ARM720T ™ TechnicalReference Manual

Revision: r4p3

Table of Contents

About this document
Intended audience
Using this manual
Typographical conventions
Product revision status
Timing diagram conventions
Further reading
Feedback on the ARM720T processor
Feedback on this document
1. Introduction
1.1. About the ARM720T processor
1.1.1. EmbeddedICE-RT logic
1.2. Coprocessors
1.3. About the instruction set
1.3.1. Format summary
1.3.2. ARM instruction set
1.3.3. Thumb instruction set
1.4. Silicon revisions
2. Programmer’s Model
2.1. Processor operating states
2.1.1. Switching between processor states
2.2. Memory formats
2.2.1. Big-endian format
2.2.2. Little-endian format
2.3. Instruction length
2.4. Data types
2.5. Operating modes
2.5.1. Changing operating modes
2.6. Registers
2.6.1. The ARM state register set
2.6.2. The Thumb state register set
2.6.3. The relationship between ARM and Thumb stateregisters
2.6.4. Accessing high registers in Thumb state
2.7. Program status registers
2.7.1. The condition code flags
2.7.2. The control bits
2.7.3. Reserved bits
2.8. Exceptions
2.8.1. Action on entering an exception
2.8.2. Action on leaving an exception
2.8.3. Exception entry and exit summary
2.8.4. Fast interrupt request
2.8.5. Interrupt request
2.8.6. Abort
2.8.7. Software interrupt
2.8.8. Undefined instruction
2.8.9. Exception vectors
2.8.10. Exception priorities
2.8.11. Exception restrictions
2.9. Relocation of low virtual addressesby the FCSE PID
2.10. Reset
2.11. Implementation-defined behavior ofinstructions
2.11.1. Indexed addressing on a Data Abort
2.11.2. Early termination
3. Configuration
3.1. About configuration
3.1.1. Compatibility
3.1.2. Notation
3.2. Internal coprocessor instructions
3.3. Registers
3.3.1. ID Register
3.3.2. Control Register
3.3.3. Translation Table Base Register
3.3.4. Domain Access Control Register
3.3.5. Fault Status Register
3.3.6. Fault Address Register
3.3.7. Cache Operations Register
3.3.8. TLB Operations Register
3.3.9. Process Identifier Registers
3.3.10. Register 14, reserved
3.3.11. Test Register
4. Instruction and Data Cache
4.1. About the instruction and data cache
4.1.1. IDC operation
4.1.2. Cachable bit
4.1.3. Read-lock-write
4.2. IDC validity
4.2.1. Software IDC flush
4.2.2. Doubly-mapped space
4.3. IDC enable, disable, and reset
5. Write Buffer
5.1. About the write buffer
5.1.1. Bufferable bit
5.2. Write buffer operation
5.2.1. Bufferable write
5.2.2. Unbufferable write
5.2.3. Read-lock-write
5.2.4. Reading from a noncachable area
5.2.5. Draining the write buffer
5.2.6. Multi-word writes
6. The Bus Interface
6.1. About the bus interface
6.1.1. Summary of the AHB transfer mechanism
6.2. Bus interface signals
6.3. Transfer types
6.4. Address and control signals
6.4.1. HADDR[31:0]
6.4.2. HWRITE
6.4.3. HSIZE[2:0]
6.4.4. HBURST[2:0]
6.4.5. HPROT[3:0]
6.5. Slave transfer response signals
6.5.1. HREADY
6.5.2. HRESP[1:0]
6.6. Data buses
6.6.1. HWDATA[31:0]
6.6.2. HRDATA[31:0]
6.6.3. Endianness
6.7. Arbitration
6.7.1. HBUSREQ
6.7.2. HLOCK
6.7.3. HGRANT
6.8. Bus clocking
6.8.1. HCLK
6.8.2. HCLKEN
6.9. Reset
7. Memory Management Unit
7.1. About the MMU
7.1.1. Access permissions and domains
7.1.2. Translated entries
7.2. MMU program-accessible registers
7.3. Address translation
7.3.1. Translation Table Base Register
7.3.2. Level one fetch
7.3.3. Level one descriptor
7.3.4. Section descriptor
7.3.5. Coarse page table descriptor
7.3.6. Fine page table descriptor
7.3.7. Translating section references
7.3.8. Level two descriptor
7.3.9. Translating large page references
7.3.10. Translating small page references
7.3.11. Translating tiny page references
7.3.12. Subpages
7.4. MMU faults and CPU aborts
7.5. Fault address and fault status registers
7.5.1. Fault Status
7.6. Domain access control
7.7. Fault checking sequence
7.7.1. Alignment fault
7.7.2. Translation fault
7.7.3. Domain fault
7.7.4. Permission fault
7.8. External aborts
7.9. Interaction of the MMU and cache
