cache. 6. repeat steps 4 and 5 until all words are loaded in the cache or one set of the cache has been loaded. 7. write to cp15 register 9, setting ld = 0 and idx[1:0] = 1. if there are more instructions to lockdown, at the ?al step, the ld bit must remain set and the process repeated. the ld bit must only be cleared when all the lockdown instructions have been loaded. the idx[1:0] bits must be set to the next available set. the only signi?ant difference between the sequence of operations for the d-cache and i-cache is that an mcr instruction must be used to force the line ?l in the i-cache, instead of an ldr. the rest of the sequence is the same as for d-cache lockdown. the mcr to perform the i-cache fetch is a cp15 register 7 operation: mcr p15, 0, rd, c7, c13, 1 4.4.1.3 example i-cache lockdown subroutine a subroutine that you can use to lockdown code in the i-cache is:
4-14 caches copyright 2000?001 by lsi logic corporation. all rights reserved. ; subroutine lock_i_cache ; r1 contains the start address ; r2 contains the end address ; assumes that r2 - r1 fits within one cache set ; the subroutine performs a lockdown of instructions in the ; instruction cache ; it first reads the current lock_down index and then locks ; down the number of sets required ; note - this subroutine must be located in a noncacheable ; region of memory ; - interrupts must be disabled ; - subroutine must be called using the bl instruction ; - r1-r3 can be corrupted in line with arm/thumb ; procedure call standards (atpcs) ; - returns final i-cache lockdown index in r0 if successful ; - returns 0xffffffff in r0 if an error occurred lock_i_cache bic r1, r1, #0x7f ;align address to cache line mrc p15, 0, r3, c9, c0, 1 ;get current i-cache index and r3, r3, #0x3 ;mask unwanted bits cmp r3, #0x3 ;check for available set beq error ;if no sets available, ;generate an error orr r3, r3, #0x8000000 ;set the lockdown bit mcr p15, 0, r3, c9, c0, 1 ;write lockdown register lock_loop mcr p15, 0, r1, c7, c13, 1 ;force an instruction fetch ;from address r1 add r1, r1, #0x20 ;increment address by a ;cache line length cmp r2, r1 ;reached our end address yet? blt lock_loop ;if not, repeat loop add r3, r3, #0x1 ;increment i-cache index bic r0, r3, #0x8000000 ;clear lockdown bit and ;write index into r0 mcr p15, 0, r3, c9, c0, 1 ;write lockdown register mov pc, lr ;return from subroutine error mvn r0, #0 ;move 0xffffffff into r0 mov pc, lr ;return from subroutine
ARM946E-S microprocessor core with cache technical manual 5-1 copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 5 protection unit this chapter describes the ARM946E-S protection unit. it contains the following sections: ? section 5.1, ?bout the protection unit ? section 5.2, ?nabling the protection unit ? section 5.3, ?emory regions ? section 5.4, ?verlapping regions 5.1 about the protection unit the protection unit allows you to partition memory and set individual protection attributes for each protection region. you can divide the address space into eight regions with different sizes for each region. figure 5.1 shows a simpli?d block diagram of the protection unit. figure 5.1 ARM946E-S protection unit the protection unit is programmed using cp15 registers 1, 2, 3, 5, and 6 (see section 3.3, ?p15 registers, page 3-2 ). address comparators address from arm9e-s hit priority encoder cp15 attribute abort attributes registers
5-2 protection unit copyright 2000?001 by lsi logic corporation. all rights reserved. 5.2 enabling the protection unit before the protection unit is enabled, you must program at least one valid protection region. otherwise, the ARM946E-S could enter a state that requires using reset to recover. to enable the protection unit, set bit 0 of cp15 register 1, the control register. when the protection unit is disabled, all instruction fetches are noncacheable, and all data accesses are noncacheable and nonbufferable. 5.3 memory regions you can partition the address space into a maximum of eight regions. each region has the following speci?ations: ? region base address ? region size ? cache and write buffer con?uration ? read and write access permissions the arm architecture uses constants known as inline literals to perform address calculations. these constants are automatically generated by the assembler and compiler and are stored inline with the instruction code. to ensure correct operation, you must de?e an area of memory from where code is to be executed that allows both data and instruction accesses. the base address and size properties are programmed using cp15 register 6. for the format and bit descriptions of this register, refer to section 3.3.9, ?rotection region/base size (pr/bs) registers (6), page 3-19 . 5.3.1 region base address the base address de?es the start of the memory region. you must align this to a region-sized boundary. for example, if a region size of 8 kbytes
overlapping regions 5-3 copyright 2000?001 by lsi logic corporation. all rights reserved. is programmed for a given region, the base address must be a multiples of 8 kbytes. note: if the region is not aligned correctly, it causes unpredictable behavior. 5.3.2 region size the region size is speci?d as a ve-bit value, encoding a range of values from 4 kbytes to 4 gbytes. for a detailed list of the bit encodings, refer to page 3-20 . 5.3.3 partition attributes each region has a number of attributes associated with it. these control how a memory access is performed when the processor core issues an address that falls within a given region. the attributes are: ? cacheable ? bufferable (for data regions only) ? read/write permissions to specify this information, program cp15 registers 2, 3, and 5 (see chapter 3, ?rogrammers model ). if an access fails its protection check (for example, if a user mode application attempts to access a privileged mode access only region), a memory abort occurs. the processor enters the abort exception mode, branching to the data abort or prefetch abort vector accordingly. the cacheable and bufferable bits in cp15 registers 2 and 3 are used together to select one of four cache and write buffer con?urations. these are described in section 7.5, ?rite buffer, page 7-10 . 5.4 overlapping regions you can program the protection unit with two or more overlapping regions. when overlapping regions are programmed, a xed priority scheme is applied to determine the overlapping region attribute that is applied to the memory access. attributes for region 7 have the highest priority, and those for region 0 have the lowest priority.
5-4 protection unit copyright 2000?001 by lsi logic corporation. all rights reserved. for example, if region 1 and 2 are programmed as follows: when the processor performs a data load from address 0x3010 while in user mode, the address falls within both region 1 and 2 (see the shaded area in figure 5.2 ). since there is a con?ct, the attributes associated with region 2 apply. this situation causes a data abort to occur, because in user mode only reads are allowed from region 2. figure 5.2 overlapping memory regions 5.5 background regions overlapping regions increase the ?xibility of how the eight regions can be mapped onto physical memory devices in the system. you can also use the overlapping properties to specify a background region. for example, you might have a number of physical memory areas sparsely distributed across the 4 gbyte address space. if a programming error region programmed for: 2 - 4 kbyte size, starting from 0x3000 - access permission bits, dap[3:0] = 0b0010 - privileged mode has full access - user mode has read only access 1 - 16 kbyte size, starting from 0x0000 - access permission bits, dap[3:0] = 0001 - privileged mode access only region 2 region 1 0x0000 0x3000 0x4000 0x3010
background regions 5-5 copyright 2000?001 by lsi logic corporation. all rights reserved. occurs therefore, it might be possible for the processor to issue an address that does not fall into any de?ed region. if the address issued by the processor falls outside any of the de?ed regions, the ARM946E-S protection unit is hardwired to abort the access. to override this behavior, program region 0 to be a 4 gbyte background region. in this way, if the address does not fall into any of the other seven regions, the access is controlled by the attributes you have speci?d for region 0.
5-6 protection unit copyright 2000?001 by lsi logic corporation. all rights reserved.
ARM946E-S microprocessor core with cache technical manual 6-1 copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 6 tightly coupled sram this chapter describes the tightly coupled sram in the ARM946E-S. it contains the following sections: ? section 6.1, ?rm946e-s sram requirements ? section 6.2, ?sing cp15 control register for details of the arm9e-s interface signals referenced in this chapter, see the arm9e-s technical reference manual . 6.1 ARM946E-S sram requirements the ARM946E-S tightly coupled sram is built using compiled sram blocks from an asic library. the instruction sram (i-sram) and data sram (d-sram) can differ in size, and they can be any size the protection unit supports, from 0 bytes to 1 mbyte. however, to ease implementation, the size must be an integer power of two. ARM946E-S supports synchronous sram for the tightly coupled sram. the memory must be capable of returning data to the arm9e-s processor core in a single cycle. this requirement applies to both the i-sram and d-sram. to initialize the i-sram and to access literal tables during execution, the arm9e-s processor core data interface requires i-sram access. to provide this access, the ARM946E-S multiplexes the instruction and data addresses before they enter the i-sram, and routes instruction data to both the instruction and data interfaces of the core. see figure 1.1 on page 1-3 for details of this data and address multiplexing. figure 6.1 shows a typical read cycle (i-sram shown).
6-2 tightly coupled sram copyright 2000?001 by lsi logic corporation. all rights reserved. figure 6.1 sram read cycle the i-sram is located at address 0x00000000 in the memory map. using this location simpli?s the implementation of the design by removing the need for complex address comparators on both the instruction and data interfaces of the arm9e-s core to generate the chip select logic for the sram. fixing the sram location at 0x0 allows an address decode to control the chip selects for greater power ef?iency. 6.2 using cp15 control register except during reset, the cp15 control register controls the behavior of the tightly coupled sram. 6.2.1 enabling the i-sram to enable the i-sram, set bit 18 of the cp15 control register to 1. to preserve the bits that are not being modi?d, you must use read-modify-write when accessing this register. see section 3.3.5, ?ontrol register (1) on page 3-11 for details of how to read and write the cp15 control register. after the i-sram is enabled, all arm9e-s instruction fetches and data accesses to the i-sram address space access the i-sram. enabling the i-sram greatly increases the performance of the ARM946E-S, because most accesses to the i-sram occur without stall cycles. accessing the ahb, however, can cause several stall cycles for each access. clk inmreq ia[31:1] instr[31:0] sram access time instr (a) addr a
using cp15 control register 6-3 copyright 2000?001 by lsi logic corporation. all rights reserved. note: make sure you initialize the i-sram before attempting to enable or use it. otherwise, behavior is unpredictable. 6.2.2 disabling the i-sram to disable the i-sram, clear bit 18 of the cp15 control register. see section 3.3.5, ?ontrol register (1), page 3-11 for details of how to read and write the cp15 control register. after you disable the i-sram, all arm9e-s instruction fetches access the ahb. note: the contents of the sram are preserved when it is disabled. if it is re-enabled, accesses to previously initialized sram locations return the preserved data. 6.2.3 i-sram load mode you must initialize the i-sram with the required code image before executing from the i-sram. to initialize the i-sram, write a 1 to it from the arm9e-s processor core data interface. using the i-sram load mode allows you to initialize the i-sram more ef?iently. with load mode, you can directly copy data into an i-sram location from the corresponding address in the data cache or external memory. when the i-sram load mode bit of cp15 register 1 is set to 1, it inhibits reads from the i-sram. this action forces i-sram reads to access either external main memory or the data cache. writes to the i- sram address range are not affected when instruction load mode is set. the procedure for initializing the i-sram using the load mode is as follows: 1. enable the i-sram and instruction load mode. 2. load arm registers from main memory, data cache, or data ram. 3. store arm registers into i-sram. 4. increment address pointers and repeat load/store steps until the code image is copied.
6-4 tightly coupled sram copyright 2000?001 by lsi logic corporation. all rights reserved. a suggested assembler code sequence for this procedure is shown below: mov r0, #0 ; initialize pointer ldr r1, =imagetop ; define end of code image mrc p15, 0, r2, c1, c0, 0 ; read control register orr r2, r2, #&c0000 mcr p15, 0, r2, c1, c0, 0 ; enable instruction ram and load mode copyloop ldmia r0, {r2 - r9} ; load 8 registers from main memory stmia r0!, {r2 - r9} ; store 8 regs into instruction sram cmp r1, r0 ; check if limit reached bgt copyloop ; repeat if more to do the read (ldmia) accesses external memory or the data cache, and the write (stmia) updates the tightly coupled i-sram. do not use swp or swpb to access i-sram addresses while in load mode. doing this produces unpredictable results. 6.2.4 enabling and disabling the d-sram to enable the d-sram, set bit 16 of the cp15 control register. see section 3.3, ?p15 registers, page 3-2 for details of how to read and write this register. after the d-sram is enabled, all read and write accesses to the d-sram address space access the d-sram. to disable the d-sram, clear bit 16 of the cp15 control register. after you disable the d-sram, all reads and writes to the d-sram address space access the ahb. reads and writes to d-sram address space either use the d-sram or access the ahb depending on whether d-sram is enabled or not. for more information, see section 3.3.12, ?ightly coupled memory region registers (9), page 3-26 . 6.2.5 d-sram load mode you must initialize the d-sram with the required data image before use. to initialize the d-sram, write to it from the arm9e-s processor core data interface.
using cp15 control register 6-5 copyright 2000?001 by lsi logic corporation. all rights reserved. the d-sram load mode allows you to initialize the d-sram more ef?iently. with load mode, you can copy into the d-sram directly from the corresponding address in the data cache or external memory. when the d-sram load mode bit of cp15 register 1 is set to 1, it inhibits reads from the d-sram. this action forces reads to access either main memory or the data cache. the load mode bit does not affect writes to the d-sram address range. the procedure for initializing the d-sram using the load mode is as follows: 1. enable the d-sram and data load mode. 2. load arm registers from main memory or data cache. 3. store arm registers into d-sram. 4. increment address pointers and repeat load/store steps until the data image is copied. a suggested assembler code sequence for this procedure is shown below: ldr r0, #imagestart ; initialized pointer ldr r1, =imagetop ; define end of data space mrc p15, 0, r2, c1, c0, 0 ; read control register orr r2, r2, #&30000 mcr p15, 0, r2, c1, c0, 0 ; enable data ram and load mode copyloop ldmia r0, {r2 - r9} ; load 8 registers from main memory stmia r0!, {r2 - r9} ; store 8 regs into instruction sram cmp r1, r0 ; check if limit reached bgt copyloop ; repeat if more to do the read (ldmia) accesses external memory or the data cache, and the write (stmia) updates the tightly coupled d-sram. do not use swp or swpb to access d-sram addresses while in load mode. doing this produces unpredictable results. swp and swpb operations to the d-sram while it is in load mode produce unpredictable results. the read accesses external memory or the data cache, and the write updates the d-sram. do not perform swp or swpb operations to locations in the i-sram address space while the i-sram is in load mode.
6-6 tightly coupled sram copyright 2000?001 by lsi logic corporation. all rights reserved.
