ARM7TDMI-S - ARM Limited.

ARM DDI 0234A

ARM7TDMI-S

(Rev 4)

Technical Reference Manua l

ARM DDI 0234A

ARM7TDMI-S

Technica l Reference Manual

Release Informat ion

Proprietary Notice

Wo rds and lo gos mar ked w ith ® or ™ are register ed trademarks or trademarks owned by ARM Limited. Ot her

brands and names menti oned herein may be the t r ademarks of th eir r es pective owne rs.

Neither the whole nor any part of the inf orma ti on c ontained in , or the product des cribed in, this document

may be adapt ed or r eprod uced in an y mater ial form ex cept with the pr ior wri tten per mis sion of the cop yrigh t

holder.

The product described in this docume nt is s ubject to con ti nuous developm ents an d improvements. All

pa rticulars of the product and its use contained in this document are gi ven by ARM in good fai th. How ever,

all warranties implied or expressed, including but not limited to implied warranties of merchantability, or

fitness for purpose, are excluded.

Thi s doc ument i s int ende d on ly to a ss ist the r ead er in th e use o f the produ ct. AR M Li mited shall not be l iabl e

for any loss or damage ar ising from the us e of any info rmatio n in this document, or an y error or omissio n in

such infor m ation, or any incorrect use of the product.

Figur e 5-8 on pa ge 5-26 re print e d w ith per m ission IEEE Std. 1149.1-1990. I EEE Standard Test A cces s Port

result ing from the placement and us e in the described manner.

Confidentiali ty S tatus

Thi s document is Open Acces s . This document ha s no restriction on distribution.

Product Status

The information in this document is f inal (information on a developed product).

Web Address

http://www.arm.com

Change history

Date Issue Change

28 September 2001 A Fi r st release of ARM7TD M I- S (Rev 4) pr ocessor

ARM DDI 0234A
Copy right © 20 01 AR M Limited. A ll rights reserved.
iii
Contents
ARM7TDMI-S  Technical Reference Manual
Preface
Abou t th is doc u m e n t  ..... ..... .. ..... ... .. ..... .. ..... ... .. ..... ... ......... ... ..... .. .. ..... ... ..... .. .. xii
Feedback ..................................................................................................... xvi
Chapter 1 Introduction
1.1 Abo u t th e  ARM7 T D M I -S  p ro c es s o r ... .... ... ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. 1-2
1.2 ARM7TDMI-S architecture .......................................................................... 1-4
1.3 ARM7TDMI-S block, core and fun cti onal diagrams . ..... .. ..... .. .......... .. ...... .. . 1-6
1.4 ARM7TDMI-S instruction set summary ....................................................... 1-9
1.5 Differ ences between Rev 3a and Rev 4 ...... ........ ..... .. ..... .. ...... .. ..... .. ..... .. .. 1-22
Chapter 2 Programmer’s Model
2.1 Abou t th e  pr og r a m m e r’ s m o del  . ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ... .... ... ..... .. ... .. 2-2
2.2 Pro c es s o r ope ra ting  sta te s   .. ... .. ..... ... .... ... .. ..... ... ..... .. .. ..... ... .. ..... .. ..... ... .. ..... 2 -3
2.3 Memory formats .......................................................................................... 2-4
2.4 Ins tru c tion le n gt h   .... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ... .. 2-6
2.5 Data types ................................................................................................... 2-7
2.6 Operating modes  ........................................................................................ 2-8
2.7 Registers ..................................................................................................... 2-9
2.8 The program status registers .................................................................... 2-16
2.9 Exceptions ................................................................................................ 2-19
2.10 Interrupt latencies  ..................................................................................... 2-26

Contents
iv
Copyright © 20 01 ARM Limited. All r ights reserved.
ARM DDI 0234A
11 Reset ........................................................................................................  2-27
Chapter 3 Memory Interface
1 About the memory interface  .......................................................................  3-2
2 Bus  in te rf a ce  si gna l s   .......... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ... ..... .. ..... .. ..  3-3
3 Bus  cyc l e  type s  .... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... ... .. ..... .. ..... ... .. ....  3-4
4 Ad dressing signal s  ..... .. ..... ..... ..... ......... ................. .. ........... ......... .............  3-10
5 Da ta ti med signals . .. ......... ... ..... ..... ..... .. ................. ..... .. .................. .. ........  3-13
6 Using CLKEN to control bus cycles ..........................................................  3-17
Chapter 4 Coprocessor Interf ace
1 Abou t copr o ce s s or s  ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ... .... ... ..... .. ... .... ..  4-2
2 Co processor interface signals ................... ..... .... ...... ..... .... ............. .... ........  4-4
3 Pipeline-following signals  ......... .. .......... ..... .. .......... ..... .. ...... .. ..... .. ........ .......  4-5
4 Co processor inter face handshaking ...................... ..... .. ............... ...............  4- 6
5 Co nnecting coprocessors .... ..... .. ........ .... ... ......... ... ..... .. ............... ..... ..... ...  4-11
6 Not using an external coprocessor ...........................................................  4-14
7 Unde fined  in s tru c tions  . .. .. ..... ... ......... ... ..... .. ... .... ... ..... .. ... ..... .. ..... .. ... ..... .. ..  4-1 5
8 Privileged instructions ...............................................................................  4-16
Chapter 5 Debugging Your System
1 Ab out debugging your system .... ............. ..... .. .... ... ...................... ...............  5-3
2 Controlling debugging .............. ............................. ............... .......................  5-5
3 Entry into debug st ate ......... .......... ............................. .......... .......................  5-7
4 De bug inter face  ..... .... ... ..... .. ..... .. ........ ..... .. ..... ..... .. ..... .. ...... .. ..... .. ........ .....  5-12
5 ARM7TDMI-S core clock domains  ...........................................................  5-13
6 The EmbeddedICE- RT macrocell ............. ............ ..... ...............................  5-14
7 Disabli ng EmbeddedICE-RT  ......... .. .. ... ..... .. ... .......... .. .. ............... .. ... ........  5-16
8 EmbeddedICE-RT r egister map .. .. .... ... .. ...... .. ..... .. ..... .. ... ..... .. ..... .. ...... .. ...  5-17
9 Mon itor mode debugging ........ .. ..... .. ........ ..... .. .... ... ..... .. ...... .. ..... .. ..... ..... .. .  5-18
10 The debug com m unications channel .... ..... ..... .. ........ .... ... ..... ..... .. ..... ..... .. .  5-20
11 Scan chains and the JTAG interface ........................................................  5-24
1 2 T he  TAP  c on t ro ller .... ... .... ... .. ..... ... ......... ... ..... .. .. ..... ... ..... .. ... .... ... ..... .. ... ....  5-2 6
13 Public JTAG instructions  ..........................................................................  5-28
14 Test data registers ....................................................................................  5-31
15 Scan timing ...............................................................................................  5-36
16 Exam ining the cor e and the system in debug state . ... ........ .... .. ........ ........  5-39
17 Exit  from debug state ........ ... ..... .. ... ..... .. ........ ......... ..... .. ... ..... .. ..... .. ........ ...  5-42
18 The program counter duri ng debug . .. ... ..... ..... .. ..... .. ...... .. ..... .. ........ ..... .. ...  5-44
1 9 P rio riti e s and  ex c e pt io n s   ...... ... ......... ... ..... .. ... .... ... ..... .. ... ..... .. .. ..... ... ..... .. ..  5-47
20 Watchpoint unit registers ..........................................................................  5-48
2 1 P ro g ra m min g bre a kp o in t s  .... ... ..... .. .. ..... ... ..... .. .. ..... ... .. ..... ... .... ... .. ..... ... ....  5-5 3
2 2 P ro g ra m min g wa tc h po i nt s  .... ... ..... .. .. ..... ... ..... .. .. ..... ... .. ..... ... .... ... .. ..... ... ....  5-5 5
2 3 A bo r t st at u s re g is te r  .... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... ..  5-5 6
24 Debug control re gister  ...... ... .. ...... .. .. ..... .. ...... .. .. ..... .. ...... .. .. .......... .. ... ..... .. .  5- 57
25 Debug status regi ster  .......... ..... .. ........ ..... .. ..... ..... .. ..... .. ...... .. ..... .. ........ .....  5-60

Contents
ARM DDI 0234A
Copy right © 20 01 AR M Limited. A ll rights reserved.
v
5.2 6 C ou p li n g b re a kp o in t s a nd w at c hp o in t s  . ... .. ..... ... ..... .. .. ..... ... ..... .. .. ..... ... ..... 5-62
5.27 EmbeddedICE-RT timing . .............................................. ........................... 5-65
Chapter 6 ETM Inter face
6.1 Abou t th e  ET M  in te r fa c e  .... ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... 6 -2
6.2 Enab l i ng  a nd di sa b ling th e  ETM 7  in te rf a ce  ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... 6 -3
6.3 ETM7 to ARM7TDMI-S (Rev 4) connections .............................................. 6-4
6.4 Clocks and resets  ........................................ ..... ..... ................. ............ ..... ... 6-6
6.5 Debug request wiring ....... ....................................... ....... ............................. 6-7
Chapter 7 I n str u ction Cycle T i mi n g s
7.1 Ab out the instruct ion cycle timi ngs .. ... .... ...... ..... ..... .... ..... ..... ..... .... ...... ..... ... 7-3
7.2 Instructio n cycle count summary  ........ ..... ..... ..... .... ............. ..... ................. ... 7-5
7.3 Branch and ARM branch with link ............................................................... 7-7
7.4 Thumb branch with link ............................................................................... 7-8
7.5 Branch and exchange .................. ..... .......................................................... 7-9
7.6 Da ta operations .. .. ...... .. ..... ..... .. ..... .. ........ ..... ..... .. ..... ..... .. ..... ..... .. ..... .. ....... 7-10
7.7 Multiply, and multiply accumulate  . .. ........ .... ... ..... ..... .. ........ .... ... ..... ..... ..... . 7-12
7.8 Load register  ........... ..... .. .......... ..... .. .......... .. ........ ..... .. ..... ..... .. ... .... ... ..... .. .. 7-14
7.9 Store register  ............................................................................................ 7-16
7.10 Load m ultipl e registers .......... ........ ......... ... .. ........ ......... ... ..... .. .......... ..... .... 7-17
7.11 Store multiple registers  ............................................................................. 7-19
7.12 Data swap ................................................................................................. 7-20
7.13 Software interrupt, and exception entry  .................................................... 7-21
7.14 Coprocessor data processing operation  ................................................... 7-22
7.15 L oad coprocessor regi ster (from memory to coprocessor)  .. ..... ..... ..... ..... . 7- 23
7.16 Store coprocessor regi ster (f rom co processor to memory) ....... .... ... ......... 7-25
7.17 Coprocessor regis ter transf er (move fr om  coprocessor to ARM register) . 7-27
7.18 Coprocessor regis ter transf er (move from ARM register  to coprocessor) . 7-28
7.19 Undefined inst ructions and coprocessor absent .... .. ..... .. ........ .... .. ........ .... 7-29
7.2 0 U ne x e c ut e d in s tr uc ti o ns  ..... .. ..... ... .. ..... .. ... ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... 7-3 0
Chapter 8 AC Parameters
8.1 Timing diagrams  ......................................................................................... 8-2
8.2 AC timing parameter definitions .................................................................. 8-8
Appendix A Signal Descriptions
A.1 Signal descriptions ...................................................................................... A-2
Appendix B Differe nces Between the ARM 7TDMI-S and the ARM7TDMI
B.1 Inte rf a ce  si g na ls  ..... .. ..... ... .. ..... .. .......... .. ..... ... .. ..... ... .... ... .. ..... ... .... ... .. ..... ... .. B-2
B.2 ATPG scan interface ................................................................................... B-6
B.3 Timing parameters ...................................................................................... B-7
B.4 AR M7 TDMI-S de si gn  con s id e ra tions  .... ... ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... ..  B -8

Contents

ARM DDI 0234A

ARM DDI 0234A
Copy right © 20 01 AR M Limited. A ll rights reserved.
vii
List of Tables
ARM7TDMI-S  Technical Reference Manual
Change history .............................................................................................................. ii
Tab l e 1-1 Ke y to  ta b le s  .. .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. 1-9
Tab l e 1-2 AR M in st ru cti on su m mary  . ... ..... .. ... .... ... ..... .. ... .... ... ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... 1-1 0
Tab l e 1-3 Ad d re s si ng  mo de  2  .. ..... .. ..... .. ... ..... .. ..... .. ... ..... .. .. ..... ... ..... .. ... .... ... ..... .. ... .... ... ..... .. ... 1-1 3
Table 1-4 Addressi ng mode 2 (privileged)  .................................. .......... ........................ ..... ..... 1-14
Tab l e 1-5 Ad d re s si ng  mo de  3  .. ..... .. ..... .. ... ..... .. ..... .. ... ..... .. .. ..... ... ..... .. ... .... ... ..... .. ... .... ... ..... .. ... 1-1 4
Tab l e 1-6 Ad d re s si ng  mo de  4  (lo ad )  . ... .. ..... ... .... ... .. ..... ... .... ... .. ..... ... ..... .. .. ..... ... ..... .. .. ..... ... .. ... 1-15
Tab l e 1-7 Ad d re s si ng  mo de  4  (st or e ) ..... ... ..... .. .. ..... ... ..... .. .. ..... ... ..... .. ... .... ... ..... .. ... .... ... ..... .. ... 1-1 5
Tab l e 1-8 Ad d re s si ng  mo de  5  .. ..... .. ..... .. ... ..... .. ..... .. ... ..... .. .. ..... ... ..... .. ... .... ... ..... .. ... .... ... ..... .. ... 1-1 5
Table 1-9 Operand 2 ............ ..... .. ... ..... .. ..... .. .......... .. ...... .. ..... .. ..... .. ... ..... .. ..... .. ... ............ ..... .. .. 1-16
Tab le 1-1 0 Fie lds  .... ..... ..... .. ..... ..... ... .... ..... ..... ... .... ..... ... ..... .... ..... ... ..... ..... .. ..... ..... ..... .. ..... .......... 1-16
Tab l e 1-1 1 Co n di tio n  fie ld s  . ... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. .......... ... 1-17
Table 1-12 Thumb instruction summary  ................................................................................... 1-17
Table 2-1 Register mode identifiers  ..... ........................................................ .......... ....... .......... 2-10
Table 2-2 PSR mode bit values ............................................................................................... 2-17
Table 2-3 Exception entr y and exit ..... ... ..... .. ........ ..... ..... .. ..... ..... .. ..... .. ........ ..... ..... .. ..... ..... .. .... 2-19
Tab l e 2-4 Ex ce p ti o n vectors .. ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... 2-24
Table 3-1 Cycle types ................................................................................................................ 3-4
Tab l e 3-2 Bu rs t ty p e s  ....... ... .. ..... ... .... ... .. ..... ... .... ... .. ..... ... .... ... .. ..... ... ..... .. .. ..... ... .. ..... .. ..... ... .. ..... 3 -7
Tab l e 3-3 Tra n s fe r w id th s   .... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ... 3-11
Table 3-4 PROT[1:0] encoding ................................................................................................ 3-11
Tab l e 3-5 Tra n s fe r si z e e nc o d in g  ...... ... .. ..... ... ......... ... ..... .. .. ..... ... ..... .. ... .... ... ..... .. ... .... ... ..... .. ... 3-1 4
Table 3-6 Signi fi cant address bit s  ....... .. ..... .. .......... ..... .. ... .... ... ..... .. ... ..... .. ........ ..... .. ..... .. ..... .. .. 3- 14

List of Tables
viii
Copyright © 20 01 ARM Limited. All r ights reserved.
ARM DDI 0234A
Tab l e 3-7 Wo r d acc e s se s  ...... ... .. ..... .. ..... ... .. ..... .. .......... .. ..... ... .. ..... .. ..... ... .. ..... ... .... ... .. ..... ... ....  3-15
Table 3-8 Halfword accesses ..................................................................................................  3-15
Table 3-9 Byte accesses .........................................................................................................  3-15
Tab l e 4-1 Co p ro c e ss o r ava ilabilit y ..... ..... ... .. ..... .. ..... ... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ..  4-3
Table 4-2 Handshaking signals .................................................................................................  4-6
Table 4-3 Handshake signal connections ...............................................................................  4-13
Table 4-4 CPnTRANS signal  meanings ...... ..... .. .. ... ..... .. .. ... ..... .. ... .......... .. .. ... ..... .. .. ........... .. .. .  4-16
Table 5-1 Function and mapping of EmbeddedICE-RT registers ...........................................  5-17
Table 5-2 DCC control register bit assignments ....................................................... ..............  5-21
Table 5-3 Public instructions ...................................................................................................  5-28
Tab l e 5-4 Sc a n cha in  nu m b e r  allo c a ti on  . ..... .. ... ..... .. ..... .. ... ..... .. ... .... ... ..... .. ... ..... .. ..... .. ... ..... .. ..  5-33
Tab l e 5-5 Sc a n cha in  1 c el ls  ..... .. ..... .. ... ..... .. ..... .. ... ..... .. .......... .. ..... .. ... ..... .. ..... ... .. ..... .. ..... ... .. ..  5-36
Tab l e 5-6 SIZ E [ 1: 0 ] si gn a l e nc o d in g  ..... .. ... .... ... .......... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... ..  5-5 1
Tab l e 5-7 De b ug co n tr o l re g i s te r b it a ss ig n me n ts   ...... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ... ....  5-57
Table 5-8 Interrupt signal control  ............................................................................................  5-58
Table 6-1 ETM7 and ARM7TDMI- S (Rev 4) pin connectio ns ....... .. .. ...... .. ..... .. ... ..... .. ..... .. ... .....  6- 4
Table 7-1 Transaction types   ....................................................................................................  7-4
Tab l e 7-2 Ins tr u ction  cy cl e c oun ts  ... .. ..... ... .... ... .. ..... ... .... ... .. ..... ... .... ... .. ..... ... ......... ... ..... .. ... .... ..  7-5
Table 7-3 Branch instruction cycle operations ..........................................................................  7-7
Table 7-4 Thumb long branch with link ....... .. ..... .. ... ..... .. .......... .. ... ..... .. ..... .. ... ..... .. .. ...... .. .. ........  7-8
Table 7-5 Branch and exchange instruction cycle operations  ..... .............................................  7-9
Table 7-6 Data operati on instruction cycle operations ........... .. ......... ... .. ........... .. ..... ..... .. ........  7-10
Table 7-7 Mul ti ply instruct ion cycle operations ..... .... .......... ................. ..... ..... ..... ..... ..... ..... .....  7-12
Table 7-8 Mul ti ply-accumu late instr uction cycle operations .. ...... ................. .... ............. ..... .... .  7-12
Table 7-10 Mul tiply-accumu late long instr uction cycle operations ...................... ............ ..... .. ...  7-13
Table 7-9 Multiply lo ng instr uction cycle operation s  ........... .............. ........... .. ......... ... ..... .. ......  7-13
Table 7-11 Load register instruction cycle operations  ..............................................................  7-14
Table 7-12 Store register instruction cycle operations ..............................................................  7-16
Table 7-13 Load multiple registers instruction cycle operations ...............................................  7-17
Table 7-14 St ore multiple registers in struction cycle operations ..... .. .................. ............ ..... .....  7-19
Table 7-15 Dat a swap instr uction cycle oper ations  .. ..... ..... ..... .. ......... ... ..... .. ............... ..... ..... ...  7-20
Table 7-16 Software interrupt instruction cycle operations .......................................................  7-21
Table 7-17 Copr ocessor data operation ins truction cycle operations .... ..... ..... .. ............... ..... ...  7-22
Table 7-18 Load coprocessor regi ster instruct ion cycle operations ..... .. ..... ..... ..... ..... ..... ..... .....  7-23
Table 7-19 Store copr ocessor  register instruction cycle operations .................... .....................  7-25
Table 7-20 Coprocessor register transfer (MRC) ......................................................................  7-27
Table 7-21 Coprocessor register transfer (MCR) ......................................................................  7-28
Table 7-22 Undefined i nstructi on cycle operations ............. .... ... ......... ... ..... .. ............... ..... ..... ...  7-29
Table 7-23 Unexecuted instruction cycle operations ................................................................  7-30
Table 8-1 Provisional AC parameters .......................................................................................  8-8
Table A-1 Signal  descriptions  ............ ..... .. .......... .. ........ ..... .. ..... .. .......... .. ........ ..... .. ..... .. ...... .. ..... A-2
Table B-1 ARM7TDMI-S processor signal s and ARM 7TDMI hard macrocell equivalents ..... .. . B-2
Table B-2 Unimplemented ARM7TDMI pr ocessor signals ........................................................ B-9

ARM DDI 0234A
Copy right © 20 01 AR M Limited. A ll rights reserved.
ix
List of Figures
ARM7TDMI-S  Technical Reference Manual
Key to timing diagram conventions  ............................................................................ xiv
Fig u re 1- 1 Th e in s tr uc t io n  pip e lin e   ..... ... .. ..... ... .... ... .. ..... ... .... ... .. ..... ... ..... .. .. ..... ... .. ..... .. ..... ... .. ..... 1-2
Figure 1-2 ARM7TDMI-S block diagram  .................................................................................... 1-6
Figure 1-3 ARM7TDMI-S core .................................................................................................... 1-7
Figure 1-4 ARM7TDMI-S functional diagram  ............................................................................. 1-8
Figure 2-1 Big-endian addresse s of byt es withi n words  ......... .. ........ ..... .. ..... ..... .. ..... .. ..... .. ........ . 2-4
Figure 2-2 Little- endian addresses of byt es withi n words ...... ... ........ ..... ......... ..... .. ........ ..... ..... .. . 2-5
Figure 2-3 Register organi zation in ARM state ........ .. ...... .. ..... .. ........ ..... .. ..... ..... .. ..... .. ..... .. ....... 2-11
Figure 2-4 Register organization in Thumb state  ........ .............................................. ............... 2-13
Figure 2-5 Mapping of Thum b state re gister s onto ARM state regi sters ... .. ...... .. ............... .. .... 2-14
Figure 2-6 Program status register format ................................................................................ 2-16
Figure 3-1 Simple memory cycle ........... ..... ................. ..... ...................... .............. ..... ................. 3-4
Figure 3-2 Nonsequential memory cycle ..................... ................................................... .......... .. 3-6
Figure 3-3 Back to back memory cycles  ................. ..... ................. ..... ...................... .............. ..... 3-6
Figure 3-4 Sequential access cycles .......................................................................................... 3-8
Figure 3-5 Merged I-S cycl e  .. .. ...... .. ..... .. ..... .. .......... .. ...... .. ..... .. ..... .. ...... .. ..... .. ..... .. .......... ..... .. .... 3 -9
Figure 3-6 Data replication  ....................................................................................................... 3- 16
Fig u re 3- 7 Us e o f CLK E N ..... .......... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. .......... .. ..... ... 3-17
Fig u re 4- 1 Co p ro c es s o r bus y-wa it  se q ue n c e  ...... ... .. ..... ... .... ... .. ..... ... ..... .. .. ..... ... ..... .. .. ..... ... ..... .. 4 -7
Fig u re 4- 2 Co p ro c es s o r re g is te r tr a ns f er  se q ue n c e  ...... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... 4 -8
Figure 4-3 Coprocessor data operation sequence  ...... ........................... ........................ ..... ....... 4-9
Figure 4-4 Coprocessor load sequence  ..... ............................. .......... ............................. .......... 4-10
Figure 4-5 Coprocessor connections  .......... ............................. .......... ............................. .......... 4-11

List of Figures
x
Copyright © 20 01 ARM Limited. All r ights reserved.
ARM DDI 0234A
Fig u re 5- 1 Ty pi ca l  de bu g  system  ...... .. ..... ... .. ..... .. ..... ... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ..  5 -3
Figure 5-2 ARM7TDMI-S block diagram ....................................................................................  5-5
Fig u re 5- 3 De b ug state  en tr y   .. ... ......... ... ..... .. .. ..... ... ..... .. .. ..... ... ..... .. .. ..... ... ..... .. ... .... ... .......... .. .... 5-8
Figure 5-4 Clock synchronization .............................................................................................  5-11
Figure 5-5 The ARM7TDMI-S core, TAP cont roll er, and EmbeddedICE-RT macrocel l ... .. ... ...  5-14
Figur e 5-6 DCC c ontrol register ......... ....... ... .. ....... ... .. ... .. ....... ... .. ... .. ....... ... .. ... .. ... .. .. ... .. ... .. ... .. .  5-20
Figure 5-7 ARM7TDMI-S scan chain arr angements .... ............................. .......... ....... ..... .........  5-24
Figure 5-8 Test access port controller state transitions  ...........................................................  5-26
Fig u re 5- 9 ID c od e  re g is te r fo rmat ...... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... ... .... ... .. ..... ... ....  5-31
Fig u re 5- 10 Sc a n timing  ..... .. ..... ... .... ... .. ..... ... ......... ... ..... .. .. ..... ... ..... .. .. ..... ... ..... .. ... .... ... ..... .. ... ....  5-36
Figure 5-11 Debu g exit  sequence ... .. ...... .. ..... ..... .. ..... .. ........ ..... ..... .. ..... ..... .. ..... ..... .. ..... .. ........ ...  5-43
Figure 5-12 EmbeddedICE-RT block diagram ...... .. ...... .. .... ... ..... .. ........ ..... ..... .. ..... ..... .. ..... .. ......  5-49
Figure 5-13 Watchpoint control value, and mask format ....... .......... ....... ..... ...............................  5-50
Fig u re 5- 14 De b ug a bo r t st at u s re g is te r  .... ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ... ..... .. ..... .. ... ..... .. ..  5-56
Fig u re 5- 15 De b ug co n tr o l re g i s te r fo rmat ...... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... ... .. ..... .. ..... ... .. ..  5-57
Figure 5-16 Debug status register format  ..................................................................................  5-60
Fig u re 5- 17 De b ug co n tr o l an d  st at u s re g is te r  str uc ture  .... ... ..... .. ... .... ... ..... .. ... ..... .. ..... .. ... ..... .. ..  5-61
Fig u re 8- 1 Tim i n g p ar a m e te rs  fo r data acc e s se s  . ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... .. ..  8-3
Fig u re 8- 2 Co p ro c e ss o r timing  ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... ... ......... ... ..... .. .. ..  8-4
Fig u re 8- 3 Ex ce p ti o n a nd co n fi g ur a tio n  in pu t  tim in g  .... .. ..... .. ... ..... .. ..... .. ... ..... .. ... .... ... ..... .. ... .... ..  8-5
Fig u re 8- 4 De b ug timin g  ..... ... .. ..... .. ..... ... .. ..... .. ..... ... .. ..... .. ... ..... .. ..... .. ... ..... .. ..... ... .. ..... .. ..... ... .. .. ..  8-6
Fig u re 8- 5 Sc a n timing  ..... .. ..... ... .... ... .. ..... ... .... ... .. ..... ... ......... ... ..... .. .. ..... ... ..... .. ... .... ... ..... .. ... ......  8-7

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

Preface

This pre fa ce in troduce s the ARM7TDMI-S proc essor and i ts ref erence doc umentat ion.

It contains the foll owing sections:

•About this document on page xii

•Feedback on pag e xvi.

Preface

xii

ARM DDI 0234A

About this document

This document is a reference ma nual for the ARM7TDMI-S processor.

Intended audie nce

This docu ment has be en writte n for expe rienc ed hardwa re and softwa re engin eers who

might or might not have experience of ARM produc ts.

Organization

This document is organized into the foll owing chapters:

Chapter 1 Introduction

Read thi s chap ter for an int r oduction to the ARM7TDMI-S proc essor.

Chapter 2 Programmer’s Model

Read thi s chapter for a desc ription of the 32-bit ARM and 16-bit Thumb

instruction sets.

Chapter 3 Memory Interface

Read this chapter for a description of the nonse quential, sequential,

internal, and c o p roc essor register tr ansfer memory cycles.

Chapter 4 Coproce sso r In terface

Read this chapter for information about im plementing spec ialized

add itional instructions for use with coproce ssors.

Chapter 5 Debugging Your System

Read this chapter for a de scription of the ARM7TDMI-S processor

hardware extensions for advanced debugging.

Chapter 6 ETM Interface

Read this chapter for information about connecting an ETM7 to an

ARM7TDMI-S processor.

Chapter 7 Instruction Cycle Timings

Read thi s chap ter for a descript ion of the inst ruction cy cle timings fo r the

ARM7TDMI-S processor.

Chapter 8 AC Parameters

Read t his c hapte r for the A C para meters timi ng diag rams and def init ion s.

Preface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

xiii

Appendix A Signal Descriptions

Read this chapter for a list of all ARM7TDMI-S processor signa ls.

Appendix B Differences Between the ARM7T D MI-S and the ARM7TDMI

Read this chapter for a description of the differences between the

ARM7TDMI-S processor and the ARM7TDMI ha rd macrocell with

reference to int erfac e signals, scan interface signals , ti mi ng paramet ers,

and design considerations.

Typographical conven tions

The fol lowing typographical conventions are use d in this docum ent:

bold Highlights ARM processor signal n ames with in text, and int erface

elements such as menu names. Can als o be used for emphasis in

descriptiv e lis ts where appropriate.

italic H ighlights specia l terminology, cross-references and ci tations.

monospace

Denotes text that ca n be entered at the keyboard, such as

commands, f ile names and program names , and source code.

monospace

Denotes a pe rmi tted abbreviation for a command or option. T he

underlined text can be entered inst ea d of the full command or

option name.

monospace italic

Denotes arguments to commands or functions where the argument

is to be replaced by a specific value.

monospace bold

De notes language keywords when use d outside example code.

Tim in g di agram c onvent io ns

This ma nual contains several timing diagrams . The following key explains t he

components us ed in thes e di agr ams. Any v ariations a re clearly labeled wh en t hey occ ur .

There f ore, no additional meaning must be attached unless specifically stated.

Preface

xiv

ARM DDI 0234A

K ey to ti ming diagram con ventions

Sha ded bus and signal areas are unde fined, so the bus or signal can a ssume any value

within t he s haded area at that time. The actual level is unimportant and does not affect

nor ma l operation.

Further read ing

This section lists publications by ARM Limited, and by third parties .

If you would like further informa tion on ARM pr oducts, or if you have questions not

an swered by thi s doc u m ent , ple a se co ntact

info@arm.com

or visit our web site at

http://www.arm.com

ARM publications

This document co ntains infor ma tion that is specific t o the ARM7TDMI - S pr ocessor.

Refer to the following documents for other relevant information:

•ARM Architecture Reference Manu al (ARM DDI 0100)

•ARM7TDMI Technical Reference Manual (ARM DDI 0029)

•ETM7 (R ev 1) Technical Reference Manual (ARM DDI 0158).

Clock

Bus stable

HIGH to LOW

Transient

Bus to high impedance

Bus change

HIGH/LOW to HIGH

High impedance to stable bus

Heavy line indicates region of interest

Preface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

Oth er publ i c atio ns

This se ction lists rel ev ant documents p ublished by third parties.

•IEEE Std. 1149.1-1990, Standard Test Access Port and Boundary-Scan

Architecture.

Preface

xvi

ARM DDI 0234A

Feedback

ARM Limited welcomes fe edback both on the ARM7TDMI-S processor, and on the

documentation.

Feedback on this document

If you have any com men ts on this document, plea se send email to

errata@arm.com

giving:

•th e docume nt title

•the document number

•the pa ge number(s) to which your comm ents re fer

•a concise expl anation of your comments.

General suggestions for a dditions and improvements are al so welcome.

Feedback on the ARM7TDMI-S processor

If you have any pr oblems with the ARM7TDMI-S proc es s or, please cont ac t your

supplier giving:

•the product na me

•details of the platform you are running on, including the ha rdware platform,

operating system type and version

•a small standalone sample of code that reproduces the problem

•a clear explana tion of what you expec ted to happen, and wha t ac tually happened

•the commands you used, including any command-line options

•sample code output illustrating the problem.

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

1-1

Chapter 1

Introduction

This chapter introduces the ARM7TDMI-S processor. It contains the following

sections:

•About the ARM7TDMI-S processor on pag e 1-2

•ARM7T DMI-S arch itecture on page 1-4

•ARM7T DMI-S block, core and funct ional diagrams on page 1-6

•ARM7TDMI-S instruction set summary on page 1-9

•Difference s be tween Re v 3a and Rev 4 on pa g e 1- 22 .

Introduction

1-2

ARM DDI 0234A

1.1 About the ARM7TDMI-S processor

The ARM7TDMI-S proc essor is a member of the ARM family of general-purpose

32- bit microprocessors. The ARM family o ffers high performance for very low-power

consumption and gate count.

The A R M architectur e is based on Reduced Ins truction Set Computer (RISC)

principles. Th e RI SC inst r u ction set, and related deco de mechani sm are much simpler

th an those of Comple x Inst ruction Se t Comput er (CISC) designs. This simplicity gives:

•a high ins truction throughput

•an excellent real-time int errupt respons e

•a sma l l, cost -e ffe ct ive, p rocessor macro ce ll .

1.1.1 The instruction pipeline

The ARM7TDMI-S processor uses a pipeline to increase the speed of the flow of

instructions to the processor. This enables several ope rations to take plac e

simultaneously, and the process ing, and memory systems to ope rate continuous ly.

A three-stage p ip eline is u sed, so instr u ctions ar e executed in three stag es:

•Fetch

•Decode

•Execute.

The three-s tage pipeline is shown in Figure 1-1.

Figure 1-1 The instruction pipeline

ARM Thumb

PC - 4

PC - 8

PC - 2

PC - 4

Fetch

Decode

Execute

The instruction is fetched from memory

The registers used in the instruction are decoded

The registers are read from the register bank

The shift and ALU operations are performed

The registers are written back to the register bank

Introduction

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

1-3

Note

The Program Counter (P C) points to the instruction being fetched rathe r than to the

inst ruction being e xecuted.

During normal op erati on, whi le one instru ction is bei ng ex ecute d, i ts s ucces sor i s be ing

decoded, and a third instruction is being fetched from memory.

1.1.2 Memor y access

The ARM7TDMI-S processor has a Von Neumann architec ture, with a single 32-bit

data bus carryin g both ins tru ctions and data. Only load, st ore, an d sw ap instru cti ons can

access d ata from me mory.

Data c an be 8-bit bytes, 16-bit halfwords, or 32-bit words. Words must be al igned to

4-byte boundarie s. Halfwords must be aligned to 2-byte boundaries.

1.1.3 Memor y interface

Th e mem o ry interface of the ARM7TD MI-S processo r enables performan ce pot en tial

to be realized, while minim izing the use of memory. Speed-c ritical control signals are

pipelined to allow system control functions to be implemented in s tandard low-powe r

logic. T hes e control signals facilitate th e exploitation of the fas t-burst ac cess modes

supported by m any on-chip and off-chip memory technologies.

The ARM7TDMI-S proc essor has four basic types of memory cycle:

•internal cycle

•nonsequential cycle

•sequential cycle

•coprocessor register transfer cycle.

Introduction

1-4

ARM DDI 0234A

1.2 ARM7TDMI-S architecture

The ARM7TDMI-S processor has two instruction sets:

•the 32-bit ARM instruct ion set

•the 16-bit Thumb i nst ruction set.

The ARM7TDMI-S p ro cessor is an i mplemen tation o f the ARM architecture v4T. F o r

full details of both the ARM and Th umb instruction se ts, see the ARM Architect u re

Ref erence Manual.

1.2.1 Instruction comp ression

Micropr ocessor architectures tradition ally had the same width fo r instructions and da ta.

There fore, 32-bit archite ctures had higher performance manipulating 32-bit dat a and

co u l d addre ss a large address space mu ch more ef ficientl y than 16-bit architectures.

16- bit architectures typically had higher code dens ity than 32-bit architectures, and

greater th an ha lf the performance.

Thumb impl em ents a 16-bit instruction set on a 32-bit architectur e to provide:

•higher performance tha n a 16-bit architecture

•higher code density than a 32-bit architecture.

1.2.2 The Thum b instru ction set

The Thumb instruction se t is a subset of the most commonly used 32-bit ARM

inst ructi ons. Thum b i nstructi ons a re eac h 16 bit s lon g, and ha v e a c orres ponding 32 -bit

ARM instruction that has the same ef fec t on the processor model.

Thumb instructions operate with t he s tandard ARM register conf iguratio n, al lowing

excellent interoperability between ARM and Thumb states.

On execution, 16-bit Thumb instructions are transparentl y decompressed to full 32-bit

ARM instructions in real time, witho ut performance lo ss.

Thumb has all the a dvantages of a 32-bit core:

•32-bit address space

•32-bit r egi s ter s

•32-bit shifter and Arithmetic Logic Unit (ALU)

•32- bit memor y transfer.

Thumb the refore offe rs a long b ranc h range, powerf ul arit hmetic oper ati ons, and a large

address space.

Introduction

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

1-5

Thumb code is typica lly 65% of the size of the ARM code and provides 160% of the

perform ance of ARM c ode when runni ng on a proce ssor con necte d to a 16 -bit memory

system . Thumb, therefore, makes the ARM7T DMI-S processor ide ally suited to

embedded applicat ions with restricted memory bandwidth, where co de density is

important.