7.9.1. Enabling the MMU
7.9.2. Disabling the MMU
8. Coprocessor Interface
8.1. About coprocessors
8.1.1. Coprocessor availability
8.2. Coprocessor interface signals
8.3. Pipeline-following signals
8.4. Coprocessor interface handshaking
8.4.1. The coprocessor
8.4.2. The ARM720T core
8.4.3. Coprocessor signaling
8.4.4. Consequences of busy‑waiting
8.4.5. Coprocessor register transfer instructions
8.4.6. Coprocessor data operations
8.4.7. Coprocessor load and store operations
8.5. Connecting coprocessors
8.5.1. Connecting a single coprocessor
8.5.2. Connecting multiple coprocessors
8.6. Not using an external coprocessor
8.7. STC operations
8.8. Undefined instructions
8.9. Privileged instructions
9. Debugging Your System
9.1. About debugging your system
9.1.1. A typical debug system
9.2. Controlling debugging
9.2.1. Debug modes
9.2.2. Examining system state during debugging
9.3. Entry into debug state
9.3.1. Entry into debug state on breakpoint
9.3.2. Entry into debug state on watchpoint
9.3.3. Entry into debug state on debug request
9.3.4. Action of the ARM720T processor in debug state
9.3.5. Clocks
9.4. Debug interface
9.4.1. Debug interface signals
9.5. ARM720T core clock domains
9.6. The EmbeddedICE-RT macrocell
9.7. Disabling EmbeddedICE-RT
9.8. EmbeddedICE-RT register map
9.9. Monitor mode debugging
9.9.1. Enabling monitor mode
9.9.2. Restrictions on monitor-mode debugging
9.10. The debug communications channel
9.10.1. DCC Control Register
9.10.2. Communications through the DCC
9.11. Scan chains and the JTAG interface
9.11.1. Scan chain implementation
9.11.2. Controlling the JTAG interface
9.12. The TAP controller
9.12.1. Resetting the TAP controller
9.13. Public JTAG instructions
9.13.1. SCAN_N (b0010)
9.13.2. INTEST (b1100)
9.13.3. IDCODE (b1110)
9.13.4. BYPASS (b1111)
9.13.5. RESTART (b0100)
9.14. Test data registers
9.14.1. Bypass register
9.14.2. ARM720T processor device identification(ID) code register
9.14.3. Instruction register
9.14.4. Scan path select register
9.14.5. Scan chains 1 and 2
9.15. Scan timing
9.15.1. Scan chain 1 cells
9.16. Examining the core and the system indebug state
9.16.1. Determining the core state
9.16.2. Determining system state
9.17. Exit from debug state
9.18. The program counter during debug
9.18.1. Breakpoints
9.18.2. Watchpoints
9.18.3. Watchpoint with another exception
9.18.4. Debug request
9.18.5. System speed access
9.18.6. Summary of return address calculations
9.19. Priorities and exceptions
9.19.1. Breakpoint with Prefetch Abort
9.19.2. Interrupts
9.19.3. Data Aborts
9.20. Watchpoint unit registers
9.20.1. Programming and reading watchpoint registers
9.20.2. Using the data, and address mask registers
9.20.3. The watchpoint unit control registers
9.21. Programming breakpoints
9.21.1. Hardware breakpoints
9.21.2. Software breakpoints
9.22. Programming watchpoints
9.23. Abort status register
9.24. Debug control register
9.24.1. Disabling interrupts
9.24.2. Forcing DBGRQ
9.24.3. Forcing DBGACK
9.25. Debug status register
9.26. Coupling breakpoints and watchpoints
9.26.1. Breakpoint and watchpoint coupling example
9.26.2. DBGRNG signal
9.27. EmbeddedICE-RT timing
10. ETM Interface
10.1. About the ETM interface
10.2. Enabling and disabling the ETM7 interface
10.3. Connections between the ETM7 macrocelland the ARM720T processor
10.4. Clocks and resets
10.5. Debug request wiring
10.6. TAP interface wiring
11. Test Support
11.1. About the ARM720T test registers
11.2. Automatic Test Pattern Generation(ATPG)
11.2.1. ARM720T processor INTEST/EXTEST wrapper
11.3. Test State Register
11.4. Cache test registers and operations
11.4.1. Addressing the CAM and RAM
11.5. MMU test registers and operations
11.5.1. Addressing the CAM, RAM1, and RAM2
A. Signal Descriptions
A.1. AMBA interface signals
A.2. Coprocessor interface signals
A.3. JTAG and test signals
A.4. Debugger signals
A.5. Embedded trace macrocell interfacesignals
A.6. ATPG test signals
A.7. Miscellaneous signals