ARM946E-S microprocessor core with cache technical manual 7-1 copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 7 bus interface unit and write buffer this chapter describes the ARM946E-S bus interface unit (biu) and write buffer. it contains the following sections: ? section 7.1, ?bout the biu and write buffer ? section 7.2, ?hb bus master interface ? section 7.3, ?oncached thumb instruction fetches ? section 7.4, ?hb clocking ? section 7.5, ?rite buffer 7.1 about the biu and write buffer the ARM946E-S supports an advanced microprocessor bus architecture (amba) advanced high-performance bus (ahb) interface. the ahb is a new generation of amba interface that addresses the requirements of high-performance synthesizable designs, including: ? single clock edge operation (rising edge) ? unidirectional (non 3-state) buses ? burst transfers ? split transactions ? single-cycle bus master handover see the amba rev 2.0 ahb speci?ation for details about this bus architecture. the ARM946E-S biu implements a fully compliant ahb bus master interface and incorporates a write buffer to increase system performance. the biu links external memory with the arm9e-s processor core, the caches, and the tightly coupled srams. external memory is accessed
7-2 bus interface unit and write buffer copyright 2000?001 by lsi logic corporation. all rights reserved. through the ahb interface for cache line ?ls and for initializing the tightly coupled srams. the ahb interface is also used to access code and data that are not within the cacheable or tightly coupled memory address regions. when an ahb access occurs, the biu and system controller handshake to ensure that the arm9e-s processor core is stalled until the access is ?ished. if you are using the write buffer, you might be able to allow the processor core to continue program execution. the biu controls the write buffer and related stall behavior. 7.2 ahb bus master interface the ARM946E-S implements a fully compliant ahb bus master interface as de?ed in the amba speci?ation, rev 2.0 . see this document for a detailed description of the ahb protocol. 7.2.1 about the ahb the ahb architecture is based on separate cycles for address and data rather than separate clock phases, as in the amba advanced system bus (asb). the address and control for an access are broadcast from the rising edge of hclk in the cycle before the data is expected to be read or written. during this data cycle, the address and control for the next transfer are driven out, providing a fully pipelined address architecture. when an access is in its data cycle, a slave can extend an access by driving the hready signal low. this action stretches the current data cycle, and the pipelined address and control for the next transfer also stretches. with this system, all ahb masters and slaves sample hready on the rising edge of hclk to determine when an access is complete and whether a new address can be sampled or driven out.
ahb bus master interface 7-3 copyright 2000?001 by lsi logic corporation. all rights reserved. 7.2.2 ARM946E-S transfer descriptions the ARM946E-S supports three of the four possible transfer types de?ed in the amba speci?ation . the supported transfer types are: note: the arm 946e-s does not support the busy transfer type, where htrans[1:0] = 01. 7.2.3 burst sizes the ARM946E-S supports the burst types listed in table 7.1 . incrementing bursts have an address increment of four (that is, a word increment). 7.2.4 line fetch transfers the ARM946E-S is optimized to run with both the i-cache and d-cache enabled. if a memory request (either instruction or data) to a cacheable area misses in the cache, the ARM946E-S does a line fetch. a line fetch transfer is shown in figure 7.1 . idle htrans[1:0] = 00 nonseq htrans[1:0] = 10 seq htrans[1:0] = 11 table 7.1 supported burst types burst type hburst[2:0] encoding use single 000 single writes (str/strh/strb) uncached single reads uncached instruction fetches incr 001 store multiple (stm) uncached burst reads (ldm) incr4 011 dirty half-cache line write back incr8 101 dirty cache line write back cache line fetches
7-4 bus interface unit and write buffer copyright 2000?001 by lsi logic corporation. all rights reserved. figure 7.1 line fetch transfer a line fetch is a xed length burst of eight words. the start address of a line fetch is aligned to an eight-word boundary. the ARM946E-S asserts the bus request hbusreq until the arbiter grants the ahb bus (hgrant asserted). the bus request is then negated. this method allows optimum system performance as the arbiter can accurately predict the end of the de?ed burst length. 7.2.5 back-to-back line fetches the ARM946E-S supports streaming of data and instructions (core execution is advanced during the line fetch). to allow for cache look ups when crossing a cache line boundary, the ARM946E-S must insert idle cycles onto the ahb bus. the effect of this is shown in figure 7.2 .itis assumed in figure 7.2 that hgrant is asserted throughout, and that the hclk frequency is the same as clk. hburst hbusreq hready hgrant haddr htrans clk nseq nseq nseq seq seq seq seq seq seq a a a a+0x04 a+0x08 a+0x0c a+0x10 a+0x14 a+0x18 a+0x1c seq incr8
ahb bus master interface 7-5 copyright 2000?001 by lsi logic corporation. all rights reserved. figure 7.2 back-to-back line fetches 7.2.6 uncached transfers if a memory request is made to an uncacheable region or the ARM946E-S cache is not enabled, the memory requests are serviced by the ahb interface. sequential instruction fetches are treated as nonsequential reads. figure 7.3 shows uncached instruction fetches. nonsequential uncached data operations have similar bus timing. figure 7.3 nonsequential uncached accesses 7.2.7 burst accesses the ahb handles uncached burst operations (stm/ldm) as incrementing bursts of unde?ed length on the ahb. seq seq idle idle idle nseq seq seq seq a+0x18 a+0x1c a+0x1c a+0x1c a+0x1c b b+0x4 b+0x8 b+0xc incr8 incr8 hburst hbusreq hready haddr htrans clk nseq nseq idle idle nseq nseq nseq idle aaaa abb bb single single hburst hbusreq hready haddr htrans clk nseq
7-6 bus interface unit and write buffer copyright 2000?001 by lsi logic corporation. all rights reserved. figure 7.4 shows a data burst followed by an uncached instruction fetch. figure 7.4 data burst followed by instruction fetch 7.2.8 bursts crossing 1 kbyte boundary the ahb speci?ation requires that bursts must not continue across a 1 kbyte boundary. line fetches and cache line write backs cannot cross a 1 kbyte boundary because the start address is aligned to either a four- or eight-word boundary, and the burst length is ?ed. uncached data bursts can cross a 1 kbyte boundary (see example in figure 7.5 ). the burst is restarted by inserting a nonsequential transfer as the boundary is crossed. figure 7.5 crossing a 1 kbyte boundary 7.3 noncached thumb instruction fetches the ahb interface performs thumb instruction fetches as 32-bit accesses. to minimize bus loading, ahb transfers are only performed for nonsequential addresses and for sequential addresses that cross a word boundary. the word returned from main memory is latched, so both halfwords are available for the processor core. nseq seq seq idle nseq idle a a + 4 a + 8 a + c a b b haddr htrans clk seq nseq seq seq nseq seq idle 0x3f0 haddr htrans clk seq 0x3f4 0x3f8 0x3fc 0x400 0x404 0x404
ahb clocking 7-7 copyright 2000?001 by lsi logic corporation. all rights reserved. 7.4 ahb clocking the ARM946E-S design uses a single rising-edge clock (clk) to time all internal activity. some systems in which the ARM946E-S is embedded might need to run the ahb at a lower rate. to support this requirement, the ARM946E-S requires a clock enable (hclken) to time ahb transfers. the hclken input is driven high coincident with a rising edge of the ARM946E-S clk. this action indicates that this particular rising-edge is also an hclk rising-edge. hclk must be synchronous with the ARM946E-S clk. when the arm9e-s processor is running from tightly coupled sram or performing writes using the write buffer, the ARM946E-S hclken and hready inputs are not used to stall the arm9e-s processor. the processor only stalls when there are sram stall cycles or if the write buffer over?ws. this means that the arm9e-s is executing instructions at the faster clk rate and is effectively decoupled from the hclk domain. however, when an ahb read access or unbuffered write occurs, the core does stall until the ahb transfer is completed. while the lower rate hclk clocks the ahb system, hclken is examined to determine when to drive out the ahb address and control that start an ahb transfer. hclken then must detect the next rising edge of hclk, so the biu knows when the access is complete. if the slave being accessed at the hclk rate has a multicycle response, the hready input to the ARM946E-S is driven low until the data is ready to return. the biu must do a logical and on the hready response with hclken to detect when the ahb transfer is completed . when the transfer is completed, sysclken is reasserted and enables the processor. note: when an ahb access is required, the processor core is stalled until the next hclken pulse is received. the processor is stalled twice, once before it starts the access and while waiting for the access to ?ish. the stall before the start of the access is a synchronization penalty, and the worst case can be expressed in clk cycles as the hclk-to-clk ratio minus 1.
7-8 bus interface unit and write buffer copyright 2000?001 by lsi logic corporation. all rights reserved. 7.4.1 clk-to-hclk skew the ARM946E-S drives out the ahb address on the rising edge of clk when the hclken input is true. the ahb outputs therefore have output hold and delay values relative to clk. however, these outputs are used in the ahb system where transfers are timed using hclk. similarly, inputs to the ARM946E-S are timed relative to hclk but are sampled within the ARM946E-S with clk. this leads to hold-time issues, from clk to hclk on outputs, and from hclk to clk on inputs. to minimize this effect, you must minimize the skew between hclk and clk. figure 7.6 shows the ahb clock relationships. figure 7.6 ahb clock relationships 7.4.1.1 clock tree insertion at top level to ensure the clock is evenly distributed to all registers in the design, the ARM946E-S requires insertion of a clock tree. the registers that drive ahb outputs and sample ahb inputs are timed off clk at the bottom of the inserted clock tree and subject to the clock tree insertion delay. to maximize performance, when the ARM946E-S is embedded in an ahb system, the hclk clock generation logic must be constrained so it matches the insertion delay of the ARM946E-S clock tree. you can achieve this using a clock tree insertion tool provided you insert the clock tree in both the ARM946E-S and the embedded system at the same time (top level insertion). figure 7.7 shows an example of an ahb slave connected to the ARM946E-S. clk hclken hclk ahb outputs from ARM946E-S ahb inputs to ARM946E-S skew between clk and hclk
ahb clocking 7-9 copyright 2000?001 by lsi logic corporation. all rights reserved. figure 7.7 ARM946E-S clk to ahb hclk sampling in figure 7.7 , the slave peripheral has input setup and hold times and output hold and valid times relative to hclk. the ARM946E-S has input setup and hold times and output hold and valid times relative to clk? which is the clock at the bottom of the clock tree. for optimal performance, use clock tree insertion to position hclk to match clk? 7.4.1.2 hierarchical clock tree insertion if you perform clock tree insertion on the ARM946E-S before it is embedded, you can add buffers on input data to match the clock tree, so that the setup and hold times are relative to the top-level clk. this is safe at the expense of extra buffers in the data input path. the hclk domain ahb peripherals must still meet the ARM946E-S input setup and hold requirements. since the ARM946E-S inputs and outputs are now relative to clk, the outputs appear comparatively later by the value of the insertion delay. this ultimately leads to lower ahb performance. ahb slave mux ahb slave haddr[31:0] clk clock tree hclken hclk clk ARM946E-S hrdata[31:0] from other ahb slaves clock divider
7-10 bus interface unit and write buffer copyright 2000?001 by lsi logic corporation. all rights reserved. 7.5 write buffer the ARM946E-S provides a write buffer to improve system performance. the write buffer has a 16-entry fifo. each entry can be either address or data. the type of entry is determined by the setting of an address/data ?g. each address entry is tagged with the transfer size, as indicated by the arm9e-s core (byte, halfword, or word). write buffer behavior is controlled by the protection region attributes of the store being performed and the d-cache and protection unit enable status. this control is indicated by the cacheable data bit (cd) and the write buffer control bit (bd) from the protection unit. the state of the cd bit is based on three factors: the cacheable attribute for the particular protection region, the d-cache enable, and the protection unit enable. the state of the bd bit is based on two factors: the bufferable attribute for the particular protection region and the protection unit enable. all accesses are initially noncacheable and nonbufferable until you have programmed and enabled the protection unit. you cannot use the write buffer while the protection unit is disabled. on reset, all entries in the write buffer are invalidated.
write buffer 7-11 copyright 2000?001 by lsi logic corporation. all rights reserved. 7.5.1 write buffer operation the write buffer is used when the d-cache hits and/or misses, depending on the mode of operation. table 7.2 shows how the cd and bd bits control the behavior of the write buffer. table 7.2 data write modes cd bd access mode description 0 0 ncnb (noncacheable, nonbufferable) data reads and writes are not cached, and they can be aborted externally. writes are not buffered, so the processor is stalled until the external access is performed. ncnb reads bypass the write buffer. 0 1 ncb (noncacheable, bufferable) data reads and writes are not cached. writes are buffered, and so they cannot be aborted externally. reads can be aborted externally. reads cause the write buffer to drain. if the d-cache hits for this type of access, there has been a programming error. d-cache hits are ignored, and the d-cache line is not updated for a read. swap instruction operations on data in an ncb region are made to perform ncnb type accesses and are not buffered. 1 0 wt (write through) searches the d-cache for reads and writes. reads that miss in the d-cache cause a line ?l. reads that hit in the d-cache do not perform an external access. all writes are buffered, regardless of whether they hit or miss in the d-cache. writes that hit in the d-cache update the cache, but do not mark the cache line as dirty, because the write is also sent to the write buffer. writes cannot be externally aborted. d-cache line ?ls cause the write buffer to drain before the line ?l starts. 1 1 wb (write back) searches the d-cache for reads and writes. reads that miss in the d-cache cause a line ?l. reads that hit in the d-cache do not perform an external access. writes that miss in the d-cache are buffered. writes that hit in the d-cache update the cache line, mark it as dirty, and do not send the data to the write buffer. d-cache write-backs are buffered. writes (write-miss and write-back) cannot be externally aborted. d-cache line ?ls cause the write buffer to drain before the line ?l starts.
7-12 bus interface unit and write buffer copyright 2000?001 by lsi logic corporation. all rights reserved. 7.5.2 enabling and disabling the write buffer you cannot directly enable or disable the write buffer. however, you can prevent the write buffer from being used by setting the properties of a memory region to ncnb, or by disabling the protection unit. 7.5.3 using self-modifying code instruction fetches and ncnb reads bypass the write buffer. if you write self-modifying code to a bufferable or cacheable region, then it is essential that you drain the write buffer before fetching instructions from these addresses.
ARM946E-S microprocessor core with cache technical manual 8-1 copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 8 external coprocessor interface this chapter describes the ARM946E-S pipelined external coprocessor interface. it contains the following sections: ? section 8.1, ?bout the external coprocessor interface ? section 8.2, ?oprocessor instructions ? section 8.3, ?dc/stc instructions ? section 8.4, ?cr/mrc instructions ? section 8.5, ?nterlocked mcr instructions ? section 8.6, ?dp instructions ? section 8.7, ?rivileged instructions ? section 8.8, ?usy-waiting and interrupts 8.1 about the external coprocessor interface the ARM946E-S fully supports the connection of on-chip coprocessors through an external coprocessor interface. all types of coprocessor instructions are supported. for a description of all the interface signals referred to in this chapter, see the arm9e-s technical reference manual . coprocessors determine the instructions they must execute using a pipeline follower in the coprocessor. as each instruction arrives from memory, it enters both the arm9e-s pipeline and the coprocessor pipeline. to avoid being a critical path for the instruction, the coprocessor pipeline operates one clock cycle behind the arm9e-s pipeline. however, there is a mechanism inside the ARM946E-S that stalls the arm9e-s pipeline, so the external coprocessor pipeline can catch up.