The av a ilabi li ty of both 16- bit Thumb and 32-bi t ARM instruc tion sets giv e s designe rs

the flexibility to emp hasize performance, or code s ize on a s ubroutine level, a ccording

to the requirements of their applications. For example, critical loops for applications

suc h as f ast int er rupts and DSP a lgo rithms can be c oded using the f ull ARM ins truct ion

set and linked with Thumb code.

Introduction

1-6

ARM DDI 0234A

1.3 ARM7TDMI-S block, core and functional diagrams

The ARM7TDMI-S processor arch itecture, core, and functional diagrams are

illustrated in the fol lowing figures:

•the ARM7TDM I-S bloc k dia gram is shown in Figure 1-2

•the ARM7T DMI -S core is shown in Figure 1-3 on page 1-7

•the ARM7T D MI-S functional diagra m is shown in F igure 1-4 on page 1-8.

Figure 1-2 ARM7TDMI-S block diagr am

Note

There are no bidirectional paths on the data bus. These a r e s hown in Figure 1-2 for

simplicity.

EmbeddedICE-RT

macrocell

CPU

DBGRNG(0)

DBGRNG(1)

DBGEXT(0)

DBGEXT(1)

EmbeddedICE-RT

TAP controller

Data bus

ADDR[31:0]

LOCK

WRITE

SIZE[1:0]

PROT[1:0]

TRANS[1:0]

WDATA[31:0]

RDATA[31:0]

Scan chain 2

DBGTDI

DBGnTRST

DBGTMS

DBGTCKEN

DBGTDO

Scan chain 1

Coprocessor

interface signals

Introduction

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

1-7

Figure 1-3 ARM7TDMI- S core

Address register

Address

incrementer

Write data register

31 x 32-bit registers

(6 status registers)

32 x 8

multiplier

Barrel shifter

32-bit ALU

Instruction pipeline

Read data register

Thumb instruction decoder

Scan debug

control

Instruction

decoder and

control logic

CLK

CLKEN

CFGBIGEND

nIRQ

nFIQ

nRESET

ABORT

CP control

CP handshake

DBG inputs

DBG outputs

TRANS[1:0]

PROT[1:0]

SIZE[1:0]

WRITE

LOCK

WDATA[31:0] RDATA[31:0]

ADDR[31:0]

A bus

ALU bus

PC bus

B bus Incrementer bus

Introduction

1-8

ARM DDI 0234A

Figure 1 -4 ARM7TDMI-S functional diagram

CPB

CPA

CPnI

CPTBIT

CPSEQ

CPnMREQ

CPnOPC

CPnTRANS

TRANS[1:0]

PROT[1:0]

SIZE[1:0]

WRITE

ABORT

RDATA[31:0]

WDATA[31:0]

ADDR[31:0]

DBGTDO

DBGnTDOEN

DBGnTRST

DBGTDI

DBGTMS

DBGTCKEN

Memory

interface

Debug

Synchronized

EmbeddedICE-RT

scan debug

Access port

Memory

management

interface

Coprocessor

interface

Arbitration

Bus control

Interrupts

Clock

DBGCOMMTX

DBGCOMMRX

DBGRNG[0]

DBGRNG[1]

DBGEN

DBGEXT[0]

DBGEXT[1]

DBGnEXEC

DBGACK

DBGBREAK

DBGRQ

LOCK

CFGBIGEND

nRESET

nFIQ

nIRQ

CLKEN

CLK

DBGINSTRVALID

ARM7TDMI-S

processor

DMORE

Introduction

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

1-9

1.4 ARM7TDMI-S instruction set summary

This section provides a summar y of the ARM and Thumb instruction set s:

•ARM in s truc ti on sum ma ry on page 1-10

•Thumb instruction summary on page 1-17.

A key to the inst ruction set ta bles i s given in Table 1-1.

The AR M 7 TD M I - S pr o c essor is an im p l ement a t ion of th e ARMv4 T ar ch it ect ure . Fo r

a complete description of both instruction sets, see the AR M Architec ture Re ference

Manual.

Table 1-1 K ey to tables

Instruction Description

{cond}

See Tabl e 1-1 1 o n pag e 1- 17 .

See Table 1- 9 on page 1-16.

{field}

See Tabl e 1-1 0 o n pag e 1- 16 .

Sets condition codes (optional).

Byte operation (optional).

Ha lfword ope ration (optional).

F orces add ress translation. Cannot be used with

pr e -ind exe d ad dre s ses.

<a_mode2>

See Table 1- 3 on page 1-13.

<a_mode2P>

See Table 1- 4 on page 1-14.

<a_mode3>

See Table 1- 5 on page 1-14.

<a_mode4L>

See Table 1- 6 on page 1-15.

<a_mode4S>

See Table 1- 7 on page 1-15.

<a_mode5>

See Table 1- 8 on page 1-15.

#32bit_Imm

A 32- bit constant, form ed by right -rotating an 8-bit

value by an even numb er o f bits.

A comma-separated list of re gister s, enclo sed i n

braces ( { and } ).

Introduction

1-10

ARM DDI 0234A

1.4.1 ARM instruction summary

The ARM instruction set summa ry is shown in Table 1-2.

Table 1-2 ARM instr uction summary

Operation Description Assembler

Move Move

MOV{cond}{S} Rd, <Oprnd2>

Move NO T

MVN{cond}{S} Rd, <Oprnd2>

Move SPSR to register

MRS{cond} Rd, SPSR

Move CPSR to register

MRS{cond} Rd, CPSR

Mov e registe r to SPSR

MSR{cond} SPSR{field}, Rm

Move register to CPSR

MSR{cond} CPSR{field}, Rm

Move immediate to

SPSR flags

MSR{cond} SPSR_f, #32bit_Imm

Move immediate to

CPSR flags

MSR{cond} CPSR_f, #32bit_Imm

Arithmetic Add

ADD{cond}{S} Rd, Rn, <Oprnd2>

Add with carry

ADC{cond}{S} Rd, Rn, <Oprnd2>

Subtract

SUB{cond}{S} Rd, Rn, <Oprnd2>

Subtract wit h carry

SBC{cond}{S} Rd, Rn, <Oprnd2>

Subtract re verse sub tract

RSB{cond}{S} Rd, Rn, <Oprnd2>

Subtract re verse sub tract

with carry

RSC{cond}{S} Rd, Rn, <Oprnd2>

Multiply

MUL{cond}{S} Rd, Rm, Rs

Multiply accumulate

MLA{cond}{S} Rd, Rm, Rs, Rn

Multiply unsigned long

UMULL{cond}{S} RdLo, RdHi, Rm, Rs

Multiply unsigned

accumulate long

UMLAL{cond}{S} RdLo, RdHi, Rm, Rs

Multiply signed long

SMULL{cond}{S} RdLo, RdHi, Rm, Rs

Multiply signed

accumulate long

SMLAL{cond}{S} RdLo, RdHi, Rm, Rs

Compare

CMP{cond} Rd, <Oprnd2>

Introduction

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

1-11

Co m p are n ega tive

CMN{cond} Rd, <Oprnd2>

Logical Test

TST{cond} Rn, <Oprnd2>

Test equivalence

TEQ{cond} Rn, <Oprnd2>

AND AND{cond}{S} Rd, Rn, <Oprnd2>

EOR EOR{cond}{S} Rd, Rn, <Oprnd2>

ORR ORR{cond}{S} Rd, Rn, <Oprnd2>

Bit clear

BIC{cond}{S} Rd, Rn, <Oprnd2>

Branch Branch

B{cond} label

Br an ch with link

BL{cond} label

Branch and exchange

instruction set

BX{cond} Rn

Load Word

LDR{cond} Rd, <a_mode2>

Word with user-mode

privilege

LDR{cond}T Rd, <a_mode2P>

Byte

LDR{cond}B Rd, <a_mode2>

Byte with user-mode

privilege

LDR{cond}BT Rd, <a_mode2P>

Byte signed

LDR{cond}SB Rd, <a_mode3>

Halfword

LDR{cond}H Rd, <a_mode3>

Halfword signed

LDR{cond}SH Rd, <a_mode3>

Multiple block

data op era t i o n s In crement before

LDM{cond}IB Rd{!}, <reglist>{^}

In crement after

LDM{cond}IA Rd{!}, <reglist>{^}

De cre ment befor e

LDM{cond}DB Rd{!}, <reglist>{^}

De cre ment af te r

LDM{cond}DA Rd{!}, <reglist>{^}

Stack operations

LDM{cond}<a_mode4L> Rd{!}, <reglist>

Stack operations and

restore CPSR

LDM{cond}<a_mode4L> Rd{!}, <reglist+pc>^

Table 1-2 ARM instruction sum m ary (con ti nued)

Operation Description Assembler

Introduction

1-12

ARM DDI 0234A

User register s

LDM{cond}<a_mode4L> Rd{!}, <reglist>^

Store Word

STR{cond} Rd, <a_mode2>

Word with User- mode

privilege

STR{cond}T Rd, <a_mode2P>

Byte

STR{cond}B Rd, <a_mode2>

Byte with User-mode

privilege

STR{cond}BT Rd, <a_mode2P>

Halfword

STR{cond}H Rd, <a_mode3>

Multiple

Block data operations

In crement before

STM{cond}IB Rd{!}, <reglist>{^}

In crement after

STM{cond}IA Rd{!}, <reglist>{^}

Decr eme nt before

STM{cond}DB Rd{!}, <reglist>{^}

Decr emen t after

STM{cond}DA Rd{!}, <reglist>{^}

Stack operations

STM{cond}<a_mode4S> Rd{!}, <reglist>

User register s

STM{cond}<a_mode4S> Rd{!}, <reglist>^

Swap Word

SWP{cond} Rd, Rm, [Rn]

Byte

SWP{cond}B Rd, Rm, [Rn]

Coprocessors Dat a operations

CDP{cond} p<cpnum>, <op1>, CRd, CRn, CRm, <op2>

Move to ARM register

from coprocessor

MRC{cond} p<cpnum>, <op1>, Rd, CRn, CRm, <op2>

Move to coprocessor

from ARM re gister

MCR{cond} p<cpnum>, <op1>, Rd, CRn, CRm, <op2>

Load

LDC{cond} p<cpnum>, CRd, <a_mode5>

Store

STC{cond} p<cpnum>, CRd, <a_mode5>

Software

Interrupt

SWI 24bit_Imm

Table 1-2 ARM instruction sum m ary (continued)

Operation Description Assembler

Introduction

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

1-13

Addr essing mode 2,

<a_mode2>

, is shown in Table 1-3.

Table 1-3 Addressing mode 2

Operation Assembler

Immediate offset

[Rn, #+/-12bit_Offset]

Regis ter offset

[Rn, +/-Rm]

Scaled register offset

[Rn, +/-Rm, LSL #5bit_shift_imm]

[Rn, +/-Rm, LSR #5bit_shift_imm]

[Rn, +/-Rm, ASR #5bit_shift_imm]

[Rn, +/-Rm, ROR #5bit_shift_imm]

[Rn, +/-Rm, RRX]

Pre-indexed immediate offset

[Rn, #+/-12bit_Offset]!

Pre-indexed register offset

[Rn, +/-Rm]!

Pre-indexed scaled register offset

[Rn, +/-Rm, LSL #5bit_shift_imm]!

[Rn, +/-Rm, LSR #5bit_shift_imm]!

[Rn, +/-Rm, ASR #5bit_shift_imm]!

[Rn, +/-Rm, ROR #5bit_shift_imm]!

[Rn, +/-Rm, RRX]!

Post-indexed immediate offset

[Rn], #+/-12bit_Offset

Post-indexed register offset

[Rn], +/-Rm

Post-indexed scaled register offset

[Rn], +/-Rm, LSL #5bit_shift_imm

[Rn], +/-Rm, LSR #5bit_shift_imm

[Rn], +/-Rm, ASR #5bit_shift_imm

[Rn], +/-Rm, ROR #5bit_shift_imm

[Rn, +/-Rm, RRX]

Introduction

1-14

ARM DDI 0234A

Addres s ing m ode 2 (privileged),

<a_mode2P>

, is shown in Table 1-4.

Addres sing mode 3 (signed byte, and halfw ord data transf er),

<a_mode3>

, is sh ow n in

Table 1-5.

Table 1 -4 Addressing mode 2 (privi leged)

Operation Assembler

Im mediate of fset

[Rn, #+/-12bit_Offset]

[Rn, +/-Rm]

Scaled register offset

[Rn, +/-Rm, LSL #5bit_shift_imm]

[Rn, +/-Rm, LSR #5bit_shift_imm]

[Rn, +/-Rm, ASR #5bit_shift_imm]

[Rn, +/-Rm, ROR #5bit_shift_imm]

[Rn, +/-Rm, RRX]

Post-indexed immediate

offset

[Rn], #+/-12bit_Offset

Post-indexed register offset

[Rn], +/-Rm

P ost-ind exed scaled regist er

offset

[Rn], +/-Rm, LSL #5bit_shift_imm

[Rn], +/-Rm, LSR #5bit_shift_imm

[Rn], +/-Rm, ASR #5bit_shift_imm

[Rn], +/-Rm, ROR #5bit_shift_imm

[Rn, +/-Rm, RRX]

Table 1-5 Addressing mode 3

Operation Assembler

Immediate offset

[Rn, #+/-8bit_Offset]

Pre-indexed

[Rn, #+/-8bit_Offset]!

Post-indexed

[Rn], #+/-8bit_Offset

Introduction

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

1-15

Addr essing mode 4 (load),

<a_mode4L>

, is shown in Table 1-6.

Addr essing mode 4 (store),

<a_mode4S>

, is shown in Table 1-7.

Addr essing mode 5 (coprocessor data trans fer),

<a_mode5>

, is sho wn in Table 1-8.

[Rn, +/-Rm]

Pre-indexed

[Rn, +/-Rm]!

Post-indexed

[Rn], +/-Rm

Table 1-6 Addressi ng mode 4 (load )

Addressing mode Stack type

IA I ncrement after FD Full descending

IB Increment bef ore ED Empty descending

DA Decrem ent af te r FA F u ll ascendin g

DB Decrement before EA Empty ascending

Table 1-7 Addressing mode 4 (store)

Addressing mode Stack type

IA I ncr emen t af te r EA Em p ty asc e nd ing

IB I ncr emen t be fo r e FA Fu ll ascending

DA Decrement after ED Empty descending

DB De cremen t be for e FD F ull de sc end i ng

Table 1-8 Addressing mode 5

Operation Assembler

Im mediate of fset

[Rn, #+/-(8bit_Offset*4)]

Pre-indexed

[Rn, #+/-(8bit_Offset*4)]!

Post-indexed

[Rn], #+/-(8bit_Offset*4)

Table 1-5 Addressing mode 3

Operation Assembler

Introduction

1-16

ARM DDI 0234A

Operand 2,

, is shown in Table 1-9.

Fields,

{field}

, are show n in Table 1-10.

Table 1-9 Operand 2

Operation Assembler

Im m ediate v alue

#32bit_Imm

Logical shift left

Rm LSL #5bit_Imm

Logical shift right

Rm LSR #5bit_Imm

Arithmetic shift right

Rm ASR #5bit_Imm

Rotate right

Rm ROR #5bit_Imm

Logical shift left

Rm LSL Rs

Logical shift right

Rm LSR Rs

Arithmetic shift right

Rm ASR Rs

Rotate right

Rm ROR Rs

Rotate right extended

Rm RRX

Table 1- 10 Fields

Suffix Sets

_c Control field mask bit (bit 3)

_f Flags field mask b it (bit 0)

_s S tatus field ma sk bit (bit 1)

_x Extension field mask bit (bit 2)

Introduction

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

1-17

Condition fields,

{cond}

, a re show n in Tab le 1 - 11.

1.4.2 Thumb instruction summary

The Thumb instruction se t summary is shown in Table 1-12.

Table 1 -11 Condi ti on fields

Suffix Description

Equal

Not equal

Unsi gned highe r, or same

Unsigned lower

Negative

Positive, or zero

Overflow

No ove rflow

Unsi gned highe r

Unsigned lo wer, or same

Greater, or equal

Less than

Greater than

Less than, or equal

Always

Table 1 -12 Thumb instr uction summ ary

Operation Assembler

Move Immediate

MOV Rd, #8bit_Imm

High to Low

MOV Rd, Hs

Low to High

MOV Hd, Rs

High to Hi gh

MOV Hd, Hs

Introduction

1-18

ARM DDI 0234A

Arithmetic Add

ADD Rd, Rs, #3bit_Imm

Add Low and Lo w

ADD Rd, Rs, Rn

Add High to Low

ADD Rd, Hs

Add Low to High

ADD Hd, Rs

Add High to High

ADD Hd, Hs

Add Immediate

ADD Rd, #8bit_Imm

Add Value to SP

ADD SP, #7bit_Imm ADD SP, #-7bit_Imm

Add with carry

ADC Rd, Rs

Subtract

SUB Rd, Rs, Rn SUB Rd, Rs, #3bit_Imm

Subtract Immediate

SUB Rd, #8bit_Imm

Subtract with carry

SBC Rd, Rs

Negate

NEG Rd, Rs

Multiply

MUL Rd, Rs

Compar e Low and Low

CMP Rd, Rs

Compare Low and Hi gh

CMP Rd, Hs

Compare Hig h and Low

CMP Hd, Rs

Compare High and Hi gh

CMP Hd, Hs

Compare Negative

CMN Rd, Rs

Compare Immediate

CMP Rd, #8bit_Imm

Table 1-12 Thum b instr uction summary (continued)

Operation Assembler

Introduction

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

1-19

Logical AND

AND Rd, Rs

EOR

EOR Rd, Rs

ORR Rd, Rs

Bit cl ea r

BIC Rd, Rs

Move NOT

MVN Rd, Rs

Te st b its

TST Rd, Rs

Shift/Rotate Logical shift left

LSL Rd, Rs, #5bit_shift_imm LSL Rd, Rs

Logical shift right

LSR Rd, Rs, #5bit_shift_imm LSR Rd, Rs

Arithmetic shift right

ASR Rd, Rs, #5bit_shift_imm ASR Rd, Rs

Rotate right

ROR Rd, Rs

Branch Conditional

If Z set

BEQ label

If Z clear

BNE label

If C set

BCS label

If C clear

BCC label

If N set

BMI label

If N clear

BPL label

If V set

BVS label

If V clear

BVC label

If C set and Z clear

BHI label

If C clear and Z set

BLS label

If N set and V s et, or

if N cl ear and V clear

BGE label

If N se t and V clear, or

if N cl ear and V set

BLT label

Table 1 -12 Thumb instr uction summary (con ti nued)

Operation Assembler

Introduction

1-20

ARM DDI 0234A

If Z cl ea r a nd N or V set,

if Z clear , and N or V

clear

BGT label

If Z se t, or

N set and V clea r, or

N clea r and V set

BLE label

Unconditional

B label

Long branch with link

BL label

Opti onal state change -

To addre ss hel d i n Lo re g

BX Rs

To addr ess held in H i reg

BX Hs

Load With immediate offset

Word

LDR Rd, [Rb, #7bit_offset]

Halfword

LDRH Rd, [Rb, #6bit_offset]

Byte

LDRB Rd, [Rb, #5bit_offset]

With regist er off set

Word

LDR Rd, [Rb, Ro]

Halfword

LDRH Rd, [Rb, Ro]

Signed half word

LDRSH Rd, [Rb, Ro]

Byte

LDRB Rd, [Rb, Ro]

Signed byte

LDRSB Rd, [Rb, Ro]

PC-relative

LDR Rd, [PC, #10bit_Offset]

SP-relative

LDR Rd, [SP, #10bit_Offset]

Address

Using PC

ADD Rd, PC, #10bit_Offset

Using SP

ADD Rd, SP, #10bit_Offset

Multiple

LDMIA Rb!, <reglist>

Table 1-12 Thum b instr uction summary (continued)

Operation Assembler

Introduction

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

1-21

Store With immediate offset

Word

STR Rd, [Rb, #7bit_offset]

Halfword

STRH Rd, [Rb, #6bit_offset]

Byte

STRB Rd, [Rb, #5bit_offset]

With regist er off set

Word

STR Rd, [Rb, Ro]

Halfword

STRH Rd, [Rb, Ro]

Byte

STRB Rd, [Rb, Ro]

SP-relative

STR Rd, [SP, #10bit_offset]

Multiple

STMIA Rb!, <reglist>

Push/Pop Push re gisters onto stac k

PUSH <reglist>

Push LR and registers

onto stack

PUSH <reglist, LR>

Pop registers from stack

POP <reglist>

Pop registers and PC

from stack

POP <reglist, PC>

Software

Interrupt

SWI 8bit_Imm

Table 1 -12 Thumb instr uction summary (con ti nued)

Operation Assembler

Introduction

1-22

ARM DDI 0234A

1.5 Differences between Rev 3a and Rev 4

The c ha n g es in c or p o r at ed in t h e AR M 7T D M I -S (R ev 4) p r o c essor are sum m ar i zed in

th e f ollowing sections:

•Additi on of EmbeddedICE-RT logic

•Improved Debug Communications Channel (DCC) bandwidth on page 1-23

•Access to DCC through JTAG on page 1-23

•TAP controller I D register on page 1-23

•More efficient multipl e transfe rs on page 1 -24.

1.5 .1 A dd iti on of Embe dd e dI C E - RT logi c

Embedde dICE-RT is an enha nced imple ment ation of the Emb edd edICE logic tha t was

part of the ARM7TDMI-S (Rev 3) proce s sor. EmbeddedICE-RT enables you to

perform deb ugging in moni tor mode. In monitor mode, the core takes an exception upon

a breakpoint or watchpoint, rather than entering debug state as it does in halt mode .

If the core does not enter debug state whe n it encounters a w atchpoint or br ea kpoint, it

can con tinue to ser vice har dware interrupt requests as normal. Debugging in monit or

mode is e xtremely useful if the core for ms part of the feedback loop of a mechanical

system, where stopping the core can potent ially lead to system fa ilure.

For more details, see Chapter 5 Debugging Your System.

Power saving

When DBGEN is tied LOW, much of the EmbeddedICE-RT logic is disabled to keep

power cons um ption to a minimum.

Changes to the programmer’s model

The changes to the programmer’s model are as follows :

Debug cont rol r egiste r

Two new bi ts have bee n added:

Bit 4 Mo nitor mode ena ble. Use this to control how the

device rea cts on a breakpoint or w atchpoint:

•When set, the core takes the instruction or data

abort excepti on.

•Wh en cle ar, the co r e en t ers d ebug stat e.

Introduction

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

1-23

Bit 5 EmbeddedICE-RT disable. Use this when changing

watchpoints and breakpoints:

•When set, this bit disa bles bre akpoints and

watchpoints, enabling the breakpoint or

watchpoint re gisters to be prog rammed wit h new

values.

•When clear, the new brea kpoint or watchpoint

values bec om e operational.

For more information, s ee Debug control register on page 5-57.

Coproce sso r register ma p

A new regist er (R2) in the coprocess or register map indicate s

whether the p roc essor entered the Prefetch o r Data Abort

exception be cause of a real abort, or because of a breakpoi nt or

watchpoint. F or more details , see Abort status register on

page 5-56.

1.5.2 Improved Debug Communications Channel (DCC) bandwidth

In the ARM7T DMI-S (Rev 3) proc essor, two ac cesses t o scan chai n 2 we re requir ed to

read the DCC data. The first accessed the status bit, and the second accessed the data

itself.

To increas e DCC bandwidth, only one acces s is required to read both the data and the

sta tus bi t in the ARM7T DMI-S (Re v 4) proce ssor. T he status bit is now inc lud ed in the

least significant bit of the address field that is read from the scan chain.

The status bit in the DCC control regis ter is left unchanged to ensure backwa rds

compatibility.

For more information, see The debug communications channel on page 5-20.

1.5.3 Access to DCC through JTAG

The DCC control re gister c an be contr oll ed from the JTA G in terfa ce in ARM7TDMI-S

Rev 4. A processor write clears bi t 0, the dat a read control bit.

For more information, see The debug communications channel on page 5-20.

1.5.4 TAP controller ID register

The TAP controll er ID registe r valu e is now

0x7F1F0F0F

Introduction

1-24

ARM DDI 0234A

For more informat ion, see ARM7TDMI-S device identification (ID) code register on

page 5-31.

1.5.5 More efficient multiple transf ers

The ARM7TDMI-S (Re v 4) core pro vides an e xtra output signal, DMORE. Th is signal

impr oves the efficienc y of

LDM

and

STM

instructions. DMORE is HIGH when the next

dat a m e m o r y acce ss is foll owed by a seq u enti al data m e m o ry access.

For a full list of ARM7TDMI-S (Rev 4) signals, see Appendix A Signal Descriptions.

ARM DDI 0234A
Copy right © 20 01 AR M Limited. A ll rights reserved.
2-1
Chapter 2 
Programmer’s Model
This cha pter des cribes the programmer’s  model for the ARM7TDMI-S processor. It 
contains  the follow ing sections:
•About the programmer’s model on page 2-2
•Processor  operating states  on page 2-3
•Me mory formats on page 2-4
•Instruct ion length on page 2-6
•Da ta ty p es  on  pag e 2 -7
•Operating modes on page 2-8
•Registers on page 2-9
•The program status registers on page 2-16
•Exceptions on page 2-19
•Interrupt latencies on page 2-26
•Reset on pa ge 2-27 .

Programmer’s Model

2-2

ARM DDI 0234A

2.1 About the programmer’s model

The ARM7TDMI-S processor core imple ments ARM architec ture v4T, which include s

the 32-b it ARM instruc tion set a nd the 16-bit Th umb ins truction set. The prog rammer’s

model is described fully in the AR M Architec tu re Refe ren ce Ma nua l .

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-3

2.2 Processor operating states

The ARM7TDMI-S processor has two operating states:

ARM state 32-bit, word-aligned ARM instructions are exec uted in this state.

Thumb state 16-bit, halfword -aligned Thu mb instructions .

In Thu m b state, th e Pro gram Coun ter (PC) uses bit 1 to select betwee n alternate

halfwords.

Note

Transition between ARM and T humb states does not affect the proc essor mode or the

regi ster co n te nts.

2.2.1 Switching state

You can swi tch the operating st ate of th e ARM7TDMI-S core between ARM state and

Thumb state using the

instruction. This is described fully in the ARM Architect u re

Ref erence Manual.

All exce ption handling is performed in ARM st ate. If an exception occ urs in Th umb

state, the processor reve rts to ARM state. The transition back to Thumb state occurs

automatically on return.

Programmer’s Model

2-4

ARM DDI 0234A

2.3 Memory formats

The ARM7TDMI-S processor views memory as a linear collection of bytes numbere d

in ascending order from z ero:

•bytes 0 to 3 hold the first stored word

•bytes 4 to 7 hold the second stored word

•bytes 8 to 11 hold the third stored word.

The ARM7TDMI-S processor can trea t words in memory as being stored in one of :

•Big-e ndian format

•Li ttle - endian fo r m a t .

2.3.1 Big-endian format

In big-endian format, the ARM7TDMI-S proc essor stores the most si gnificant byte of

a word at th e lowest-nu mbered byte, a nd the lea st signi ficant byte at the

highest-number ed byte. So byt e 0 of t he memory system conne ct s to data line s 31 to 24.

This is show n in Figure 2-1.

Figure 2-1 Big-endi an addresses of b ytes within words

2.3.2 Little-endian format

In little-endian fo r ma t, t he lowes t-numbere d byte in a word is considered the

least-significant byte of the word, and the highest-numbered byte is the most significant.

So byte 0 of the mem ory system connects to data lines 7 to 0. T his is shown in

Figu re 2-2 on page 2-5.

Higher address 8

31 24 23 Word

address

16 15 8 7 0

Lower address

0 1 2 3

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-5

Figure 2-2 Li ttle-endian addresses of bytes within words

Higher address 8

31 24 23 Word

address

16 15 8 7 0

Lower address

3 2 1 0

Programmer’s Model

2-6

ARM DDI 0234A

2.4 Instruction length

Ins tructions are either :

•32 bits long (in ARM state)

•16 bits long (in Thumb st ate).

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-7

2.5 Data types

The ARM7TDMI-S processor supports the following data types:

•word (32-bit)

•halfword (16-bit)

•byte (8-bit).

You mu s t al i gn th ese as f ol l ows :

•word quantities m us t be aligned to four-byte boundaries

•halfword quantities must be aligne d to two-byte boundarie s

•byte quantities can be placed on any byte boundary.

Programmer’s Model

2-8

ARM DDI 0234A

2.6 Operating modes

The ARM7TDMI-S proc essor has seven operating modes:

•User mode is the usual ARM program execution state, and is use d for executing

most appl ication programs.

•Fast interrupt (FIQ) mode suppor ts a data transfer or chann el process.

•Interrupt (IRQ) mode is used for general-purpose interrupt handling.

•Supervisor mode is a protecte d mode for the operating system.

•Abort mode is entered after a da ta or instruction prefetch abort.

•System mode is a privilege d use r mode for the operating sy stem.

•Undefined mode is ent ere d wh en an undefined inst ruction is ex ecuted.

Modes other than User mode are c ollectively known as privileged modes. Privil eged

modes are used to service interrupts , exce ptions, or access protec ted resources.

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-9

2.7 Registers

The ARM7TDMI-S proc essor has a total of 37 registers:

•31 gene ral-purpose 32-bit registe rs

•6 status registers.

These registers are not all accessible at the same time. The processor state and operating

mode determine which registers are available to the programmer.

2.7.1 The ARM state register set

In ARM state , 16 gene ral re giste rs, and one or two sta tus reg iste rs are acc essibl e at any

one tim e. In privileged modes, mode-s pecific banked re gisters become available.

Fig ure 2-3 on page 2-11 sho ws which registers are available in each mode.

The ARM state regis ter set contains 16 directly-accessible re gisters, r0 to r15. An

additional register, the Cur rent Prog ram Status Re gister (CPSR), contai ns condition

code fl ags, and the current mode bits. Registers r0 to r13 are general-purpo se registers

use d to hold either data or ad dres s values . Registers r14 and r15 have the following

special functions:

Link register Register 14 is used as the subroutine Link Register (LR).

r14 receives a copy of r15 when a Branch with Link (BL)

instruction is executed.

At all othe r times you can treat r14 as a general-purpose re gister.

The corres ponding banked regist ers r14_svc, r14 _irq, r14_fi q,

r14_abt, and r14_und are similarly used to hold the return values

of r15 when inte rrupts a nd exce ptions arise, or when BL

instructions are ex ecuted within int errupt or exception routines.

Pr ogram counte r Regis ter 15 holds the Program Counter (PC).

In ARM state, bits [1:0] of r15 are zero. Bits [31:2] contain the PC.

In Thumb state, bit [0] is zero. Bit s [31:1] conta in the PC.

In privileged modes, another register, the Saved Pro gram St atus Register (SPSR), is

acc es sible. This contains the condition code flags, and the mode bits saved as a result

of the exception that cause d entry to the current mode.

See The program status re gisters on page 2-16 for a description of the program status

registers.

Programmer’s Model

2-10

ARM DDI 0234A

Bank ed registers ha ve a mode ide ntif ier that sho ws to which User mode re gister t hey are

mapped. The se mode identif iers a r e s hown in Tabl e 2-1.

FIQ mode has seven banked regi st ers mappe d to r8–r14 (r8_fiq–r14_fiq).

In ARM state, m os t of the FIQ handlers do not hav e to save any registers.

The User , IRQ, Supervisor, Abort, and undefined modes each have two banked registers

mapped to r13 and r14, allowing a private stack pointer and LR for each mode

Figu re 2-3 on page 2-11 shows the ARM state registers.

Table 2 -1 Register mode identifiers

Mode Mode identifier

User usr

Fas t in te rrupt fiq

Interrupt irq

Supervisor svc

Abort abt

System sys

Undefined und

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-11

Figure 2-3 Register organization in ARM st ate

ARM state general registers and program counter

r10

r11

r12

r13

r14

r15 (PC)

System and User

CPSR CPSR

SPSR_fiq

CPSR

SPSR_svc

CPSR

SPSR_abt

CPSR

SPSR_irq

CPSR

SPSR_und

ARM state program status registers

= banked register

r8_fiq

r9_fiq

r10_fiq

r11_fiq

r12_fiq

r13_fiq

r14_fiq

r15 (PC)

FIQ

r13_svc

r14_svc

r15 (PC)

Supervisor

r10

r11

r12

r13_abt

r14_abt

r15 (PC)

Abort

r10

r11

r12

r13_irq

r14_irq

r15 (PC)

IRQ

r10

r11

r12

r13_und

r14_und

r15 (PC)

Undefined

r10

r11

r12

Programmer’s Model

2-12

ARM DDI 0234A

2.7.2 The Thumb state reg ister set

Th e Thumb state register set is a subset o f the ARM state s et. The programmer has

direc t access to:

•eight general registers, r0 –r7

•th e PC

•a Stack Pointer (SP)

•a Lin k Regist er (L R )

•the CPSR.

There are banked SPs, LRs, and SPSRs for each privileged mode. This register set is

shown in Figure 2-4 on page 2-13.

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-13

Figure 2- 4 Register organization in Thumb state

2.7.3 The relationsh ip between AR M state and Thumb state registers

The Thumb state registers relate to the ARM state registers in the following w ay:

•Thumb state r0–r7 , and ARM state r0 –r7 ar e id enti cal

•Thumb state CPSR and SPSRs, and ARM state CPSR and SPSRs are identical

•Thumb state SP maps onto ARM state r13

•Thumb state LR maps onto ARM sta te r14

•The Thumb state PC maps onto the ARM state PC (r15).

These relationships are shown in Figure 2-5 on page 2-14.

Thumb state general registers and program counter

System and User

CPSR CPSR

SPSR_fiq

CPSR

SPSR_svc

CPSR

SPSR_abt

CPSR

SPSR_irq

CPSR

SPSR_und

Thumb state program status registers

= banked register

FIQ

SP_fiq

LR_fiq

Supervisor

SP_svc

LR_svc

Abort

SP_abt

LR_abt

IRQ

SP_irq

LR_irq

Undefined

SP_und

LR_und

Programmer’s Model

2-14

ARM DDI 0234A

Figure 2-5 Mapping of Thumb state regist ers onto ARM state registers

Note

Registers r0–r7 are known as the low registers. Registers r8–r15 are known as the high

registers.

2.7.4 Accessi ng high registers in Thumb state

In Thumb sta te, the high registers (r8–r15) are not part of the standard regist er se t. The

assembly language programmer has limited access to them, but can use them for fas t

temporary storage.

Program counter (PC)

Thumb state

Stack pointer (PC)

Link register (LR)

Current program status register

(CPSR)

Saved program status register

(SPSR)

Program counter (r15)

ARM state

Stack pointer (r13)

Link register (r14)

Current program status register

(CPSR)

Saved program status register

(SPSR)

r10

r11

r12

r0 r0

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-15

You can use special variants of the

MOV

inst ruc tion to tr ansf er a val ue fro m a lo w register

(in th e range r0–r7) to a h igh re gist er , and from a high re gister to a lo w re gist er. The

CMP

i n struct ion enables you to compare high regist er v alues with low reg i ster values. The

ADD

instructi on enables you to add high register values t o low re gis ter v alues. For more

details, se e the ARM Architecture Reference Manual.

Programmer’s Model

2-16

ARM DDI 0234A

2.8 The program status registers

The ARM7TDMI-S core contains a CPSR and fiv e SPSRs for except ion handlers to

use . The program status re gist ers :

•hold the condition code fla gs

•control the enabling and disabli ng of interrupts

•set the proce ssor operating mode.

The arrangement of bits is shown in Figure 2-6.

Figure 2-6 Program status register format

Note

To mainta in compatibility with future ARM processors, and as good practice, you are

stro ngly advised to use a read-write-modify strategy when chang ing the CPS R.

2.8.1 The condition cod e flags

The N, Z, C, and V bits a re the condit ion code flags, You can set these bits by a rithmeti c

and logical operations. The flags can also be set by MSR a nd LDM instructions. The

ARM7TDMI-S processor tests these flags to determine whether to execute an

instruction.

All ins tructions can execute conditionally in ARM s tate. In Thumb state, only the

Branch instruction can be execute d conditionally. For more inform ation about

conditional execution, see the AR M Architecture Reference Manual.

31 30 29 28 27 26 25 24 23 8 7 6 4 3 2 1 0

Reserved

Condition

code flags Control bits

Mode bits

State bit

FIQ disable

IRQ disable

Overflow

Carry or borrow or extend

Zero

Negative or less than

•I F M4 M3 M2 M1 M0TN Z C V • • • • •

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-17

2.8.2 The control bits

The bottom eight bi ts of a PSR are known collectively as the control bits. They are the:

•Interrupt disable bits

•T bit

•Mode bits.

The control bits change when an e xception occurs. Wh en the processor is op erating in

a pr ivil eg ed mo de , s o f twar e can m an i pu l at e th ese b it s.

Inte rru pt di sa ble bits

The I and F bits are the interrupt disab l e bits:

•when the I bit is set, IRQ interrupts are disabled

•wh en th e F bi t is set, FIQ in t er r u pt s ar e d isabled .

T bit

The T b it reflects the operating state:

•when the T bit is set, the processor is executing in Thumb state

•wh en th e T b it is cle ar, the pr o c essor exec u ti ng in ARM s t at e.

The oper a ti n g state is r ef l ec te d by th e CPTBIT extern al signal.