List of Figures

1. Key to timing diagram conventions
1.1. 720T Block diagram
1.2. ARM720T processor functional signals
1.3. ARM instruction set formats
1.4. Thumb instruction set formats
2.1. Big-endian addresses of bytes withwords
2.2. Little-endian addresses of bytes withwords
2.3. Register organization in ARM state
2.4. Register organization in Thumb state
2.5. Mapping of Thumb state registersonto ARM state registers
2.6. Program status register format
3.1. MRC and MCR bit pattern
3.2. ID Register read format
3.3. ID Register write format
3.4. Control Register read format
3.5. Control Register write format
3.6. Translation Table Base Register format
3.7. Domain Access Control Register format
3.8. Fault Status Register format
3.9. Fault Address Register format
3.10. FCSCE PID Register format
3.11. PROCID Register format
6.1. Simple AHB transfer
6.2. AHB bus master interface
6.3. Simple memory cycle
6.4. Transfer type examples
7.1. Translation Table Base Register
7.2. Translating page tables
7.3. Accessing translation table level onedescriptors
7.4. Level one descriptor
7.5. Section descriptor
7.6. Coarse page table descriptor
7.7. Fine page table descriptor
7.8. Section translation
7.9. Level two descriptor
7.10. Large page translation from a coarsepage table
7.11. Small page translation from a coarsepage table
7.12. Tiny page translation from a finepage table
7.13. Domain Access Control Register format
7.14. Sequence for checking faults
8.1. Coprocessor busy-wait sequence
8.2. Coprocessor register transfer sequence
8.3. Coprocessor data operation sequence
8.4. Coprocessor load sequence
8.5. Example coprocessor connections
9.1. Typical debug system
9.2. ARM720T processor block diagram
9.3. Debug state entry
9.4. Clock synchronization
9.5. The ARM720T core, TAP controller,and EmbeddedICE-RT macrocell
9.6. DCC Control Register
9.7. ARM720T processor scan chain arrangements
9.8. Test access port controller statetransitions
9.9. ID code register format
9.10. Scan timing
9.11. Debug exit sequence
9.12. EmbeddedICE-RT block diagram
9.13. Watchpoint control value, and maskformat
9.14. Debug abort status register
9.15. Debug control register format
9.16. Debug status register format
9.17. Debug control and status registerstructure
11.1. CP15 MRC and MCR bit pattern
11.2. Rd format, CAM read
11.3. Rd format, CAM write
11.4. Rd format, RAM read
11.5. Rd format, RAM write
11.6. Rd format, CAM match RAM read
11.7. Data format, CAM read
11.8. Data format, RAM read
11.9. Data format, CAM match RAM read
11.10. Rd format, write cache victim andlockdown base
11.11. Rd format, write cache victim
11.12. Rd format, CAM write and data format,CAM read
11.13. Rd format, RAM1 write
11.14. Data format, RAM1 read
11.15. Rd format, RAM2 write and data format,RAM2 read
11.16. Rd format, write TLB lockdown