8-2 external coprocessor interface copyright 2000?001 by lsi logic corporation. all rights reserved. for that reason, consider the two pipelines synchronized. the arm9e-s processor informs the coprocessor when instructions move from decode to execute, and whether the instruction must be executed or not. to enable coprocessors to continue executing data operations while the arm9e-s pipeline is stalled (for example, when waiting for a cache line ?l to occur), the coprocessor receives a clock (clk) and a clock enable signal (cpclken). if cpclken is low on the rising edge of clk, then the arm9e-s pipeline is stalled and the coprocessor pipeline must not advance. figure 8.1 indicates the timing for these signals and when the coprocessor pipeline must advance its state. figure 8.1 coprocessor clocking the coprocessor clock is the result of oring clk with the inverse of cpclken. this is one technique for generating a clock that re?cts the arm9e-s core pipeline advancing. 8.2 coprocessor instructions there are three classes of coprocessor instructions: clk cpclken coprocessor clock ldc/stc load from memory to coprocessor or store from coprocessor to memory mcr/mrc register transfer between coprocessor and arm processor core cdp coprocessor data operation
ldc/stc instructions 8-3 copyright 2000?001 by lsi logic corporation. all rights reserved. 8.3 ldc/stc instructions the load/store coprocessor from/to memory (ldc/stc) instructions are used to transfer data to and from external coprocessor registers and memory. for the ARM946E-S, the memory can be either internal memory (cache or tightly coupled sram) or the ahb depending on the address range of the access and the protection unit settings. figure 8.2 shows the cycle timing for the ldc/stc operations. figure 8.2 ldc/stc cycle timing in the example shown in figure 8.2 , four data words are transferred. what the coprocessor drives on the chsde[1:0] and chsex[1:0] buses determines the number of words transferred. as with all other instructions, the arm9e-s performs the main decode off the rising edge of the clock during the decode stage. from this, the core commits to executing the instruction, so it does an instruction fetch. the coprocessor instruction pipeline keeps in step with the arm9e-s processor by monitoring ncpmreq. this is a registered version of the arm9e-s instruction memory request signal (inmreq). coprocessor pipeline cplatecancel fetch decode execute execute execute execute memory write (go) (go) (go) (last) clk cpinstr[31:0] ncpmreq cppass chsde[1:0] chsex[1:0] cpdout[31:0] ldc cpdin[31:0] stc ldc go go go last ignored
8-4 external coprocessor interface copyright 2000?001 by lsi logic corporation. all rights reserved. at the rising edge of clk, if cpclken is high and ncpmreq is low, an instruction fetch is taking place. on the next rising edge of the clock, when cpclken is high, the coprocessor instruction bus (cpinstr[31:0]) contains the fetched instruction. in this case, the following occurs: 1. the last instruction fetched enters the decode stage of the coprocessor pipeline. 2. the instruction in the decode stage of the coprocessor pipeline enters its execute stage. 3. the fetched instruction is sampled. in all other cases, the arm9e-s pipeline is stalled, and the coprocessor pipeline does not advance. during the execute stage, the condition codes are compared with the status ?gs to determine whether the instruction can actually execute. the output cppass is asserted (high) if the instruction in the execute stage of the coprocessor pipeline: ? is a coprocessor instruction ? has passed its condition codes if a coprocessor instruction busy-waits, cppass is asserted on every cycle until the coprocessor instruction is executed. if an interrupt occurs during busy-waiting, cppass is driven low, and the coprocessor stops execution of the coprocessor instruction. another output, cplatecancel, cancels a coprocessor instruction when the instruction preceding it causes a data abort. this output is valid on the rising edge of clk on the cycle that follows the ?st execute cycle of the coprocessor instruction. this is the only cycle in which cplatecancel can be asserted. on the rising edge of the clock, the arm9e-s processor examines the coprocessor handshake signals, chsde[1:0] or chsex[1:0], based on the following criteria: ? if a new instruction is entering the execute stage in the next cycle, it examines chsde[1:0].
ldc/stc instructions 8-5 copyright 2000?001 by lsi logic corporation. all rights reserved. ? if the currently executing coprocessor instruction requires another execute cycle, it examines chsex[1:0]. 8.3.1 coprocessor handshake states the handshake signals encode one of four states: absent, wait, go, and last. table 8.1 describes these four handshake states. table 8.1 coprocessor handshake states state description absent if there is no coprocessor attached that can execute the coprocessor instruction, the handshake signals indicate the absent state. in this case, the arm9e-s takes the unde?ed instruction trap. wait if there is a coprocessor attached that can handle the instruction, but not immediately, the coprocessor handshake signals are driven to indicate that the arm9e-s processor core must stall until the coprocessor can catch up. this is known as the busy-wait condition. in this case, the arm9e-s processor core loops in an idle state waiting for chsex[1:0] to be driven to another state, or for an interrupt to occur. if chsex[1:0] changes to absent, the unde?ed instruction trap is taken. if chsex[1:0] changes to go or last, the instruction proceeds as described below. if an interrupt occurs, the arm9e-s processor is forced out of the busy-wait state. this is indicated to the coprocessor by the cppass signal going low. the instruction is restarted later and so the coprocessor must not commit to the instruction (it must not change any coprocessor state) until it has seen cppass high at the same time as the handshake signals indicate the go or last condition. go the go state indicates that the coprocessor can execute the instruction immediately, and that it requires another cycle of execution. both the arm9e-s processor core and the coprocessor must also consider the state of the cppass signal before actually committing to the instruction. for an ldc or stc instruction, the coprocessor instruction drives the handshake signals with go when two or more words still have to be transferred. when only one more word remains to be transferred, the coprocessor drives the handshake signals with last. during the execute stage, the arm9e-s processor core outputs the address for the ldc/stc. also in this cycle, dnmreq is driven low, indicating to the ARM946E-S memory system that a memory access is required at the data end of the device. the timing for the data on cpdout and cpdin is shown in figure 8.2 on page 8-3 . last you can use an ldc or stc for more than one item of data. if this is the case, possibly after busy-waiting, the coprocessor drives the coprocessor handshake signals with a number of go states, and in the penultimate cycle it drives last. the last state indicates that the next transfer is the ?al one. if there is only one transfer, the sequence is wait, wait, ..., last.
8-6 external coprocessor interface copyright 2000?001 by lsi logic corporation. all rights reserved. 8.3.2 coprocessor handshake encoding table 8.2 shows the encoding for the chsde[1:0] and chsex[1:0] handshake signals. note: if an external coprocessor is not attached in the ARM946E-S embedded system, the chsde[1:0] and chsex[1:0] handshake inputs must be tied off to indicate absent. 8.3.3 multiple external coprocessors if multiple external coprocessors are attached to the ARM946E-S interface, you can combine the handshaking signals by anding bit 1 and oring bit 0. in the case of two coprocessors that have handshaking signals (where coprocessor 1 signals are chsde1/chsex1 and coprocessor 2 signals are chsde2/chsex2), combine the signals as shown below: chsde[1] = chsde1[1] and chsde2[1 ] chsde[0] = chsde1[0] or chsde2[0 ] chsex[1] = chsex1[1] and chsex2[1] chsex[0] = chsex1[0] or chsex2[0]. table 8.2 handshake encoding chsde/chsex[1:0] de?ition 10 absent 00 wait 01 go 11 last
mcr/mrc instructions 8-7 copyright 2000?001 by lsi logic corporation. all rights reserved. 8.4 mcr/mrc instructions the mcr (move cpu register to coprocessor register) instruction and the mrc (move from coprocessor register to cpu register) instruction have timing cycles that are very similar to the stc/ldc instructions. figure 8.3 provides an example with a busy-wait state. figure 8.3 mcr/mrc transfer timing with busy-wait first, ncpmreq is driven low to indicate that the instruction on cpinstr[31:0] is entering the decode stage of the pipeline. this causes the coprocessor to decode the new instruction and drive chsde[1:0] as required. in the next cycle, ncpmreq is driven low to indicate that the instruction has now been issued to the execute stage. if the condition codes pass, and therefore, the instruction is to be executed, then the cppass signal is driven high and the chsde[1:0] handshake bus is examined. it is ignored in all other cases. for any successive execute cycles, the chsex[1:0] handshake bus is examined. when the last condition is observed, the instruction is coprocessor pipeline cplatecancel fetch decode execute execute memory write (wait) (last) clk cpinstr[31:0] ncpmreq cppass chsde[1:0] chsex[1:0] cpdout[31:0] mcr cpdin[31:0] mrc mcr/mrc ignored last coproc data coproc data wait
8-8 external coprocessor interface copyright 2000?001 by lsi logic corporation. all rights reserved. committed. in the case of an mcr instruction, the cpdout[31:0] bus is driven with the registered data during the coprocessor write stage. in the case of an mrc instruction, cpdin[31:0] is sampled at the end of the arm9e-s processor memory stage and written to the destination register during the next cycle. 8.5 interlocked mcr instructions if the data for an mcr instruction is not available inside the arm9e-s processor pipeline during its ?st decode cycle, then the arm9e-s processor pipeline interlocks for one or more cycles until the data is available. for example, this interlocking applies when the register being transferred is the destination from a preceding ldr instruction. in this situation, the mcr instruction enters the decode stage of the coprocessor pipeline, and then remains there a number of cycles before entering the execute stage. figure 8.4 gives an example of an interlocked mcr that also has a busy-wait state. figure 8.4 interlocked mcr timing with busy-wait coprocessor pipeline cplatecancel fetch decode execute execute memory write (wait) (last) clk cpinstr[31:0] ncpmreq cppass chsde[1:0] chsex[1:0] cpdout[31:0] mcr cpdin[31:0] mrc ignored last wait wait decode (interlock) mcr
cdp instructions 8-9 copyright 2000?001 by lsi logic corporation. all rights reserved. 8.6 cdp instructions coprocessor data processing (cdp) instructions normally execute in a single cycle. as with all the previous cycles, ncpmreq is driven low to indicate when an instruction is entering the decode stage and then the execute stage of the pipeline. if the instruction is to be executed, the cppass signal is driven high during the execute cycle. if the coprocessor can execute the instruction immediately, it drives chsde[1:0] with last. if the instruction requires a busy-wait cycle, the coprocessor drives chsde[1:0] with wait and then chsex[1:0] with last. figure 8.5 shows a cdp instruction that is cancelled because the previous instruction caused a data abort. figure 8.5 late cancelled cdp instruction in this example, the cdp instruction enters the execute stage of the pipeline and is signaled to execute by cpass. in the following cycle, cplatecancel is asserted. this event forces the coprocessor to terminate execution of the cdp instruction and prevents the instruction from causing any coprocessor state changes. coprocessor pipeline cplatecancel fetch decode execute memory (data) (aborted) clk cpinstr[31:0] ncpmreq cppass chsde[1:0] chsex[1:0] last ignored instruction (cancelled) cprt
8-10 external coprocessor interface copyright 2000?001 by lsi logic corporation. all rights reserved. 8.7 privileged instructions the coprocessor can restrict some instructions for use in privileged mode only. to do this, the coprocessor tracks the ncptrans output. when ncptrans is low, the processor is in user mode. when it is high, the processor is in privileged mode. figure 8.6 shows how ncptrans changes after a mode change. figure 8.6 privileged instructions the ?st two chsde[1:0] responses are ignored by the arm9e-s processor, because only the ?al chsde[1:0] response counts (when the instruction moves from decode into execute). this method allows the coprocessor to change its response as ncptrans changes. 8.8 busy-waiting and interrupts the coprocessor is permitted to stall, or busy-wait, the processor during the execution of a coprocessor instruction. for example, the coprocessor can do this if it is busy with an earlier coprocessor instruction. to do so, the coprocessor associated with the decode stage instruction drives wait onto chsde[1:0]. when the instruction concerned enters the coprocessor pipeline cplatecancel fetch decode execute memory instruction clk cpinstr[31:0] ncpmreq cppass chsde[1:0] chsex[1:0] cprt ignored ignored decode decode aborted ignored last ncptrans new mode old mode
busy-waiting and interrupts 8-11 copyright 2000?001 by lsi logic corporation. all rights reserved. execute stage of the pipeline, the coprocessor can drive wait onto chsex[1:0] for as many cycles as necessary to keep the instruction in the busy-wait loop. for interrupt latency reasons, the coprocessor can be interrupted while busy-waiting. this causes the instruction to be abandoned. abandoning execution is done through cppass. the coprocessor must monitor the state of cppass during every busy-wait cycle. if it is high, the instruction must still be executed. if it is low, the instruction must be abandoned. figure 8.7 shows a busy-waiting coprocessor instruction abandoned due to an interrupt. cplatecancel is also asserted as a result of the execute interruption. figure 8.7 busy-waiting and interrupts coprocessor pipeline cplatecancel fetch decode execute execute execute execute execute (wait) (wait) (wait) (wait) clk cpinstr[31:0] ncpmreq cppass chsde[1:0] chsex[1:0] cpinstr wait wait wait wait ignored (interrupted)
8-12 external coprocessor interface copyright 2000?001 by lsi logic corporation. all rights reserved.
ARM946E-S microprocessor core with cache technical manual 9-1 copyright 2000-2001 by lsi logic corporation. all rights reserved. chapter 9 debug interface this chapter describes the ARM946E-S debug interface. it contains the following sections: ? section 9.1, ?ebug systems ? section 9.2, ?ebug operations overview ? section 9.3, ?ebug using the serial interface and tap controller ? section 9.4, ?ebug using the embeddedice-rt ? section 9.5, ?reakpoints, watchpoints, and debug requests ? section 9.6, ?etermining the core and system state ? section 9.7, ?eal-time debug ? section 9.8, ?rm9e-s clock domains ? section 9.9, ?ynchronizing debug clocks a more detailed description of the arm9e-s debug features and jtag interface is provided in the arm9e-s technical reference manual, appendix d, ?ebug in depth. 9.1 debug systems the ARM946E-S forms one component of a debug system, a system that ranges from a high-level, user debugging capability to the low-level hardware interfaces in the ARM946E-S. figure 9.1 shows a typical debug system.
