ARM920T Technical Reference Manual(Rev 1)
Home > Debug Support > Test data registers > Scan chains 4 and 15, the ARM920T memory system

9.6.7. Scan chains 4 and 15, the ARM920T memory system

On entry to debug state, the debugger must extract and save the state of CP15. It is advisable that the caches and MMUs are then switched off to prevent any debug accesses to memory altering their state. At this point, the debugger can non-invasively determine the state of the memory system. When in debug state, the debugger can see the state of the ARM920T memory system. This includes:

Scan chains 4 and 15 are reserved for this use.

Scan chain 15

This scan chain is 40 bits long. The format of the scan chain is dependent on the access mode used. The formats for both modes for scan chain 15 are shown in Table 9.7.

Table 9.7. Scan chain 15 format and access modes

Scan chain bit

Interpreted access mode

Physical access mode

Function

Read/write

Function

Read/write

39

0

Write

nR/W

Write

38:33

000000

Write

Register address

Write

32:1

Instruction word

Write

Register value

Read/write

0

0

Write

1

Write

With scan chain 15 selected, TDI is connected to bit 39 and TDO is connected to bit 0. An access using this scan chain allows all of the CP15 registers to be read and written, the cache CAM and RAM to be read, and the TLB CAM and RAM to be read. There are two access modes available using scan chain 15. These are:

Physical access mode

You can do a physical access mode operation using scan chain 15 as follows:

  1. In SHIFT-DR, shift in the read/write bit, register address and register value for writing, shown in Table 9.8.

  2. Move through UPDATE-DR. For a write, the register is updated here.

  3. For reading, return to SHIFT-DR through CAPTURE-DR and shift out the register value.

Table 9.8 shows the bit format for scan chain 15 physical access mode operations.

Table 9.8. Scan chain 15 physical access mode bit format

Scan chain bit

Function

Read/

write

39

nR/W

Write

38:33

Register address

Write

32:1

Register value

Read/

write

0

1

Write

The mapping of the 6-bit register address field to the CP15 registers for physical access mode is shown in Table 9.9.

Table 9.9. Physical access mapping to CP15 registers

Address

Register

[38]

[37:34]

[33]

Number

Name

Type

0

0x0

0

C0

ID register

Read

0

0x0

1

C0

Cache type

Read

0

0x1

0

C1

Control

Read/write

0

0x9

0

C9

Data cache lockdown

Read

0

0x9

1

C9

Instruction cache lockdown

Read

0

0xD

0

C13

Process ID

Read/write

0

0xF

0

C15.State

Test state

Read/write

1

0xD

1

C15.C.I.Ind

Instruction cache index

Read

1

0xE

1

C15.C.D.Ind

Data cache index

Read

1

0x1

1

C15.C.I

Instruction cache

Read/write

1

0x2

1

C15.C.D

Data cache

Read/write

1

0x5

0

C15.M.I

Instruction MMU

Read

1

0x6

0

C15.M.D

Data MMU

Read

Interpreted access mode

You can do an interpreted access mode operation using scan chain 15 as follows:

  1. A physical access read-modify-write to C15 (test state) must be done in order to set bit 0, CP15 interpret.

  2. The required MCR/MRC instruction word is shifted in to scan chain 15.

  3. A system-speed LDR (read) or STR (write) is performed on the ARM9TDMI.

  4. CP15 responds to this LDR/STR by executing the coprocessor instruction in its scan chain.

  5. In the case of a LDR, the data is returned to the ARM9TDMI and can be captured onto scan chain 1 by performing an STR.

  6. In the case of an STR, the interpreted MCR completes with the data that is issued from the ARM9TDMI.

  7. A physical access read-modify-write to C15 (test state) must be done in order to clear CP15 interpret, bit 0.

Table 9.10 shows the bit format for scan chain 15 interpreted access mode operations.

Table 9.10. Scan chain 15 interpreted access mode bit format

Scan chain bit

Function

Read/

write

39

0

Write

38:33

000000

Write

32:1

Instruction word

Write

0

0

Write

The mapping of the 32-bit instruction word field to the remaining CP15 registers supported for interpreted access mode is shown in Table 9.11, Table 9.12, and Table 9.13. This supported subset is used for cache and MMU debug operations. Using interpreted accesses for other CP15 register operations produces UNPREDICTABLE behavior. The construction of a CP15 instruction word from ARM assembler is shown in Figure 2.1.

