ARM1020TTM ARM1020T ARM1020 ARM10 0001D ARM10TDMI EPOC-32 ARM920T D15-D0 - Datasheet Archive

 

(Rev 0) Technical Reference Manual ARM DDI 0135A ARM1020TTM (Rev 0) Technical Reference Manual © Copyright ARM Limited 2000.

 

ARM1020TTM ARM1020TTM (Rev 0) Technical Reference Manual ARM DDI 0135A ARM1020TTM ARM1020TTM (Rev 0) Technical Reference Manual © Copyright ARM Limited 2000. All rights reserved. Release information Change history Date Issue Change 9 February 2000 A First release Proprietary notice ARM, the ARM Powered logo, Thumb and StrongARM are registered trademarks of ARM Limited. The ARM logo, AMBA, Angel, ARMulator, EmbeddedICE, ModelGen, Multi-ICE, PrimeCell, ARM7TDMI, ARM7TDMI-S, ARM9TDMI, ARM9E-S, ETM7, ETM9, TDMI, and STRONG are trademarks of ARM Limited. All other products or services mentioned herein may be trademarks of their respective owners. Neither the whole nor any part of the information contained in, or the product described in, this document may be adapted or reproduced in any material form except with the prior written permission of the copyright holder. The product described in this document is subject to continuous developments and improvements. All particulars of the product and its use contained in this document are given by ARM Limited in good faith. However, all warranties implied or expressed, including but not limited to implied warranties or merchantability, or fitness for purpose, are excluded. This document is intended only to assist the reader in the use of the product. ARM Limited shall not be liable for any loss or damage arising from the use of any information in this document, or any error or omission in such information, or any incorrect use of the product. Document confidentiality status Figure 7-1 on page 7-2 reprinted with permission IEEE Std 1149.1-1990, IEEE Standard Test Access Port and Boundary-Scan Architecture Copyright1999, by IEEE. The IEEE disclaims any responsibility or liability resulting from the placement and use in the described manner. Product status The information in this document is Preliminary (information on a product under development). ARM web address http://www.arm.com ii © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A Contents ARM1020TTM ARM1020TTM (Rev 0) Technical Reference Manual Preface About this document .xiv Further reading. xvii Feedback . xviii Chapter 1 Introduction 1.1 1.2 1.3 1.4 Chapter 2 System Coprocessor Programmer's Model 2.1 2.2 2.3 Chapter 3 About the programmer's model. 2-2 Summary of ARM1020T ARM1020T system control coprocessor (CP15) registers. 2-3 Register descriptions . 2-6 Memory Management Unit 3.1 3.2 3.3 3.4 3.5 3.6 ARM DDI 0135A About the ARM1020T ARM1020T . 1-2 Processor functional block diagram . 1-3 Pipeline . 1-6 Clocking . 1-10 About the MMU . 3-2 MMU software-accessible registers . 3-3 Address translation . 3-5 MMU descriptors. 3-8 MMU memory access control. 3-18 MMU cachable and bufferable information . 3-20 © Copyright ARM Limited 2000. All rights reserved. iii 3.7 3.8 3.9 3.10 3.11 3.12 3.13 Chapter 4 Caches and Write Buffer 4.1 4.2 4.3 4.4 4.5 Chapter 5 Bus features . 6-2 ARM1020T ARM1020T AMBA AHB signals. 6-3 Arbiter signals. 6-5 Test signals . 6-6 AHB control signals in ARM1020T ARM1020T . 6-8 Timing. 6-11 The ARM1020T ARM1020T instruction bus interface unit (I-BIU) overview. 6-12 The ARM1020 ARM1020 data bus interface unit (D-BIU) overview. 6-13 AMBA interface. 6-14 The Write Buffer (WB) . 6-15 Handling external aborts. 6-16 Coprocessor interface . 6-17 JTAG Interface 7.1 7.2 7.3 7.4 7.5 7.6 7.7 7.8 7.9 7.10 iv About the Prefetch Unit . 5-2 Branch prediction. 5-3 Treatment of BL and BLX instructions. 5-4 Instruction memory barrier instruction (IMB) . 5-5 ARM1020T ARM1020T IMB implementation. 5-6 Bus Interface 6.1 6.2 6.3 6.4 6.5 6.6 6.7 6.8 6.9 6.10 6.11 6.12 Chapter 7 About the caches and write buffer . 4-2 Instruction cache . 4-3 Data cache and write buffer. 4-6 Cache coherence . 4-13 Portability issues. 4-15 Branch Prediction and Prefetch Unit 5.1 5.2 5.3 5.4 5.5 Chapter 6 MMU aborts . 3-21 MMU fault checking sequence . 3-22 MMU and write buffer . 3-26 MMU faults and CPU aborts. 3-27 Fault status . 3-28 External aborts . 3-29 Interaction of the MMU, caches, and write buffer . 3-30 JTAG interface and halt mode. 7-2 The JTAG port and test data registers . 7-4 EXTEST. 7-6 SCAN_N . 7-7 RESTART. 7-8 INTEST. 7-9 IDCODE. 7-10 BYPASS . 7-11 HALT . 7-12 INTEST. 7-13 © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A 7.11 7.12 Chapter 8 Debug 8.1 8.2 8.3 8.4 8.5 8.6 Chapter 9 ARM1020T ARM1020T timing diagrams. 11-2 ARM1020T ARM1020T timing parameters . 11-3 Signal Descriptions A.1 A.2 A.3 A.4 A.5 A.6 A.7 ARM DDI 0135A Introduction . 10-2 Instruction cycle times. 10-8 Interlocks. 10-10 AC Characteristics 11.1 11.2 Appendix A About the AMBA test interface. 9-2 Memory mapping . 9-4 TIC test modes. 9-5 JTAG test mode . 9-9 Cache testing . 9-10 MMU testing. 9-15 Instruction Cycle Summary and Interlocks 10.1 10.2 10.3 Chapter 11 About the ARM1020T ARM1020T debug unit. 8-2 Debug registers. 8-4 Values in the link register after aborts. 8-13 Halt mode. 8-15 Monitor mode . 8-22 Comms channel . 8-23 AMBA Test Interface 9.1 9.2 9.3 9.4 9.5 9.6 Chapter 10 Using EXTEST and INTEST with ARM1020T ARM1020T. 7-14 Scan chain descriptions . 7-15 Global control signals.A-2 AHB signals in normal mode.A-3 AHB signals in test mode .A-6 PLL signals .A-7 JTAG and TAP controller signals .A-8 Debug signals .A-10 Coprocessor signals .A-11 © Copyright ARM Limited 2000. All rights reserved. v vi © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A List of Tables ARM1020TTM ARM1020TTM (Rev 0) Technical Reference Manual Table 2-1 Table 2-2 Table 2-3 Table 2-4 Table 2-5 Table 2-6 Table 2-7 Table 2-8 Table 2-9 Table 2-10 Table 2-11 Table 2-12 Table 2-13 Table 2-14 Table 2-15 Table 2-16 Table 2-17 Table 2-18 Table 2-19 Table 2-20 Table 2-21 Table 3-1 Table 3-2 ARM DDI 0135A CP15 register summary . 2-3 Address types in ARM1020T ARM1020T . 2-4 CP15 abbreviations. 2-5 Reading from register 0. 2-7 Bit fields for register 0 . 2-7 Register 0 bit definitions. 2-8 Accessing register 1. 2-9 Control bit functions register 1 . 2-10 Accessing register 2. 2-12 Reading from register 3. 2-12 FSR bits . 2-13 Accessing the FSR register 5. 2-14 Accessing the FAR register 6. 2-14 Function descriptions register 7 . 2-15 Cache instructions register 7. 2-16 Bit fields for index cache operations . 2-17 Bit fields for VA cache operations . 2-18 TLB instructions register 8 . 2-19 Accessing the cache lockdown register 9 . 2-21 Accessing the TLB lockdown register 10 . 2-21 Accessing the process identifier register r13 . 2-23 CP15 register functions. 3-3 Access types from Level 1 descriptor bit values . 3-9 © Copyright ARM Limited 2000. All rights reserved. vii Table 3-3 Table 3-4 Table 3-5 Table 3-6 Table 3-7 Table 3-8 Table 4-1 Table 4-2 Table 5-1 Table 6-1 Table 6-2 Table 6-3 Table 6-4 Table 6-5 Table 6-6 Table 6-7 Table 6-8 Table 7-1 Table 7-2 Table 7-3 Table 8-1 Table 8-2 Table 8-3 Table 8-4 Table 8-5 Table 8-6 Table 8-7 Table 8-8 Table 8-9 Table 8-10 Table 8-11 Table 9-1 Table 9-2 Table 9-3 Table 9-4 Table 9-5 Table 9-6 Table 9-7 Table 9-8 Table 9-9 Table 9-10 Table 9-11 Table 9-12 Table 9-13 Table 9-14 Table 9-15 Table 9-16 viii Access types from Level 2 descriptor bit values. 3-11 Access types from Level 2 descriptor bit values. 3-14 Domain access encodings. 3-18 Interpreting access permission bits . 3-19 Interpretation of the C and B bits. 3-20 Priority encoding of fault status . 3-28 cachable/control bits and their outputs . 4-4 DCache cachable bufferable control bits and their outputs . 4-8 Optimization of branch instructions . 5-4 ARM1020T ARM1020T AMBA AHB signals. 6-3 Arbiter signals. 6-5 Test signals . 6-6 ARM1020T ARM1020T transfer sizes . 6-8 ARM1020T ARM1020T HBURST operation. 6-9 ARM1020T ARM1020T transfer attributes . 6-9 ARM1020T ARM1020T macrocell inputs . 6-17 ARM1020T ARM1020T macrocell outputs . 6-18 Supported public instructions and their binary codes . 7-4 Method of debug entry bit values . 7-18 DSCR bits from the core. 7-21 CP14 registers and scan chain numbers. 8-4 Bit field definitions for register 0 . 8-6 Bit field definitions for register 1 (DSCR). 8-7 Bit field definitions for registers 64-79 . 8-9 Breakpoint control register bits and definitions . 8-10 Bit field definitions for registers 96-97 . 8-10 Bit field definitions of the watchpoint control registers . 8-11 Values in the link register after exceptions . 8-13 Values in the link register after watchpoints . 8-14 Legal CP14 instructions. 8-17 Legal instructions for breakpoint and watchpoint registers. 8-18 HADDRT bit values in test mode. 9-4 HADDR bit values in test mode . 9-5 Address for BIU test . 9-6 JTAG test vectors and decoded values. 9-9 ICache and DCache decodings . 9-10 Cache component decodings . 9-11 Supported TIC operations for caches . 9-11 Location and width of cache data accesses . 9-12 Accessing PA bits. 9-13 Accessing CAM/flags. 9-14 I-MMU and D-MMU decodings . 9-15 MMU component decodings . 9-16 Supported TIC operations for MMUs . 9-16 Location and width of MMU data accesses . 9-17 Accessing CAM bits. 9-18 Accessing PROT RAM bits. 9-18 © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A Table 9-17 Table 10-1 Table 10-2 Table 10-3 Table 10-4 Table 10-5 Table 10-6 Table 10-7 Table 10-8 Table 11-1 Table A-1 Table A-2 Table A-3 Table A-4 Table A-5 Table A-6 Table A-7 Table A-8 Table A-9 Table A-10 Table A-11 Table A-12 Table A-13 Table A-14 ARM DDI 0135A Accessing PA RAM bits . 9-18 Data processing instructions cycle times . 10-3 Multiply instructions cycle times . 10-4 Branch instruction cycle counts. 10-6 Coprocessor instruction cycle counts. 10-6 Status register access cycle counts . 10-7 Symbols used in tables . 10-8 Instruction cycle counts . 10-8 Data bus instruction times. 10-9 ARM1020T ARM1020T timing parameters . 