9-2 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. figure 9.1 typical debug system a debug system typically has three parts: ? debug host ? protocol converter ? ARM946E-S debug target the debug host and the protocol converter are system-dependent. the following subsections describe each of the debug system blocks. 9.1.1 debug host the debug host is a computer that is running a software debugger, such as armsd . the debug host allows you to issue high-level commands, such as setting breakpoints or examining memory contents. 9.1.2 protocol converter an interface, such as a parallel port, connects the debug host to the ARM946E-S development system. the messages broadcast over this connection must be converted to the interface signals of the ARM946E-S. the protocol converter does the conversion. for example, multi-ice development system containing ARM946E-S host computer running arm or third party toolkit debug host protocol converter debug target
debug systems 9-3 copyright 2000-2001 by lsi logic corporation. all rights reserved. 9.1.3 ARM946E-S debug target the arm9e-s processor core within the ARM946E-S has hardware extensions that ease debugging at the lowest level. the debug extensions make it possible to: ? stall the processor program execution ? examine the core internal state ? examine the state of the memory system ? resume program execution figure 9.2 shows the major blocks of the arm9e-s processor and associated debug logic. figure 9.2 arm9e-s processor and debug logic the blocks in figure 9.2 are brie? described as follows: embeddedice-rt arm9e-s tap controller arm9e-s coprocessor15 processor core scan chain 2 scan chain 1 scan chain 15 scan chain 3 boundary scan arm9e-s processor core includes debug support hardware embeddedice-rt logic contains a set of registers and comparators used to generate debug exceptions (such as breakpoints)
9-4 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. 9.2 debug operations overview the embedded arm9e-s processor core provides debug support capabilities for the ARM946E-S. the ARM946E-S debug interface is based on ieee std. 1149.1- 1990, standard test access port and boundary-scan architecture . see this standard for an explanation of the terms used in this chapter. the arm9e-s processor core, which contains hardware extensions for advanced debugging features, makes it easier to develop the hardware, the application software, and operating systems. these debug extensions allow you to force the processor to stop for a particular: ? instruction fetch - using breakpoints ? data access - using watchpoints ? external debug request the condition when stopped is known as the debug state . in the debug state, the processor core and ARM946E-S memory system are effectively stopped and isolated from the rest of the system. this condition is known as halt mode operation and allows you to examine the internal state of the arm9e-s core, ARM946E-S system, and external ahb state, while all other system activity continues normally. when tap controller controls the scan chains using the jtag serial interface cp15 contains system con?uration and control state boundary scan includes the optional external scan chain scan chain 1 provides access to the processor instruction and data buses scan chain 2 provides access to the registers in the embeddedice-rt scan chain 3 provides control of the optional external boundary scan chain scan chain 15 provides access to the cp15 register set and the cache
debug using the serial interface and tap controller 9-5 copyright 2000-2001 by lsi logic corporation. all rights reserved. debug has been completed, the arm9e-s restores the processor and system state, and resumes program execution. the examination of the internal state of the ARM946E-S uses a jtag-style interface that allows the serial insertion of instructions into the instruction pipeline, and exports the contents of the arm9e-s core registers. the exported data is serially shifted out without affecting the rest of the system. in addition, the arm9e-s supports a real-time debug mode, where instead of generating a breakpoint or watchpoint, an internal instruction abort or data abort is generated. this mode is known as monitor mode operation. when used in conjunction with a debug monitor program activated by the abort exception entry, you can debug the ARM946E-S while allowing the execution of critical interrupt service routines. the debug monitor program typically communicates with the debug host over the ARM946E-S debug communication channel. real-time debug is described in section 9.7, ?eal-time debug, page 9-28 . 9.3 debug using the serial interface and tap controller the jtag interface includes six serial registers and a tap controller state machine. 9.3.1 serial registers the jtag interface includes the following serial registers: ? boundary scan register contains boundary scan data. ? bypass register a one-bit shift register that contains test data. ? device id code register the content of this register identi?s the device. tapid[31:0] drive this register. tie these signals to a constant value that represents the unique device id code.
9-6 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. ? tap instruction register the content of this four-bit register selects the register (boundary scan, bypass, device id, scan path select, scan) to be read and written when the tap controller is in the shift-dr state. the tap instruction register does not include a parity bit. during the capture-ir state, a ?ed value of 0b0001 is loaded into this register. ? scan path select register this register selects the scan path. ? scan register contains data shifted in from the associated scan path. 9.3.2 tap controller state machine figure 9.3 shows the state transitions that occur in the tap controller. each state is encoded as a hexadecimal value, which is output on tapsm[3:0]. these values are shown in the diagram.
debug using the serial interface and tap controller 9-7 copyright 2000-2001 by lsi logic corporation. all rights reserved. figure 9.3 tap controller state diagram the tap controller states are brie? de?ed as follows: ? test-logic-reset resets the debug interface. see section 9.3.2.1, ?esetting the tap controller for more information. ? run-test/idle the tap controller is idle and can be left in this state when not used. ? select-ir-scan and select-dr-scan these states serve as intermediate states on the path to selecting either instruction or data register update. test-logic-reset tms = 1 run-test/idle 0 select-dr-scan 1 0 capture-dr 0 0 shift-dr 1 exit1-dr 0 pause-dr 1 exit2-dr 1 update-dr 0 0 0 1 1 0 1 select-ir-scan capture-ir 0 0 shift-ir 1 exit1-ir 0 pause-ir 1 exit2-ir 1 update-ir 0 0 0 1 1 0 1 1 1 0xf 0xc 0x7 0x6 0x2 0x1 0x3 0x0 0x5 0x4 0xe 0xa 0x9 0xb 0x8 0xd note: 1. the state transition values (0 and 1) in this diagram correspond to the test mode select input signal, dbgtms. 2. the hexadecimal value in each bubble represents the dbgtapsm[3:0] output.
9-8 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. ? capture-dr the action taken during this state depends on the tap instruction being executed. see table 9.1 for tap instruction descriptions. ? capture-ir during this state, 0x1 is loaded into the tap instruction register. ? shift-dr the data register is inserted in the tdi/tdo shift path and shifted on each rising edge of tck. ? shift-ir the instruction register is inserted in the tdi/tdo shift path and shifted on each rising edge of tck. ? exit1-dr and exit1-ir these are temporary states with no effect. ? pause-dr and pause-ir this state is temporary with no effect, except pausing. ? exit2-dr and exit2-ir these states are temporary with no effect. ? update-dr the action taken during this state depends on the tap instruction being executed. see table 9.1 for tap instruction descriptions. ? update-ir during this state, the value in the tap instruction register is the current instruction. 9.3.2.1 resetting the tap controller to force the tap controller into the correct state after power-up of the device, apply a reset pulse to the dbgntrst signal or cycle the jtag state machine through the test-logic-reset state. before using the jtag interface, drive dbgntrst low, and then high again. if you do not intend to use the boundary scan interface, tie the dbgntrst input permanently low. note: a clock on tck is not necessary to reset the device.
debug using the serial interface and tap controller 9-9 copyright 2000-2001 by lsi logic corporation. all rights reserved. reset causes the following action: 1. reset forces exit from the debug state. the boundary scan chain cells do not intercept any of the signals passing between the external system and the core. 2. the idcode instruction is selected. if the tap controller is put into the shift-dr state and tck is pulsed, the contents of the id register are clocked out of tdo. 9.3.2.2 jtag interface signals and pull-up resistors the ieee 1149.1 standard effectively requires tdi and tms to have internal pull-up resistors. to minimize static current draw, these resistors are not included in the arm9e-s processor core. accordingly, the four inputs to the test interface (the tdo, tdi, tms, and tck) must all be driven to valid logic levels to achieve normal circuit operation. 9.3.2.3 test access port instructions this section describes how the tap controller state machine controls the serial jtag interface when the following instructions are executed: ? extest - external test ? scan_n - scan-in ? intest - internal test ? idcode - device id code ? bypass - bypass ? sample/preload - sample/preload ? restart - restart in this section, it is assumed that tdi and tms are sampled on the rising edge of tck, and all output transitions on tdo occur as a result of the falling edge of tck. table 9.1 provides a description of each tap instruction.
9-10 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. . table 9.1 test access port instruction descriptions instruction description extest (0000) the extest instruction puts the selected scan chain and all scan cells in test mode, and it connects the selected scan chain between tdi and tdo. in the capture-dr state, inputs from the system logic and outputs from the output scan cells to the system are captured by the scan cells. in the shift-dr state, previously captured test data is shifted out of the scan chain on tdo, while new test data is shifted in through tdi. this data is applied immediately to the system logic and system pins. scan_n (0010) this instruction connects the scan path select register between tdi and tdo. during the capture-dr state, a ?ed value of 0b10000 is loaded into the scan path select register. during the shift-dr state, the id number of the desired scan path is shifted into the scan path select register. in the update-dr state, the scan register of the selected scan chain is connected between tdi and tdo, and it remains connected until a subsequent scan_n instruction is issued. on reset, scan chain 3 is selected by default. the scan path select register is 5 bits long in this implementation, although no ?ite length is speci?d. intest (1100) the intest instruction puts the selected scan chain and all scan cells in test mode, and it connects the selected scan chain between tdi and tdo. in the capture-dr state, the output and input scan cells capture the value of the data applied from the core logic and the system logic, respectively. in the shift-dr state, previously captured test data is shifted out of the scan chain on tdo, while new test data is shifted in through tdi.
debug using the serial interface and tap controller 9-11 copyright 2000-2001 by lsi logic corporation. all rights reserved. idcode (1110) the idcode instruction connects the device identi?ation (id) register between tdi and tdo. the id register is a 32-bit register that allows the manufacturer, part number, and version of a component to be determined through the tap. the id register is loaded from the tapid[31:0] input bus. this input must be tied to a constant value that provides a unique device id code. when the instruction register is loaded with the idcode instruction, all the scan cells are placed in their normal (system) mode of operation. in the capture-dr state, the id register captures the device identi?ation code. in the shift-dr state, the previously captured device identi?ation code is shifted out of the id register on tdo, while data is shifted into the id register through the tdi pin. in the update-dr state, the id register is not changed. bypass (1111) the bypass instruction connects the 1-bit shift bypass register between tdi and tdo. when the bypass instruction is loaded into the instruction register, all the scan cells are placed in their normal (system) mode of operation. this instruction has no effect on the system pins. in the capture-dr state, the bypass register captures a logic 0. in the shift-dr state, test data shifts into the bypass register on tdi, and then after a delay of one tck cycle, it shifts out on tdo. the ?st bit shifted out is a 0. the bypass register is not affected by the update-dr state. note: all unused instruction codes default to the bypass instruction. table 9.1 test access port instruction descriptions (cont.) instruction description
9-12 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. 9.3.3 scan chains ARM946E-S supports 32 scan chains. three of the scan chains are located inside the ARM946E-S. the scan chains allow testing, debugging, and programming of the embeddedice macrocell watchpoint units. table 9.2 lists the scan chains and their functions. sample/preload (0011) when the tap instruction register is loaded with the sample/preload instruction, all the scan cells of the selected scan chain are placed in the normal mode of operation. in the capture-dr state, a snapshot of the signals of the boundary scan is taken on the rising edge of tck. normal system operation is not affected. in the shift-dr state, sampled test data shifts out of the boundary scan on tdo, while new data shifts in on tdi to preload the boundary scan parallel input latch. this data is not applied to the system logic or system pins while the sample/preload instruction is active. you must use this instruction to preload the boundary scan register with known data prior to executing intest or extest instructions. restart (0100) this instruction restarts the processor on exit from the debug state. the restart instruction connects the bypass register between tdi and tdo, and the tap controller behaves as if the bypass instruction is loaded. the processor re-synchronizes back to the memory system when the run-test/idle state is entered. table 9.1 test access port instruction descriptions (cont.) instruction description table 9.2 ARM946E-S scan chain functions scan chain function 0 reserved 1 debug 2 embeddedice-rt logic programming 3 external boundary scan
debug using the serial interface and tap controller 9-13 copyright 2000-2001 by lsi logic corporation. all rights reserved. 9.3.3.1 scan chain 1 scan chain 1 is 67 bits long. its primary function is to provide debugging support and access to the core instruction and data buses. table 9.3 shows the bit allocation for scan chain 1. during debugging operations, the value of the sysspeed control bit determines whether the arm9e-s core executes an instruction at system speed or not. after the ARM946E-S enters the debug state, the ?st time sysspeed is captured and scanned out tells the debugger whether the core has entered debug state due to a breakpoint (sysspeed low) or a watchpoint (sysspeed high). a watchpoint and a breakpoint can occur simultaneously. when a watchpoint condition occurs, the debugger must examine the wptandbkpt bit to determine whether the instruction currently in the execute stage of the pipeline is breakpointed. if it is, wptandbkpt is high, otherwise it is low. 4?4 reserved 15 control coprocessor 16?1 unassigned table 9.2 ARM946E-S scan chain functions (cont.) scan chain function table 9.3 scan chain 1 bit allocation bit function 67:35 data values 34 syspeed control 33 wptandbkpt control 32 reserved 31:0 instruction values
9-14 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. 9.3.3.2 scan chain 2 scan chain 2 is 37 bits long. this scan chain allows access to the embeddedice-rt logic registers. the order of the scan chain, from dbgtdi to dbgtdo, is [37:0]. table 9.4 shows the bit allocation for scan chain 2. during capture-dr, no action occurs for scan chain 2. during shift-dr, a data value is shifted into the serial register. bits 36:32 specify the address of the embeddedice-rt register to be accessed. during update-dr, either read or write the embeddedice-rt register depending on the value of bit 37. 9.3.3.3 scan chain 3 scan chain 3 allows ARM946E-S to control an optional external boundary scan chain. you determine the length of scan chain 3. 9.3.3.4 scan chain 15 scan chain 15 provides debug access to cp15 registers. this access allows you to control the system state within the ARM946E-S while in the debug mode. for example, you can use it to enable or disable the sram before performing a debug load or store. you can also use scan chain 15 to interrogate the cache. table 9.4 scan chain 2 bit allocation bit function 37 read/write control. read = 0. write = 1. 36:32 register address 31:0 data value
debug using the serial interface and tap controller 9-15 copyright 2000-2001 by lsi logic corporation. all rights reserved. scan chain 15 is 39 bits long. table 9.5 shows the order of the scan chain bits from the dbgtdi input to the dbgtdo output. table 9.6 shows the address mapping of scan chain 15 to cp15 registers. table 9.5 scan chain 15 bit allocation bits contents 38 read/write control. read = 0. write = 1. 37:32 cp15 register address 31:0 cp15 data value table 9.6 mapping of scan chain 15 address field to cp15 registers register address register number cp15 register 37 [36:33] 32 name type 0 0000 0 c0.id id register read 0 0000 1 c0.c cache type read 0 0001 0 c1 control read/write 0 0010 0 c2.d data cacheable bits read/write 0 0010 1 c2.i instruction cacheable bits read/write 0 0011 0 c3 write buffer control read/write 0 0100 0 c0.m tightly coupled memory size read 0 0101 0 c5.d data space access permissions read/write 0 0101 1 c5.i instruction address access permissions read/write 1 1 0 c6.[7:0] memory region protection read/write 0 0111 0 c7.fd flush data cache write 0 0111 1 c7.fi flush instruction cache write 0 1110 0 c7.fd.s flush d-cache single (uses c15.c.ind) write 0 1110 1 c7.fi.s flush i-cache single (uses c15.c.ind) write
9-16 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. when the tap controller is in the shift-dr state, the scan chain 15 read/write bit, register address, and register value (for writing) shift in from tdi. for a write operation, the register value is updated when the tap controller reaches the update-dr state. for a read operation, return to shift-dr through capture-dr to shift out the register value. 1 1010 1 c7.cd.s clean d-cache single (uses c15.c.ind) write 0 1001 0 c9.d data cache lockdown read/write 0 1001 1 c9.i instruction cache lockdown read/write 1 1000 1 c9.dram data sram size/location read/write 1 1001 1 c9.iram instruction sram size/location read/write 0 1101 1 c13.tpid trace process identi?r read/write 0 1111 0 c15.state test state read/write 0 1111 1 c15.tag tag bist control read/write 1 1111 1 c15.ram cache ram bist control read/write 1 1101 0 c15.c.ind cache index (address/segment) read/write 0 1010 0 c15.dc data cache read/write (uses c15.c.ind) read/write 0 1010 1 c15.ic instruction cache read/write (uses c15.c.ind) read/write 0 1011 0 c15.dt data tag read/write (uses c15.c.ind) read/write 0 1011 1 c15.it instruction tag read/write (uses c15.c.ind) read/write 1 1110 1 c15.mem memory ram bist control read/write 1. for cp15 register 6, crm corresponds to memory region number [7:0]. table 9.6 mapping of scan chain 15 address field to cp15 registers (cont.) register address register number cp15 register 37 [36:33] 32 name type
debug using the serial interface and tap controller 9-17 copyright 2000-2001 by lsi logic corporation. all rights reserved. 9.3.4 debug access to the caches it is useful for the debugger to examine the instruction and data cache contents during debug operations. this examination requires two steps: 1. the debugger determines if valid addresses are stored in the cache and forms tag addresses from the tag contents and the tag index. 2. the debugger uses the generated addresses either to access main memory or to read individual entries using the cp15 scan chain. step 1 to do this step, the debugger reads the i-cache and d-cache tag arrays using scan chain 15. the debugger must do this for each entry set within the cache. figure 9.4 shows the format of the return data. figure 9.4 tag address format the tag address is formed from the tag contents and the tag index. this combination ensures that the format of the return data is consistent regardless of cache size. step 2 reading individual entries using the cp15 scan chain is useful if an entry is marked dirty, because this indicates an inconsistency between the cache contents and main memory. for the d-cache, the debugger can execute system speed accesses that hit in the cache and return the cache contents. writes to the d-cache from the processor core using this method cause the dirty bits to set for write-back regions, and main memory is updated for write-through regions. if the cp15 scan chain is used for updating the d-cache, only the cache contents are updated. writes are not made to main memory. with this method, you must ?st program the index/set register with the required cache index, set, and word values. figure 9.5 shows the cache index register format. 31 54 3 210 tag address valid dirty 1 dirty 2 set 1 set 0
9-18 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. figure 9.5 cache index register format note: although 27 bits are speci?d for the tag address, only those bits required for the particular tag implementation are used. the cache index register is also used for writing to the instruction cache. this is useful for setting software breakpoints within code already in the cache. it means that you do not have to ?sh the cache and reload the entry. note: there is no mechanism for detecting that the i-cache has been updated in this way. the debugger must restore the original cache contents after executing the breakpoint. 9.4 debug using the embeddedice-rt the arm9e-s embeddedice-rt logic provides integrated on-chip debug support for the arm9e-s core within the ARM946E-S. embeddedice-rt is programmed serially using the arm9e-s tap controller. figure 9.6 illustrates the relationship between the core, embeddedice-rt, and the tap controller, showing only the signals that are pertinent to the embeddedice-rt. 31 30 29 n+1 n 5 4 2 1 0 set sbz index word address sbz
debug using the embeddedice-rt 9-19 copyright 2000-2001 by lsi logic corporation. all rights reserved. figure 9.6 the arm9e-s, tap controller, and embeddedice-rt the embeddedice-rt logic consists of: ? two real-time watchpoint units ? two independent registers: debug control register debug status register ? debug comms channel the debug control register and the debug status register provide overall control of embeddedice-rt operation. for more detailed information about these registers, refer to the arm9e-s technical reference manual, appendix d, ?ebug in depth. dbgext[1:0] dbgcommrx dbgcommtx dbgrng[1:0] dbgack dbgiebkpt edbgrq dbgdewpt dbgen dbgtcken dbgtms dbgtdi dbgtdo clk embeddedice-rt arm9e-s dbgntrst ta p controller dbginstrexec dbgrqi
9-20 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. you can program one or both watchpoint units to halt the execution of instructions by the core. execution halts when the values programmed into embeddedice-rt match the values currently appearing on the address bus, data bus, and various control signals. note: you can mask bits so that their values do not affect the comparison. you can con?ure each watchpoint unit to be either a watchpoint (monitoring data accesses) or a breakpoint (monitoring instruction fetches). watchpoints and breakpoints can be data-dependent in halt mode debug. 9.4.1 disabling embeddedice-rt to disable embeddedice-rt, set the dbgen input low. note: hardwiring the dbgen input low permanently disables debug access. when dbgen is low, it inhibits dbgdewpt, dbgiebkpt, and edbgrq to the core, and dbgack from the ARM946E-S is always low. 9.4.2 debug communications channel the arm9e-s embeddedice-rt logic contains a communications channel for passing information between the target and the host debugger. this channel is implemented as coprocessor 14. the communications channel consists of: ? a 32-bit comms data read register ? a 32-bit comms data write register ? a 6-bit comms control register for synchronized handshaking between the processor and the asynchronous debugger these registers are located in ?ed locations in the embeddedice-rt logic register map and are accessed from the processor using mcr and mrc instructions to coprocessor 14. in addition to the comms channel registers, the processor can access a 1-bit debug status register for use in the real-time debug con?uration.