Caution

Ne ver use an MSR instruction to force a change to the state of the T bit in the CPSR. If

you do this, the proce ssor enters an unpredictabl e state.

Mode bits

The M4, M3, M2, M1, an d M0 bits (M[4:0]) are the mo de bi ts. Thes e bi ts determin e the

proce ssor operat ing mo de as s ho wn in Table 2-2. Not al l com binati ons of the mode bits

define a valid process or mode, so take care to use only the bit combinations shown.

Table 2-2 PSR mode bit values

M[4:0] Mode Visible Thumb state r egister s Visibl e ARM state register s

10000 User r0–r7, SP, LR, PC, CPSR r0–r14, PC, CPSR

10001 FIQ r0–r7, SP_fiq, LR_f iq PC, CPSR, SPSR_fiq r0–r7, r8 _ fiq –r14_f iq, PC, CPSR, SPSR_fiq

10010 IRQ r0–r7, SP_irq, LR_ir q, PC, CPSR, SPSR_irq r0–r12, r13_irq, r14_irq, PC, CPSR, SPSR_irq

Programmer’s Model

2-18

ARM DDI 0234A

Note

If y ou pr ogra m an ill ega l v alu e into M[4:0 ], the proc essor e nters a n un recov erab le stat e.

2.8.3 Rese rved bits

The remaining bits in the PSRs are unused but are reserved. When changing a PSR flag

or contro l b its make sure that these reserved bi ts are not altered. Also, make sure th at

your program does not rely on reserved bits cont aining specific values be cause future

processors might have these bits set to one or zero.

10011 Supervisor r0–r7, SP_svc, LR_svc, PC, CPSR ,

SPSR_svc r0–r12, r13_svc, r14_svc, PC, CPSR,

SPSR_svc

10111 Abort r0–r7, SP_abt, LR_abt, PC, CPSR, SPSR_abt r0–r12, r13_abt, r14_abt, PC, CPSR,

SPSR_abt

11011 Undefined r0–r7, SP_und, LR_und, PC, CPSR,

SPSR_und r0–r12, r13_und, r14_und, PC, CPSR,

SPSR_und

11111 System r0–r7 , SP, LR, PC, CPSR r0–r14, PC, CPSR

Table 2-2 PSR mode bit values (conti nued)

M[4:0] Mode Visible Thumb state re gister s Visibl e ARM state regi sters

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-19

2.9 Exceptions

Exceptions arise whenever th e norm al flow of a program has to be halte d temporarily,

for example to service an interrupt from a peripheral. B efore attempting to handle an

ex ception, the A RM 7 TDMI-S core p r eserves th e cu rrent p r o cessor state so that the

original program can resume when the handler routine has finished.

If two or more exceptions arise simultaneously , the exceptions are dealt with in the fixed

order given in Exception prioritie s on page 2-24.

This section provides details of the e xception handling on the ARM7TDMI-S

processor:

•Excepti o n en t ry/ exi t s u mm a r y

•Entering an e xception on page 2-20

•Leaving an exception on page 2-21.

2.9.1 Exceptio n entry/exit summar y

Table 2-3 show s the PC value preserved in the relevant r14 on excepti on entry and the

recommended instruction for exiting the exception handler.

Table 2-3 Exception entry and exi t

Exception

or entr y Return instruction Previous state Notes

ARM r14_x Thumb r14_x

MOV PC, R14

PC + 4 PC + 2

Where the PC is the addre ss of the BL,

SWI, undefined instruction Fetch, or

in struction that had the Prefetch A bort.

SWI

MOVS PC, R14_svc

PC + 4 PC + 2

Undefined

instruction

MOVS PC, R14_und

PC + 4 PC + 2

Prefetch

Abort

SUBS PC, R14_abt, #4

PC + 4 PC + 4

Programmer’s Model

2-20

ARM DDI 0234A

2.9.2 Entering an ex c epti on

When handling an exception the ARM7TDMI-S core:

1. Preserves the address of the next instruction in the appropriate LR. When the

excepti on en t ry is f rom:

•ARM state, th e ARM7TDMI- S copies th e ad d ress of t h e n ext in struction

into the LR (current PC + 4, or PC + 8 depending on the exception)

•Th u mb s ta te, the AR M 7 TD M I - S w r it es th e valu e o f th e PC in t o th e LR,

offset by a value (current PC + 4, or PC + 8 depending on the exception).

The exception handler does not have to dete rmi ne the state when entering an

ex cep tio n. F o r e xampl e, in th e ca se o f a S WI,

MOVS PC, r14_svc

al wa ys ret ur ns to

the next ins truction regardless of whether the SWI was e xecuted in ARM or

Thumb state.

2. Copies the CPSR into the appropriate SPSR.

3. Fo rce s the CPSR mode bit s to a value whic h depends on the exce ption.

4. Forces the PC to fetch the next ins truction from the re levant exception vector.

The ARM7TDMI-S core also s ets the interrupt dis able flags on interrupt exceptions t o

prevent otherwise unmanageable nestings of exceptions.

FIQ

SUBS PC, R14_fiq, #4

PC + 4 PC + 4 W he r e th e PC is the ad dr ess of the

instruction that was not executed

because the FIQ or IRQ took priority.

IRQ

SUBS PC, R14_irq, #4

PC + 4 PC + 4

Data Abort

SUBS PC, R14_abt, #8

PC + 8 PC + 8 Where the PC is the address of the Load

or Store instruction that genera ted the

Data Abort.

RESET Not applicable - - The value saved in r14_svc on reset is

UNPREDICTABLE

Table 2-3 Exceptio n entry and exit (continued)

Exception

or entr y Return instruction Previous state Notes

ARM r14_x Thumb r14_x

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-21

Note

Excepti ons are alwa ys handled i n ARM state. When t he processor i s in Thumb state and

an exception occ u r s, the s w itch to ARM st ate takes plac e automatical l y w h en the

ex ception v ector ad d ress i s loaded into the PC.

2.9.3 Leaving an exception

When an e xception is completed, the e xception handler m ust:

1. M ove th e LR , m i nus an offse t to th e P C . Th e o ffset vari es ac co r d in g to th e ty p e

of exception, as s hown in Table 2-3 on page 2-19.

2. Copy the SPS R back to the CPS R.

3. Clear the interrupt dis able fla gs that were set on entry.

Note

The action of rest oring the CPSR from the SPSR automat ically restores the T, F, and I

bits to whatever value they held immediately prior to the exception.

2.9.4 Fast interrupt request

The Fa st Interrupt Request (FIQ) e xception supports data transfers or channel

processes. In ARM state, FIQ mode has eight private reg isters to remove the need for

An FIQ is externally genera ted by taking the nFIQ signa l input LO W.

Irrespecti ve of whether exce ption ent ry is fr om ARM state, or from Thumb s tate, a n FIQ

handler ret urns from the interrupt by exec uting:

SUBS PC,R14_fiq,#4

You can disable FIQ exceptions within a privileged mode by setting the CPS R F flag.

When t h e F flag is clear, the ARM7TD M I-S checks for a LOW level on the output of

the FIQ synchronizer at the end of each instruction.

2.9.5 Interru pt req uest

The Int errupt Re quest (IRQ) e xcepti on is a normal interrup t caus ed by a LOW lev el on

the nI RQ input. IRQ has a lower priority than FIQ, and is masked on entry to an FIQ

sequence. You can disable IRQ at any time, by setting the I bit in the CPSR from a

privileged mode.

Programmer’s Model

2-22

ARM DDI 0234A

Irrespec tiv e of whether e xception entry is from ARM state, or Thumb state, an IRQ

handler returns from the interrupt by e xecuting:

SUBS PC,R14_irq,#4

2.9.6 Abort

An abort indicates that the c urrent memory access ca nnot be completed. It is sig naled

by the e xte rnal ABOR T input. The ARM7 TDMI-S ch ecks for t he abort ex ce ption at the

end of m e mo r y ac ce s s cyc le s.

The r e ar e tw o ty pe s of ab o rt:

•a Prefe tch Abort oc curs during an instruc tion prefetch

•a Data Abort occurs during a data access.

Prefetch Abort

When a Prefetch Abort occurs, the ARM7TDMI-S core marks the prefetched

instruction as invalid, but does not take the except ion until the inst ruction reache s the

ex ecut e stage of the pi peline . If the instruc tion is no t ex ec uted because a branch occurs

while it is i n the pipeline, the abort does not take place.

After dealing with the reason for the abort, the ha ndler executes th e followin g

instruction irres pective of the proc essor operating state:

SUBS PC,R14_abt,#4

This action re stores bo th the PC and the CP SR and retrie s the aborted ins truction.

Data Abort

When a Data Abort occurs, the action taken depends on the instruction type:

•Single data transfer instructions (

LDR

STR

) write back modif ied base re gisters. The

abort handler must be aware of this.

•The swap instruction (

SWP

) aborts as though it had not been exec uted. (The abor t

must occur on the read access of the SWP instruction.)

•Block data transfer instructions (

LDM

STM

) complete. When write-back is set, the

base is updated. If the ins truction would have overwritten the base with data

(when i t has the ba se r e gist er in t he tr ansf er lis t), the ARM7TDMI-S prev ents the

overwriting.

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-23

The AR M 7 TD M I- S co re p reve nts al l regi st er overw r i tin g af t er an ab or t is

indicated. This means that the ARM7TDMI-S core always preserves r15 (always

the la st register to be transferred) in an aborted

LDM

instruction.

The abort mec hanism enables the impl ementation of a demand-paged virtual memory

system. In such a system, the processor is allowed to generate arbitrary addresses. When

th e data a t an a ddress is una v ail ab le , the Memory Management Unit (MMU) s ignals an

abort. The abort handler must then work out th e cause o f the abort, make the requested

data av aila ble, and retry the aborted instr uction. The appli cation progra m doe s not hav e

to kno w t he amount of mem ory a v ail able t o it, nor i s its s tat e in an y w ay af fect ed b y the

abort.

After fixing the reason for the abort, the handler must execute the following return

instruction irrespective of the processor operating state at the point of entry:

SUBS PC,R14_abt,#8

This action restores both th e PC, and the CPS R, and re tries t he aborted instruction.

2.9.7 Software interrupt instructi on

The Softwa re Interr upt (SWI) is used to en ter Supervisor mode, usually to request a

particular supervis or function. A SWI handler returns by exe cuting the following

irrespect ive of the proc essor operat ing s tate:

MOVS PC, R14_svc

This ac tion restores the PC and CPSR, and returns to the ins truc tion follo wing the SWI.

The SWI handler reads the opcode to extract the SW I function number.

2.9.8 Undefined instruction

When the ARM7TDMI-S processor encounte rs an instruction that ne ither it nor any

coprocessor in the syst em ca n handle, the ARM7TDMI-S core takes the undefined

instruction trap. Software can use this mechanism to extend the ARM instruction set by

emulating undefined co p r o cessor instruct io ns.

Note

The AR M 7 TD M I - S pr o c essor is f ull y co mpliant w i th th e A RM arch it ec tu r e v 4 T, and

tra p s all in st ru c ti o n b it pa tt er n s th at a re cl as sified as un d e fin e d.

After emulati ng the failed ins truction, the trap handler executes the fol lowing

irrespect ive of the proc essor operat ing s tate:

MOVS PC,R14_und

Programmer’s Model

2-24

ARM DDI 0234A

This action restores the CPSR a nd returns to the next instruction after the undefined

instruction.

For more information about undefined instructions, see the ARM Ar chitecture Reference

Manual.

2.9.9 Exceptio n vectors

Table 2-4 show s the exce ption vector addresses. In the tabl e, I and F represent the

previous value.

2.9.10 Excep tion priorities

When multiple e xcept ions aris e at the s ame time, a fixed pr iority sys tem deter mines the

order in which they are ha ndled:

1. Res et (highest pr iority).

2. Data Abort.

3. FIQ.

4. IRQ.

5. Pr efetch Abort.

6. Undefined instr uction.

7. SWI (lowest pri ority).

Table 2-4 Excepti on vectors

Address Except ion M ode on entry I state on

entry F state on

entry

0x00000000

Reset Supervisor Disabled Disabled

0x00000004

Undefined instru ction Un defined I F

0x00000008

So ftwar e in te rrupt Su p er vis or Dis ab led F

0x0000000C

Abor t (Prefet ch) Abor t I F

0x00000010

Abor t (Data) Abor t I F

0x00000014

Reserved Reserved - -

0x00000018

IRQ IRQ Disabled F

0x0000001C

FIQ FIQ Disabled Disabled

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-25

Some e xceptions cannot occur together:

•The Undefined Instruc tion and SWI exceptions are mutu ally exclusive. Each

corre sponds to a partic ula r (non-ov e rlappin g) decodi ng of the current instr uction.

•When FIQs are enabled and a Data Ab o rt o ccurs at the s ame time as an FIQ, the

ARM7TDMI-S core e nters the Data Abort handler and proceeds immediately to

t h e FIQ vector.

A norm al re turn fro m the FIQ caus es the Data Abort ha ndl er to re sume ex e cution.

Data Aborts must have higher priority than FIQs to ensure that the transfer error

does not es cape detect ion. You must add the time for this e xception entry to the

wor st - case FIQ late ncy ca lculation s in a sy s te m th a t uses ab o r ts.

Programmer’s Model

2-26

ARM DDI 0234A

2.10 Interrupt laten cies

Interrupt latencies are described in:

•Maximum interrupt latencies

•Minimum interrupt latencies.

2.10 .1 Ma x imum int e r rupt lat e ncies

When FIQs are enabled, the worst-case latency for FIQ comprises a combination of:

•Tsyncmax, the longest time the request can take to pass through the synchronizer.

Tsyncmax is two processor cycl es.

•Tldm, the time f or the longest i nstruction to complete. (The longest instruct ion is

LDM

that lo ads all the re giste rs including the PC.) Tldm is 20 cy cles in a ze ro wa it

state sy stem.

•Texc, the time for th e Data Abort entry. Texc is three cycles.

•Tfiq, the time for FIQ entry. T fiq is two cycles.

The to tal lat ency is the refore 27 processor cyc les, slig htly less than 0.7 mic roseconds in

a system that uses a continuous 40MHz processor clock. At the end of this time, the

ARM7TDMI-S executes the instruction at

0x1c

The m aximum I RQ latency calculation is si milar, but must allow f o r the fac t that FIQ,

having hi gher priority, might delay entry into the IRQ handling routine for an arbitrary

length of time.

2.10 .2 Minim um in ter ru pt la tencie s

The minimum late ncy for FIQ or IRQ is the shortest time the re quest can take through

the s ynchronizer, Tsyncmin plu s Tfiq (four processor cycles).

Programmer’s Model

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

2-27

2.11 Reset

When the nRESET signal goes LOW, the ARM7TDMI-S processor abandons the

executing instruction.

When nRESET goes HIGH again the ARM7TDMI-S proce ssor:

1. Forces M[4:0] to b10 011 (S upervisor mode).

2. Sets the I and F bits in the CPSR.

3. Clears t h e CPSR T bi t.

4. Force s the PC to fetch the next instruction from addres s

0x00.

5. Reverts to ARM state and resumes execution.

After reset, all register values except the PC and CPSR are indeterminate.

Programmer’s Model

2-28

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

3-1

Chapter 3

Memory Interface

This chapte r describes the memory interf ac e on the ARM7TDMI-S proces sor. It

contains the follow ing sections:

•About the me mory interface on pag e 3-2

•Bus interface signals on page 3-3

•Bus cycl e ty p es on page 3-4

•Addressi ng signals on page 3-10

•Data timed signals on page 3-13

•Using CLKEN to control bus cycles on page 3-17.

Memory Interface

3-2

ARM DDI 0234A

3.1 About the memory interface

The ARM7TDMI-S processor has a Von Neumann arc hitecture, wit h a single 32-bit

data bus carrying both i nstructions and dat a. Only load, store, and swap i nstructions can

access d at a fro m mem o ry.

The ARM7TDMI-S proce sso r supp orts four basic types of me mory cycle:

•nonsequential

•sequential

•internal

•coprocessor re gist er trans fer .

Memory Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

3-3

3.2 Bus interface signals

The signa ls in the ARM7TDMI-S proce ssor b us interface can be grouped into four

categories:

•clocking and clock control

•address class signals

•memory request signals

•data timed signals .

The clocking and clock control signals are:

•CLK

•CLKEN

•nRESET.

Th e addres s clas s signal s ar e:

•ADDR[31:0]

•WRITE

•SIZE[1:0]

•PROT[1:0]

•LOCK.

Th e memory request signals are:

•TRANS[1:0].

The da ta tim ed s ignals are:

•WDATA[31:0]

•RDATA[31:0]

•ABORT.

Each of these signal groups shares a common timing relationship to the bus interfa ce

cycle. All signa ls in the ARM7TDMI-S processor bus in terface are generated from or

sampl ed by the rising edge of CLK.

Bus cycles c an be e xtended usi ng the CLKEN signal. This s ignal is i ntroduce d in Using

CLKE N to control bu s c ycle s on pa ge 3-1 7. All ot her s ectio ns of th is cha pter de scribe a

simple sy stem in w hich CLKEN is permanently HIGH.

Memory Interface

3-4

ARM DDI 0234A

3.3 B us cycle types

The ARM7TDMI-S proce sso r bus interface is pi pelined, and so the ad dress class

signals, and the m emory request signals a r e broadcast in t he bus cycle ahe ad of the bus

cycle to which they refer. This gives the maximum time for a memory cycle to decode

the a ddress, and respond to the ac cess request.

A singl e memory cycle is shown in Figure 3-1.

Figu re 3-1 Simple memory cycle

The ARM7TDMI-S processor bus interface can perform four different types of memory

cycle. These are indicated by the state of the TRANS[1:0] signals. Memory cycle types

are enc oded on the TRANS[1:0] signals as shown in Table 3-1.

A memory contr oll e r for the ARM7TDMI-S processor c ommits t o a memo ry a c ces s

only on an N cy cle or an S cycle .

Address

Cycle type

Write data

Bus cycle

CLK

Address-class signals

TRANS[1:0]

WDATA[31:0]

(write)

RDATA[31:0]

(read) Read data

Tabl e 3-1 Cycle types

TRANS[1:0] Cycle type Description

00 I cycle Int e r nal cyc le

01 C c y cle Coproces sor regi ster tr ansfer c ycle

10 N cycle Nonseq uential cycle

11 S cycle Sequential cycle

Memory Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

3-5

The ARM7TDMI-S proc essor has four basic types of memory cycle:

Nonsequen tial cycle

During this cycle, the ARM7TDMI-S core requests a transfer to,

or from an address which is unrelated to the address used in the

pr ec ed i n g cy cl e.

Sequen tial cycle During this cycle, the ARM7TDMI-S core requests a transfer to

or from an a ddress t hat is eith er on e word or one h alfword greate r

th an th e ad d r ess use d in th e p r ec ed in g cyc le .

Internal cy cle During this cycle, the ARM7TDMI-S core does not require a

transfer because it is performing an internal function and no useful

prefetching c an be performed at the same time.

Coproce ssor register tra nsfe r cycle

During this cycle, the ARM7TDMI-S core uses the data bus to

communic ate with a copr oce ssor but does not require an y ac tion

by the memory system.

3.3.1 Nonsequential cycles

A nonseq uential cycle is the simplest form of an ARM7TDMI-S processor bus cycle,

and occurs when the ARM7TDMI-S processor request s a t ransfe r to or from an address

that is unrelated to the address used in the preceding cycle. The memory controller must

i nitiate a m emory access to satisfy th is reques t.

The address class signals, and the TRANS[1:0] = N c ycl e are bro adc ast on the b us . At

the end of the next bus cycle the data is trans ferred betwee n the CPU, and the m em ory.

This is illustra ted in Figure 3-2 on page 3-6.

Memory Interface

3-6

ARM DDI 0234A

Figure 3-2 Nonsequen ti al memory cycle

The ARM7TDMI-S processor can perfor m back to ba ck non seque ntial memory c ycles.

This happens, for example, when an

STR

inst ruction is ex ec uted, as shown in Figure 3-3 .

If you are designing a memory controller for the ARM7TDMI -S proce ssor, and your

memory system is unable to cope with this case, you mu st use the CLKEN signal to

extend the bus cycle to allow sufficient cycles for the memory system. See Using

CLKE N to control bus cycles on pag e 3- 1 7.

Figure 3-3 Back to back memory cycles

Address

Ncycle

CLK

Address-class signals

TRANS[1:0]

WDATA[31:0]

(write)

RDATA[31:0]

(read)

Write data

Read data

Write data

Write

cycle

CLK

Address-class signals

TRANS[1:0]

WDATA[31:0]

(write)

RDATA[31:0]

(read)

Read

cycle

WRITE

Ncycle Ncycle

Read data

Read addressWrite address

Memory Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

3-7

3.3.2 Sequential cyc les

Sequential cycles perform burst transfers on the bus. You can use this information to

optim ize the design of a memory controller interfacing to a b urst memory device, such

as a DRAM.

During a sequential cycl e, the ARM7TDMI-S processor requests a memory location

that is part of a sequential burst. If this is the first cycle in the burst, the address can be

t h e same as the prev ious internal cycle. Otherwise the address is increm ented from the

previous cycle:

•fo r a burs t of wor d access es , th e ad d r ess is inc r emented by 4 byt es

•for a burst of halfword accesses, the address is incremented by 2 bytes.

Bursts of byte accesses are not possible.

A burst always star ts with an N cy cle or a merged I-S cycle (s ee Merged I-S cycles on

page 3-8), and continues with S cycles. A burst compris es tra nsfers of the same type.

The ADDR[31:0] signal increments during the burst. The other address class s ignals

remain the same throughout the burst.

The types of burst are shown in Table 3-2.

All ac cesses in a burst are of the same width, dire ction, and protection type. For more

details, se e Addressing si gnals on page 3-10.

An example of a burst acc es s is shown in Figure 3-4 on page 3-8.

Table 3-2 Burst types

Burst type Address increment Cause

Word rea d 4 byte s AR M7TD MI-S co d e fe tches , or LDM in st ru c tio n

Word wr it e 4 byte s ST M inst ru c tio n

Halfword read 2 bytes Thumb code fetches

Memory Interface

3-8

ARM DDI 0234A

Figure 3-4 Sequential access cycles

3.3.3 Intern al cycles

Dur ing an internal c ycle, the ARM7 TDMI-S p rocessor does not req u i re a memory

acc ess, as an inte rnal function is being performed, and no useful prefetching can be

performed at the same time.

Where possible the ARM7TDMI-S processor broa dcasts the addre ss for the next

access, so that decode can start, bu t the memory controller must not commit to a

memory acce ss. This is described in Merged I-S cy cl es.

3.3.4 Merged I-S cycles

Where possible, the ARM7TD MI-S processor performs an optimization on the bus to

allow extra time for memory decode. Wh en this happens, the address of the next

memory c ycle is broadcast during an internal cycle on this b us . This enables the

memory controller to decode the address, but it must not initiate a memory access

dur ing th is c ycl e. I n a mer g ed I-S cy cle , the ne xt cy cle is a se que nti al cycl e to t he sam e

memory location. This commits to the access, and the memory controller must initiate

the memo ry access. This is shown in Figure 3-5 on page 3-9.

Address

Ncycle

CLK

Address-class signals

TRANS[1:0]

WDATA[31:0]

(write)

RDATA[31:0]

(read) Read data1

Address+4

Scycle

W rite data1 W rite data2

Read data2

Scycle

Memory Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

3-9

Figure 3-5 Merged I -S cycle

Note

When designing a memory controller, make sure that the design also works when an I

cycle is followed by an N cycle to a different address. This sequence might occur during

exceptions, or dur ing writes to the PC. I t is essential that the memory controller does

not commit to the memory cycle during an I cycl e.

3.3.5 Coprocesso r register tran sfer cycles

During a coprocessor register transfer cycle, the ARM7TDMI-S processor uses the data

bus es to transfer dat a to or from a coproce ssor. A memory c ycle is not re qui red and the

memory controller does not initiate a transaction.

The coproces s or interface is described in Chapter 4 Coprocessor Interface.

Address

Icycle

CLK

Address-class signals

TRANS[1:0]

RDATA[31:0]

(read) Read data1

Address+2

Scycle

Read data1

Merged

Scycle

Memory Interface

3-10

ARM DDI 0234A

3.4 Addressing signals

The address class sign als are descr i bed in th e f o llow ing s ections:

•ADDR[31:0]]

•WRITE

•SIZE[1:0]

•PROT[1:0] on pa ge 3-11

•LOCK on page 3-12

•CPTBIT on page 3-12.

3.4.1 ADDR[31:0]

ADDR[31:0] is th e 32-bit address bus which specifies the addre ss for the transfer. All

addresses are byte addresses, so a burst of word accesses results in the address bus

incrementing by four for each cycle.

The addres s bus provides 4GB of li near addressing space. When a word acces s is

signaled, the memory system mus t ignore the bottom two bits, ADDR[1:0], an d when

a hal fword access i s signaled the memory sys tem must ignore the bottom bit, ADDR[0].

3.4.2 WRITE

WRITE specifies the dir ection of the trans f er. WRITE indicates an ARM7T D MI-S

core write cycle when HIGH, and an ARM7TDMI-S core read cycle when LOW. A

burs t of S cycles is always eit her a read burst or a write burs t. Th e direction cannot be

ch an ged in th e middle of a burst.

3.4.3 SIZE[1:0]

The SIZE[1:0] bus enco d es the si ze of the t rans f er. The ARM7TDMI-S proce ssor can

tr ansfe r w ord, ha lfw ord, a nd b yte qu ant ities . T his is enc oded on SIZE[1:0] as shown in

Table 3-3 on page 3-11.

Memory Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

3-11

The size of transfer does not c hange during a burs t of S cycles.

Note

A writable memory system for the ARM7TDMI-S processor must have indi vidual byte

write enables. B o th the C Compiler and the ARM deb u g tool chain (for e x ample,

Multi -ICE) assume t ha t arbit rar y b ytes in the memory c an be wr itt en. If individual b yte

write capability is not provided, it might not be pos s ible to use either of these too ls.

3.4.4 PROT[1:0]

The PROT[1:0] bus enc odes information about the transfer. A memory management

unit uses this signal to determine whe ther an access is from a privileged mode, and

whether it is an opcode or a data fetch. This can therefore be use d to im plement an

access permission scheme. The encoding of PROT[1:0] is shown in Table 3-4.

Table 3-3 Transfer widths

SI ZE[1 :0 ] Tran sfer w id th

00 Byte

01 Halfword

10 Word

11 Reserved

Table 3-4 PROT[ 1:0] encoding

PR OT[1:0] Mode Opcode or data

00 User Opcode

01 User Data

10 Privileged Opcode

11 Privileged Data

Memory Interface

3-12

ARM DDI 0234A

3.4.5 LOCK

LOCK indicates to an arbiter tha t an atomic operation is being performe d on the bus.

LOCK is nor mally LO W, but is set HIGH to indicate that a

SWP

SWPB

instruction is

being pe rformed. These in struc tions perfor m an atomic read /write operation and can be

us ed to implemen t sem a p ho r e s .

3.4.6 CPTBIT

CPTBIT indicates the operating s tate of the ARM7TDMI-S proce ssor:

•in ARM state, the CPTBIT signal is LO W

•in Thumb state, the CPTBIT si gnal is HIGH.

Memory Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

3-13

3.5 Data timed signals

The da ta tim ed s ignals are described in the following sec tions:

•WDATA[31:0]

•RDATA[31:0]

•ABORT.

3.5.1 WDATA[31:0]

WDATA[31:0] is th e wr ite data b u s. All data written out f r om the ARM7TDMI - S

processor is broadcast on this bus. Data transfers from the ARM7TDMI-S core to a

coprocessor also use this bus during C-cycles. In norm al circumstances, a memory

system must samp le the WDATA[31:0] bus on the ris ing edge of CLK at the end of a

write bus cycle. The WDATA[31:0] v alue is valid only during wr ite cycles.

3.5.2 RDATA[31:0]

RDATA[31:0] is the read data bu s, and is used b y the ARM7TDMI- S c ore to fetch both

opcodes and data. The RDATA[31:0] signal is sampled on the rising edge of CLK at

the end of the bus cycle. RDATA[31:0] is also used during C-cycles to transfer d ata

from a coprocess or to the ARM7TDMI-S core.

3.5.3 ABORT

ABORT indicat es th at a mem o r y transact ion failed to complete successfully. ABORT

i s sampled at th e end of the bu s cycle during ac tive memory cycles (S-cycles and

N-cycles).

If ABORT is asserted on a data access, it causes the ARM7TDMI-S processor to take

the Data Abort trap. If it is asserted on an opcode fetch, the abort is tracked down the

pipeline, and the Pref etch Abort trap is taken if the instruction is executed.

ABORT can be used by a memory mana gement system to implement, for e xamp le, a

basic memory protection scheme or a demand-paged virtual memory system.

For more de tails about aborts, see Abort on page 2-22.

Memory Interface

3-14

ARM DDI 0234A

3.5.4 Byte and halfword accesses

The ARM7TDMI-S processor indicates the size of a transfer using the SIZE[1:0]

si gna ls. Th ese ar e en co d e d as s h own in Tabl e 3-5.

All writ able memory in an ARM7TDMI -S processor -based system suppor ts the wri ting

of individua l bytes to allow the us e of the C Compiler and the ARM deb ug t ool chain

(f o r examp l e, Mul ti - ICE).

The address produced by the ARM7TDMI-S proc essor is always a byte address.

However, the m emory system ignores the insignificant bits of the address. The

significant address bits are shown in Table 3-6.

When a halfword or byte read is perform ed, a 32-bit memory system can retu rn the

complete 32-bit word, and the ARM7TDMI-S processor extracts the valid halfword or

by te f ie ld fr om it. The f iel ds e xtra cted depend o n the s tate of th e CFGBIGEND signal,

which determi nes the endianness of the sys tem (see Memory formats on pa ge 2-4).

Table 3 -5 Transf er size encoding

SIZE[1:0] Transfe r widt h

00 Byte

01 Halfword

10 Word

11 Reserved

Table 3- 6 Significant address bits

SIZE[1:0] Width Signif icant address bits

00 Byte ADDR[31:0]

01 Halfword ADDR[31:1]

10 Word ADDR[31:2]

Memory Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

3-15

The fields extracted by the ARM7TDMI-S processor are shown in Table 3-7.

When conne cting 8-bit to 16-bit memory s ystems to the ARM7TDMI-S proce ssor,

ma ke sur e th at th e dat a is pres e n ted to th e cor r ect byt e la nes o n th e AR M 7 TD MI- S

processor as sho w n in Table 3-8 and Table 3-9.

Writes

When the ARM7TDMI-S processor performs a byte or halfwo rd write, the data being

written is re plicated across the bus, as illustrated in Figure 3-6 on page 3-16. The

memory system can use the most convenient copy of the data. A writable memory

syste m must be capab le of pe rformin g a write t o any singl e byt e in the memory s ystem.

This capability is r equired by t h e ARM C Compiler and the Debug tool chain.

Table 3-7 Word acces ses

SIZE[1:0] ADDR[1:0] Little-endian

CFGBIGEND = 0 Big-endian

CFGBIGEND = 1

10 XX RDATA[31:0] RDATA[31:0]

Table 3-8 Halfword acces ses

SIZE[1:0] ADDR[1:0] Little-endian

CFGBIGEND = 0 Big-endian

CFGBIGEND = 1

01 0X RDATA[15:0] RDATA[31:16]

01 1X RDATA[31:16] RDATA[15:0]

Table 3-9 Byte accesses

SIZE[1:0] ADDR[1:0] Little-endian

CFGBIGEND = 0 Big-endian

CFGBIGEND = 1

00 00 RDATA[7:0] RDATA[31:24]

00 01 RDATA[15:8] RDATA[23:16]

00 10 RDATA[23:16] RDATA[15:8]

00 11 RDATA[31:24] RDATA[7:0]

Memory Interface

3-16

ARM DDI 0234A

Figure 3-6 Data repl ication

ARM7TDMI-S processor

byte write

Memory interface

BWDATA[31:24]

WDATA[7:0]

WDATA[15:8]

WDATA[23:16]

ARM7TDMI-S processor

halfword write

Memory interface

BWDATA[31:16]

WDATA[15:0]

Memory Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

3-17

3.6 Using CLKEN to control bus cycles

The pi pelined nature of the ARM7TDMI-S processor bus interface means that there is

a distinction between clock cycles and bus cycles. CLKEN can be used to stretch a bus

cycle, so that it lasts for many clock cycles. The CLKEN input extends the tim ing of

b u s cycles in increments o f co mplete CLK cycles:

•when CLKEN is HIGH on the rising edge of CLK, a bus cy cl e co mp l et es

•when CLKEN is sam p led LOW, the bus cycle is ex tended.

In the pipeline, the addre ss class s ignals and the memory requ es t signals are ahead of

the data transfer by one bus c y cle. I n a s ys tem u sin g CLKEN this can b e more t han one

CLK cycle. This is illustrated in Figure 3-7, which shows CLKEN being used to extend

a nons equential cycle. In the example, the first N cycle is followed by another N cycle

to an unre lated address, and the address for the sec ond access is broadcast before the

first access comp let es.

Figure 3-7 Use of CLKEN

Note

When designing a memory controller, you are strongly advis ed to sample the values of

TRANS[1:0] and the address class signals only when CLKEN is HIGH. This ensures

that the state of the memory controller is not accidentally updated during a bus cycle.

Address 1Address-class signals

TRANS[1:0]

RDATA[31:0]

(read) Read data1

Address 2

Read data2

First bus cycle Second bus cycle

CLK

Next address

Ncycle Ncycle Next cycle type

CLKEN

Memory Interface

3-18

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

4-1

Chapter 4

Coprocessor Interface

This chapte r describe s the ARM7TDMI-S copro ce ssor interface . It contains the

following sections:

•About coprocessors on page 4-2

•Cop rocessor interface signals on page 4-4

•Pipe line-following signals on page 4-5

•Coprocessor interface handshaking on page 4-6

•Conn ecting coprocessors on page 4-11

•Not using an extern al coprocessor on page 4-14

•Undefined instructio ns on page 4-15

•Pr ivil eged in s t r u ct i on s on page 4-16.

Coprocessor Int erface

4-2

ARM DDI 0234A

4.1 About coprocessors

The ARM7TDMI-S pr oce ssor instruction s et enables you to implement specialized

additional instructio ns using coprocessors . These a r e separate processing units t hat are

tightly coupled to the ARM7TDMI-S core. A typic al coprocessor contains:

•an instruction pipeline

•instruction decoding logic

•handshake logic

•a regi st er ba n k

•special processing logic, with its own data path.

A coproc essor i s con nected t o the same data bu s as the AR M7TDMI-S proce ssor in the

system, and tracks th e p i peline i n t h e A RM 7 TDMI-S co re. This means that the

coproc ess or can decode the instructi ons in the instruction stre am, and e xecute those t hat

it supports . Each instruction progresses down both the ARM7TDMI-S proce ssor

pipeline a nd the coprocessor pipeline at the same ti me .

The execution o f in structions is shar ed betw een the ARM7TD M I -S cor e and the

coprocessor.

The ARM7TDMI-S core:

1. Evaluat es the condition codes to determine whether the instruction must be

executed by the c oprocessor, then signals this to any coprocessors in the s ystem

(using CPnI).

2. Generates any addresses that are required by the instruction, including

prefetching the next ins truction to refill the pipel ine.

3. Takes the undefined instruction tra p if no coprocessor acce pts the ins truction.

Th e coprocessor:

1. Decodes instructions to determine whe ther it c an accept the instruction.

2. Indicates whe ther it can acce pt the instruction (by signaling on CPA and CPB).

3. Fetches any value s required from its own register ba nk.

4. Perform s the operat ion required by the inst ruction.

If a coproc essor cannot execute an ins truction, the instruction takes the undefined

inst ructi on trap. You c an choose whether to emul ate coproc essor fun cti ons in softwa re,

or to des ign a de dicated c oprocessor .

Coprocessor Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

4-3

4.1.1 Coprocesso r ava ilability

You can connect up to 16 coprocessors into a system, ea ch with a unique coprocessor

ID number to identify it. The ARM7TDMI-S processor contains two internal

coprocessors:

•CP14 is the communications channel coprocessor

•CP15 is the system cont rol coprocessor for cache and MMU functions.

Theref ore, you cannot assi gn e xterna l coproc essors to cop rocess or numbers 14 an d 1 5.

Other c oprocess or numbers hav e als o been res erve d by ARM. Cop rocess or av a ilabi lity

is shown in Table 4-1.

If you i ntend to design a coprocessor s end an E-mail wit h

coprocessor

in the subject line

info@arm.com

for up to date information on coproce ssor numbers that have already

been alloca ted.

Table 4 -1 Copr ocessor av ailabil it y

Coprocessor

number Allocation

15 System control

14 De bug contr oller

13:8 Reserved

7:4 Available to users

3:0 Reserved

Coprocessor Int erface

4-4

ARM DDI 0234A

4.2 Coprocessor interf ace signals

The si gnals used to int erf ace the ARM7T DMI-S c ore to a coproc essor a re grou ped into

fo ur categories.

The clock and cl ock control signals are:

•CLK

•CLKEN

•nRESET.

