B.4. MMU test registers and operations

The ITLB and DTLB are maintained using MCR and MRC instructions to CP15 registers 2, 3, 5, 6, 8, and 10, defined by the ARM v4T programmer’s model. Additional operations are available using MCR and MRC instructions to CP15 register 15. These operations are combined with those using registers 2, 3, 5, 6, 8, and 10 to enable testing of the TLBs entirely in software.

A modified subset of these MCR and MRC instructions are available in AMBA test for production test. See Chapter 11 AMBA Test Interface.

All MCR and MRC instructions to CP15 are available through the debug scan chains in CP15 Interpret Mode. This mode of access is intended to be used with a subset of the available CP15 MCR and MRC instructions, so that using other than the minimal subset causes unpredictable behavior. See Scan chains 4 and 15, the ARM922T memory system.

The register 2 operations are read and write. They are extended by the register 15 operations to allow individual control of the separate I and D Translation Table Base (TTB) registers, and are listed in Table B.9.

Table B.9. TTB register operations

RegisterTLBFunction
c2I and DWrite I and D TTB registers
c2DRead D TTB register
c15IWrite I TTB register
c15DWrite D TTB register
c15IRead I TTB register

The register 3 operations are read and write. They are extended by the register 15 operations to allow individual control of the separate I and D Domain Access Control (DAC) registers, and are listed in Table B.10.

Table B.10. DAC register operations

RegisterTLBFunction
c3I and DWrite I and D DAC registers
c3DRead D DAC register
c15IWrite I DAC register
c15DWrite D DAC register
c15IRead I DAC register

The register 5 operations are read and write, but the ability to access the I FSR is not architecturally defined in ARMv4T and is only intended for debug, when testing the TLB miss mechanism using aborts rather than hardware page table walks. Register 5 operations are listed in Table B.11. The register 15 operations are a duplication of the register 15 operations to the I FSR.

Table B.11. FSR register operations

RegTLBFunction
c5I or DWrite Fault Status Register (FSR)
c5I or DRead FSR
c15IWrite I FSR
c15IRead I FSR

The register 6 operations are read and write. The I TLB is identical to the D TLB, but the I FAR is not architecturally defined, so the ability to access the I FAR is for testability only and the MCR and MRC instructions are described by the ARMv4T as being UNPREDICTABLE. Register 6 operations are listed in Table B.12.

Table B.12. FAR register operations

RegTLBFunction
c6I or DWrite Fault Address Register (FAR)
c6I or DRead FAR

The register 8 operations are all write-only. They are listed in Table B.13.

Table B.13. Register 8 operations

RegTLBFunction
c8I and D, or I, or DInvalidate TLB
c8I or DInvalidate single entry using MVA

The register 10 operations are read and write. They are listed in Table B.14.

Table B.14. Register 10 operations

RegTLBFunction
c10I or DRead victim, lockdown base and preserve bit
c10I or DWrite victim, lockdown base and preserve bit

The register 15 operations that operate on the CAM, RAM1, and RAM2 are listed in Table B.15.

Table B.15. CAM, RAM1, and RAM2 register 15 operations

TLBFunctionRdData
I or DCAM read to C15.M.<I or D>SBZTag, Size, V, P
I and D, or I, or DCAM writeTag, Size, V, P 
I or DRAM1 read to C15.M.<I or D>SBZProtection
I and D, or I, or DRAM1 writeProtection 
I or DRAM2 read to C15.M.<I or D>SBZPA Tag, Size
I and D, or I, or DRAM2 writePA Tag, SizePA Tag, Size
I or DCAM match RAM1 read to C15.M.<I or D>MVAFault, Miss, Protection

While the ARM922T memory system is a Harvard architecture, the TLBs are accessed using CData. This means the write operations can be combined to operate on both the I TLB and D TLB in parallel.

Note

Setting the CP15 register 15 test status register MMU test bit (bit 3) enables auto-increment of the TLB index pointer in both MMUs on CAM and RAM1 reads and writes. If this bit is not set, the TLB index pointer only increments on RAM1 writes.

For the CAM match, RAM1 read operation a TLB miss will not cause a page walk.

These register 15 operations are all issued as MCR, which means that the read and match operations have to be latched into the CP15.M.I or CP15.M.D in CP15. These are 32-bit registers that are read with the following CP15 MRC instruction:

Read from register CP15.M.<I or D>

Table B.16 summarizes C2, C3, C5, C6, C8, C10, and C15 operations.

Table B.16. Register 2, 3, 5, 6, 8, 10, and 15 operations

Function

Rd

Instruction

 Read TTB registerTTBMRC p15,0,Rd,c2,c0,0
Write TTB registerTTBMCR p15,0,Rd,c2,c0,0
 Read domain 15:0 access controlDACMRC p15,0,Rd,c3,c0,0
Write domain 15:0 access controlDACMCR p15,0,Rd,c3,c0,0
 Read data FSR valueFSRMRC p15,0,Rd,c5,c0,0
Write data FSR valueFSRMCR p15,0,Rd,c5,c0,0
 Read prefetch FSR value [1]FSRMRC p15,0,Rd,c5,c0,1
Write prefetch FSR value aFSRMCR p15,0,Rd,c5,c0,1
 Read D FARFARMRC p15,0,Rd,c6,c0,0
Write D FARFARMCR p15,0,Rd,c6,c0,0
 Read I FAR aFARMRC p15,0,Rd,c6,c0,1
Write I FAR aFARMCR p15,0,Rd,c6,c0,1
 