For the MCR, Rd has been replaced by r0, because the register being used as the source data is governed by the STR. For the MRC, Rd has been replaced by r0, because the register being used as the destination is governed by the LDR.

The mapping of the 32-bit instruction word field to the remaining CP15 registers for interpreted access mode is shown in Table 9.11. The construction of a CP15 instruction word from ARM assembler is shown in CP15 register map summary.

Table 9.11. Interpreted access mapping to CP15 registers

ARM920T

instruction

FunctionRdRaCP15 instruction
STR Rd,[Ra]Write I TTBTTB-MCR p15,5,r0,c15,c1,2
LDR Rd,[Ra]Read I TTBTTB-MRC p15,5,r0,c15,c1,2
STR Rd,[Ra]Write D TTBTTB-MCR p15,5,r0,c15,c2,2
LDR Rd,[Ra]Read D TTBTTB-MRC p15,0,r0,c2,c2,2
STR Rd,[Ra]Write I DACDAC-MCR p15,5,r0,c15,c1,3
LDR Rd,[Ra]Read I DACDAC-MRC p15,5,r0,c15,c1,3
STR Rd,[Ra]Write D DACDAC-MCR p15,5,r0,c15,c2,3
LDR Rd,[Ra]Read D DACDAC-MRC p15,0,r0,c3,c0,0
STR Rd,[Ra]Write I FSRFSR-MCR p15,0,r0,c5,c0,1
LDR Rd,[Ra]Read I FSRFSR-MRC p15,0,r0,c5,c0,1
STR Rd,[Ra]Write D FSRFSR-MCR p15,0,r0,c5,c0,0
LDR Rd,[Ra]Read D FSRFSR-MRC p15,0,r0,c5,c0,0
STR Rd,[Ra]Write I FARFAR-MCR p15,0,r0,c6,c0,1
LDR Rd,[Ra]Read I FARFAR-MRC p15,0,r0,c6,c0,1
STR Rd,[Ra]Write D FARFAR-MCR p15,0,r0,c6,c0,0
LDR Rd,[Ra]Read D FARFAR-MRC p15,0,r0,c6,c0,0
STR Rd,[Ra]ICache invalidate all--MCR p15,0,r0,c7,c5,0
STR Rd,[Ra]ICache invalidate entry-Tag, SegMCR p15,0,r0,c7,c5,1
STR Rd,[Ra]DCache invalidate all--MCR p15,0,r0,c7,c6,0
STR Rd,[Ra]DCache invalidate entry-Tag, SegMCR p15,0,r0,c7,c6,1
STR Rd,[Ra]Write ICache victim-Victim, SegMCR p15,0,r0,c9,c1,1
STR Rd,[Ra]Write DCache victim-Victim, SegMCR p15,0,r0,c9,c1,0
STR Rd,[Ra]Write ICache victim and lockdown base-VictimMCR p15,0,r0,c9,c0,1
STR Rd,[Ra]Write DCache victim and lockdown base-VictimMCR p15,0,r0,c9,c0,0
STR Rd,[Ra]Write I TLB lockdownBase,Victim-MCR p15,0,r0,c10,c0,1
LDR Rd,[Ra]Read I TLB lockdownBase,Victim-MRC p15,0,r0,c10,c0,1
STR Rd,[Ra]Write D TLB lockdownBase,Victim-MCR p15,0,r0,c10,c0,0
LDR Rd,[Ra]Read D TLB lockdownBase,Victim-MRC p15,0,r0,c10,c0,0

Table 9.12. Interpreted access mapping to the MMU

ARM920T instructionFunctionRd/RlistRaCP15 instruction
LDR Rd,[Ra] or LDMIA Ra,[Rlist]I CAM ReadMVA Tag, Size, V, P-MCR p15,4,r0,c15,c5,4
LDR Rd,[Ra] or LDMIA Ra,[Rlist]I RAM1 ReadProtection-MCR p15,4,r0,c15,c9,4
LDR Rd,[Ra]or LDMIA Ra,[Rlist]I RAM2 ReadPA Tag, Size-MCR p15,4,r0,c15,c1,5
LDR Rd,[Ra]or LDMIA Ra,[Rlist]D CAM ReadMVA Tag, Size, V, P-MCR p15,4,r0,c15,c6,4
LDR Rd,[Ra]or LDMIA Ra,[Rlist]D RAM1 ReadProtection-MCR p15,4,r0,c15,c10,4
LDR Rd,[Ra]or LDMIA Ra,[Rlist]D RAM2 ReadPA Tag, Size-MCR p15,4,r0,c15,c2,5