The pipeline-foll owing signals are:

•CPnMREQ

•CPSEQ

•CPnTRANS

•CPnOPC

•CPTBIT.

The handshake signals are:

•CPnI

•CPA

•CPB.

Th e d ata signals are:

•WDATA[31:0]

•RDATA[31:0].

These signals and their use are described in:

•Pipe line-following signals on page 4-5

•Coprocessor interfa ce handshak ing on page 4-6

•Conn ec ting coprocessor s on page 4-11

•Not using an externa l coprocessor on page 4-14

•Undefined inst ructions on page 4-15

•Priv il ege d in st r u cti on s on page 4-16.

Coprocessor Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

4-5

4.3 Pipeline-following signals

Eve r y coprocessor in the system mus t contain a pi peline follo wer to tr ack the

inst ructions e xecut ing in t he ARM7TDMI-S cor e p ipeline. The copro cessors conn ec t to

the ARM7TDMI-S processor input data bus, RDATA[31:0], over which ins tructions

are fet ched, and to CLK and CLKEN.

It is essential that the two pipelines rem ain in step at all times. When de si gning a

pipeli ne follower for a coprocessor, the following rules must be observed:

•At reset (nRESET L OW), the pipel ine m ust eith er be mark ed as inv ali d, or fil le d

with instructions that do not deco de to valid instru ctions for that coprocessor .

•Th e coprocessor state must o n ly chang e when CLKEN is HIGH (except f or

reset).

•An instruction must be lo aded into the pipeline on the ris ing edge of CLK, and

only when CPnOPC, CPnMREQ, and CPTBIT were all LOW in the previous

bus cycle.

These conditions indic ate that this cycle is an ARM stat e opcode Fetch, s o the

new opcode must be samp led into the pipeline.

•The pi peline must be advanced on the ris ing edge of CLK when CPnOPC,

CPnMREQ, and CPTBIT are all LOW i n th e cu r ren t bus cycle.

These conditions indicate th at the cu rrent ins truction is abo ut to compl ete

execution, because the first action of any instruction perform ing an instruction

fetch is to refill the pipeline.

Any instructions that are flushed from t he ARM7T DMI-S pr oce ssor pipeline never

signal on CPnI that they have entered Execute, and s o they are automatically flushed

from the coproce ssor pi peline by the prefet che s required to refill the pipeline.

There are no coprocesso r instructions in the Thumb instru ction set, and so copro cessors

must mo nit or the state of the CPTBIT signal to ensure that they do not tr y to decode

pairs of Thumb instructions a s ARM instructions.

Coprocessor Int erface

4-6

ARM DDI 0234A

4.4 Coprocessor interface handshaking

The ARM7TDMI-S core and any coprocessors in the system perform a handshake

using the signals shown in Table 4-2.

These signals are explained in more detail in Coprocessor signaling on page 4-7.

4.4.1 The coprocesso r

The coprocessor dec odes th e ins truction curre ntly i n the Decod e stage of its pipeline

and checks whe ther that instruction is a c oprocessor instruction. A c oprocessor

instruction has a coproce s sor number that matches the coproce s sor ID of the

coprocessor.

If the instruction cur r ently in the Decode stage is a co p r oc esso r in st r u ct io n :

1. Th e coprocess o r att empt s to e xecute the ins t r uction .

2. The coprocessor signals b ack to the ARM7TDMI-S core using CPA and CPB.

4.4.2 The ARM7 TDMI-S core

Copr oce ssor instructions progress down the ARM7TDMI-S pr ocessor pipeline in st ep

with th e coprocess or p ipeline. A co processor i nstruction i s e xecu ted if the foll owin g are

true:

1. The coproc es sor instru ction has reached the Execute stage of the pipeline. (It

migh t not if it w as preceded by a b r anch.)

2. The instruction has passed its conditional execution tests.

3. A coprocessor in the system has signaled on CPA and CPB that it is able to accept

th e instruction.

If al l these re quirements are met, the ARM7TDMI-S core signal s by ta king CPnI LO W ,

committing the coproc es sor to the e xecution of the coproc essor inst ruction.

Table 4-2 Handshaking signals

Signal Direction Meaning

CPnI ARM7TD MI-S to coprocessor Not coprocessor instruction

CPA Coprocessor to A RM7TDMI-S Cop rocessor absent

CPB Coprocessor to ARM7TDMI-S Coprocessor busy

Coprocessor Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

4-7

4.4.3 Coprocesso r signali ng

The coprocessor si gnals as follows:

Coproce ssor absent If a copro ce ssor canno t accept the instruc tion current ly in Decode

it must leave CPA and CPB both HIGH.

Co pro cesso r p rese n t

If a coprocessor can accept an instruction, and can start that

instruction immediatel y, it must signal this by dr iving both CPA

and CPB LOW.

Coproce ssor busy (busy-wait)

If a coprocess or can ac ce pt an instruction, but is curre ntly unable

to proc ess that req uest, it can s tall the ARM7TD MI - S core by

assert ing busy-wait. T his is signaled by driving CPA LOW, but

leaving CPB HIGH. When the coprocessor is ready to start

executing the instruction it signals this by dri ving CPB LOW . This

is shown i n Figure 4-1.

Figure 4-1 Coprocessor busy -wait sequence

ADD SWINETSTCPDOSUB

TSTCPDOSUBADD SWINE

CPDOSUBADD SWINETST

IFetch IFetchIFetchIFetch IFetch IFetchIFetch

(ADD) (SUB) (SWINE)(TST)(CPDO)

coprocessor busy-waiting

CLK

Fetch stage

Decode stage

Execute stage

CPnI (from core)

CPA (from

coprocessor)

CPB (from

coprocessor)

RDATA[31:0]

Coprocessor Int erface

4-8

ARM DDI 0234A

4.4.4 Conseq uen ces of busy-wa iting

A bus y-wait ed coproc essor inst ruction can be inte rrupte d. If a va lid FI Q or IRQ oc curs

(the ap propriate bit is cleare d in the CSPR), the ARM7TDMI-S core abandons t he

copr ocessor ins truction, and sign als this by taki ng CPnI HIGH. A co process or that is

capable of busy-waiting must monitor CPnI to detect this condition. When the

ARM7TDMI-S core abandons a coprocessor instruction, the coprocessor also abandons

the ins truction and cont inues tracking the ARM7TDMI-S proc essor pipeline.

Caution

It is essential tha t any action taken by the coproce ssor while it is busy-waiting is

idem potent. The actio ns taken by the coprocessor must not corrupt the state of the

coprocessor, and must be repeatable with identical results. The coprocessor can only

change its own state after the instruction has been executed.

4.4.5 Coprocesso r register tran sfer instructions

The co p roc ess or r e gi ster tr ansf e r ins tr uct ion s, MCR and MRC, tr ans fe r dat a be twee n a

regi ste r in t he ARM7TDMI-S processor re gi ster bank and a regi ster in th e coprocessor

reg ist er ba n k . A n exam p l e seq u en ce for a co p r oc esso r regi st er tr an sf e r is s hown in

Figure 4-2.

Figure 4-2 Coprocessor register transfer sequence

ADD SWINETSTMCRSUB

TSTMCRSUBADD SWINE

MCRSUBADD SWINETST

IFetch IFetchIFetchIFetch IFetchIFetch

(ADD) (SUB) (SWINE)(TST)(MCR)

CLK

Fetch stage

Decode stage

Execute stage

CPnI

(from core)

CPA (from

coprocessor)

CPB (from

coprocessor)

RDATA[31:0]

WDATA[31:0]

Coprocessor Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

4-9

4.4.6 Coprocesso r data operati on s

Copr oce ssor d ata ope rations, CDP in st ructions, per form processing operat ions on the

data held in the coprocessor regist er bank. No inform ation is tra nsferred be tween the

ARM7TDMI-S core and the c oprocessor as a result of this operation. An example

seq uenc e is shown in F igure 4-3.

Figure 4-3 Coprocessor data operation sequence

ADD SWINETSTCPDOSUB

TSTCPDOSUBADD SWINE

CPDOSUBADD SWINETST

IFetch IFetchIFetchIFetch IFetchIFetch

(ADD) (SUB) (SWINE)(TST)(CPDO)

CLK

Fetch stage

Decode stage

Execute stage

CPnI

(from core)

CPA (from

coprocessor)

CPB (from

coprocessor)

RDATA[31:0]

Coprocessor Int erface

4-10

ARM DDI 0234A

4.4.7 Coprocesso r load and s tore operati on s

The coprocessor load and store instructions are used to tra nsfer data between a

coprocessor and memory. The y can be used to transfe r either a sin gle word o f data or a

numbe r of the co processor registers . The r e is no limit to the number of words of dat a

that can be transferred by a single LDC or STC instruc tion, but by convention a

coprocessor must not transfer more than 16 words of data in a single ins truction. An

example sequence is shown in Figure 4-4.

Note

If you transfe r more than 16 words of data in a s ingle inst ruction, the worst case

interrupt late ncy of the ARM7TDM I-S core increases.

Figure 4-4 Coprocessor load sequence

ADD SWINETSTLDCSUB

TSTLDCSUBADD SWINE

LDCSUBADD SWINETST

IFetch IFetchIFetchIFetch CP data IFetchIFetch

(ADD) (SUB) (SWINE)(TST)(CPDO)

CLK

Fetch

stage

Decode

stage

Execute

stage

CPnI

(from core)

(from coprocessor)

RDATA[31:0]

n=4

CPA

(from coprocessor)

CPB

CP dataCP dataCP data

Coprocessor Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

4-11

4.5 Connecting coprocessors

A coprocessor in an ARM7TDMI-S processor-based system must have 32-bit

connections to:

•transfer da ta from memory (instruction stream and LDC)

•write data from the ARM7TDMI-S (MCR)

•read data to the ARM7TDMI-S (MRC ).

4.5.1 Connecting a single coprocessor

An example of how to connec t a c oprocess or into an ARM7TDMI-S processor-based

system is shown in Figu re 4-5.

Figure 4-5 Coprocessor connections

ARM

Coprocessor

Memory

system

RDATA

WDATA

ase

csel

CPDOUT

CPDIN

bsel

Coprocessor Int erface

4-12

ARM DDI 0234A

The fragments of Ve rilog that describe the regist er logic to derive

asel

bsel

, an d

csel

from the relevant ARM7TDMI-S processor or ARM7TDMI processor pins are

des cribed in this se ction.

The logic for asel, bsel, and csel is as follo ws:

assign asel = ~(cprt | (cpdt & nRW_r));

assign bsel = ~cpdt;

assign csel = cprt;

assign cpdt = ~nMREQ_r & ~CPA_r2 & nOPC_r;

assign cprt = nMREQ_r & SEQ_r;

Note

cpdt

shows th at the current cycle is a load or store cycle du e to a n LDC or S TC

instruction.

cprt

shows th at the curren t cycle is a copro cesso r regis ter transfer cycle.

The o t her sign als used to drive thes e terms are as f ollow s:

always @(posedge CLK)

if (CLKEN)

begin

nMREQ_r <= CPnMREQ; // Output from ARM7TDMI-S

SEQ_r <= CPSEQ; // Output from ARM7TDMI-S

nOPC_r <= CPnOPC; // Output from ARM7TDMI-S

nRW_r <= WRITE; // Output from ARM7TDMI-S

CPA_r <= CPA; // Input to ARM7TDMI-S

CPA_r2 <= CPA_r;

end

Note

If you are building a sys tem wi th an ETM and an ARM7TDMI-S pro cessor, you must

directly connect the ETM7 RDATA[31:0] and WDATA[31:0] to th e ARM7 TD M I - S

RDATA[31:0] and WDATA[31:0] buses. This enables the ETM to co r r ectly trace

coprocessor instructions.

Coprocessor Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

4-13

4.5.2 Conne ctin g multiple coprocessors

If you have multiple coprocessors in your sys tem, connect the handshake signals as

shown in Ta ble 4-3.

You must als o mul tiplex the output data from the coprocessors.

Table 4-3 Handshake signal connections

Signal Connection

CPnI Connect this signal to all coprocessors present in the system

CPA and CPB The individual CPA and CPB outputs f rom each coprocessor must be

ANDed together, and connected to the CPA and CPB input s on the

ARM7TDMI-S processor

Coprocessor Int erface

4-14

ARM DDI 0234A

4.6 Not using an external coprocessor

If you are i mplementin g a syst em that does n ot include any extern al coproce ssors , you

mus t tie both CPA and CPB HIGH. This indic ates that no external coprocessors are

present in the system. If any coprocessor instructions are received, they take the

undefined instruction trap so that they can be emulat ed in software if required.

The coprocessor-specif ic outputs from the ARM7TDMI-S proc essor must be left

unconnected:

•CPnMREQ

•CPSEQ

•CPnTRANS

•CPnOPC

•CPnI

•CPTBIT.

Coprocessor Interface

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

4-15

4.7 Undefin ed instructions

The ARM7TDMI-S processor implements full ARM architecture v4T undefined

instruction handling. This me ans that any instruc tion defined in the ARM Archi tect u re

Ref erence Manual as

UNDEFINED

, au tomaticall y causes the ARM7T DMI-S processor to

take the undefined ins truction trap. Any cop r oce ssor instructions that are not ac cepted

by a coprocessor also result in the ARM7TD MI-S processor taki ng the undef ined

instruction trap.

Coprocessor Int erface

4-16

ARM DDI 0234A

4.8 Privileged instructio ns

The out put signal CPnTRANS enables the implementation of coproce ssors, or

coprocessor instructions, that ca n only be accessed from privileged modes. The si gnal

meanings are shown in Table 4-4.

The CPnTRANS signal is sam p led at the same time as the instruc tion, and is factored

into the coprocessor pipeline Decode s tage.

Note

If a User mode proc ess (CPnTRANS LO W) tries to access a coprocessor instruction

that can only be e xecut ed in a pri vileg ed mode, the coprocessor must r espond with CPA

and CPB HIGH. This causes the ARM7TDMI-S processor to take the undefined

instru ct io n trap .

Table 4-4 CPnTRANS signal meanings

CPnTRANS Meaning

LOW Use r m o de ins tru ct ion

HIGH Privileged mode instruction

ARM DDI 0234A
Copy right © 20 01 AR M Limited. A ll rights reserved.
5-1
Chapter 5 
Debugging Your System
This chapter de scribes the debug fe atures of the ARM7TDMI-S processor. It contains 
the following sections:
•About debugging your system on page 5-3
•C o nt rol lin g d e bu gg in g  on page 5-5
•Entr y into debug state  on pa g e 5- 7
•Debug interface  on page 5-12
•ARM7TDMI-S core clock doma ins on page 5-13
•The Em b e ddedIC E - RT m ac ro c el l on page 5-14
•Disabling Embedde dICE-RT on page 5-16
•The debug com munications channel on page 5-20
•Scan chains and the JTA G interface  on page 5 - 24
•Resetting the TAP controller on page 5-27
•Public JTAG instructions  on page 5-28
•Test dat a registers on page 5-31
•Scan timing on page 5-36
•Examining the core and the system in debug state on page 5-39
•The program counter during debug on  pag e 5-44
•Priorities and exceptions on page 5-47

Debugging Your System

5-2

ARM DDI 0234A

•Watc hpoint unit re gisters on page 5-48

•Programmi ng break points on page 5-53

•Programmi ng watchpoints on page 5-55

•Abor t s tatus register on page 5-56

•Debug control register on page 5-57

•Debug status register on page 5-60

•Coup ling breakpoints and watchpoints on page 5-62

•Em be dde d ICE - RT tim i ng on page 5-65.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-3

5.1 About debugging your system

The advanced debugging features of the ARM7TDMI-S (Rev 4) processor make it

easier to develop applica tion softw are , operating syste ms, and the hardwar e itself.

5.1.1 A typical debug system

The ARM7 TDMI-S proc es s or forms one component of a deb ug system t hat interfaces

from th e high-level debug ging t hat you pe rform to th e lo w-level i nte rface support ed by

the ARM7T DMI-S pr oce ssor. Figure 5-1 shows a typica l debug system.

Figure 5-1 Typical debug system

A debug system usually has three parts:

Debu g host A compu ter that is running a software debugger such as the ARM

Debu gger fo r Wind o w s (ADW). The debug hos t enables you to

issue high-level commands su ch as setting breakpoints or

examining the contents of memory.

Pr otocol converter T h is in t er f aces be tween th e hig h - l eve l co m mand s is s ued by the

debug host and the lo w-lev el comm ands of the ARM7TDMI-S

processor JTAG i nterface. Typically it interfac es to the host

through an interface such as an enh anced parallel port.

Debug host

(host compiler

running ARM or

third party toolkit)

Protocol converter

(for example Multi-

ICE)

Debug target

(development

system containing

ARM7TDMI-S

processor)

Debugging Your System

5-4

ARM DDI 0234A

Debug target The ARM7TDMI-S processor has hardware ext ensions that ease

debugging at the lowest level. These extensions e nable you to:

•halt program execution

•ex amine and mod ify the i n ternal state of th e co re

•ex amine the state of th e mem o ry system

•exe cute abort exceptions, allowing real-time monitoring of

th e co r e

•resume prog ram executio n.

The debug h ost and the protocol converter are syste m-dependent.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-5

5.2 Controlling debu gging

The major blocks of the ARM7TDMI-S processor are :

ARM CPU core This has hardware support for debug.

EmbeddedICE-RT macrocell

A set of reg is ters and com parators that you use to generate debug

exceptions (such as breakpoints). This unit is described in The

EmbeddedICE-RT mac rocel l on page 5-14.

TAP controller Controls the ac tion o f the s ca n cha ins using a JTA G se rial

interf ace. For m ore details, see The TAP controller on page 5-26.

These blocks are show n in F igure 5-2.

Figure 5-2 ARM7TDMI-S block diagr am

5.2.1 Debug modes

You can perform debugging in either of the following modes:

Halt mode When t he system is in halt mode, the core e nters deb ug stat e when

it en counters a b reakpoint o r a watchpoin t. In deb ug stat e, the core

is stopped and isolated from the res t of the system. When debug

has completed, the de bug host restores the co re and system state ,

and program ex ec ution res um es .

ARM7TDMI-S

EmbedddedICE-RT CPU core

ARM7TDMI-S

TAP controller

Scan chain 2

Scan chain 1

Debugging Your System

5-6

ARM DDI 0234A

For more informat ion, see E ntry into debug state on page 5-7.

Monitor mode When the system is in monitor mode, the core doe s not enter

debu g stat e on a bre akpoint or watc hpoi nt. Ins tead, an Instruc tion

Abort or Dat a Abor t is gene rat ed and the core continues to recei v e

and service interrupts as normal. You can use the abort status

regi st er to esta blish whether the exception wa s due to a breakpoint

or watch point, or to a genuine memory abort.

For more information, see Monitor mode debugging on page 5-18.

5.2.2 Examining system state during debugging

In both halt mode and monitor mo de, the JTAG-styl e s erial inte rface enables you to

examine the internal state of the core and the external state of the system while system

activi ty continues .

In ha lt mode, this enabl es instructions to be inser ted serially into th e core pipeline

without using t he ext ern al data b us . For e xampl e, when in deb u g state, a Store M ultiple

(

STM

) can be in se rted into the ins truction pipeline to export the contents of the

ARM7TDMI-S pr ocessor registers. This data can be s erially shifted out without

affec ting the rest of the sys te m. For more information, see Examining the core and the

system in debug state on page 5-39.

In monit or mode, the JTAG interfa ce is used t o transf er data be tween the deb ugge r and

a simpl e monitor p rogram runni ng on the ARM7TDMI-S core.

Fo r detai led in formation a bout the s can chain s and t he JTA G in terfa ce, se e Scan c ha ins

and the JTAG interface on page 5-24.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-7

5.3 Entry into debug state

If the sys tem is in halt mode , any of th e follo wi ng types of int erru pt force the proc essor

into debug stat e:

•a brea kpoint (a given ins truction fetch)

•a watchpoint (a data acces s)

•an externa l debug request.

Note

In monitor mode, the pr oce ssor cont inues to ex ecute ins tructions in re al time, and will

t ake an abo r t exception. The abor t status re g i ster enables y o u to establish w h ether th e

exception was due to a breakpoint or watchpoint, or to a genuine memory abort.

You can us e the EmbeddedICE-RT logic to program the conditions under which a

break point or watchpoint can oc cur . Alte rnati vely , you can use the DBGBREAK signa l

to enable ext ernal logic to flag breakpoi nts or watchpoints and monitor the following:

•address bus

•data bus

•control signals .

The timing is the same for externally-generated breakpoints and watchpoints. Data must

alwa ys be valid around the rising edge of CLK. When this data is an instruction to be

break poin ted, the DBGBREAK sig nal mus t be HIGH around the rising ed ge of CLK.

Sim ilarl y , when t he data is for a loa d o r sto re, as se rting DBGBREAK ar ound the r ising

edge of CLK marks the data a s wa tchpointed.

When a breakpoint or watchpoint is g enerated , there might be a de lay before the

ARM7TDMI-S core enters debug state. When it enters debug state, the DBGACK

sign al is asse rted. T he timing for an externall y-generated breakpoint is sho wn in

Fig ure 5-3 on page 5-8.

Debugging Your System

5-8

ARM DDI 0234A

Figure 5-3 Deb ug state ent ry

5.3.1 Entry into debug state on breakpoint

The ARM7TDMI-S processor marks instructions as being breakpointed as they ente r

the ins truction pipeline, but the c ore does not ent er debug st ate until the inst ruction

reach es the Execu te stage.

Breakpointed instructions are not executed. Instead, the ARM7TDMI-S core enters

debug st ate. When you e xami ne the internal state , you s ee the state before the

breakpointed instruct ion. When your exam ination is complete, re move the breakpoi nt.

Program execution restarts from the previously-brea kpoint ed instruction.

When a breakpointed conditional instruc tion reaches the Execute stage of the pi peline,

the breakpoint is always taken if the system is in halt mode. The ARM7TDMI-S core

enters deb ug state regardless of whet her the ins truction condition is met.

A breakp ointed i nstruc tion doe s not c ause the ARM7TDMI-S core to ente r deb ug st ate

when:

•A br anch or a write to the PC precedes the breakpointed ins truction. In this case,

when t he branch i s executed, the ARM7TDMI-S processor fl ushes the instruc tion

pipeline, so cance ling the breakpoint.

•An exception oc curs, causing the ARM7TDMI-S pro cessor to flus h the

instruction pipeline, and canc el the breakpoint. In normal circ um stances, on

exit in g fr o m an exc ep tion , th e ARM 7 TD M I - S co re branch es bac k to the

inst ructio n that w ould ha v e been exe cute d next bef ore the e xcepti on occurre d. In

this case, the pipe line is refilled and the breakpoint is reflagge d.

CLK

Internal cyclesMemory cycles

ADDR[31:0]

DBGACK

DATA[31:0]

DBGBREAK

TRANS[1:0]

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-9

5.3.2 Entry into debug state on watchpoint

W a tchpoints occ ur on data accesses. In halt mode, the core processing st ops. In monitor

mode, an abort exception is executed (see Abort on page 2- 22). A wat chpoint is al w ays

taken, bu t a core in halt mode m ight not enter debug state immediately bec aus e the

cu r ren t instruction alway s completes . If t h e cu rrent in struction is a multi w o r d load or

store (an

LDM

STM

), many cycles can el apse before the wa tchpoint is ta ken.

On a watc hpoint, the following sequence occurs :

1. Th e current instruction completes.

2. All c h anges to the core stat e are made.

3. Load data is written into the destination registers.

4. Base write-back is perform ed.

Note

Watchpoints are simila r to Data Aborts. The difference is that when a Data Abort

occurs, although the inst ruction completes, the ARM7TDMI-S core prevents all

subsequent changes to the ARM7TDMI-S processor state. This action enables the abort

handler to cu re the cause of the abort, so the instruction ca n be re-executed.

If a w atchp oint oc curs when an except ion is pendi ng, the core enters debug state in the

same mode as the exception.

5.3.3 Entry into debug state on debug request

An ARM7TDMI-S core in halt mode can be forced into debug state on debug request

in either of the foll owing ways:

•through Embedde dICE-RT programming (see Programming breakpoints on

page 5-53, and Programming watchpoints on page 5-55.)

•by asserting the DBGRQ pin.

When the DBGRQ pin has been asserted, the core normall y enters debug state at the

end of the c urrent instruction. However, when the current ins tructio n is a busy-wai ting

access to a coprocessor, the instruction terminates, and the ARM7TDMI-S core enters

de bug st ate immed iately. This is s i milar to the action of nIRQ and nFIQ.

5.3.4 A ction of the ARM7TDMI-S in debug state

When th e ARM7TDMI-S proc essor e nters d ebug sta te, the core forces TRANS[1:0] to

indic ate int ernal cyc les . Th is a ction enab les the r est of the memory syste m t o i gnore t he

ARM7TDMI-S c ore and to function a s normal. Because th e rest of the syst em c ontinues

to operate, the ARM7TDMI-S core is forced to ignore aborts and interrupts.

Debugging Your System

5-10

ARM DDI 0234A

Caution

Do not reset the core while debugging, otherwise the debugger loses trac k of the co re.

Note

The s yst em mu st no t ch ange th e CFGBIGEND sig nal duri ng de bug. From the poi nt of

view of the programmer, if CFGBIGEND cha nges, the ARM7TDMI-S processor

changes, with the debugge r unaware that the core has reset. You must also ensure that

nRESET is held st able during debug. When the syste m ap plies res et to the

ARM7TDMI-S processor (that is, nRESET is driven LO W), the ARM7TDMI-S

processor state changes with the de bugger unaware that the co re has reset.

5.3.5 Clocks

The system and test clocks must be synchronized externally to the macrocell. The ARM

Multi-ICE debug agent directly supports one or more cores within an ASIC design.

Synchronizing of f-chip debug clocking with the ARM7TDMI-S macrocell re quires a

three-sta ge synchronizer. The of f-chip device (for example, Multi -ICE) issues a TCK

sign al and waits for the RTCK (Retur ned TCK) signa l to come back. Syn chroniz ation

is mai ntaine d be cause th e of f- chip device doe s not pr ogress to the next TCK unt il afte r

RTCK is received.

Figu re 5-4 on page 5-11 shows this sync hronization.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-11

Figure 5-4 Clock synchronization

Note

All the D-types shown in Figure 5-4 are reset by DBGnTRST.

Reset circuit DBGnTRST

nTRST

DBGTDOTDO

DQDQDQ

CLK

TCK synchronizer

TCK

RTCK

TMS

Input sample

and hold

CLK

TDI

DBGTMS

DBGTDI

ARM7TDMI-Smacrocell

Multi_ICE interface pads

DBGTCKEN

Debugging Your System

5-12

ARM DDI 0234A

5 .4 Debug interf ace

The ARM7TDMI-S processor debug interface is based on IEEE Std . 1149.1- 1990,

Standard Test Access Port and Bou ndary-Scan Architecture. Refer to this standard for

an explanation of the terms used in this chapter, and for a description of the TAP

controller states.

5.4.1 Debug interf ace signals

There ar e th r e e pr i mary ext ern al sig n a ls as s ociated wi t h th e debu g interfa ce:

•DBGBREAK and DBGRQ are syste m requests for the ARM7TDMI-S core to

ent er de bug stat e

•DBGACK is used by the ARM7TDMI-S core to flag back to the system that it is

in debug state.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-13

5.5 ARM7TDMI - S core clock domains

The ARM7TDMI-S proc essor has a single clock, CLK, that is qual ified by two clock

enables:

•CLKEN contro ls access to the me mor y system

•DBGTCKEN controls de bug operations.

During norm al opera tion, CLKEN condit ions CLK to clock the core. When the

ARM7TDMI-S proc essor is in deb ug state, DBGTCKEN conditions CLK to clock t he

core.

Debugging Your System

5-14

ARM DDI 0234A

5.6 The Em beddedICE-RT m acrocell

The ARM7TDMI-S proc essor EmbeddedICE-RT macrocell module provides

integrated on-chip debug support for the ARM7TDMI-S core.

Embedde dICE-RT is programmed serially using the ARM7TDMI-S proc es s or TAP

controller. Figure 5-5 illustrates the relationship between the core, EmbeddedICE-RT,

and the TAP co ntr oller, showing only the signals tha t ar e p ertinent to

EmbeddedICE-RT.

Figure 5-5 The ARM7TDMI-S core, TAP control ler, and EmbeddedICE-RT macr ocell

CLK

ARM7TDMI-S

core

EmbeddedICE-RT

macrocell DBGRNG[1:0]

DBGACK

DBGBREAK

DBGCOMMTX

DBGCOMMRX

DBGRQ

DBGEXT[1:0]

DBGEN

TAP

DBGTCKEN

DBGTMS

DBGTDI

DBGTDO

DBGnTRST

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-15

The EmbeddedICE-RT logic c ompris es the f ollowing:

Tw o real -time watchpoint units

You can program one or both watchpoint units to ha lt the

execution of instructions by the core. Execution halts when the

values programmed into EmbeddedICE-RT match the values

curr ently appearing on the a ddress bus, data bus, a nd various

control si gnals. You can mask any bit so that its value does not

af f ect the comparison.

You ca n confi gure each watchpoint unit to be either a watchpoint

(monitoring data accesses) or a breakpoint (monitoring instruction

fetches). Watc hpoints and breakpoints c an be data-dependent.

For more details, s ee Watc hpoint unit registers on page 5-48.

Abort status register

This re gister identifies the cause of an ab or t excep tion en try. For

more information, see A bort status register on page 5-56.

Debug Commu nications Channe l (DC C)

The DCC passes informa tion between the target and the host

debugge r. For more information, see The debug communications

channel on page 5-20.

In addition, two independent registers provide overall c ontrol of EmbeddedICE-RT

operation. These are describ ed in the followin g se ctions:

•Debug control register on page 5-57

•Debug status register on page 5-60.

The locations of the EmbeddedICE-RT registers are given in EmbeddedIC E-RT re gis te r

map on page 5-17.

Debugging Your System

5-16

ARM DDI 0234A

5.7 Disabling EmbeddedICE-RT

You can dis able Embe ddedICE-RT in two ways:

Permanently By wiri ng the DBGEN input LOW.

When DBGEN is LOW:

•DBGBREAK an d DBGRQ ar e ignored b y the core

•DBGACK is forced LOW by the ARM7TDMI-S core

•interr upts pass thr ough to the process or uninhibite d

•the EmbeddedICE-RT logic enters low-power mode.

Caution

Hard-wiring the DBGEN input LOW perma nently disabl es d ebug

access. However, you must not rely on this for system s ecurity.

Temporarily By set ting bit 5 i n the debug control register (descri b ed in Debug

control register on page 5-57). Bit 5 is also known as the

EmbeddedICE -RT disable bit.

You must set bit 5 before doing either of the following:

•program mi ng brea kpoint or watchpoint regis ters

•changing bit 4 of the deb ug control regi ster.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-17

5 .8 Emb ed dedICE-RT regi st er map

The locations of the EmbeddedICE-RT registers are shown in Table 5-1.

Table 5-1 Function and mapping of EmbeddedICE-RT registers

Address Width Function

b00000 6 Debug control

b00001 5 Debug status

b00100 32 Debug Communications Channel (DCC) control

b00101 32 Debug Communications Channel (DCC) data register

b01000 32 Watchpoint 0 address value

b01001 32 Watchpoint 0 address mask

b01010 32 Watchpoint 0 data value

b01011 32 Watchpoint 0 data mask

b01100 9 Watchpoint 0 control va lue

b01101 8 Watchpoint 0 control mask

b10000 32 Watchpoint 1add ress value

b10001 32 Watchpoint 1 address mask

b10010 32 Watchpoint 1 data value

b10011 32 Watchpoint 1 data mask

b10100 9 Watchpoint 1 control va lue

b10101 8 Watchpoint 1 control mask

Debugging Your System

5-18

ARM DDI 0234A

5.9 Monitor mode debugging

The ARM7TDMI-S (Rev 4) process or contains logic that enables the debugging of a

system without stopping the core entirely. T his means tha t critica l interrupt routines

continue to be serviced while the core is being interrogated by the debugger.

5.9 .1 E nabl i ng m onito r m od e

The debugging mode is controlled by bit 4 of the deb ug control regi st er (des cribed in

Debu g c ontrol r egister on page 5-57). Bi t 4 of thi s re gi ster is a lso kno wn as t he monito r

mode enable bit:

Bit 4 set Enables the moni tor m ode features of the ARM7TDMI-S proc essor.

When this bit is set, the EmbeddedICE-RT logic is configured so that a

breakpoint or watchpoint causes the ARM7TDMI -S core to ente r abort

m od e, taki n g the P re f e t ch or D at a A b or t vecto r s respec tively.

Bit 4 clea r Monitor mode debugging is disabled and the s ystem is pl aced into hal t

mode. In halt mode, the cor e ent ers debug state when it encount ers a

breakpoint or watchpoint.

5.9. 2 Restrictions on monitor-mode debugging

There are se veral restrictions you must be aware of when the ARM core is configured

for monit or-mode debugging:

•Breakpoints and watc hpoints cannot be data -dependent in mon itor mode. No

support is provided for use of the range functionality. Breakpoints and

watchpoints can only be based on the following:

—instruction or data addresses

—external wa tchpoint conditioner (DBGEXT[0] or DBGEXT[1])

—User or privile ged mode access (CPnTRANS)

—read/ write access for watc hpoints (WRITE)

—ac ce ss si ze (wat ch p oi n ts SIZE[1:0]).

•Exte rnal brea kpoints or watch points are not sup ported.

•No support is provided to m ix halt mode and monitor m ode functionality.

The fact that an abort has been generated by the mon itor mode is r ecorded in the abo r t

status register in coprocessor 14 (see Abort status register on page 5-56).

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-19

The monitor mod e enable bit does not put the ARM7TD MI-S pr oce ssor into debug

sta te. F or this re ason, it is neces s ary to change the contents of the wa tchpoint registers

while external memory accesses are taking place, rather than changing them when in

de bug state whe re the co r e is halted.

If there is a pos sibility of false matches occurring during changes to the watchpoint

registers (caused by old data in som e re gisters and new dat a in others) you mu st :

1. Disable the watc hpoint unit by sett ing bit 5 in the debug control register (also

known as the EmbeddedICE-RT disable bit).

2. Poll th e debug cont rol regis ter unti l the Embedd edICE-R T dis able bit is read back

as set.

3. Change the other registers.

4. Re-enable the w atchpoint unit by cle ari ng the Embe ddedICE-RT disable bit i n the

debug control register.

Debugging Your System

5-20

ARM DDI 0234A

5.10 The debug communications channel

The ARM7TDMI-S (Rev 4) Embe ddedICE-RT contains a De bug Communication

Channel (DCC) for pas sing i nforma tion bet ween t he t arge t and t he h ost deb ugge r . This

is implemented as coprocessor 14.

The DCC comprises two registers, as follows:

DCC control register

A 32- bit re gi ster , u sed for s yn chroniz ed ha ndshak ing bet ween t he

processor and the asynchronous debugger. For more details, s ee

DCC control register .

DCC data register

A 32-bit register, used for data transfers between the debugger and

the processor. F or more d etails, see Communications throug h the

DCC on page 5-22.

These registers oc cupy fix ed lo cations in t he Embedded ICE-R T memory map, as shown

in Table 5-1 on page 5-17. They are accessed from the processor using

MCR

and

MRC

instructions to coproc essor 14.

Th e r egisters are accessed as follows:

By th e debugger Through s can chain 2 in the usual way.

By th e proc essor Through coproc es s or register trans f er ins tructions .

5.10.1 DCC control register

The DCC control registe r is read-only and enable s sync hronized hands haking between

the processor and the debugger. The regi ster format is shown in Figure 5-6.

Figure 5 -6 DCC control register

31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00

0 RW100

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-21

The DCC control register bit assignments are shown in Table 5-2.

Note

If ex ecut ion is halt ed, bit 0 might rema in asse rte d. The deb ugger ca n clear it b y writ ing

t o th e D CC control register.

Writing to this register is rarely necessary, because in normal operation the processor

cle ars bit 0 after read ing it.

Instructions

The fol lowing instructions must be us ed:

MRC CP14, 0, Rd, C0, C0

Retu r n s the value fro m the DCC control register into the

dest ination regist er Rd.

MCR CP14, 0, Rn, C1, C0

Writes the value in the source register Rn to the DCC data write

Table 5-2 DCC control regist er bit ass ignment s

Bit Function

31:28 Contain a fixed patt ern that denotes the

Embed dedICE-RT v ersion numb er, in this case

b0001.

27:2 Reserved.

1 The write control bit.

If t hi s bi t is cl ea r , th e DCC dat a wr it e r egi st er is r ead y

to accept data from the processor.

If this bit is set, there is data in the DCC data write

registe r and the debugger can scan it out.

0 The read control bit.

If this bit is clear, the DCC data read register is ready

t o ac c e p t data from t h e de bugg e r.

If this bit is set, the DCC data read register contains

new data t hat has no t been read by the pro cessor , and

the debugger must wait.

Debugging Your System

5-22

ARM DDI 0234A

MRC CP14, 0, Rd, C1, C0

Retu r n s th e valu e fro m th e D C C d at a re a d r egi ster in to th e

destination register Rd.

Note

The Thumb instruction se t does not contain coproce ssor i nstructions, so it is

recommended that these are accessed using SWI instructions when in Thumb state.