debug using the embeddedice-rt 9-21 copyright 2000-2001 by lsi logic corporation. all rights reserved. 9.4.3 debug comms channel registers there are four debug comms channel registers. table 9.7 lists the registers. for a description of each register and its format, including ?ld and bit de?itions, refer to section 3.4, ?p14 registers in this manual. 9.4.4 communications using the comms channel you can send and receive messages using the comms channel. 9.4.4.1 sending a message to the debugger when the processor has to send a message to the debugger, it must check that the comms data write register is free for use by ?ding out whether the w bit of the debug comms control register is clear. the processor reads the debug comms control register to check the status of the w bit: ? if the w bit is clear, the comms data write register is clear. ? if the w bit is set, previously written data has not been read by the debugger. the processor must continue to poll the control register until the w bit is clear. when the w bit is clear, a message is written by a register transfer to coprocessor 14. as the data transfer occurs from the processor to the comms data write register, the w bit is set in the debug comms control register. table 9.7 coprocessor 14 register map register name register number notes comms channel status c0 read-only comms channel data read c1 for reads comms channel data write c1 for writes debug status c2 read/write
9-22 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. the debugger sees both the r and w bits when it polls the debug comms control register through the jtag interface. when the debugger sees that the w bit is set, it can read the comms data write register, and scan the data out. the action of reading this data register clears the debug comms control register w bit. at this point, the communications process can begin again. 9.4.4.2 receiving a message from the debugger transferring a message from the debugger to the processor is similar to sending a message to the debugger. in this case, the debugger polls the r bit of the debug comms control register. ? if the r bit is low, the comms data read register is free, and data can be placed there for the processor to read. ? if the r bit is set, previously deposited data has not yet been collected, so the debugger must wait. when the comms data read register is free, data is written there using the jtag interface. the action of this write sets the r bit in the debug comms control register. the processor polls the debug comms control register. if the r bit is set, there is data that can be read using an mrc instruction to coprocessor 14. the action of this load clears the r bit in the debug comms control register. when the debugger polls this register and sees that the r bit is clear, the data has been taken, and the process can now be repeated. 9.5 breakpoints, watchpoints, and debug requests breakpoints, watchpoints, and external debug requests can cause the ARM946E-S to enter the debug state. these events are associated with the following debug interface signals: ? dbgiebkpt, dbgdewpt, and edbgrq are system requests for the ARM946E-S to enter the debug state. the three signals indicate an instruction breakpoint, data watchpoint, and external debug request, respectively. all three originate from hardware external to the ARM946E-S.
breakpoints, watchpoints, and debug requests 9-23 copyright 2000-2001 by lsi logic corporation. all rights reserved. ? dbgack acknowledges to the system that the ARM946E-S processor is in the debug state. the notations in figure 9.7 through figure 9.9 are de?ed as follows: 1. fn, dn, en, mn, wn = fetch, decode, execute, memory, and writeback, respectively, for instruction n, where n is the instruction in instr[31:0] 2. ldr = load register from memory instruction 3. dp = any data processing instruction 4. b = branch instruction 5. ddebug = decode debug entry 6. edebug = execute debug 7. t = branch target 9.5.1 entry into debug state on breakpoint any instruction fetched from memory is sampled at the end of a cycle. to apply a breakpoint to that instruction, you must assert the breakpoint signal by the end of the same cycle. figure 9.7 illustrates breakpoint timing. figure 9.7 breakpoint timing to extend the breakpoint functionality of the embeddedice-rt logic, you can add external logic, such as additional breakpoint comparators. the external logic output must be applied to the dbgiebkpt input. this f1 d1 f2 e1 d2 f1 m1 e2 d1 ddebug w1 m2 e1 edebug1 w2 m1 edebug2 w1 2 13 4 clk ia[31:1] instr[31:0] dbgiebkpt dbgack
9-24 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. signal is ored with the internally generated breakpoint signal before being applied to the arm9e-s core control logic. the timing of the input makes it unlikely that data-dependent external breakpoints can occur. a breakpointed instruction can enter the execute stage of the pipeline, but state changes that normally occur from executing the instruction are inhibited. all writes from previous instructions complete as usual. the decode cycle of the debug entry sequence occurs during the execute cycle of the breakpointed instruction. the latched breakpoint signal forces the processor to start the debug sequence. 9.5.2 breakpoints and exceptions a breakpointed instruction can have a prefetch abort associated with it. if so, the prefetch abort takes priority and the breakpoint is ignored. it is ignored, because if there is a prefetch abort, the instruction data might be invalid and the breakpoint could be data-dependent. since the data could be incorrect, the breakpoint might have triggered incorrectly. swi and unde?ed instructions are treated the same as any other instruction that might incur a breakpoint. therefore, the breakpoint takes priority over the swi or unde?ed instruction. on an instruction boundary, if there is a breakpointed instruction and an interrupt (nirq or nfiq), the interrupt is taken and the breakpointed instruction is discarded. after the interrupt is serviced, the execution ?w is returned to the original program. the previously breakpointed instruction is fetched again. if the breakpoint is still set, the processor enters the debug state when it reaches the pipeline execute stage. after the processor enters the halt mode debug state, it is important that additional interrupts not affect the instructions executed. for this reason, interrupts are disabled as soon as the processor enters the halt mode debug state. however, the state of the i and f bits in the program status register (psr) are not affected. 9.5.3 watchpoints entry into the debug state following a watchpointed memory access is imprecise, because of the nature of the pipeline.
breakpoints, watchpoints, and debug requests 9-25 copyright 2000-2001 by lsi logic corporation. all rights reserved. to extend functionality of the embeddedice-rt logic, you can build external logic, such as external watchpoint comparators. the external logic output must be applied to the dbgdewpt input. this signal is ored with the internally generated watchpoint signal before it is applied to the arm9e-s core control logic. the timing of the input makes it unlikely that data-dependent external watchpoints can occur. after a watchpointed access, the next instruction in the processor pipeline is always allowed to complete execution. when this instruction is a single-cycle data-processing instruction, entry into the debug state is delayed for one cycle while the instruction completes. figure 9.8 illustrates the timing of debug entry after a watchpointed ldr instruction. figure 9.8 watchpoint entry with data processing instruction although instruction 5 enters the execute stage, it is not executed, and there is no state update as a result of this instruction. when the debugging session is complete, normal operation involves returning to instruction 5 because it has not executed yet. the instruction following the instruction that generated the watchpoint might modify the program counter (pc). if this happens, you cannot f1 d1 f2 e1 d2 fldr m1 e2 dldr fdp w1 m2 eldr ddp f5 w2 mldr edp d5 wldr mdp e5 w5 ddebug wdp m5 edebug1edebug2 clk inmreq instr[31:0] da[31:0] wdata[31:0] rdata[31:0] dbgdewpt dbgack 12 dp56 78 ldr
9-26 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. determine the instruction that caused the watchpoint. however, you can always restart the processor. the timing diagram in figure 9.9 shows debug entry after a watchpoint when the next instruction is a branch. after the processor enters the debug state, you can interrogate the arm9e-s processor core to determine its state. in the case of a watchpoint, the pc contains a value that is ?e instructions after the address of the next instruction to be executed. therefore, upon entry into the debug state, if the instruction sub pc, pc, #20 is scanned in and the processor restarts, execution ?w returns to the next instruction in the code sequence. figure 9.9 watchpoint entry with branch 9.5.4 watchpoints and exceptions if a watchpointed data access is also aborted, the watchpoint condition is registered and the exception entry sequence is performed. then the processor enters the debug state. if there is an interrupt pending, the arm9e-s allows the exception entry sequence to occur and then enters the debug state. fldr dldr fb eldr db mldr eb wldr mb ft wb dt et ddebug edebug1edebug2 clk inmreq instr[31:0] da[31:0] wdata[31:0] rdata[31:0] dbgdewpt dbgack bt ldr x x t+4 t+8 t+c ia[31:1]
determining the core and system state 9-27 copyright 2000-2001 by lsi logic corporation. all rights reserved. 9.5.5 debug request a debug request can take place through the embeddedice-rt logic or by asserting the edbgrq signal. the request is synchronized and passed to the processor. a debug request takes priority over any pending interrupt. following synchronization, the processor core enters the debug state after the instruction that is currently in the execute stage ?ishes both the memory and write stages. while waiting for the instruction to complete, the processor allows no more instructions to enter the execute stage. note: if edbgrq is asserted while the processor is operating in monitor mode, the processor enters the debug state as if operating in halt mode. 9.5.6 actions of the arm9e-s in debug state when the arm9e-s is in the debug state, both memory interfaces indicate internal cycles. this ensures that the tightly coupled sram within the ARM946E-S and the ahb interface are both quiescent, allowing the rest of the ahb system to ignore the arm9e-s and function normally. because the rest of the system continues operation, the arm9e-s ignores aborts and interrupts. the nreset signal must be held stable during debug. if the system applies reset to the ARM946E-S (nreset is driven low), the state of the arm9e-s changes without the debugger knowing about it. 9.6 determining the core and system state when the ARM946E-S is in the debug state, you can examine the core and system state by forcing load and store multiple instructions into the instruction pipeline. before you examine the core and system state, the debugger must check the embeddedice-rt debug status register (bit 4) and determine whether the processor entered debug from the thumb state or the arm state. when bit 4 is high, it indicates the processor was in the thumb state. when bit 4 is low, the processor was in the arm state.
9-28 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. 9.7 real-time debug the arm9e-s processor contains logic that permits you to debug a system without completely stopping the processor. this allows servicing critical interrupt routines to continue while the debugger interrogates the processor. setting bit 4 of the debug control register enables the arm9e-s real-time debug features. when set, this bit con?ures the embeddedice-rt logic so a breakpoint or watchpoint causes the processor to enter abort mode and take the prefetch abort or data abort vectors, respectively. the following restrictions apply when the arm9e-s processor is con?ured for real-time debugging: ? breakpoints/watchpoints cannot be data-dependent. no support is provided for the range and chain functionality. breakpoints/watchpoints are based only on: instruction/data addresses external watchpoint conditioner (dbgextern) user/privileged mode access (dntrans/intrans) read/write access (watchpoints) access size (breakpoints: itbit, watchpoints: dmas[1:0]). ? single-step hardware is not enabled. ? external breakpoints/watchpoints are not supported. ? use the vector catching hardware, but you must not con?ure it to catch the prefetch or data abort exceptions. ? no support is provided for mixing halt mode/monitor mode debug functionality. when the processor is con?ured for monitor mode, asserting the external edbgrq signal or setting the internal edbgrq bit causes unpredictable behavior. if an abort is generated in monitor mode, the abort is recorded in the cp14 debug status register (bit 0). for more information about this register, including its format and bit de?itions, see section 3.4.2, ?ebug status register (c2) in this manual.
arm9e-s clock domains 9-29 copyright 2000-2001 by lsi logic corporation. all rights reserved. because the monitor mode debug does not put the processor into the debug state, you must change the contents of the watchpoint registers while external memory accesses are taking place. if the watchpoint registers are updated during a memory access, all matches from the affected watchpoint unit using the register are disabled for that update cycle. if false matches can occur during changes to the watchpoint registers (due to old data in some registers and new data in others), then you must do the following: 1. disable the watchpoint unit using the control register for that watchpoint unit. 2. change the other registers. 3. re-enable the watchpoint unit by rewriting the control register. 9.8 arm9e-s clock domains the arm9e-s processor has a single clock, clk, that is quali?d by two clock enables: ? sysclken controls access to the memory system ? dbgtcken controls debug operations during normal operation, sysclken conditions clk to clock the processor. when the ARM946E-S is in the debug state, dbgtcken conditions clk to clock the processor. 9.9 synchronizing debug clocks the arm multi-ice debug agent directly supports one or more cores within an asic design. external synchronization is required for the system debug and test clock inputs to the ARM946E-S. to synchronize the ARM946E-S with off-chip debug clocking, you must use a three-stage synchronizer. the off-chip device (for example, multi-ice) issues a tck signal, and waits for the returned tck (rtck) signal to come back. synchronization is maintained because the off-chip device does not progress to the next tck until after rtck is received.