Table 9.13. Interpreted access mapping to the caches

ARM920T instructionFunctionRd/RlistRaCP15 instruction
LDR Rd,[Ra] or LDMIA Ra,[Rlist]I CAM ReadTag, Seg, DirtySegMCR p15,2,r0,c15,c5,2
LDR Rd,[Ra] or LDMIA Ra,[Rlist]I RAM ReadDataSeg, WordMCR p15,2,r0,c15,c9,2
LDR Rd,[Ra]or LDMIA Ra,[Rlist]D CAM ReadTag, Seg, DirtySegMCR p15,2,r0,c15,c6,2
LDR Rd,[Ra] or LDMIA Ra,[Rlist]D RAM ReadDataSeg, WordMCR p15,2,r0,c15,c10,2

Debug access to the MMU

This is achieved through scan chain 1 and 15, using the physical access and interpreted access modes. The following steps explain how to read the Data TLB:

  1. Physical access: Read-modify-write cp15, register 1, to turn off both the caches and MMU.

  2. Physical access: Read-modify-write cp15, register 15, to set MMU test and CP15 interpret mode.

  3. Interpreted access: LDR Rd,[Ra]. MCR = Read D TLB lockdown. This will read the Base and Victim to Rd.

  4. Physical access: Read-modify-write CP15 register 15 to clear CP 15 interpret mode.

  5. STR of Rd loaded in step (3). Capture on scan chain 1 and shift out.

  6. Physical access: Read-modify-write CP15 register 15 to set CP15 interpret mode.

  7. Interpreted access: STR Rd,[Ra]. MCR = Write D TLB lockdown, where Rd = Base[read in (3)], Victim[=0].

  8. Interpreted access: 8 word LDM, LDMIA Ra,[Rlist]. MCR = D CAM Read. The CAM Read will increment the victim pointer on every access, so this will read entries 0-7.

  9. Physical access: Read-modify-write CP15 register 15 to clear CP 15 interpret mode.

  10. 8 word STM of the values loaded in step (6). Capture these on scan chain 1 and shift out. These 8 values are the CAM Tag for entries 0-7.

  11. Physical access: Read-modify-write CP15 register 15 to set CP15 interpret mode.

  12. Repeat steps (8) to (11) eight times to read entries 0-63.

  13. Interpreted access: STR Rd,[Ra]. MCR = Write D TLB lockdown, where Rd = Base[read in step (3)], Victim[=0].

  14. Interpreted access: LDR Rd,[Ra]. MCR = D RAM1 Read. The RAM1 Read will increment the victim pointer on every access as MMU test in cp15, register 15, Test State register has been set.

  15. Interpreted access: LDR Rd,[Ra]. MCR = D RAM2 Read. This uses a pipelined version of the last RAM1 read.

  16. Physical access: Read-modify-write CP15 register 15 to clear CP 15 interpret mode.

  17. 2 word STM of the values loaded in steps (10) and (11). Capture these on scan chain 1 and shift out. These 2 values are RAM1 and RAM2 from entry 0.

  18. Physical access: Read-modify-write CP15 register 15 to set CP15 interpret mode.

  19. Repeat steps (14) to (18) 64 times to read RAM1 and RAM2 entries 0-63.

  20. Interpreted access: STR Rd,[Ra]. MCR = Write D TLB lockdown, where Rd = Base[read in step (3)], Victim[read in step (3)].

  21. Physical access: Read-modify-write cp15, register 15, to clear MMU test and CP15 interpret mode.

  22. Physical access: Read-modify-write cp15, register 1, to turn on (restore state of) both the caches and MMU.

Debug access to the caches

This is achieved through scan chain 1 and 15, using the physical access and interpreted access modes. The following steps explain how to read the DCache. They assume you are trying to read the contents of segment 2 of the DCache.

  1. Physical access: Read-modify-write cp15, register 1, to turn off both the caches and MMU.

  2. Physical access: Read-modify-write cp15, register 15, to set CP15 interpret mode.

  3. Interpreted access: LDR Rd,[Ra]. MCR = D CAM Read, where Ra = Seg2. This will cause the current victim for segment 2 to be read into C15.C.D.Ind.