5.1 0.2 Com mun ications th roug h t he D C C

Messages can be sent and receiv ed through the DCC.

Sending a message to the debugger

When the processor wishe s t o send a mes sa ge to the debugger, it must check that the

DCC data write register is free for use by finding out whether the W bit of the DCC

co n tro l r egister is cl ear.

The processor reads the DCC c ontrol register to check the st atus of the W bi t:

•If W bit is clear, the D C C d at a w r it e r egi st er is cl ear.

•If the W bit is set , pre vi ously wri tten da ta has not been re ad by t he deb ugge r . The

process or must continue to poll the control register until the W bit is clear.

When the W bit is clear, a message is written by a register transfer to coprocessor 14.

As the data tra ns fer occ urs from the proce s sor to t he DCC da ta writ e re gi ste r , the W bit

is set in the DCC control register.

The deb ugger see s both the R and W bit s wh en i t polls the DCC contr ol regis ter through

th e JTAG i nte rfa ce . When t h e deb u g ger sees t hat th e W bi t i s set, i t c an r ea d th e co mms

data write reg is ter and s ca n the data out. The act ion of reading this data register clea rs

the debug comms control register W bit . At this point the communica tions process ca n

begin again.

Receiving a messa ge from the deb ugger

Transferr ing a message from the debugger to the proce ssor is sim ilar to sending a

mess age to the debugger. In this c as e, the debugg er polls the R bit of the d ebug comms

control regist er:

•If the R bit is LOW, the comms data read register is free, and data can be placed

there for the processor to read.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-23

•If the R bit is set, previously deposite d data has not yet been colle cted, so the

debugger must wait .

When the comms data read register is free, data is written there using the JTAG

interface. The action of this write set s t he R bit in the debug comms contro l register.

The proces sor polls the debug comms control register. If the R bit is s et, there is data

that can be read using an MRC instruc tion to coprocessor 14. The action of this load

clears the R bit in the debug comms control regis ter. When the debugger polls this

reg iste r and s ees that th e R bit is clea r , t he dat a has bee n tak en, a nd t he proc ess c an n ow

be repeated.

Debugging Your System

5-24

ARM DDI 0234A

5.11 Scan chains and th e JTAG interface

There are two JT AG-style scan chains within the ARM7TDMI-S processor. These allow

debugging and EmbeddedICE-RT programmi ng.

A JTAG-style Test Access Port (TAP) controller controls the scan chains. For more

details of the JTAG specifica tion, see IEEE Standard 1 149.1 - 1990 Standard Test

Access Port and Boundary -Scan Architecture.

5.11.1 Scan chain implementation

Th e two scan paths are referred to as scan chain 1 an d scan c h ain 2. They are shown in

Figure 5-7. Scan chain 0 is not implemented on the ARM7TDMI-S processor.

Figure 5-7 ARM7TDMI -S scan chain ar rangem ents

Scan chain 1

Scan chain 1 p ro v ides serial acce ss to the c o re da ta bus RDATA/WDATA and the

DBGBREAK signal.

There are 33 bits in this sc an chain, the order being (from serial data in to out):

•data bus bits 0 through 31

•the DBGBREAK bi t ( the f irst to be shifted o ut) .

ARM7TDMI-S

EmbedddedICE-RT CPU core

ARM7TDMI-S

TAP controller

Scan chain 2

Scan chain 1

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-25

Scan chain 2

Scan chain 2 ena b les ac cess t o th e EmbeddedI C E-RT re g i sters. See Test data registers

on page 5-31 for details.

5.11.2 Controlling the JTAG interface

The JTAG interface is driven by the currently-loaded instruction in the instruction

regi st er (de s cr i b ed in Instruction register on page 5-32). The loading of instructions is

co n trolled by the Test Access Port (TAP) control ler.

For more information about th e TAP controller, see Th e TAP contro ller on page 5-26.

Debugging Your System

5-26

ARM DDI 0234A

5.12 The TAP controller

The TAP controller is a state mach ine that d etermines th e state of th e ARM7TDMI-S

boundary-scan test signals DBGTDI and DBGTDO. Figur e 5-8shows the state

transitions that occur in the TAP controller.

Figure 5-8 Test access port controller stat e transit ions

Test-Logic Reset

0xF

Run-Test/Idle

0xC

Select-DR-Scan

0x7

Capture-DR

0x6

Capture-IR

0xE

Shift-DR

0x2

Shift-IR

0xA

Exit1-DR

0x1

Exit1-IR

0x9

Pause-DR

0x3

Pause-IR

0xB

Exit2-DR

0x0

Exit2-IR

0x8

Update-DR

0x5

Update-IR

0xD

Select-IR-Scan

0x4

tms=1

tms=0

tms=1 tms=1 tms=1

tms=0

tms=1

tms=0

tms=1

tms=1tms=1

tms=0 tms=0

tms=1 tms=1

tms=1

tms=0

tms=1

tms=0

tms=1

tms=0

tms=1

tms=0

tms=1

tms=0

tms=0 tms=0

tms=0

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-27

5.12.1 Resetting the TAP controller

To force t he TAP contro ller i nto the c orrect state after po wer -up, you must ap ply a reset

pulse to the DBGnTRST signal:

•When the boun dary-scan interface is to be used, DBGnTRST must be driven

LOW and then HIGH again.

•When the bound ary-sc an int erfac e is not to be used, you ca n ti e the DBGnTRST

input LOW.

Note

A clock on CLK with DBGTCKEN HIGH is not neces sary to r es et the device.

The action of reset is as follows:

1. Syste m mode is select ed. Thi s means t hat t he boundary- scan cells do not i ntercept

any of the signals passing between the external system and the core.

2. Th e I DCODE inst r u ction is select ed.

When the TAP controller is put into the S HIFT-DR s tate an d CLK is pulsed while

en a ble d by DBGTCKEN, the cont ents of th e ID register are clock ed out of

DBGTDO.

Debugging Your System

5-28

ARM DDI 0234A

5. 13 Pub lic JTA G i nstru ctio ns

Table 5-3 shows the public JTAG instructions.

In the following descriptions, the ARM7TDMI-S processor samples DBGTDI and

DBGTMS on the rising edge of CLK with DBGTCKEN H IG H . Th e TAP co n t rol ler

states are s hown in Figure 5-8 on page 5-26.

5.13.1 SCAN_N (0010)

The SCAN_N inst ruction connect s the sca n path sele ct re gist er between DBGTDI and

DBGTDO:

•In the CAPTURE - DR s tate, the fixed value 1000 is loaded into the register.

•In the S HI FT-DR s tate, the ID number of the desired sc an path is shifted into the

scan pa th selec t register.

•In the UPDATE-DR state, the scan register of the selected scan chain is connected

between DBGTDI and DBGTDO, and re mains conne cted until a subsequent

SCAN_N instruction is issue d .

•On reset, scan chain 0 is selected by d efault.

The scan path select register is 4 bits long in this implementation, although no finite

length is specified.

5.13.2 INTES T (1100)

The I N TEST in struction pl aces the se lected scan chain in test mode:

•The I NTEST i nstructi on c onnect s the se lected s can chain bet ween DBGTDI and

DBGTDO.

Table 5-3 Public instructions

Instructi o n Binary code

SCAN_N 0010

INTEST 1100

IDCODE 1110

BYPASS 1111

RESTART 0100

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-29

•When the INTEST instruction is loaded into the instruction register, all the scan

cells are placed in their test mode of operation.

•In the CAPTURE-DR state, the value of the data applied from th e core logic to

the output scan cells, and the value of the data applied from the system logic to

the input scan cells is captured.

•In the S HIFT-DR sta te, the pre vi ously- cap ture d t est data is s hif ted o ut of t he scan

chain through the DBGTDO pin, while new test data is shifted in through the

DBGTDI pin.

Sin gle-step operation of the core i s possible using the INT EST ins truction.

5.13.3 IDCODE (1110)

The IDCODE instruction connects the device identification code register (or

ID register) between DBGTDI and DBGTDO. The ID r egister is a 32-bit register that

enabl es the manufacturer, par t num ber, and versio n of a c omponent to be rea d through

the T AP. See ARM7TDMI-S device identification (ID) code register on pa ge 5-3 1 for t he

details of the ID regis ter format.

When the I D CODE instruction is loaded into the instruction regi ster , all the sca n cells

are pla ced in their normal (s ystem) mode of operation:

•In the CAPTURE - DR s tate, the device identifi cation code is capture d by the ID

•In the SHIFT-DR state, the previously c aptured device identification code is

shif te d out o f t he ID re giste r t hrough t he DBGTDO pin, while data is shifte d into

the ID register through the DBGTDI pin.

•In the UPDATE-DR state, the ID register is unaffected.

5.13.4 BYPASS (1111)

The BYPASS ins truction connects a 1-bit shift register (the bypass register) between

DBGTDI and DBGTDO.

Wh e n th e BYPAS S ins tru cti on is lo a d ed in to th e in s t r u ct io n reg iste r, all the scan cel l s

assume their normal ( system) m ode of ope ration. The BYP ASS instruction has no ef fect

on the s ystem pins:

•In the CAPTURE-DR s tate, a logic 0 is ca p t u red the b ypass r egister.

•In the SHIFT-DR state, test data is shifte d into t he bypass register through

DBGTDI and s hi fted o ut on DBGTDO a fte r a de lay o f on e CLK cy cl e. T he f ir st

bit to shift out is a zer o.

Debugging Your System

5-30

ARM DDI 0234A

•The bypa ss reg ister is not affected in the U PDATE- D R state.

All unused ins truction codes default to the BYPASS instruction.

5.13.5 RESTART (0100)

Th e RESTART instr uc tio n r es t art s th e pr oc e ssor o n exit from debu g s t ate. The

RESTART instr uct ion connec ts the bypa ss regis t er between DBGTDI and DBGTDO.

The TAP controller behaves as if the BYPASS in struction had been loade d.

The processor exits debug state when the RUN-TEST/IDLE state is entered.

For more informat ion, see Exit from debug state on page 5-42.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-31

5.14 Test data registers

The six test data registers th at can connec t between DBGTDI and DBGTDO are

de scr ib ed in th e following se c tio ns:

•Bypa ss register

•ARM7TDMI-S device identification (ID) code r egister

•Instruction register on page 5-32

•Scan path se lect register on page 5-32

•Scan chain 1 on page 5-34

•Scan chain 2 on page 5-34.

In the following descriptions, data is shifted during every CLK cycle w h en

DBGTCKEN enable is HIGH.

5.14.1 Bypass register

Purpose Bypasses the device duri ng sca n testing by providing a path

between DBGTDI an d DBGTDO.

Length 1 bit.

Oper atin g mode When the BYPASS instr u ction is the current ins tr uction in the

instruction register, serial data is tran sferred from DBGTDI to

DBGTDO in the SHIF T-DR stat e with a delay o f one CLK cy cl e

enabled by DBGTCKEN.

There is no paralle l output from the bypa ss register.

A logic 0 is loaded fro m th e parall el input of the byp ass re gister in

the CAP TURE-DR state .

5.14.2 ARM7TDMI -S device identification (ID) code regis ter

Purpose Re ads the 32-bit device identification c ode. No programmable

supplementary identification code is provided.

Length 32 bits. The format of th e ID code register is as shown in

Figure 5-9.

Figure 5-9 ID code regi ster forma t

011112272831

Version Part number Manufacturer identity 1

Debugging Your System

5-32

ARM DDI 0234A

The default device identification code is

0x7f1f0f0f

Opera ting mode When the IDCODE instruct ion is current, the ID register is

selected as the seri al path betwe en DBGTDI and DBGTDO.

There is no parallel output from the ID regi st er.

The 32-bit dev ice identi ficat ion co de is loaded into t he ID register

from its parallel inputs during the CAP TURE -DR state.

5.14.3 Instru ction reg ister

Purpose Changes the curr ent TAP inst ru ction.

Length 4 bits.

Opera ting mode In the SHIFT- I R state, the instruction regist er is selected as the

serial pa th between DBGTDI, and DB GTDO.

During the CAPTURE-IR st ate , the binary value 0001 is loaded

into this regis ter. Thi s va lue is shift ed out during S HIFT-IR (least

signi ficant bit first), whil e a new i nstruction is shifted in (lea st

significa nt bit first).

Durin g the UPDATE- IR s tate, the va lue in the ins t ruct ion regis t er

becomes the current instruction.

On reset, ID CO DE becomes the current i n struction.

There is no pa rity b it.

5.14.4 Scan path select register

Purpose Changes the current active scan chain.

Length 4 bits.

Opera ting mode SC AN_N as the cu rrent inst ruction in t he SHIFT-DR st ate selec ts

the scan path select register as the serial path between DBGTDI,

and DBGTDO.

During the CAPTURE-DR state, the value 1000 binary is l oaded

into thi s regi s ter. This v a lue i s lo aded out d urin g SHI FT-DR (le ast

signific ant bi t first), while a new valu e is loaded in (lea st

signi ficant bit first). Duri ng the UPDATE-DR state, the value in

th e reg i st er s el ec ts a sca n c ha in to be co me th e cu r re n t ly act ive

scan chain. All addi tional instructions, such as INTES T, then

apply to that scan ch ain.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-33

The currently-selected scan chain changes only when a SCAN_N

instruct io n is e xecuted, or when a rese t occurs. On reset, scan

cha in 0 is selected as the active scan chain.

Table 5-4 s h ows the scan chain number al lo cation.

5.14.5 Scan chains 1 and 2

The scan chains allow serial access to the core logic, and to the EmbeddedICE-RT

hardware for programming purposes. Each scan chai n ce ll is simple and comprises a

serial register and a multiplexor.

The sca n ce lls perform t hree basic functions:

•capture

•shift

•update.

For input cells, the capture stage involves copying the value of the syst em input to the

cor e in to the s er ial re gi ster. During s hift , t his va lue is ou tput seri al ly. The v alu e ap pli ed

to the co re from an input ce ll is e ither the system input, or the conten ts of the pa rallel

control.

For output cells, capture involves placing the value of a c ore output into the serial

re gister. During shif t, this value is se r ially output as bef o r e. The value applied to the

sys tem f rom an ou tput ce ll is ei the r th e cor e outpu t, or th e c onten ts of the seri al r e gist er.

Table 5-4 Scan chain number allocation

Scan chain number Function

0Reserveda

a. When sel ected , all r eserv ed scan c hains sc an

out zer os .

1Debug

2EmbeddedICE-RT

programming

3Reserveda

4Reserveda

8Reserveda

Debugging Your System

5-34

ARM DDI 0234A

All the control signals for the scan cells are generated internally by the TAP controller.

The a ction of th e TAP controll er is deter mined by curr ent inst ructio n and the state o f the

TAP state machine.

Scan chain 1

Purpose Scan chai n 1 is use d for communicat ion between the debugger,

and the ARM7TDMI-S core. It is used to read and write data, and

to scan instructions into the pipeline. The SCAN_N TAP

instruction can be used to select scan chain 1.

Length 33 bits, 32 bits a for the dat a value and 1 bit for the scan cell on

the DBGBREAK core input.

Scan chain order From DBGTDI to DBGTDO, the ARM7TDMI-S p rocess or data

bits, bits 0 to 31, then the 33rd bit, the DBGBREAK sc a n cel l .

Scan chain 1, bit 33 s erves three purposes:

•Under norm al INTEST test conditions, it enabl es a known value to be scanned

in to the DBGBREAK input.

•While debugging, the value plac ed in the 33rd bit determi nes whether the

ARM7TDMI-S core synchroniz es bac k to system spee d before executing the

in struc tion. See Syst em spee d acc ess on page 5-46 for more details.

•After the ARM7TDMI-S core has entered de bug state, the value of the 33r d bit

on the first occasion that it is captured, and scanned out tells the debugger whether

the c ore entered debug state from a bre akpoint (bit 33 LOW), or from a

watchpoint (bit 33 HIGH).

Scan chain 2

Purpose Sc an ch a in 2 provid es acce ss to the Em b e d de d I CE - RT r egi st er s.

To do thi s, sca n cha in 2 must be sel ected us in g the SCAN_N TAP

controller inst ruction, and the n the TAP controller m ust be put in

INTEST mo de.

Length 38 bits.

Scan chain order From DBGTDI to DBGTDO, the read/write bit, the register

addr es s bits, bits 4 to 0, then the data bits, bit s 0 to 31.

No acti on occ urs during CAPTURE-DR.

Duri ng SHIFT-DR, a data value is shifted into the se r ial regi ster. Bits 32 to 36 specify

the address of the Em beddedICE-RT register to be accessed.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-35

During UPDATE-DR, this register is either rea d or written de pending on the val ue of

bit 37 (0 = read, 1 = write). See Fig ure 5-12 on page 5-49 for more details.

Debugging Your System

5-36

ARM DDI 0234A

5.15 Scan timing

Figu re 5-10 provides general scan timing information.

Figure 5-10 Scan timing

5.15.1 Scan chain 1 cells

The ARM7TDMI-S proc essor provides data for scan chain 1 cells as shown in

Table 5-5.

tohtdo

tovtdo

tistctl

tihtctl

tistcken

tihtcken

CLK

DBGTCKEN

DBGTMS

DBGTDI

DBGTDO

Table 5-5 Scan chain 1 cells

Number Signal Type

1DATA[0] Input/output

2DATA[1] Input/output

3DATA[2] Input/output

4DATA[3] Input/output

5DATA[4] Input/output

6DATA[5] Input/output

7DATA[6] Input/output

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-37

8DATA[7] Input/output

9DATA[8] Input/output

10 DATA[9] Input/output

11 DATA[10] Input/output

12 DATA[11] Input/output

13 DATA[12] Input/output

14 DATA[13] Input/output

15 DATA[14] Input/output

16 DATA[15] Input/output

17 DATA[16] Input/output

18 DATA[17] Input/output

19 DATA[18] Input/output

20 DATA[19] Input/output

21 DATA[20] Input/output

22 DATA[21] Input/output

23 DATA[22] Input/output

24 DATA[23] Input/output

25 DATA[24] Input/output

26 DATA[25] Input/output

27 DATA[26] Input/output

28 DATA[27] Input/output

29 DATA[28] Input/output

30 DATA[29] Input/output

Table 5-5 Scan chain 1 cells (continued)

Number Signal Type

Debugging Your System

5-38

ARM DDI 0234A

31 DATA[30] Input/output

32 DATA[31] Input/output

33 DBGBREAK Input

Table 5-5 Scan chain 1 cells (continued)

Number Signal Type

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-39

5.16 Examining the core and the system in debug state

When the ARM7TDMI-S pr oce ssor is in deb ug state, you can exami ne the core and

system state by for cing the load and store multiples into t h e inst r uction pipeline.

Before you ca n examine the core and syste m state, the debugger must determine

wh et h er the p ro c essor en t er e d d ebug stat e f r om Thu mb st at e o r AR M stat e, by

examini ng bit 4 of the EmbeddedIC E-RT de bug status register, as follows:

Bit 4 HIGH Th e core has entered deb ug fr om Thumb state .

Bit 4 LOW The core has entered d e bug from ARM stat e.

5.16.1 Determini ng the core state

When the process or has entered de bug state from Thumb state, the si mpl est cours e of

act ion is for the deb ugger to force the core back into ARM state. The debugger can then

execute the sam e sequence of instructions to determine the processor state .

To force the processor into ARM state, execute the following sequence of Thumb

instructions on the core:

STR R0, [R0]; Save R0 before use

MOV R0, PC ; Copy PC into R0

STR R0, [R0]; Now save the PC in R0

BX PC ; Jump into ARM state

MOV R8, R8 ; NOP

Note

Because al l Thumb instructions ar e only 16 bits long, you can repeat the ins truction

when shif ting scan chain 1. For example, the encoding for BX R0 is

0x4700

, so when

0x47004700

shif ts int o s can chain 1, t he deb ugger doe s not have to k eep trac k of th e half

of the bus on which the proc essor expects to read the data.

You can use the sequenc es of ARM ins tructions below to determine the state of the

processor.

Wi th the proc essor in the ARM s tate, th e first instruc tion to e xecute i s ty pically:

STM R0, {R0-R15}

This ins truction caus es the conten ts of the registers to appe ar on the data bus . You can

th en sam ple and shif t out these values.

Debugging Your System

5-40

ARM DDI 0234A

Note

The use of r0 as the base register for the STM is only for illustration, any register can

be used.

After you have determined the values in the current bank of registers, you might wish

to ac cess the banked registers. To do this, you must change mode. Normally, a m ode

change can occur only i f the co re is already in a privileged mode. However , while in

debug state, a m ode change from one mode into any other mode ca n occur.

The debugger must restore the ori ginal mode be fore exiting deb ug state. F or example,

if the de bugger was requested to return the state of the User mode r egisters, and FIQ

mode registers, and debug state was ente red in Supervisor mode, the instruction

sequence might be:

STM R0, {R0-R15}; Save current registers

MRS R0, CPSR

STR R0, R0; Save CPSR to determine current mode

BIC R0, 0x1F; Clear mode bits

ORR R0, 0x10; Select user mode

MSR CPSR, R0; Enter USER mode

STM R0, {R13,R14}; Save register not previously visible

ORR R0, 0x01; Select FIQ mode

MSR CPSR, R0; Enter FIQ mode

STM R0, {R8-R14}; Save banked FIQ registers

All th ese instr uct ions ex ecu te at deb ug sp eed. De b ug spe ed is much slo we r th an syst em

spe ed. This is because between each core clock, 33 clocks occ ur in order to shift in an

in struc tion, or shift out data. Executing instruc tions this sl owly is acceptabl e for

accessing the core state because the ARM7TDMI-S processor is fully static. Ho wever,

you cannot use this method for determining t he state of the rest of the sys tem.

While i n deb ug stat e, only the foll owing ins tructions ca n be scanned i nto the instruc tion

pipeli ne for execution:

•all data processing operations

•all load, stor e, load multiple, and store multiple instr u ctions

•MSR and MRS.

5.16.2 Determ ining system state

To meet the dyna mic ti ming re qui rements of the memory s ystem , an y a ttempt t o a ccess

system state must occur with the clock qualified by CLKEN. To perform a memory

access, CLKEN mus t be used to forc e the ARM7TDMI-S processor to run in normal

operatin g mode. T his is controlled by bit 33 of scan chain 1.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-41

An inst ructi on place d in scan cha in 1 with bi t 33, the DBGBREAK bit, LO W executes

at d ebug s pee d. T o ex ec ute an i nstruction at syste m speed, th e instru ct ion prior t o it must

be scanned into scan chain 1 with bit 33 set HIGH.

After the system speed ins truction has sc anned into the dat a bus and clocked into the

pipeline, the RESTART instruc tion must be loaded into the TAP controller. RESTART

causes the ARM7TDMI-S processor to:

1. Switch au tomatically to CL KEN control.

2. Execute the instruction at system speed.

3. Reenter debug state.

When the instruction has completed, DBGACK is HIGH and the core reverts to

DBGTCKEN control. It is now possible to select INTEST in the TAP controller and

resume debugging.

The debugger must look at both DBGACK and TRANS[1:0] to determine whether a

system speed instruction has completed. To access memory, the ARM7TDMI-S core

drives both bits of TRANS[1:0] LOW af ter it ha s synchronized back to s ystem speed.

This transition is used by the memory controller to arbitrate whether the ARM7TDMI-S

core can have the bus in the next cycle. If the bus is not available, the ARM7TDMI-S

processor mi ght have its clock s talled inde finite ly. The only way to determin e whe ther

t h e memory access has completed is to e x amine the sta t e o f b o th TRANS[1:0] and

DBGACK. Whe n bo th ar e HI G H , th e access h as co mp l et ed .

The debugger usually uses EmbeddedICE-R T to control deb u gging, and so the state of

TRANS[1:0] and DBGACK can be determined by rea ding the E mbeddedICE-RT

status register. See Debug stat us regis ter on page 5 - 60 for mor e det ails.

The state of the system memory can be fed back to the debug host by using system speed

load m ultiples and debug speed store multiples.

There are restrictions on whic h instructions can have bit 33 set. The valid instructions

on which to set this bit are:

•loads

•stores

•lo ad mult iple

•store multiple.

See also Exi t from debug state on page 5-42.

When the ARM7TDMI-S processor returns to deb ug state after a system speed access,

bit 33 of scan chai n 1 is set HIGH. The st ate of bit 33 gives the debugger informa tion

about why the co re entered de bug state the f irst time this s can chain is rea d.

Debugging Your System

5-42

ARM DDI 0234A

5.17 Exit from de bug state

Lea ving deb ug st ate inv olves:

•restoring the ARM7TDMI-S processor int ernal sta te

•causing th e e xecution of a bra nch to the next ins truction

•returning to normal ope ration.

After re storing the internal state, a branc h instructi on m ust be loade d into the pipeline.

See The program counter during debug on page 5-44 for deta ils on calculating the

branch.

Bit 33 of scan chain 1 forces the ARM7TDMI-S processor to resynchronize back to

CLKEN, clock enable. The penultimate instruction of the debug sequence is scanned

in wi th bit 33 se t HIGH. The fi nal ins truction of the debug sequence is the branch, which

is s canned in with bit 33 LOW. The core is then clocked to lo ad th e br anch instruction

in to the pipeli ne, and the RESTART instru ction is sele cted in the TAP controller.

When the state machine enters the R U N-T EST/I D LE s tate, the scan chain revert s back

to Syste m mode. The ARM7TDMI-S processor then re sumes normal operation,

fe tching instr u ctions from memory. This delay, until the state m achine is in the

RUN-T EST/IDLE state, enables conditions to be set up in other devices in a

mult iproce ssor syst em wit hout tak ing immed iate e f fect . When the s tate machine ent ers

the RUN-TEST/I DLE st ate , all the proc essors resum e operation simulta neously.

DBGACK inform s the re st of the syst em wh e n th e AR M 7 TDMI - S pr o cessor is in

debug st ate. This information ca n be used to inhibit peripherals, such as watchdog

ti mers, that have r eal-time ch aracteristics. DBGACK can also mask out memory

acc esses caused by the de bugging proces s.

Fo r example, when the ARM7TDMI-S processor ent ers debu g stat e after a breakpoint ,

the instruction pipeline contains the breakpointed instruction, and two other instructions

that ha ve bee n p refe tche d. On entry to deb u g state the pipelin e is f lushed. On e xit f rom

debug state the pipeline must the r efore revert to its previous state.

Because of the debugging process, more memory accesses occur than are expected

normally. DBGACK can inhibit any system peripheral that might be sensitive to the

number of memory ac cesses. For example, a peripheral that counts the number of

memory cycles must return the same answer after a program has been run with and

without deb ugging. Fi gure 5-11 o n page 5-43 sho ws the behavior of th e ARM7TDMI-S

proce ssor on exit from the de bug state.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-43

Figure 5-11 Debug exit sequence

Fig ure 5-3 on page 5-8 shows that the final memory access occurs in the cycle after

DBGACK goes HIGH. This is the point at whi ch the cycle counter must be disabled.

Figure 5-11 shows that the first memory access tha t t he cycle coun ter has not prev iously

seen occurs in the cycle after DBGACK goe s LOW. This is the point at which to

re-en able the counter.

Note

Whe n a system sp eed access f rom debug state occu rs, the ARM7 TD MI -S pro c ess or

tempora rily dro ps out of deb ug sta te , so DBGACK can g o LOW. If there are per ipherals

that a re sen si ti ve to th e number of m em ory acc esses, the y must be led to be lie ve t hat the

ARM7TDMI-S processor is still in debug state. You can do this by programming the

EmbeddedICE-RT co ntrol r egister to forc e the value on DBGACK to be HIGH. Se e

Debug status register on page 5-60 for more details.

CLK

DBGACK

Internal cycles N SS

Ab Ab+8Ab+4

DATA[31:0]

ADDR[31:0]

TRANS

Debugging Your System

5-44

ARM DDI 0234A

5.18 The program counter during debug

The debugger must keep track of w hat happens to the PC, so that the ARM7TDMI-S

core can be forced to branch back to the place at which program flow was interrupted

by debug. Program flow can be interrupted by any of the follow ing:

•Breakpoints

•Watchpoints

•Watchpoint with another e xception on page 5-45

•Debug req uest on page 5-45

•Syst em s pee d access on page 5-46.

5.18.1 Breakpoints

Entry i nto debug s ta te from a brea kpoint adv ances the PC b y four addresses or 16 b ytes.

Each ins truction exec uted in debug stat e advances the PC b y one a ddress or 4 bytes .

The usual way to exit from debug state after a breakpoint is to remove the breakpoint

and branc h bac k to the previously-breakpointed addre ss.

Fo r exa mple, i f the AR M7TDMI-S proc essor e ntered deb ug sta te from a bre akpoint set

on a given address, and two debug speed instructions were executed , a branch of –7

addresses must occur (4 for debug entry, pl us 2 for the instructions, plus 1 for the final

branch).

The fol lowing sequence shows the da ta sc anned into scan chain 1, most signific ant bit

first. The value of the first digit goes to the DBGBREAK bit, and then the instruction

data into the remainder of scan chain 1:

0 E0802000; ADD R2, R0, R0

1 E1826001; ORR R6, R2, R1

0 EAFFFFF9; B -7 (2’s complement)

After the ARM7TDMI-S processor enters debug stat e, it must exec ute a minimum of

tw o inst ructions be fore the branch , a lthough these can both be NOPs (

MOV R0, R0

). For

small branche s, you can replace the final branch with a subtract, with the PC as the

des tination (

SUB PC, PC, #28

in the above example).

5.18.2 Watchpoints

The return to progr am e xecut ion af ter entry to deb ug st at e from a watc hpoint is made in

the s ame way as the proced ure described in Breakpoints.

Debu g e ntry ad ds four ad dresse s to the PC, a nd e v ery inst ructio n a dds one addre ss. T he

differenc e from b reakpoint is that the instruction that caused the watchpoint has

exec uted, a nd the program must return to the ne xt ins truction.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-45

5.18.3 Watchpoint with another exception

If a watchpointed access simultaneously causes a Data Abort, the ARM7TDMI-S

processor enters debug state in abort mode. Entry into debug is held off until the core

changes into abort mode and has fetched the instr uction from the abort vector.

A simila r se quence follows when an int errupt, or any other exception, occurs during a

watchpointed memo ry ac cess. The ARM7TDMI-S proc essor ent ers debug state in the

mode of the e xception. The debugger must che ck to see whether a n exce ption has

occurred by examining the current and previous mode (in the CPSR, and SPSR), and

the value of the PC. When an exception has taken place, you are given the choice of

servicing the except ion before debugging.

Ent r y to de bug stat e w h en an exce p ti o n h as o cc ur red cau s es the PC to be in cr ement ed

b y thr ee instr u ctions rather than four, a nd th is mu st be considered in return branc h

calculation when exiting debug state. For example, suppose that an abort occurs on a

watchpointed ac ce ss, and ten instructions hav e been executed to dete rmine this

eventuality. You can us e the following sequence to r eturn to program ex ecution.

0 E1A00000; MOV R0, R0

1 E1A00000; MOV R0, R0

0 EAFFFFF0; B -16

This code forces a branch back to the abort vector, causing t he ins truction at that

loca tion to be refetched and e xecuted.

Note

After the abort se rvice routine, the in struction that caused the abort, and watch point is

ref etc h ed an d exec u ted . Th is tr i g gers th e watc h p oi n t agai n an d th e ARM7 TD M I - S

proce ssor reenters debug state.

5.18.4 Debug request

Entry int o deb ug stat e using a deb ug requ est is simil ar to a br eakpoin t. Ho we ver, unli ke

a breakpoint, the last instruction has completed execution and so must not be refetched

on exit from debug state. Therefore, you can assume that entry to debug state adds three

addresses to th e PC a nd every instruction executed in debug state adds one addre ss.

For exa mple, suppose you have invoked a debug request, and decide to return to

program execution straight away. You could us e the following sequence:

0 E1A00000; MOV R0, R0

1 E1A00000; MOV R0, R0

0 EAFFFFFA; B -6

This code restor es the PC and r es tarts the progr am from the next instruct ion.

Debugging Your System

5-46

ARM DDI 0234A

5.18.5 System spe ed access

When a system speed access is performed during debug state, the value of the PC

increases by three addresses. System speed instructions access the memory system and

so it is possibl e for ab orts to take pla ce . If an ab ort occurs during a system speed

memory acces s, the ARM7TDMI-S process or enters abort mode before returning to

debug st ate.

This s cenari o is sim ilar t o an abort ed watc hpoint, b ut t he proble m is muc h harder t o f ix

beca use the abort was not caused by an instruction in the main program, a nd so the PC

does not poi nt to the ins truc tio n th at caus ed the a bort. An abo rt h andler usual ly loo ks at

th e PC to determine the instru ction that caused the abort and also the abort addr ess. In

this case, the value of the PC is invalid, bu t because the debugger can det ermine which

location was being accessed, the debugger can be written to help the abort handler fix

the me mory system.

5.1 8.6 S um m a r y of re turn address calculat io ns

The calc ulation of the branc h return address is as follows:

•for nor mal breakpoint and watchpoint, the branch is:

- (4 + N + 3S)

•for entry through debug request ( DBGRQ) or watchpoint with exce ption, the

br an ch is:

- (3 + N + 3S)

where N is the number of debug speed instructions executed (including the final branch)

and S is the number of system speed instructions executed.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-47

5. 19 Prio ri ties and excep tio ns

When a breakpoint, or a de bug request oc curs, the normal flow of the prog ram is

interrupted. Therefore, debug can be tr ea ted as another type of e xception. The

interac tion of the debugger with other e xceptions is described in The program counter

during debug on page 5-44. This section covers the following priorities:

•Breakpoint with Prefetch Abo rt

•Interrupts

•Da ta Ab o r ts.

5.19.1 Breakpo int with Prefetch Abor t

When a breakpointed instruction fe tch causes a Pre fetch Abort, the abo rt is taken, and

the bre akpoint is disregarded. Normally, Pre f etch Aborts occur when, for example, an

acc es s is made to a virtual address that does not physically exist, and the returned data

is t herefore inva li d. In s uch a cas e, the norma l acti on of the oper ating s yste m is to s wap

in the page of m emory, and to ret urn to t he pr evi ously -inva li d address . This ti me, when

the ins truction is fetched, and providing the break point is a ctivated (it can be

data-dependent), the ARM7TD MI-S processor enters debug state.

The Prefetc h Abort, therefore, takes higher priority than the breakpoint.

5.19.2 Interrupts

When t h e ARM7T DMI-S processor en ters debug state, interrup ts are automaticall y

disabled.

If an interrupt is pending during the instruction prior to entering debug state, the

ARM7TDMI-S processor enters deb ug state in the mode of the interrupt. On entry to

debug state, the debugger cannot ass ume tha t the ARM7TDMI-S processor is in the

mod e ex pect ed by th e prog ram o f the u ser . The A RM7TDMI-S core m ust c heck t he PC,

the CPSR, and the SPSR to determine accurately the reason for the except ion.

Debug, therefore, takes higher prior ity than the interrupt, but the ARM7TDMI-S

processor does remember that an interrupt has occurred.

5.19.3 Data Aborts

When a Data Abort occ urs on a watchpointed access, the ARM7TDMI-S pr oce ssor

ente rs debug state in abort mode. Th e wa tchpoint, therefore , has higher pri ority tha n the

abort, but the ARM7TDMI-S proce ssor remembers that the abort happe ned.

Debugging Your System

5-48

ARM DDI 0234A

5 .20 Watch poi nt unit r egis ter s

The tw o watchpoi nt units, kno wn as W at chpoint 0 and W atchpoi nt 1, each cont ain three

pairs of registers:

•address value and addr es s mask

•data value and data mask

•control value a nd control mas k.

Each register is indepe ndently progra mmable a nd has a unique address. The function

and mapping of the re si sters is s hown in Tabl e 5-1 on page 5-17.

5.20.1 Progr ammin g and reading wa tchpoint regi st er s

A watchpoint register is programmed by shifting data into the EmbeddedICE-RT scan

chai n ( scan chai n 2). T he scan chain is a 38-bi t shift register compri si ng:

•a 32-bit data field

•a 5-bit address field

•a read /w rite bi t.

This s etup is shown in Figure 5-12 on page 5-49.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-49

Figure 5-12 EmbeddedICE-RT block diagr am

The data to be wr itten is shifted into the 32-bit data f i eld, the address of the register is

shifted into the 5-bit address field, and the read/write bit is set.

read/write

Data

Address Address decoder

Value Mask Comparator

Control

DATA[31:0]

ADDR[31:0]

W atchpoint registers and comparators

Debugging Your System

5-50

ARM DDI 0234A

A regis ter is read by shi f ting its address into the ad dres s f ield, and by shi fting a 0 into

th e r ead/write bit. The 32-bi t data fie ld is igno r ed.

The register addresse s are shown in Table 5-1 on page 5-17.

Note

A re ad or w r it e actually takes pl ac e w h en th e TA P co n t ro l le r en te rs the UPDAT E- D R

state.

5.20.2 Using the data, and address mask registers

For each valu e r egi ster in a reg is ter pai r, the r e is a mask reg ist er of th e sam e fo rm at .

Setting a bit to 1 in the mask reg ister has the effect of making the corresponding bit in

the value register disregarded in the comparison.