11-3 Global control signals .A-2 AHB control signals .A-3 AHB input signals .A-3 AHB output signals .A-4 AHB instruction bus arbitration signals .A-4 AHB data BIU arbitration signals .A-5 AHB output signals in test mode .A-6 AHB input signals in test mode .A-6 PLL signals .A-7 TAP controller signals .A-8 JTAG signals .A-8 Debug signals .A-10 ARM1020T ARM1020T macrocell input values .A-11 ARM1020T ARM1020T macrocell outputs .A-11 © Copyright ARM Limited 2000. All rights reserved. ix x © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A List of Figures ARM1020TTM ARM1020TTM (Rev 0) Technical Reference Manual Figure 1-1 Figure 1-2 Figure 1-3 Figure 1-4 Figure 1-5 Figure 1-6 Figure 1-7 Figure 2-1 Figure 2-2 Figure 2-3 Figure 2-4 Figure 2-5 Figure 2-6 Figure 2-7 Figure 2-8 Figure 2-9 Figure 2-10 Figure 2-11 Figure 2-12 Figure 2-13 Figure 2-14 Figure 2-15 Figure 3-1 ARM DDI 0135A ARM1020T ARM1020T functional block diagram . 1-3 ARM1020T ARM1020T pipeline. 1-6 Typical operations in pipeline stages . 1-7 An ALU operation. 1-8 Progression of a load/store operation . 1-8 Progression of a load multiple, store multiple operation . 1-9 Progression of an LDR which misses . 1-9 CP15 MRC and MCR bit pattern. 2-4 Read device ID bit fields . 2-7 Register 0 read cache type . 2-7 Control register bit settings . 2-10 Register 2. 2-12 Register 3. 2-12 Register 5. 2-14 Register 6. 2-15 Register 7 index tag format . 2-17 Register 7 virtual address format . 2-18 Register 8 virtual address tag format . 2-19 Register 9. 2-20 Register 10 bit fields. 2-21 Register 13 bit fields. 2-23 Address mapping using CP15 register 13. 2-24 Section and page translation overview . 3-6 © Copyright ARM Limited 2000. All rights reserved. xi Figure 3-2 Figure 3-3 Figure 3-4 Figure 3-5 Figure 3-6 Figure 3-7 Figure 3-8 Figure 3-9 Figure 3-10 Figure 3-11 Figure 3-12 Figure 3-13 Figure 6-1 Figure 6-2 Figure 6-3 Figure 6-4 Figure 7-1 Figure 7-2 Figure 8-1 Figure 9-1 Figure 10-1 xii Level 1 descriptor formats . 3-8 Level 2 descriptor formats . 3-8 Creating a Level 1 descriptor address . 3-9 Translation for a 1MB section. 3-10 Generating a Level 2 coarse page table address. 3-11 Large page table walk . 3-12 4KByte small page or 1KByte small page subpage translations . 3-13 Generating fine page table addresses. 3-14 Fine large page table walk. 3-15 Fine small page table walk . 3-16 Translation process for tiny pages. 3-17 Fault checking sequence. 3-23 ARM1020T ARM1020T AHB interface . 6-7 GCLK to HCLK ratio . 6-11 Top-level block diagram of the I-BIU . 6-12 D-BIU Block diagram . 6-13 JTAG TAP state machine diagram . 7-2 Device ID code register . 7-16 Comms channel output. 8-23 I-BIU AHB test block diagram . 9-7 Forwarding paths in the ARM1020T ARM1020T integer core. 10-11 © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A Preface This preface introduces the ARM1020T ARM1020T (Rev 0) and its reference documentation. It contains the following sections: · About this document on page xiv · Further reading on page xvii · Feedback on page xviii. ARM DDI 0135A © Copyright ARM Limited 2000. All rights reserved. xiii About this document This document is the technical reference manual for the ARM1020T ARM1020T (Rev 0). Intended audience This document has been written for experienced hardware and software engineers who have experience of ARM products. Using this manual This document is organized into the following chapters: Chapter 1 Introduction Read this chapter for an overview of the ARM1020T ARM1020T (Rev 0). Chapter 2 System Coprocessor Programmer's Model Read this chapter for details of the programmer's model and ARM1020T ARM1020T registers. Chapter 3 Memory Management Unit Read this chapter for details of the Memory Management Unit (MMU) and address translation process. Chapter 4 Caches and Write Buffer Read this chapter for a description of the instruction cache, the data cache, the write buffer, and the physical address tag RAM. Chapter 5 Branch Prediction and Prefetch Unit Read this chapter for a description of the branch prediction and prefetch unit. Chapter 6 Bus Interface Read this chapter for a description of the bus interface to AMBA. Chapter 7 JTAG Interface Read this chapter for information on how to use JTAG for debug. Chapter 8 Debug Read this chapter for a description of ARM10 ARM10 debug. xiv © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A Chapter 9 AMBA Test Interface Read this chapter for a detailed description of test methodology. Chapter 10 Instruction Cycle Summary and Interlocks Read this chapter for a description of the instruction cycles and interlocks. Chapter 11 AC Characteristics Read this chapter for details of the physical characteristics of the ARM1020T ARM1020T. Appendix A Signals This appendix lists the ARM1020T ARM1020T (Rev 0) signals in functional groups. Typographical conventions The following typographical conventions are used in this document: bold Highlights ARM processor signal names, and interface elements such as menu names. Also used for terms in descriptive lists, where appropriate. italic Highlights special terminology, cross-references and citations. typewriter Denotes text that may be entered at the keyboard, such as commands, file names and program names, and source code. typewriter Denotes a permitted abbreviation for a command or option. The underlined text may be entered instead of the full command or option name. typewriter italic Denotes arguments to commands or functions where the argument is to be replaced by a specific value. typewriter bold Denotes language keywords when used outside example code. ARM DDI 0135A © Copyright ARM Limited 2000. All rights reserved. xv Timing diagram conventions This manual contains one or more timing diagrams. The following key explains the components used in these diagrams. Any variations are clearly labelled when they occur. Therefore, no additional meaning should be attached unless specifically stated. Clock HIGH to LOW Transient HIGH/LOW to HIGH Bus stable Bus to high impedance Bus change High impedance to stable bus Key to timing diagram conventions Shaded bus and signal areas are undefined, so the bus or signal can assume any value within the shaded area at that time. The actual level is unimportant and does not affect normal operation. xvi © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A Further reading This section lists publications by ARM Limited, and by third parties. ARM periodically provides updates and corrections to its documentation. See http://www.arm.com for current errata sheets and addenda. See also the ARM Frequently Asked Questions list at: http://www.arm.com/DevSupp/Sales+Support/faq.html ARM publications This document contains information that is specific to the ARM1020T ARM1020T (Rev 0). Refer to the following documents for other relevant information: · ARM Architecture Reference Manual (ARM DUI 0100) · ARM AMBA Specification (ARM IHI 0001D 0001D) · ARM 10200 (Rev 0) Test Chip Implementation Guide (ARM DXI 0106A). Other publications This section lists relevant documents published by third parties. · IEEE Standard, Test Access Port and Boundary-Scan Architecture specification 1149.1-1990 (JTAG). Figure 7-1 reprinted with permission IEEE Std 1149.1-1990, IEEE Standard Test Access Port and Boundary-Scan Architecture Copyright1999, by IEEE. The IEEE disclaims any responsibility or liability resulting from the placement and use in the described manner. ARM DDI 0135A © Copyright ARM Limited 2000. All rights reserved. xvii Feedback ARM Limited welcomes feedback both on the ARM1020T ARM1020T (Rev 0), and on the documentation. Feedback on the ARM1020T ARM1020T (Rev 0) If you have any comments or suggestions about this product, please contact your supplier giving: · the product name · a concise explanation of your comments. Feedback on this document If you have any comments on about this document, please send email to errata@arm.com giving: · the document title · the document number · the page number(s) to which your comments refer · a concise explanation of your comments. General suggestions for additions and improvements are also welcome. xviii © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A Chapter 1 Introduction This chapter introduces the ARM1020T ARM1020T processor and its features. It contains the following sections: · About the ARM1020T ARM1020T on page 1-2 · Processor functional block diagram on page 1-3 · Pipeline on page 1-6 · Clocking on page 1-10. ARM DDI 0135A © Copyright ARM Limited 2000. All rights reserved. 1-1 Introduction 1.1 About the ARM1020T ARM1020T The ARM1020T ARM1020T processor incorporates the ARM10TDMI ARM10TDMI integer unit, which implements the ARMv5T architecture. It supports the ARM and Thumb instruction sets, and includes EmbeddedICE logic and JTAG software debug features. ARM1020T ARM1020T is a high-performance, low-power, ARM cached processor macrocell which provides full virtual memory capabilities. ARM1020T ARM1020T is designed to run sophisticated operating systems such as JavaOS, Linux, Microsoft WindowsCE, NetBSD, and Symbian's EPOC-32 EPOC-32. ARM1020T ARM1020T consists of the ARM10TDMI ARM10TDMI integer unit along with data and instruction caches, memory management unit, and write buffers. The ARM1020T ARM1020T comprises: · ARM10TDMI ARM10TDMI integer unit with integral EmbeddedICE logic · external coprocessor interface and coprocessors 14 and 15 · instruction and data Memory Management Units (MMU) · instruction and data caches · writeback Physical Address (PA) tag RAM · write buffer and Hit-Under-Miss (HUM) · Advanced Micro Bus Architecture (AMBA) bus interface and Amba High-performance Bus (AHB) · JTAG-based debug. 