  4. Physical access: Read C15.C.D.Ind which contains the victim of segment 2.

  5. Interpreted access: STR Rd,[Ra]. MCR = Write DCache victim, where Ra = Victim0, Seg2. This sets the victim counter to 0 for segment 2, and configures the counter to increment after a CAM read or write. The Base remains unchanged.

  6. Interpreted access: 8 word LDM, LDMIA Ra,[Rlist]. MCR = D RAM Read, where Ra = seg2, word0. The LDMIA will increment the word part of the address and move across the cache line from word0 to word7.

  7. Interpreted access: LDR Rd,[Ra]. MCR = D CAM Read, where Ra = Seg2.

  8. Physical access: Read-modify-write cp15, register 15, to clear CP15 interpret mode.

  9. 9 word STM of the values loaded in (6) and (7). Capture these on scan chain 1 and shift out. These 9 values are the CAM Tag and RAM cache line data for segment 2, index 0.

  10. Physical access: Read-modify-write cp15, register 15, to set CP15 interpret mode.

  11. Increment the victim (+1) and repeat steps (5) to (10) 64 times. This approach avoids using the auto increment capability of the victim counter. If the auto increment capability is used, the victim counter will loop back to the Base value when it reaches 63, so either the Victim must start at 0, or the Base must be read, set to 0, then restored after reading the memory.By starting the victim at 0, repeat steps (6) to (10) 64 times.

  12. Interpreted access: STR Rd,[Ra]. MCR = Write DCache victim, where Ra = Victim, Seg2. The Victim value should be the value read and saved in step (5).

  13. Repeat steps (3) to (12) for each segment.

  14. Physical access: Read-modify-write cp15, register 15, to clear CP15 interpret mode.

  15. Physical access: Read-modify-write cp15, register 1, to turn on (restore state of) both the caches and MMU.

Scan chain 4 - debug access to the PA TAG RAM

This scan chain is 49 bits long, as shown in Table 9.14.

Table 9.14. Scan chain 4 format

Scan

chain

bit

Function

Read/

write

48

PA TAG sel TCK

Write

47

RAM enable

Write

46

Odd not even

Write

45:40

Scan index [5:0]

Write

39:33

Scan seg [6:0]

Write

32

PA TAG sync TCK

Read

31:0

WBPA

Read

With scan chain 4 selected, TDI is connected to bit 48 and TDO is connected to bit 0. An access using this scan chain allows the physical address TAG RAM to be read.

Figure 9.7 shows the construction of write back physical addresses.

Figure 9.7. Write back physical address format

Note

Although Scan Seg [6:0] is provided, only bits [2:0] are used in ARM920T to address segments 0-7. Bits [6:3] are defined for forwards compatibility.

To read an entry in the PA TAG RAM, you must execute the following sequence:

  1. Write:

    • PA TAG sel TCK = 1

    • RAM enable = 0.

    This synchronizes the PA TAG RAM to TCK, the test clock.

  2. Read PA TAG sync TCK until it is 1.

    This confirms that the PA TAG RAM is synchronized to TCK.

  3. Write:

    • PA TAG sel TCK = 1

    • RAM enable = 1

    • odd not even

    • scan index bits [5:0]

    • scan seg bits [2:0].

  4. Go through the UPDATE-DR state of the ARM920T TAP controller three times. The most efficient way of doing this, after doing the write in step 3 is to go through the following sequence. This avoids rewriting the values in step 3 on each iteration:

    1. EXIT1-DR

    2. UPDATE-DR

    3. SELECT-DR-SCAN

    4. CAPTURE-DR

    5. Repeat (a) to (d) x 2

    6. SHIFT-DR.

    The PA TAG RAM requires three clock cycles to perform the read. Its clock is cycled in UPDATE-DR, and therefore this state must be passed through three times.

  5. Read the Write Back Physical Address (WBPA).

  6. Write:

    • PA TAG sel TCK = 0

    • RAM enable = 0.

    Resynchronize the PA TAG RAM to the system clock.

  7. Read PA TAG sync TCK until it is 0. This confirms that resynchronization has occurred.

You must repeat this sequence of steps (1 to 7) for the eight segments, corresponding to the eight DCache segments, and the 64 entries per segment, corresponding to the 64 entries in each DCache segment.

Copyright © 2000, 2001 ARM Limited. All rights reserved.ARM DDI 0151C
Non-Confidential
PDF file icon  PDF version
Home > Debug Support > Test data registers > Scan chains 4 and 15, the ARM920T memory system