9-30 debug interface copyright 2000-2001 by lsi logic corporation. all rights reserved. figure 9.10 shows the clock synchronization logic. figure 9.10 clock synchronization logic dbgtms dbgtdi multi-ice interface pads dbgntrst dbgtdo dbgtcken tdo rtck tck clk tms dq tck synchronizer dq dq dq clk clk dq clk ARM946E-S input sample and hold tdi
ARM946E-S microprocessor core with cache technical manual 10-1 copyright 2000 by lsi logic corporation. all rights reserved. chapter 10 etm interface this chapter describes the ARM946E-S embedded trace macrocell (etm) interface. it contains the following sections: ? section 10.1, ?bout the etm ? section 10.2, ?tm interface ? section 10.3, ?nabling the etm interface 10.1 about the etm the ARM946E-S supports the connection of an optional external embedded trace macrocell (etm) to provide real-time tracing of ARM946E-S instructions and data in an embedded system. the etm consists of a trace port and triggering facilities. 10.1.1 trace port the etm compresses the trace information and exports it through the trace port. an external trace port analyzer (tpa) captures the trace information. a trace protocol has been developed to provide a real-time trace capability for processor cores that are deeply embedded in much larger asic designs. as the asic typically includes signi?ant amounts of on-chip memory, you cannot determine how the processor core is operating simply by observing the pins of the asic. a trace port is required to con?m the performance of the processor while in operation.
10-2 etm interface copyright 2000 by lsi logic corporation. all rights reserved. 10.1.2 triggering facilities an extensible speci?ation exists that allows you to specify the exact set of trigger resources required for a particular application. resources include address and data comparators, counters, and sequencers. for more information, see the embedded trace macrocell (rev 1) speci?ation available from arm limited. 10.2 etm interface the etm interface is primarily one way. to provide code tracing, the etm must monitor various processor inputs and outputs. the required inputs and outputs are collected and driven out from the ARM946E-S as the etm interface. etm interface outputs are pipelined by a single clock cycle to provide early output timing and to isolate any etm input load from the critical ARM946E-S signals. the latency of the pipelined outputs does not affect etm trace behavior, because all outputs are delayed by the same amount. figure 10.1 shows the ARM946E-S etm interface.
enabling the etm interface 10-3 copyright 2000 by lsi logic corporation. all rights reserved. figure 10.1 ARM946E-S etm interface 10.3 enabling the etm interface the only input to the etm interface is an enable signal that allows the required processor i/o to be driven to/from the ARM946E-S. etmen is the etm interface enable signal. when etmen is high, the etm interface is enabled and the outputs are driven so that an external etm can begin code tracing. when the etmen input is driven low, the etm interface outputs are held at their last value before the interface is disabled. at reset, all etm interface outputs are reset low. etm etm interface registers etmen en clk ARM946E-S arm9e-s to/from ARM946E-S logic nreset to/from ARM946E-S logic etm interface signals (see notes 1 and 2) 1. for a list of etm signals and de?itions, see section 2.12, ?tm interface signals. 2. for timing information, see section figure a.10, ?tm interface timing,
10-4 etm interface copyright 2000 by lsi logic corporation. all rights reserved. the etm normally drives the etmen input. it is driven high when you have programmed the etm using its tap controller. note: if you do not use an etm in an embedded ARM946E-S design, tie the etmen input low to save power.
ARM946E-S microprocessor core with cache technical manual 11-1 copyright 2000?001 by lsi logic corporation. all rights reserved. chapter 11 test support this chapter describes the test methodology used for the ARM946E-S synthesized logic and tightly coupled sram. it contains the following sections: ? section 11.1, ?bout the ARM946E-S test methodology ? section 11.2, ?can insertion and atpg ? section 11.3, ?ist of memory arrays 11.1 about the ARM946E-S test methodology to achieve a high level of fault coverage, you can use scan insertion and automatic test pattern generation (atpg) techniques on the arm9e-s processor core and ARM946E-S control logic as part of the synthesis ?w. you can use bist to provide high fault coverage of the compiled sram. 11.2 scan insertion and atpg scan insertion requires that all register elements be replaced by scannable versions that are then connected into a number of large scan chains. these scan chains are used to set up data patterns on the combinatorial logic between the registers and to capture the logic outputs. the logic outputs are then scanned out while the next data pattern is scanned in. after scan insertion, you can use atpg tools to create the necessary scan patterns to test the logic. using this technique, you can achieve very high fault coverage for the standard cell combinatorial logic, typically, in the 95?9% range.
11-2 test support copyright 2000?001 by lsi logic corporation. all rights reserved. scan insertion does affect the area and the performance of the synthesized design. this affect is due to the larger scan register elements and the serial routing between them. however, to minimize the impact, scan insertion is performed early in the synthesis cycle and the design is reoptimized after the scan elements are in place. 11.3 bist of memory arrays bist is performed at manufacturing test. there is no software interface that will run the memory bist. the bist controller is accessible through the jtag interface.
ARM946E-S microprocessor core with cache technical manual a-1 copyright 2000?001 by lsi logic corporation. all rights reserved. appendix a ac parameters this appendix lists the ac timing parameters for the ARM946E-S. it contains the following sections: ? section a.1, ?iming diagrams ? section a.2, ?c timing parameter de?itions a.1 timing diagrams the timing diagrams in this section are: ? clock, reset, and ahb enable timing ? ahb bus request and grant related timing ? ahb bus master timing ? coprocessor interface timing ? debug interface timing ? jtag interface timing ? dbgsdout to dbgtdo timing ? exception and con?uration timing ? intest wrapper timing ? etm interface timing refer to table a.1 on page a-10 for de?itions of the parameters shown in the timing diagrams.
a-2 ac parameters copyright 2000?001 by lsi logic corporation. all rights reserved. clock, reset and ahb enable timing parameters are shown in figure a.1 . figure a.1 clock, reset, and ahb enable timing ahb bus request and grant related timing parameters are shown in figure a.2 . figure a.2 ahb bus request and grant related timing clk hclken hresetn t cyc t ishen t ihhen t isrst t ihrst t ohreq t ohlck t isgnt t ihgnt t ovreq t ovlck clk hbusreq hlock hgrant
timing diagrams a-3 copyright 2000?001 by lsi logic corporation. all rights reserved. ahb bus master timing parameters are shown in figure a.3 . figure a.3 ahb bus master timing t ovtr t ohtr t ova t oha t ohctl t ovctl t ovwd t ohwd t ihrdy t ihrsp t ihrd t isrdy okay t isrsp read data (a) t isrd okay write data (a) control a nonseq clk htrans[1:0] haddr[31:0] hwrite hsize[2:0] hburst[2:0] hprot[3:0] hwdata[310] hready hresp hrdata[31:0]
a-4 ac parameters copyright 2000?001 by lsi logic corporation. all rights reserved. coprocessor interface timing parameters are shown in figure a.4 . figure a.4 coprocessor interface timing t ovcpen t ovcpd t ohcpen t ohcpd t ovcpctl t ohcpctl t ohcphs t iscphs t ohcplc t ohcpps t ovcplc t ovcpps t ovcprd t ohcprd t ihcpwr t iscpwr stc/mrc data ldc/mcr data wait/go last/absent clk cpclken cpinstr[31:0] ncpmreq ncptrans cptbit chsde chsex cplatecancel cppass cpdout[31:0] cpdin[31:0]
timing diagrams a-5 copyright 2000?001 by lsi logic corporation. all rights reserved. debug interface timing parameters are shown in figure a.5 . figure a.5 debug interface timing t ovdbgack t ovdbgrng t ovdbgrqi t ovdbgstat t ovdbgcomm t ohdbgack t ohdbgrng t ohdbgrqi t ohdbgstat t ohdbgcomm t ihdbgin t ihiebkpt t ihdewpt t isdbgin t isiebkpt t isdewpt clk dbgack dbgrng[1:0] dbgrqi dbginstrexec commrx commtx dbgen edbgrq dbgext[1:0] dbgiebkpt dbgdewpt
a-6 ac parameters copyright 2000?001 by lsi logic corporation. all rights reserved. jtag interface timing parameters are shown in figure a.6 . figure a.6 jtag interface timing t ovdbgsm t ovtdoen t ovsdin t ovtdo t isntrst t ohdbgsm t ohtdoen t ohsdin t ohtdo t ihtdi t ihtcken t ihtapid t istdi t istcken t istapid clk dbgir[3:0] dbgntdoen dbgsdin dbgto dbgntrst dbgtdi dbgtms dbgtclken tapid[31:0] dbgscreg[4:0] dbgtapsm[3:0] t ihntrst
timing diagrams a-7 copyright 2000?001 by lsi logic corporation. all rights reserved. figure a.7 shows a combinational path timing parameter that exists from the dbgsdout input to the dbgtdo output. figure a.7 dbgsdout to dbgtdo timing exception and con?uration timing parameters are shown in figure a.8 . figure a.8 exception and con?uration timing dbgsdout dbgtdo t tdsh t tdsd clk initram nfiq t isint t ovbigend nirq vinithi bigendout t ohbigend t inint t ishivecs t ihhivecs t isinitram t ihinitram
a-8 ac parameters copyright 2000?001 by lsi logic corporation. all rights reserved. the intest wrapper timing parameters are shown in figure a.9 . figure a.9 intest wrapper timing t ovso t ohso t ihsi t issi t ihscanen t isscanen t ihtesten t istesten clk so si scanen testen t ihserialen t isserialen serialen
timing diagrams a-9 copyright 2000?001 by lsi logic corporation. all rights reserved. the etm interface timing parameters are shown in figure a.10 . figure a.10 etm interface timing t ovetminst t ovetmictl t ovetmstat t ohetminst t ohetmictl t ohetmstat t ohetmdata t ohetmnwait t ohetmdctl t ohetmcfg t ohetmcpif t ohetmdbg t ihetmen t isetmen t ovetmdbg t ovetmcpif t ovetmcfg t ovetmdctl t ovetmnwait t ovetmdata clk etmia[31:1] etmid31to24[31:24] etmid15to8[15:8] etminmreq etmiseq etmitbit etmiabort etminstrexec etmda[31:0] etmrdata[31:0] etmwdata[31:0] etmdmas[1:0] etmnwait etmdmore etmdnmreq etmdnrw etmdabort etmbigend etmhivecs etmchsd[1:0] etmchse[1:0] etmpass etmlatecancel etmdbgack etmrngout[1:0] etmen
a-10 ac parameters copyright 2000?001 by lsi logic corporation. all rights reserved. a.2 ac timing parameter de?itions table a.1 shows target ac parameters. all values are expressed as percentages of the clk period at maximum operating frequency. note: the values quoted are relative to the rising clock edge after the clock skew for internal buffering has been added. inputs given a 0% hold value therefore require a positive hold relative to the top-level clock input. the amount of hold required is equivalent to the internal clock skew. table a.1 timing parameter de?itions symbol parameter min max t cyc clk cycle time 100% t ishen hclken input setup to rising clk 85% t ihhen hclken input hold from rising clk 0% t isrst hresetn deassertion input setup to rising clk 90% t ihrst hresetn deassertion input hold from rising clk 0% t ovreq rising clk to hbusreq valid 30% t ohreq hbusreq hold time from rising clk >0% t ovlck rising clk to hlock valid 30% t ohlck hlock hold time from rising clk >0% t isgnt hgrant input setup to rising clk 40% t ihgnt hgrant input hold from rising clk 0% t ovtr rising clk to htrans[1:0] valid 30% t ohtr htrans[1:0] hold time from rising clk >0% t ova rising clk to haddr[31:0] valid 30% t oha haddr[31:0] hold time from rising clk >0% t ovctl rising clk to ahb control signals valid 30% t ohctl ahb control signals hold time from rising clk >0%