Invalidate TLB(s)

SBZ

MCR p15,0,Rd,c8,c7,0

Invalidate I TLB

SBZ

MCR p15,0,Rd,c8,c5,0

Invalidate I TLB single entry (using MVA)

MVA format

MCR p15,0,Rd,c8,c5,1

Invalidate D TLB

SBZ

MCR p15,0,Rd,c8,c6,0

Invalidate D TLB single entry (using MVA)

MVA format

MCR p15,0,Rd,c8,c6,1

 

Read D TLB lockdown

TLB lockdown

MRC p15,0,Rd,c10,c0,0

Write D TLB lockdown

TLB lockdown

MCR p15,0,Rd,c10,c0,0

Read I TLB lockdown

TLB lockdown

MRC p15,0,Rd,c10,c0,1

Write I TLB lockdown

TLB lockdown

MCR p15,0,Rd,c10,c0,1
 

Read I TTB

TTBMRC p15,5,Rd,c15,c1,2

Write I TTB

TTB

MCR p15,5,Rd,c15,c1,2

Write D TTB

TTB

MCR p15,5,Rd,c15,c2,2
 

Read I DAC

DAC

MRC p15,5,Rd,c15,c1,3

Write I DAC

DAC

MCR p15,5,Rd,c15,c1,3

Write D DAC

DAC

MCR p15,5,Rd,c15,c2,3
 Read prefetch FSR valueFSRMRC p15,5,Rd,c15,c1,5
Write prefetch FSR valueFSRMCR p15,5,Rd,c15,c1,5
 

D CAM read to C15.M.D

SBZ

MCR p15,4,Rd,c15,c6,4

I CAM read to C15.M.I

SBZ

MCR p15,4,Rd,c15,c5,4
 

D CAM write

Tag, Size, V, PMCR p15,4,Rd,c15,c6,0

I CAM write

Tag, Size, V, P

MCR p15,4,Rd,c15,c5,0

D and I CAM write

Tag, Size, V, P

MCR p15,4,Rd,c15,c7,0
 

D RAM1 read to C15.M.D

SBZ

MCR p15,4,Rd,c15,c10,4

I RAM 1 read to C15.M.I

SBZ

MCR p15,4,Rd,c15,c9,4
 

D RAM1 write

Protection

MCR p15,4,Rd,c15,c10,0

I RAM 1 write

ProtectionMCR p15,4,Rd,c15,c9,0

D and I RAM1 write

ProtectionMCR p15,4,Rd,c15,c11,0
 

D RAM2 read to C15.M.D

SBZ

MCR p15,4,Rd,c15,c2,5

I RAM2 read to C15.M.I

SBZ

MCR p15,4,Rd,c15,c1,5
 

D RAM2 write

PA Tag, Size

MCR p15,4,Rd,c15,c2,1

I RAM2 write

PA Tag, Size

MCR p15,4,Rd,c15,c1,1

D and I RAM2 write

PA Tag, Size

MCR p15,4,Rd,c15,c3,1
 

D CAM match, RAM1 read to C15.M.D

MVA

MCR p15,4,Rd,c15,c14,4

I CAM match, RAM1 read to C15.M.I

MVAMCR p15,4,Rd,c15,c13,4
 

Read C15.M.D

Data

MRC p15,4,Rd,c15,c2,6

Read C15.M.I

Data

MRC p15,4,Rd,c15,c1,6

[1] These MCR and MRC instructions are not architecturally defined in ARMv4T, and are only intended for testability. Their behavior is described by ARMv4T as being UNPREDICTABLE.

Figure B.12 shows the format of Rd for CAM writes and data for CAM reads.

Figure B.12. Rd format, CAM write and data format, CAM read

In Figure B.12, V is the Valid bit, P is the Preserve bit, and SIZE_C sets the memory region size. The allowed values of SIZE_C are shown in Table B.17.

Table B.17. CAM memory region size

SIZE_C[3:0]Memory region size
0b11111MB
0b011164KB
0b001116KB
0b00014KB
0b00001KB

Figure B.13 shows the format of Rd for RAM1 writes.

Figure B.13. Rd format, RAM1 write

In Figure B.13, AP[3:0] determines the setting of the access permission bits for a memory region. The allowed values are listed in Table B.18.

Table B.18. Access permission bit setting

AP[3:0]Access permission bits
0b10000b11
0b01000b10
0b00100b01
0b00010b00

Figure B.14 shows the data format for RAM1 reads.

Figure B.14. Data format, RAM1 read

In Figure B.14, bits [24:22] are only valid for a match operation. In this case the values listed in Table B.19 apply.

Table B.19. Miss and fault encoding

Prot faultDomain faultTLB missFunction
000Hit, OK
010Hit, domain fault
100Hit, protection fault
110Hit, protection and domain fault
--1TLB miss

Figure B.15 shows the Rd format for RAM2 writes, and the data format for RAM2 reads.

Figure B.15. Rd format, RAM2 write and data format, RAM2 read

In Figure B.15, SIZE_R2 sets the memory region size. The allowed values of SIZE_R2 are shown in Table B.20.

Table B.20. RAM2 memory region size

SIZE_R2[3:0]Memory region size
0b11111MB
0b011164KB
0b001116KB
0b00004KB
0b00011KB

Note

The encoding for SIZE_R2 is different from SIZE_C.

Copyright © 2000, 2001 ARM Limited. All rights reserved.ARM DDI 0184B
Non-Confidential