| |||
| Home > CP15 Test Registers > MMU test registers and operations | |||
The ITLB and DTLB are maintained using MCR and MRC instructions
to CP15 registers 2, 3, 5, 6, 8, and 10, defined by the ARM v4T
programmer’s model. Additional operations are available using MCR and MRC instructions
to CP15 register 15. These operations are combined with those using
registers 2, 3, 5, 6, 8, and 10 to enable testing of the TLBs entirely
in software.
A modified subset of these MCR and MRC instructions
are available in AMBA test for production test. See Chapter 11 AMBA Test Interface.
All MCR and MRC instructions
to CP15 are available through the debug scan chains in CP15 Interpret
Mode. This mode of access is intended to be used with a subset of
the available CP15 MCR and MRC instructions,
so that using other than the minimal subset causes unpredictable
behavior. See Scan chains 4 and 15, the ARM922T
memory system.
The register 2 operations are read and write. They are extended by the register 15 operations to allow individual control of the separate I and D Translation Table Base (TTB) registers, and are listed in Table B.9.
Table B.9. TTB register operations
| Register | TLB | Function |
|---|---|---|
| c2 | I and D | Write I and D TTB registers |
| c2 | D | Read D TTB register |
| c15 | I | Write I TTB register |
| c15 | D | Write D TTB register |
| c15 | I | Read I TTB register |
The register 3 operations are read and write. They are extended by the register 15 operations to allow individual control of the separate I and D Domain Access Control (DAC) registers, and are listed in Table B.10.
Table B.10. DAC register operations
| Register | TLB | Function |
|---|---|---|
| c3 | I and D | Write I and D DAC registers |
| c3 | D | Read D DAC register |
| c15 | I | Write I DAC register |
| c15 | D | Write D DAC register |
| c15 | I | Read I DAC register |
The register 5 operations are read and write, but the ability to access the I FSR is not architecturally defined in ARMv4T and is only intended for debug, when testing the TLB miss mechanism using aborts rather than hardware page table walks. Register 5 operations are listed in Table B.11. The register 15 operations are a duplication of the register 15 operations to the I FSR.
Table B.11. FSR register operations
| Reg | TLB | Function |
|---|---|---|
| c5 | I or D | Write Fault Status Register (FSR) |
| c5 | I or D | Read FSR |
| c15 | I | Write I FSR |
| c15 | I | Read I FSR |
The register 6 operations are read and write. The I TLB is
identical to the D TLB, but the I FAR is not architecturally defined,
so the ability to access the I FAR is for testability only and the MCR and MRC instructions
are described by the ARMv4T as being UNPREDICTABLE. Register 6 operations
are listed in Table B.12.
Table B.12. FAR register operations
| Reg | TLB | Function |
|---|---|---|
| c6 | I or D | Write Fault Address Register (FAR) |
| c6 | I or D | Read FAR |
The register 8 operations are all write-only. They are listed in Table B.13.
Table B.13. Register 8 operations
| Reg | TLB | Function |
|---|---|---|
| c8 | I and D, or I, or D | Invalidate TLB |
| c8 | I or D | Invalidate single entry using MVA |
The register 10 operations are read and write. They are listed in Table B.14.
Table B.14. Register 10 operations
| Reg | TLB | Function |
|---|---|---|
| c10 | I or D | Read victim, lockdown base and preserve bit |
| c10 | I or D | Write victim, lockdown base and preserve bit |
The register 15 operations that operate on the CAM, RAM1, and RAM2 are listed in Table B.15.
Table B.15. CAM, RAM1, and RAM2 register 15 operations
| TLB | Function | Rd | Data |
|---|---|---|---|
| I or D | CAM read to C15.M.<I or D> | SBZ | Tag, Size, V, P |
| I and D, or I, or D | CAM write | Tag, Size, V, P | |
| I or D | RAM1 read to C15.M.<I or D> | SBZ | Protection |
| I and D, or I, or D | RAM1 write | Protection | |
| I or D | RAM2 read to C15.M.<I or D> | SBZ | PA Tag, Size |
| I and D, or I, or D | RAM2 write | PA Tag, Size | PA Tag, Size |
| I or D | CAM match RAM1 read to C15.M.<I or D> | MVA | Fault, Miss, Protection |
While the ARM922T memory system is a Harvard architecture, the TLBs are accessed using CData. This means the write operations can be combined to operate on both the I TLB and D TLB in parallel.