ac timing parameter de?itions a-11 copyright 2000?001 by lsi logic corporation. all rights reserved. t ovwd rising clk to hwdata[31:0] valid 30% t ohwd hwdata[31:0] hold time from rising clk >0% t isrdy hready input setup to rising clk 75% t ihrdy hready input hold from rising clk 0% t isrsp hresp[1:0] input setup to rising clk 50% t ihrsp hresp[1:0] input hold from rising clk 0% t isrd hrdata[31:0] input setup to rising clk 40% t ihrd hrdata[31:0] input hold from rising clk 0% t ovcpen rising clk to cpclken valid 30% t ohcpen cpclken hold time from rising clk >0% t ovcpid rising clk to cpinstr[31:0] valid 30% t ohcpid cpinstr[31:0] hold time from rising clk >0% t ovcpctl rising clk to transaction control valid 30% t ohcpctl transaction control hold time from rising clk >0% t iscphs coprocessor handshake input setup to rising clk 50% t ihcphs coprocessor handshake input hold from rising clk 0% t ovcplc rising clk to cplatecancel valid 30% t ohcplc cplatecancel hold time from rising clk >0% t ovcpps rising clk to cppass valid 30% t ohcpps cppass hold time from rising clk >0% t ovcprd rising clk to cpdout[31:0] valid 30% t ohcprd cpdout[31:0] hold time from rising clk >0% t iscpwr cpdin[31:0] input setup to rising clk 40% t ihcpwr cpdin[31:0] input hold from rising clk 0% t ovdbgack rising clk to dbgack valid 60% table a.1 timing parameter de?itions (cont.) symbol parameter min max
a-12 ac parameters copyright 2000?001 by lsi logic corporation. all rights reserved. t ohdbgack dbgack hold time from rising clk >0% t ovdbgrng rising clk to dbgrng[1:0] valid 60% t ohdbgrng dbgrng[1:0] hold time from rising clk >0% t ovdbgrqi rising clk to dbgrqi valid 45% t ohdbgrqi dbgrqi hold time from rising clk >0% t ovdbgstat rising clk to dbginstrexec valid 30% t ohdbgstat dbginstrexec hold time from rising clk >0% t ovdbgcomm rising clk to comms channel outputs valid 30% t ohdbgcomm comms channel outputs hold time from rising clk >0% t isdbgin debug inputs input setup to rising clk 30% t ihdbgin debug inputs input hold from rising clk 0% t isiebkpt dbgiebkpt input setup to rising clk 20% t ihiebkpt dbgiebkpt input hold from rising clk 0% t isdewpt dbgdewpt input setup to rising clk 20% t ihdewpt dbgdewpt input hold from rising clk 0% t ovdbgsm rising clk to debug state valid 30% t ohdbgsm debug state hold time from rising clk >0% t ovtdoen rising clk to dbgntdoen valid 40% t ohtdoen dbgntdoen hold time from rising clk >0% t ovsdin rising clk to dbgsdin valid 20% t ohsdin dbgsdin hold time from rising clk >0% t ovtdo rising clk to dbgtdo valid 65% t ohtdo dbgtdo hold time from rising clk >0% t isntrst dbgntrst deasserted input setup to rising clk 35% t ihntrst dbgntrst input hold from rising clk 0% table a.1 timing parameter de?itions (cont.) symbol parameter min max
ac timing parameter de?itions a-13 copyright 2000?001 by lsi logic corporation. all rights reserved. t istdi tap state control input setup to rising clk 25% t ihtdi tap state control input hold from rising clk 0% t istcken dbgtcken input setup to rising clk 50% t ihtcken dbgtcken input hold from rising clk 0% t istapid tapid[31:0] input setup to rising clk 20% t ihtapid tapid[31:0] input hold from rising clk 0% t dsd dbgtdo delay from dbgsdoutbs changing 30% t dsh dbgtdo hold time from dbgsdoutbs changing >0% t ovbigend rising clk to bigendout valid 30% t ohbigend bigendout hold time from rising clk >0% t isint interrupt input setup to rising clk 15% t ihint interrupt input hold from rising clk 0% t ishivecs vinithi input setup to rising clk 95% t ihhivecs vinithi input hold from rising clk 0% t isinitram initram input setup to rising clk 95% t ihinitram initram input hold from rising clk 0% t ovso rising clk to so valid 30% t ohso so hold time from rising clk >0% t issi si input setup to rising clk 95% t ihsi si input hold from rising clk 0% t isscanen scanen input setup to rising clk 95% t ihscanen scanen input hold from rising clk 0% t isserialen serialen input setup to rising clk 95% t ihserialen serialen input hold from rising clk 0% t ovetminst rising clk to etm instruction interface valid 30% table a.1 timing parameter de?itions (cont.) symbol parameter min max
a-14 ac parameters copyright 2000?001 by lsi logic corporation. all rights reserved. note: the vinithi pin is speci?d as 95% of the cycle because it is for input con?uration during reset and can be considered static. t ohetminst etm instruction interface hold time from rising clk >0% t ovetmictl rising clk to etm instruction control valid 30% t ohetmictl etm instruction control hold time from rising clk >0% t ovetmstat rising clk to etminstrexec valid 30% t ohetmstat etminstrexec hold time from rising clk >0% t ovetmdata rising clk to etm data interface valid 30% t ohetmdata etm data interface hold time from rising clk >0% t ovetmnwait rising clk to etmnwait valid 30% t ohetmnwait etmnwait hold time from rising clk >0% t ovetmdctl rising clk to etm data control valid 30% t ohetmdctl etm data control hold time from rising clk >0% t ovetmcfg rising clk to etm con?uration valid 30% t ohetmcfg etm con?uration hold time from rising clk >0% t ovetmcpif rising clk to etm coprocessor signals valid 30% t ohetmcpif etm coprocessor signals hold time from rising clk >0% t ovetmdbg rising clk to etm debug signals valid 30% t ohetmdbg etm debug signals hold time from rising clk >0% t isetmen etmen input setup to rising clk 50% t ihetmen etmen input hold from rising clk 0% table a.1 timing parameter de?itions (cont.) symbol parameter min max
ARM946E-S microprocessor core with cache technical manual ix-1 copyright 2000?001 by lsi logic corporation. all rights reserved. index a ac timing parameters 11-10 access address for a 4 kbyte cache 4-3 access permission registers 3-15 address format 3-24 ahb bus master interface 7-2 clocking 7-7 interface unit 1-5 signals 2-5 transfers clock enable 7-7 ARM946E-S 1-1 block diagram 1-3 transfer 7-3 arm9e-s 1-1 core programmer? model 3-1 atpg 11-1 scan control signals 2-30 automatic test pattern generator 11-1 b background regions 5-4 base address, region 5-2 base setting, example 3-21 bist memory arrays 11-2 block diagram 1-3 breakpoints 9-23 exceptions 9-24 instruction boundary 9-24 prefetch abort 9-24 burst access 7-5 crossing 1 kbyte boundary 7-6 size 7-3 bus interface unit 7-1 bus master interface, ahb 7-2 busy-waiting 8-10 c cache architecture 4-1 configuration registers 3-13 debug access 9-17 debug index register 3-31 lockdown 4-11 lockdown register 3-25 operations register 3-22 size 4-4 type register 3-6 cd and bd bits cache stores 4-9 cd bit 4-8 cdp instructions 8-9 clk to hclk slew 7-8 clock ahb 7-7 domains 9-29 enable ahb transfers 7-7 interface signals 2-5 tree insertion 7-8 hierarchical 7-9 control register 3-11 , 6-2 coprocessor clocking 8-2 external 8-6 handshake encoding 8-6 handshake signals 8-5 instructions 8-2 interface 8-1 interface signals 2-20 states 8-5 core state determining 9-27 cp14 registers 3-34 cp15 6-2 register map 3-3
ix-2 index copyright 2000?001 by lsi logic corporation. all rights reserved. d data cache signals 2-15 data ram signals 2-10 data write modes 7-11 d-cache 1-5 , 4-7 bd and cd bits 4-7 clean and flush 4-9 disabling 4-7 enabling 4-7 lockdown 4-12 operation 4-7 validity 4-9 debug clocks 9-29 comms channel 9-21 comms channel registers 9-21 comms channel status register 3-34 communications channel 9-20 host 9-2 interface 9-1 logic 9-3 message transfer 9-21 multi-ice 9-29 operations 9-4 pullup resistors 9-9 real-time 9-28 request 9-27 serial interface 9-5 signals 2-22 status register 3-35 systems 9-1 target 9-3 debug state actions of arm9e-s 9-27 breakpoints 9-23 watchpoints 9-24 determining core state 9-27 system state 9-27 dirty bits 4-4 disabling d-sram 6-4 disabling embeddedice-rt 9-20 d-sram disabling 6-4 enabling 6-4 load mode 6-4 e embeddedice-rt debug 9-18 disabling 9-20 enabling d-sram 6-4 etm interface 10-1 enabling 10-3 signals 2-25 external coprocessor 8-1 , 8-6 f flushing entire i-cache 4-6 single i-cache line 4-6 h harvard bus architecture 1-4 i i-cache 1-5 , 4-5 disabling 4-5 enabling 4-5 flushing 4-6 lockdown 4-13 operation 4-5 validity 4-6 id code register 3-5 index field 3-23 , 4-4 index format 3-23 instruction cache signals 2-11 instruction ram signals 2-8 instruction/data access permission (i/dap) regis- ter (extended) 3-16 instruction/data access permission (i/dap) regis- ter (standard) 3-18 instructions cdp 8-9 coprocessor 8-2 ldc/sts 8-3 mcr interlocked 8-8 privileged 8-10 interlocked mcr 8-8 interrupts busy-waiting 8-10 i-sram disabling 6-3 enabling 6-2 load mode 6-3
ARM946E-S microprocessor core with cache technical manual ix-3 copyright 2000?001 by lsi logic corporation. all rights reserved. j jtag signals 2-24 l ldc/stc instructions 8-3 line fetch back to back 7-4 transfer 7-3 load and store multiples 4-9 load mode d-sram 6-4 i-sram 6-3 lockdown cache 4-11 d-cache 4-12 example subroutine 4-13 i-cache 4-13 m mcr cycles 8-7 instruction format 3-4 interlocked 8-8 memory regions 5-2 miscellaneous signals 2-25 mrc cycles 8-7 instruction format 3-4 multi-ice 9-29 n noncached thumb instruction fetch 7-6 o overlapping regions 5-3 p partition attributes 5-3 privileged instructions 8-10 protection region/base size register 3-19 protection unit 1-5 diagram 5-1 enabling 5-2 protocol converter 9-2 r real-time debug 9-28 region background 5-4 base address 5-2 memory 5-2 overlapping 5-3 size 5-3 register 7 rd format 4-10 access permission 3-15 base size 3-19 cache configuration 3-13 cache debug index 3-31 cache lockdown 3-25 cache operations 3-22 cache type 3-6 control 3-11 , 6-2 debug comms channel 9-21 debug comms channel status 3-34 debug status 3-35 id code 3-5 instruction/data access permission (extended) 3-16 instruction/data access permission (standard) 3-18 protection region 3-19 serial 9-5 test state 3-29 tightly-coupled memory region 3-26 tightly-coupled memory size 3-9 trace process identifier 3-29 write buffer control 3-14 register map, cp15 3-3 s scan chain 15 mapping 9-15 scan chains 9-12 scan insertion 11-1 serial registers 9-5 set format 3-23 signal descriptions 2-1 signal properties and requirements 2-1 signals ahb 2-5 atpg scan control 2-30 clock interface 2-5
ix-4 index copyright 2000?001 by lsi logic corporation. all rights reserved. coprocessor interface 2-20 data cache 2-15 data ram 2-10 debug 2-22 etm interface 2-25 instruction ram 2-8 insturction cache 2-11 jtag 2-24 miscellaneous 2-25 size, region 5-3 slew 7-8 sram bist 11-2 requirements 6-1 system state, determining 9-27 t tag field 4-4 tap controller 9-6 tap instructions bypass 9-11 extest 9-10 idcode 9-11 intest 9-10 restart 9-12 sample/preload 9-12 scan_n 9-10 test methodology 11-1 test state register 3-29 thumb instruction fetch noncached 7-6 tightly-coupled memory region register 3-26 size register 3-9 timing diagrams 11-1 parameters 11-10 trace port 10-1 trace process indentifier register 3-29 transfer 7-3 line fetch 7-3 uncached 7-5 u uncached transfers 7-5 w watchpoints 9-24 exceptions 9-26 timing 9-25 write buffer 7-1 , 7-10 control register 3-14 disabling 7-12 enabling 7-12 operation 7-11
ARM946E-S microprocessor core with cache technical manual copyright 2000?001 by lsi logic corporation. all rights reserved. customer feedback we would appreciate your feedback on this document. please copy the following page, add your comments, and fax it to us at the number shown. if appropriate, please also fax copies of any marked-up pages from this document. impor tant: please include your name, phone number, fax number, and company address so that we may contact you directly for clari?ation or additional information. thank you for your help in improving the quality of our documents.
customer feedback copyright 2000?001 by lsi logic corporation. all rights reserved. readers comments fax your comments to: lsi logic corporation technical publications m/s e-198 fax: 408.433.4333 please tell us how you rate this document: ARM946E-S microprocessor core with cache technical manual. place a check mark in the appropriate blank for each category. what could we do to improve this document? if you found errors in this document, please specify the error and page number. if appropriate, please fax a marked-up copy of the page(s). please complete the information below so that we may contact you directly for clari?ation or additional information. excellent good average fair poor completeness of information ____ ____ ____ ____ ____ clarity of information ____ ____ ____ ____ ____ ease of ?ding information ____ ____ ____ ____ ____ technical content ____ ____ ____ ____ ____ usefulness of examples and illustrations ____ ____ ____ ____ ____ overall manual ____ ____ ____ ____ ____ name date telephone title company name street city, state, zip department mail stop fax
customer feedback copyright 2000?001 by lsi logic corporation. all rights reserved.
customer feedback copyright 2000?001 by lsi logic corporation. all rights reserved.