List of Tables

1.1. Key to tables
1.2. ARM instruction summary
1.3. Addressing mode 2
1.4. Addressing mode 2 (privileged)
1.5. Addressing mode 3
1.6. Addressing mode 4 (load)
1.7. Addressing mode 4 (store)
1.8. Addressing mode 5
1.9. Operand 2
1.10. Fields
1.11. Condition fields
1.12. Thumb instruction summary
2.1. ARM720T modes of operation
2.2. PSR mode bit values
2.3. Exception entry and exit
2.4. Exception vector addresses
3.1. Cache and MMU Control Register
3.2. Cache operation
3.3. TLB operations
6.1. Transfer type encoding
6.2. Transfer size encodings
6.3. Burst type encodings
6.4. Protection control encodings
6.5. Response encodings
6.6. Active byte lanes for a 32-bit little-endian data bus
6.7. Active byte lanes for a 32-bit big-endian data bus
7.1. CP15 register functions
7.2. Level one descriptor bits
7.3. Interpreting level one descriptor bits [1:0]
7.4. Section descriptor bits
7.5. Coarse page table descriptor bits
7.6. Fine page table descriptor bits
7.7. Level two descriptor bits
7.8. Interpreting page table entry bits [1:0]
7.9. Priority encoding of fault status
7.10. Interpreting access control bits in Domain Access ControlRegister
7.11. Interpreting access permission (AP) bits
8.1. Coprocessor availability
8.2. Handshaking signals
8.3. Handshake signal connections
8.4. CPnTRANS signal meanings
9.1. Function and mapping of EmbeddedICE-RT registers
9.2. DCC Control Register bit assignments
9.3. Instruction encodings for scan chain 15
9.4. Public instructions
9.5. Scan chain number allocation
9.6. Scan chain 1 cells
9.7. Determining the cause of entry to debug state
9.8. SIZE[1:0] signal encoding
9.9. Debug control register bit assignments
9.10. Interrupt signal control
9.11. Debug status register bit assignments
10.1. Connections between the ETM7 macrocell and the ARM720T processor
11.1. Summary of ATPG test signals
11.2. Test State Register operations
11.3. Summary of CP15 register c7, c9, and c15 operations
11.4. Write cache victim and lockdown operations
11.5. CAM, RAM1, and RAM2 register c15 operations
11.6. Register c2, c3, c5, c6, c8, c10, and c15 operations
11.7. CAM memory region size
11.8. Access permission bit setting
11.9. Miss and fault encoding
11.10. RAM2 memory region size
A.1. AMBA interface signals
A.2. Coprocessor interface signal descriptions
A.3. JTAG and test signal descriptions
A.4. Debugger signal descriptions
A.5. ETM interface signal descriptions
A.6. ATPG test signal descriptions
A.7. Miscellaneous signal descriptions

Proprietary Notice

Words and logos marked with ® or ™ are registered trademarks or trademarksof ARM Limited in the EU and other countries, except as otherwisestated below in this proprietary notice. Other brands and names mentionedherein may be the trademarks of their respective owners.

Neither the whole nor any part of the information containedin, or the product described in, this document may be adapted orreproduced in any material form except with the prior written permissionof the copyright holder.

The product described in this document is subject to continuousdevelopments and improvements. All particulars of the product andits use contained in this document are given by ARM in good faith.However, all warranties implied or expressed, including but notlimited to implied warranties of merchantability, or fitness forpurpose, are excluded.

This document is intended only to assist the reader in theuse of the product. ARM Limited shall not be liable for any lossor damage arising from the use of any information in this document,or any error or omission in such information, or any incorrect useof the product.

Figure 9.8 reprintedwith permission IEEE Std. 1149.1-1990. IEEE Standard Test AccessPort and Boundary Scan Architecture Copyright 2001, by IEEE. TheIEEE disclaims any responsibility or liability resulting from theplacement and use in the described manner.

Confidentiality Status

This document is Non-Confidential. The right to use, copyand disclose this document may be subject to license restrictionsin accordance with the terms of the agreement entered into by ARMand the party that ARM delivered this document to.

Product Status

The information in this document is final, that is for a developedproduct.

Revision History
Revision A November2002 First Release for Rev4
Revision B June2003 First release for r4p2
Revision C April2004 Release for patch update from r4p2 to r4p3.Minor corrections to text.
Copyright © 2001, 2003, 2004 ARM Limited. All rights reserved. ARM DDI 0229C