Ingenic XBurst 2 CPU Core, Programming Manual

Page 1: ...XBurst 2 CPU Core Programming Manual Release Date June 2 2017 ...

Page 2: ... provided for by Ingenic Terms and Conditions of Sale Ingenic products are not designed for and should not be used in any medical or life sustaining or supporting equipment All information in this document should be treated as preliminary Ingenic may make changes to this document without notice Anyone relying on this documentation should contact Ingenic for the current documentation and errata Ing...

Page 3: ...ol Registers 45 3 3 7 CPU Performance Monitor Registers 46 3 3 8 Debug Registers 48 3 3 9 User Mode Support Registers 54 3 3 10 Kernel Mode Scratch Registers 56 4 Exceptions and Interrupts 58 4 1 Exception Priority 58 4 2 Exception Vector Locations 59 4 3 Exception Handling Process 60 4 3 1 Enter Exception Handler Routine 60 4 3 2 Return from Exception Handler Routine 60 4 4 Exception Categories 6...

Page 4: ...ription 82 8 2 1 Cores SLeep Control Register 83 8 2 2 Core Sleep Status Register 84 8 2 3 Core Software Reset Register 85 8 2 4 Memory Subsystem Control Register 86 8 2 5 Memory Subsystem Implementation Register 87 8 2 6 CPU Configuration Register 88 8 2 7 Peripheral IRQ Pending Register 89 8 2 8 Peripheral IRQ Mask Register 89 8 2 9 Mailbox IRQ Pending Register 90 8 2 10 Mailbox IRQ Mask Registe...

Page 5: ...2 Debug Exception by Data Breakpoint 104 9 7 3 Breakpoint Used as Triggerpoint 104 9 8 Test Access Port TAP 104 9 8 1 EJTAG Internal and External Interfaces 105 9 8 2 Test Access Port Operation 105 9 8 3 Test Access Port TAP Instructions 109 9 8 4 TAP Processor Accesses 111 9 9 EJTAG Registers 113 9 9 1 General Purpose Control and Status 113 9 9 2 Instruction Breakpoint Registers 114 9 9 3 Data Br...

Page 6: ...ECR_A 136 9 13 3 Processor Access Address Register in ACC mode ADDRESS_A 138 9 13 4 Processor Access Data Register in ACC mode DATA_A 138 9 13 5 Debug Mode Address Space in Compliant Mode AM 0 139 9 13 6 Debug Mode Address Space in ACC Mode AM 1 139 9 13 7 Supported JTAG Instructions in ACC Mode 140 Revision History 141 XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor...

Page 7: ... dual issue floating point single and double and 128 bit SIMD Unit 32 x 128 bit registers 128 bit loads stores to from SIMD unit data types 8 16 32 bits integer Q15 Q31 fixed point and 32 64 bits floating point IEEE 754 2008 compliance Programmable Memory Management Unit MMU 1st level mini TLB MTLB 8 entry instruction MTLB 16 entry data MTLB 2nd level joint TLBs 32 entry VTLB 256 entry 4 way set a...

Page 8: ...Mode Table 2 1 the conditions of operating mode Debug DM Status UM Status EXL Status ERL Operating Mode 1 X X X Debug Mode 0 0 X X Kernel Mode 0 X 1 X 0 X X 1 0 1 0 0 User Mode X denotes don t care XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor Co Ltd All rights reserved 6 ...

Page 9: ......

Page 10: ... 1 CP0 Register Grouped by Function and Table 3 2 CP0 Registers Grouped by Number 3 1 1 CP0 Registers Grouped by Function The CP0 registers set are divided into several register groups listed below Table 3 1 CP0 Register Grouped by Function Category Register Name Register Number Register Select CPU Configuration and Status Config 16 0 section 3 3 1 1 Config1 16 1 section 3 3 1 2 Config2 16 2 secti...

Page 11: ... 25 2 section 3 3 7 1 PerfCntCnt1 25 3 section 3 3 7 2 Debug Debug 23 0 section 3 3 8 1 Debug2 23 6 section 3 3 8 2 DEPC 24 0 section 3 3 8 3 DESAVE 31 0 section 3 3 8 4 WatchLo 18 0 section 3 3 8 5 WatchHi 19 0 section 3 3 8 6 User Mode Support HWREna 7 0 section 3 3 9 1 UserLocal 4 2 section 3 3 9 2 LLAddr 17 0 section 3 3 9 3 Kernel Mode Support KScratch1 31 2 section 3 3 10 1 KScratch2 31 3 se...

Page 12: ... instruction section 3 3 9 1 8 0 BadVaddr The virtual address triggering the most recent address related exception section 3 3 2 9 9 0 Count Interval counter section 3 3 4 1 9 6 SpinLock Spinlock register 10 0 EntryHi High order portion of the TLB entry section 3 3 2 4 11 0 Compare Compare value for interval count section 3 3 4 2 12 0 Status Processor status and control section 3 3 1 9 12 1 IntCtl...

Page 13: ...PerfCntCtl1 Performance counter 1 control section 3 3 7 1 25 3 PerfCntCnt1 Performance counter 1 count section 3 3 7 2 28 0 TagLo Cache tag read write interface for I Cache and D Cache section 3 3 5 1 28 1 DataLo Low order data read write interface for I Cache and D Cache section 3 3 5 2 30 0 ErrorEPC Program counter of resuming after servicing the most recent Error exception like reset section 3 ...

Page 14: ...r static or is updated only by hardware If the reset state of this field is either 0 or 1 hardware initializes this field A field to which the value written by software is ignored Software may write any value to this field without affecting hardware behavior Software reading the field will return the last value updated by hardware If the reset state of this field is Undefined software reading of t...

Page 15: ...gister specifies various configuration and capabilities information Most of the fields in the Config register are initialized by hardware reset or are constant value Config Register 31 30 28 27 25 24 16 15 14 13 12 10 9 7 6 4 3 2 0 M K23 KU 0 BE AT AR MT 0 VI K0 Name Bits Description R W Reset M 31 This bit is hardwired to 1 to indicate the presence of the Config1 register R 1 K23 30 28 These fiel...

Page 16: ... a VTLB FTLB MMU R 4 0 6 4 Must be written as zero returns zero on read R 0 VI 3 Virtual instruction cache This field is hardwired to 1 b0 to indicate the instruction cache of XBurst2 CPU is not virtual R 0 K0 2 0 Kseg0 cache attributes SeeTable 6 2 Cache Coherency Attributes for detail R W 2 XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor Co Ltd All rights reserved ...

Page 17: ...ntries Refer to the Config4 register for more information 0x1F indicates 32 VTLB entries for this implementation R 0x1F IS 24 22 L1 instruction cache number of sets per way This field is encoded as follows 0 Reserved 1 128 sets per way 2 7 Reseveed R 1 IL 21 19 L1 instruction cache line size This field is encoded as follows 0 3 Reserved 4 32 byte line size 5 7 Reserved R 4 IA 18 16 L1 Instruction ...