1-2 © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A Introduction 1.2 Processor functional block diagram Figure 1-1 shows the main blocks in the ARM1020T ARM1020T with the data paths in bold. IPA[31:0] Instruction MMU Instruction cache IA[31:0] IWD[63:0] CP15 CP14 JTAG and TAP controller External coprocessor interface ARM10TDMI ARM10TDMI integer unit with integral EmbeddedICE logic ITR Instruction bus interface unit IRD[63:0] AMBA bus interface DRD[63:0] DWD[63:0] Write buffer Hit under miss AHB Data bus interface unit DA[31:0] Data MMU PA[7:0] Data cache DPA[31:0] Figure 1-1 ARM1020T ARM1020T functional block diagram 1.2.1 ARM10TDMI ARM10TDMI ARM1020T ARM1020T is built around the ARM10TDMI ARM10TDMI processor unit. This is an ARMv5T implementation which runs the ARM (32-bit) and Thumb (16-bit compressed) instruction sets, allowing the programmer to select high-performance or high code density. This enables you to balance performance against code size and extract maximum performance from 8-bit, 16-bit, and 32-bit memory. ARM1020T ARM1020T includes EmbeddedICE logic JTAG software debug capabilities, and is supported by the Multi-ICE JTAG debug interface and ARM Developer Suite (ADS). Refer to Chapter 2 System Coprocessor Programmer's Model for system coprocessor programming information. ARM DDI 0135A © Copyright ARM Limited 2000. All rights reserved. 1-3 Introduction 1.2.2 MMU ARM1020T ARM1020T incorporates a Memory Management Unit (MMU) with separate Instruction and Data Translation Lookaside Buffers (TLBs). The MMU is backward-compatible with the ARM architecture v4 MMU found in StrongARM and ARM920T ARM920T. The ARM1020T ARM1020T MMU includes a new 1KB tiny page mapping size to allow a smaller RAM and ROM footprint with operating systems such as WindowsCETM which have many small mapped objects. ARM1020T ARM1020T implements the Fast Context Switching Extension (FCSE) and High Vectors Extension which are required to run Microsoft WindowsCE. Refer to Chapter 3 Memory Management Unit for more information. 1.2.3 Instruction and data caches ARM1020T ARM1020T incorporates 32KB Instruction Cache (ICache) and 32KB Data Cache (DCache). The data cache provides write-though (WT) or writeback (WB) operation, selected under software control on a per-region basis. The large caches mean you can gain high performance from commodity memory systems by significantly reducing: · the read bandwidth required of main memory · with writeback caching, the write bandwidth required of main memory · overall system power consumption as accesses to off-chip memory are reduced. ARM1020T ARM1020T provides a write buffer that can hold eight 64-bit values, each at an independent address. Refer to Chapter 4 Caches and Write Buffer for more information. 1.2.4 Branch prediction and prefetch unit (PU) The Prefetch Unit (PU), one element of the ARM10TDMI ARM10TDMI integer unit, influences the behavior of the instruction cache. Refer to Chapter 5 Branch Prediction and Prefetch Unit for more information. 1.2.5 AMBA ARM1020T ARM1020T implements the AMBA on-chip System Bus interface as its interface to memory and peripherals. The ARM High-performance Bus (AHB) is a multimaster on-chip bus with two unidirectional 64-bit data buses and one 32-bit address bus. ARM1020T ARM1020T provides a full coprocessor interface for on-chip coprocessors such as a floating-point unit or application-specific hardware acceleration units. Refer to Chapter 6 Bus Interface for more information. 1-4 © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A Introduction 1.2.6 Debug Hardware and software debug facilities are dealt with in Chapter 7 JTAG Interface and Chapter 8 Debug. 1.2.7 System-on-chip design features ARM1020T ARM1020T is designed to be embedded into larger ICs, enabling system-on-chip designs. The EmbeddedICE logic debug facilities, AMBA on-chip system bus, and AMBA TIC Test Methodology are all designed to allow efficient use of ARM1020T ARM1020T when integrated into a larger IC. Refer to Chapter 9 AMBA Test Interface for details of testing. 1.2.8 Instruction cycle timing and interlocks The pipeline and typical instruction progressions through the pipeline appear in Pipeline on page 1-6. Refer to Chapter 10 Instruction Cycle Summary and Interlocks for further details. ARM DDI 0135A © Copyright ARM Limited 2000. All rights reserved. 1-5 Introduction 1.3 Pipeline Figure 1-2 shows the six stages of the ARM1020T ARM1020T pipeline. Figure 1-2 ARM1020T ARM1020T pipeline The integer pipeline consists of six stages to maximize instruction throughput: · Instruction Fetch and branch prediction · Instruction Issue 1-6 © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A Introduction · · · · Instruction Decode and register read Execute shift and ALU, or address calculate, or multiply Memory Access, or multiply Register Write. By overlapping the various stages of operation, ARM10TDMI ARM10TDMI maximizes the clock rate achievable to execute each instruction. It delivers a throughput approaching one instruction per cycle. Because it has multiple execution units, ARM10TDMI ARM10TDMI allows multiple instructions to exist in the same pipeline stage, allowing simultaneous execution of some instructions. The Fetch stage can hold up to three instructions, where branch prediction is performed on instructions ahead of execution of earlier instructions. The Issue and Decode stages can contain any instruction in parallel with a predicted branch. The Execute, Memory, and Write stages can contain a predicted branch, an ALU or multiply instruction, a load or store multiple instruction and a coprocessor instruction in parallel execution. 1.3.1 Instruction progression Figure 1-3 shows the typical operations in each of the six pipeline stages in the ALU pipeline, the load/store pipeline and in the HUM . Figure 1-3 Typical operations in pipeline stages ARM DDI 0135A © Copyright ARM Limited 2000. All rights reserved. 1-7 Introduction Figure 1-4 shows an ALU operation. The load/store pipeline and the hit-under-miss buffer are not used. Figure 1-4 An ALU operation Figure 1-5 shows the progression of a LDR/STR which hits. The load/store pipeline is used . Figure 1-5 Progression of a load/store operation 1-8 © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A Introduction Figure 1-6 shows an LDM/STM operation using the load/store pipeline to complete. Other instructions can use the ALU pipeline at the same time as the LDM/STM completes in the load/store pipeline. Fetch ALU pipeline Fetch instruction 1 Issue Main decode of instruction 2 Decode Execute Secondary decode Read registers 3 Base writeback calculation (if needed) 4 Data address calculation 4,5,6 Load/store pipeline Memory 5 Access memory 5,6,7 Write Base writeback calculation (if needed) 6 Write results to registers 7,8,9 Load from memory Hit-under-miss Figure 1-6 Progression of a load multiple, store multiple operation Figure 1-7 shows the progression of an LDR which misses. When the LDR is in the HUM stage, other instructions, including independent loads, can run under it. Fetch ALU pipeline Fetch instruction 1 Load/store pipeline Issue Main decode of instruction 2 Decode Execute Secondary decode Read registers 3 Base writeback calculation (if needed) 4 Data address calculation 4 Hit-under-miss Memory 5 Access memory 5 Write Base writeback calculation (if needed) 6 Write result to register 8 Load 6,7 Figure 1-7 Progression of an LDR which misses ARM DDI 0135A © Copyright ARM Limited 2000. All rights reserved. 1-9 Introduction 1.4 Clocking The ARM1020T ARM1020T is a fully static design.The ARM1020T ARM1020T has two functional clock inputs: · GCLK · HCLK. Both clocks can be stopped indefinitely without loss of state. GCLK is used to control the internal ARM1020T ARM1020T integer unit and any cache operations. Therefore most macrocell signal timings are specified with respect to HCLK. Refer to Timing on page 6-11 for details. 1-10 © Copyright ARM Limited 2000. All rights reserved. ARM DDI 0135A Chapter 2 System Coprocessor Programmer's Model This chapter describes the ARM1020T ARM1020T registers and provides information for programming the microprocessor. It contains the following sections: · About the programmer's model on page 2-2 · Summary of ARM1020T ARM1020T system control coprocessor (CP15) registers on page 2-3 · Register descriptions on page 2-6. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 2-1 System Coprocessor Programmer's Model 2.1 About the programmer's model The ARM10TDMI ARM10TDMI programmer's model, including a detailed instruction set specification, is described in the ARM Architecture Reference Manual (Rev D). The programmer's model of ARM1020T ARM1020T is the same as the programmer's model of ARM10TDMI ARM10TDMI, but extended in the following ways: · · 2-2 The system control coprocessor (CP15) integrated within ARM1020T ARM1020T provides additional registers which are used to configure and control the caches, MMU, protection system, and clocking mode of ARM1020T ARM1020T. The MMU page tables define the virtual to physical address mapping, access permissions, and cache and write buffer configuration. These are created by the operating system software and accessed automatically by the ARM1020T ARM1020T MMU hardware whenever an access causes a TLB miss. Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A System Coprocessor Programmer's Model 2.2 Summary of ARM1020T ARM1020T system control coprocessor (CP15) registers CP15 defines 16 registers. Table 2-1 shows the read and write functions of the registers. Table 2-1 CP15 register summary Register Reads Writes 0 ID and information UNPREDICTABLE 1 Control Control 2 Translation table base Translation table base 3 Domain access control Domain access control 4 UNPREDICTABLE UNPREDICTABLE 5 Fault status Fault status 6 Fault address Fault address 7 UNPREDICTABLE Cache operations 8 UNPREDICTABLE TLB operations 9 Cache lockdown Cache lockdown 10 TLB lockdown TLB lockdown 11 UNDEFINED UNDEFINED 12 PLL control PLL control 13 Process ID Process ID 14 UNDEFINED UNDEFINED 15 Test configuration Test configuration All CP15 register bits that are defined and contain state, are set to zero by Reset except: · · B Bit in register 1, which takes the value of macrocell input signal BIGENDINIT · ARM DDI 0135A V Bit in register 1, which takes the value of macrocell input signal HIVECSINIT Bits [6:3] in register 1, which are all defined as ones and which all take the value one at Reset. Copyright © ARM Limited 2000. All rights reserved. 