Setting the CP15 register 15 test status register MMU test bit (bit 3) enables auto-increment of the TLB index pointer in both MMUs on CAM and RAM1 reads and writes. If this bit is not set, the TLB index pointer only increments on RAM1 writes.
For the CAM match, RAM1 read operation a TLB miss will not cause a page walk.
These register 15 operations are all issued as MCR,
which means that the read and match operations have to be latched
into the CP15.M.I or CP15.M.D in CP15. These are 32-bit registers
that are read with the following CP15 MRC instruction:
Read from register CP15.M.<I or D>
Table B.16 summarizes C2, C3, C5, C6, C8, C10, and C15 operations.
Table B.16. Register 2, 3, 5, 6, 8, 10, and 15 operations
Function | Rd | Instruction | |
|---|---|---|---|
| Read TTB register | TTB | MRC p15,0,Rd,c2,c0,0 | |
| Write TTB register | TTB | MCR p15,0,Rd,c2,c0,0 | |
| Read domain 15:0 access control | DAC | MRC p15,0,Rd,c3,c0,0 | |
| Write domain 15:0 access control | DAC | MCR p15,0,Rd,c3,c0,0 | |
| Read data FSR value | FSR | MRC p15,0,Rd,c5,c0,0 | |
| Write data FSR value | FSR | MCR p15,0,Rd,c5,c0,0 | |
| Read prefetch FSR value [1] | FSR | MRC p15,0,Rd,c5,c0,1 | |
| Write prefetch FSR value a | FSR | MCR p15,0,Rd,c5,c0,1 | |
| Read D FAR | FAR | MRC p15,0,Rd,c6,c0,0 | |
| Write D FAR | FAR | MCR p15,0,Rd,c6,c0,0 | |
| Read I FAR a | FAR | MRC p15,0,Rd,c6,c0,1 | |
| Write I FAR a | FAR | MCR p15,0,Rd,c6,c0,1 | |
Invalidate TLB(s) | SBZ |
| |
Invalidate I TLB | SBZ |
| |
Invalidate I TLB single entry (using MVA) | MVA format |
| |
Invalidate D TLB | SBZ |
| |
Invalidate D TLB single entry (using MVA) | MVA format |
| |
Read D TLB lockdown | TLB lockdown | MRC p15,0,Rd,c10,c0,0 | |
Write D TLB lockdown | TLB lockdown | MCR p15,0,Rd,c10,c0,0 | |
Read I TLB lockdown | TLB lockdown | MRC p15,0,Rd,c10,c0,1 | |
Write I TLB lockdown | TLB lockdown | MCR p15,0,Rd,c10,c0,1 | |
Read I TTB | TTB | MRC p15,5,Rd,c15,c1,2 | |
Write I TTB | TTB | MCR p15,5,Rd,c15,c1,2 | |
Write D TTB | TTB | MCR p15,5,Rd,c15,c2,2 | |
Read I DAC | DAC | MRC p15,5,Rd,c15,c1,3 | |
Write I DAC | DAC | MCR p15,5,Rd,c15,c1,3 | |
Write D DAC | DAC | MCR p15,5,Rd,c15,c2,3 | |
| Read prefetch FSR value | FSR | MRC p15,5,Rd,c15,c1,5 | |
| Write prefetch FSR value | FSR | MCR p15,5,Rd,c15,c1,5 | |
D CAM read to C15.M.D | SBZ | MCR p15,4,Rd,c15,c6,4 | |
I CAM read to C15.M.I | SBZ | MCR p15,4,Rd,c15,c5,4 | |
D CAM write | Tag, Size, V, P | MCR p15,4,Rd,c15,c6,0 | |
I CAM write | Tag, Size, V, P | MCR p15,4,Rd,c15,c5,0 | |
D and I CAM write | Tag, Size, V, P | MCR p15,4,Rd,c15,c7,0 | |