Page 18: ...R 3 Watch registers implemented Refer to WathcLo WatchHi registers for more information R 1 CA 2 MIPS16e present This bit always reads as 0 to indicate no support of MIPS16e ISA R 0 EP 1 EJTAG implemented This bit always reads as 1 to indicate the EJTAG unit is implemented R 1 FP 0 FPU implemented If an FPU is implemented further capabilities of the FPU can be read from the capability bits in the ...

Page 19: ...ds of TU TS TL TA are not used and are all tied to 0 R 0 TS 27 24 R 0 TL 23 20 R 0 TA 19 16 R 0 SU 15 13 Version of L2 0 V0 0 1 V1 0 2 V2 0 3 8 reserved R 2 SS 11 8 L2 cache sets per way This field is encoded as follows 0 1 6 7 Reserved 2 256 set per way 3 512 set per way 4 1024 set per way 5 2048 set per way R 4 SL 7 4 L2 cache line size This field is encoded as follows 0 4 6 7 Reserved 5 64 byte...

Page 20: ...indicating that it is not implemented R 0 SC 25 Segment Control implemented The bit indicates whether SegCtl0 SegCtl1 are present R 0 PW 24 Hardware Page Table Walk implemented Read as zero indicating that it is not implemented R 0 VZ 23 Virtualization implemented Read as zero indicating that it is not implemented R 0 IPLW 22 21 Config3MCU is zero indicating that MCU ASE is not implemented so this...

Page 21: ... for MIPS32 R 0 VEIC 6 Supporting an external interrupt controller is implemented Read as zero indicating that it is not implemented R 0 VInt 5 Vectored interrupts implemented 0 Vectored interrupts are not implemented 1 Vectored interrupts are implemented R 1 SP 4 Small 1KByte page support is implemented Always reads as zero indicating that XBurst2 CPU does not support 1KByte page R 0 CDMM 2 Commo...

Page 22: ...16 Indicates how many scratch registers are available to kernel mode software within COP0 register 31 Each bit represents a select for Coprocessor0 Register 31 Bit 16 represents Select 0 DESAVE register Bit 23 represents Select 7 If the bit is set the associated scratch register is implemented and available for kernel mode software R 0xFC MMU ExDef 15 14 MMU Extension Definition Always read as 3 i...

Page 23: ...11 Reserved FTLB Sets 3 0 Indicates the number of sets per way within the FTLB array Encoding Set per Way 0000 0101 Reserved 0110 64 0111 1111 Reserved R 0x6 XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor Co Ltd All rights reserved 21 ...

Page 24: ...ion Control is not implemented R 0 CV 29 Segmentation Control is not implemented R 0 EVA 28 Enhanced Virtual Addressing instructions not implemented R 0 MSAEn 27 MIPS SIMD architecture MSA enable This bit is encoded as follows 0 MSA instructions and registers are disabled Executing an MSA instruction causes a MSA disabled exeption 1 MSA instructions and registers are enabled R W 0 0 26 1 Must be w...

Page 25: ...signed or manufactured the processor R 0x13 Processor ID 15 8 Processor ID Identifies the uA type of processor This field allows software to distinguish between the various types of processors 1 Generation 15 13 0 XBurst1 1 XBurst2 others reserved 2 uA 12 8 micro architecture version 0 X2000 R 0x20 Revision 7 0 The revision number of mass production 1 Process 7 4 encode of IC process technology 0 ...

Page 26: ...e final exception address The combination of these two restrictions forces the final exception address to be in the kseg0 or kseg1 unmapped virtual address segments If the value of the Ebase base register is to be changed this must be done with Status BEV equal to 1 The operation result is UNDEFINED if the Ebase is written with a different value when Status BEV is 0 Ebase Register 31 30 29 12 11 1...

Page 27: ... Coprocessor 0 is always usable when the core is running in Kernel Mode or Debug Mode independent of the state of the CU0 bit R W 0 RP 27 Enables reduced power mode implemented Always read as zero indicating that it is not implemented R 0 FR 26 Floating point register mode for 64 bit point unit 0 only 32 bit datatype can be hold in one floating point register 64 bit datatypes are stored in even od...

Page 28: ...ed so IM 7 0 is only used for interrupt mask R W 0x0 IM1 IM0 9 8 Interrupt Mask Controls the enabling of each of the software interrupts 0 Interrupt request disabled 1 Interrupt request enabled R W 0x0 0 7 5 Must be written as zero returns zero on read R 0 UM 4 The encoding for this bit is 0 Base mode is Kernel Mode 1 Base mode is User Mode R W 0 R0 3 Supervisor mode is not implemented write is ig...

Page 29: ...SRSCtl will not be updated if another exception is taken IE 0 Global Interrupt Enable 0 interrupts disabled 1 interrupts enabled Note that IE being cleared just prohibit acknowledging interrupts by executing IRQ handler it can t prevent some hardware behaviors like captured interrupt signals waking the core from SLEEP state R W 0 XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Sem...

Page 30: ...d as zero because Fast Debug Channel Interrupt request is not implemented R 0x0 0 22 10 Must be written as zero returns zero on read R 0 VS 9 5 Vector spacing If vectored interrupts are implemented as denoted by Config3 VEIC or Config3 VINT this field specifies the spacing between vectored interrupts VS Field Encoding Spacing Between Vectors hex Spacing Between Vectors decimal 0x00 0x000 0 0x01 0x...

Page 31: ...is equal to Ceiling log2 VTLBSize FTLBSize Index Register 31 30 8 0 P Reserved Index Name Bits Description R W Reset P 31 Probe Failure Hardware writes this bit after executing TLBP instruction to indicate whether a TLB match occurred Encoding Meaning 0 A match occurred and the Index field contains the index of the matching entry 1 No match occurred and the Index field is UNPREDICTABLE R 0 Reserve...

Page 32: ...written by a TLBWR An upper bond is set by the total number of VTLB entries minus 1 Within the required constraints of the upper and lower bounds the manner in which the processor selects values for the Random register is implementation dependent The processor initializes the Random register to the upper bound when reset and when the Wired register is updated Random Register 31 5 4 0 Reserved Rand...

Page 33: ...me Number The PFN field corresponds to bits 31 12 of the physical address R W 0 C 5 3 Cache attribute of the page See Table 6 2 Cache Coherency Attributes for detail R W 0 D 2 Dirty attribute of the page The Dirty flag indicates that the page has been written and or is writable If D has been set stores to the page are permitted However if D has been cleared stores to the page cause a TLB Modified ...

Page 34: ...HINV ASIDX ASID Name Bits Description R W Reset VPN2 31 13 VA31 13 of the virtual address This field is written by hardware on a TLB exception or on a TLB read and can be written by software before a TLB write R W 0 VPN2X 12 11 XBurst 2 CPU does not support 1KB pages and returns zero on read R 0 EHINV 10 TLB HW Invalidate If this bit is set the TLBWI instruction will invalidate the VPN2 field of t...

Page 35: ...VPN2 field of the Context register The PTEBase field is written only by software and used by the operating system The BadVPN2 field of the Context register is not defined after an address error exception occurs Context register 31 23 22 4 3 0 PTEBase BadVPN2 Reserved Name Bits Description R W Reset PTEBase 31 23 This field is normally written with a value that allows the operating system to use th...