2-3 System Coprocessor Programmer's Model 2.2.1 Addresses in ARM1020T ARM1020T Three distinct types of address exist in an ARM1020T ARM1020T system: · Virtual Address (VA) · Modified Virtual Address (MVA) · Physical Address (PA). Table 2-2 shows the address types in ARM1020T ARM1020T. Table 2-2 Address types in ARM1020T ARM1020T ARM10TDMI ARM10TDMI Address type Caches and TLBs AMBA bus Virtual Modified Virtual Address Physical Below is an example of the address manipulation that occurs when the ARM10TDMI ARM10TDMI requests an instruction (see Figure 1-1 on page 1-3): 1. 2. The VA is translated using the ProcID to the MVA. The instruction cache and MMU detect the MVA (see Process ID register r13 on page 2-23. 3. If the protection check carried out by the MMU on the MVA does not abort and the MVA tag is in the instruction cache, the instruction data is returned to the ARM10TDMI ARM10TDMI. 4. If the instruction cache misses (the MVA tag is not in the instruction cache) then the MMU performs a translation to produce the Instruction PA (IPA). 5. 2.2.2 The VA of the instruction is issued by the ARM10TDMI ARM10TDMI. The PA is passed to the AMBA bus interface to perform an external access. Accessing CP15 registers CP15 registers can only be accessed with MRC and MCR instructions in a privileged mode. The instruction bit pattern of the MCR and MRC instructions is shown in Figure 2-1. 31 28 27 cond 24 23 21 20 19 1 1 1 0 opcode_1 L 16 15 CRn 12 11 Rd 8 7 5 4 1 1 1 1 opcode_2 1 3 0 CRm Figure 2-1 CP15 MRC and MCR bit pattern 2-4 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A System Coprocessor Programmer's Model The assembler for these instructions is: MCR{cond} P15,opcode_1,Rd,CRn,CRm,opcode_2 MRC{cond} P15,opcode_1,Rd,CRn,CRm,opcode_2 Other CP15 instructions (CDP, LDC,and STC), along with MRC and MCR instructions executed in User mode, are UNDEFINED. Any MCR or MRC instructions which is not executed in a privileged mode will take the UNDEFINED instruction trap. The CRn field of MRC and MCR instructions specifies the coprocessor register to access. The CRm field, opcode_1, and opcode_2 fields are used to specify a particular action when addressing registers. Table 2-3 shows the terms and abbreviations used throughout this chapter. Table 2-3 CP15 abbreviations Term Abbreviation Description UNPREDICTABLE UNP For Reads: The data returned when reading from this location is unpredictable. It could have any value. For Writes: Writing to this location causes unpredictable behavior, or an unpredictable change in device configuration. UNDEFINED UND An instruction that accesses CP15 in the manner indicated takes the undefined instruction trap. SHOULD BE ZERO SBZ When writing to this location, all bits of this field should be 0. SHOULD BE ONE SBO When writing to this location, all bits in this field should be 1. In all cases, reading from, or writing any data values to any CP15 registers, including those fields specified as UNPREDICTABLE, SHOULD BE ONE, or SHOULD BE ZERO will not cause any physical damage to the chip. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 2-5 System Coprocessor Programmer's Model 2.3 Register descriptions The following registers are described in this section: · ID and cache information register r0 on page 2-6 · Control register r1 on page 2-9 · Translation table base register r2 on page 2-11 · Domain access control register r3 on page 2-12 · Register 4 on page 2-13 · Fault status register r5 on page 2-13 · Fault address register r6 on page 2-14 · Cache operations register r7 on page 2-15 · TLB operations register r8 on page 2-18 · Cache lockdown register r9 on page 2-19 · TLB lockdown register r10 on page 2-21 · Register 11 on page 2-22 · Process ID register r13 on page 2-23 · Register 14 on page 2-25 · Test configuration register r15 on page 2-25. 2.3.1 ID and cache information register r0 Register 0 is the ID register and cache information register. Reading from this register returns the device ID or the ICache and DCache sizes and line lengths of the device, depending on the value of opcode_2 used. The CRm fields should be zero when reading: opcode_2 = 0 opcode_2 = 1 Gives the ID value 0x4104A20r, where r is the revision. Gives the instruction and data cache parameter value 0x0D1B21B2. 2-6 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A System Coprocessor Programmer's Model The CRm fields should be zero when reading from this register. Table 2-4 shows the instructions for reading register 0. Table 2-4 Reading from register 0 Function Data Instruction Read ID ARM1020T ARM1020T Device ID MRC p15,0,Rd,c0,c0,0 Read cache information I and DCache type MRC p15,0,Rd,c0,c0,1 Writing to register 0 is UNPREDICTABLE. Register 0 read device ID Figure 2-2 shows the bit field settings for reading details of the device type. 31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 1 0 0 1 0 0 1 0 0 0 0 0 0 Revision Figure 2-2 Read device ID bit fields Table 2-5 gives the meanings of the read device ID bit fields in r0. Table 2-5 Bit fields for register 0 Bits Meaning Bits [31:24] Contain the ASCII code of implementers trademark, 0x41 = ARM Bits [19:16] Contain the architecture, 0x04 = version 5T Bits [15:4] Contain the 3-digit part number, 0xA20 Bits [3:0] Contain the revision number for the processor Read cache information Figure 2-3 shows the bit settings for reading details of the cache parameters. 31 29 28 reserved 25 24 23 class 21 20 18 17 15 14 13 12 11 9 8 6 H reserved D Cache associa- R length reserved ICache size tivity 5 3 2 1 0 associa- R length tivity Figure 2-3 Register 0 read cache type ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 2-7 System Coprocessor Programmer's Model The meanings of the bit settings are explained in Table 2-6. Table 2-6 Register 0 bit definitions Bits Value Notes Bits [31:29] Reserved 000 - Bits [28:25] Cache class 0110 Cache-clean-step operation Cache-flush-step operation Lock-down facilities Bit 24 Harvard architecture 1 - Bits [23:21] Reserved 000 - Bits [20:18] Data cache sizes 000 512kBytes Bits [20:18] Data cache sizes 001 1KB Bits [20:18] Data cache sizes 010 2KB Bits [20:18] Data cache sizes 011 4KB Bits [20:18] Data cache sizes 100 8KB Bits [20:18] Data cache sizes 101 16KB Bits [20:18] Data cache sizes 110 32KB Bits [20:18] Data cache sizes 111 64KB Bits [17:15] Data cache associativity 000 Direct-mapped Bits [17:15] Data cache associativity 001 2-way associative Bits [17:15] Data cache associativity 010 4-way associative Bits [17:15] Data cache associativity 011 8-way associative Bits [17:15] Data cache associativity 100 16-way associative Bits [17:15] Data cache associativity 101 32-way associative Bits [17:15] Data cache associativity 110 64-way associative Bits [17:15] Data cache associativity 111 128-way associative Bit 14 Reserved 0 - Bits [13:12] Data cache line length 00 2 words per line Bits [13:12] 2-8 Meaning Data cache line length 01 4 words per line Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A System Coprocessor Programmer's Model Table 2-6 Register 0 bit definitions (continued) Bits Value Notes Bits [13:12] Data cache line length 10 8 words per line Bits [13:12] Data cache line length 11 16 words per line Bits [11:9] Reserved 000 - Bits [8:6] Instruction cache size 110 32KB Bits [5:3] Instruction cache associativity 110 64-way set associative Bit 2 Reserved 0 - Bits[1:0] 2.3.2 Meaning Instruction cache line length 10 8 words per line Control register r1 Register r1 is the control register. This register specifies the configuration used to enable and disable the caches and MMU. It is recommended that this register is accessed using a read-modify-write sequence. For both reading and writing the CRm and opcode_2 fields should be zero. Table 2-7 shows the instructions used for reading and writing register 1. Table 2-7 Accessing register 1 Function Data Instruction Read configuration Configuration data MRC p15,0,Rd,c1,c0,0 Write configuration Configuration data MCR p15,0,Rd,c1,c0,0 All defined control bits are set to zero on RESET except: · · ARM DDI 0135A The V Bit which is set to zero at Reset if the HIVECSINIT signal is LOW, or one if the HIVECSINIT signal is HIGH. The B Bit is set to zero at Reset if the BIGENDINIT signal is LOW, or one if the BIGENDINIT signal is HIGH. Copyright © ARM Limited 2000. All rights reserved. 2-9 System Coprocessor Programmer's Model The control bits have the functions detailed in Table 2-8. Figure 2-4 shows the bit settings for the control register. 31 15 14 13 12 11 10 9 SBZ LT RR V I 8 7 6 5 4 3 2 1 0 Z 0 R S B 1 1 1 1 C A M Figure 2-4 Control register bit settings Table 2-8 sets out the functions of the control bits in full. Table 2-8 Control bit functions register 1 Bit Function [31:16] - When read returns an unpredictable value. When written should be zero, or a value read from bits [31:16] on the same processor. Using a read-modify-write sequence when modifying this register provides the greatest future compatibility. Bit 15 LT bit LDR to PC sets T bit. Bit 14 RR bit Replacement strategy for ICache and DCache: 0 = Random replacement 1 = Round robin replacement. Bit 13 V bit Location of exception vectors: 0 = Low Addresses = 0x0000 0000 1 = High Addresses = 0xFFFF 0000. Bit 12 I bit Instruction cache enable/disable: 0 = Instruction cache disabled 1 = Instruction cache enabled. Bit 11 Z bit Branch prediction: 0 = branch prediction disabled 1 = branch prediction enabled. Bit 10 - SBZ Bit 9 R bit ROM protection. This bit modifies the ROM protection system. Bit 8 2-10 Name S bit System protection. This bit modifies the MMU protection system: 0 = MMU protection disabled 1 = MMU protection enabled. Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A System Coprocessor Programmer's Model Table 2-8 Control bit functions register 1 (continued) Bit Endianness: 0 = Little-endian operation 1 = Big-endian operation. - When read returns one and when written Should Be One (SBO). Bit 2 C bit Data cache enable/disable: 0 = Data cache disabled 1 = Data cache enabled. Bit 1 A bit Alignment Fault enable/disable: 0 = Data Address Alignment Fault Checking disabled 1 = Data Address Alignment Fault Checking enabled. Bit 0 2.3.3 B bit Bits[6:3] · Function Bit 7 · Name M bit MMU enable/disable, both IMMU and DMMU: 0 = Memory Management Unit (MMU) disabled 1 = Memory Management Unit (MMU) enabled. Note Take care with the address mapping of the code sequence used to enable the MMU (see Enabling the MMU on page 3-30). See Data cache and write buffer enable/disable on page 4-6 for restrictions and effects of having caches enabled with the MMU disabled. Translation table base register r2 Register r2 is the Translation Table Base (TTB) register, for the base address of the first-level translation table. Reading from r2 returns the pointer to the first-level translation table in bits[31:14] and an UNPREDICTABLE value in bits[13:0]. The CRm field should be zero when reading r2. Writing to r2 updates the pointer to the first-level translation table from the value in bits[31:14] of the written value. Bits[13:0] should be zero. The CRm and opcode_2 fields should be zero when writing r2. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 2-11 System Coprocessor Programmer's Model Table 2-9 shows the instructions used for reading and writing register 2. Table 2-9 Accessing register 2 Function Data Instruction Read TTB TTB address MRC p15,0,Rd,c2,c0,0 Write TTB TTB address MCR p15,0,Rd,c2,c0,0 Figure 2-5 shows the location of the bits in the translation table base register. 31 14 13 0 TTB SBZ Figure 2-5 Register 2 2.3.4 Domain access control register r3 Register r3 is the domain access control register consisting of sixteen discrete 2-bit fields, each of which defines the access permissions for one of the sixteen domains (D15-D0 D15-D0). Reading from r3 returns the value of the domain access control register. Writing to r3 writes the value of domain access control register. Table 2-10 shows the instructions needed for accessing r3. The CRm and opcode_2 fields are ignored and should be zero. Table 2-10 Reading from register 3 Function Data Instruction Read register 3 Domain 15 to 0 data MRC p15,0,Rd,c3,c0,0 Write register 3 Domain 15 to 0 data MCR p15,0,Rd,c3,c0,0 Figure 2-6 shows the two-bit domain access permission fields of register 3. 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 D15 D14 D13 D12 D11 D10 D9 D8 D7 D6 D5 8 D4 7 6 D3 5 4 D2 3 2 D1 1 0 D0 Figure 2-6 Register 3 2-12 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A System Coprocessor Programmer's Model The encoding of the two-bit domain access permission field is given in Table 3-5 on page 3-18. 2.3.5 Register 4 Accessing (reading or writing) this register is UNDEFINED. 2.3.6 Fault status register r5 Register r5 is the Fault Status Register (FSR). The FSR contains the source of the last data fault. The FSR indicates the domain and type of access being attempted when an abort occurred. Table 2-11 shows the bit fields for the FSR. Table 2-11 FSR bits Bits Meaning Bits [31:10] UNP Bit [9] Watchpoint occurred Bit [8] Always read as zero Bits [7:4] Specifies which of the 16 domains (D15-D0 D15-D0) was being accessed when a fault occurred Bits[3:0] Type of fault generated (see Fault address and fault status registers on page 3-27) The encoding of these bits is shown in Fault address and fault status registers on page 3-27. The FSR is only updated for data faults, not for prefetch instruction faults. Reading r5 returns the value of the FSR. Writing r5 sets the FSR to the value of the data written. This is useful for a debugger to restore the value of the FSR. The register should be written using a read-modify-write sequence. Bits[31:10] should be zero. The CRm and opcode_2 fields should be zero when reading or writing CP15 r5. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 2-13 System Coprocessor Programmer's Model Table 2-12 shows the instructions used to access the FSR. Table 2-12 Accessing the FSR register 5 Function Data Instruction Read FSR FSR data MRC p15,0,Rd,c5,c0,0 Write FSR FSR data MCR p15,0,Rd,c5,c0,0 Figure 2-7 shows the location of the domain and status bits in register 5. 31 10 9 UNP/SBZ 8 7 WP 0 4 Domain 3 0 Fault number Figure 2-7 Register 5 2.3.7 Fault address register r6 Register 6 is the Fault Address Registers (FAR) which holds the virtual address of the access which was attempted when a fault occurred. The DFAR is updated for data faults. The IFAR is updated for breakpoints. Reading register 6 returns the value of an FAR, either the Data FAR or Instruction FAR as specified by the opcode_2 value. Writing register 6 sets an FAR to the value of the data written. This is useful for a debugger to restore the value of an FAR. The CRm and opcode_2 fields should be zero when reading or writing CP15 r6. Table 2-13 shows the instructions needed to access the FAR. Table 2-13 Accessing the FAR register 6 Function Instruction Read Data FAR FAR data MRC p15,0,Rd,c6,c0,0 Write Data FAR FAR data MCR p15,0,Rd,c6,c0,0 Read Instruction FAR FAR data MRC p15,0,Rd,c6,c0,1 Write Instruction FAR 2-14 Data FAR data MCR p15,0,Rd,c6,c0,1 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A System Coprocessor Programmer's Model Figure 2-8 shows the FAR addresses in register 6. 31 0 Fault address Figure 2-8 Register 6 2.3.8 Cache operations register r7 Register r7 is a write-only register used to manage ICache and DCache. Note Dirty data is data that has been modified in the cache but not yet copied back to main memory. Cache operations are shown in Table 2-14. Table 2-14 Function descriptions register 7 Function Description Invalidate cache Invalidates all cache data, including any dirty data. Use with caution. Invalidate single entry using Virtual Address Invalidates a single cache line, including any dirty data. Use with caution. Clean D single entry using either Index or Virtual Address Writes the specified cache line to main memory if the line is marked valid and dirty (and is from a writeback memory region) and marks the line as not dirty. The valid bit is unchanged. Clean and Invalidate D entry using either Index or Virtual Address Writes the specified cache line to main memory if the line is marked valid and dirty, and is from a writeback memory region. The line is marked not valid. Prefetch cache line Performs an ICache lookup of the specified address. If the cache misses, and the region is cachable, a linefill is performed. The function of each cache operation is selected by the opcode_2 and CRm fields in the MCR instruction used to write CP15 register 7. Writing other opcode_2 or CRm values is UNPREDICTABLE. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 2-15 System Coprocessor Programmer's Model Reading from CP15 register 7 is UNPREDICTABLE. Table 2-15 lists the cache operation functions and the associated data and instruction formats for register 7. Table 2-15 Cache instructions register 7 Function Instruction Invalidate caches SBZ MCR p15,0,Rd,c7,c7,0 Invalidate ICache SBZ MCR p15,0,Rd,c7,c5,0 Invalidate I single entry (using VA) VA MCR p15,0,Rd,c7,c5,1 Prefetch ICache line VA MCR p15,0,Rd,c7,c13,1 Invalidate DCache SBZ MCR p15,0,Rd,c7,c6,0 Invalidate D single entry (using VA) VA MCR p15,0,Rd,c7,c6,1 Clean D single entry (using VA) VA MCR p15,0,Rd,c7,c10,1 Clean and Invalidate D entry (using VA) VA MCR p15,0,Rd,c7,c14,1 Clean D single entry (using index) Index, Segment Format MCR p15,0,Rd,c7,c10,2 Clean and invalidate D entry (using index) Index, Segment Format MCR p15,0,Rd,c7,c14,2 Drain write buffer SBZ MCR p15, 0,Rd,c7,c10,4 Wait for interrupt 2-16 Data SBZ MCR p15,0,Rd,c7,c0,4 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A System Coprocessor Programmer's Model Index cache operations Table 2-16 shows the bit fields for cache operations and their meanings. Table 2-16 Bit fields for index cache operations Bit fields Meaning Bits [31:26] Index in segment being accessed Bits [25:9] SBZ Bits [8:5] Segment being accessed (Sg) Bits [4:3] 64-bit double word being accessed (Wd) Bits [2:0] SBZ The operations that act on a single cache line identify the line using the contents of Rd as the address, passed in the MCR instruction. The data is interpreted using the formats shown in Figure 2-9, and Figure 2-10 on page 2-18. 31 26 25 Index 9 SBZ 8 5 Sg 4 3 Wd 2 0 SBZ Figure 2-9 Register 7 index tag format The index tag format of Figure 2-9 is used when a specific line in the cache needs to be accessed. Example 2-1 is an example using the command Clean D single entry (using index). Example 2-1 Clean D single entry (using index) ;code is specific to ARM1020T ARM1020T with 32KB caches MOV R0, #0:SHL:5 seg_loop MOV R1, #0:SHL:26 line_loop ORR R2,R1,R0 MCR p15,0,R2,c7,c10,2 ADD R1,R1,#1:SHL:26 CMP R1,#0 ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 2-17 System Coprocessor Programmer's Model BNE line_loop ADD R0,R0,#1:SHL:5 CMP R0,#1:SHL:9 BNE seg_loop Virtual Address (VA) format The VA format is useful for flushing a particular address or range of addresses in the caches. Figure 2-10 shows the virtual address format. 31 26 25 9 Virtual CAM tag 8 5 Sg 4 3 2 Wd 0 SBZ Figure 2-10 Register 7 virtual address format Table 2-17 expands the abbreviations in the bit fields of Figure 2-10. Table 2-17 Bit fields for VA cache operations Bit fields Bits [31:9] Virtual Content Addressable Memory (CAM) tag Bits [8:5] Segment being accessed Bits [4:3] 64-bit double word being accessed Bits [2:0] 2.3.9 Meaning SBZ TLB operations register r8 Register 8 is a write-only register used to manage the Translation Lookaside Buffers (TLBs), the Instruction TLB, and the Data TLB. The TLB operations listed in Table 2-18 are defined and the function to be performed is selected by the opcode_2 and CRm fields in the MCR instruction used to write CP15 register 8. Writing other opcode_2 or CRm values is UNPREDICTABLE. 