For exa mple, when a watc hpoint is require d on a particular memory location, but the

data value is irre lev ant, the data m ask re giste r can be programmed to

0xffffffff

(all bits

se t to 1) to ig n or e the en tire dat a bus field.

Note

The mask is an XNOR m ask rathe r than a convent iona l AND ma sk. When a mask bi t is

set to 1, the comparator for that bit positi on always matches, irrespective of the value

Set ting the mask bi t to 0 means tha t the compar ator matches only i f the input value

matches the v alue programmed into the value register.

5.20.3 The con trol registers

The control val ue and control ma sk registers are ma pped identica lly in the lower eight

bits, as sho w n in F igure 5-13.

Figure 5-13 W atchpoint cont rol value, and mask format

Bit 8 of the c ontrol val ue re gister is the ENABLE bit and cannot be masked.

ENABLE CHAINRANGE DBGEXT PROT[0]PROT[1] SIZE[1] WRITESIZE[0]

8 67 5 34 2 01

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-51

Th e bit s have th e fo l l ow i ng func tio n s :

WRITE Compares a gainst t he write signal from the core in order to detec t

the dir ection of bus a ctiv ity. WRITE is 0 fo r a rea d cy cl e, an d 1

for a write cycle.

SIZE[1:0] Compares against the SIZE[1:0] signal from t he core in order to

detect the size of bus activity .

The encoding is shown in Table 5-6.

PROT[0] Is used to detect whethe r the current cycle is an inst ruction fetch

(PROT[0] = 0), or a data acce ss (PROT[0] = 1) .

PROT[1] Is used to compar e agains t the not transla te signal from the core in

order to distinguish between user mode (PROT[1] = 0), and

non-User mode (PROT[1] = 1) ac cesse s.

DBGEXT[1:0] Is an external input to EmbeddedICE - RT logic that en ables the

watchpoin t to be dependen t on some external condition.

The DBGEXT input for Watchpoint 0 is labeled DBGEXT[0].

The DBGEXT input for Watchpoint 1 is labeled DBGEXT[1].

CHAIN Can be c onnected to the chain output of another watchpoint in

order to implement, for example, debugger requests of the form

breakpoint on address YYY only when in process XXX

In the ARM7TDMI-S processor EmbeddedICE-R T macrocell, the

CHAINOUT out put of Watchp oint 1 is conne cted to th e CHAIN

input of Watchpoint 0.

The CHAINOUT output is derived from a register. The

address/cont r o l fiel d comparator drives the write enable for the

re gister. The input to the register is the value of the d ata fie ld

comparator.

Table 5 -6 SI ZE[1: 0] signal encoding

bit 1 bit 0 Data size

00Byte

01Halfword

10Word

11(Reserved)

Debugging Your System

5-52

ARM DDI 0234A

The CHAINOUT register is cleare d when the cont rol value

RANGE In the ARM7TDMI-S proc es s or EmbeddedICE-RT logic, the

RANGEOUT output of Watchpo int 1 is co nnected to the

RANGE inp ut of Watchpoint 0. Connection enab les the two

watchpoints to be co upled for detec ting conditions tha t occ ur

simultaneously, suc h as f o r range checking.

ENABLE When a watc hpoint ma tch occ urs, the intern al DBGBREAK

signa l is a sserte d only when th e ENABLE b it is set. This b it exist s

only in the value registe r. It cannot be masked.

Fo r each o f the bit s [7:0 ] in t he cont rol v al ue reg iste r, there is a corr espond ing b it i n the

control mask register. T hese bits remove the dep endency on particular sign als.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-53

5.21 Programming breakpoints

Breakpoints are classifi ed as hardwa re breakpoints or software breakpoints:

•Hardware breakpo ints typically monit or the address value a nd can be set in any

code, even in code that is i n ROM or code that is self-mod ifying. See Hardware

breakpoints for more detai ls .

•Software bre akpoints monitor a part icular bit pattern being fetched from any

addre ss. One Embe ddedICE -RT watc hpoint c an there fore be us ed to s upport an y

number of s oftware break points. See Softwar e br eakpo ints on page 5-54 for more

details.

Soft ware bre akpoints can normally be set only i n RAM because a special bit

pattern chosen to cause a software breakpoint h as to replac e the ins truction.

5.21.1 Hardware breakpo ints

To ma ke a wat chpoint unit cau se hardware breakpoi nts (on instruction fetc hes):

1. Program its address value register with the address of the instruction to be

breakpointed.

2. For an ARM-state breakpoint, program bits [1: 0] of the address mask regis ter to

11. For a breakpoint in Thu mb sta te, program bits [1:0] o f the ad dres s mask

regi ster to 01.

3. Progr am the da ta value regist er only when you re quire a dat a-depe ndent

breakpoint, that is only when you have to match the actual ins truction code

fetched as well as the address. If the data value is not re quired, program the data

mask register to

0xffffffff

(all bits t o 1). Otherwise program it to

0x00000000

4. Progr am the control val ue re gister with PROT[0] = 0 .

5. Progr am the co ntrol ma sk register with PROT[0]= 0.

6. When you ha ve to make the distinction between User and non-User m ode

inst ruction fetches , program the PROT[1] value and mask bits appropriately.

7. If requi red, program the DBGEXT, RANGE, and CHAIN bits in the s ame way.

8. Program the mask bit s for all unused control values to 1.

Debugging Your System

5-54

ARM DDI 0234A

5.21.2 Software breakpoint s

To make a watchpoint unit cause software brea kpoints (on instruction fetches of a

particular bit pattern):

1. Program its address mask register to

0xffffffff

(all bits set to 1) s o that the

address is disr egarded.

2. Program the data v alu e regis ter wi th the pa rticular bi t pattern that has been c hosen

to represent a software breakpoint.

If you are programmi ng a Thu mb software breakpoint, repe at the 16-bit pattern

in bo th halve s of the data v alue re gister. For example, if the bit patter n i s

0xdfff

program

0xdfffdfff

. When a 16-bit instruction is fetched, Embe ddedICE-RT

compar es on ly the v ali d hal f of t he data bus agains t the conten ts of the data value

breakpoints on both the upper and lower halves of the data bus.

3. Program the data mask register to

0x00000000

4. Program the control value register with PROT[0] = 0.

5. Program the control mask regi ster with PROT[0] = 0 and all other bits to 1.

6. If you wan t to ma ke the disti nctio n betwee n User a nd non-Use r mode ins tructi on

fetc hes, progra m th e PROT[1] bi t in the co ntro l val ue, and cont rol mask r egi st ers

accordingly.

7. If requi red, program the DBGEXT, RANGE, and CHAIN bits in the same way.

Note

You do not have to program the address value register.

Setting the breakpoint

To set the so ftware breakpoint:

1. Re ad the instruction at the d esired address and store it.

2. Write the spe cial bit pattern representing a s oftware breakpoint at the addre ss.

Clearing the breakpoint

To cl ear the software break p oint , r estore the instructio n to t he addre ss.

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-55

5.22 Programming watchpoints

To make a wa tchpoint unit caus e watchpoints (on data ac cesses ):

1. Program its addres s value register with the addre ss of the dat a ac ce ss to be

watchpointed.

2. Progr am the addres s mask re gis ter to

0x00000000

3. Program th e data value register only if you require a data-dependent watchpoint,

that is, only i f you have to match the actua l data value read or written as well as

the add r ess. If the data value is irrelevant, program the data mask regist er to

0xffffffff

(all bit s set to 1). Otherwi se program the data mas k regist er to

0x00000000

4. Progr am the control val ue re gister with PROT[0]= 1, WRITE= 0 for a re ad, or

WRITE = 1 fo r a wr it e, SIZE[1:0] with the value corresponding to the

appropriate data siz e.

5. Program the control ma sk register with PROT[0] = 0, WRITE = 0, SIZE[1:0]=

0, and all othe r bi ts to 1. You can set WRITE, or SIZE[1:0]t o 1 when both re ads

and writes, or data size accesses are to be watchpoin ted respectively.

6. If you have to make the distinction be twee n Use r and non-User mode data

accesses, program the PROT[1] bit in the control value and control mask registers

accordingly.

7. If requi red, program the DBGEXT, RANGE, and CHAIN bits in the s ame way.

Note

The above are examp les of ho w to program t he watc hpoint regis ter to genera te

breakpoints and watchpoints. Many other ways of programming the registers are

possib le. For e xample , you can provide simple ran ge b reakpoints by se tting one or more

of the addr ess mask bits .

Debugging Your System

5-56

ARM DDI 0234A

5.23 Abort stat us register

Only bit 0 of this 32 bi t rea d/write regis ter is u se d. It det erm ines whether an abort

exc eptio n e ntry wa s ca used by a breakpoi nt, a wa tchpoi nt, or a real a bort. The fo rmat is

shown in Figure 5-14.

Figure 5-14 Deb ug abort st atus regi ster

Thi s bi t is se t w h en th e ARM 7 TD M I -S cor e tak es a P r ef e tc h o r Da ta Ab o r t as a re su lt

of a breakpoint o r w atchpoint. If, on a part icular ins truction or data fetch, both the

Debug Abort and the external Abort signal a re asserted, the external Abort takes

priority, and the DbgAbt bit is not set. Once set, DbgAbt remains set until reset by the

user. The register is accessed by

MRC

and

MCR

ins t r u ct io n s .

DbgAbt

SBZ/RAZ

31:1

Debugging Your System

ARM DDI 0234A

Copy right © 20 01 AR M Limited. A ll rights reserved.

5-57

5.24 Debug control register

The debug control regis ter is six bits wide. Writes to the debug control regist er occur

when a watchpoint unit register is written. Reads of the de bug control register occur

when a watch point unit register i s read. See Watchpoint uni t re gister s on page 5-48 for

more information.

Figure 5-15 shows the function of each bit in the debug control register.

Figure 5-15 Deb u g con trol register forma t

The debug control register bit assignments ar e shown in Tabl e 5-7.

INTDIS DBGRQ DBGACK

2 1 0

EmbeddedICE-RT

disable

Monitor mode

enable SBZ/RAZ

5 4 3

Table 5-7 Debug control register bit ass ignments

Bit Function

5 Us ed to d isable the EmbeddedICE-RT comp arator ou tputs while the watch point and

breakpoint registers are be ing p rogrammed. This bit can be read and writ ten throu gh

JTAG.

Set bi t 5 when:

•programming breakpoi nt or watchpoi nt registers

•changing bit 4 of the deb ug control register.

You must cl ear bit 5 after you have made the changes, to re-enable the

EmbeddedICE-RT logic and ma ke the ne w breakpoi nts and watchpo ints operational.

4 Used to determine the behavior of the core when breakp oints or watchpoi nts are

reached:

•If clear, t h e core enters d ebug state wh en a breakpoint or watchpoin t is re ached.

•If set, the core performs an ab ort exc eption when a breakpoin t or watc hpoint i s

reached.

This bit can be read and written from JTAG.

3 T his bi t m ust b e cl ear.

Debugging Your System

5-58

ARM DDI 0234A

5.24.1 Disabling interru pts

IRQs a nd FIQs are disabled under the following conditions:

•during debugging (DBGACK HIGH)

•wh en th e INTDIS bit is HIGH.

The IFEN signal is driven as sh own i n Table 5-8.

5.24.2 Forcing DBGRQ

Figu re 5-17 on page 5-61 shows that the value stor ed in bit 1 of the de bug control

regi ster is s ynch ronized and t hen ORed with t he exter nal DBGRQ bef ore being applied

to the processor . The output of this OR g at e i s t he signal DBGRQI which is brought o ut

externally from the macrocell.

The synchronization betw een debug control register bit 1 and DBGRQI ass ists in

multiprocessor environ ments. The s ynchronization latch only ope ns when the TAP

controller state machine is in the R UN-TEST-IDLE state. This enables an enter-debug

condition to be set up in all the proc es sors in the system wh ile they are still running.

When the condition is set up in all the processors, it can be applied to them

simultaneously by entering the RUN-TEST-IDLE state.

2 Used to disable interrupts:

•If set, the interrupt enable signal of the core (IFEN) is force d LOW. The IFEN

signal is driven as shown in Table 5-8.

•If clear, interrupts are enabl ed.

1 Used to for ce the value on DBGRQ.

0 Used to for ce the value on DBGACK.

Table 5 -7 Debug control register bit assignme nts (cont inued)

Bit Function

Table 5-8 Interrupt signal control

DBGACK INTDIS IFEN Interrupts

001Permitted

1 x 0 Inhibited

x 1 0 Inhibited

Debugging Your System

ARM DDI 0234A

5-59

5.24.3 Forcing DBGACK

Fig ure 5-17 on page 5-61 shows that the val ue of the internal signal DBGACKI from

the core is ORed with the value held in bit 0 of the debug control register, to genera te

t h e external va lu e of DBGACK seen at th e peri phery of th e ARM7TDMI-S core. This

enab les the debug syst em to signal to the rest of the syst em that the core is still being

debugged even when system-speed accesses are being performed (when the interna l

DBGACK signal fr o m the core is LOW).

Debugging Your System

5-60

ARM DDI 0234A

5 .25 Debug stat us reg iste r

The deb u g statu s re gi ster is 5 bits wide . If it is acce sse d for a write (with the rea d/wri te

bit s et ) , th e status bit s ar e w r it te n . If it is a cc essed fo r a re ad (wi th the read /w r i te bi t

clear) , th e st atus bits ar e rea d . Th e f ormat of th e de bu g st at u s reg is te r is shown in

Figure 5-16.

Figure 5-16 Debug status regi ster format

The function of each bit in this re gister is as follows:

Bit 4 Enables TBIT t o be read. This enable s the de b ugger to det ermine

th e pr o c es s or state an d the ref o r e w h ic h in s t ructio n s to execu t e.

Bit 3 Enables the state of the TRANS[1] signal from the core to be read.

This e nables the de b ugger t o d etermine whethe r a m emory ac cess

from the debug st ate has complet ed.

Bit 2 Enables the state of the core interrupt enable signal (IFEN) to be

read.

Bits [1:0] Enable the values on the synchronized versions of DBGRQ and

DBGACK to be re ad.

The struc ture of the debug control and status registers is show n in F igure 5-17 on

page 5-61.

TBIT

TRANS[1]

IFEN

DBGRQ

DBGACK

Debugging Your System

ARM DDI 0234A

5-61

Figure 5-17 Debug control and status register structure

Bit 4

Bit 3

Bit 2

Bit 1

Bit 0

Bit 2

Bit 1

Debug

control

Debug

status

TBIT

(from core)

TRANS[1]

(from core)

DBGACKI

(from core) Interrupt mask enable

(to core)

DNGRQ

(from ARM7TDMI-S input)

DBGACKI

(from core)

DBGACK

(to ARM7TDMI-S output)

DBGRQI

(to core)

Debugging Your System

5-62

ARM DDI 0234A

5.26 Coupling breakpoints and watchpoints

You can couple watchpoint units 1 and 0 together using the CHAIN and RANGE

inputs. The use of CHAIN enables Watchpoint 0 to be triggered only if Watchpoint 1

has previously matc hed. The use of RANGE enables simple range checki ng to be

perform ed by combining the outputs of both watchpo ints.

5.26.1 Brea kpoin t and watchpoint cou pling example

Let:

Av[31:0]

Be th e value in th e ad d r ess valu e r egi st er

Am[31:0]

Be the value in the ad d r ess m ask reg i s te r

A[31:0]

Be the address bus from the ARM7TDMI-S processor

Dv[31:0]

Be th e valu e in th e dat a val ue reg iste r

Dm[31:0]

Be th e valu e in th e d ata ma s k reg ist er

D[31:0]

Be the data bus from the ARM7TDMI-S processor

Cv[8:0]

Be the value in the co n trol valu e r egi ster

Cm[7:0]

Be the value in the co n trol m ask reg i s t er

C[9:0]

Be the combi ned control bus from th e ARM7T DMI -S core, othe r

watchpoint registers, and the DBGEXT signal.

CHAINOUT signal

The CHAINOUT signa l is derived as follows:

WHEN (({Av[31:0],Cv[4:0]} XNOR {A[31:0],C[4:0]}) OR {Am[31:0],Cm[4:0]} == 0xFFFFFFFFF)

CHAINOUT = ((({Dv[31:0],Cv[6:4]} XNOR {D[31:0],C[7:5]}) OR {Dm[31:0],Cm[7:5]}) == 0x7FFFFFFFF)

The CHAINOUT output of watchpoint register 1 provides the CHAIN input to

Watchpoint 0. This CHAIN input enables you to use quite comp licated configurations

of breakpoints and watchpoints .

Note

The r e is no CHAIN input to Watchpoint 1 and no CHAIN out put from Watchpoint 0.

Take, for e xample, t he r equest b y a d eb ugger to breakpoint on the instruction at locati on

YYY when runn ing p rocess XXX in a m ultipro cess s yst em. If the curren t pr ocess I D is

stored in memory, you can implement the above function with a wa tchpoint and

Debugging Your System

ARM DDI 0234A

5-63

breakpoint chained toge ther. The w atchpoint address points to a known me mory

location containing the current process ID, the watchpoint data points to the required

process ID a nd the ENABLE b i t is cl ea r ed .

The addres s compa r ator output of the w atchpo in t is used t o d r ive t h e w rit e enable f o r

the CHAINOUT l atch. The in put to the la tch is t he ou tput of the da ta com parat or fro m

the s ame wa tchpoi nt. The o utpu t of the la tch drives the CHAIN inp ut of the break poin t

comparator. The add r ess YYY is stored i n the breakpoint register, and when the

CHAIN input is asserted, the br ea kpoint address matches and the breakpoint triggers

correctly.

5.26.2 DBGRNG signal

The DBGRNG signal is derived as follows:

DBGRNG = ((({Av[31:0],Cv[4:0]} XNOR {A[31:0],C[4:0]}) OR {Am[31:0],Cm[4:0]}) == 0xFFFFFFFFF) AND

((({Dv[31:0],Cv[7:5]} XNOR {D[31:0],C[7:5]}) OR

Dm[31:0],Cm[7:5]}) == 0x7FFFFFFFF)

The DBGRNG output of watchpoint re gister 1 provides the RANGE input to

watchpoint register 0. This RANGE input enables you to couple two breakpoints

together to form range breakpoints.

Selec table range s are re s tricted to being powers of 2. For e xample, if a breakpoint is to

occur when the address is in the fi rs t 256 byte s of memory, b ut not in t he f irst 32 bytes ,

program the watchpoint registers as follows:

For Watchpoint 1:

1. Program Watchpoint 1 with an address value of

0x00000000

and an addre ss mask

0x0000001f

2. Clear the ENABLE bit.

3. Program all other Watchpoint 1 registers as normal for a breakpoint.

An add r ess within the f irst 32 by tes ca uses the RANGE output to go HIGH but

does not trigger the breakpoint.

For Watchpoint 0:

1. Progr am Watc hpoi nt 0 with an ad dress v alue of

0x00000000

, and a n address mask

0x000000ff

2. S e t th e E NAB L E bit .

3. Program the RANGE bit to m atc h a 0.

4. Program all other Watchpoint 0 registers as normal for a breakpoint.

Debugging Your System

5-64

ARM DDI 0234A

If Watchpoint 0 matches but Watchpoint 1 does not (that is the RANGE input to

Watchpoint 0 is 0), the breakpoint is triggered.

Debugging Your System

ARM DDI 0234A

5-65

5.27 EmbeddedICE-R T timing

EmbeddedICE-RT s amples t he DBGEXT[1] and DBGEXT[0] inputs on the rising

edge of CLK.

See Chapter 8 AC Parameters for details of the required setu p and hold times for these

signals.

Debugging Your System

5-66

ARM DDI 0234A

6-1

Chapter 6

ETM Inte rf ace

This chapter des cribes t he ETM interface that is provid ed o n the ARM7T D MI-S

processor. It contains the following sections:

•About the ETM interface on page 6-2

•Enabling and disabling the ETM7 int er face on page 6-3

•ETM7 to ARM7TDMI-S (Rev 4) connections on pa ge 6-4

•Clocks and re sets on page 6-6

•Debug request wiring on page 6-7.

ETM Interface

6-2

ARM DDI 0234A

6.1 About the ETM interface

You can connect an external Embedded T race Macr ocell (ETM) to t he ARM7TDMI-S

processor, so that you can pe rform real -time traci ng of the code th at the processor is

executing.

Note

If you ha ve more than one ARM processor in your system, each processor must ha ve its

ow n dedicated ETM.

In general, little or no glue logic is requi red to connect t he ETM7 to th e ARM7TDMI- S

(Re v 4) p roces sor. You program the ETM thr ough a JTA G int erf ace. T he inte rfac e is a n

extension of the ARM TAP control ler, and is assigned scan chain 6.

Note

See the ETM7 (Rev 1) Tec hnical Reference Manual for detailed information about

integrating an ETM7 with an ARM7TD MI-S pr ocessor.

ETM Interface

ARM DDI 0234A

6-3

6.2 Enabling and disabling the ETM7 interface

Under the control of the ARM debug tools, the ETM7 PWRDOWN output is used to

enable and disable the ETM. When PWRDOWN is HIGH, th is in dic ates that the ETM

is not currently enable d, so you can stop the CLK i nput a nd hold the o ther ET M sig nals

stable. This enables you to reduce power consumption when you are not performing

tracing.

When a TAP reset (DBGnTRST) occurs, PWRDOWN is forced HIGH until the ETM7

control regist er ha s been programmed (see the Embedded Trace Macrocell

Specification for de tails of this reg ister).

PWRDOWN is automatically clea red at the start of a debug session.

ETM Interface

6-4

ARM DDI 0234A

6.3 ETM7 to ARM7TDMI-S (Rev 4) connections

The ETM7 int erface port names are a mixture of those from the ARM7TDMI and the

ARM7TDMI-S macrocells. Table 6-1 shows the connections that you must make

between the ARM7TDMI- S processor a nd ET M7.

Table 6-1 ETM7 and ARM7TDMI-S (Rev 4) pin connect ions

ETM7 signal name ARM7TDMI-S (Rev 4)

signal name

A[31:0] ADDR[31:0]

ABORT ABORT

ARMTDO DBGTDO

BIGEND CFGBIGEND

CLKaCLKa

CLKEN CLKEN

CPA CPA

CPB CPB

DBGACK DBGACK

DBGRQbDBGRQb

nMREQ CPnMREQ

SEQ CPSEQ

MAS[1:0] SIZE[1:0]

nCPI CPnI

nEXEC DBGnEXEC

nOPC CPnOPC

nRESET nRESET

nRW WRITE

nTRSTaDBGnTRSTa

PROCID[31:0]c-

PROCIDWRc-

ETM Interface

ARM DDI 0234A

6-5

RANGEOUT[0] DBGRNG[0]

RANGEOUT[1] DBGRNG[1]

RDATA[31:0] RDATA[31:0]

TBIT CPTBIT

TCKaCLKa

TCKEN DBGTCKEN

TDI DBGTDI

TDO DBGTDO

TMS DBGTMS

WDATA[31:0] WDATA[31:0]

INSTRVALID DBGINSTRVALID

a. See Clocks and resets on page 6-6.

b. See Debug re q ue s t w ir i n g on page 6-7.

c. The ARM7TDMI-S processor does not provide

the PROCID[31:0] or PROCIDWR si gnal s. You

must tie these ETM inputs LOW.

Table 6-1 ETM7 and ARM7TDMI- S (Rev 4) pin connections (continued)

ETM7 signal name ARM7TDMI-S (Rev 4)

signal name

ETM Interface

6-6

ARM DDI 0234A

6.4 Clocks and resets

The ARM7TDMI-S (Rev 4) process or us es a s ingle clock, CLK, as both the main

system clock and the JTA G clock. You must connect the processor clo ck to both CLK

and TCK on the ETM. You can then use TCKEN to co ntro l the JTAG in terf a c e .

To trace throug h a warm reset of the ARM7TDMI-S processor, use the TAP reset

(connect nTRST to DBGnTRST) to reset the ETM7 state.

For more information about ETM7 clocks and resets, see the ETM7 Techni cal Refer ence

Manual.

ETM Interface

ARM DDI 0234A

6-7

6.5 Debug request wiring

It is recommended tha t you connect to gether the DBGRQ output of the ETM7 to the

DBGRQ input of the ARM7TDMI-S processor. If this input is alrea dy in use, you can

OR the DBGRQ inputs to gether. See the ETM7 Technical Reference Manual for more

details.

ETM Interface

6-8

ARM DDI 0234A

ARM DDI 0234A
Copy right © 20 01 AR M Limited. A ll rights reserved.
7-1
Chapter 7 
Instruction Cycle Timings
This chapter gives th e ARM7T DMI -S  processor  ins truction cycle timi ngs. It cont ains 
the following sections:
•About the instruction cycle timings on page 7-3
•Inst ruction  cycle count su mmary on page 7-5
•Branch and ARM branch with link on page 7-7
•Thumb branch with link on page 7-8
•Branch and ex change on page 7-9
•Data operations on  pag e 7- 1 0
•Multiply, and multiply acc umulate on page 7-12
•Load register on page 7-14
•Store register on page 7 - 16
•Load mul tiple register s on page 7 -17
•Store multiple registers on page 7-19
•Data swap on page 7-20
•Software interrupt, and ex ception entry on page 7-21
•Coproces sor data processing operation on page 7 - 22
•Load coprocessor register (from memory to coprocessor ) on page 7-23
•Store coprocessor register (from coprocessor to memory) on page 7-25

Instruction Cycle Timings

7-2

ARM DDI 0234A

•Coprocessor register transfer (move from coprocessor to ARM register) on

page 7-27

•Co proce ssor registe r transf er (mov e from AR M regi ster to co proce sso r) on

page 7-28

•Undefined inst ructions and coprocessor abse nt on page 7-29

•Unexecuted instructions on pag e 7-30.

Ins truct ion C ycle T imings

ARM DDI 0234A

7-3

7.1 About the instruction cycle timings

The TRANS[1:0] signa ls pre dict the ty pe of th e n e xt c ycl e. Thes e s ignals are pip eline d

in th e cycle b ef o r e th e o ne to wh i ch th ey ap p l y an d ar e s h own li ke th is in th e ta b les in

this section.

In t he tables in thi s cha pter , th e fol lowi ng sign als (whi ch als o appe ar ah ead of t he cy cle)

ar e reg istered in the cycle to which they apply:

•Address is ADDR[31:0]

•Loc k is LOCK

•Size is SIZE[1:0]

•Write is WRITE

•Prot1 and Prot0 are PROT[1:0]

•Tbi t is CPTBIT.

The address is incremented for prefetching instructions in most cases. The increment

v aries with the instruct ion length:

•4 byt es in AR M state

•2 bytes in Thumb state.

Note

The letter i is used to indicate th e instr u ction lengt hs.

Size indicates the width of the transfer:

•w (word) represents a 32-bit data access or ARM opcode fe tch

•h (halfword) represents a 16-bit data access or Thumb opcod e fet ch

•b (byte) represents an 8-bit dat a access.

CPA and CPB are pipe lined inputs and are sho wn as sampled by the ARM7TDMI-S

processor. They are therefore sho wn in the tables the c ycle after they have been driven

by the coprocessor.

Transaction types are sho wn in Table 7-1 on page 7-4.

Instruction Cycle Timings

7-4

ARM DDI 0234A

Note

All cycle counts in this chapter assume zero-wait-state memory access. In a system

where CLKEN is used to add w ait s tate s, yo u must adj ust t he cy cle c ounts a ccordi ngly.

Table 7-1 Trans acti on types

TRANS[1:0] Transacti on type Descripti on

00 I cycle Internal (address-only) next cycle

01 C cycle Coprocessor transfer next cycle

10 N c ycle Memory access to n ext addr ess is nonseque ntial

11 S cycle Memory access to n ext address is sequent ial

Ins truct ion C ycle T imings

ARM DDI 0234A

7-5

7.2 I nstruction cycle count s ummary

In the pipelined architectur e of the ARM7TDMI-S co r e, whil e one ins truction is being

fetched, the pr evious instruction is being decode d, and the one prior to that is being

executed. Table 7-2 s hows the number of cycles require d by an ins truction, when tha t

instruction reaches the Execute stage.

You can calculate the number of cycles for a routine from the figures in T able 7-2. These

f igures assume execution of the ins truction. Unexecuted instructions take one c ycle.

In Table 7-2:

n Is the number of words transferred.

m Is 1 if bits [32:8] of the multiplier ope rand are a ll zero or one.

Is 2 if bits [32:16] of the m ultiplier operand are all zero or one.

Is 3 if bits [31:24] of the m ultiplier operand are all zero or one.

Is 4 otherwise.

b Is the number of cycles spent in the coproce ssor busy-wait loop (which

can be zero or more).

When the co ndition is not met, a ll the instruct ions take one S-cycle.

Table 7-2 Instr ucti on cycle counts

Instruct ion Qua li fier Cycle count

An y unexecuted Condi tion codes fail +S

Dat a processing S ingle-c ycle +S

Data processing Register-specified shift +I +S

Data processing R15 destination +N +2S

Data process ing R15, register-specified shift +I +N +2S

MUL

-+(m)I +S

MLA

- +I +(m)I +S

MULL

-+(m)I +I +S

MLAL

- +I +(m)I +I +S

-+N +2S

LDR

No n-R15 destination +N +I +S

LDR

R15 destinati on +N +I +N +2S

Instruction Cycle Timings

7-6

ARM DDI 0234A

The cycle types N, S, I, and C are defined in Table 7-1 on page 7-4 .

STR

-+N +N

SWP

- +N +N +I +S

LDM

No n-R15 destination +N + (n–1) S +I +S

LDM

R15 destination +N +(n–1)S +I +N +2S

STM

-+N +(n–1 )S +I +N

MSR

MRS

-+S

SWI

, trap - +N +2S

CDP

- +(b)I +S

MCR

- +(b)I +C +N

MRC

- +(b)I +C +I +S

LDC

STC

- +(b)I +N +(n – 1)S +N

Table 7-2 Instruction cycle counts (conti nued)

Instr uction Qualifi er Cyc le count

Ins truct ion C ycle T imings

ARM DDI 0234A

7-7

7.3 Branch and ARM branch with link

Any ARM or Thumb branch, a nd an ARM branch with link operation takes three

cycles:

1. During the f irs t cy cle, a br anch i nstruc tion cal culates the b ranch destin ation wh ile

per f o r mi ng a prefet ch fr o m th e c urr e nt P C. Thi s pr e f et ch is d on e in all cases

because, b y the time the dec ision to take the branch has been reached, it is already

too late to p revent the p r ef et ch .

2. During t he second cycle, the ARM7TDMI-S core performs a Fetch from the

br an ch destinati o n. Th e re tu r n address is s t or e d in r14 if th e li n k bit is se t .

3. During t he third cycle, the ARM7TDMI-S core perform s a Fetch from the

des tinat ion + i, ref i lling t he in structi on pi peline . When th e in structi on is a branc h

with link, r14 is modified (4 is subtracted from it) to simplify return to

MOV PC,R14.

This modification ensures subroutines of the type

STM..{R14} LDM..{PC}

work

correctly.

Table 7-3 sho w s the c y cle timings , w h ere:

pc Is t he address of the branch instruction.

pc’ Is an address calculated by the ARM7TDMI-S core.

(pc’) Are the cont ents of th at address.

Note

This data ap plies only to branc hes in ARM and Thumb states, and to branch with link

in A R M st at e.

Tabl e 7-3 Branch instruction cycle operations

Cycle Address Size Write Data TRANS[1:0] Prot0

1 pc+2i w/h 0 (pc + 2i) N cycle 0

2pc’w’/h’0(pc’)S cycle 0

3pc’+i w’/h’0(pc’ + i) S c ycle 0

pc’+2i w’/h’-- - -

Instruction Cycle Timings

7-8

ARM DDI 0234A

7.4 Thumb branch with link

A Thumb Branch with Link (

) operat ion c omprises two c onsecutive Thumb

instructions and takes four cycles:

1. The f irst instruction act s as a s imple da ta operation. It takes a si ngle cycle to ad d

the PC to the upper pa rt of the offset and store s the result in r14 (LR).

2. The second instruction acts similar to the ARM

ins t r u ct io n over th r ee cycles:

•Duri ng the fir st cycle, the ARM7TDMI-S core calc ulates the final branch

destination while pe rform ing a prefetch from the current PC.

•During the second cyc le, the ARM7TDMI-S core performs a Fetch from

the branch destination. The return address is stored in r14.

•Duri ng the third cycle , the ARM7TDMI-S core per forms a Fetch from the

destination +2, refills the instruction pipeline, and modifies r14 (subtracting

2) to simplify the return to

MOV PC, R14

. Th is m odi fi c a tion ensu res tha t

subroutines of the type

PUSH {..,LR} ; POP {..,PC}

work correctly.

Table 7-4 shows the cycle timings of the complete operation.

Note

PC is the address of the first instruction of the operation.

Thumb

operat ions are e xplained i n detail i n the ARM Ar ch itectur e Refe re nce Manual.

Table 7-4 Thumb long branch wit h li nk

Cycle Address Size Write Data TRANS[1:0] Prot0

1 pc + 4 h 0 (pc + 4) S c yc le 0

2 pc + 6 h 0 (pc + 6) N cycle 0

3pc’h0 (pc’) S cycle 0

4pc’ + 2 h 0 (pc’ + 2) S cycle 0

pc’ + 4 - - - - -

Ins truct ion C ycle T imings

ARM DDI 0234A

7-9

7.5 Branch and exch ange

A Branch and eXchange (

) operation takes three cycles, it is similar to a Branch:

1. During the fi rst cycle, the ARM7TDMI-S core extracts the branch destination,

and t he ne w core sta te from t he re gist er source, while p erforming a pre fetch from

the cu rrent P C . T h is p re f etch is p er f o r med in all ca se s, beca use by the time th e

decision to ta ke the branch has been reached, it is already too late to prevent the

prefetch.

2. During t he second cycle, the ARM7TDMI-S core performs a Fetch from the

branch destination using the new instruction width, dependent on the state that has

been selected.

3. During t he third cycle, the ARM7TDMI-S core perform s a Fetch from the

destinat ion +2 or +4 dependent on the ne w specif ied st ate , refi lling the instruc tion

pipeline.

Ta bl e 7 - 5 s hows the cycle t imin g s .

Note

i and i’ represent the instruction widths before and af ter the BX respe ctively.

In ARM state, Size is 2, and in Thumb state Size is 1. When changing from Thumb to

ARM sta te, i equals 1, and i’ equals 2.

t, and t’ represent the states of the T bit before and after the BX respectively. In ARM

state, Tbit is 0, and in Thumb st ate Tbit is 1. When chang ing from ARM to Thumb stat e,

t equa ls 0, and t’ equals 1.

Table 7-5 Branch and exchange instructi on cycle operati ons

Cycle Address Size Write Data TRANS[1:0] Prot0 Tbit

1 pc + 2i w /h 0 (pc + 2i) N cycle 0 t

2pc’w’/h’0(pc’) S cycle 0 t’

3pc’+ i’w’/h’0(pc’+i’) S cycle 0 t’

pc’ + 2i’-- - - - -

Instruction Cycle Timings

7-10

ARM DDI 0234A

7.6 Data o perations

A data ope ration executes in a s ingle data path c ycle exce pt where the shift is

de termined by the contents of a register. The A RM 7 TDMI-S co r e reads a fi r st register

on to th e A bus, and a s ec o nd regi s te r or th e imme di at e fi el d ont o th e B bu s.

The A LU combines the A bus source and the shifted B bus source accordin g to th e

operation specified in the instr uction. Th e ARM7TDMI-S core writes the r esult (w hen

requir ed) into the destina tion register . (Compares and te sts d o not produce results. Only

the ALU status flags are affected.)

An instruction prefetch occurs at the same time as the data operation, and the PC is

incremented.

When a register specifies the shift len gth, an additional data path cycle occurs before

the da ta operation to copy the bottom 8 bits of that register into a holding latch in the

barrel shi fter . The inst ruction pre fetch occurs during this f irst c ycl e. The operation c ycle

is internal (it does not reques t memory). Becaus e the address remains stable through

both cycles, the mem ory manager ca n merge this internal cyc le with the follo w ing

sequentia l acces s.

The PC can be one or more of the register operands. Wh en the PC is th e destination,

external bus activity can be affected. When the ARM7TDMI-S core writes the result to

the PC, the contents of the instruction pipeline are invalidated, and the ARM7TDMI-S

core takes the address for the next instruction prefetch from the ALU rather than the

address incrementer. The ARM7TDMI-S processor refills the instruction pipeline

before any more execution takes place . During this time e xceptions are locked out.

PSR tra nsfer operat ions e xhibit the sa me tim ing characteri stics as the data opera tions

except that the PC is never us ed as a source or destination r egister.

The da ta ope ration timing cyc les a re s hown in Table 7-6.