Page 36: ...s Description R W Reset Reserved 31 27 Must be written as zero returns zero on read R 0 Mask 26 13 Mask bits for varying page size 00_0000_0000_0000 4KB 00_0000_0000_0011 16KB 00_0000_0000_1111 64KB 00_0000_0011_1111 256KB 00_0000_1111_1111 1MB 00_0011_1111_1111 4MB 00_1111_1111_1111 16MB 11_1111_1111_1111 64MB R W 0x0 Reserved 12 0 Must be written as zero returns zero on read R 0 XBurst 2 CPU Cor...

Page 37: ...gisters is enabled R 1 Reserved 29 Must be written as zero returns zero on read R 0 ESP 28 Always read as 0 since 1KB page is not supported R 0 IEC 27 Enable unique exception code for the Read Inhibit and Execute Inhibit exceptions 0 Read Inhibit and Execute Inhibit exceptions both use the TLBL exception code 1 Read Inhibit exceptions use the TLBRI exception code Execute Inhibit exceptions use the...

Page 38: ...d register is reset to zero Writing the Wired register will cause the Random register to reset to its upper bound The operation of the processor is UNDEFINED if a value greater than or equal to the number of VTLB entries is written to the Wired register Wired Register 31 5 4 0 Reserved Wired Name Bits Description R W Reset Reserved 31 5 Must be written as zero returns zero on read R 0 Wired 4 0 TL...

Page 39: ...ess error AdEL or AdES TLB Refill TLB Invalid TLB Modified The BadVAddr register does not capture address information for cache or bus errors BadVAddr Register 31 0 BadVAddr Name Bits Description R W Reset BadVAddr 31 0 Failed virtual address in Address Error or TLB exceptions R 0x0 XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor Co Ltd All rights reserved 37 ...

Page 40: ...ot 1 In delay slot The core can update BD only if StatusEXL was zero when an exception occurred R 0 TI 30 Indicates whether a timer interrupt is pending 0 No timer interrupt is pending 1 Timer interrupt is pending R 0 CE 29 28 Coprocessor unit number referenced when a Coprocessor unusable exception is taken 00 Coprocessor 0 CP0 01 Coprocessor 1 FPU 10 Coprocessor 2 MXA 11 Coprocessor 3 Reserved R ...

Page 41: ...ed because MCU ASE is not implemented write is ignored and read as zero R 0 IP 7 2 15 10 Indicates pending interrupts Bit Name Meaning 15 IP7 Hardware interrupt 5 14 IP6 Hardware interrupt 4 13 IP5 Hardware interrupt 3 12 IP4 Hardware interrupt 2 11 IP3 Hardware interrupt 1 10 IP2 Hardware interrupt 0 IP 7 2 are connected with IRQ sources as follows IP7 Timer Interrupt request IP6 Performance Coun...

Page 42: ...ed instruction exception 11 CPU Coprocessor unusable exception 12 Ov Integer overflow exception 13 Tr Trap exception 14 MSAFPE MSA Floating Point exception 15 FPE Floating point exception 16 20 N A 19 TLBRI TLB Read Inhibit exception 20 TLBXI TLB Execution Inhibit exception 21 MSADis MSA Disabled exception 22 N A 23 WATCH Reference to WatchHi WatchLo address 24 Mcheck Machine Check 25 31 Reserved ...

Page 43: ...he instruction that is the direct cause of the exception The program counter of the preceding branch or jump instruction that is the adjacent one of the exception causing instruction in the branch delay slot and therefore the Branch Delay bit in the Cause register is set Note that the core does not update the EPC register when the EXL bit in the Status register has been set to one for a new except...

Page 44: ...hich program resumes after a Reset exception All bits of the ErrorEPC register are significant and writable ErrorEPC Register 31 0 ErrorEPC Name Bits Description R W Reset ErrorEPC 31 0 Error Exception Program Counter R W undef XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor Co Ltd All rights reserved 42 ...

Page 45: ...pare CP0 Register 11 Select 0 The Compare register acts in conjunction with the Count register to implement a timer and timer interrupt function When the value of the Count register equals the value of the Compare register a timer interrupt arises This IRQ request is then conntected with hardware interrupt signal pin number 5 in order to set interrupt bit IP 7 in the Cause register For diagnostic ...

Page 46: ...he operation to initialize the cache tags of I Cache and D cache to a valid state at powerup TagLo Register 31 12 11 1 0 PTagLo 0 V Name Bits Description R W Reset PTagLo 31 12 Physical address of the indexed cache line R W 0 0 11 1 Must be written as zero returns zero on read R 0 V 0 Valid bit of the cache line R W 0 3 3 5 2 DataLo Register CP0 number 28 Select 1 The DataLo register acts as the i...

Page 47: ...rved 25 22 Must be written as zero returns zero on read R 0 EICSS 21 18 EIC interrupt mode shadow set Because Config3VEIC 0 this field must be written as zero and returns zero on read R 0 Reserved 17 16 Must be written as zero returns zero on read R 0 ESS 15 12 Exception Shadow Set Must be written as zero and returns zero on read R 0 Reserved 11 10 Must be written as zero returns zero on read R 0 ...

Page 48: ...ormance counters implemented and how they map into the select values of the PerfCnt register Table 3 5 Example Performance Counter Usage of the PerfCnt CP0 Register Performance Counter PerfCnt Register Select Value PerfCnt Register Usage 0 PerfCnt Select 0 Control Register 0 PerfCnt Select 1 Counter Register0 1 PerfCnt Select 2 Control Register 1 PerfCnt Select 3 Counter Register1 3 3 7 1 Performa...

Page 49: ... 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Event Count Name Bits Description R W Reset Event Count 31 0 Increments once for each event that is enabled by the corresponding Control Register When the most significant bit is one a pending interrupt request is ORed with those from other performance counters and indicated by the PCI bit in the Cause register R W 0 3 3 7 ...

Page 50: ...DDBL DDBS DIB DINT are updated on both debug exceptions and on exceptions in debug modes DExcCode is updated on exceptions in debug mode and is undefined after a debug exception Halt and Doze are updated on a debug exception and is undefined after an exception in debug mode DBD is updated on both debug and on exceptions in debug modes Debug Register 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 ...

Page 51: ...ug Mode Cache Error exception This bit is read only R and read as zero R 0 IEXI 20 An imprecise Error Exception Inhibit IEXI is not implemented This bit is read only R and reads as zero R 0 DDBSImpr 19 A Debug Data Break Store Imprecise exception is not implemented this bit read as zero R 0 DDBLImpr 18 A Debug Data Break Load Imprecise exception is not implemented this bit read as zero R 0 EJTAGVe...

Page 52: ... occurred R 0 DBp 1 Indicates that a debug software breakpoint exception occured 0 No debug software breakpoint exception occured 1 Debug software breakpoint exception occurred R 0 DSS 0 Indicates that a debug single step exception occured 0 No debug single step exception occured 1 Debug single step exception occured R 0 3 3 8 2 Debug2 Register CP0 Register 23 Select 6 Debug2 Register 31 30 29 28 ...