2-18 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A System Coprocessor Programmer's Model Reading from CP15 register 8 is UNPREDICTABLE. Table 2-18 TLB instructions register 8 Function Data Instruction Invalidate I and D TLB(s) SBZ MCR p15,0,Rd,c8,c7,0 Invalidate I TLB SBZ MCR p15,0,Rd,c8,c5,0 Invalidate I TLB single entry (using VA) Virtual address MCR p15,0,Rd,c8,c5,1 Invalidate D TLB SBZ MCR p15,0,Rd,c8,c6,0 Invalidate D TLB single entry (using VA) Virtual address MCR p15,0,Rd,c8,c6,1 Note Invalidating the full TLB invalidates all the unlocked entries in the TLB. Invalidating TLB single entry functions invalidates any TLB entry corresponding to the virtual address given in Rd, regardless of its locked state (see TLB lockdown register r10 on page 2-21). Figure 2-11 shows the virtual address format for register 8. 31 5 Virtual CAM tag 4 0 SBZ Figure 2-11 Register 8 virtual address tag format 2.3.10 Cache lockdown register r9 Register r9 is the cache lockdown register. The cache lockdown register is set to 0 at Reset. The cache lockdown register allows software to: · · ARM DDI 0135A control which cache line in the ICache or DCache respectively is loaded for a linefill by changing base and victim counter values prevent lines in the ICache or DCache from being replaced during a linefill, locking them into the cache. Copyright © ARM Limited 2000. All rights reserved. 2-19 System Coprocessor Programmer's Model Reading CP15 r9 returns the value of the cache lockdown register, which is the base pointer for all cache segments. Note Only bits [31:26] are returned. Bits [25:0] are zero. Writing CP15 register 9 updates the cache lockdown register, both the base and the current victim counter value, for all cache segments. Bits [25:0] should be zero. The victim counter specifies the cache line to be used as the victim for the next linefill. The counter is incremented using either a random or round-robin replacement policy, determined by the state of the RR bit in CP15 r1. The victim counter generates values in the range (base to 63). This locks lines with index values in the range (0 to base-1), with an upper limit of 62 locked entries in the DCache. If base = 0 there are no locked lines. Writing to CP15 register 9 updates the base pointer and the current victim counter, so the next linefill will use the victim counter value, then increment the victim counter. The victim counter continues incrementing on linefills and wraps around to the base pointer. For example, setting the base pointer to 0x3 prevents the victim counter from selecting entries 0x0 to 0x2, locking them into the cache. Example 2-2 shows how to load a single entry into line 0 and lock it down. Example 2-2 Updating the cache lockdown register, base pointer, and current victim pointer MCR to CP15 register 9, Victim=Base=0x0 MCR to cause an I prefetch, LDR/LDM, depending on whether it is ICache or DCache. Assuming the appropriate cache misses, a linefill will occur to line 0. MCR to CP15 register 9, Victim=Base=0x1 Further linefills will now occur into lines 1-63. Figure 2-12 shows the format for writing the base pointer and current victim pointer in the caches. 31 26 25 Lockdown base 0 UNP/SBZ Figure 2-12 Register 9 2-20 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A System Coprocessor Programmer's Model Table 2-19 shows the instructions used to access the cache lockdown register. Table 2-19 Accessing the cache lockdown register 9 Function Instruction Read DCache lockdown base Base MRC p15,0,Rd, c9,c0,0 Write DCache victim and lockdown base Victim = base MCR p15,0,Rd, c9,c0,0 Read ICache lockdown base Base MRC p15,0,Rd, c9,c0,1 Write ICache victim and lockdown base 2.3.11 Data Victim = base MCR p15,0,Rd, c9,c0,1 TLB lockdown register r10 Register r10 is the TLB lockdown register. The TLB lockdown register is set to 0 at Reset. There is a TLB lockdown register for each TLB. Reading CP15 r10 returns the value of the TLB lockdown counter base register, the current victim counter value and the preserve bit. Note that bits [19:1] are UNPREDICTABLE when read. Writing CP15 register 10 updates the TLB lockdown counter base register, the current victim counter value and the state of the preserve bit. Bits [19:1] should be zero when written. Table 2-20 shows the instructions needed to access the TLB lockdown register. Table 2-20 Accessing the TLB lockdown register 10 Function Data Instruction Read D TLB lockdown TLB lockdown MRC p15,0,Rd,c10,c0,0 Write D TLB lockdown TLB lockdown MCR p15,0,Rd,c10,c0,0 Read I TLB lockdown TLB lockdown MRC p15,0,Rd,c10,c0,1 Write I TLB lockdown TLB lockdown MCR p15,0,Rd,c10,c0,1 Figure 2-13 shows the bit fields in register r10. 31 26 25 Base value 20 19 Current victim 1 SBZ/UNP 0 P Figure 2-13 Register 10 bit fields ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 2-21 System Coprocessor Programmer's Model The entries in the TLBs are replaced using a round-robin replacement policy. This is implemented using a victim counter which counts from entry 0 up to 63 and then wraps back round to the base value and continues counting, wrapping back to the base value from 63 each time. There are two mechanisms available you can use to ensure entries are not removed from the TLB: · Locking an entry down prevents it from being selected for overwriting during a table walk. This is achieved by programming the base value to which the victim counter reloads. For example, if the bottom 3 entries (0-2) are to be locked down, the base counter should be programmed to 3. · An entry can also be preserved during an Invalidate All instruction. This is done by ensuring the P (Preserve) bit is set when the entry is loaded into the TLB. Example 2-3 shows how to load a single entry into location 0, make it immune to Invalidate All and lock it down. Example 2-3 Ensuring an entry is not removed from the TLB MCR to CP15 register 10, Base Value = 0, Current Victim = 0, Preserve = `1' MCR to cause prefetch, assuming a miss occurs in the TLB then entry 0 will be loaded. MCR to CP15 register 10, Base Value = 1, Current Victim = 1, Preserve = `0' 2.3.12 Register 11 Accessing (reading or writing) any of this register takes the UNDEFINED instruction trap. 2.3.13 Registers 12 Register 12 is the PLL control register. For details of PLL control refer to ARM 10200 (Rev 0) Test Chip Implementation Guide. 2-22 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A System Coprocessor Programmer's Model 2.3.14 Process ID register r13 Register r13 is the process identifier. The process identifier is set to 0 at Reset. Reading from CP15 r13 returns the value of the process identifier. Writing CP15 r13 updates the process identifier to the value in bits[31:25]. Bits [24:0] should be zero as shown in Figure 2-14. 31 25 24 0 Proc ID SBZ Figure 2-14 Register 13 bit fields Table 2-21 shows the instructions used to access the process identifier register r13. Table 2-21 Accessing the process identifier register r13 Function Data Instruction Read process identifier Process identifier MRC p15,0,Rd,c13,c0,0 Write process identifier Process identifier MCR p15,0,Rd,c13,c0,0 Using the process identifier (ProcID) Addresses issued by the ARM10TDMI ARM10TDMI in the range 0 to 32MB are translated by the ProcID. Address A becomes A + (ProcID x 32MB). This translated address is used by both the caches and MMU. Addresses above 32MB are not translated. This is shown in Figure 2-15 on page 2-24. The ProcID is a seven-bit field, enabling 64 x 32MB processes to be mapped. Note If ProcID is zero, as it is on Reset, then there is a flat mapping between the ARM10TDMI ARM10TDMI and the caches and MMU. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 2-23 System Coprocessor Programmer's Model Address issued by ARM10TDMI ARM10TDMI Address input to caches and MMU 4G ProcID No 63 4G ProcID No 2 64MB 32M ProcID No 1 32MB 0 ProcID No 0 0 Figure 2-15 Address mapping using CP15 register 13 Changing the ProcID, performing a fast context switch A fast context switch is performed by writing to CP15 r13. The contents of the caches and TLBs do not have to be flushed after a fast context switch because they still hold valid address tags. From two up to five instructions after the MCR used to write the ProcID may have been fetched with the old ProcID: {ProcID = 0} MOV r0, #1 ; Fetched with ProcID = 0 MCR p15,0,r0,c13,c0,0 ; Fetched with ProcID = 0 A0 (any instruction) ; Fetched with ProcID = 0 A2 (any instruction) ; Fetched with ProcID = 0/1 A3 (any instruction) ; Fetched with ProcID = 0/1 A4 (any instruction) ; Fetched with ProcID = 0/1 A5 2-24 (any instruction) ; Fetched with ProcID = 0 A1 (any instruction) ; Fetched with ProcID = 1 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A System Coprocessor Programmer's Model 2.3.15 Register 14 Accessing (reading or writing) this register is UNDEFINED. 2.3.16 Test configuration register r15 Register r15 is used for test purposes. Reading or writing this register under normal operating conditions is UNPREDICTABLE. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 2-25 System Coprocessor Programmer's Model 2-26 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A Chapter 3 Memory Management Unit This chapter describes the Memory Management Unit (MMU). It contains the following sections: · About the MMU on page 3-2 · MMU software-accessible registers on page 3-3 · Address translation on page 3-5 · MMU descriptors on page 3-8 · MMU memory access control on page 3-18 · MMU cachable and bufferable information on page 3-20 · MMU aborts on page 3-21 · MMU fault checking sequence on page 3-22 · MMU and write buffer on page 3-26 · MMU faults and CPU aborts on page 3-27 · Fault address and fault status registers on page 3-27 · External aborts on page 3-29 · Interaction of the MMU, caches, and write buffer on page 3-30. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 3-1 Memory Management Unit 3.1 About the MMU The ARM1020T ARM1020T MMUs work with the cache memory system to control accesses to and from external memory. The MMUs also control the translation of virtual addresses to physical addresses. ARM1020T ARM1020T implements an enhanced ARMv5 MMU to provide address translation and access permission checks for the instruction and data ports of the ARM10TDMI ARM10TDMI. The MMU controls table-walking hardware which accesses translation tables in main memory. A single set of two-level page tables stored in main memory controls the contents of the instruction and data side Translation Lookaside Buffers (TLBs). The finished Virtual Address to Physical Address translation is put into the TLB. The TLBs are enabled from a single bit in CP15 Register 1, providing a single address translation and protection scheme from software. The MMU features are: · · mapping sizes are 1KB, 4KB, 64KB, and 1MB · the access permissions for 1MB sections are specified for the entire section · access permissions for 64KB large pages and 4KB small pages can be specified separately for each quarter of the page (these quarters are called subpages) · 16 domains · two 64-entry instruction and data TLBs · independent lockdown of instruction TLB and data TLB · hardware page table walks · 3-2 standard ARMv5 MMU mapping sizes, domains, and access protection scheme round-robin replacement algorithm. Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A Memory Management Unit 3.2 MMU software-accessible registers The system control coprocessor (CP15) registers shown in Table 3-1, in conjunction with page table descriptors stored in memory, control the operation of the MMUs. Table 3-1 CP15 register functions Register Number Bits Register description Control register CP15 1 M, A, S, R M bit, Bit 0, MMU enable/disable: 0 = MMU disabled 1 = MMU enabled. A bit, Bit 1, Alignment fault enable/disable: 0 = Address alignment fault checking disabled 1 = Address alignment fault checking enabled. S bit, bit 8, System protection bit. R bit, bit 9, ROM protection. Translation table base register 2 [31:14] Holds the physical address of the base of the translation table maintained in main memory. This base must reside on a 16KB boundary and is common to both MMUs. Domain access control register 3 [31:0] Comprises 16 2-bit fields. Each field defines the access control attributes for one of 16 domains (D15­D0). Fault status register 5 [9:0] Indicates the cause of a data abort and the domain number of the aborted access, when a data abort occurs. Bit 9 indicates a watchpoint occurred. Bit 8 SBZ. Bits 7:4 specify which of the 16 domains (D15­D0) was being accessed when a fault occurred. Bits 3:0 indicate the type of access being attempted. The value of all other bits is UNPREDICTABLE. The encoding of these bits is shown in Table 3-8 on page 3-28. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 3-3 Memory Management Unit Table 3-1 CP15 register functions (continued) Register Number Bits Register description Fault address register (FAR) 6 [31: 0] Holds the virtual address associated with the access that caused the data abort. See 2.3.7 on page 2-14 for instructions needed to address the FAR. See Table 3-8 on page 3-28 for details of the address stored for each type of fault. Register r14 can be used to determine the virtual address associated with a Prefetch Abort. TLB operations register 8 [31:5] Writing to this register causes the MMU to perform TLB maintenance operations. This either invalidates all the (unpreserved) entries in a TLB, or invalidates a specific entry. TLB lock down register 10 [31:20], [0] Allows specific page table entries to be locked into a TLB and the TLB victim counter to be read/written. Locking entries in a TLB guarantees that accesses to the locked page or section can proceed without incurring the time penalty of a TLB miss. This allows the execution latency for time-critical pieces of code such as interrupt handlers to be minimized. Note All the CP15 MMU registers, except r7 and r8, contain state and can be read using MRC instructions and written to using MCR instructions. Registers r5 and r6 are also written by the MMU. Reading register 8 is UNPREDICTABLE. 3.2.1 Access permissions For 4KB small and 64KB large pages, access permissions are defined for each subpage (1KB for small pages, 16KB for large pages). 1MB sections and 1KB tiny pages have a single set of access permissions. 3-4 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A Memory Management Unit 3.3 Address translation The address translation process is used to fetch a TLB entry from the page tables in main memory. It is activated when the TLB does not contain the mapping for a particular virtual address, causing a TLB miss. 3.3.1 TLBs Each TLB caches 64 translated entries. During CPU memory accesses, the TLB provides protection information to the access control unit. If the TLB contains a translated entry for the virtual address, the access control unit determines whether access is permitted: · If access is permitted and an off-chip access is required, the MMU outputs the appropriate physical address corresponding to the virtual address. · If access is permitted and an off-chip access is not required, the cache services the access. · If access is not permitted, the MMU signals the CPU to abort. If a TLB misses, the translation table walk hardware is invoked to retrieve the translation information from a translation table in main memory. Once retrieved, the translation information is written into the TLB, possibly overwriting an existing value. The entry to be written is normally chosen by cycling sequentially through the TLB locations. To enable use of TLB locking features, the location to be written can be specified using CP15 register 10 TLB lockdown. When the MMU is turned off (as happens at Reset), no address mapping occurs and all regions are marked as noncachable and nonbufferable. 3.3.2 Translation routes for sections and pages The MMU translates virtual addresses from the ARM10 ARM10 integer unit to physical addresses for an external memory access (see Figure 3-1 on page 3-6). The MMU in the ARM1020T ARM1020T supports multiple memory block sizes. There are several ways that a virtual address is translated to a physical address. The two types of memory blocks, sections and pages, require a specific translation process to occur. The route taken depends on the how the address was marked in the page tables, as a section or a page. A section requires only a Level 1 descriptor fetch. A page requires both a Level 1 and Level 2 descriptor fetch. The memory translation process begins with the TTB address (CP15 r2) and the virtual memory address. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 3-5 Memory Management Unit Figure 3-1 Section and page translation overview 3-6 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A Memory Management Unit Figure 3-1 shows the translation process. The Translation Table Base Address (TTBA) points to the table in memory which contains the Level 1 descriptor entries. This table is a 16KB memory block with 4096 32-bit entries. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 3-7 Memory Management Unit 3.4 MMU descriptors To support sections and pages the ARM1020T ARM1020T MMU uses a two-level descriptor definition. The Level 1 descriptor indicates whether the access is to a section or to a page table. If the access is to a page table, the ARM1020T ARM1020T MMU determines the page table type, coarse or fine, and fetches a Level 2 descriptor. The Level 1 descriptor indicates that an access is to a section or a reference to a page table. The access type can be determined by examining bits [1:0] of the Level 1 descriptor. Figure 3-2 shows how the access type is determined. 31 12 1110 9 8 20 19 5 4 3 21 0 00 Translation fault Coarse page table Coarse level 2 descriptor base address Section (1M) Section base address Fine page table Fine level 2 descriptor base address Domain 1 0 1 selector Domain 1 CB 10 selector Domain 1 11 selector Figure 3-2 Level 1 descriptor formats Fine page tables are used to hold large, small and tiny pages. Coarse page tables can only hold large and small pages. A coarse page table holds 256 32-bit entries 4KB in size. A fine page table holds 1024 32-bit entries 1KB in size. When bits[1:0] of the Level 1 descriptor are set to 01 this indicates memory access is to a coarse page. When bits[1:0] of the Level 1 descriptor are set to 11 this indicates memory access is to a fine page. In both 01 and 11 cases a Level 2 descriptor is required to determine the page type. Figure 3-3 shows how page types are determined. 31 1615 Translation fault 12 11 10 9 8 7 6 5 4 3 2 1 0 00 Large page (64K) Large page base address AP3 AP2 AP1 AP0 C B 0 1 Small page (4K) Small page base address AP3 AP2 AP1 AP0 C B 1 0 Tiny page (1K) Tiny page base address AP C B 1 1 Figure 3-3 Level 2 descriptor formats By examining bits[1:0] of the Level 2 descriptor the page type can be determined. For large and small pages, there can be four subpages defined with different access permissions. For a large page, the subpage size is 16KB and is accessed via bits [15:14] of the page index of the virtual address. For a small page, the subpage size is 1KB and is accessed via bits [11:10] of the page index of the virtual address. 3-8 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A Memory Management Unit 3.4.1 MMU table-walking process A table walk occurs whenever there is a TLB miss. If the data MMU is performing an external memory operation for the ARM1020T ARM1020T load/store unit, the write buffer is flushed before the table walk. This guarantees that memory remains coherent. The MMU then performs the operation as noncachable and nonbufferable. The write buffer is not flushed before an instruction TLB table walk. The table walk begins with the formation of a Level 1 descriptor. 