D RAM1 read to C15.M.D | SBZ | MCR p15,4,Rd,c15,c10,4 | |
I RAM 1 read to C15.M.I | SBZ | MCR p15,4,Rd,c15,c9,4 | |
D RAM1 write | Protection | MCR p15,4,Rd,c15,c10,0 | |
I RAM 1 write | Protection | MCR p15,4,Rd,c15,c9,0 | |
D and I RAM1 write | Protection | MCR p15,4,Rd,c15,c11,0 | |
D RAM2 read to C15.M.D | SBZ | MCR p15,4,Rd,c15,c2,5 | |
I RAM2 read to C15.M.I | SBZ | MCR p15,4,Rd,c15,c1,5 | |
D RAM2 write | PA Tag, Size | MCR p15,4,Rd,c15,c2,1 | |
I RAM2 write | PA Tag, Size | MCR p15,4,Rd,c15,c1,1 | |
D and I RAM2 write | PA Tag, Size | MCR p15,4,Rd,c15,c3,1 | |
D CAM match, RAM1 read to C15.M.D | MVA | MCR p15,4,Rd,c15,c14,4 | |
I CAM match, RAM1 read to C15.M.I | MVA | MCR p15,4,Rd,c15,c13,4 | |
Read C15.M.D | Data | MRC p15,4,Rd,c15,c2,6 | |
Read C15.M.I | Data | MRC p15,4,Rd,c15,c1,6 | |
[1] These MCR and MRC instructions are not architecturally defined in ARMv4T, and are only intended for testability. Their behavior is described by ARMv4T as being UNPREDICTABLE. | |||
Figure B.12 shows the format of Rd for CAM writes and data for CAM reads.
In Figure B.12, V is the Valid bit, P is the Preserve bit, and SIZE_C sets the memory region size. The allowed values of SIZE_C are shown in Table B.17.
Table B.17. CAM memory region size
| SIZE_C[3:0] | Memory region size |
|---|---|
| 0b1111 | 1MB |
| 0b0111 | 64KB |
| 0b0011 | 16KB |
| 0b0001 | 4KB |
| 0b0000 | 1KB |
Figure B.13 shows the format of Rd for RAM1 writes.
In Figure B.13, AP[3:0] determines the setting of the access permission bits for a memory region. The allowed values are listed in Table B.18.
Table B.18. Access permission bit setting
| AP[3:0] | Access permission bits |
|---|---|
| 0b1000 | 0b11 |
| 0b0100 | 0b10 |
| 0b0010 | 0b01 |
| 0b0001 | 0b00 |
Figure B.14 shows the data format for RAM1 reads.
In Figure B.14, bits [24:22] are only valid for a match operation. In this case the values listed in Table B.19 apply.
Table B.19. Miss and fault encoding
| Prot fault | Domain fault | TLB miss | Function |
|---|---|---|---|
| 0 | 0 | 0 | Hit, OK |
| 0 | 1 | 0 | Hit, domain fault |
| 1 | 0 | 0 | Hit, protection fault |
| 1 | 1 | 0 | Hit, protection and domain fault |
| - | - | 1 | TLB miss |
Figure B.15 shows the Rd format for RAM2 writes, and the data format for RAM2 reads.
In Figure B.15, SIZE_R2 sets the memory region size. The allowed values of SIZE_R2 are shown in Table B.20.
Table B.20. RAM2 memory region size
| SIZE_R2[3:0] | Memory region size |
|---|---|
| 0b1111 | 1MB |
| 0b0111 | 64KB |
| 0b0011 | 16KB |
| 0b0000 | 4KB |
| 0b0001 | 1KB |
The encoding for SIZE_R2 is different from SIZE_C.