Table 7-6 Data operation instruction cycle operations

Cycle Address Size Write Data TRANS[1:0] Prot0

no rm al 1 p c+2i w/h 0 (pc+2i) S cycl e 0

pc+3i - - - - -

dest=pc 1 pc+2i w/h 0 (pc+2i) N cycle 0

2pc’w/h 0 (pc’)S cycle 0

3pc’+i w/h 0 (pc’+i) S cycle 0

pc’+2i - - - - -

Ins truct ion C ycle T imings

ARM DDI 0234A

7-11

Note

Shifte d register with destination equals PC is not possible in Thumb stat e.

shift(Rs) 1 pc+2i w/h 0 (pc+2i) I cycle 0

2 pc+3i w/h 0 - S c y cle 1

pc+3i - - - - -

shift( R s ) 1 pc+8 w 0 (pc +8) I cycle 0

dest=pc 2 p c+12 w 0 - N c ycle 1

3pc’w0 (pc’)S cycle 0

4pc’+4 w 0 (pc’+4) S cycle 0

pc’+8 - - - - -

Table 7-6 Data operation instruction cycle operations (continued)

Cycle Address Size Write Data TRANS[1:0] Prot0

Instruction Cycle Timings

7-12

ARM DDI 0234A

7.7 Multiply, and multiply accumulate

The multiply instru ctions use special h ard ware that imple ment s integer multipli cation

with early termination. A ll cycl es exce p t the f irst are int ernal .

The cy cl e timings are sh own i n Table 7-7 to Tab le 7-10 on p age 7-13, in wh ich m i s the

numbe r of cycles required by the multiplication algorithm (see Instruction cycle count

summary on page 7-5).

Table 7-7 Multiply instruction cycle operations

Cycle Address Write Size Data TRANS[1:0] Prot0

1 pc+2i 0 w/h (pc+2i) I cycle 0

2 pc+3i 0 w/h - I cycle 1

•pc+3i 0 w/h - I cycle 1

m pc+3i 0 w/h - I cycl e 1

m+1 pc+3i 0 w/h - S cycl e 1

pc+3i - - - - -

Tabl e 7-8 Multiply-accumulate instruction cycle operations

Cycle Address Write Size Data TRANS[1:0] Prot0

1 pc+2i 0 w/h (pc+2i) I cycle 0

2 pc+2i 0 w/h - I cycle 1

•pc+3i 0 w/h - I cycle 1

m pc+3i 0 w/h - I cycl e 1

m+1 pc+3i 0 w/h - I cycle 1

m+2 pc+3i 0 w/h - S cycl e 1

pc+3i - - - - -

Ins truct ion C ycle T imings

ARM DDI 0234A

7-13

Note

Multi ply long is av ailable o nly in ARM state.

Note

Multiply-acc umulate long is av ailable onl y in ARM st ate.

Tabl e 7-9 Multipl y long inst ruction cycle operati ons

Cycle Address Write Size Data TRANS[1:0] Prot0

1 pc+8 0 w (pc+8) I cycle 0

2 pc+12 0 w - I cycle 1

•pc+ 1 2 0 w - I cycle 1

m pc+12 0 w - I cycle 1

m+1 pc+12 0 w - I cycle 1

m+2 pc+12 0 w - S cycle 1

pc+12 - - - - -

Table 7-10 Mult iply-accumulate long inst ruction cycle operations

Cycle Address Write Size Data TRANS[1:0] Prot0

1 pc+8 0 w (pc+8) I cycle 0

2 pc+8 0 w - I cycle 1

•pc+ 1 2 0 w - I cycle 1

m pc+12 0 w - I cycle 1

m+1 pc+12 0 w - I cycle 1

m+2 pc+12 0 w - I cycle 1

m+3 pc+12 0 w - S cycle 1

pc+12 - - - - -

Instruction Cycle Timings

7-14

ARM DDI 0234A

7.8 Load registe r

A load r egister instruction takes a v ariab le number of cycles:

1. During the first c ycle, the ARM7TDMI-S process or calculates the ad dres s to be

loaded.

2. During the second cycle, the ARM7TDMI-S processor fetches the data from

memory and performs the base regis ter modification (if required).

3. D u rin g th e th i r d cyc l e, th e AR M 7 TD M I - S pro c es sor tr a ns fe r s the d a t a to th e

destination register . (External memory is not used.) Normally , the ARM7TDMI-S

core merges this third cycle with the next prefetch to form one memory N-cycle.

The load register cycle timings are shown in Table 7-11, where:

b, h, and w Are byte , halfword and word as defined in Table 5-6 on page 5-51.

s Represents current supervi so r-mode-depe ndent value.

u Is either 0, when the force tr anslation bi t is specified in th e instruction

(LDRT), or s at all other times.

Either the base or the destination (or both) can be the PC. T he prefetch sequence

changes when the PC is affected by the instruction. If the Data Fetch aborts, the

ARM7TDMI-S processor prevents m odification of the des tination register.

Table 7-11 Load register instruction cycle operations

Cycle Ad dress Size Write Data TRANS[1:0] Prot0 Prot1

norm al 1 p c+ 2i w/h 0 (pc+2i) N cycle 0 s

2pc’w/h/b 0 (pc’) I cycle 1 u/s

3 pc+ 3i w/h 0 - S cycl e 1 s

pc+3i - - - - - -

dest=pc 1 pc+8 w 0 (pc+8) N cycle 0 s

2da w/h/b0 pc’I cycle 1 u/s

3 pc+12 w 0 - N cycle 1 s

4pc’w0 (pc’)S cycle 0 s

5pc’+4 w 0 (pc’+4) S cycle 0 s

pc’+8 - - - - - -

Ins truct ion C ycle T imings

ARM DDI 0234A

7-15

Note

Destination equals PC is not possibl e in Thumb state .

Instruction Cycle Timings

7-16

ARM DDI 0234A

7.9 Store register

A sto r e regi ster ha s tw o cycl es :

1. During the f irs t cycle, the ARM7TDMI-S core c alcul ates the addres s to be sto red.

2. During the second cycle, the ARM7TDMI-S core performs the base modification,

and writes the data to memory (if re quired).

The store r egister cycle timings are shown in Table 7-12, where:

s Represents current mode-depende nt value.

t Is ei th er 0, wh e n th e T bit is spec if ied in th e in s t r uc ti on (

STRT

) or c at all

other times.

Table 7-12 Store register instruction cy cle operations

Cycle Address Size Write Data TRANS[1:0] Prot0 Prot1

1 pc+2i w/h 0 (pc+2i) N cycle 0 s

2 da b/h/w 1 Rd N cycle 1 t

pc+3i - - - - - -

Ins truct ion C ycle T imings

ARM DDI 0234A

7-17

7.10 Load multiple registers

A LoaD Multiple (

LDM

) takes four cycles:

1. During the first cycle, the ARM7TDMI-S core calculates the address of the first

word to be tr ansferred, while performing a prefetch from memory.

2. During t he second cyc le, the ARM7TDMI-S core fetches the first word and

performs the base modification.

3. During t he third cycle, the ARM7TDMI-S core moves the first word to the

appropriate destination register and fet ches the second word fr om memory. The

ARM7TDMI- S l atche s the modif i ed b ase int ernall y, in c ase it is re quir ed afte r a n

abort. The third cycle is repeat ed for subsequent fet ches until the last data word

has been accessed.

4. During the fourth and final (internal) cycle , the ARM7TDMI-S core moves the

las t word to its des tination register. The last cycle can be mer ged with the next

instruction prefetch to form a single memory N-cycle.

When an abort occurs, th e ins truction continues to comple tion. The ARM7TDMI-S

co re prev en ts all re gister writing aft er the abo r t. T he ARM7 TDMI-S co re ch anges the

final cycle to restore the modified base register (which the load activity before the abort

occurred might have overwritten).

When the PC is in the lis t of reg iste rs to be loade d, th e ARM7T DMI-S c ore in v al ida tes

the c urrent i nstru ction p ipe line. The PC i s al ways the la st re gis ter t o loa d, s o an abor t at

any point prevents the PC from being overwritten.

Note

LDM

with destina tion = PC cannot be executed in Thumb st ate. Howe ver,

POP{Rlist,PC}

equates to an LDM with de stination = PC.

The

LDM

cycle tim ings are shown in Table 7-13.

Table 7-13 Load multi ple registers inst ruction cycle operations

Cycle Address Si ze Write Data TRANS[1:0] Prot0

1 register 1 pc+2i w/h 0 (pc+2i) N cycle 0

2da w 0 da I cycle 1

3 pc+3i w/h 0 - S cycle 1

pc+3i - - - - -

Instruction Cycle Timings

7-18

ARM DDI 0234A

1 register 1 pc+2i w/h 0 (pc+2i) N cycle 0

dest=pc 2 da w 0 pc’I cycle 1

3 pc+3i w/h 0 - N cycle 1

4pc’w/h 0 (pc’) S cycl e 0

5pc’+i w/h 0 (pc’+i) S cy cl e 0

pc’+2i - - - - -

n registe rs 1 pc+2i w/h 0 (pc+2i) N cycle 0

(n> 1 ) 2 da w 0 da S cy cle 1

•da++ w 0 (d a++ ) S cycl e 1

n d a++ w 0 (d a++ ) S cycl e 1

n+1 da++ w 0 (da ++) I cycle 1

n+2 pc+3i w/h 0 - S cycle 1

pc+3i - - - - -

n registe rs 1 pc+2i w/h 0 (pc+2i) N cycle 0

(n> 1 ) 2 da w 0 da S cy cle 1

inc l pc •d a + + w 0 (d a++ ) S cycl e 1

n d a++ w 0 (d a++ ) S cycl e 1

n+1 da++ w 0 pc’I cycle 1

n+2 pc+3i w/h 0 - N cycle 1

n+3 pc’w/h 0 (pc’) S cy cle 0

n+4 pc’+i w/h 0 (pc’+i) S cycle 0

pc’+2i - - - - -

Table 7-13 Load multiple registers instruction cycle operations (continued)

Cycle Address Si ze Writ e Data TRANS[1:0] Prot0

Ins truct ion C ycle T imings

ARM DDI 0234A

7-19

7.11 Store multiple registers

STor e Multip le (

STM

) proceeds very much as

LDM

, a lt hough wi thou t the f i nal c ycle. The re

are therefore two cycles:

1. During the first cycle, the ARM7TDMI-S core calculates the address of the first

word to be stored.

2. During the second cycle, the ARM7TDMI-S core performs the base modification,

and w rites the data to memory.

Res tart is straightforward bec ause there is no genera l overwrit ing of registers.

The

STM

cycle tim ings are shown in Table 7-14.

Table 7-14 Store multi ple registers instruction cycle operations

Cycle Address Size Write Data TRANS[1:0] Prot0

1 register 1 pc+2i w/h 0 (pc+2i) N cycle 0

2 da w 1 R N cycle 1

pc+3i

n registers 1 pc+8 w/h 0 (pc+2i) N cycle 0

(n> 1 ) 2 da w 1 R S cyc le 1

•da++ w 1 R’S cycle 1

nda++ w 1 R’’ S cycle 1

n+1 da++ w 1 R’’’ N cycle 1

pc+12

Instruction Cycle Timings

7-20

ARM DDI 0234A

7.12 Data swap

Data s wa p is simil ar to the loa d and store r egi ster in struc tio ns, al thou gh the swap ta ke s

place in cy cles 2 and 3. The data is fetched fr om external memo r y in the second cycle,

and in the third cycle the contents of the source register are written to the external

memory. In the fourth cycle the data read during cycle 2 is written into the destination

The data swapped can be a byte or word quantity (b/w).

The ARM7TDMI-S core m ight abort the swap operation in either the read or wr ite

cycle. The swap operation (r ea d or wr ite) does not affect the dest ination regis ter.

The d ata swa p cy cl e timings a re sho wn in Table 7-15, where b a nd w are b yte an d wo rd

as defined in Table 5-6 on page 5-51.

Note

Data swa p can not be executed in Thumb state.

The LOCK output of the ARM7TDMI-S processor is driven HIGH for both load and

store dat a cycles to indic ate to the mem ory controller that this is an at omic opera tion.

Table 7-15 Dat a swap instruction cycle operations

Cycle Address Size Write Data TRANS[1:0] Prot0 Lock

1 pc+8 w 0 ( pc+8) N cycle 0 0

2 Rn w/b 0 (Rn) N cy cle 1 1

3 Rn w/b 1 Rm I cycle 1 1

4 pc+12 w 0 - S c ycle 1 0

pc+12

Ins truct ion C ycle T imings

ARM DDI 0234A

7-21

7.13 Software interrupt, and exception entry

Exceptions, and SoftWare Interrupts (SWIs) force the PC t o a specific value, and re fill

th e instruction pipe line from this address:

1. During t he f irs t c ycle, the ARM7TDMI -S core c onstr ucts the for ce d addre ss, an d

a mode change might take place. The ARM7TDMI-S core moves the return

address to r14 and moves the C PSR to SPSR_svc.

2. Dur ing the second cycle, th e A R M7 TDMI-S co r e modifies the retu r n address to

facilitate return (although this m odification is less us eful than in the case of

branch with link).

3. The third cycle is required only to complete the refilling of the instruction

pipeline.

The SWI cycle timings are shown in Table 7-16, where:

s Represents the current supervisor mode dependent value.

t Represe nts the c urrent Thumb state value.

pc Is, for software interrupts, the address of the SWI instruction.

Fo r exceptions, th is is t he address of the instru ction f ollowing the last one

to be exec uted before entering the exception.

For Prefetch Aborts, this is the address of the aborting instruction.

For Data Aborts, this is the a ddress of the instruction following the one

that attempted the aborted dat a tr ansfer.

Xn Is the appropriate trap ad dress.

Tabl e 7-16 Software interrupt i nstruction cycle operations

Cycle Address Size Write Data TRANS[1:0] Prot0 Prot1 Mode Tbit

1 pc+2i w/h 0 (pc+2i) N c ycle 0 s old mode t

2Xn w’0 (Xn) S cycle 0 1 ex ce p tio n

mode

3 Xn+4 w’0 (Xn+4) S cycle 0 1 ex ce p tio n

mode

Xn+8

Instruction Cycle Timings

7-22

ARM DDI 0234A

7.14 Coprocessor data processing operation

A Coprocessor Data Processing (

CDP

) operat ion is a request from the ARM7TDMI-S

cor e f or t he cop roces so r to initi at e som e acti on. Ther e is n o need to com plete t he actio n

immedi at ely , b ut the coproc ess or must commit t o completion be fore dri ving CPB LO W .

If the coproce s sor cannot perform the re quested task, it leaves CPA and CPB HIGH.

When the coprocessor is able to perform the ta sk, but ca nnot commit immedi ately, th e

coproc es s or drives CPA LOW, but le aves CPB HIGH until able to co mmit. The

ARM 7 T D M I-S pro c e ss o r bus y- wai ts un t i l CPB go es LOW. H ow eve r, an in ter r u pt

might cause the ARM7TDMI-S core to aban don a busy-wai ting copro cessor ins tructio n

(see Conseq uences of busy-waiting on page 4-8).

The coprocess or data ope rations cycle timings are sho wn in Table 7-17.

Note

Co pr o c ess o r op e r at io n s are avail ab l e on l y in AR M stat e.

Table 7-17 Coprocessor data operation instruction cycle operations

Cycle Address Write Size Data TRANS[1:0] Prot0 CPnI CPA CPB

ready 1 pc+8 0 w (p c + 8) N cycle 0 0 0 0

pc+12

n ot ready 1 pc+8 0 w (pc+ 8) I cycle 0 0 0 1

2 pc+8 0 w - I cycle 1 0 0 1

•pc+8 0 w - I cycle 1 0 0 1

n pc+8 0 w - N cycle 1 0 0 0

pc+12

Ins truct ion C ycle T imings

ARM DDI 0234A

7-23

7.15 Load coprocessor register (from memory to coprocessor)

The LoaD Coprocessor (

LDC

) operation tra nsfers one or more words of data from

memory to coprocess or registers.

The coprocessor commits to the transfer o n ly when it is re ady to accept the d ata. The

WRITE line is driven LOW during the transfer cycle. When CPB goes LOW, the

ARM7TDMI-S core pr oduces addres s es , and e xpects the coprocessor to take the data

at seque ntial cycl e rates. The coprocessor is respo nsibl e for determin ing the number of

words to be transferred. An interrupt can cause the ARM7TDMI-S core to a bandon a

busy-waiting coproc essor instruction (see Consequence s of busy-waiting on page 4-8).

The fir s t cyc l e (a n d any bu sy -wait cycl es) gen erates th e tr a n sf er ad d re ss . The s ec on d

cycl e pe r f orms th e w r it e- b ac k of th e ad d r ess b ase. The co p r o cesso r in dicate s th e last

transfer cycle by driving CPA and CPB HIGH.

The lo ad coprocessor regis ter cycle tim ings are shown in Table 7-18.

Tabl e 7-18 Load copr ocessor register instruc ti on cycle opera ti ons

Cycle Address Size Write Data TRANS[1:0] Prot0 CPnI CPA CPB

1 register

ready 1 pc+8 w 0 (pc+8) N cycle 0 0 0 0

2da w0(da)N cycle1111

pc+12

1 register

not ready

1 pc+ 8 w 0 (p c + 8) I cycl e 0 0 0 1

2 pc+ 8 w 0 - I cycl e 1 0 0 1

•pc+ 8 w 0 - I cycle 1 0 0 1

n pc+8 w 0 - N cycle 1 0 0 0

n+1 da w 0 (da) N cycl e 1 1 1 1

pc+12

m registers

(m>1)

ready

1 pc+8 w 0 (pc+8) N cycle 0 0 0 0

2 da w 0 (da) S cycle 1 1 0 0

•da++ w 0 (da++) S cycle 1 1 0 0

m da++ w 0 (da++) S cycle 1 1 0 0

m+1 da++ w 0 (da++) N cycle 1 1 1 1

pc+12

Instruction Cycle Timings

7-24

ARM DDI 0234A

Note

Co pr o c ess o r op e r at io n s are avail ab l e on l y in AR M stat e.

m registers

(m>1)

not ready

1 pc+ 8 w 0 (p c + 8 ) I cy cl e 0 0 0 1

2 pc+ 8 w 0 - I cycle 1 0 0 1

•pc+ 8 w 0 - I cycle 1 0 0 1

n pc+8 w 0 - N cycle 1 0 0 0

n+1 da w 0 (da) S cycl e 1 1 0 0

•da++ 0 (da++) S cycle 1 1 0 0

n+m da + + w 0 (da++) S cycl e 1 1 0 0

n+m+ 1 da++ w 0 (da++) N cycl e 1 1 1 1

pc+12

Table 7-18 Load coprocessor register instruction cycle operations (continued)

Cycle Address Siz e W rite Data TRANS[1:0] Prot0 CPnI CPA CPB

Ins truct ion C ycle T imings

ARM DDI 0234A

7-25

7.16 Store coprocessor register (from coprocessor to memory)

The STore Coproc essor (

STC

) operat ion transfers one or more words of data from

coproc es s or registers to memory.

The coprocessor commits to the transfer o n ly when it is re ady to write data. The

WRITE line is driven HIGH during the transfer cycle. When CPB goes LOW, the

ARM7TDMI-S core produce s addresses, and expects the coprocessor to write the data

at seque ntial cycl e rates. The coprocessor is respo nsibl e for determin ing the number of

words to be transferred. An interrupt can cause the ARM7TDMI-S core to a bandon a

busy-waiting coproc essor instruction (see Consequence s of busy-waiting on page 4-8).

The fir s t cyc l e (a n d any bu sy -wait cycl es) gen erates th e tr a n sf er ad d re ss . The s ec on d

cycl e pe r f orms th e w r it e- b ac k of th e ad d r ess b ase. The co p r o cesso r in dicate s th e last

transfer cycle by driving CPA and CPB HIGH.

The store coprocessor re gister cycle ti mi ngs are shown in Table 7-19.

Table 7-19 Store copr ocessor register instruction cycle operati ons

Cycle Address Size Write Data TRANS[1:0] Prot0 CPnI CPA CPB

1 register

ready

1 pc+8 w 0 (pc+8) N cycle 0 0 0 0

2 da w 1 CPdata N cycle 1 1 1 1

pc+12

1 register

no t ready

1 pc+8 w 0 (pc+8) I cycle 0 0 0 1

2 pc+8 w 0 - I cycle 1 0 0 1

•pc+8 w 0 - I cycle 1 0 0 1

n pc+8 w 0 - N cycle 1 0 0 0

n+1 da w 1 CPdata N cycle 1 1 1 1

pc+12

m registers

(m>1)

ready

1 pc+8 w 0 (pc+8) N cycle 0 0 0 0

2 d a w 1 C P dat a S cyc l e 1 1 0 0

•da++ w 1 CPdata’S cycle 1 1 0 0

m da++ w 1 CPdata’’ S cycle 1 1 0 0

m+1 da++ w 1 CPdata’’’ N cycle 1 1 1 1

pc+12

Instruction Cycle Timings

7-26

ARM DDI 0234A

Note

Co pr o c ess o r op e r at io n s are avail ab l e on l y in AR M stat e.

m registers

(m>1)

no t ready

1 pc+8 w 0 (pc+8) I cycle 0 0 0 1

2 pc+8 w 0 - I cycle 1 0 0 1

•pc+8 w 0 - I cycle 1 0 0 1

n pc+8 w 0 - N cycle 1 0 0 0

n+ 1 da w 1 C P d ata S cy cle 1 1 0 0

•da++ w 1 CPdata S cycle 1 1 0 0

n+m da++ w 1 CPdata S cycle 1 1 0 0

n+m+ 1 da++ w 1 CPdata N cycle 1 1 1 1

pc+12

Tabl e 7-19 Store coprocessor register instruction cycle operations ( continued)

Cycle Address Size Write Data TRANS[1:0] Prot0 CPnI CPA CPB

Ins truct ion C ycle T imings

ARM DDI 0234A

7-27

7 .17 Cop r o ces sor register transfer ( mo ve f r o m c op ro cess or to A RM r egis ter )

The Move fRom Copr ocessor (

MRC

) oper ation reads a single coproc essor re gister i nto the

sp ec if ied A R M reg is t er.

Data is transferred in the second c ycle and written to the ARM register during the third

cycl e of th e op er at i on .

If the cop r oce ssor signal s busy-wait by asse rting CPB, an inte rrupt can c ause the

ARM7TDMI-S core to abandon the co processor instruction (see Consequences of

busy-waiting on page 4-8).

As is the case with all ARM7TDMI-S register load instructions, the ARM7TDMI-S

core might merge the third cycle with the following prefetch cycle into a merged I-S

cycle.

The

MRC

cycle tim ings are shown in Table 7-20.

Note

This operation ca nnot occur in Thumb state.

Table 7-20 Copr ocessor register transfer (MRC)

Cycle Address Size Write Data TRANS[1:0] Prot0 CPnI CPA CPB

ready 1 pc+8 w 0 (pc+8) C cycle 0 0 0 0

2 p c + 1 2 w 0 C P da ta I cycle 1 1 1 1

3 pc+12 w 0 - S cycle 1 1 - -

pc+12

not ready 1 pc+8 w 0 (pc+8) I cycle 0 0 0 1

2 p c + 8 w 0 - I cycl e 1 0 0 1

•pc+8 w 0 - I cycle 1 0 0 1

n pc+8 w 0 - C cycle 1 0 0 0

n+1 pc+12 w 0 CPdata I cycl e 1 1 1 1

n+2 pc+12 w 0 - S cycle 1 1 - -

pc+12

Instruction Cycle Timings

7-28

ARM DDI 0234A

7 .18 Cop r o cess or register transfer ( mo ve f r o m AR M regist er to cop r o cess or )

The Move to CoprocessoR (

MCR

) operat ion tr ansf ers the contents of a single ARM

The data is transferred to the coprocessor during the second cyc le. If the copr oce sso r

signals busy-wait by asserting CPB, an interru pt can cause the A R M7 TDMI-S co r e to

abandon the coproces sor inst ruction (see Consequences of busy-waiting on page 4-8).

The

MCR

cycle tim ings are shown in Table 7-21.

Note

Co pr o c ess o r op e r at io n s are avail ab l e on l y in AR M stat e.

Table 7-21 Coprocessor register transfer (MCR)

Cycle Address Size Write Data TRANS[1:0] Prot0 CPnI CPA CPB

ready 1 pc+8 w 0 (pc+8) C cycl e 0 0 0 0

2 pc+12 w 1 Rd N cycl e 1 1 1 1

pc+12

n ot ready 1 pc+8 w 0 (pc+8) I cycle 0 0 0 1

2 pc+8 w 0 - I cycle 1 0 0 1

•pc+8 w 0 - I cycle 1 0 0 1

n pc+8 w 0 - C cycle 1 0 0 0

n+1 pc+12 w 1 Rd N cycle 1 1 1 1

pc+12

Ins truct ion C ycle T imings

ARM DDI 0234A

7-29

7.19 Undefined instructions and coprocessor absent

The undefined instruction trap is ta ken if an undefined inst ruction is ex ecuted. For a

definition of unde fined instructions, see the AR M Architec tu re Refe rence Ma nua l .

If no coproc ess or is able to accept a coprocess or instruction, th e instruction is treat ed as

an unde fine d instruction. This e nables software to emulate coprocessor instructions

when no har d war e c o p roc ess o r is pr e sen t.

Note

By default CPA and CPB mus t be driven HIGH unless th e coprocesso r ins truction is

being handled by a coprocessor.

Undefined inst ruction cycle tim ings a r e shown in Table 7-22.

where:

s Represents the current mode-dependent value.

t R epresents the c urrent state-depe ndent value.

Note

Co pr ocesso r op e r at io n s ar e availa ble onl y in AR M st at e.

Table 7-22 Undefin ed inst ruction cycle operati ons

Cycle Address Size Write Data TRANS[1:0] Prot0 CPnI CPA

and

CPB Prot1 Mode Tbit

1 pc+2i w/h 0 (pc+2i) I cycle 0 0 1 s Old t

2 pc+2i w/h 0 - N cycle 0 1 1 s Old t

3Xn w’0 (Xn) S c ycle 0 1 1 1 00100 0

4Xn+4w’0 (Xn+4) S c ycle 0 1 1 1 00100 0

Xn+8

Instruction Cycle Timings

7-30

ARM DDI 0234A

7.20 Unexecuted instructions

When the condition code of any instruction is not met, the ins truction is not exe cuted.

An unexecuted instruction takes one cycle .

Unexecuted inst ruction cycle timings are shown in Table 7-23.

Table 7-23 Unexecuted instruction cycle operations

Cycle Address Size Write Data TRANS[1:0] Prot0

1 pc+2i w/h 0 (pc+2i) S cycle 0

pc+3i

ARM DDI 0234A

8-1

Chapter 8

AC Parameters

This cha pter gives the AC timing parameters of the ARM7TDMI-S proc es sor. It

contains the follow ing sections:

•Timing diagrams on page 8-2

•AC timing parameter definitions on page 8-8.

AC Parameters

8-2

ARM DDI 0234A

8.1 Timing diagrams

This section contains ti mi ng diagrams, as follows:

•Timing parameters for data acc es ses

•Cop rocessor timing on page 8-4

•Exception and configuration input timing on page 8 - 5

•Debug timing on page 8-6

•Scan timing on page 8-7.

8.1.1 Timing param eters for data accesses

Timing para meters for data ac cesses are shown in Figure 8-1 on page 8-3.

AC Parameters

ARM DDI 0234A

8-3

Figure 8-1 Timing pa ram eters for data accesses

tovtrans

tohtrans

CLK

TRANS[1:0]

WDATA[31:0]

(write data)

tovaddr tohaddr

ADDR[31:0] Addr

Control

tovctl tohctl

WRITE

SIZE[1:0]

PROT[1:0]

TRAN

tovwdata tohwdata

tisclken

tihclken

tisabort

tihabort

Data

tisrdata

tihrdata

CLKEN

ABORT

RDATA[31:0]

(read data)

AC Parameters

8-4

ARM DDI 0234A

Note

The timing for both read and write dat a access are superim pos ed in Figure 8-1 on

page 8-3. The WRITE signal conveys whether the access uses the RDATA or WDATA

port.

CLKEN LO W st re tch es the dat a ac ces s whe n the read or writ e tr an sact ion is una bl e to

complete within a single cycle.

The d ata buses are u sed for transfer only w h en the transaction sign als TRANS[1:0]

ind i ca te a valid memo ry cycl e o r a co p ro cesso r regis t er trans f er cycl e .

8.1.2 Coprocesso r timing

Coprocessor timing param eters are shown in Figure 8-2.

Figure 8-2 Coprocessor timing

CPA

CPB

CPnMREQ

CPSEQ

ohcpni

ohcpctl

iscpstat

ihcpstat

CPnI

CLK

ovcpctl

ovcpni

ohcpctl

CPnOPC

CPnTRANS

CPTBIT

ovcpctl

AC Parameters

ARM DDI 0234A

8-5

8.1.3 Exce pti on and configuration input timin g

Exception and configuratio n input tim ing parameters ar e sh own in Figure 8-3.

Figure 8-3 Exception and configuration input timing

CLK

nFIQ

nIRQ

nRESET

tihcfg

tisexc

tihexc

tisexc

tihexc

tiscfg

CFGBIGEND

AC Parameters

8-6

ARM DDI 0234A

8.1.4 Debu g timing

Debug timing parameters are shown in Figure 8-4.

Figure 8-4 Debug timing

Note

DBGBREAK is sampled on rising clock, so external data-dependent brea kpoints and

watchpoints must be matched and signaled by th is edge.

tihdbgctl

tisdbgctl

tihdbgctl

tisdbgctl

tihdbgctl

tovdbgstat tohdbgstat

tohdbgstat

tovdbgstat

CLK

DBGRQ

DBGBREAK

DBGEXT[1:0]

DBGACK

DBGCOMMTX

DBGCOMMRX

DBGRNG[1:0]

AC Parameters

ARM DDI 0234A

8-7

8.1.5 Scan timing

Scan timing parameters are shown in Figure 8-5.

Figure 8-5 Scan timing

tihtctl

tistcken

tistctl

tihtcken

tovtdo tohtdo

CLK

DBGTCKEN

DBGTMS

DBGTDI

DBGTDO

AC Parameters

8-8

ARM DDI 0234A

8.2 AC timing parameter definitions

Table 8-1 shows target AC paramete rs. All figures are expressed as pe rce ntages of the

CLK period at maximum operating frequency. Please contac t your silic on supplier for

more details .

Note

Where 0% is shown, this indi ca tes the hol d t ime to c lock e dge plus t he maxim um c lock

skew for internal clock buffering.

Table 8-1 Provisional AC parameters

Symbol Parameter Min Max

tcyc CLK cycle time 100% -

tisclken CLKEN input setup to rising CLK 40% -

tihclken CLKEN input hold from ri sing CLK -0%

tisabort ABORT input setup to rising CLK 15% -

tihabort ABORT input hold from rising CLK -0%

tisrdata RDATA input setup to rising CLK 10% -

tihrdata RDATA i nput hold from rising CLK -0%

tovaddr Rising CLK to ADDR valid - 90%

tohaddr ADDR hold t ime from risi ng CLK >0% -

tovctl Rising CLK to control valid - 90%

tohctl Cont rol hold time from risi ng CLK >0% -

tovtrans Rising CLK to transact ion typ e valid - 50%

tohtrans Transa ction typ e hold time fr om rising CLK >0% -

tovwdata Rising CLK to WDATA valid - 40%

tohwdata WDATA hold ti me from rising CLK >0% -

tiscpstat CPA, CPB input setup to rising CLK 20% -

tihcpstat CPA, CPB inpu t hold from ri sing CLK -0%

AC Parameters

ARM DDI 0234A

8-9

tovcpctl Rising CLK to coprocess or control valid - 80%

tohcpctl Coprocessor control hol d time from rising CLK >0% -

tovcpni Rising CLK to coprocesso r CPnI valid - 40%

tohcpni Coprocessor CPnI hol d time from risi ng CLK >0% -

tisexc nFIQ, nIRQ, nRESET s e tup to rising CLK 10% -

tihexc nFIQ, nIRQ, nRESET hold from rising CLK -0%

tiscfg CFGBIGEND setup to rising CLK 10% -

tihcfg CFGBIGEND hol d from risi ng CLK -0%

tisdbgstat De bug stat us inputs setup to rising CLK 10% -

tihdbgstat Debug status inputs hold from rising CLK -0%

tovdbgctl Rising CLK to de bug co n tro l valid - 40 %

tohdbctl Debug control hold tim e from risi ng CLK >0% -

tistcken DBGTCKEN input setup to rising CLK 40% -

tihtcken DBGTCKEN inp u t hold from ri sing CLK -0%

tistctl DBGTDI, DBGTMS i nput setup to rising CLK 35% -

tihtctl DBGTDI, DBGTMS input hold from ri sing CLK -0%

tovtdo Rising CLK to DBGTDO val id - 20%

tohtdo DBGTDO hold time fr om rising CLK >0% -

tovdbgstat Rising CLK to de bu g stat us vali d 40% -

tohdbgstat Debug status hold time >0% -

Table 8-1 Provisional AC parame ter s (conti nued)

Symbol Parameter Min Max

AC Parameters

8-10

ARM DDI 0234A

A-1

Appendix A

Signal Descriptions

This appe ndix lists and d escribes all th e ARM7TDMI-S proce ssor signals. It contains

the following section:

•Signal descriptions on page A-2.

Signal Descriptions

A-2

ARM DDI 0234A

A.1 Signal descriptions

The signa ls of the ARM7TDMI-S proc essor are shown i n Table A-1.

Tabl e A-1 Signal descriptions

Name Type Description

ABORT Input Memory abort or b us erro r . This is an inp ut that is used b y the memor y syste m t o signa l

to the process o r that a requested access is disallowed.

ADDR[31:0] Output This is the processor address bus.

CFGBIGEND Input Big-en dian conf iguration. When this signal is HIGH, the p rocessor treats by tes in

memor y as be in g in bi g-end ia n for mat . When the sign al is LO W, memor y i s trea te d as

little-endian.

CFGBIGEND is normally a static configurat ion signa l.

This signal is analogous to BIGEND on the hard m acrocel l.

CLK Input Clock in put. This clock times all ARM7TDMI-S memory accesses and internal

opera tions . All outputs chan ge from the ri sing edg e of CLK and al l input s are s ampl ed

on the rising ed ge of CLK.

The CLKEN input can be used with a fr ee-running CLK to add synchronous

wait-states.

Alternatively, the clock can be stretched indefinitely in either pha se to allow access to

slow peripheral s or memory or to put th e system into a low-power state. CLK is also

used fo r seri al scan-chai n deb ug operati on with the Emb eddedICE-RT tool-cha in . This

signal is analogous to inv erted MCLK on the hard macrocell.

CLKEN Input Wa it sta te contr ol. When accessing slow perip herals, the ARM7TDMI-S can be made

to w a it for an i n teger number of CLK cycles by driving CLKENLOW. When the

CLKEN control is not used, it must be tied HIGH.

This signal is analogous to nWAIT o n th e h ar d mac rocell.

CPA Input Coprocessor abse nt handshak e. A c oprocess or that is capable of performing t h e

opera ti on that t he ARM 7TDMI- S is re que st ing (b y a ss erti ng CPnI), t ak es CPA LOW,

set up to the cycle edge that precedes the coprocessor access. W hen CPA is signaled

HIGH and the coprocessor cycle is executed (as signaled by CPnI signaled LOW), the

ARM7TD MI -S a borts the coproces sor handshake and takes th e undefi ned instruc tion

trap. Whe n CPA is LOW and r emains LO W, the ARM7TDMI-S busy-wa its unt il CPB

is LOW and then comple tes the cop rocessor inst ruction.

CPB In put Coprocessor bu sy handshake. A co processor is capable of pe rforming the operation

requested by the ARM7TDMI-S (by asserting CPnI), but cannot c om mit to starting it

immediatel y, this is indicat ed by driving CPBHIGH.

When the coprocessor is ready to start, it takes CPB LOW, wi th th e s ign al be ing se t u p

befo re the st art of the coproce ssor instructi on ex ecution cy cle.

Signal Descriptions

ARM DDI 0234A

A-3

CPnI O utput Not coprocess o r instru ction. Wh en th e ARM 7TD MI-S ex ecutes a coproces sor

in struction, it takes this output LOW and waits for a response from th e co processor.

The acti on ta ken depen ds on thi s re spon se, whic h the copro cesso r sig nal s on the CPA

and CPB inputs.

CPnMREQ Output Not memory request. When LOW, this signal indicates that the pr ocessor requires

memory acces s during the next tran saction .

This signal is analogous to nMREQ on th e ha rd m acro c ell.

CPnOPC Output Not o pcode fetch. When LOW, this signal indicates th at the processo r is fe tching an

instruction from memory. When HIGH, data (if present) is being transferred.

This signal is analogous to nOPC on the hard macrocell and to BPROT[0] on t he

AMBA ASB.

CPSEQ Output Sequential address. This output signal becomes HIGH when the address of the next

memor y cycl e is re lated to tha t of th e last memory access. The ne w addr ess is eithe r the

same as the pre vious one or four greater in A R M state or two g reater when fetching

opcodes in Thumb state.

This signal is analogous to SEQ on the hard macrocell.

CPTBIT Output When HIGH, this signal indic ates to a coprocessor that the process or is executing the

Thumb ins tructi on set. When LO W, the pr ocess or is ex ecut ing the ARM ins truction se t.

CPnTRANS Output Not memory translate. When LOW, this signal indicates that the processor is in User

mode. It can be used to sign al to m emory ma nagement hardwar e when to bypass

translat ion of the addresses or as an indicator of pr ivil eged mode activity.

This signal is analogous to nTRANS on the hard macrocell.

DBGACK Output Debug acknowledge. When HIGH, this signal DBGBREAK indi cates that the

ARM7TDMI-S is i n debug state. It is ena bled only when DBGEN is HIGH.

DBGBREAK Input EmbeddedICE-RT break point/w atchpoint indicator. This s ignal enables extern al

hardware to halt the execut ion o f the proce ssor for debug purposes.

When HIG H, this signal caus es th e c urrent memor y access to be breakpointed.

When t he memory a ccess is an i nstruct ion fet ch, th e ARM7TDMI-S ente rs deb ug sta te

if the instruction reaches the execute stage of the ARM7TDMI-S pipeline.

When the memory access is for data, the ARM 7TDMI- S enters de bug stat e after the

cur rent instruct ion complete s execu tion. This enables extension of th e internal

breakpoints provided by the EmbeddedICE-RT module.

DBGBREAK is enabled only when DBGEN is HIGH.

This signal is analogous to BREAKPT on the hard macrocell.

Table A-1 Si gnal descripti ons (conti nued)

Name Type Description

Signal Descriptions

A-4

ARM DDI 0234A

DBGCOMMRX Output EmbeddedICE-R T communications channel receive. When HIGH, this signal indicates

th at the comms channel re ceive buf fer is full. DBGCOMMRX is ena bled only when

DBGEN is HIGH.

This signal is analogous to COMMRX on th e hard macrocell.

DBGCOMMTX Output Embedded ICE-R T communica tions c hannel transmit. When HIGH , this s ignal denot es

th at the comms channel transmit buffer is empty. DBGCOMMTX is enabled only

when DBGEN is HIGH.

This signal is analogous to COMMTX on th e hard macrocell.

DBGEN Input Debug enab le. This input signal enables the debug fe atures of the ARM7TD M I-S. If

you intend to use the ARM7TD M I-S debug features, tie this signal HIGH. Drive this

signal LOW only when debugging is not required.

DBGnEXEC Output Not executed. When HIGH, this signal indicates that the instruction in the execution

unit is not bei ng ex ec ute d (be cau se, for e xa mpl e, i t has f ai led it s cond it ion c ode c hec k).

DBGEXT[1:0] Input Embed dedICE-RT external input 0, ex ternal inpu t 1. These are inputs to the

EmbeddedICE-RT macrocell logic in the ARM7TDMI-S that allow breakpoints and/or

watchpoints to be dependent on an external condition. The inputs are enabled only

when DBGEN is HIGH.

These signals are a nalogous to EXTERN[1:0] on the hard macrocell.

DBGINSTRVALID Output Instruction executed signal. Goes HI G H for o n e cycle f o r each inst ruction committed

to the execute stage of the pipel ine. Used by ETM7 to trace th e ARM7 TD MI-S

processor pipeline.

This signal is analog ous to INSTRVALID on the hard m acrocell.

DBGRNG[1:0] Output EmbeddedICE-RT rangeout. This signal indicates that EmbeddedICE-RT watchpoint

buses.

This signal is independent of the state of the watchpoint enab le control bit.

The signal is en abled only when DBGEN is HIGH.

This signal is analogous to RANGE[1:0] on th e ha rd mac r o c ell.

DBGRQ Input Debug request. This internally synchronized input signal requests the processor to

ente r de bug st at e. DBGRQ i s enabled only when DBGEN is HIGH.

DBGTCKEN Input Test clock enable. DBGTCKEN is enabled only when DBGEN is HIGH.

DBGTDI Input Embedded ICE-RT data in. JTAG t est data input. DBGTDI is en abled only whe n

DBGEN is HIGH.

DBGTDO Output EmbeddedICE- RT data out. Output from the boundary sc an logic. DBGTDO is

enabled only whe n DBGEN is HIGH.

Table A-1 Si gnal descripti ons (cont inued)

Name Type Description

Signal Descriptions

ARM DDI 0234A

A-5

DBGnTDOEN Output Not DBGTDO enable. When LOW, this signal denotes that serial data is being driven

out on the DBGTDO output . DBGnTDOEN is normally used as an output enable for

a DBGTDO pin in a packaged par t.

DBGTMS Input EmbeddedICE-RT mode select. JTAG test mode select . DBGTMS is enabled only

when DBGEN is HIGH.

DBGnTRST In put Not test reset. This is the active-lo w reset signal for the EmbeddedICE-RT mac rocell

in ternal state.

DMORE O u tp u t Assert e d fo r

LDM

and

STM

instruct ions (new for Rev 4). This signal has the ef fect of

maki ng memory ac cesses more e ffi cient.

nFIQ In put Active-lo w fast interrupt request . This is a high priori ty synchr onous interrupt request

to the processor. If the appropri ate enable in the proce ssor is active when this signal is

taken LOW, the processor is interrupted.

This signal is level-sensitive and must be held LOW until a suitable interrupt

acknowledge response is received from the processor.

This signal is analogous to nFIQ on the hard macrocell when ISYNC is HIGH.

nIRQ Input Active-low interrupt request. This is a low priority synchronous interrupt request to the

pr oc essor. If the appropriat e enable in the processor is active whe n this signal is taken

LOW, th e proc essor is in terrupted.

This signal is level-sensitive and must be held LOW until a suitable interrupt

acknowledge response is received from the processor.

This signal is analogous to nIRQ on the har d m a cr oc e ll w h en ISYNC is HIGH.

LOCK Output Locked transaction operation. Wh en LOCK is HIGH, the processor is performing a

locked memory access, the arbiter must wait until LOCK goes LOW before allowing

anot he r device to ac ce s s the memor y.

PROT[1:0] Output These o utput sig nals t o t he memor y s ystem indi cat e wh ether the output is code or dat a

and wh ether the access is User Mode or privileged access:

opcode fetch

data access

Us er-mode access

supervisor or privileged mode access.

RDATA[31:0] Input Rea d data input bu s. This is the read data bu s used to transfer instructions and data

betw een the processor and memory. The data on this bus is sampled by the proce ssor

at the end of the clock c y cle during read accesses (that is, when WRITE is LOW).

This signal is analogous to DIN[31:0] on th e ha rd m ac r o c ell.

Table A-1 Si gnal descripti ons (conti nued)

Name Type Description

Signal Descriptions

A-6

ARM DDI 0234A

nRESET Input Not res et. T his input signa l f orces the pr ocessor to termin ate the c urren t instr uction and

subsequently to enter the reset vector in supervisor mode. It must be asserted for at least

two cy cles.

A LOW level forces the instruction being executed to terminate abnormally on the next

nonw ait cycle and causes th e processor to perform idl e cycles at the bus int erface .

When nRESET be comes HI GH for at leas t one clock cycl e, the pr ocesso r res ta rts from

add ress 0.

SCANENABLE Input Scan tes t path enable (f or autom atic test pattern generat ion) is LO W for normal sys tem

configur ation and H IGH during sc an testing.

SCANIN Input Scan te st pa th serial input (for automatic test pattern generati on). Serial shift register

in p ut i s activ e when SCANENABLE is active (HIGH).

SCANOUT Output Scan test path serial output (for automatic test pattern generation). Serial shift register

output is active w hen SCANENABLE is active (HIGH).

SIZE[1:0] Output Me m o ry a ccess width. These output signals indicate to the external mem ory system

when a word transfer or a half w ord or byte length is re quired:

00 8-bi t byte ac c ess (a d dr ess ed in w ord by ADDR[1:0])

01 16-bit halfwo rd access (address ed in word by ADDR[1])

10 32-bit word access (always word- aligned)

11 (reserved)

This signal is analogous to MAS[1:0] on the hard macrocell.

TRANS[1:0] Output Next transaction type. TRANS indicates the next transaction type:

00 address-only (internal operation cycl e)

01 coprocessor

10 memory access at nonsequential address

11 memory access at sequenti al burst address.

The TRANS[ 1 ] si gnal is an alogous t o inverted nMREQ and the TRANS[0 ] signal is

analogous to SEQ on the hard macr ocell. TRANS i s analogou s to BTRAN on the

AMBA syste m bus.

VDD Power supply to the device.

Table A-1 Si gnal descripti ons (cont inued)

Name Type Description

Signal Descriptions

ARM DDI 0234A

A-7

VSS Ground reference for all signals.

WDATA[31:0] Output Write data output bus. This is the write data bus, used to transfer data from the

processor to the me mory or coprocess or s ystem.

Write data i s set up to the end of the cycle of stor e accesses (that is, when WRITE is

HIGH) and remains valid throughou t wait states.

This signal is analogous to DOUT[31:0] on the hard mac rocell.

WRITE Output Write/read access. Wh en H IGH, WRITE indicates a processor write c ycle, when

LOW, it indicates a processor read cycle.

This signal is analogous to nRW on the hard macrocell.

Table A-1 Si gnal descripti ons (conti nued)

Name Type Description

Signal Descriptions

A-8

ARM DDI 0234A

B-1

Appendix B

Differences Between the ARM7TDMI-S and the

ARM7TDMI

This app endi x describe s the di ff erenc es betwee n the ARM7TDMI- S and ARM7TDMI

macrocell interfaces. It contains the following sections:

•Interface signals on page B-2

•ATPG sc an int erf ace on page B-6

•Timing parameters on page B-7

•ARM7TDMI-S design consi derations on page B-8.

Differences Between the ARM7TDMI-S and the ARM7TD MI

B-2

ARM DDI 0234A

B.1 Interface signals

The signa l name s have prefixes that identify groups of func tionally-related signa ls:

CFGxxx Shows configuration inputs (typically hard-wired for an embedded

application).

CPxxx Shows coprocessor expansion interface signals.

DBGxxx Shows sca n-based EmbeddedICE-RT debug s upport input or output.

Other s ignals provide the system designer interf ac e, which is primarily

memory-mapped. Table B-1 shows the ARM7TDMI-S (Rev 4) processor signals with

their ARM7TDMI (Rev 4) hard macrocell equivale nt signals.

Table B-1 ARM7TDMI-S processor signals and ARM7TDMI har d m acrocell equivalents

ARM7TDMI-S

processor

signal Function ARM7TDMI hard

macrocell equivalent

ABORT 1 = memory abort or bus error .

0 = no error. ABORT

ADDR[31:0] a32-bit address output bus, available in the cycle preceding the

memory cycle. A[31:0]

CFGBIGEND 1 = big-endian configuration.

0 = little-endian con figuration. BIGEND

CLK bM as ter ri sing edg e cl oc k. Al l in put s ar e sample d o n th e risi ng

edge of CLK.

All timing dependen cies are from the rising ed ge of CLK.

MCLK

CLKEN cSyst em memory inte rface clock e nable:

1 = advance th e core on rising CLK.

0 = pre vent th e core advancing on rising CLK.

nWAIT

CPA dCoprocessor absent. Tie HIGH w hen no coprocess o r is present. CPA

CPB d Coprocessor b u sy . Ti e H IG H w hen n o coprocess or is present. CPB

CPnI Ac tive LOW coprocessor instruction execute qual ifier. nCPI

CPnMREQ Active LOW memory request signal, pipelined in the preceding

access. This is a coproces sor interface signal.

Use the A R M7TDMI-S output TRANS[1:0] for bu s inte rfa ce

design.

nMREQ

Di ffe r ences B etw ee n the A RM7T DMI -S and t he AR M7TD MI

ARM DDI 0234A

B-3

CPnOPC Active LO W opcode fetch qualifier output, pipelined in the

prec eding access. Th is is a coprocessor interface signal.

Use the A R M 7TD MI-S output PROT[1:0] for bus int e rface

design.

nOPC

CPnTRANS A ctiv e LOW supervis or mode acces s qualif ier output. This is a

coprocessor interface signal.

Use the A R M 7TD MI-S output PROT[1:0] for bus int e rface

design.

nTRANS

CPSEQ Sequential address signal. Th is is a coprocessor interface signal.

Use the A R M 7TD MI-S output TRANS[1:0] for bus i n te rfa ce

design.

SEQ

CPTBIT Instruction set qualifier output:

1 = THUMB instr uction set.

0 = ARM ins truction set.

TBIT

DBGACK Debug acknowledge qualifier output:

1 = proce ssor in debug state (r eal-time stopped) .

0 = normal system state.

DBGACK

DBGBREAK External bre akpoint (tie LOW whe n not used). BREAKPT

DBGCOMMRX E m b edded ICE-RT com m u ni cati o n ch a nn el re ce ive buffe r fu ll

output. COMMRX

DBGCOMMTX E m b edded IC E -RT co mm u nica ti o n ch annel tra n sm i t buffe r

empt y output. COMMTX

DBGEN Debug enable. Tie this si gnal HIGH to be able to use the debug

features of the ARM7TDMI. DBGEN

DBGEXT[1:0] EmbeddedICE-RT EXTERN debug qualifiers (tie LO W wh en

not required). EXTERN0, EXTERN1

DBGINSTRVALID eSignals instru ction execution to ETM7. INSTRVALID

DBGnEXEC Active LOW condition codes success at Exec ute stage . nEXEC

DBGnTDOEN fActive LOW TAP controller DBGTDO output qualifier. nTDOEN

Table B-1 ARM7TDMI-S processor signals and ARM7TDMI har d m acrocell equiv alents (continued )

ARM7TDMI-S

processor

signal Function ARM7TDMI hard

ma cro c ell equivale n t

Differences Between the ARM7TDMI-S and the ARM7TD MI

B-4

ARM DDI 0234A

DBGnTRST f Active LOW TAP controller rese t (asynchr onous assertion).

Resets the ICEBreaker subsystem. nTRST

DBGRNG[1:0] EmbeddedICE-RT rangeout qualifier outputs. RANGEOUT1,

RANGEOUT0

DBGRQ gEx t e r nal de bu g req ue s t ( ti e L OW wh en no t requ i red) . DBGRQ

DBGTCKEN Mult i-ICE clock input qualifier sampled on the rising edge of

CLK. Used to qualify CLK to enable the debug subsystem.

DBGTDI f Multi-ICE TDI test data input. TDI

DBGTDO f EmbeddedICE-RT TAP controller serial data output. TDO

DBGTMS f Multi-ICE TMS te st mode select input. TMS

DMORE Asserted fo r

LDM

and

STM

instructions. No equivalent on the

ARM7TDMI processor.

LOCK a Indicates whether the current address is part of locked access.

This signal is generated by execution of a

SWP

instruction. LOCK

nFIQ hActive LOW fast interrupt request input. nFIQ

nIRQ h Active LOW interrupt request input. nIRQ

nRESET Activ e LOW reset input (asynchronous assertion). Resets the

pro cessor cor e subsyst em. nRESET

PROT[1:0] a, i Protec tion output, indicates w hether the cur rent address is being

accessed as ins truction or data, and whether it is being accessed

in a privileg ed mode or User mo de.

nOPC,

nTRANS

RDATA[31:0] jUnidirectional 32-bit i nput data b us. DIN[31:0]

SIZE[1:0] Indicates t h e w idth of the bus tr ansaction to the current a ddress:

00 = 8-bit

01 = 16-bit

10 = 32-bit

11 = not suppo rted.

MAS[1:0]

Table B-1 ARM7TDMI-S pr ocessor signals and ARM7TDMI hard ma crocell equiv alents (cont inued)

ARM7TDMI-S

processor

signal Function ARM7TDMI hard

macrocell equivalent

Di ffe r ences B etw ee n the A RM7T DMI -S and t he AR M7TD MI

ARM DDI 0234A

B-5

TRANS[1:0] N e xt tra nsac tio n typ e ou tpu t bus:

00 = addr ess-onl y/idle transaction next

01 = copr ocessor register transaction n ext

10 = non-sequential (new address) transaction next

11 = sequential (incremental address) transaction next.

nMREQ, SEQ

WDATA[31:0] Un idirectional 32-bit output data bus DOUT[31:0]

WRITE Write acces s indicat or. nRW

a. All the address-class signals (ADDR[31:0], WRITE, SIZE[1:0], PROT[1:0], an d LOCK) change on the rising edge of

CLK.

In a system with a lo w-frequency clock this means that it is possible for the signals to change in the fi rst phase of the clock

c ycle. T his is unlike the ARM7T D MI hard macro cell where they w ould always change in the l as t phase of the cycle.

b. CLK is a rising-edge clock. It is inv erted with respec t to the MCLK signal used on the ARM 7TDMI hard mac rocell .

c. CLKEN is sam pled on the ris ing edge of CLK. The nWAIT signal on the ARM7TDMI hard macrocell must be held

throughout the HIGH phase of MCLK. This means that the address-class outputs (ADDR[31:0], WRITE, SIZE[1:0],

PROT[1:0], and LOCK) might still change in a cy cle in which CLKEN is taken LOW.

You must take this possibility into account when designing a m emory system.

d. CPA and CPB are sam pled on the rising edge of CLK. The y can no longe r change in t he first phas e of the next cycle, as is

possible with the ARM7TDMI hard macrocell.

e. DBGINSTRVALID is implemented on the ARM7TDMI-S (Rev 3) and ARM7TDMI-S (Rev 4) soft core and ARM7TDMI

(Rev 4) hard core macr ocells. This siganl is not i m plemented on pr evio us versions .

f. All JTAG signals are synchr onous to CLK on the ARM7TDMI- S processor. There i s no asynchronous TCLK as on the

ARM7TDMI hard macrocell.

You can us e an e xternal synchroniz ing circuit to generate TCLKEN when an asynchronous TCLK is required.

g. DBGRQ must be s ynchroni zed externally t o the macrocell. I t i s not an asyn chr onous input as on the ARM7TD MI hard

macrocell.

h. nFIQ and nIRQ are synchronous inputs to the ARM7TDMI-S pr ocessor, and are sampled on the rising edge of CLK.

Asynchronous interrupts ar e not supported.

i. PROT[0] is the equ ivalent of nOPC, and PROT[1] is the equivalent of nTRANS on the A RM7TDMI hard macrocell.

j. The ARM7TDMI-S processor supports o nly unidirectional da ta buses, RDATA[31:0] and WDATA[31:0]. When a

bidirectional bus is required, you must implement external bus combining logic.

Table B-1 ARM7TDMI-S processor signals and ARM7TDMI har d m acrocell equiv alents (continued )

ARM7TDMI-S

processor

signal Function ARM7TDMI hard

ma cro c ell equivale n t

Differences Between the ARM7TDMI-S and the ARM7TD MI

B-6

ARM DDI 0234A

B.2 ATPG scan interface

Where auto matic scan path i s in serted f o r au to matic t est pattern generation, th ree

sig nals are instant i ated on t h e macroce ll interface:

•SCANENABLE is LOW for normal usage, HIGH for scan test

•SCANIN is the serial s can path input

•SCANOUT is the serial scan path output.

Di ffe r ences B etw ee n the A RM7T DMI -S and t he AR M7TD MI

ARM DDI 0234A

B-7

B.3 Timing parameters

The timing cons traints have bee n adjusted to balance the external timing parameters

with the area of the synthesized co re. All input s are sampled on the risin g edge of CLK.

The timing diagrams associated wit h th ese timing para meters ar e shown in Timing

diagrams on page 8-2.

The clock enab les a re s ampled on every ris ing clock edge :

•CLKEN setup time is tisclken, hold time is tihclken

•DBGTCKEN s etup time is t istcken, hold tim e is tihtcken.

All oth er i nputs ar e sampled on the ris i ng edge of CLK whe n the cl ock ena ble is ac ti v e

HIGH:

•ABORT setup time is tisabort, hold tim e is tihabort, when CLKEN is acti ve

•RDATA setup tim e is tisrdata, hold tim e is tihrdata, when CLKEN is active

•DBGTMS, DBGTDI setup time is tistctl, hold time is tihtctl, whe n DBGTCKEN

is active.

Outputs are all sa mpled on the rising edge of CLK wit h the a ppropriate clock enable

active:

•ADDR outpu t hold time is tohaddr, valid tim e is tovaddr when CLKEN is active

•TRANS output hold t ime is tohtrans, valid time is tovtrans when CLKEN is active

•LOCK, PROT, SIZE, WRITE control output hold time is tohctl, valid time is

tovctl when CLKEN is ac tive

•WDATA out put hold time is tohwdata, valid time is tovwdata when CLKEN is active.

Similarly, all coproc es sor and debug signa l expansion signals are defined with input

setup parameters of tis... , hold parameters of tih. .. , output hold parameters of toh... and

output valid parameters of tov.. . .

Differences Between the ARM7TDMI-S and the ARM7TD MI

B-8

ARM DDI 0234A

B.4 ARM7TDMI-S design considerations

When an ARM7TDMI ha rd mac rocell desi gn is being convert ed to the ARM7TDMI-S

sof t c o r e, the following ar eas requir e specia l consideration:

•Mas ter clock

•JTAG in terface timing

•TAP controll er

•In terr u p t ti m i ng

•In terr u p t ti m i ng.

B.4.1 M aster clock

The master clock to the ARM7TDMI-S processor , CLK, is inverted w ith respect to

MCLK used on the ARM7TDMI hard macrocell. The rising edge of the clock is the

active edge of the clock, on which all inputs are sampled, and all outputs are caus al.

B.4.2 JTAG interface timing

All JTAG si gnal s on the ARM7TDMI-S p roces sor a re s ynchronous to the master c lock

input, CLK. When an external TCLK i s used , u se an ext er n al syn c h ro n i ze r to th e

ARM7TDMI-S processor.

B.4.3 TAP controller

The ARM7TDMI-S processor doe s not have a boundary sc an chai n. Consequently

support for some JTAG instructions hav e bee n removed.

Optional JTAG specific ation instr u ctions ar e:

•CLAMP

•HIGHZ

•CLAMPZ.

When scan chain 1 or scan chain 2 is selected, you can not use the EXTEST, SAMPLE,

and PRELOAD in st r u ct io n s be ca u s e:

•unpredict able behavior o cc urs

•instructions ar e only supported for designer added scan chains.

B.4.4 I nte rru pt t imi ng

As wit h all ARM7T DMI-S proc essor s i gna ls, the int er rupt signa ls nIRQ and nFIQ are

sampled on the rising edge of CLK.

Di ffe r ences B etw ee n the A RM7T DMI -S and t he AR M7TD MI

ARM DDI 0234A

B-9

When you are converting an ARM7TDMI hard macroce ll design where the ISYNC

signal is asse rted LOW, add a synchronizer to the de si gn to synchronize the interrupt

signals before they are applied to the ARM7TDMI-S processor.

B.4.5 Add ress-class si gn al timing

The addres s - cla ss outputs (ADDR[31:0], WRITE, SIZE[1:0], PROT[1:0], and

LOCK) on the ARM7TDMI-S processor al l change in res ponse to the rising e dge of

CLK. This means that they can change in the first phase of the clock in some systems.

When exact compatibility is r equired, add latc hes to the o utside of the ARM7TDMI-S

processor to make s ure that they can change only in the second phase of the c lock.

Because the CLKEN s ignal is sampled only on the risi ng edge of the clock, the

address-class outputs still change in a cycle in which CLKEN is LOW. (This is similar

to the behavior of nMREQ and SEQ in an AR M 7 TD M I hard macroc ell syst em, when

a wait stat e is i n serted usi n g nWAIT.) Mak e sure that the memory system design takes

this into ac count.

Also make sure that the correct address is used for the memory cycle, even though

ADDR[31:0] might have moved on to address for the next m emory cycle.

For mo r e de tail s, see Ch ap te r 3 Memory Interface.

B.4.6 ARM7TDMI signals not implemented on ARM7TDMI-S processor

Th e following ARM7 TDMI signals are not impl emented on th e ARM7TDMI-S

processor.

Table B-2 Unimplemented ARM 7TDMI processor signal s

Description Signal name

Bus enables ABE

DBE

TBE

BiD ir e c tio na l da ta bus D

Addr ess timing control inputs ALE

APE

By t e la tch con trols BL

Differences Between the ARM7TDMI-S and the ARM7TD MI

B-10

ARM DDI 0234A

For more details on any of these signals, see the A RM 7 TD MI Te chni ca l Ref erenc e

Manual.

Data bus timing control signals BUSDIS

BUSEN

nENIN

nENOUT

nENOUTI

Mode out put nM

Interrupt configuration signal ISYNC

Deb ug signals DBGRQI

ECLK

JTAG e xpansion si gnals DRIVEBS

ECAPCLK

ECAPCLKBS

HIGHZ

ICAPCLKBS

nHIGHZ

PCLKBS

RSTCLKBS

SCREG

SDINBS

SDOUTBS

SHCLKBS

SHCLK2BS

TAPSM

TCK1

TCK2

Table B-2 Unimplemented ARM7TDMI processor signals

Description Signal name

ARM DDI 0234A
Copy right © 20 01 AR M Limited. A ll rights reserved.
Index-1
Index
The items in this  index are listed in alpha betical order, with s ymbols and nume rics appeari ng at the end. The 
r efe renc es given are to page numb ers.
A
Abort
Data   2-22, 5-9, 5-45
excep t i o n   2-22
handler   2-22, 5-9
hold time   B-7
mode   2- 8
Prefetch   2-22 , 5-47
setup time   B-7
si g na l   A- 2
vector   5-45
Aborted watchpoint   5-46
ACtiming diagrams   8-2–8-7
tim ing para me ter defi nitions   8-8
Add res s cl as s sig na l
timing   B-9
Address mask register   5-48, 5-50
Add res s va l u e  regis ter   5-48
Ar chitect ure   1- 4, 2-2
ARM
instruct ion set   1-9–??
operating state   2-3
ARM state   1-4
register set   2-9
ATP G scan  in te rf ac e   B -6
B
B anked regis ters   2-9, 5-40
B ig-endia n format   2-4
Boundary-scan
chain cells   5-27
interface   5-27
Breakpoint
address mask   5-53, 5-54
data-dependent   5-53
entry into debug stat e   5-8
e xternally-ge nerated   5-7
h ardware   5-53
programming   5-53
Breakpoints
programming   5-53
software   5-53
Bus interface
cycle types    3-4
signals   3-3
BYPASS instructi on   5-29
Bypass register   5-3 0, 5-31
C
CAPTURE-DR state   5 -28
Clock
domains   5-13
maximum skew   8-8
system   5- 10
test   5-10
Code density   1-4, 1-5
Conditi on code flags   2-16
Control bits   2-17
Control mask   5-48, 5-50
Control mask register   5-48, 5-50
Control value
register   5-52
Control value register   5-48, 5-50

Index
Index-2
Copyright © 20 01 ARM Limited. All r ights reserved.
ARM DDI 0234A
Coprocessor
about   4-2
busy-waiting   4-8
connecti ng   4-11–4-13
da ta o p erations   4-9
data processi ng operation   7-22
handshaking   4-6
interfac e handshaking   4-6
interfac e signals    4-4
load a nd store ope rations   4-10
load register   7-23
not using   4-14
register transfer   7-27
register transfer, from ARM   7-28
Stor e Cop roc es sor (S TC) o per at ion   
7-25
timing   8-4
CPnCPI   4-8
CPSR   2-9
Current Program Status Register, See 
CPSR
Cycle
co processor register  transfer   1-3
idle   1-3
nonsequential   1-3
sequential   1-3
D
Data
abort   2-22, 5-9, 5-47
operation s   7-10
types   2-7
Dat a fo rmats
big-endian   2-4
little-endian   2-4
Data mask register   5-48, 5-50
Data swap instruction   7-20
Data value regi ster   5-48
DCC
access through JTAG   1-23
bandw idth improvements   1-23
Debug
actions   5-9
breakpoints   5-8
communications channel   ??–5-23
co ntrol register   5-57
core st at e   5-39
entry into debug state from 
breakpoint/watchpoint   5-44
exception s   5-47
expansion si gnals   B-7
host   5-3
interface   5-12
interface signals    5-12
message transfer   ??–5-22
Multi-ICE   5-10
priorities   5-47
request   5-7, 5-9, 5-44, 5-45
st at e   5-9
state, entry from a breakpoint   5-44
state, exit from   5-43
status register   5-39,  5-60
system state   5-39
target   5-3
timing   8-6
watchpoint   5-9
Debug st atus
register   5-61
Decode   1-2
De sign consi derations   B-10
De vice iden tification code   5-29, 5-31
Disable EmbeddedICE   5-16
DMORE output   1-24
E
E mb eddedICE   5-5
breakpoint s software   5-54
breakpoints, coupling wi th 
watchpoints   5-62
breakpoints, hardware   5-53
communications channel   5-20
control re gister   5-43
control re gisters   5-50
coupling breakpoint s and 
watchpoints   5-62
coupling breakpoint s w ith 
watchpoints   5-62
debug s tatus register   5-39, 5-60
disable   5-16
hardware breakpoints   5-53
overview   5-14
program   5-7
programming   5-9, 5-24
registers   5-48
software br eakpoint s   5-54
timing   5-65
wa tchpoint   5-53
watchpoint re gisters   5-48–5-52
Em beddedICE-RT   1-22
Exception
abort   2-22
ac ti on on  en try   2- 20
action on leaving   2-21
ARM state   2-20
Data Abor t   2-22
entry/exit summary   2-19
FIQ   2-21
IRQ    2- 21
priorities   2-24
Thumb state   2-20
vectors   2-24
wa tchpoint   5-45
E xceptions   2-19–2-25
E xecute   1-2
F
F bi t   2-17
F etch   1-2
instruction   5-51
FIQ
disable bits   2-17
exception   2-21
mode   2- 8
registers   2 -10
See in terrupts
valid   4-8
Flags
condition code   2-16
H
Ha lt mode   5 -6, 5-7
Hardware breakpoints   5-53
Hi gh registers   2 -14
I
I bit   2-17
ID  register   5-27, 5-29, 5-31

Index
ARM DDI 0234A
Copy right © 20 01 AR M Limited. A ll rights reserved.
Index-3
IDCO D E instructi on   5-29
Iden tifi ca tion re gis te r, S ee  ID  reg is ter
Input timing
configuration   8-5
excep t i o n   8-5
Instruction
ARM   1-4
co m pression   1-4
fetch   5-51
pipeline   1-2
register   5-29, 5-31, 5-32
set   1-9–??
Thum b   1-4
Instruction cycle
timings   7-3
Instruction set
ARM   1-9–??
Thum b   1-17–??
Interface
ATPG scan   B-6
coprocessor   4-1
debug   5-12
JTAG   5 -24
memory   1-3, 3-2
signals   B-2
Interrupt
mas k enable   5-61
Interrupts   5-47
disable bits   2-17
latencies   2-26
INTEST
instruction   5-28
mod e   5-34
IRQ
excep t i o n   2-21
mode   2- 8
valid   4-8
J
JTAG
BYPASS   5-29
IDC O D E    5-29,  5-3 2
interface   5-5, 5-24
INTEST   5-28
public instructions (summary)   5-28
RESTART   5-30
SCAN_N   5-28
L
Link re gist er, See LR
Little-endian format   2-4
Load coprocessor register   7-23
Low  re gist er s   2-14
LR   2-9
M
Mask en able
interrupt   5-61
Memory
access   1-3
access cycles   2-22
access fro m de bugging st ate   5-40, 
5-42
b ig-endian  format   2-4
byte an d  halfw o rd ac ce s s e s   3-14
coprocessor register transfer cycle   
1-3
formats   2-4
idle cycle   1-3
interface   1-3, 3-2
little-endian format    2-4
nonsequent ial cycle   1-3
sequentia l cycle   1-3
Mem ory format
big endian   2-4
Mem ory formats
big-endian   2-4
little-endian   2-4
Mode
abort   2-8
FIQ   2-8
IRQ    2- 8
o peratin g   2-8
privileged   2-8, 4-16
PSR   2-17
PSR  bit va l u e s    2- 17
Supervisor   2-8
system   2-8
undefined   2-8, 2-23
User   2-8
Mode bits   2-9, 2-17
Monitor mode   5-6, 5-18
Multi-ICE   5-10
N
nFIQ   2-21, A-5
nIRQ   2 -21, A-5
nRESET   2-27
O
Operating modes   2-8
Operating state
ARM   2-3
Thum b   2-3
Operating states
switching   2-3
transition   2-3
P
PC   1-3, 2-3, 2-9, 2-12, 2-13
Pipeline
follower   4-5
instruction   1-2
Porting considerations   B -10
Pref et ch  A bo rt   2-2 2
Privileged instructions   4-16
Privileged modes   2-8, 2-21, 4-16
Processor
st at e   5- 39
Program Counter, See PC
Program Status Register, See PSR
Programming EmbeddedICE   5-9
PROT   5-51
Protocol converter   5-4
PSR   2-17
control bi ts   2-17
format   2-16
mode bit val ues   2-17
reserved   2-18
Public instructions   5-28
R
Range   5-52, 5-53, 5-54, 5-55, 5-62, 
5-63
Register
control va lue   5-52

Index
Index-4
Copyright © 20 01 ARM Limited. All r ights reserved.
ARM DDI 0234A
debug status   5-61
Regis ter set   2- 9
Thumb state   2-12
Register transfer coprocessor   7-27
Registers
abort mode   2 -10
AR M  st ate   2- 9
banked   2-9
debug communications channel   
5-20
debug control
DBGACK   5-59
DBGRQ   5-58
FIQ   2-10
general-p urpose   2-9
high   2-14
instruct ion   5-29, 5-31, 5-32
IRQ    2- 10
low   2-14
status   2-9
supervisor m ode   2-10
Thumb state   2-12
undefined mode   2-10
User m ode   2-10
Registers, debug
address mask   5-53, 5-54
BYPASS   5-29
bypass   5-31
co ntrol mask   5-48, 5-50
control value   5-4 8, 5-50
data ma sk   5-48
data value   5-48
EmbeddedICE   5-34
Embe ddedICE  ac ces sing    5- 25 , 5-3 3
EmbeddedICE debug status   5-39
ID   5-31
instruct ion   5-29, 5-31, 5-32
scan path select   5-31, 5-32
scan path  select re gister   5-28
status   5-60
status register   5-39
test data   5-31
watchpoint address mask   5-48
watchpoint address value   5-48
Reserve d bit s
PSR   2-18
Reset
nRESET   2-27
RESTART
on exit from debug   5-30
RE START ins tr ucti on    5-30,   5-41,  5-4 2
Return addr ess calculation   5-46
Retu rne d TCK, Se e RTCK
RTCK   5-10
RUN-TEST/IDLE st ate   5-30, 5-42
S
Saved Program Status Register, See 
SPSR
Scan
input cells   5-29
interface timing   5-36
limitations   5-24
output cells   5-29
path   5-28
paths   5-24
Scan cells   5-29, 5-33
Scan chain
selected   5-28
S can c hain 1   5-24, 5-31, 5-34, 5-36, 
5-39, 5-40, 5-41, 5-44
S can c hain 1 cells   5-36
S can c hain 2   5-24, 5-31, 5-34, 5-48
Scan chains   5-24, 5-33
number allocation   5-33
S can p ath s elect register   5-28 , 5-31, 
5-32
S C AN _N    5-28, 5-32, 5-34
S H IFT-DR   5- 27, 5-28, 5-29, 5-34
S HIFT-IR   5-32
S ignals compared to
hard macrocell
ARM7TDMI   B-2
S ingle-step core ope ration   5-29
SIZE   3-10, 5- 51, A-6
S oftware br eakpoint s   5-53, 5-54
cl e arin g   5-54
programming   5-54
setting   5-53, 5-54
Software Interrupt Instruction, See SWI
SP   2-12 , 2- 1 3
SPSR   2-9
Stack Pointer, See SP
State
ARM   1-4
CAPTURE-DR   5-28, 5-29
processor   5-39
register set
AR M  st ate   2- 9
SHIF T-DR   5-27,  5-28, 5-29, 5-31
Thum b   1-4
UPDATE-DR   5-28, 5-29, 5-30
UPDATE-IR   5-32
Status registers   2-9
S tore copr ocessor register   7-2 5
S uperviso r mode   2-8, 2-23
S WI    2-23
S ystem mode   2-8
S ystem speed
instruction   5-41, 5-46
S ystem state
determining   5-40
T
T bi t   2-17 , 2-27
TAP
controller   5-5, 5-14, 5-24, 5-26
controller state
transitions   5-26
instruction   5-32
st at e   5- 34
T est Access Port, See TAP
T est data re gisters   5-31
Thumb
code   1-5
instruction set   1-4, 1-9
operating state   2-3
registers   2 -12
Thumb instruction set   1-17–??
T hum b state   1-4
T iming parame ters   B-7
Transitions
TA P co ntr o lle r stat e   5-26
U
Undefined instructio n   2-8, 2-23
handling   4-15
trap   2-23, 4-2, 4-14, 4-15, 4-16, 
7-29
Un defined mode    2-8
Unexecuted instruction   7-30

Index
ARM DDI 0234A
Copy right © 20 01 AR M Limited. A ll rights reserved.
Index-5
UP DATE-DR   5-28
UPDATE-IR   5- 32
User mode   2 -8
W
Wat chpoint   5-7, 5-9, 5-15, 5-34 , 5-44, 
5-62
aborted   5-46
coupling   5-62
EmbeddedICE   5-53
ex ternal ly generated   5-7
programming   5-55
register   5-48, 5-54
registers   5-48
unit   5-55
units   5-48
with exception   5-46
Wa t c hp oin t 0   5- 64
Watchpointed
access   5-45, 5-47
memory access   5-45
WRITE   5-51

Index

Index-6

ARM DDI 0234A