3.4.2 Level 1 descriptor address The CP15 register 2 TTBA and the virtual address from the ARM10 ARM10 integer unit are used to create the Level 1 descriptor address. Figure 3-4 shows the relationship between the translation table base, the virtual address and the Level 1 descriptor address. 0 1413 31 Translation table base Translation base 31 Virtual address 31 Level 1 descriptor address 2019 1413 Translation base 0 First level table index 2 1 0 First level table index 0 0 Figure 3-4 Creating a Level 1 descriptor address 3.4.3 Level 1 descriptor Using the Level 1 descriptor address, a request is made to external memory. This returns the Level 1 descriptor. By examining bits [1:0] of the Level 1 descriptor, the access type is indicated as shown in Table 3-2. Table 3-2 Access types from Level 1 descriptor bit values Bit values 00 Translation fault 01 Coarse page table base address 10 Section base address 11 ARM DDI 0135A Access type Fine page table base address Copyright © ARM Limited 2000. All rights reserved. 3-9 Memory Management Unit 3.4.4 Level 1 translation fault If bits [1:0] of the Level 1 descriptor are 00, a translation fault is generated. This will cause either a Prefetch Abort or Data Abort in the ARM10TDMI ARM10TDMI integer unit. A Prefetch Abort will occur in the instruction MMU. A Data Abort will occur in the data MMU. 3.4.5 Level 1 coarse page table address If bits [1:0] of the Level 1 descriptor are 01, then a coarse page table walk is required. This process is described in Level 2 coarse page table walk on page 3-11. 3.4.6 Level 1 section base address If bits [1:0] of the Level 1 descriptor are 10, a request to a section memory block has occurred. Figure 3-5 shows the translation process for a 1MB section. Figure 3-5 Translation for a 1MB section Following the Level 1 descriptor translation, the physical address is used to transfer to and from external memory the data requested from and to the ARM10TDMI ARM10TDMI integer unit. This is done only after the domain and access permission checks are performed on the Level 1 descriptor for the section. These checks are described in MMU memory access control on page 3-18. 3.4.7 Level 1 fine page table base address If bits [1:0] of the Level 1 descriptor are 11, then a fine page table walk is required. This is described in Level 2 fine page table walk on page 3-14. 3-10 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A Memory Management Unit 3.4.8 Level 2 coarse page table walk When the Level 1 descriptor bits [1:0] indicate a coarse page table walk is required, the MMU requests the Level 2 coarse page table address from external memory. Figure 3-6 shows how the address is generated. 31 Translation table base 1413 0 Translation base 31 Virtual address 1413 31 Level 1 descriptor address Translation base Level 1 fetch 2019 Page table base address 31 Level 2 descriptor address 0 2 1 0 First level table index 31 Level 1 descriptor 1211 Second level table index First level table index 0 0 10 9 8 5 4 3 2 1 0 Domain Domain 1 0 1 Selector selector 10 9 2 1 0 Second level table index Page table base address 0 0 Figure 3-6 Generating a Level 2 coarse page table address When the coarse page table address is generated, a request is made to external memory for the Level 2 coarse descriptor. By examining bits [1:0] of the Level 2 coarse descriptor, the access type is indicated as shown in Table 3-3. Table 3-3 Access types from Level 2 descriptor bit values Bit values 00 Translation fault 01 64KB 10 A 4KB small page base address 11 3.4.9 Access type UNPREDICTABLE Level 2 coarse translation fault If bits [1:0] of the Level 2 coarse descriptor are 00, then a translation fault is generated. This will generate an abort to the ARM10 ARM10 integer unit, either a Prefetch Abort for the instruction side or a Data Abort for the data side. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 3-11 Memory Management Unit 3.4.10 Level 2 coarse large page base address If bits [1:0] of the Level 2 coarse descriptor are 01, then a coarse large page table walk is required. Figure 3-7 shows the translation process for a 64KB large page or a 16KB large page subpage. Figure 3-7 Large page table walk The 64KByte large page is generated by setting all of the AP bit pairs to the same values, AP3=AP2=AP1=AP0. If any one of the pairs are different, then the 64KB large page are converted into four 16KB large page subpages. The subpage access permission bits are chosen using the virtual address bits [15:14]. 3-12 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A Memory Management Unit 3.4.11 Level 2 coarse small page base address If bits [1:0] of the Level 2 Coarse Descriptor are 10, then a coarse small page table walk is required. Figure 3-8 on page 3-13 shows the translation process for a 4KB small page or a 1KB small page subpage. 31 Translation table base 1413 0 Translation base 31 Virtual address 1413 31 Level 1 descriptor address 2019 First level table index Translation base Page table base address Level 2 descriptor address 1211 0 0 10 9 8 5 4 3 2 1 0 Domain Domain 1 0 1 selector 10 9 31 Page table base address Level 2 fetch 2 1 0 Second level table index 1615 31 Page base address Level 2 descriptor Physical address 0 Page index 2 1 0 First level table index Level 1 fetch 31 Level 1 descriptor 1615 Second level table index 31 0 0 1211 10 9 8 7 6 5 4 3 2 1 0 AP3 AP2 AP1 AP0 C B 1 0 0 1211 Page base address Page index Figure 3-8 4KByte small page or 1KByte small page subpage translations The 4KB small page is generated by setting all of the AP bit pairs to the same values, AP3=AP2=AP1=AP0. If any one of the pairs are different, then the 4KB small page will be converted into four 1KB small page subpages. The subpage access permission bits are chosen using the virtual address bits [11:10]. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 3-13 Memory Management Unit 3.4.12 Level 2 fine page table walk When the Level 1 descriptor bits [1:0] indicate that a fine page table walk is required, the MMU will request from external memory the Level 2 fine page table address. Figure 3-9 on page 3-14 shows how the address is generated. Figure 3-9 Generating fine page table addresses When the fine page table address is generated, a request is made to external memory for the Level 2 fine descriptor. By examining bits [1:0] of the Level 2 fine descriptor, the access type is indicated as shown in Table 3-4. Table 3-4 Access types from Level 2 descriptor bit values Bit values 00 Translation fault 01 Large page table base address 10 Small page base address 11 3-14 Access type Tiny page table base address Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A Memory Management Unit 3.4.13 Level 2 fine translation fault If bits [1:0] of the Level 2 fine descriptor are 00, then a translation fault is generated. This causes either a Prefetch Abort or Data Abort in the ARM1020T ARM1020T integer unit. A Prefetch Abort occurs on the instruction side, while a Data Abort occurs on the data side. 3.4.14 Level 2 fine large page base address If bits [1:0] of the Level 2 Fine Descriptor are 01, then a fine large page table walk is required. Figure 3-10 shows the translation process for a 64KB large page or a 16KB large page subpage. Figure 3-10 Fine large page table walk The 64KB large page is generated by setting all of the AP bit pairs to the same values, AP3=AP2=AP1=AP0. If any one of the pairs are different, then the 64KB large page is converted into four 16KB large page subpages. The subpage access permission bits are chosen using the virtual address bits [15:14]. ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 3-15 Memory Management Unit 3.4.15 Level 2 fine small page base address If bits [1:0] of the Level 2 fine descriptor are 10, then a fine small page table walk is required. Figure 3-11 shows the translation process for a 4KB small page or a 1KB small page subpage. Figure 3-11 Fine small page table walk 3-16 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A Memory Management Unit 3.4.16 Level 2 fine tiny page base address If bits [1:0] of the Level 2 fine descriptor are 11, then a fine tiny page table walk is required. Figure 3-12 is a diagram showing the translation process for a 1KB tiny page. Figure 3-12 Translation process for tiny pages ARM DDI 0135A Copyright © ARM Limited 2000. All rights reserved. 3-17 Memory Management Unit 3.5 MMU memory access control Domains provide support for multi-user operating systems. All regions of memory have an associated domain. A domain is the primary access control mechanism for a region of memory and defines the conditions in which an access can proceed. The domain determines whether: · access permissions are used to qualify the access · access is unconditionally allowed to proceed · access is unconditionally aborted. In the latter two cases, the access permission attributes are ignored. There are 16 domains, which are configured using the domain access control register. The current domain definition provides access for two types of users, managers and clients. Each MMU, both instruction and data, accesses CP15 r3 to provide 16 2-bit programmable domains. The encoding for the domain is shown in Table 3-5. Table 3-5 Domain access encodings Domain User Notes 00 No access Access will generate a domain fault 01 Client access Access permissions are checked 10 Reserved Behaves like the No access domain 11 Manager Access permissions are not checked A manager controls the domain behavior. Therefore, each access has only to be checked to be a manager of the domain. A client is a domain user, and each access has to be checked against the access permission settings for each memory block and the system protection bit, the S bit, and the ROM protection bit, the R bit, in CP15 register 1. Table 3-6 on page 3-19 shows the access permissions. 3-18 Copyright © ARM Limited 2000. All rights reserved. ARM DDI 0135A Memory Management Unit Table 3-6 Interpreting access permission bits CP15 AP R Supervisor permissions