4.3.21. Using the CTDOR

Example 4.1 shows how to use the Cache and TCM Debug Operation Register (CTDOR).

Example 4.1. Corrupting a single bit in word x of a data cache

Assumptions:

  • The data to be corrupted is present in L1, way 1. Ways are numbered 0-3.

  • Word 2. Words are numbered 0-7.

  • The address of the data is stored in r0.

Use the register as follows:

  1. Write the CTDOR:

    MOV r2,     #0x3F00         ; Index mask (high bits)
    
    ORR r2, r2, #0xE0           ; Index mask (low bits)
    
    AND r1, r0, r2              ; Index extraction for cache access
    
    ORR r1, r1, #1<<30          ; Way indication
    
    ORR r1, r1, #1<<22          ; Cache RAM selection
    
    ORR r1, r1, #1<<21          ; Data RAM selection
    
    ORR r1, r1, #0<<20          ; Data side memory selection
    
    ORR r1, r1, #2<<2           ; Word selection
    
    ORR r1, r1, #0<<0           ; Read operation
    
    
    
    MCR p15, 0, r1, c15, c1, 0  ; Write CTDOR with operation selected above
    
  2. The word to corrupt is now stored in c15,0,c1,1 and its ECC chunk in c15,0,c1,2:

    MRC p15, 0, r3, c15, c1, 1  ; Read data
    
    MRC p15, 0, r4, c15, c1, 3  ; Read ECC chunk (useless in this case)
    
    ORR r3, r3, #1<<5           ; We want to corrupt bit 5 in read word
    
    MRC p15, 0, r3, c15, c1, 1  ; Copy corrupted data to CP15 register
    
    MRC p15, 0, r4, c15, c1, 3  ; Copy corrupted ECC chunk to CP15 register (useless in this case)
    
  3. Write the CTDOR to write the corrupted word on the data cache:

    ORR r1, r1, #1<<0           ; Write operation
    
    MCR p15, 0, r1, c15, c1, 0  ; Actual write of corrupted data and chunk to L1 cache
    

Copyright © 2012, 2014 ARM. All rights reserved.ARM DDI 0458C
Non-ConfidentialID112814