Page 53: ...branch delay slot and therefore the Debug Branch Delay bit in the Debug register is set Software may write the DEPC register to change the resuming address Debug Exception Program Counter Register 31 0 DEPC Name Bits Description R W Reset DEPC 31 0 Debug exception point R W Undef 3 3 8 4 Debug Save Register CP0 Register 31 Select 0 The DESAVE register functions as a simple scratchpad register For ...

Page 54: ...rts all reference types Software can determine which enables are supported by the Watch register pair by setting all enables bits and reading them back to see which ones were actually set Note that a data access watchpoint is never triggered by a Prefetch CACHE or SYNCI instruction whose address matches the Watch register pair address match conditions WatchLo Register 31 3 2 1 0 VAddr I R W Name B...

Page 55: ...ASID field of the EntryHi register to cause a watch exception R W 0 Reserved 29 26 Must be written as zero returns zero on read R 0 EAS 25 24 Must be written as zero returns zero on read R 0 ASID 23 16 ASID value which is required to match that in the EntryHi register if the G bit is zero in the WatchHi register R W 0 Reserved 15 12 Must be written as zero returns zero on read R 0 Mask 11 3 Any bi...

Page 56: ...gister by executing RDHWR 29 R W 0 0 28 4 Must be written as zero returns zero on read R 0 CCRes 3 Resolution of the Count register present Setting 1 permits programs in user mode obtaining the value of the CCRes by executing RDHWR 3 The value of CCRes denotes the number of cycles between updates of the Count register CCRes Value Meaning 1 Count register increments every cycle 2 Count register inc...

Page 57: ...CP0 Register 17 Select 0 The LLAddr register contains the the physical address corresponding to the virtual address of the load operation caused by the Load Linked LL instruction This register is implementation dependent and for diagnostic purposes only and serves on function during normal operation Load Linked Address Register 31 2 1 0 LLAddr Name Bits Description R W Reset LLAddr 31 0 This field...

Page 58: ...h1 31 0 Used by the kernel for temporary storage of information R W undef 3 3 10 2 Kernel Scratch Register 2 KScratch2 CP0 Register 31 Select 3 KScratch2 is a read write 32 bit register that is used by the kernel for temporary storage of information The presence of the KScratch2 register is indicated by Config4KScrExist 3 1 KScratch2 Register 31 0 KScratch2 Name Bits Description R W Reset KScratch...

Page 59: ...y storage of information The presence of the KScratch5 register is indicated by Config4KScrExist 6 1 KScratch5 Register 31 0 KScratch5 Name Bits Description R W Reset KScratch5 31 0 Used by the kernel for temporary storage of information R W undef 3 3 10 6 Kernel Scratch Register 6 KScratch6 CP0 Register 31 Select 7 KScratch6 is a read write 32 bit register that is used by the kernel for temporary...

Page 60: ...nment error or fetch protected address space 8 TLBL Fetch TLB miss or fetch hit page with V 0 or XI 1 9 DBp Execution of SDBBP 10 Sys Execution of SYSCALL 11 Bp Execution of BREAK CpU Execution of CpX instruction while relative Status CUx is disabled RI Execution of a Reserved Instruction FPE Floating Point exception MSAFPE MSA Floating Point exception MSADis MSA Disabled exception Ov Execution of...

Page 61: ...xff200200 Status BEV Status EXL Cause IV Base Offset TLB Refill 0 0 x EBase 31 12 12 b0 0x000 0 1 x 0x180 1 0 x 0xbfc00200 0x000 1 1 x 0x180 Interrupt 0 x 0 EBase 31 12 12 b0 0x180 0 x 1 0x200 1 x 0 0xbfc00200 0x180 1 x 1 0x200 Others 0 x x EBase 31 12 12 b0 0x180 1 x x 0xbfc00200 XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor Co Ltd All rights reserved 59 ...

Page 62: ...nted reset exception or to EPC for granted generic exception or to DEPC for granted debug or debug mode exception Set necessary status bits such as Status EXL and so on After above all has been done switching core context has been accomplished then change PC to jump to the expected handler entry for service of granted exception 4 3 2 Return from Exception Handler Routine Return from exception rout...

Page 63: ...n there is a transition of Status EXL Status ERL 1 to Status EXL Status ERL 0 meanwhile WP bit has been set DIB A Debug Instruction Break Exception occurs when an instruction hardware breakpoint matches an executed instruction in Non debug mode Watch A Watch Exception occurs when an instruction or data reference matches the address information stored in the WatchHi and WatchLo registers A Watch Ex...

Page 64: ... A Reserved Instruction Exception occurs only when a reserved instruction was executed If both a Coprocessor Unusable Exception and a Reserved Instruction Exception occur on the same instruction the Coprocessor Unusable Exception takes priority FPE A Floating Point Exception is initiated by the floating point coprocessor signaling an exception MSAFPE MSA Floating Point Exception MSADis MSA Disable...

Page 65: ...rmation for address translation tables located in memory It enables high speed translation of virtual addresses into physical addresses Address translation uses the paging system and supports 8 kinds of page size The access right to virtual address space can be set for privileged and user modes to provide memory protection XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconduc...

Page 66: ...User Mode The core operates in user mode when the DM bit in the Debug register is 0 and the Status register contains the following bit values UM 1 EXL 0 ERL 0 useg Mapped kseg3 Mapped kseg2 Mapped kseg1 Unmapped Uncached Kseg0 Unmapped kuseg Mapped kseg3 Mapped kseg2 Mapped kseg1 Unmapped Uncached Kseg0 Unmapped kuseg Mapped 0x0000 0000 0x8000 0000 0xA000 0000 0xC000 0000 0xE000 0000 0xFFFF FFFF d...

Page 67: ...let PC jump to the code position pointed by the EPC register meanwhile clear EXL to 0 In kernel mode virtual address space is divided into serveral regions differentiated by the high order bits of the virtual address 5 2 2 1 kuseg kuseg address range is 0x0000_0000 0x7FFF_FFFF 2G Byte Accessing kuseg need be combined with the ASID field of EntryHi register to form a unique virtual address for addr...

Page 68: ...uch address belongs to kseg2 with size of 229 byte 512M Byte located at virtual address region 0xC000_0000 0xDFFF_FFFF References to kseg2 need be combined with the ASID field of EntryHi register to form a unique virtual address for address mapping by TLB 5 2 2 5 kseg3 In kernel mode when the most significant three bits of a 32 bit virtual address are 1112 such address belongs to kseg3 with size o...

Page 69: ...ardware and is transparent to software which is organized as per entry containg a pair of even odd pages DMTLB is dedicated to performing address translation for load store operations with supporting variable page size from 4 KB tp 64 MB Like the IMTLB if a load store virtual address cannot be translated by the DMTLB then the JTLB is to be searched further And if the missed page is successfully fo...

Page 70: ... 5 2 TLB Tag Entry Format PageMask 26 13 VPN2 31 13 ASID 7 0 41 28 8 0 26 7 27 G Figure 5 3 TLB Data Entry Format FPN1 31 12 RI1 XI1 C1 2 0 D1 V1 FPN0 31 12 RI0 XI0 C0 2 0 D0 V0 0 1 5 2 4 6 7 26 27 28 32 29 31 33 34 52 Table 5 1 TLB Tag Entry Field Description Field Description PageMask 26 13 Mask bits for variable page size 00_0000_0000_0000 4KB 00_0000_0000_0011 16KB 00_0000_0000_1111 64KB 00_00...

Page 71: ...streaming 101 Cacheable write back write allocate streaming 110 Reserved 111 Reserved XI0 XI1 eXecute Inhibit bit 1 Instruction Fetching from the page is inhibited 0 Instruction Fetching from the page is not inhibited RI0 RI1 Read Inhibit bit 1 Data read from the page is inhibited 0 Data read from the page is not inhibited D0 D1 Dirty or Write enable bit 1 Indicates that the page has already been ...

Page 72: ...FTLB Configuration Options FTLB Parameter Programmable Options CP0 Register Reference Ways 4 ways Config4FTLB Ways Sets 128 sets Config4FTLB Sets Page Size 4 KB 16 KB Config4FTLB Page Size Both TLBWI and TLBR instructions use Index register to access JTLB VTLB FTLB to correctly access them respectively programmers must pay attention to the integrated index for JTLB depicted by following Figure 5 4...

Page 73: ... access FTLB set Index register by executing MTC0 0 0 index index 0 and index index Config1 MMUsize index index Config1 MMUsize and index index Config1 MMUsize FTLB sets FTLB ways set Index regiser by executing TLBP 5 3 5 2 TLBWR See following table for detail of how the execution of a TLBWR instruction can access a VTLB FTLB entry access VLTB access FTLB value of PageMask register represents a la...

Page 74: ...VPN field of the virtual address equals the VPN field of the entry and either G bit of the TLB entry is set or ASID field of the virtual address held in the EntryHi register matches the ASID field of the TLB entry VPN ASID User Mode User Address Address Error Range of Kseg0 Kseg1 Unmapped Address VPN Match G 1 ASID Match V 0 Or RI 1 current load access Or XI 1 current fetch access D 1 TLB Invalid ...

Page 75: ...cy Attribute Cache coherency attribute is specified by the C 2 0 field in EntryLo0 and EntryLo1 entry of the TLB table for mapped address regions including useg kuseg kseg2 and kseg3 For unmapped segment kseg0 Config K0 2 0 field specifies the cache attribute Unmapped segment kseg1 is not cacheable The cache attribute is defined as following Table 6 2 Cache Coherency Attributes CCA Encoding Descri...

Page 76: ... a virtual address The virtual address need be translated by MMU to form a physical address The physical address then is used in the following 2 ways based on the operation to be performed The physical address is directly used to address the cache The physical address is used to index the sets and ways of the cache as shown below 31 15 14 12 11 5 4 0 unused Way index Set Index Byte offset op 17 16...

Page 77: ...ord corresponding to the word offset ignore least significant two bits of the address into the DataLo register 0102 Index Store Tag Write the tag for the cache block at the specified index from the TagLo register 0112 Index Store data Write the DataLo contents to the way and word index as specified 1002 Hit Invalidate If the virtual address hits I cache the hit line is invalidated otherwise nothin...

Page 78: ...epping through all valid indices Doing so requires that the TagLo and TagHi registers associated with the cache be initialized first 0112 Reserved 1002 Hit Invalidate If the virtual address hits D cache the hit line is invalidated otherwise nothing is done 1012 Hit write back Invalidate If the virtual address hits D cache invalidate the hit cache line If the cache line is dirty write back the dirt...

Page 79: ...ers the meaning of the program Table 6 6 Values of the hint Field for the PREF PREFX Instruction Hint Action Description 0 Prefetch Prefetch data in the same way as cacheable LOAD instruction However it is a non blocking operation it does not block pipeline while waiting for the missed data to be returned from external memory Moreover if the VA of prefetch may trigger any address relative exceptio...

Page 80: ...hed memory access operations may be caused by Load Store instruction CACHE instruction PREF instruction etc to complete before the execution of SYNC In other words SYNC instruction eliminates potential data coherency hazard in the memory hierarchy in a core XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor Co Ltd All rights reserved 78 ...

Page 81: ...1MB Cache Line Size 64 byte Sets way associativity 256 8 128 16 128KB 512 8 256 16 256KB 1024 8 512 16 512KB 2048 8 1024 16 1MB Lookup policy physically indexed Physically tagged Replace policy round robin Lock N A Others smart HW prefetcher provides powerful streaming performance XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor Co Ltd All rights reserved 79 ...

Page 82: ...he Initialization Both D cache and I cache L1 cache are all initialized by HW automatically after reset power on reset watchdog reset or soft reset for core However L2 cache is initialized by HW automatically after reset power on reset watchdog reset 7 2 Initialized Core State by Software 7 2 1 General Purpose Registers Initialization All 31 integer general purpose registers need be initialized by...

Page 83: ... region they can be accessed by load store instructions in kernel mode CCU implements follwoing functions Record the sleep state of a core Control software reset of a core Mailbox IRQ supporting IPI mechanism Flexible IRQ mask bits masking IRQ Hardware spinlock mechanism for atomic access of CCU by multiple cores XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor Co Ltd...

Page 84: ...ending Register R 0x 0000 0x0180 OIMR OST IRQ Mask Register RW 0x 0001 0x01a0 DIPR Debug Interrupt Pending Register R 0x 0x01c0 DIMR Debug Interrupt Mask Register RW 0x00000001 0x01e0 LDIMR N 2 Local Debug Interrupt Mask Register RW 0x00000000 0x0300 N 32 RER Reset Entry Register RW 0xBFC0000 0x0f00 CSLR CCU Spin Lock Register RW0 0x00000000 0x0fa0 CSAR CCU Spin Atomic Register RW 0x 0x0fa4 GIMR C...

Page 85: ...13 SM12 SM11 SM10 SM9 SM8 SM7 SM6 SM5 SM4 SM3 SM2 SM1 SM0 Rst 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 Bits Name Description R W 31 N 1 Reserved Writing has no effect read as zero R N 0 SM N Sleep Mask 0 core N s sleep status can t be sent to SOC s CPM 1 1 core N s sleep status can be sent to SOC s CPM If any one of these bits is a zero SOC can t enter sleep mode even if all cores finish the execution of t...

Page 86: ...ping When executing a WAIT instruction in a core the core need complete all outstanding operations then freezes the pipeline and send a sleep status to CCU CCU captures the signal and set the corresponding SS bit to one and then turns off Core N s clock Later when an interrupt need be taken by core N CCU should clear the corresponding SS N bit and restore Core N s clock R The following picture is ...

Page 87: ...16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Reserved SRE15 SRE14 SRE13 SRE12 SRE11 SRE10 SRE9 SRE8 SRE7 SRE6 SRE5 SRE4 SRE3 SRE2 SRE1 SRE0 Rst 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 0 Bits Name Description R W 31 N 1 Reserved Writing has no effect read as zero R N 0 SRE N Software Reset 0 the core is out of soft reset state 1 the core is in soft reset state After external hardware reset software can reset cor...

Page 88: ...ifier from L2C to memory controller 0 The QoS identifier is fixed and the highest priority 1 The QoS identifier is dynamic and based on the status of L2C RW 2 DisPFB1 0 Enable the prefetcher between L1 cache and L2 cache 1 Disable the prefetcher between L1 cache and L2 cache RW 1 DisPFB2 0 Enable the prefetcher between L2 cache and DDR 1 Disable the prefetcher between L2 cache and DDR RW 0 DisL2C ...

Page 89: ...ion Rst 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 Bits Name Description R W 31 16 Reserved Writing has no effect read as zero R 15 8 ProcessorID The same meaning as the field of PRID register 0x20 7 0 Revision Specifies the revision number of the memory subsystem including CCX and L2C R XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor Co Ltd All rights reserved 87 ...

Page 90: ... TOTAL This field specifies the amount of the core in a multi processor system and can be used by software to distinguish the amount of the core The total number can be from 0 to 255 In a single processor system the value is zero In the SMT system the value means the total amount of the logic core For examples if a SMT system has 2 physical cores 4 threads the value should be 3 R XBurst 2 CPU Core...

Page 91: ...eripheral IRQ Mask Register PIMR Base 0x0120 Bit 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Reserved IM15 IM14 IM13 IM12 IM11 IM10 IM9 IM8 IM7 IM6 IM5 IM4 IM3 IM2 IM1 IM0 Rst 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Bits Name Description R W 31 N 1 Reserved Writing has no effect read as zero R N 0 IM N Peripheral IRQ of Core N mask 0 pending periperal IRQ can not ...

Page 92: ...N Hardware clears the IP N automatically when software writes zero value into the MBR N R 8 2 10 Mailbox IRQ Mask Register MIMR Base 0x0160 Bit 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Reserved IM15 IM14 IM13 IM12 IM11 IM10 IM9 IM8 IM7 IM6 IM5 IM4 IM3 IM2 IM1 IM0 Rst 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Bits Name Description R W 31 N 1 Reserved Writing has n...

Page 93: ...g R 8 2 12 OST IRQ Mask Register OIMR Base 0x01a0 Bit 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Reserved IM15 IM14 IM13 IM12 IM11 IM10 IM9 IM8 IM7 IM6 IM5 IM4 IM3 IM2 IM1 IM0 Rst 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Bits Name Description R W 31 N 1 Reserved Writing has no effect read as zero R N 0 IM N OST IRQ of Core N mask 0 pending OST IRQ can not enter it...

Page 94: ...tains mask bits used to control which of the cores should receive a EJTAG Debug Interrupt request usually from a EJTAG When DIMR IM N is set The reset value of core0 s DIMR IM0 is 1 This is used to make sure that core 0 as a default can accept Debug Interrupt Request after reset DIMR Base 0x01e0 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Reserved IM15 IM1...

Page 95: ...ntry point of the reset exception handler is The initial value is 0xbfc00000 RW 8 2 16 Mailbox Register N MBR Base 0x1000 N 4 Bit 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 MSG Rst 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Bits Name Description R W 31 0 MSG Message to Core N The nonzero value is available for use as software flags or...

Page 96: ... on CSAR value when CSLR Lock is zero and writing CSAR value by software R 8 2 18 CCU Spin Atomic Register CSAR Base 0x0fa4 Bit 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Reserved Value Rst 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Bits Name Description R W 31 Reserved Writing has no effect read as zero R 30 0 Value It s meaning is det...

Page 97: ...Rst 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 Bits Name Description R W 31 N 1 Reserved Writing has no effect read as zero R N 0 IM N Global interrupt of core N mask 0 Any IRQ can not enter its corresponding core 1 Whether an IRQ can enter its corresponding core or not is determined by its local mask register eg PIMR MIMR OIMR RW XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor...

Page 98: ...0 Eanble instruction Fusion optimization 1 Disable instruction Fusion optimization RW 5 DisMissGate 0 Enable IU low power gate when there is a DCache Miss 1 Disable IU low power gate when there is a DCache Miss RW 4 DisLoopGate 0 Enable IFU low power gate when enter into simple loop 1 Disable IFU low power gate when enter into simple loop RW 3 DisSimpleLoop 0 Enable IFU Simple Loop 1 Disable IFU S...

Page 99: ...lue of the counter comes from BusCnt After the BIU receives an active BusExp signal the bus deadlock will be released forcibly Therefore Active BusExp signal means the external bus is not usable any longer RW0 30 CntEn 0 Disable bus timeout counter 1 Enable bus timeout counter RW 29 20 Reserved Writing has no effect read as zero R 19 0 BusCnt When the CntEn being 1 and external bus being busy an i...

Page 100: ... cslr 0 cslr clsr_mask current_processor_id break 2 unlock CCU current_processor_id smp_processor_id cslr_mask 0x7fffffff cslr ccu_read CSLR if cslr 0 cslr clsr_mask crrent_processor_id ccu_write CSLR 0 The function smp_processor_id can return the current core number by read CP0 EBase CPUNum Cp0 Register 15 Select1 The function ccu_read can load a value from the specified CCU register The function...

Page 101: ...mostly by probe developers and can only be accessed via a probe DCR Debug Control Register This register is located in the drseg memory segment and can only be accessed in Debug mode DINT Debug Interrupt an interrupt which causes a debug exception and entry into debug mode DRSEG Debug Register Segment A memory overlay present only while executing in debug mode that allows access to registers contr...

Page 102: ...Execution of a Debug Exception Return DERET instruction 2 Reset the core 3 Power cycle the core During normal operation exceptions are taken by the core and processed Once the exception processing is complete software executes an Exception Return ERET instruction When in debug mode software executes a Debug Exception Return DERET instruction This causes the core to exit debug mode and return to pr...

Page 103: ...e registers for each data breakpoint including masking or qualification on the transaction properties When a data breakpoint matches a trigger is generated and a debug exception is optionally signaled An internal bit in the data breakpoint registers is set to indicate that the match occurred 9 5 3 Overview of Instruction Breakpoint Registers Up to two instruction breakpoints are available and are ...

Page 104: ...C which can be masked at the bit level The match can also include an optional compare of the ASID value The registers for each instruction breakpoint contain the values and mask used in the compare and the equation that determines the match is shown below in C like notation IB_match IBCnASIDuse ASID IBASIDnASID all 1 s IBMnIBM PC IBAnIBA IBMnISAM ISAMode IBAnISA The match indication for instructio...

Page 105: ... value from the data bus DATA is compared and masked with the registers for the data breakpoint The endianess is not considered in these match equations for value as the compare uses the data bus value directly thus debug software is responsible for setup of the breakpoint corresponding with endianess DB_value_match DATA 7 0 DBVnDBV 7 0 BYTELANE 0 DBCnBLM 0 DBCnBAI 0 DATA 15 8 DBVnDBV 15 8 BYTELAN...

Page 106: ...used the DB_match equation to be true The instruction causing the Debug Data Break Exception does not update any registers due to the instruction and the following applies to the load or store transaction causing the debug exception A store transaction is not allowed to complete the store to the memory system A load transaction is not allowed to complete the load The result of this is that the loa...

Page 107: ...e TAP controller state The core signal for this is called EJ_TDI TDO O Test Data Output Serial output data is shifted from the Instruction or data registers to the TDO pin on the falling edge of the TCK clock When no data is shifted out the TDO is 3 stated The core signal for this is called EJ_TDO TRST_N I Test Reset Input Optional pin The TRST_N pin is an active low signal for asynchronous reset ...

Page 108: ...ansition the TAP through the appropriate states shown in figure below The states of the data and instruction register scan blocks are mirror images of each other adding symmetry to the protocol sequences The first action that occurs when either block is entered is a capture operation For the data registers the Capture DR state is used to capture or parallel load the data into the selected serial d...

Page 109: ... in this state When TMS is sampled HIGH on the rising edge of TCK the controller transitions to the Select_DR state 9 8 2 3 Select_DR_Scan State This is a temporary controller state in which all test data registers selected by the current instruction retain their previous state If TMS is sampled LOW at the rising edge of TCK then the controller transitions to the Capture_DR state A HIGH on TMS cau...

Page 110: ... selected by the current instruction retain their previous state If TMS is sampled LOW at the rising edge of TCK the controller transitions to the Shift_DR state to allow another serial shift of data A HIGH on TMS causes the controller to transition to the Update_DR state which terminates the scanning process The instruction cannot change while the TAP controller is in this state 9 8 2 10 Update_D...

Page 111: ...the instruction register retains its previous state If TMS is sampled LOW at the rising edge of TCK then the controller transitions to the Shift_IR state to allow another serial shift of data A HIGH on TMS causes the controller to transition to the Update_IR state which terminates the scanning process The instruction cannot change while the TAP controller is in this state 9 8 2 16 Update_IR State ...

Page 112: ...ediately available via a TAP data scan operation after power up when the TAP has been reset with on chip power on or through the optional TRST_N pin 9 8 3 3 IMPCODE Instruction This instruction selects the Implementation register for output which is always 32 bits 9 8 3 4 ADDRESS Instruction This instruction is used to select the Address register to be connected between TDI and TDO The EJTAG Probe...

Page 113: ...indication will be cleared When NORMALBOOT is active EJTAGBOOT is not active a core reset will set the ProbTrap ProbEn and EjtagBrk bits in the EJTAG Control register to 0 The Bypass register is selected when the NORMALBOOT instruction is given 9 8 4 TAP Processor Accesses The TAP modules support handling of fetches loads and stores from the CPU through the dmseg segment whereby the TAP module can...

Page 114: ...h the target address in the appropriate range Almost the same protocol is used to execute a store instruction to the EJTAG Probe s memory through dmseg The store address must be in the range 0xFF20 0000 to 0xFF2F FFFF the ProbEn bit must be set and the processor has to be in debug mode DM 1 The sequence of actions is found below 1 The internal hardware latches the requested address into the Addres...

Page 115: ...upt enables that enable specific mechanisms The NMI interrupt is not implemented Hardware and software interrupts are always disabled in Debug Mode Pending interrupts are indicated in the Cause register The ProbEn bit reflects the state of the ProbEn bit from the EJTAG Control register ECR Through this bit the probe can indicate to the debug software running on the CPU if it expects to service dms...

Page 116: ...sable mechanisms 0 Interrupt disabled 1 Interrupt enabled depending on other enabling mechanisms R W 1 0 3 1 Must be written as zero returns zero on read R 0 ProbEn 0 Indicates value of the ProbEn value in the DCR register 0 No access should occur to the dmseg segment 1 Probe services accesses to the dmseg segment R Same value as ProbEn in ECR 9 9 2 Instruction Breakpoint Registers The registers f...

Page 117: ...are IBASIDn register implemented ASID support indication does not guarantee a TLB type MMU because the same breakpoint implementation can be used with processors having all different types of MMUs R 1 0 29 28 Must be written as zero returns zero on read BCN 27 24 Number of instruction breakpoints implemented 0 Reserved 1 15 Number of instructions breakpoints R 2 BS 1 0 Break Status BS bit for brea...

Page 118: ...r the address compare used in the condition for instruction breakpoint n Figure 9 6 IBMn Register Format 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 IBM Table 9 9 IBMn Register Field Description Name Bits Description R W Reset IBM 31 0 Instruction breakpoint address mask for condition 0 Corresponding address bit compared 1 Corresponding address bit masked ...

Page 119: ...e ASID value in compare for instruction breakpoint n 0 do note use ASID value in compare 1 Use ASID value in compare R W 0 TE 2 Use instruction breakpoint n as triggerpoint 0 do not use it as triggerpoint 1 use it as triggerpoint R W 0 BE 0 Use instruction breakpoint n as breakpoint 0 do not use it as breakpoint 1 use it as breakpoint R W 0 0 31 24 22 3 1 Must be written as zero returns zero on re...

Page 120: ... 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 0 ASIDsup NoSVmatch NoLVmatch BCN 0 BS Table 9 13 DBS Register Field Description Name Bits Description R W Reset ASIDsup 30 Indicates if ASID compare is supported in instruction breakpoints 0 No ASID compare 1 ASID compare IBASIDn register implemented ASID support indication does not guarantee a TLB type MMU because the ...

Page 121: ...ster The Data Breakpoint Address n DBAn register has the address used in the condition for data breakpoint n Figure 9 10 DBAn Register Format 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DBA Table 9 14 DBAn Register Field Description Name Bits Description R W Reset DBA 31 0 Data breakpoint virtual address for condition R W Undefined 9 9 3 3 Data Breakpoint ...

Page 122: ... R W Reset ASID 7 0 Data Breakpoint ASID value for compare R W Undefined 0 31 8 0 R 0 9 9 3 5 Data Breakpoint Control n DBCn Register The Data Breakpoint Control n DBCn register controls the setup of data breakpoint n In the P5600 core this register is 64 bits and is accessed as two consecutive 32 bit registers Figure 9 13 DBCn Register Format 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 ...

Page 123: ...access R W 0 BLM 7 4 Byte lane mask for value compare on data breakpoint BLM 0 masks byte at bits 7 0 of the data bus BLM 1 masks byte at bits 15 8 etc 0 Compare corresponding byte lane 1 Mask corresponding byte lane Debug software must adjust for endianess when programming this field R W 0 TE 2 Use data breakpoint n as triggerpoint 0 do not use it as triggerpoint 1 use it as triggerpoint R W 0 BE...

Page 124: ...truction register scan operation the TAP controller selects the output of the Instruction register to drive the TDO pin The shift register consists of a series of bits arranged to form a single scan path between TDI and TDO During an Instruction register scan operations the TAP controls the register to capture status information and shift data from TDI to TDO Both the capture and shift operations ...

Page 125: ... of all ones to satisfy the IEEE 1149 1 Bypass instruction requirement 9 9 4 4 Device Identification ID Register The Device Identification register is defined by IEEE 1149 1 to identify the device s manufacturer part number revision and other device specific information Table below shows the bit assignments defined for the read only Device Identification Register and inputs to the core determine t...

Page 126: ...ersion Figure 9 17 Implementation Register Format 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 EJTAGver R4k R3k 0 DINTsup 0 ASIDsize 0 MIPS16e 0 NoDMA 0 MIPS32 64 Table 9 21 Implementation Register Field Description Name Bits Description R W Reset EJTAGve r 31 29 Indicates the EJTAG version 0 Version 1 and 2 0 1 Version 2 5 2 Version 2 6 3 Version 3 1 4 Ver...

Page 127: ... 0 or written to 0 This is in order to ensure proper handling of processor accesses The value used for reset indicated in the table below takes effect on CPU resets but not on TAP controller resets e g TRST_N TCK clock is not required when the CPU reset occurs but the bits are still updated to the reset value when the TCK is supplied The first 5 TCK clocks after CPU reset may result in reset of th...

Page 128: ...ers Reserved Note LE little endian BE big endian the byte refers to the byte number in a 32 bit register where byte 3 bits 31 24 byte 2 bits 23 16 byte 1 bits 15 8 byte 0 bits 7 0 independently of the endianess R Undefined Doze 22 Doze state The Doze bit indicates any type of low power mode The value is sampled in the Capture DR state of the TAP controller 0 CPU not in low power mode 1 CPU is in l...

Page 129: ...hat this setting has taken effect in the system when the read value of this bit is also 1 This is to ensure that the setting from the TCK clock domain gets effect in the CPU clock domain and in peripherals When the bit is written to 0 then the bit must also be read as 0 before it is guaranteed that the indication is cleared in the CPU clock domain also This bit controls the EJ_PrRst signal If the ...

Page 130: ...setting of the ProbEn bit see comment under ProbEn bit The ProbTrap should not be set to 1 unless the ProbEn bit is also set to 1 to indicate that the EJTAG memory may be accessed The read value indicates the effective value to the CPU due to synchronization issues between TCK and CPU clock domains however it is ensured that change of the ProbTrap bit prior to setting the EjtagBrk bit will have ef...

Page 131: ...t Address 31 0 Address used by processor access R Undefined 9 9 4 8 Processor Access Data Register The Data register is used to provide data value to and from a processor access The length of the Data register is 32 bits and this register is selected by shifting in the DATA instruction The register has the written value for a processor access write due to a CPU store to the dmseg and the output fr...

Page 132: ...in order of priority from highest to lowest The table also categorizes each exception with respect to type debug or non debug Each debug exception has an associated status bit in the Debug register indicated in the table in parentheses Though in the following table Debug Data Break on Load Address and Data Value have a lower priority than Watch on Data Access the Debug Data Break on Load with Data...

Page 133: ...ion can be restarted and the DBD bit is set to indicate whether the last debug exception occurred in a branch delay slot The value loaded into the DEPC register is either the current PC if the instruction is not in the delay slot of a branch or the PC of the branch or jump if the instruction is in the delay slot of a branch or jump The DSS DBp DDBL DDBS DIB and DINT bits in the Debug register are ...

Page 134: ...ister enables Debug Single Step exceptions They are disabled on the first execution step after a DERET The DEPC register points to the instruction on which the Debug Single Step exception occurred which is also the next instruction to execute when returning from Debug Mode The debug software can examine the system state before this instruction is executed Thus the DEPC will not point to the instru...

Page 135: ...ue to a low power mode The sources for debug interrupts are only from EJTAG TAP Debug Register Debug Status Bit Set DINT Additional State Saved None Entry Vector Used Debug exception vector 9 10 6 Debug Instruction Break Exception A Debug Instruction Break exception occurs when an instruction hardware breakpoint matches an executed instruction The DEPC register and DBD bit in the Debug register in...

Page 136: ...are updated All other CP0 registers are unchanged by an exception taken in Debug Mode The exception vector is equal to the debug exception vector and the processor stays in Debug Mode Reset and soft reset are handled as when occurring in Non Debug Mode 9 11 1 Exceptions Taken in Debug Mode Only some Non Debug Mode exception events cause exceptions in Debug Mode Remaining events are blocked Excepti...

Page 137: ...rocessing flow The DEPC register is loaded with the PC at which execution can be restarted and the DBD bit is set to indicate whether the last debug exception occurred in a branch delay slot The value loaded into the DEPC register is either the current PC if the instruction is not in the delay slot of a branch or the PC of the branch or jump if the instruction is in the delay slot of a branch or j...

Page 138: ...G compliant mode and Accelerated Mode ACC Mode For more details of MIPS EJTAG compliant mode please refer to MIPS EJTAG Specification 9 13 Accelerated EJTAG Mode This section describes the behavior and organization of Accelerated EJTAG Mode ACC Mode ACC Mode is designed to accelerate the data access from probe in debug mode Debugger can use EJTAG instruction EJTAGBOOTA to enter into ACC mode and e...

Page 139: ...1 write access 1 PRW 0 R Processor Access PA 0 No pending processor access 1 Pending processor access 0 PA Reset value Read write Description BITS Field PA PRW 0 1 XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semiconductor Co Ltd All rights reserved 137 ...

Page 140: ...ST 36 35 Processor Access burst pattern 00 single 01 4 beat wrapping burst 10 8 beat wrapping burst 11 8 beat incrementing burst Note 4 beat wrapping burst will never occur in this implementation And 8 beat incrementing burst may occur only for burst read access R Undefined 0 31 PAA 33 32 SZ 34 R BST 35 36 Undefined W Pipeline lock label 1 processor can proceed due to processor access to dmseg don...

Page 141: ...000 Extended Dseg space in ACC mode 0 0xFF00_0000 0xFF1F_FFFF 0xFF00_0000 0xFF1F_FFFF extended Dmseg 2M Dseg 2 0xFF20_0000 0xFF2F_FFFF 0xFF20_0000 0xFF2F_FFFF Dmseg 1M 0 0xFF40_0000 0xFFFF_FFFF 0xFF40_0000 0xFFFF_FFFF extended Dmseg 12M 2 0xFF30_0000 0xFF3F_FFFF 0xFF30_0000 0xFF3F_FFFF Drseg 1M Cache attribute Physical address Virtual address Sub segment Segment Dseg Drseg Dmseg Address Space and ...

Page 142: ...S DATA and ECR register The scan sequence is TDI ADDRESS DATA ECR TDO In ACC mode Selects the DATA_A ADDRESS_A and ECR_A register The scan sequence is TDI DATA_A ADDRESS_A ECR_A TDO 0x0C EJTAGBOOT Boot from probe host in MIPS mode by setting ECREjtagbrk ECRProbEn and ECRProbTrap when reset Bypass register is selected 0x0D NORMALBOOT Boot in normal way by clearing Ejtagbrk ProbEn and ProbTrap when ...

Page 143: ... 2016 Add more hardware spin lock Change CSCR into CCCR 00 03 June 2 2017 Update about debug description Update CCU s spin clock and spin atomic register 00 04 Auguest 30 2018 Revised MMU and Cache Part of CCU 00 10 April 20 2020 Remove sophisticated but efficentless EJTAG debug mechanism for SMP system Some syntax error fixed XBurst 2 CPU Core Programming Manual Copyright 2005 2020 Ingenic Semico...