u.s. distributors by state a. e. avnet electronics http://www.hh.avnet.com b. m. bell microproducts, inc. (for habs) http://www.bellmicro.com i. e. insight electronics http://www.insight-electronics.com w. e. wyle electronics http://www.wyle.com alabama daphne i. e. tel: 334.626.6190 huntsville a. e. tel: 256.837.8700 b. m. tel: 256.705.3559 i. e. tel: 256.830.1222 w. e. tel: 800.964.9953 alaska a. e. tel: 800.332.8638 arizona phoenix a. e. tel: 480.736.7000 b. m. tel: 602.267.9551 w. e. tel: 800.528.4040 tempe i. e. tel: 480.829.1800 tucson a. e. tel: 520.742.0515 arkansas w. e. tel: 972.235.9953 california agoura hills b. m. tel: 818.865.0266 granite bay b. m. tel: 916.523.7047 irvine a. e. tel: 949.789.4100 b. m. tel: 949.470.2900 i. e. tel: 949.727.3291 w. e. tel: 800.626.9953 los angeles a. e. tel: 818.594.0404 w. e. tel: 800.288.9953 sacramento a. e. tel: 916.632.4500 w. e. tel: 800.627.9953 san diego a. e. tel: 858.385.7500 b. m. tel: 858.597.3010 i. e. tel: 800.677.6011 w. e. tel: 800.829.9953 san jose a. e. tel: 408.435.3500 b. m. tel: 408.436.0881 i. e. tel: 408.952.7000 santa clara w. e. tel: 800.866.9953 woodland hills a. e. tel: 818.594.0404 westlake village i. e. tel: 818.707.2101 colorado denver a. e. tel: 303.790.1662 b. m. tel: 303.846.3065 w. e. tel: 800.933.9953 englewood i. e. tel: 303.649.1800 idaho springs b. m. tel: 303.567.0703 connecticut cheshire a. e. tel: 203.271.5700 i. e. tel: 203.272.5843 wallingford w. e. tel: 800.605.9953 delaware north/south a. e. tel: 800.526.4812 tel: 800.638.5988 b. m. tel: 302.328.8968 w. e. tel: 856.439.9110 florida altamonte springs b. m. tel: 407.682.1199 i. e. tel: 407.834.6310 boca raton i. e. tel: 561.997.2540 bonita springs b. m. tel: 941.498.6011 clearwater i. e. tel: 727.524.8850 fort lauderdale a. e. tel: 954.484.5482 w. e. tel: 800.568.9953 miami b. m. tel: 305.477.6406 orlando a. e. tel: 407.657.3300 w. e. tel: 407.740.7450 tampa w. e. tel: 800.395.9953 st. petersburg a. e. tel: 727.507.5000 georgia atlanta a. e. tel: 770.623.4400 b. m. tel: 770.980.4922 w. e. tel: 800.876.9953 duluth i. e. tel: 678.584.0812 hawaii a. e. tel: 800.851.2282 idaho a. e. tel: 801.365.3800 w. e. tel: 801.974.9953 illinois north/south a. e. tel: 847.797.7300 tel: 314.291.5350 chicago b. m. tel: 847.413.8530 w. e. tel: 800.853.9953 schaumburg i. e. tel: 847.885.9700 indiana fort wayne i. e. tel: 219.436.4250 w. e. tel: 888.358.9953 indianapolis a. e. tel: 317.575.3500 iowa w. e. tel: 612.853.2280 cedar rapids a. e. tel: 319.393.0033 kansas w. e. tel: 303.457.9953 kansas city a. e. tel: 913.663.7900 lenexa i. e. tel: 913.492.0408 kentucky w. e. tel: 937.436.9953 central/northern/ western a. e. tel: 800.984.9503 tel: 800.767.0329 tel: 800.829.0146 louisiana w. e. tel: 713.854.9953 north/south a. e. tel: 800.231.0253 tel: 800.231.5775 maine a. e. tel: 800.272.9255 w. e. tel: 781.271.9953 maryland baltimore a. e. tel: 410.720.3400 w. e. tel: 800.863.9953 columbia b. m. tel: 800.673.7461 i. e. tel: 410.381.3131 massachusetts boston a. e. tel: 978.532.9808 w. e. tel: 800.444.9953 burlington i. e. tel: 781.270.9400 marlborough b. m. tel: 800.673.7459 woburn b. m. tel: 800.552.4305 michigan brighton i. e. tel: 810.229.7710 detroit a. e. tel: 734.416.5800 w. e. tel: 888.318.9953 clarkston b. m. tel: 877.922.9363 minnesota champlin b. m. tel: 800.557.2566 eden prairie b. m. tel: 800.255.1469 minneapolis a. e. tel: 612.346.3000 w. e. tel: 800.860.9953 st. louis park i. e. tel: 612.525.9999 mississippi a. e. tel: 800.633.2918 w. e. tel: 256.830.1119 missouri w. e. tel: 630.620.0969 st. louis a. e. tel: 314.291.5350 i. e. tel: 314.872.2182 montana a. e. tel: 800.526.1741 w. e. tel: 801.974.9953 nebraska a. e. tel: 800.332.4375 w. e. tel: 303.457.9953 nevada las vegas a. e. tel: 800.528.8471 w. e. tel: 702.765.7117 new hampshire a. e. tel: 800.272.9255 w. e. tel: 781.271.9953 new jersey north/south a. e. tel: 201.515.1641 tel: 609.222.6400 mt. laurel i. e. tel: 856.222.9566 pine brook b. m. tel: 973.244.9668 w. e. tel: 800.862.9953 parsippany i. e. tel: 973.299.4425 wayne w. e. tel: 973.237.9010 new mexico w. e. tel: 480.804.7000 albuquerque a. e. tel: 505.293.5119
u.s. distributors by state (continued) new york hauppauge i. e. tel: 516.761.0960 long island a. e. tel: 516.434.7400 w. e. tel: 800.861.9953 rochester a. e. tel: 716.475.9130 i. e. tel: 716.242.7790 w. e. tel: 800.319.9953 smithtown b. m. tel: 800.543.2008 syracuse a. e. tel: 315.449.4927 north carolina raleigh a. e. tel: 919.859.9159 i. e. tel: 919.873.9922 w. e. tel: 800.560.9953 north dakota a. e. tel: 800.829.0116 w. e. tel: 612.853.2280 ohio cleveland a. e. tel: 216.498.1100 w. e. tel: 800.763.9953 dayton a. e. tel: 614.888.3313 i. e. tel: 937.253.7501 w. e. tel: 800.575.9953 strongsville b. m. tel: 440.238.0404 valley view i. e. tel: 216.520.4333 oklahoma w. e. tel: 972.235.9953 tulsa a. e. tel: 918.459.6000 i. e. tel: 918.665.4664 oregon beaverton b. m. tel: 503.524.1075 i. e. tel: 503.644.3300 portland a. e. tel: 503.526.6200 w. e. tel: 800.879.9953 pennsylvania mercer i. e. tel: 412.662.2707 philadelphia a. e. tel: 800.526.4812 b. m. tel: 877.351.2355 w. e. tel: 800.871.9953 pittsburgh a. e. tel: 412.281.4150 w. e. tel: 440.248.9996 rhode island a. e. 800.272.9255 w. e. tel: 781.271.9953 south carolina a. e. tel: 919.872.0712 w. e. tel: 919.469.1502 south dakota a. e. tel: 800.829.0116 w. e. tel: 612.853.2280 tennessee w. e. tel: 256.830.1119 east/west a. e. tel: 800.241.8182 tel: 800.633.2918 texas arlington b. m. tel: 817.417.5993 austin a. e. tel: 512.219.3700 b. m. tel: 512.258.0725 i. e. tel: 512.719.3090 w. e. tel: 800.365.9953 dallas a. e. tel: 214.553.4300 b. m. tel: 972.783.4191 w. e. tel: 800.955.9953 el paso a. e. tel: 800.526.9238 houston a. e. tel: 713.781.6100 b. m. tel: 713.917.0663 w. e. tel: 800.888.9953 richardson i. e. tel: 972.783.0800 rio grande valley a. e. tel: 210.412.2047 stafford i. e. tel: 281.277.8200 utah centerville b. m. tel: 801.295.3900 murray i. e. tel: 801.288.9001 salt lake city a. e. tel: 801.365.3800 w. e. tel: 800.477.9953 vermont a. e. tel: 800.272.9255 w. e. tel: 716.334.5970 virginia a. e. tel: 800.638.5988 w. e. tel: 301.604.8488 haymarket b. m. tel: 703.754.3399 spring?ld b. m. tel: 703.644.9045 washington kirkland i. e. tel: 425.820.8100 maple valley b. m. tel: 206.223.0080 seattle a. e. tel: 425.882.7000 w. e. tel: 800.248.9953 west virginia a. e. tel: 800.638.5988 wisconsin milwaukee a. e. tel: 414.513.1500 w. e. tel: 800.867.9953 wauwatosa i. e. tel: 414.258.5338 wyoming a. e. tel: 800.332.9326 w. e. tel: 801.974.9953
sales of?es and design resource centers lsi logic corporation corporate headquarters 1551 mccarthy blvd milpitas ca 95035 tel: 408.433.8000 fax: 408.433.8989 north america california irvine 18301 von karman ave suite 900 irvine, ca 92612 ? tel: 949.809.4600 fax: 949.809.4444 pleasanton design center 5050 hopyard road, 3rd floor suite 300 pleasanton, ca 94588 tel: 925.730.8800 fax: 925.730.8700 san diego 7585 ronson road suite 100 san diego, ca 92111 tel: 858.467.6981 fax: 858.496.0548 silicon valley 1551 mccarthy blvd sales of?e m/s c-500 milpitas, ca 95035 ? tel: 408.433.8000 fax: 408.954.3353 design center m/s c-410 tel: 408.433.8000 fax: 408.433.7695 wireless design center 11452 el camino real suite 210 san diego, ca 92130 tel: 858.350.5560 fax: 858.350.0171 colorado boulder 4940 pearl east circle suite 201 boulder, co 80301 ? tel: 303.447.3800 fax: 303.541.0641 colorado springs 4420 arrowswest drive colorado springs, co 80907 tel: 719.533.7000 fax: 719.533.7020 fort collins 2001 dan?ld court fort collins, co 80525 tel: 970.223.5100 fax: 970.206.5549 florida boca raton 2255 glades road suite 324a boca raton, fl 33431 tel: 561.989.3236 fax: 561.989.3237 georgia alpharetta 2475 north winds parkway suite 200 alpharetta, ga 30004 tel: 770.753.6146 fax: 770.753.6147 illinois oakbrook terrace two mid american plaza suite 800 oakbrook terrace, il 60181 tel: 630.954.2234 fax: 630.954.2235 kentucky bowling green 1262 chestnut street bowling green, ky 42101 tel: 270.793.0010 fax: 270.793.0040 maryland bethesda 6903 rockledge drive suite 230 bethesda, md 20817 tel: 301.897.5800 fax: 301.897.8389 massachusetts waltham 200 west street waltham, ma 02451 ? tel: 781.890.0180 fax: 781.890.6158 burlington - mint technology 77 south bedford street burlington, ma 01803 tel: 781.685.3800 fax: 781.685.3801 minnesota minneapolis 8300 norman center drive suite 730 minneapolis, mn 55437 ? tel: 612.921.8300 fax: 612.921.8399 new jersey red bank 125 half mile road suite 200 red bank, nj 07701 tel: 732.933.2656 fax: 732.933.2643 cherry hill - mint technology 215 longstone drive cherry hill, nj 08003 tel: 856.489.5530 fax: 856.489.5531 new york fairport 550 willowbrook of?e park fairport, ny 14450 tel: 716.218.0020 fax: 716.218.9010 north carolina raleigh phase ii 4601 six forks road suite 528 raleigh, nc 27609 tel: 919.785.4520 fax: 919.783.8909 oregon beaverton 15455 nw greenbrier parkway suite 235 beaverton, or 97006 tel: 503.645.0589 fax: 503.645.6612 texas austin 9020 capital of tx highway north building 1 suite 150 austin, tx 78759 tel: 512.388.7294 fax: 512.388.4171 plano 500 north central expressway suite 440 plano, tx 75074 ? tel: 972.244.5000 fax: 972.244.5001 houston 20405 state highway 249 suite 450 houston, tx 77070 tel: 281.379.7800 fax: 281.379.7818 canada ontario ottawa 260 hearst way suite 400 kanata, on k2l 3h1 ? tel: 613.592.1263 fax: 613.592.3253 international france paris lsi logic s.a. immeuble europa 53 bis avenue de l'europe b.p. 139 78148 velizy-villacoublay cedex, paris ? tel: 33.1.34.63.13.13 fax: 33.1.34.63.13.19 germany munich lsi logic gmbh orleansstrasse 4 81669 munich ? tel: 49.89.4.58.33.0 fax: 49.89.4.58.33.108 stuttgart mittlerer pfad 4 d-70499 stuttgart ? tel: 49.711.13.96.90 fax: 49.711.86.61.428 italy milan lsi logic s.p.a. centro direzionale colleoni palazzo orione ingresso 1 20041 agrate brianza, milano ? tel: 39.039.687371 fax: 39.039.6057867 japan tokyo lsi logic k.k. rivage-shinagawa bldg. 14f 4-1-8 kounan minato-ku, tokyo 108-0075 ? tel: 81.3.5463.7821 fax: 81.3.5463.7820 osaka crystal tower 14f 1-2-27 shiromi chuo-ku, osaka 540-6014 ? tel: 81.6.947.5281 fax: 81.6.947.5287
sales of?es and design resource centers (continued) korea seoul lsi logic corporation of korea ltd 10th fl., haesung 1 bldg. 942, daechi-dong, kangnam-ku, seoul, 135-283 tel: 82.2.528.3400 fax: 82.2.528.2250 the netherlands eindhoven lsi logic europe ltd world trade center eindhoven building ?ijder bogert 26 5612 lz eindhoven tel: 31.40.265.3580 fax: 31.40.296.2109 singapore singapore lsi logic pte ltd 7 temasek boulevard #28-02 suntec tower one singapore 038987 tel: 65.334.9061 fax: 65.334.4749 sweden stockholm lsi logic ab finlandsgatan 14 164 74 kista ? tel: 46.8.444.15.00 fax: 46.8.750.66.47 taiwan taipei lsi logic asia, inc. taiwan branch 10/f 156 min sheng e. road section 3 taipei, taiwan r.o.c. tel: 886.2.2718.7828 fax: 886.2.2718.8869 united kingdom bracknell lsi logic europe ltd greenwood house london road bracknell, berkshire rg12 2ub ? tel: 44.1344.426544 fax: 44.1344.481039 ? sales of?es with design resource centers
international distributors australia new south wales reptechnic pty ltd 3/36 bydown street neutral bay, nsw 2089 ? tel: 612.9953.9844 fax: 612.9953.9683 belgium acal nv/sa lozenberg 4 1932 zaventem tel: 32.2.7205983 fax: 32.2.7251014 china beijing lsi logic international services inc. beijing representative of?e room 708 canway building 66 nan li shi lu xicheng district beijing 100045, china tel: 86.10.6804.2534 to 38 fax: 86.10.6804.2521 france rungis cedex azzurri technology france 22 rue saarinen sillic 274 94578 rungis cedex tel: 33.1.41806310 fax: 33.1.41730340 germany haar ebv elektronik hans-pinsel str. 4 d-85540 haar tel: 49.89.4600980 fax: 49.89.46009840 munich avnet emg gmbh stahlgruberring 12 81829 munich tel: 49.89.45110102 fax: 49.89.42.27.75 wuennenberg-haaren peacock ag graf-zepplin-str 14 d-33181 wuennenberg-haaren tel: 49.2957.79.1692 fax: 49.2957.79.9341 hong kong hong kong avt industrial ltd unit 608 tower 1 cheung sha wan plaza 833 cheung sha wan road kowloon, hong kong tel: 852.2428.0008 fax: 852.2401.2105 serial system (hk) ltd 2301 nanyang plaza 57 hung to road, kwun tong kowloon, hong kong tel: 852.2995.7538 fax: 852.2950.0386 india bangalore spike technologies india private ltd 951, vijayalakshmi complex, 2nd floor, 24th main, j p nagar ii phase, bangalore, india 560078 ? tel: 91.80.664.5530 fax: 91.80.664.9748 israel tel aviv eastronics ltd 11 rozanis street p.o. box 39300 tel aviv 61392 tel: 972.3.6458777 fax: 972.3.6458666 japan tokyo daito electron sogo kojimachi no.3 bldg 1-6 kojimachi chiyoda-ku, tokyo 102-8730 tel: 81.3.3264.0326 fax: 81.3.3261.3984 global electronics corporation nichibei time24 bldg. 35 tansu-cho shinjuku-ku, tokyo 162-0833 tel: 81.3.3260.1411 fax: 81.3.3260.7100 technical center tel: 81.471.43.8200 marubeni solutions 1-26-20 higashi shibuya-ku, tokyo 150-0001 tel: 81.3.5778.8662 fax: 81.3.5778.8669 shinki electronics myuru daikanyama 3f 3-7-3 ebisu minami shibuya-ku, tokyo 150-0022 tel: 81.3.3760.3110 fax: 81.3.3760.3101 yokohama-city innotech 2-15-10 shin yokohama kohoku-ku yokohama-city, 222-8580 tel: 81.45.474.9037 fax: 81.45.474.9065 macnica corporation hakusan high-tech park 1-22-2 hadusan, midori-ku, yokohama-city, 226-8505 tel: 81.45.939.6140 fax: 81.45.939.6141 the netherlands eindhoven acal nederland b.v. beatrix de rijkweg 8 5657 eg eindhoven tel: 31.40.2.502602 fax: 31.40.2.510255 switzerland brugg lsi logic sulzer ag mattenstrasse 6a ch 2555 brugg tel: 41.32.3743232 fax: 41.32.3743233 taiwan taipei avnet-mercuries corporation, ltd 14f, no. 145, sec. 2, chien kuo n. road taipei, taiwan, r.o.c. tel: 886.2.2516.7303 fax: 886.2.2505.7391 lumax international corporation, ltd 7th fl., 52, sec. 3 nan-kang road taipei, taiwan, r.o.c. tel: 886.2.2788.3656 fax: 886.2.2788.3568 prospect technology corporation, ltd 4fl., no. 34, chu luen street taipei, taiwan, r.o.c. tel: 886.2.2721.9533 fax: 886.2.2773.3756 wintech microeletronics co., ltd 7f., no. 34, sec. 3, pateh road taipei, taiwan, r.o.c. tel: 886.2.2579.5858 fax: 886.2.2570.3123 united kingdom maidenhead azzurri technology ltd 16 grove park business estate waltham road white waltham maidenhead, berkshire sl6 3lw tel: 44.1628.826826 fax: 44.1628.829730 milton keynes ingram micro (uk) ltd garamonde drive wymbush milton keynes buckinghamshire mk8 8df tel: 44.1908.260422 swindon ebv elektronik 12 interface business park bincknoll lane wootton bassett, swindon, wiltshire sn4 8sy tel: 44.1793.849933 fax: 44.1793.859555 ? sales of?es with design resource centers

▲Up To Search▲

Price & Availability of ARM946E-S

	To Download ARM946E-S Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .