(R) MiniRISC EZ4021-FC EasyMACROTM Microprocessor Technical Manual February 2001 (R) Order No. R14018.A This document contains proprietary information of LSI Logic Corporation. The information contained herein is not to be used by or disclosed to third parties without the express written permission of an officer of LSI Logic Corporation. Document DB15-000163-01, Second Edition (February 2001) This document describes LSI Logic Corporation's MiniRISC EZ4021-FC Microprocessor and will remain the official reference source for all revisions/releases of this product until rescinded by an update. LSI Logic Corporation reserves the right to make changes to any products herein at any time without notice. LSI Logic does not assume any responsibility or liability arising out of the application or use of any product described herein, except as expressly agreed to in writing by LSI Logic; nor does the purchase or use of a product from LSI Logic convey a license under any patent rights, copyrights, trademark rights, or any other of the intellectual property rights of LSI Logic or third parties. Copyright (c) 1998-2001 by LSI Logic Corporation. All rights reserved. TRADEMARK ACKNOWLEDGMENT The LSI Logic logo design, CoreWare, EasyMACRO, G12, MiniRISC, and Right-First-Time are registered trademarks or trademarks of LSI Logic Corporation. All other brand and product names may be trademarks of their respective companies. ii Preface This book is the primary reference and technical manual for the EZ4021-FC Subsystem. Audience This document assumes that you have some familiarity with microprocessors and related support devices. The people who benefit from this book are: * Engineers and managers who are evaluating the microprocessor for possible use in a system * Engineers who are designing the microprocessor into a system Organization This document has the following chapters: * Chapter 1, Introduction, introduces the EZ4021-FC subsystem and describes its key features. * Chapter 2, Functional Description, describes the function of the major blocks within the EZ4021-FC subsystem. * Chapter 3, Programmer's Model, describes the memory model and operating modes of the EZ4021-FC subsystem, and discusses the EZ4021-FC register set. * Chapter 4, Instruction Set Architecture, describes the formats and operation of the EZ4021-FC MIPS instruction set. * Chapter 5, Signal Descriptions, discusses the function of each EZ4021-FC interface signal. Preface iii * Chapter 6, Interface Operation, provides waveforms to illustrate various operations of the EZ4021-FC subsystem, including QuickBus and reset. * Chapter 7, Error and Exception Handling, describes the events that cause EZ4021-FC exceptions. * Chapter 8, Memory Test, describes the cache test capabilities provided for the instruction cache, data cache, and TLB. * Chapter 9, Specifications, lists the AC and electrical parameters for the EZ4021-FC subsystem. Related Publications MiniRISC(R) EZ4021-FC EasyMACRO Microprocessor Preliminary Datasheet, Document No. DB08-000138-00 MIPS RISC Architecture by Gerry Kane and Joe Heinrich, Prentice-Hall Conventions Used in This Manual The first time a word or phrase is defined in this manual, it is italicized. The word assert means to drive a signal true or active. The word deassert means to drive a signal false or inactive. Hexadecimal numbers are indicated by the prefix "0x"--for example, 0x32CF. Binary numbers are indicated by the prefix "0b"--for example, 0b0011.0010.1100.1111. iv Preface Contents Chapter 1 Chapter 2 Introduction 1.1 Overview 1.2 Features 1.3 Application Examples 1.4 CoreWare Program Functional Description 2.1 EZ4021-FC CPU 2.1.1 CPU Data Path Control (CDC) Module 2.1.2 Integer Data Path (IDP) Module 2.1.3 System Coprocessor 0 (CP0) 2.1.4 Pipeline Architecture 2.2 Memory Management Unit 2.3 Cache Memory 2.3.1 Instruction Cache 2.3.2 Data Cache 2.3.3 Cache Maintenance Operations 2.4 Multiply/Divide Unit (MDU) 2.4.1 Standard Instructions 2.4.2 Extended Instructions 2.4.3 Performance 2.4.4 Pipeline Interlocks 2.5 Quick Bus Interface 2.6 Bus Interface Unit (BIU) 2.6.1 BIU Features 2.6.2 Instruction Cache Refill Summary 2.6.3 Data Cache Refill Summary 2.6.4 Quick Bus Access Priority 2.6.5 Programmable BIU Features Contents 1-1 1-3 1-5 1-5 2-2 2-3 2-3 2-3 2-3 2-4 2-5 2-5 2-7 2-11 2-12 2-12 2-12 2-12 2-13 2-13 2-14 2-15 2-17 2-17 2-17 2-18 v 2.7 2.8 Chapter 3 Chapter 4 vi EJTAG Interface Clocks 2.8.1 System Clock 2.8.2 EJTAG and Scan Clocks 2.8.3 Require External Synchronization to System Clock 2-18 2-23 2-23 2-24 2-24 Programmer's Model 3.1 Memory Management 3.1.1 Operating Modes 3.1.2 Virtual Memory and the TLB 3.1.3 Memory and TLB-Support Registers 3.1.4 Virtual Address Translation 3.2 Exception Processing 3.2.1 Exception Vector Locations 3.2.2 CP0 Exception Processing Registers 3.3 EJTAG Debugging 3.3.1 EJTAG Debug Registers 3.3.2 EJTAG Serial-Access Registers 3.3.3 EJTAG CP0 Registers 3.3.4 EJTAG Memory Mapped Registers 3.4 System Configuration Register 1 3-1 3-1 3-7 3-9 3-20 3-22 3-23 3-23 3-34 3-35 3-35 3-49 3-57 3-74 Instruction Set Architecture 4.1 Instruction Set Formats 4.2 Load and Store Instructions 4.2.1 Scheduling a Load Delay Slot 4.2.2 Defining Access Types 4.2.3 CPU Loads and Stores 4.2.4 Atomic Update Loads and Stores 4.2.5 Coprocessor Loads and Stores 4.3 Computational Instructions 4.3.1 ALU 4.3.2 Three-Operand, Register Type 4.3.3 Shift 4.3.4 Multiply and Divide 4.4 Jump and Branch Instructions 4-1 4-2 4-2 4-3 4-5 4-9 4-9 4-10 4-11 4-13 4-14 4-16 4-19 Contents 4.5 4.6 4.7 4.8 4.9 4.10 Chapter 5 Chapter 6 Exception Instructions Serialization Instruction Coprocessor Instructions 4.7.1 Coprocessor Data Movement and Conditional Branch Instructions 4.7.2 System Control Coprocessor (CP0) Instructions Cache Maintenance Instruction EZ4021-FC Instruction Extensions 4.9.1 General 32-Bit Instruction Extensions 4.9.2 CP0 Instruction Extensions CPU 32-Bit Instruction Opcode Encoding 4-22 4-24 4-24 4-24 4-26 4-27 4-32 4-32 4-33 4-42 Signal Descriptions 5.1 Quick Bus Interface 5.2 Interrupt, Clock, and Reset Signals 5.3 EJTAG and PC Trace Signals 5.3.1 EJTAG Standard Signals 5.3.2 EJTAG Standard Support Signals 5.3.3 Nonmultiplexed EJTAG Signals 5.3.4 EJTAG External Module Signals 5.3.5 EJTAG Configuration Signals 5.4 Global Test Mode Signals 5.5 BIST Signals 5.6 Miscellaneous Signals 5-1 5-5 5-7 5-7 5-10 5-10 5-11 5-11 5-13 5-14 5-15 Interface Operation 6.1 Quick Bus Transactions 6.1.1 Basic Transactions 6.1.2 Advanced Transactions 6.2 Reset Behavior 6.2.1 Reset 6.2.2 Soft Reset 6.2.3 Modules Affected by Reset 6.3 Interrupt Behavior 6.3.1 Nonmaskable Interrupt 6.3.2 Maskable Interrupts 6.4 Wait States 6-1 6-1 6-7 6-14 6-14 6-15 6-15 6-17 6-17 6-18 6-19 Contents vii Chapter 7 viii Error 7.1 7.2 7.3 7.4 7.5 7.6 7.7 7.8 7.9 and Exception Handling Overview Exception Handling Registers Standard Exception Operation Standard Exception Processing Actions Debug Exception Operation Debug Exception Processing Precision of Exceptions Exception Vector Locations Priority of Exceptions 7.9.1 Overriding Priority (Stage Independent) 7.9.2 W Stage Exceptions 7.9.3 M Stage Exceptions 7.9.4 X Stage Exceptions 7.9.5 R Stage Exceptions 7.10 Exception Descriptions 7.10.1 Reset Exception 7.10.2 Soft Reset Exception 7.10.3 Data Address Break Exception 7.10.4 Bus Error Exception 7.10.5 Floating-Point Exception 7.10.6 TLB Refill Exception 7.10.7 TLB Invalid Exception 7.10.8 TLB Modified Exception 7.10.9 EJTAG Break Exception 7.10.10 Integer Overflow Exception 7.10.11 Trap Exception 7.10.12 Address Error Exception 7.10.13 Interrupt Exception 7.10.14 Software Debug Breakpoint Exception 7.10.15 Coprocessor Unusable Exception 7.10.16 System Call Exception 7.10.17 Breakpoint Exception 7.10.18 Reserved Instruction Exception 7.10.19 Debug Single Step Exception 7.10.20 Instruction Address Break Exception 7.11 Loss of PC Trace Information 7.12 Spurious Debug Mode Indications Contents 7-1 7-5 7-6 7-7 7-8 7-9 7-9 7-10 7-11 7-11 7-12 7-12 7-12 7-12 7-12 7-13 7-14 7-16 7-17 7-18 7-19 7-21 7-22 7-23 7-24 7-25 7-26 7-27 7-28 7-29 7-30 7-31 7-32 7-33 7-35 7-36 7-37 Chapter 8 Chapter 9 Memory Test 8.1 I-Cache BIST 8.2 D-Cache Test 8.2.1 D-Cache Tag/LRU RAMs 8.2.2 D-Cache Data RAMs 8.3 Register File Test 8.4 Translation Lookaside Buffer (TLB) Test 8-1 8-3 8-3 8-3 8-4 8-4 Specifications 9.1 Physical Specifications 9.2 AC Timing and Loading 9-1 9-2 Customer Feedback Figures 1.1 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 2.11 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 EZ4021-FC EasyMACRO Microprocessor Block Diagram EZ4021-FC EasyMACRO Microprocessor Block Diagram EZ4021-FC Instruction Pipeline I-Cache Line State Diagram Address to I-Cache Tag and Line Number Write Back Line State Transition Diagram Write Through Line State Transition Diagram Address to D-Cache Tag and Line Number BIU I/O Block Diagram TAP Controller On-Chip SCLKP Generation EZ4021-FC Clock Distribution User Mode Memory Map Supervisor Mode Memory Map Kernel Mode Memory Map EZ4021-FC Virtual Address Format EZ4021-FC TLB Entry Format Index Register (0) Random Register (1) EntryLo0/1 Register Contents 1-2 2-2 2-3 2-6 2-7 2-8 2-9 2-10 2-15 2-20 2-23 2-25 3-3 3-4 3-5 3-7 3-8 3-10 3-11 3-12 ix 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 3.17 3.18 3.19 3.20 3.21 3.22 3.23 3.24 3.25 3.26 3.27 3.28 3.29 3.30 3.31 3.32 3.33 3.34 3.35 3.36 3.37 3.38 3.39 3.40 3.41 3.42 3.43 3.44 3.45 3.46 x PageMask Register (5) Wired Register Location Wired Register EntryHi Register (10) PRId Register (15) Config Register (16) TagLo Register EZ4021-FC TLB Address Translation Process Context Register (4) BadVAddr Register (8) Count Register (9) Compare Register (11) Status Register (12) Cause Register (13) EPC Register (14) ErrorEPC Register (30) EJTAG Instruction Register (EIR) EJTAG Bypass Register (EBR) EJTAG Device Identification Register (EDIR) EJTAG Implementation Register (EIMR) EJTAG Address Register (EAR) EJTAG Data Register (EDR) EJTAG Control Register (ECR) Byte Lane Significance and Dsz Definition Debug Register (23) (Debug) Debug Exception Program Counter (DEPC) Register (24) Debug Exception Save (DESAVE) Register (31) Debug Control Register (DCR) Instruction Address Break Status (IBS) Register Instruction Address Break n Register (IBAn) Instruction Address Break Control n Register (IBCn) Instruction Address Break Mask n Registers (IBMn) Data Address Break Status Register (DBS) Data Break Address n Registers (DBAn) Data Break Control n Registers (DBCn) Data Address Break Mask n Registers (DBMn) Data Value Break n Registers (DVBn) System Configuration Register 1 Contents 3-13 3-14 3-14 3-15 3-16 3-17 3-20 3-21 3-25 3-26 3-26 3-27 3-27 3-30 3-33 3-34 3-36 3-38 3-38 3-39 3-41 3-42 3-43 3-47 3-50 3-55 3-56 3-60 3-62 3-64 3-65 3-66 3-68 3-69 3-70 3-73 3-74 3-74 4.1 4.2 4.3 6.1 6.2 6.3 6.4 6.5 6.6 6.7 6.8 6.9 6.10 6.11 6.12 6.13 7.1 7.2 7.3 7.4 8.1 9.1 Instruction Format Byte Specifications for Loads/Store Index Effective Address Format Four-Doubleword Instruction Request Instruction Burst Data Return Single Doubleword Instruction Request and Return Store Data Write Store Burst Quick Bus Slave Ready Operation Burst Request of a Nonburstable Device Multiple Requests Reset Pipeline Behavior NMI Pipeline Behavior (Detected Immediately) NMI Pipeline Behavior (Detection Delayed due to Stall) Interrupt Pipeline Behavior (Detected Immediately) WAITI Pipeline Stall Reset Exception Soft Reset and NMI Exceptions Common Exceptions Debug Exceptions I-Cache with BIST Block Diagram AC Specifications 4-2 4-4 4-28 6-2 6-3 6-4 6-6 6-7 6-9 6-10 6-12 6-14 6-17 6-18 6-19 6-20 7-7 7-7 7-8 7-9 8-2 9-2 2.1 2.2 2.3 2.4 2.5 3.1 3.2 3.3 4.1 4.2 4.3 4.4 4.5 Write Back D-Cache Data Coherency Write Through D-Cache Data Coherency Cache Maintenance Operations Execution Time of Multiply and Divide Instructions Programmable Features Exception Addresses EJTAG Interface Instructions Memory-Mapped Registers Normal CPU Load/Store Instructions Unaligned CPU Load/Store Instructions Atomic Update CPU Load/Store Instructions Coprocessor Load/Store Instructions ALU Instructions with an Immediate Operand 2-9 2-10 2-11 2-13 2-18 3-23 3-37 3-58 4-6 4-8 4-9 4-10 4-12 Tables Contents xi 4.6 4.7 4.8 4.9 4.10 4.11 4.12 4.13 4.14 4.15 4.16 4.17 4.18 4.19 4.20 4.21 4.22 4.23 4.24 4.25 4.26 4.27 4.28 6.1 7.1 7.2 7.3 7.4 7.5 7.6 9.1 9.2 9.3 9.4 9.5 9.6 xii Three-Operand, Register Type Instructions Shift Instructions Multiply and Divide Instructions Execution Time of Multiply and Divide Instructions Jump Instructions PC-Relative Conditional Branch Instructions PC-Relative Conditional Branch Likely Instructions Breakpoint and System Call Instructions Trap-on-Condition Instructions Serialization Instruction Coprocessor Data Movement and Conditional Branch Instructions CP0 Instructions Cache Maintenance Instruction Cache Operation Code Definitions General Instruction Extensions CP0 Instruction Extensions MIPS III Major Opcode Bit Encoding COPz rs Opcode Bit Encoding COPz rt Opcode Bit Encoding REGIMM Opcode rt Bit Encoding SPECIAL Opcode Bit Encoding SPECIAL 2 Opcode Bit Encoding CP0 Opcode Bit Encoding Reset Sensitivity EZ4021-FC Standard Exception Summary CP0 Exception Processing Registers Current Processor Mode Standard Exception Vector Base Addresses Debug Exception Vector Base Addresses Exception Vector Offset Addresses EZ4021-FC Physical Layout Size EZ4021-FC AC Timing Conditions EZ4021-FC Core Timing Conditions for G12 EZ4021-FC Core Maximum Clock Frequency for AC Timing EZ4021-FC Core Input AC Timing (ns) and Loading EZ4021-FC Core Output AC Timing (ns) and Loading Contents 4-13 4-15 4-17 4-18 4-20 4-20 4-21 4-22 4-23 4-24 4-25 4-26 4-27 4-29 4-32 4-33 4-42 4-43 4-43 4-43 4-44 4-44 4-45 6-16 7-3 7-5 7-7 7-10 7-11 7-11 9-1 9-2 9-3 9-3 9-4 9-6 Chapter 1 Introduction This chapter introduces the MiniRISC(R) EZ4021-FC EasyMACROTM Microprocessor. This chapter contains the following sections: * Section 1.1, "Overview" * Section 1.2, "Features" * Section 1.3, "Application Examples" * Section 1.4, "CoreWare Program" 1.1 Overview The MiniRISC EZ4021-FC EasyMACRO microprocessor is a compact, high-performance, 64-bit microprocessor subsystem implemented in G12TM CMOS technology. The EZ4021-FC uses LSI Logic CoreWare(R) system-on-a-chip methodology and executes the MIPS III instruction set. It is ideal for high-performance, cost-sensitive, embedded processor applications. As shown in Figure 1.1, the EZ4021-FC includes the following components: * CPU includes a system coprocessor, an integer data path with multiply divide unit, and a CPU data path controller * Instruction and data caches * Memory Management Unit (MMU) * Bus Interface Unit (BIU) * Quick Bus interface * EJTAG Interface module MiniRISC EZ4021-FC EasyMACRO Microprocessor 1-1 Figure 1.1 EZ4021-FC EasyMACRO Microprocessor Block Diagram Coprocessor 0 (CP0) Integer Data Path (IDP) CPU Data Path Control (CDC) CPU Memory Management Unit (MMU) EZ4021-FC EasyMACRO Instruction Cache EJTAG Interface JTAG Instruction Cache Controller Data Cache Controller Bus Interface Unit (BIU) Quick Bus Optional Modules Data Cache Caches The EZ4021-FC CPU is a high-performance, RISC microprocessor that is a successor to the LSI Logic CW4011 superscalar microprocessor core. The EZ4021-FC CPU has a single-issue, five-stage pipeline. Operating at 250 MHz, the EZ4021-FC provides more than twice the performance of a CW4011, which operates at 92 MHz. The I-Cache and D-Cache are both organized as two-way set associative 16-Kbyte caches with fixed cache block (line) sizes of 8 words (32 bytes). The caches are virtually indexed and physically tagged. The Quick Bus is a split transaction bus that allows the overlap of memory requests (fetch/load/store) and data returns. A Quick Bus design operating at 125 MHz can achieve a peak bandwidth of 1.0 Gbytes/s. The BIU passes address/data between the CPU and the Quick Bus and arbitrates CPU-to-Quick Bus access. It provides a 64-bit, incoming data path from the Quick Bus to the CPU and a 64-bit path for outgoing data. Depending on the customer design, outgoing Quick Bus data can go to a variety of destinations outside the EZ4021-FC. The MMU performs virtual-to-physical address translation using a 32-entry joint translation lookaside buffer (TLB). The MMU supports a variety of page sizes from 4 Kbytes to 16 Mbytes. 1-2 Introduction The EZ4021-FC includes a Joint Test Action Group (JTAG) interface and supports Enhanced JTAG (EJTAG) functions. EJTAG is a debug feature of MIPS-based processors. You can use EJTAG to debug stand-alone processors as well as 32-bit or 64-bit processors that are embedded in a system like the EZ4021-FC. The EZ4021-FC complies with these industry standards: * MIPS III-compatible ISA, 32-bit width instruction code * EJTAG 1.5.3 - MIPS standard debug support 1.2 Features This section summarizes key features of the EZ4021-FC: * * High-performance RISC CPU - Single issue, five-stage pipeline - 250 native MIPS, 275 Dhrystone MIPS at 250 MHz - 250 MHz operation at WCABS (Tj = 125 C, VDD = 1.71 V, WC process) - Both big- and little-endian support for load and store operations - R4000 standard, 32-bit timer/counter - MIPS CPU standard interrupt exceptions (one NMI, one timer, five hardware, two software) Integrated multiply and divide unit - - High-performance, 8-bit/cycle multiplier 32-bit, signed/unsigned multiply in 5 CPU clock cycles 64-bit, signed/unsigned multiply in 9 CPU clock cycles Compact 1 bit/cycle divider 32-bit, signed/unsigned divide in 34 CPU clock cycles 64-bit, signed/unsigned divide in 66 CPU clock cycles * Windows CE-compatible MMU with 32 dual-entry page translations * Integrated instruction and data caches - Features Harvard architecture 1-3 - * * * 1-4 16 Kbytes, 2-way, set-associative instruction and data caches LRU algorithm for replacement Line level lock for instruction RAM and scratch-pad memory Data cache has write-through or write-back update policy, programmable on a page basis MIPS III Instruction Set Architecture - MIPS III ISA supporting 64-bit integer operations - Thirty-two 64-bit, general-purpose registers - R4000-style status register and exception processing - Wait for Interrupt (WAITI) instruction for power saving - Supports SPECIAL2 Multiply-Accumulate extensions Advanced Debug Support - MIPS EJTAG 1.5.3 - Instruction and data breakpoints - Program Counter (PC) trace - Processor single step and software debug breakpoints Technology - 2.6 mW/MHz power consumption (includes caches) - 12 mm2 core size - 1.8 V Core VDD - LSI Logic G12 CMOS technology (0.18 L-drawn, 0.15 L-effective) Introduction 1.3 Application Examples The following list contains several applications that are ideal for the EZ4021-FC microprocessor subsystem: * Laser beam and multifunction printers * Multifunction peripherals for office automation * Network controllers This list is not complete; there are many other high-performance applications that would benefit from the power and flexibility of the EZ4021-FC. 1.4 CoreWare Program The CoreWare program consists of three main elements: * A library of cores * A design development and simulation package * Expert applications support The CoreWare library contains a wide range of complex cores based on accepted and emerging industry standards from high-speed interconnect and digital video to DSP and MIPS microprocessors. LSI Logic provides a complete framework for device and system development and simulation. LSI Logic has advanced ASIC technologies that consistently produce Right-First-TimeTM silicon. LSI Logic in-house experts provide design support from system architecture definition through chip layout and test vector generation. Application Examples 1-5 1-6 Introduction Chapter 2 Functional Description This chapter describes the major functional blocks of the EZ4021-FC. It contains the following sections: * Section 2.1, "EZ4021-FC CPU" * Section 2.2, "Memory Management Unit" * Section 2.3, "Cache Memory" * Section 2.4, "Multiply/Divide Unit (MDU)" * Section 2.5, "Quick Bus Interface" * Section 2.6, "Bus Interface Unit (BIU)" * Section 2.7, "EJTAG Interface" * Section 2.8, "Clocks" Figure 2.1 is a simplified block diagram of the EZ4021-FC. MiniRISC EZ4021-FC EasyMACRO Microprocessor 2-1 Figure 2.1 EZ4021-FC EasyMACRO Microprocessor Block Diagram |-Cache Tag, I-Cache Data (16 Kbytes, 2-way) I-Cache Controller CP0 MMU Integer Data Path CPU Data Path Control EJTAG Interface D-Cache Controller D-Cache Tag, D-Cache Data (16 Kbytes, 2-way) EZ4021-FC EasyMACRO Core 2.1 EZ4021-FC CPU The EZ4021-FC CPU includes the: 2-2 * CPU Data Path Control (CDC) module * Integer Data Path (IDP) module * System Coprocessor 0 (CP0) Functional Description QuickBus BIU 2.1.1 CPU Data Path Control (CDC) Module The CDC decodes instructions and controls the data path using control signals and clock gating. 2.1.2 Integer Data Path (IDP) Module The IDP includes a 64-bit data path, a 32 x 64-bit register file, and an integrated Multiply/Divide Unit (MDU). The MDU supports: * Accumulate operations (MADD, MADDU, MSUB, and MSUBU) and 3-operand multiply (MUL). * 8 bits/cycle multiply capability and 1 bit/cycle divide capability. 2.1.3 System Coprocessor 0 (CP0) CP0 provides exception processing support to the CPU using the MIPS R4000 exception model. It also provides processor state control that includes kernel, user, and supervisor modes. In addition, CP0 has a debugging capability with support for a software debug breakpoint (SDBBP) instruction and single-step debugging. 2.1.4 Pipeline Architecture The EZ4021-FC's five-stage instruction pipeline is illustrated in Figure 2.2. Figure 2.2 EZ4021-FC Instruction Pipeline Instruction Fetch F EZ4021-FC CPU Instruction Execution R X M W 2-3 Instruction fetch occurs during the first two pipeline stages and instruction execution during the last three stages. After a stage accepts an instruction from the previous stage, it must hold the instruction for re-execution in case the pipeline stalls. The function of each pipeline stage is summarized below. Instruction Fetch (F) - The EZ4021-FC fetches the instruction during this first stage. Register Read (R) - In the R stage, the CPU reads any required operands from the Register file while decoding the instruction. Execute (X) - Computational and logical instructions execute during the X stage. The CPU resolves conditional branches during this stage, and does the address calculations for load and store instructions. Memory Access (M) - In this stage, the CPU accesses the cache for load and store instructions. Data returns to the register bypass logic at the end of the M stage. Write-Back (W) - The CPU writes results into the Register file in the W stage. 2.2 Memory Management Unit The memory management unit (MMU) performs virtual-to-physical address translation using a 32-entry joint translation lookaside buffer (TLB). The MMU supports a variety of page sizes from 4 Kbytes to 16 Mbytes. To improve performance, the EZ4021-FC also includes two 4-entry micro-TLBs that reside between the MMU and the TLB. The micro-TLBs serve a cache-like function for the larger 32-entry TLB, and provide data and instruction cache address translation for the four most recently used pages. 2-4 Functional Description 2.3 Cache Memory The EZ4021-FC has separate primary caches for instructions and data, the I-Cache and D-Cache. 2.3.1 Instruction Cache The I-Cache has these features: * Two-way, set associative 16 Kbyte cache with a fixed cache block (line) size of 8 words (32 bytes). * Virtually indexed and physically tagged. * Least Recently Used (LRU) cache line replacement algorithm. When a cacheable instruction fetch misses in the primary cache, an entire cache line is refilled from external memory starting with the missed word. * Instruction forwarding to the CPU to reduce external memory fetch latency. * Individual I-Cache line locking to prevent removal from the cache * Individual valid bit for each cache line 2.3.1.1 I-Cache Line States The I-Cache maintains state information on a line basis and supports three line states: Invalid, Valid Clean, and Locked. At initialization, set all I-Cache lines to the Invalid/Unlocked state using the CACHE Index Store Tag instruction. For a description of cache operations, see Section 4.8, "Cache Maintenance Instruction," on page 4-27. The I-Cache line state transitions from the Invalid to the Valid Clean state if either of the following conditions occurs: * A cacheable CPU instruction fetch misses in the I-Cache. Upon return of valid data from system memory, the I-Cache line is updated and set valid. This operation is referred to as a Fetch-Miss Refill. * A CACHE operation (Fill, Fetch and Lock, Store Tag with TagLo bit [7] = 1) occurs. Cache Memory 2-5 The I-Cache line state transitions from the Valid Clean to Invalid state if either of the following conditions occurs: * A CACHE operation (Invalidate, Store Tag with TagLo bit [7] = 0). * A Fetch-Miss Refill with data error. The V (valid) bit of each cache line indicates its state. V = 0 is Invalid and V = 1 is Valid Clean. Figure 2.3 shows the state transition diagram for I-Cache line states. Figure 2.3 I-Cache Line State Diagram Fetch-Miss Refill, CACHE (Fill, Store Tag) Invalid CACHE (Invalidate, Store Tag), Fetch-Miss Refill Error Fetch-Miss Refill Error Valid Clean Fetch-Hit, Fetch-Miss Refill The line locked bit can modify the behavior illustrated in Figure 2.3. When this bit is set to 1 in an I-Cache Tag entry, the corresponding I-Cache line is locked in its current state (Invalid or Valid Clean) and cannot be displaced from the I-Cache by normal cache block replacement activity. However, a CACHE Invalidate operation can clear the lock bit. Refer to Section 4.8, "Cache Maintenance Instruction," on page 4-27 for more information on how to set or clear the locked state. Note: Having the same index locked in both I-Cache sets is not recommended. However, doing so does not prevent proper operation of the EZ4021-FC. 2.3.1.2 Instruction Address and I-Cache Access The address fields shown in Figure 2.4 illustrate the relationship between an instruction address and its cache memory location. The MMU translates the I-Cache Tag ID, address bits [31:13], and compares it with the physical address bits contained within each I-Cache set Tag RAM to determine which set, if any, contains the desired fetch data. The Line Index field, bits [12:5], addresses a line in each cache memory set, and the Word Offset field, bits [4:2], addresses a word within a line. Address bits [1:0] are reserved. 2-6 Functional Description Figure 2.4 Address to I-Cache Tag and Line Number 31 13 12 I-Cache Tag ID 5 Line Index 4 2 Word Offset 1 0 R As stated previously, the cache RAMs are indexed by the virtual address and tagged using the translated physical address. Because the cache set size is 8 Kbytes and the minimum MMU page size is 4 Kbytes, address bit 12 of the virtual and physical address must be coincident for proper cache operation. 2.3.1.3 Instruction RAM Mode Individual I-Cache lines can be locked to prevent their replacement. This feature provides a convenient means for setting up portions of the I-Cache as instruction RAM. Cache blocks can be filled and locked using the CACHE Fetch and Lock command. For more information on this command, refer to Section 4.8, "Cache Maintenance Instruction," on page 4-27. 2.3.2 Data Cache The D-Cache has these features: * Two-way set associative 16 Kbyte cache with a fixed cache block (line) size of 8 words (32 bytes). * Virtually indexed and physically tagged. * Least Recently Used (LRU) cache line replacement algorithm. When a cacheable data access misses in the primary cache, an entire cache line is refilled from external memory starting with the missed doubleword. * Load data forwarding to the CPU to reduce load-miss latency. * Individual D-Cache line locking to prevent removal from the cache. * Individual valid bit for each cache line. * Both write-back and write-through update policies. The MMU controls the update policy on a page basis. D-Cache does not support store-allocate (store miss) operations. Cache Memory 2-7 2.3.2.1 D-Cache Line States (Write-Back mode) The Write-Back D-Cache implements four cache line states: Invalid, Valid Clean, Dirty Exclusive, and Locked. The valid, dirty, and locked information are maintained on a line basis. Figure 2.5 shows the line state transition diagram for Write-Back D-Cache operations. Figure 2.5 Write-Back Line State Transition Diagram Invalid Load-Miss Refill Error CACHE (Invalidate, Store Tag), Snoop Invalidate (Match) Store-Hit Dirty Exclusive Load-Miss Refill Valid Clean Load-Miss Write-Back and Refill CACHE (Hit Write-Back) Load-Hit, Store-Hit Load-Miss Refill, Load-Hit A store operation is considered a D-Cache hit when the Tag matches the physical address and the valid (V) bit is set. The physical address must be in a cached area. When a Store-Miss occurs, the state condition of the cache line is not changed, and the store data is not written into D-Cache. Instead, the store data is sent to the BIU, which passes it to the system main memory. The line locked (LL) bit can modify the behavior illustrated in Figure 2.5. When this bit is set to 1 in a D-Cache Tag entry, the corresponding D-Cache line is locked in its current state (Invalid, Valid Clean, Dirty Exclusive) and cannot be displaced from the D-Cache by normal cache block replacement activity. However, a CACHE Invalidate operation can clear the lock bit. For more information on how to set or clear the locked state, see Section 4.8, "Cache Maintenance Instruction," on page 4-27. 2-8 Functional Description Note: Table 2.1 Having the same index locked in both D-Cache sets is not recommended. However, doing so does not prevent proper operation of the EZ4021-FC. Write-Back D-Cache Data Coherency State V Bit D1 Bit Condition Invalid 0 X Cached line does not contain valid information. Valid Clean 1 0 Cached line contains valid information consistent with memory. Dirty Exclusive 1 1 Cached line contains valid information that may not be consistent with memory. 1. The Dirty bit is maintained in the LRU RAM. 2.3.2.2 D-Cache Line States (Write-Through Mode) The Write-Through D-Cache implements three cache line states: invalid, valid clean, and locked. The valid, dirty, and locked information is maintained on a line basis. Figure 2.6 shows the line state transition diagram for Write-Through D-Cache operations. Figure 2.6 Write-Through Line State Transition Diagram Load-Miss Refill Invalid CACHE (Invalidate, Store Tag), Snoop Invalidate (Match), Load-Miss Refill Error Load-Miss Refill Error Valid Clean Load-Miss Refill, Load-Hit, Store-Hit A store operation is considered a D-Cache hit when the tag matches the physical address and the valid (V) bit is set. The physical address must be in a cached area. When a Store-Miss occurs, the state condition of the cache line is not changed, and the store data is not written into D-Cache. Instead, the store data is sent to the BIU, which passes it to the system main memory. Cache Memory 2-9 The line locked (LL) bit can modify the behavior illustrated in Figure 2.6. When this bit is set to 1 in a D-Cache tag entry, the corresponding D-Cache line is locked in its current state (Invalid, Valid Clean) and cannot be displaced from the D-Cache by normal cache block replacement activity. However, a CACHE Invalidate operation can clear the lock bit. For more information on how to set or clear the locked state, refer to Section 4.8, "Cache Maintenance Instruction," on page 4-27. Note: Having the same index locked in both D-Cache sets is not recommended. However, doing so does not prevent proper operation of the EZ4021-FC. Table 2.2 Write-Through D-Cache Data Coherency State V Bit D1 Bit Condition Invalid 0 X Cached line does not contain valid information. Valid Clean 1 0 Cached line contains valid information consistent with memory. 1. The Dirty bit is maintained in the LRU RAM. 2.3.2.3 Data Address and D-Cache Access The address fields in Figure 2.7 illustrate the relationship between a data access address and a cache memory location. The MMU translates the D-Cache Tag ID, bits [31:13], and compares it with the physical address bits contained within each D-Cache set Tag RAM to determine which set, if any, contains the desired load data. The Line Index field, bits [12:5], addresses a line in each cache memory set, and the Byte Offset field, bits [4:0], addresses a byte within a line. Figure 2.7 Address to D-Cache Tag and Line Number 31 13 12 D-Cache Tag ID 2-10 Functional Description 5 Line Index 4 0 Byte Offset As stated previously, the cache RAMs are indexed by the data virtual address and tagged using the translated physical address. Because the cache set size is 8 Kbytes and the minimum page size is 4 Kbytes, address bit 12 of the virtual and physical addresses must be coincident for proper cache operation. 2.3.2.4 Scratch-Pad RAM Mode Individual D-Cache lines can be locked to prevent their replacement. This feature provides a convenient way to set up part of the D-Cache as scratch-pad RAM. Entries can be locked using the CACHE Load and Lock command or a combination of CACHE Creative Exclusive Dirty and Index Store Tag operations. For more information on these commands, refer to Section 4.8, "Cache Maintenance Instruction," on page 4-27. 2.3.3 Cache Maintenance Operations The EZ4021-FC supports several different cache maintenance operations. All maintenance operations are supported using the CACHE instruction as described in Section 4.8, "Cache Maintenance Instruction," on page 4-27. Table 2.3 highlights the maintenance operations supported for both instruction and data caches. Table 2.3 Cache Maintenance Operations Maintenance Operation CACHE Operation I-Cache Support D-Cache Support Reset Store Tag Yes Yes Invalidate Index Invalidate Yes No Write-Back Cache Memory Index Write-Back with Invalidate No Yes Hit Invalidate Yes Yes Index Write-Back with Invalidate No Yes Hit Write-Back No Yes Hit Write-Back with Invalidate No Yes 2-11 2.4 Multiply/Divide Unit (MDU) This section describes the MDU's instructions and performance. It also summarizes the types of pipeline interlocks the MDU can generate. 2.4.1 Standard Instructions The EZ4021-FC implements the standard MIPS III multiply and divide instructions, which includes instructions for both single and doubleword operands as well as signed and unsigned values. Table 4.8 (page 4-17) lists and briefly describes each one of the MIPS III multiply and divide instructions. In addition to the multiply and divide instructions, the MDU also supports the special data movement instructions: MTHI, MTLO, MFHI, and MFLO. 2.4.2 Extended Instructions The EZ4021-FC MDU implements five extended instructions: MADD, MADDU, MUL, MSUB, and MSUBU. The first two instructions are signed and unsigned, 32-bit, multiply-add instructions. The MUL instruction is a three-operand, 32-bit, signed multiply that places the sign-extended, least-significant 32 bits of its result directly into the general-purpose register file. The MSUB and MSUBU instructions are signed and unsigned, 32-bit, multiply-subtract instructions. For a description of these instructions, refer to Section 4.9.1, "General 32-Bit Instruction Extensions," on page 4-32. 2.4.3 Performance The performance of the MDU varies based on the type of operation and the size of the operands. Divide operations are processed at 1 bit/cycle. A 32-bit divide operation takes 34 cycles to complete. A 64-bit divide operation takes 66 cycles until the results are posted in the special HI and LO registers. 2-12 Functional Description Multiply operations are processed at a rate of 8 bits/cycle. A 32-bit multiply operation takes a maximum of 6 cycles to complete. A 64-bit multiply operation takes a maximum of 10 cycles until the results are posted in the HI and LO registers. Table 2.4 compares the MDU performance in cycles with that of other MIPS RISC processors. Table 2.4 Execution Time of Multiply and Divide Instructions 32 Bit Operation 64 Bit R3000 CW33300 R4FC000 EZ4021-FC R4000 EZ4021-FC Multiply 12 1 + (Bits/3) 10 5/6 20 9/10 Divide 34 34 69 34 133 66 2.4.4 Pipeline Interlocks The MDU generates three classes of hardware pipeline interlocks: * An MFHI or MFLO instruction that follows a multiply or divide operation (not including MUL) stalls in the X stage until the operation completes and the HI and LO registers are updated with the final result. * A multiply or divide instruction that finds the MDU busy in the R stage stalls until the prior MDU operation is completed. * The MUL instruction stalls the pipeline in the X stage the entire time the MDU is processing the multiply. After the operation completes, hardware removes the interlock, and the final result passes to the M stage for posting in the general-purpose register file. 2.5 Quick Bus Interface The EZ4021-FC interface supports a new high-performance, on-chip bus known as Quick Bus. The Quick Bus is a split transaction bus that allows the overlap of memory requests (fetch/load/store) and data returns. A Quick Bus design operating at 125 MHz can achieve a peak bandwidth of 1.0 Gbytes/s. Quick Bus Interface 2-13 The Quick Bus has the following features: * Latency of main memory and other off-chip devices is hidden * Split transaction operation with minimal latency from cache-miss to Quick Bus request * Independent interfaces that allow command request and read-return operations to overlap * Flexible cycle-by-cycle bus arbitration that you can customize for each application * Support for multiple bus masters using a 4-bit identifier * Support for burst transactions with bus locking * Simple priority encoding that you can modify to support more complex customer needs 2.6 Bus Interface Unit (BIU) The Bus Interface Unit (BIU) passes addresses and data between the CPU and the Quick Bus. The BIU arbitrates CPU-to-Quick Bus access and Quick Bus response to the CPU. It provides a 64-bit, incoming data path from the Quick Bus to the CPU and a 64-bit path for outgoing data. Depending on the customer design, outgoing data can go to a variety of destinations outside the EZ4021-FC. All the memory devices or their controllers are connected to the Quick Bus. Figure 2.8 shows the major BIU interfaces. 2-14 Functional Description Figure 2.8 BIU I/O Block Diagram EZ4021-FC EasyMACRO Core 32-Bit Quick Bus Addr (Snooping) BIU 32-Bit Quick Bus Addr Quick Bus 64-Bit Quick Bus Data 64-Bit Quick Bus Data 2.6.1 BIU Features The BIU includes these key features: * Four-doubleword bursts * Eight-doubleword write buffers * Speculative instruction fetching (prefetching) * Bus Snooping * Optional Read Priority over Write 2.6.1.1 Four Doubleword Bursts - Instruction Fetch and Data The BIU services all cacheable read requests from the CPU by returning four doublewords. From the CPU perspective, a 4-doubleword burst is fetched for each cache miss. However, the BIU is not always granted a burst transaction on the Quick Bus, especially if the device it is accessing does not support bursting. In this case, the BIU generates four individual doubleword read requests. 2.6.1.2 Eight Doubleword Write Buffer The BIU contains an 8-doubleword write buffer for data queuing. Data is output to the Quick Bus when there are no pending instruction fetch or data read requests. Each write buffer entry is composed of data Bus Interface Unit (BIU) 2-15 (64 bits), address (32 bits), and byte enables (8 bits). To disable the write buffer, deassert the EZ4021-FC input pin WRITEBUF_ENABLEP. By disabling the write buffer, the number of entries goes from 8 doublewords to 1 doubleword. The CPU will stall if another store is executed before the previous store is output on the Quick Bus. Normally, write requests are the lowest priority, except when the CPU issues a load and there is a partial address match (bits 5-7) with one of the entries in the writer buffer. In this case, the load request is held pending until the write buffer is flushed (emptied) to the entry where its address (partially) matches the pending load. 2.6.1.3 Speculative Instruction Fetching (Prefetching) For instruction cache refills, the BIU issues a read request for the missed word's cache line and a speculative read request for the subsequent line. Once the first line comes back, the BIU issues a speculative request for the next line (in this case, the third line). This process is broken when the CPU informs the BIU that the instruction stream is broken. The BIU stops issuing requests until the CPU indicates the next instruction fetch miss. Speculative fetching is limited to lines within any 4 Kbyte page. That is, the BIU does not attempt to fetch a line speculatively that starts a new 4 Kbyte physical page. This method avoids problems when crossing from a cached page to an uncached page and other potential exception problems. A speculative fetch could attempt to access an invalid memory location (for example, not present in the memory map). An error response for such an event is not reflected to the CPU. The BIU simply discards the erroneous data, and no exception is reported. To disable speculative instruction fetching, deassert the EZ4021-FC input pin, PREFETCH_ENABLEP. 2.6.1.4 Bus Snooping Bus snooping helps maintain cache coherency. If an external device on the Quick Bus writes to cacheable space, the BIU initiates a tag lookup in the CPU Data Cache Controller (DCC). If there is a match, the DCC invalidates the appropriate cache line. To disable this cache snooping mechanism, deassert the EZ4021-FC input pin QB_WRITEP or SNOOP_ENABLEP. 2-16 Functional Description 2.6.1.5 Read Priority When enabled, the BIU prioritizes data reads (loads) ahead of data writes (stores) to the Quick Bus, resulting in out of order execution. To disable this feature, deassert the EZ4021-FC input pin, READPRI_ENABLEP. 2.6.2 Instruction Cache Refill Summary This section summarizes the instruction cache refill policy: * The I-Cache is filled with four doublewords (four doubleword blocks). * Uncached instructions are single doubleword fetches where the second word is sent to the CPU in the next cycle, if there is an address match. * Missed doubleword is returned first. * Data wraps around; that is, a line is always fetched. * There is speculative instruction fetching (prefetching). 2.6.3 Data Cache Refill Summary This section summarizes the data cache refill policy: * The D-Cache is filled with four doublewords (four doubleword blocks). * Uncached data are single fetches, depending on the byte enables (an uncached load byte operation reads a single doubleword). * Missed doubleword is returned first. * Data wraps around; that is, a line is always fetched. 2.6.4 Quick Bus Access Priority The Quick Bus access priorities are listed below from highest to lowest: 1. Write-Back Store 2. EJTAG DMA (read/write) 3. CPU Instruction Bus Interface Unit (BIU) 2-17 4. CPU Write Data (entry matches load) 5. CPU Read Data (load) 6. CPU Write Data (whatever is in the write buffer) 2.6.5 Programmable BIU Features Table 2.5 lists EZ4021-FC programmable features and the signals that control them. Table 2.5 Programmable Features Feature Signal1 Write Buffer Assert WRITEBUF_ENABLEP to enable the BIU eight doubleword write buffer. Instruction Prefetching Assert PREFETCH_ENABLEP to enable the BIU speculative instruction prefetching. Data Bus Snooping Assert SNOOP_ENABLEP to enable data bus snooping. Read Priority Assert READPRI_ENABLEP to enable data read priority over data writes.1 1. These BIU inputs are registered. For most applications, tie these inputs either HIGH or LOW. 2.7 EJTAG Interface The EZ4021-FC interface supports both Joint Test Action Group (JTAG) and Enhanced JTAG (EJTAG) functions. JTAG provides a serial interface and EJTAG supports debugging. EJTAG is a debug feature of MIPS-based processors. You can use EJTAG to debug stand-alone processors as well as 32- or 64-bit processors that are embedded in a system like the EZ4021-FC. EJTAG supports the following functions: 2-18 * Debugging for MIPS I, II, and III software code * Standardized debugging that simplifies and speeds up designing systems based on the EZ4021-FC Functional Description * Emulator connection with a small number of pins * Real-Time Program Counter trace (PC Trace) * Software breakpoints * Program single stepping * Simple DMA support * Hardware signal for indicating debug mode * Debug exception vector located in normal memory The EJTAG interface provides memory-mapped registers and serially-accessed registers for controlling EJTAG debugging operations. These are in addition to the CP0 EJTAG registers. For a description of all the EJTAG registers, see Section 3.3.1, "EJTAG Debug Registers," on page 3-35. The EJTAG interface provides for attachment of an EJTAG probe, which a debug host controls. The serially-accessed registers allow the probe to control EJTAG resources through a serial TAP port and the associated TAP controller state machine. The probe uses the TMS (DJ_TMSP) and TCK (DJ_TCKP) input pins to control the TAP controller in the EJTAG Interface. For each rising edge on the TCK clock, the TAP controller changes its state according to the state diagram shown in Figure 2.9. EJTAG Interface 2-19 Figure 2.9 TAP Controller TMS = 1 Test-LogicReset 0 0 Run-Test/ Idle 1 Select-DRScan 1 Select-IRScan 0 1 0 1 Capture-DR 0 Capture-IR 0 0 Shift-DR 1 Exit1-DR 0 1 Exit1-IR 0 0 1 1 Exit2-DR 0 Exit2-IR 1 1 Update-DR 2-20 Functional Description 0 Update-IR 1 1 0 Pause-IR Pause-DR 1 0 Shift-IR 1 0 1 0 The TAP controller states are defined as follows: * Test-Logic-Reset The EJTAG interface is reset and does not interfere with the normal operation of the chip. The instruction register is set to the IDCODE. Reset of the EJTAG interface by TRST puts the TAP controller in this state. The TAP controller can always reach this state within 5 TCK cycles if TMS equals 1. * Run-Test/Idle The TAP controller is idle and can be left in this state when not used. If the PC_Trace instruction is given, and the TAP controller is taken into the Run-Test/Idle state, the PC Trace output is enabled. As soon as the TAP controller leaves the Run-Test/Idle state, the PC Trace output is disabled. * Select-IR-Scan and Select-DR-Scan These serve as intermediate states on the path to selecting either an instruction or data register update. * Capture-DR The selected data register (bypass, device ID, implementation, control, address or data registers) is captured in the data shift-through register. The register is selected by the contents of the instruction register. * Capture-IR The value 0x1 is captured in the instruction shift-through register. * Shift-DR The data shift-through register is inserted in the TDI/TDO shift path and shifted on each rising edge of TCK: TDO Data Shift-Through Register TDI 0/31/95 0 On each falling edge of TCK, the least significant bit in the data shift-through register is available on TDO to be sampled by the probe on the next rising edge of TCK. EJTAG Interface 2-21 On each rising edge of TCK, the TDI value is sampled and shifted into the most significant bit in the data shift-through register. The length is 1, 32, 64, or 128 bits, depending on the instruction. * Shift-IR The instruction shift-through register is inserted in the TDI/TDO shift path and shifted on each rising edge of TCK: TDO Instruction Shift-Through Register TDI 4/5/6/7 0 The instruction shift-through register operation is similar to the data shift-through register operation. The length of the instruction shift-through register is 5, 6, 7, or 8 bits, depending on the length of the instruction register. * Exit1-DR and Exit1-IR These are temporary states, with no effect. * Pause-DR and Pause-IR These are temporary states, with no effect. They are used for pausing. * Exit2-DR and Exit2-IR These are temporary states, with no effect. * Update-DR The data shift-through register is copied to the selected register (bypass, device ID, implementation, control, address or data registers). When a register is selected, and the Capture-DR state is entered, the Update-DR state must also be entered and the selected register might be changed. * Capture-IR The instruction shift-through register is copied to the instruction register. 2-22 Functional Description 2.8 Clocks The EZ4021-FC accepts these three clock inputs: * PCLKP - processor clock. This clock generates all on-chip clocks except DJ_TCKP and GSCAN_RAMCLKP. * DJ_TCKP - EJTAG clock * GSCAN_RAMCLKP - global scan mode RAM clock 2.8.1 System Clock The EZ4021-FC generates the system clock (SCLKP) from PCLKP. The BIU Quick Bus interface uses SCLKP inside the core. At the chip level, the EZ_SCLK_GATEP output from the core is latched and ANDed with PCLKP to generate SCLKP. This guarantees that SCLKP inside the core is fully synchronous with SCLKP outside the core. Figure 2.10 illustrates this principle for an SCLKP divider of 2. Figure 2.10 On-Chip SCLKP Generation PCLKP EZ_SCLK_GATEP Latch Output SCLKP SCLKP is synchronous with PCLKP, and operates at either the same, 1/2, or 1/3 of the PCLKP frequency. In addition to PCLKP, the core accepts the inputs SCLKP_DIVP[1:0] and CG_RESETP. SCLKP_DIVP[1:0] sets the ratio between PCLKP and SCLKP. The CG_RESETP input forces the SCLKP divider to reload. CG_RESETP is required during logic simulation to initialize the SCLKP divider; in actual hardware the divider counts down and reloads regardless of its power-up state. Clocks 2-23 Figure 2.11 shows the clock distribution for the various EZ4021-FC clocks. If the insertion delay for the surrounding logic is much larger than the EZ4021-FC, then EZ_SCLK_GATEP might not meet timing requirements to the external SCLK clock generator module. The recommended solution is to insert a synchronization module between the EZ_SCLK_GATEP output and the external clock generator module. The synchronization module in Figure 2.11 has three flip-flops in series. The clock net going into the EZ4021-FC clocks the first synchronizer flip-flop (Sync 0). A clock net with an insertion delay less than the EZ4021-FC PCLKP input and greater than the insertion delay to the clock generator module clocks the second flip-flop (Sync 1). Ideally, the same clock that goes to the clock generator also clocks the third synchronizer flip-flop (Sync 2). The synchronization module holds the EZ_SCLK_GATEP signal for use in the clock generator until the next PCLKP cycle. If you use a synchronizer, you must assert reset for at least three more clock cycles. 2.8.2 EJTAG and Scan Clocks DJ_TCKP shifts data in and out of the EJTAG instruction register. This clock may be fully asynchronous to PCLKP. For more information on DJ_TCKP, refer to Section 5.3.1, "EJTAG Standard Signals," on page 5-7. Off-chip test equipment supplies GSCAN_RAMCLKP, which clocks the RAMs in scan mode. Clocking the RAMs allows data to pass through from the RAM inputs to outputs and improves scan test coverage. 2.8.3 Require External Synchronization to System Clock The EZ4021-FC has a reset input, a nonmaskable interrupt (NMI) input, and five hardware interrupt exception inputs. These signals must be synchronized externally to the system clock (SCLKP). 2-24 Functional Description Figure 2.11 EZ4021-FC Clock Distribution PCLKP Core Clock Distribution Clocks SCLKP_DIVP[1:0] CG_RESETP Divider SCLKP Latch BIU Quick Bus Interface EZ4021-FC EasyMACRO Core EZ_SCLK_GATEP SCLK_DIVP[1:0] SCLKP Sync0 Sync1 Sync2 Latch PCLKP1 PCLKP2 PCLKP3 Clock Generator Chip-Level Clock Distribution 2-25 2-26 Functional Description Chapter 3 Programmer's Model This chapter describes the programmer's model for the EZ4021-FC. It contains the following sections: * Section 3.1, "Memory Management" * Section 3.2, "Exception Processing" * Section 3.3, "EJTAG Debugging" * Section 3.4, "System Configuration Register 1" 3.1 Memory Management The EZ4021-FC memory model is based on an R4000 implementation. The EZ4021-FC physical address space is 4 Gbytes and uses a 32-bit address. The virtual address is also 32-bits wide, and it supports a user process size of up to 2 Gbytes (231). The virtual address is extended with an Address Space Identifier (ASID) to reduce the frequency of Translation Lookaside Buffer (TLB) flushing during context switches. The ASID is 8-bits wide and is contained in the CP0 EntryHi register. (See Section 3.1.3.6, "EntryHi Register (10)," on page 3-15.) 3.1.1 Operating Modes This section describes the four modes of EZ4021-FC operation. The first three modes support normal processor operations and are always available. The four modes are: MiniRISC EZ4021-FC EasyMACRO Microprocessor 3-1 * User mode - allows execution of nonsupervisory programs * Supervisor mode - includes higher level operating system functions that are layered on top of the kernel * Kernel mode - provides the lowest level operating system (kernel) functions * Debug mode - supports system level debug operations that use an external processor probe The EZ4021-FC normally operates in User mode until an exception forces a transition into Kernel mode. It remains in Kernel mode until an Exception Return (ERET) instruction is executed, which restores the processor to the operating mode that existed before the exception. Debug mode can be entered from any other operating mode by the taking of a debug exception. The EZ4021-FC remains in Debug mode until a Debug Exception Return (DERET) instruction is executed to restore the processor to the operating mode existing prior to the exception. Address mapping is different for Kernel, Supervisor, and User modes. To simplify the management of User state from within the Kernel or Supervisor, the User mode address space is a subset of both the Kernel and Supervisor mode address spaces. The address mapping for Debug mode is similar to that of Kernel mode, except for the redefinition of an address range as EJTAG probe and register addresses. 3.1.1.1 User Mode Operations In User mode, a single, uniform virtual address space (useg) of 2 Gbytes (231 bytes) is available. The User segment starts at address 0x0000.0000, and all valid accesses have the most-significant bit cleared to 0. Referencing an address with the most significant bit set while in User mode causes an Address Error exception. The TLB maps all references to useg identically regardless of operating mode, and controls cache accessibility on a per-page basis. Figure 3.1 shows User mode address mapping. 3-2 Programmer's Model Figure 3.1 User Mode Memory Map Virtual Physical 0xFFFF.FFFF 0xFFFF.FFFF Address Error Memory (4 Gbytes) 0x80000000 0x7FFF.FFFF useg 0x0000.0000 Any User Mapped Cacheable 0x0000.0000 Under normal operation (not debug mode), the processor executes in User mode when the Status register contains the following bit values: * KSU[1:0] = 0b10 * EXL = 0 * ERL = 0 For a description of the Status register, see Section 3.2.2.5, "Status Register (12)," on page 3-27. 3.1.1.2 Supervisor Mode Operations Supervisor mode is designed for layered operating systems in which a true kernel runs in R4000 Kernel mode, and the rest of the operating system runs in Supervisor mode. During normal operation, the processor executes in Supervisor mode when the Status register contains the following bit values: Memory Management 3-3 * KSU[1:0] = 0b01 * EXL = 0 * ERL = 0 The virtual address space is divided into two regions, differentiated by the high-order bits of the address, as shown in Figure 3.2. Figure 3.2 Supervisor Mode Memory Map Virtual 0xFFFF.FFFF Address Error 0xE000.0000 0xDFFF.FFFF sseg 0xC0000000 0xBFFF.FFFF Physical 0xFFFF.FFFF Supervisor Mapped Cacheable Any Address Error Memory (4 Gbytes) 0x8000.0000 0x7FFF.FFFF suseg 0x0000.0000 Any User Mapped Cacheable 0x0000.0000 The two regions are suseg and sseg: suseg - Starts at virtual address 0x00000000 and is 2 Gbytes long. This segment allows selective caching and mapping on a per-page basis. This segment overlaps Supervisor memory access and User memory access. sseg - Starts at virtual address 0xC0000000 and is 512 Mbytes long. Like suseg, this segment uses TLB entries to map virtual addresses to arbitrary physical ones, with or without caching. Accesses that fall outside of either suseg or sseg segments result in an Address Error exception. 3-4 Programmer's Model 3.1.1.3 Kernel Mode Operations During normal operation, the processor executes in Kernel mode when the Status register contains one or more of the following bit values: * KSU[1:0] = 0b00 * EXL = 1 * ERL = 1 The virtual address space is divided into five regions, differentiated by the high-order bits of the address, as shown in Figure 3.3. Figure 3.3 512 Mbytes 512 Mbytes Kernel Mode Memory Map Virtual Kernel 0xFFFF.FFFF Mapped kseg3 0xE000.0000 Cacheable 0xDFFF.FFFF Supervisor Mapped ksseg 0xC000.0000 Cacheable 0xBFFF.FFFF Kernel kseg1 Unmapped 0xA000.0000 Uncached 0x9FFF.FFFF Kernel kseg0 Unmapped Cached 0x8000.0000 0x7FFF.FFFF kuseg User Mapped 0x0000.0000 Cacheable Physical Any 0xFFFF.FFFF Any Memory (4 Gbytes) Any 0x2000.0000 0x1FFF.FFFF 0x0000.0000 The five regions are kuseg, kseg0, kseg1, ksseg, and kseg3. kuseg - Starts at virtual address 0x0000.0000 and is 2 Gbytes long. This segment allows selective caching and mapping on a per-page basis. This segment overlaps Kernel memory access and User memory access. Memory Management 3-5 kseg0 - Starts at virtual address 0x8000.0000 and is 512 Mbytes long. The EZ4021-FC direct maps references within kseg0 onto the first 512 Mbytes of physical memory. These references use cache memory but do not use the TLB for address translation. Thus, kseg0 is typically used for kernel executable code and some kernel data. kseg1 - Starts at virtual address 0xA000.0000 and is 512 Mbytes long. The EZ4021-FC direct maps references within kseg1 onto the first 512 Mbytes of physical memory. These references do not use cache memory or the TLB for address translation. Thus, kseg1 is typically used by operating systems for I/O registers, ROM code, and disk buffers. ksseg - Starts at virtual address 0xC000.0000 and is 512 Mbytes long. Like kuseg, this segment uses TLB entries to map virtual addresses to arbitrary physical ones, with or without caching. kseg3 - Starts at virtual address 0xE000.0000 and is 512 Mbytes long. Like kuseg, this segment uses TLB entries to map virtual addresses to arbitrary physical ones, with or without caching. An operating system typically uses kseg3 for stacks and per-process data that must remap on context switches. The operating system also uses kseg3 for user page tables and some dynamically allocated data areas. 3.1.1.4 Debug Mode Operations In debug mode, an Extended JTAG (EJTAG) interface typically controls the built-in debug features. All operations - such as reads and writes to internal registers, to external system memories, and to on-chip peripherals - are performed using the EJTAG protocol. The EZ4021-FC is in Debug mode when the Debug Mode (DM) bit sets to 1 in the Debug register (23). During normal operation, the DM bit is 0. The Debug register is part of the exception coprocessor (CP0) register set. See Section 3.3.3.1, "Debug Register (23) (Debug)," on page 3-49 for more information. The virtual address space is identical to that of Kernel mode with one exception. Two special kseg3 address ranges have been set aside for debug mode use. These ranges are: 3-6 Programmer's Model Probe Memory - Virtual address range 0xFF20.0000 to 0xFF2F.FFFF. References to this memory segment do not use cache memory or the TLB for address translation. The virtual address is passed directly to the external memory subsystem and is used to access off-chip processor probe memory. EJTAG Register Map - Virtual address range 0xFF30.0000 to 0xFF3F.FFFF. References to this memory segment do not use cache memory or the TLB for address translation. The virtual address is used to directly access the EJTAG register map. 3.1.2 Virtual Memory and the TLB Mapped virtual addresses are translated into physical addresses using an on-chip TLB. The TLB is a fully associative memory. It holds 32 entries that provide mapping to 64 physical page frames. The address range mapped by a page can vary from 4 Kbytes to 16 Mbytes in size. When address mapping is indicated, each TLB entry is simultaneously matched against the virtual address extended by the current ASID stored in the EntryHi register. If there is a match (hit), the physical page number is read from the TLB and concatenated with the offset to form the physical address, as shown in Figure 3.4. Figure 3.4 EZ4021-FC Virtual Address Format Virtual address with 4 Kbyte page size 32 31 29 28 39 ASID VPN Virtual to physical translation 3 8 Bits [31:29] select User or Kernel address spaces Virtual address with 16 Mbyte page size 12 11 Offset 17 Offset passed unchanged 31 32-Bit Physical Address VPN ASID 8 12 0 Virtual to physical translation 32 31 29 28 24 23 39 0 8 Memory Management Offset passed unchanged 0 Offset 24 3-7 If no match occurs (a page miss), an exception is taken. Typically, software refills the TLB from a page table maintained by the system. Software can write over a selected TLB entry or use a hardware mechanism to write into a random location. The EZ4021-FC does not support the TLB-shutdown (TS) bit in the Status register, which indicates that more than one entry in the TLB matches the virtual address being translated. If more than one TLB entry matches the virtual address, the virtual address may be translated to an incorrect physical address. System software must ensure that this situation is never created. 3.1.2.1 TLB Entry Format Figure 3.5 shows the format of the 32-bit, TLB entry. Each field of an entry has a corresponding field in the EntryHi, EntryLo0, EntryLo1, or PageMask registers. Figure 3.5 127 EZ4021-FC TLB Entry Format 109 108 121 120 R MASK 7 12 R 13 77 76 75 95 63 72 71 64 VPN2 G R ASID 19 1 4 8 58 57 38 37 35 34 33 32 R PFN C D V R 6 20 3 1 1 1 2 1 0 26 25 31 3-8 96 6 5 3 R PFN C D V R 6 20 3 1 1 1 R Reserved [127:121], [108:96], [75:72], [63:58], [32:26], 0 These bits are read as 0s. The EZ4021-FC ignores attempts to set these bits. MASK Page Mask [120:109] This field holds a comparison mask that defines the page size for the corresponding TLB entry. Programmer's Model VPN2 Virtual Page Number Divided by 2 [95:77] This field contains the Virtual Page Number divided by 2. Each TLB entry maps two pages. G Global 76 When this bit is set to 1, the contents of the ASID field are ignored during TLB lookup. ASID Address Space Identifier [71:64] This field contains the Address Space Identifier. PFN Page Frame Number [57:38, 25:6] This field contains the Page Frame Number. These bits are the upper bits of the physical address. C Cache [37:35, 5:3] This field specifies the cache coherency algorithm for references to the page. If the references are to be cached, you can select one of two update algorithms: write-back or write-through. C Bits Algorithm Ob000 Reserved Ob001 Reserved Ob010 Uncached Ob011 Cacheable - write-back Ob100 Reserved Ob101 Reserved Ob110 Reserved Ob111 Cacheable - write-through D Dirty 34, 2 When this bit is set to 1, the page is marked dirty and writable. V Valid When this bit is set to 1, the TLB entry is valid. 33, 1 3.1.3 Memory and TLB-Support Registers The registers described in the following subsections are used in association with the memory management and CP0 TLB support: Memory Management 3-9 * Index Register (0) * Random Register (1) * EntryLo0 (2) and EntryLo1 (3) Registers * PageMask Register (5) * Wired Register (6) * EntryHi Register (10) * PRId Register (15) * TagLo (28) and TagHi (29) Registers 3.1.3.1 Index Register (0) The Index register is a 32-bit, read/write register containing 6 bits that index an entry in the TLB. The Index register also specifies the TLB entry that is read or written by the TLB Read (TLBR) or TLB Write (TLBWI) instruction. Figure 3.6 shows the register format. Figure 3.6 Index Register (0) 31 30 6 P 3-10 R 5 0 Index P Probe 31 When this bit is set to 1, the last TLB probe (TLBP) instruction failed to find a match. R Reserved [30:6] These bits are read as 0s. The EZ4021-FC ignores attempts to set these bits; however, software should write these bits as 0 to ensure compatibility with future versions of the software. Index Index [5:0] This field contains the index to the TLB entry. The TLBR and TLBWI instructions use this index. The range of legal Index values is 0-31 because the TLB implements 32 entries. Programmer's Model 3.1.3.2 Random Register (1) The 32-bit, read-only Random register contains 6 bits that are used to index an entry in the TLB. The register decrements as each instruction executes. The values range between a lower boundary set by the number of TLB entries reserved for exclusive use by the operating system (defined in the Wired register), and an upper boundary set by the total number of TLB entries (31 maximum). The TLB Write Random (TLBWR) instruction loads the contents of the EntryHi and EntryLo registers into the TLB entry specified in the Random register. You can read the register to verify proper operation. To simplify testing, the Random register is set to the value of the upper boundary when the system is reset. It is also set to its upper boundary when the Wired register is written. Figure 3.7 shows the register format. Figure 3.7 Random Register (1) 31 6 5 R 0 Random R Reserved [31:6] These bits are read as 0s. The EZ4021-FC ignores attempts to set these bits; however, software should write these bits as 0 to ensure compatibility with future versions of the software. Random Random [5:0] This field contains the index to the TLB entry that the TLBWR instruction loads. The range of legal Random values is 0-31 because the TLB has 32 entries. 3.1.3.3 EntryLo0 (2) and EntryLo1 (3) Registers The EntryLo0 and EntryLo1 registers contain address translation information that software reads from or writes into the TLB. * EntryLo0 - contains TLB entries for even virtual pages * EntryLo1 - contains TLB entries for odd virtual pages Memory Management 3-11 Both registers have read/write access and use the format shown in Figure 3.8. Figure 3.8 31 EntryLo0/1 Register 26 25 6 R 3-12 5 PFN 3 C 2 1 0 D V G R Reserved [31:26] These bits are read as 0s. The EZ4021-FC ignores attempts to set these bits; however, software should write these bits as 0 to ensure compatibility with future versions of the software. PFN Physical Page Frame Number [25:6] This field contains the Physical Page Frame Number. C Cache [5:3] This field specifies the cache coherency algorithm for references to the page. If the references are to be cached, you can select one of two update algorithms: write-back or write-through. The following table shows how the Cache bits are encoded: C Bits Algorithm Ob000 Reserved Ob001 Reserved Ob010 Uncached Ob011 Cacheable - write-back Ob100 Reserved Ob101 Reserved Ob110 Reserved Ob111 Cacheable - write-through D Dirty When this bit is set, the page marked is dirty and writable. 2 V Valid When this bit is set, the TLB entry is valid. 1 Programmer's Model G Global 0 When this bit is set, ignore the contents of the ASID field during TLB lookup. Mapping is globally available to all ASIDs. 3.1.3.4 PageMask Register (5) The read/write PageMask register is used to access the TLB. It implements a variable page size by holding a per-entry comparison mask. When virtual addresses are presented for translation, the corresponding PageMask bits in the TLB specify which of the virtual address bits [24:13] to use in the comparison. Figure 3.9 shows the register format. Figure 3.9 31 PageMask Register (5) 25 24 R 13 12 0 MASK R R Reserved [31:25], [12:0] These bits are read as 0s. The EZ4021-FC ignores attempts to set these bits; however, software should write these bits as 0 to ensure compatibility with future versions of the software. M Mask This field contains the PageMask. [24:13] Bit Page Size 24 23 22 21 20 19 18 17 16 15 14 13 4 Kbytes 0 0 0 0 0 0 0 0 0 0 0 0 16 Kbytes 0 0 0 0 0 0 0 0 0 0 1 1 64 Kbytes 0 0 0 0 0 0 0 0 1 1 1 1 256 Kbytes 0 0 0 0 0 0 1 1 1 1 1 1 1 Mbyte 0 0 0 0 1 1 1 1 1 1 1 1 4 Mbytes 0 0 1 1 1 1 1 1 1 1 1 1 16 Mbytes 1 1 1 1 1 1 1 1 1 1 1 1 Memory Management 3-13 3.1.3.5 Wired Register (6) The read/write Wired register specifies the boundary between the wired (fixed, nonreplaceable entries that cannot be overwritten by a TLBWR operation) and random entries of the TLB. Figure 3.10 shows the location of the Wired register. Figure 3.10 Wired Register Location TLB 31 Range of Random Entries Wired Register Range of Wired Entries 0 When the system is reset, the Wired register is set to 0. Writing the register also sets the Random register to the value of its upper boundary. Figure 3.11 shows the register format. Figure 3.11 Wired Register 31 6 R 3-14 5 0 Wired R Reserved [31:6] These bits are read as 0s. The EZ4021-FC ignores attempts to set these bits; however, software should write these bits as 0 to ensure compatibility with future versions of the software. Wired Wired [5:0] This field defines the N number of Wired TLB entries. Wired entries have indices from 0 to N - 1; random replaceable entries have indices from N to 31. The range of legal Wired values is 0-31 because the TLB has 32 entries. Programmer's Model 3.1.3.6 EntryHi Register (10) The read/write EntryHi register is used to access the TLB. In addition, this register contains the current ASID value for the processor. The ASID value is used to match the virtual address with a TLB entry during virtual address translation. Typically, the operating system assigns a unique ASID value to each known process. In this way, mappings held in the TLB are made unique to the process whose ASID they match. The EntryHi register holds the high-order bits of a TLB entry when performing TLB read and write operations. When either a TLB refill, TLB invalid, or TLB modified exception occurs, the EntryHi register is loaded with the Virtual Page Number (VPN2) and the ASID of the virtual address that failed to have a matching TLB entry. The TLBP, TLBW, TLBWI, and TLBR instructions can access the EntryHi register. Figure 3.12 shows the register format. Figure 3.12 EntryHi Register (10) 31 13 12 VPN2 8 R 7 0 ASID VPN2 Virtual Page Number Divided by 2 [31:13] This field contains the Virtual Page Number divided by 2. Each TLB entry maps two pages. R Reserved [12:8] These bits are read as 0s. The EZ4021-FC ignores attempts to set these bits; however, software should write these bits as 0 to ensure compatibility with future versions of the software. ASID Address Space ID This field contains the Address Space Identifier. [7:0] 3.1.3.7 PRId Register (15) The Processor Revision Identifier (PRId) is a 32-bit, read-only register that contains information identifying the implementation and revision level of the EZ4021-FC EasyMACRO core. Figure 3.13 shows the register format. Memory Management 3-15 Figure 3.13 PRId Register (15) 31 16 15 R 8 IMP 7 0 REV R Reserved [31:16] These bits are read as 0s. The EZ4021-FC ignores attempts to set these bits; however, software should write these bits to 0 to ensure compatibility with future versions of the software. IMP Implementation Number [15:8] The value in this field represents the core implementation number. For the EZ4021-FC, this value is 0x35. REV Revision Number [7:0] The value in this field is a revision number for the core. The upper four bits [7:4] represent the major revision number, which is 0x0000 for the EZ4021-FC. The least significant four bits [3:0] are the minor revision number. Use the PRID_REV [3:0] signals at the core interface to program bits [3:0]. Important: LSI Logic does not guarantee that changes to the EZ4021-FC are reflected in the PRId register, nor does it guarantee that changes to the revision number reflect real core changes. For that reason, revision numbers are not listed here, and software should not rely on the revision number in the PRId register to characterize the core. 3.1.3.8 Config Register (16) The Config register specifies various configuration options for the EZ4021-FC processor. At reset, the hardware sets the options in the Config bits [31:3]. The software has read-only access to the information in these bit fields. Software controls the K0 field, bits [2:0], which have read-write access. At reset, the K0 field is undefined. Figure 3.14 shows the register format. 3-16 Programmer's Model Figure 3.14 Config Register (16) 31 30 R 28 27 18 17 16 15 14 EC R SC R BE 12 11 R 9 IC 8 6 DC 5 4 3 2 IB DB R 0 K0 R Reserved [31, 27:18, 16, 14:12, 3] These bits are read as 0s. The EZ4021-FC ignores attempts to set these bits. EC System Clock Ratio [30:28] This field reflects the value of the EZ4021-FC core input pins SCLKP_DIVP[1:0]. EC SCLKP_DIVP Sys Clock Ratio 0 10 SCLKP = PCLKP/2 1 11 SCLKP = PCLKP/3 2-6 - Reserved 7 01 SCLKP = PCLKP SC Secondary Cache Not Present 17 The EZ4021-FC does not support a secondary cache, so this bit is hardwired to a 1. BE Big Endian Memory 15 This field reflects the value of EZ4021-FC core input pin BIG_ENDIANP. When this bit is 0, memory is little endian. When this bit is 1, memory is big endian. Memory Management 3-17 IC DC 3-18 Instruction Cache Size [11:9] The EZ4021-FC sets this field to 0x2 (16 Kbytes). IC I-Cache Size (KBytes) 000 4 001 8 010 16 011 32 100 64 101 128 110 256 111 512 Data Cache Size [8:6] The EZ4021-FC sets this field to 0x2 (16 Kbytes). DC D-Cache Size (KBytes) 000 4 001 8 010 16 011 32 100 64 101 128 110 256 111 512 IB Instruction Cache Block Size The EZ4021-FC sets this bit to 1 to indicate that the instruction cache block (cache line) size is 32 bytes. DB Data Cache Block Size 4 The EZ4021-FC sets this bit to 1 to indicate that the data cache block (cache line) size is 32 bytes. K0 Kseg0 Coherency Algorithm [2:0] This field specifies the cache coherency algorithm for references to kseg0 address space, and all other cacheable accesses when the MMU is disabled. If the Programmer's Model 5 references are to be cached, you can select one of two update algorithms: write-back or write-through. C Bits Algorithm 000 Reserved 001 Reserved 010 Uncached 011 Cacheable - write-back 100 Reserved 101 Reserved 110 Reserved 111 Cacheable - write-through 3.1.3.9 TagLo (28) and TagHi (29) Registers The 32-bit, read/write TagLo and TagHi registers hold the primary cache tag during cache initialization or diagnostics. The Tag registers are written by the CACHE Index Load Tag and MTC0 instructions. Note: If a CACHE D-Cache Index Store Tag or D-Cache Hit Invalidate instruction precedes a D-Cache Index Load Tag instruction, make sure there is at least one instruction between the Store Tag/Hit Invalidate and the Load Tag instruction. Otherwise, the D, LL, and LRU bits in the TagLo register are corrupted. The TagHi register is not used by the EZ4021-FC when not in cache test mode and returns 0s when read. Figure 3.15 shows the register format. Memory Management 3-19 Figure 3.15 TagLo Register 31 28 27 8 R PAddr[31:12] R 7 6 5 4 V D LL LRU 3 0 R Reserved [31:28], [3:0] These bits are not used and read as 0s. The EZ4021-FC ignores attempts to set these bits; however, software should write these bits as 0 to ensure compatibility with future versions of the software. PAddr[31:12] Tag Physical Address [27:8] This field is used to read and write the physical address Tag ID. V Line Valid This bit is used to read and write the line valid bit. 7 D Line Dirty 6 This bit is used to read and write the cache line dirty bit. For I-Cache Store Tag operations, this bit is ignored. For I-Cache Load Tag operations, this bit always reads as 0. LL Line Locked 5 This bit is used to read and write the line locked bit. When not operating in cache test mode, this bit will always return a value of 0 following a CACHE Index Load Tag operation. LRU Least Recently Used 4 This bit is used to read and write the Least Recently Used (LRU) bit. When not operating in cache test mode, this bit will always return a value of 0 following a CACHE Index Load Tag operation. 3.1.4 Virtual Address Translation During virtual-to-physical address translation, the CPU compares the ASID and, depending upon the page size, the highest 7-19 bits of the virtual address to the contents of the TLB. Figure 3.16 illustrates the TLB address translation process. 3-20 Programmer's Model Figure 3.16 EZ4021-FC TLB Address Translation Process VPN and ASID No Address Error Yes Valid Address? User Mode? No Supr Mode? Yes No Yes Unmapped Access Yes Valid Address? No Address Error Yes kseg0 or kseg1? No VPN Match? No Yes G = 1? No ASID Match? No Yes Yes V = 1? No Yes Yes No Write? D = 1? Yes TLB Mod No Yes Access Main Memory C= 0b010? Output Physical Address TLB Invalid TLB Refill No Access Cache Note: Bits A, V, D, and C are bits in the TLB entry. Indicates an exception Memory Management 3-21 A virtual address matches a TLB entry when: * VPN2 field of the virtual address equals the VPN2 field of the entry * G bit of the TLB entry is set, or the ASID held in the EntryHi register matches the ASID field in the TLB entry The V bit in the TLB entry must be set to 1 for a valid translation to occur. However, the V bit is not used when checking for a match between the virtual address and the TLB entry. If a TLB entry matches, the physical address and access control bit (C, D, and V) are retrieved from the entry. If no match is found, a TLB miss exception occurs. If the access control bits (D and V) indicate that the access is not valid, a TLB modification or TLB invalid exceptions occurs, respectively. If the C bits equal 0b010, the physical address that is retrieved is used to bypass the cache and access main memory directly. 3.2 Exception Processing The processor receives exceptions from a number of sources, including TLB misses, arithmetic overflow, I/O interrupts, system calls, and debug events. When the processor detects one of these exceptions, it suspends the normal sequence of instruction execution and enters either Kernel or Debug mode depending on the type of exception. The processor then disables interrupts and forces execution of a software exception handler located at a fixed address. The exception handler saves the context of the processor, including the contents of the program counter, the current operating mode, and the status of the interrupts (enabled or disabled). This context is saved so it can be restored after the exception is serviced. When a debug exception occurs, the CPU loads the Debug Exception Program Counter (DEPC) register with a location where execution can restart after the exception is serviced. For all other exceptions, except Reset, Soft Reset/NMI, the Exception Program Counter (EPC) register is loaded with the restart location. The restart location in the EPC or DEPC register is the address of the instruction that caused the exception or, if the instruction was executing in a branch delay slot, the address of the branch instruction preceding the delay slot. 3-22 Programmer's Model The registers described later in this section assist in this exception processing by retaining address, cause, and status information. For detailed descriptions of the exception handling process, refer to Chapter 7. 3.2.1 Exception Vector Locations The EZ4021-FC defines the placement of exception processing code. The Reset, Soft Reset, and NMI exceptions always vector to virtual address location 0xBFC0.0000. Debug exceptions vector to either 0xFF20.0200 or to 0xBFC0.0200 if the ProbEn and SetDEV (EJTAG Control Register [15:14]) bits are 0. Addresses for other exceptions are a combination of a vector offset and a base address, and they are determined by the BEV bit of the Status register. Table 3.1 defines these values. Table 3.1 Exception Addresses Base Address Exception BEV = 0 BEV = 1 Offset TLB Refill (EXL = 0) 0x8000.0000 0xBFC0.0200 0x000 All Others 0x8000.0000 0xBFC0.0200 0x180 3.2.2 CP0 Exception Processing Registers This section describes the System Coprocessor (CP0) registers that are used in exception processing: * Context Register (4) * BadVAddr Register (8) * Count Register (9) * Compare Register (11) * Status Register (12) * Cause Register (13) * EPC Register (14) Exception Processing 3-23 * ErrorEPC Register (30) There are three additional CP0 registers used for EJTAG debugging. These registers are described in Section 3.3.3, "EJTAG CP0 Registers," on page 3-49. * Debug Register (23) * DEPC Register (24) * DESAVE Register (31) 3.2.2.1 Context Register (4) The read/write Context register contains a pointer to an entry in the Page Table Entry (PTE) array. This array is an operating system data structure that stores virtual-to-physical address translations. When there is a TLB miss, operating system software handles the miss by loading the TLB with the missing translation from the PTE array. The BadVPN field is not writable. It contains the VPN of the most recently translated virtual address that did not have a valid translation (TLBL or TLBS). The PTEBase field is both writable and readable, and indicates the base address of the PTE table of the current user address space. The Context register duplicates part of the address information provided in the BadVAddr register, and the information is in a form that is more useful for a software TLB exception handler. The Context register is provided solely for the operating system to use. The operating system can use this register to hold a pointer into the PTE array. The operating system sets the PTE base field register as needed. Normally, the operating system uses the Context register to address the current page map, which resides in the kernel-mapped segment, kseg3. Figure 3.17 shows the register format. 3-24 Programmer's Model Figure 3.17 Context Register (4) 31 23 22 4 PTEBase BadVPN2 3 0 R PTEBase Page Table Entry Base [31:23] This field is the pointer into the current Page Table Entry (PTE) in memory. It is maintained by the operating system. BadVPN2 Bad Virtual Page Number Divided by 2 [22:4] Hardware writes this field on a TLB miss. It contains the VPN of the most recently translated virtual address that did not have a valid translation. This 19-bit BadVPN2 field contains bits [31:13] of the virtual address that caused the TLB miss; bit 12 is excluded because a single TLB entry maps an even-odd page pair. This format can be used directly as an address in a table of pairs of 8-byte PTEs, for a 4 Kbyte page size. For other page and PTE sizes, shifting and masking this value produces an appropriate address. R Reserved [3:0] These bits are read as 0s. The EZ4021-FC ignores attempts to set these bits; however, software should write these bits as 0 to ensure compatibility with future versions of the software. 3.2.2.2 BadVAddr Register (8) The Bad Virtual Address register (BadVAddr) is a read-only register that contains the most recently translated virtual address that failed to have a valid translation or that caused an address error. Figure 3.18 shows the register format. Note: When a bus error occurs, the Bad Virtual Address register does not save any information about it, because it is not an address error. Exception Processing 3-25 Figure 3.18 BadVAddr Register (8) 31 0 BadVAddr 3.2.2.3 Count Register (9) The Count register acts as a timer. It increments at a constant rate equal to one-half the maximum instruction issue rate (which is one-half PCLKP) regardless of whether an instruction is executed, retried, or has made any forward progress. The Count register is a read/write register; it can be written to either for diagnostic purposes or during system initialization to synchronize two processors operating in lock step. Figure 3.19 shows the register format. Figure 3.19 Count Register (9) 31 0 Count 3.2.2.4 Compare Register (11) The Compare register acts as a timer (see also the Count register). When the Count register reaches a value that equals the Compare register, interrupt bit IP5 in the Cause register is set to 1. This indicates that a timer/compare interrupt is pending. When enabled, an interrupt is taken on the next execution cycle. Writing a value to the Compare register clears the timer interrupt. For diagnostic purposes, the Compare register is a read/write register. During normal operation, the Compare register is write only. Figure 3.20 shows the register format. 3-26 Programmer's Model Figure 3.20 Compare Register (11) 31 0 Compare 3.2.2.5 Status Register (12) The read/write Status register contains the operating mode, interrupt enabling, and the diagnostic states of the processor. The EZ4021-FC processor implements the MIPS III ISA, which is always enabled across all operating modes. Although the EZ4021-FC supports 64-bit data operations, it only supports 32-bit addressing. Note that the EZ4021-FC does not support the MIPS KX, SX, and UX fields (bits [7:5]). These bits are reserved and read as 0s. The 8-bit Interrupt Mask field (Int[5:0], SW[1:0]) controls the enabling of eight interrupt conditions. Interrupts must be enabled before they can be asserted, and the corresponding bits are set in both the Interrupt Mask field of the Status register and the Interrupt Pending field of the Cause register. The 2-bit KSU field, along with the ERL and EXL bits, define the normal operating modes of the EZ4021-FC processor. Figure 3.21 shows the register format. Figure 3.21 Status Register (12) 31 28 27 CU[3:0] 23 22 R 21 20 19 BEV R SR 16 15 R 10 9 Int[5:0] 8 7 SW [1:0] 5 4 R 3 2 1 0 KSU ERL EXL IE [1:0] CU[3:0] Coprocessor Usability Bits [31:28] This 4-bit field individually controls the usability of the four coprocessors. When a bit is set to 1, the corresponding coprocessor is marked as usable; for example, CU[1] = 1 indicates that coprocessor 1 is usable. Regardless of the setting of the CU[0] bit, CP0 is always considered usable when in kernel mode. R Reserved [27:23], 21, [19:16], [7:5] These bits are read as 0s. The EZ4021-FC ignores attempts to set these bits; however, software should write Exception Processing 3-27 these bits to 0 to ensure compatibility with future versions of the software. BEV Bootstrap Exception Vector 22 This bit controls the location of the TLB refill and general exception vectors. Setting the bit to 1 indicates a bootstrap operation, and bootstrap vector locations are used. When the bit is cleared to 0, the general exception vectors are used. SR Soft Reset When this bit is set, it indicates that a soft reset or nonmaskable interrupt occurred. Int[5:0] Hardware Interrupt Mask [15:10] This 6-bit field defines the hardware interrupt mask. Setting a bit to 1 enables the corresponding hardware interrupt. For example, setting bit 15 (Int5) to 1 enables the Count/Compare timer interrupt. Clearing bit 0, the Interrupt Enable (IE) bit, disables all interrupts. SW[1:0] Software Interrupt Mask [9:8] This 2-bit field defines the software interrupt mask. Setting bits 1 and 0 to a 1 enables software interrupts 1 and 0, respectively. KSU[1:0] Kernel/Supervisor/User Mode [4:3] This field specifies the EZ4021-FC base operating mode as shown below: ERL 3-28 KSU[1:0] Description 00 Kernel 01 Supervisor 10 User 11 Undefined 20 Error Level 2 The ERL bit specifies the EZ4021-FC error level. Reset and Soft Reset/NMI set this bit to a 1. When set, the ERL bit overrides the KSU mode setting and forces kernel operation. When cleared, the ERL bit indicates normal operation. Programmer's Model EXL Exception Level 1 The EXL bit specifies the exception level of the EZ4021-FC. All exceptions, except Reset and Soft Reset/NMI, set the EXL bit to a 1. When EXL is set, it overrides the KSU mode setting and forces kernel operation. When cleared, the EXL bit indicates normal operation. IE Interrupt Enable 0 Setting the IE bit to 1 enables interrupts. Clearing the bit to 0 disables interrupts. Status Register Modes and Access States - The Status register enables the following modes and access states: * Interrupt Enable INT[5:0] and SW[1:0] enable their corresponding hardware and software interrupts when all of the following conditions are true: * - IE = 1 - EXL = 0 - ERL = 0 Operating Mode The following CPU Status register bit settings are required for User, Kernel, and Supervisor modes. For more information about operating modes, refer to Section 3.1.1, "Operating Modes," on page 3-1. * - The processor is in User mode when KSU = 0b10, EXL = 0, and ERL = 0. - The processor is in Supervisor mode when KSU = 0b01, EXL = 0, and ERL = 0. - The processor is in Kernel mode when KSU = 0b00, or EXL = 1, or ERL = 1. Kernel Address Space Access to the kernel address space is allowed when the processor is in Kernel mode. * Supervisor Address Space Access to the supervisor address space is allowed when the processor is in Kernel or Supervisor mode, as described above. Exception Processing 3-29 * User Address Space Access to the user address space is allowed in any of the above operating modes. Status Register Reset - The contents of the Status register are undefined at reset, except for the following bits in the Diagnostic Status field: * ERL =1 * BEV = 1 The SR bit distinguishes between the Reset exception and the Soft Reset exception (caused by either Reset or Nonmaskable Interrupt [NMI]). 3.2.2.6 Cause Register (13) The read/write Cause register describes the nature of the last exception. A 5-bit exception code indicates the cause, and the remaining fields contain detail information relevant to the handling of certain types of exceptions. The contents of this register are undefined at reset. All bits in the register, with the exception of the SI[1:0] field, are read-only. Figure 3.22 shows the register format. Figure 3.22 Cause Register (13) 31 30 29 28 27 BD R 3-30 16 15 CE [1:0] R 10 9 IP[5:0] 8 7 SI [1:0] R 6 2 ExcCode[4:0] BD Branch Delay When set, this bit indicates that the last exception occurred while the EZ4021-FC was executing an instruction in the branch delay slot. R Reserved These bits are read as 0s. Programmer's Model 1 0 R 31 30, [27:16], 7, [1:0] CE[1:0] Coprocessor Error [29:28] The value in this field indicates which coprocessor unit was being referenced when a Coprocessor Unusable exception occurred. CE[1:0] Coprocessor Referenced 11 Coprocessor 3 10 Coprocessor 2 01 Coprocessor 1 00 Coprocessor 0 IP[5:0] Interrupt Pending [15:10] The EZ4021-FC sets these bits to indicate that an external interrupt is pending. Bit 15 corresponds to the Count/Compare timer interrupt, and bits [14:10] correspond to the external hardware interrupts, INTP[4:0]. SI[1:0] Software Interrupts [9:8] When setting either of these bits, software can cause the EZ4021-FC to transfer control to the general exception handler. The exception routine can determine which bit is set by examining this field. The exception routine must clear the SI[1:0] bits to 0 before returning control to the interrupted program. Exception Processing 3-31 ExcCode[4:0] Exception Code [6:2] The EZ4021-FC sets this field to indicate the type of event that caused the last general exception. ExcCode Mnemonic Description 3-32 0x00 Int Interrupt 0x01 TLBMOD TLB Modification Exception 0x02 TLBL TLB Exception, Load, or Inst Fetch 0x03 TLBS TLB Exception, Store 0x04 AdEL Address Error Exception, Load, or Fetch 0x05 AdES Address Error Exception, Store 0x06 IBE Bus Error Exception--Instruction Fetch 0x07 DBE Bus Error Exception--Load or Store 0x08 Sys System Call Exception 0x09 Bp Breakpoint Exception 0x0A RI Reserved Instruction Exception 0x0B CpU Coprocessor Unusable Exception 0x0C Ov Arithmetic Overflow Exception 0x0D Tr Trap Exception 0x0E - Reserved 0x0F FPE Floating Point Exception 0x10- 0x1F - Reserved Programmer's Model 3.2.2.7 EPC Register (14) The read/write Exception Program Counter (EPC) contains the address at which instruction processing can resume after servicing an exception. For synchronous exceptions, the EPC register contains either of the following: * The virtual address of the instruction that was the direct cause of the exception * The virtual address of the immediately preceding branch or jump instruction, when the instruction is in a branch delay slot If the exception is caused by a recoverable, temporary condition (such as a TLB miss), the EPC contains the virtual address of the instruction that caused the exception. After correcting the exception condition, the address in the EPC serves as a pointer to the instruction where execution can resume. The EPC is not updated if the Status register EXL bit is set to 1. Figure 3.23 shows the EPC register format. Figure 3.23 EPC Register (14) 31 0 EPC EPC Virtual Address [31:0] This register contains the virtual address of the exception-causing instruction or the address of the immediately preceding branch or jump. 3.2.2.8 ErrorEPC Register (30) The Error Exception Program Counter (ErrorEPC) is a read/write register similar to the EPC register. It stores the Program Counter (PC) on Reset, Soft Reset, and NMI exceptions. The contents of this register can be: * The virtual address of the first instruction (victim) that did not complete due to the exception Exception Processing 3-33 * The virtual address of the immediately preceding branch or jump instruction - if the victim instruction was in a branch delay slot * Invalid, if a Reset or Soft Reset exception occurs when there is no valid instruction in the CPU pipeline Figure 3.24 shows the register format. Note: There is no branch delay slot indication for the ErrorEPC register. Figure 3.24 ErrorEPC Register (30) 31 0 Error EPC Error EPC Virtual Address [31:0] This register contains the virtual address of the exception-causing instruction or the address of the immediately preceding branch or jump. 3.3 EJTAG Debugging The EZ4021-FC includes the following EJTAG debug features: 3-34 * Instruction Address Matching * Data Address Matching * PC Trace * EJTAG DMA * Software Debug Breakpoint (SDBBP) instruction and Debug Exception Return (DERET) instruction. The EZ4021-FC implements these two new instruction extensions to the standard MIPS ISA. For details on these new instructions, refer to Chapter 4, "Instruction Set Architecture." Programmer's Model 3.3.1 EJTAG Debug Registers The EJTAG Debug registers are grouped as follows and described in the sections that follow: * EJTAG Serial-Access Registers * EJTAG CP0 Registers * EJTAG Memory Mapped Registers 3.3.2 EJTAG Serial-Access Registers The following registers are accessed serially through the EJTAG interface: * EJTAG Instruction Register (EIR) * EJTAG Bypass Register (EBR) * EJTAG Device Identification Register (EDIR) * EJTAG Implementation Register (EIMR) * EJTAG Address Register (EAR) * EJTAG Data Register (EDR) * EJTAG Control Register (ECR) Data shifts into each of the registers through the DJ_TDIP_DINTN input pin and shifts out through the DJ_TDOP_TPCP output pin. The state of the EJTAG TAP controller and the value of the EJTAG instruction register determine which register is selected. Data shifts in and out with the least-significant-byte (LSB) first. The CPU cannot read or write these registers. They are only accessible through the EJTAG pins of the EZ4021-FC. EJTAG Debugging 3-35 3.3.2.1 EJTAG Instruction Register (EIR) The EJTAG Instruction register is addressable through the EJTAG TAP Controller. The EIR has an initialization value of 0x01. Access is write only (reads as 0x01). Figure 3.25 shows the register format. Figure 3.25 EJTAG Instruction Register (EIR) 7 54 PI PI INST 3-36 0 INST Possible Instruction [7:5] The EIR has a variable length in order to match the maximum JTAG length of 8 bits. The bits exist under the definition of the DJ_EJTAGIRBITS[1:0] bus, as shown in the table below. These bits are always 0 when implemented unless the INST field contains a Bypass instruction, in which case they contain a 1, as explained below. DJ_EJTAGIRBITS[1:0] EIR Length 00 5 bits 01 6 bits 10 7 bits 11 8 bits Instruction [4:0] These bits contain the EJTAG interface instruction. The table above shows the eight valid EJTAG instructions. For detailed descriptions of the instructions, refer to the MIPS EJTAG Specification. Programmer's Model Table 3.2 EJTAG Interface Instructions INST[4:0] Instruction Function 0x01 IDCODE Select Device ID Register 0x03 ImpCode Select Implementation Register 0x08 EJTAG_ADDRESS_IR Select EJTAG Address Register 0x09 EJTAG_DATA_IR Select EJTAG Data Register 0x0A EJTAG_CONTROL_IR Select EJTAG Control Register 0x0B EJTAG_ALL_IR1 Select EJTAG Address, Data, and Control Registers 0x10 PC_Trace Issue PC Trace Command and Select Bypass Register 0x1F2 BYPASS3 Select Bypass Register 1. The connection order for the EJTAG_ALL_IR instruction is TDI to high-order bit of EJTAG Address register, low-order bit of EJTAG Address register to high-order bit of EJTAG Data register, and low-order bit of EJTAG Data register to high-order bit of EJTAG Control register. The TDO is connected to the low-order bit of the EJTAG Control register. 2. For this INST code only, the PI bits, however many are selected, are set to 1 so that all bits in the EIR are 1. Otherwise, when implemented, these bits are 0. 3. All undefined instructions map to Bypass. 3.3.2.2 EJTAG Bypass Register (EBR) The EJTAG Bypass register is a single bit, connecting TDI to TDO using one register element. The EBR has no initialization value. Access is write only (reads as a 0). Figure 3.26 shows the register format. Note: This register is bypassed if the Bypass instruction is active and the DJ_JTAGALSOP pin is asserted, because it connects DJ_JTAGTDOP directly to DJ_TDO_TPCP. If this pin is not asserted, this register connects DJ_TDIP_DINTN and DJ_TDO_TPCP. EJTAG Debugging 3-37 Figure 3.26 EJTAG Bypass Register (EBR) 0 B B Bypass Bit 0 When the instruction register contains a Bypass instruction, this bit connects the EJTAG TDI and TDO pins. When the TAP Controller enters the Capture-DR state, this bit is loaded with a 0. 3.3.2.3 EJTAG Device Identification Register (EDIR) The EDIR identifies LSI Logic as the EJTAG component manufacturer. In addition, it includes a user-defined value controlled by the DJ_PON[19:0] input pins. This value can serve as a customer part number. The value that shifts in while the EDIR value shifts out is not used. The EJTAG part number is equivalent to the part number that would be used if a JTAG controller were present. The EDIR has an initialization value of 0bhhhh.hhhh.hhhh.hhhh.hhhh.0000.0110.1101, where h is determined by hardwired customer inputs The EDIR has read-only access. Figure 3.27 shows the register format. Figure 3.27 EJTAG Device Identification Register (EDIR) 31 12 11 PONUM PONUM 1 0 00000110110 Part Order Number [31:12] This field is tied to the DJ_PON[19:0] input pins. The input value is user-defined. 00000110110 Manufacturer Identity This field identifies LSI Logic as the component manufacturer. 3-38 R Programmer's Model [11:1] R Reserved 0 This bit is hardwired to 1. The EZ4021-FC ignores attempts to set or clear this bit. However, software should write a 1 to this bit to ensure compatibility with future versions of the software. 3.3.2.4 EJTAG Implementation Register (EIMR) The EIMR specifies the EJTAG features implemented on the EZ4021-FC. The value that shifts in while the EDIR value shifts out is not used. The EIMR's initial value is 0b0000.0000.1100.0h01.h001.1001.1000.0001, where h is controlled by a hardwired pin. The EIMR has read-only access. Figure 3.28 shows the register format. Figure 3.28 EJTAG Implementation Register (EIMR) 31 26 25 R 15 14 NoPC Trace 0 24 00 13 11 011 10 22 1 8 001 23 21 10 20 0 7 6 5 1 0 0 19 18 17 16 0 D Cache C 0 1 1 0 4 0000 1 R Reserved [31:26] These bits are hardwired to 0s and read as 0s. The EZ4021-FC ignores attempts to set these bits. However, software should write 0s to them to ensure compatibility with future versions of the software. 00 Profiling Support [25:24] This field is hardwired to 0b00 to indicate that the EZ4021-FC does not support simple profiling. 1 SDBBP Uses SPECIAL2 Opcode 23 This bit is hardwired to 1 to indicate that the EZ4021-FC decodes the SPECIAL2 SDBBP instruction, not the previous SDBBP opcode specified in the MIPS EJTAG Specification (version 1.3 and earlier). EJTAG Debugging 3-39 3-40 10 ASID Size [22:21] This field is hardwired to 0b10, which specifies an 8-bit ASID size. 0 Complex Break Support 20 This bit is hardwired to 0 to indicate that the EZ4021-FC does not support complex break. 0 Physical Address Width 19 This bit is hardwired to 0 to indicate that the EZ4021-FC has 32-bit addressing. DCacheC Data Cache Coherency 18 This bit connects to the VCED_ENABLEP input signal, which is tied to 0. Since the DCacheC bit is always 0, it indicates that the EJTAG debug solution in the EZ4021-FC does not maintain data cache coherency with EJTAG-initiated DMA operations. Before doing an EJTAG DMA, LSI Logic recommends that you issue CACHE Hit Write-Back Invalidate instructions to properly flush all occurrences of the DMA target line from the data cache. 0 Instruction Cache Coherency 17 This bit is hardwired to 0 to indicate that the EJTAG debug solution in the EZ4021-FC does not maintain instruction-cache coherency with EJTAG-initiated DMA operations. Before doing an EJTAG DMA, LSI Logic recommends that you issue CACHE Hit Invalidate instructions to properly flush all occurrences of the DMA target line from the instruction cache. 1 MIPS16 Support 16 This bit is hardwired to 1 to indicate that the EZ4021-FC supports the MIPS16 debug features. Although the EZ4021-FC does not execute the MIPS16 ASE, hardware registers and data output formats are consistent with implementation of the MIPS16 ASE. NoPCTrace No PC Trace Support 15 This bit indicates whether PC Trace is enabled or disabled. When the DT_PCTEN input signal is driven LOW, it disables PC Trace and sets this bit to 1. When DT_PCTEN is HIGH, it enables PC Trace and clears this bit. Programmer's Model 0 No EJTAG DMA Support 14 This bit is hardwired to 0 to indicate that the EZ4021-FC supports DMA with EJTAG. 011 Trace PC Width [13:11] This field is hardwired to 0b011, which specifies an 8-bit PC Trace width. 001 PCST Width and DCLK Division Factor [10:8] This field is hardwired to 0b001, which specifies a 6-bit PCST width and a DCLK division factor of 2. 1 No Processor Bus Break Support 7 This bit is hardwired to 1 to specify that the EZ4021-FC does not support the Processor Bus Break. 0 No Data Break Support 6 This bit is hardwired to 0 to specify that the EZ4021-FC supports the Data Break. 0 No Instruction Address Break Support 5 This bit is hardwired to 0 to specify that the EZ4021-FC supports the Instruction Address Break. 0000 Obsolete Field This field is hardwired to 0. 1 MIPS 32-Bit or 64-Bit 0 This field is hardwired to 1 to specify that the EZ4021-FC is a 64-bit machine (data). [4:1] 3.3.2.5 EJTAG Address Register (EAR) The EAR has no initialization value and has read/write access. Figure 3.29 shows the register format. Figure 3.29 EJTAG Address Register (EAR) 31 0 EA EA EJTAG Address [31:0] This register contains either the address for an EJTAG-initiated DMA or, for a processor access of probe memory. EJTAG Debugging 3-41 3.3.2.6 EJTAG Data Register (EDR) The EDR has no initialization value and has read/write access. Figure 3.30 shows the register format. Figure 3.30 EJTAG Data Register (EDR) 63 32 ED 31 0 ED ED EJTAG Data [63:0] This register holds data destined for the probe due to an EJTAG-initiated DMA load or processor-initiated probe store. The register also can hold data from the probe due to an EJTAG-initiated DMA store or processor-initiated load from probe space. 3.3.2.7 EJTAG Control Register (ECR) The ECR controls operation of the hardware resources accessible by the EJTAG probe. In addition, the ECR contains status information as well as hardware semaphores that are polled to determine real-time status. The ECR has an initialization value of 0b0000.0000.0x10.0000.0000.0000.0000.0000, where x is don't care. ECR access is defined individually for each bit or field in the register. Figure 3.31 shows the register format. 3-42 Programmer's Model Figure 3.31 EJTAG Control Register (ECR) 31 29 27 26 DNM R PCAS ID 13 12 11 10 9 0 Ejtag Brk Dstrt Derr Drwn R 15 14 Prob En Set DEV 28 25 24 00 23 22 Sync Doze 8 7 Dsz 6 R 21 20 1 Per PRnW PrAcc Rst 5 4 Dlock Dinc 19 18 3 2 BrkSt TIF 17 16 Dma PrRst Acc 1 0 TOF ClkEn R Reserved [31:29], 27, 6 These bits are hardwired to 0s and read as 0s. The EZ4021-FC ignores attempts to set these bits. However, software should write 0s to them to ensure compatibility with future versions of the software. These bits have read-only access. DNM DMA Normal Memory Access 28 Processor accesses to locations 0xFF20.0000- 0xFF3F.FFFF map to the EJTAG registers of the EJTAG Memory module only in Debug mode; in normal mode, these accesses go to normal memory. Valuable data may therefore reside in the normal memory at those addresses that the debug software must access. The DMA must have access to the real memory, not the debug overlay. When set, this bit allows the probe-based DMA to access the normal memory at locations 0xFF20.0000-0xFF3F.FFFF. When cleared to 0, the EJTAG probe or the EJTAG registers claim the DMA access to this address range. Software should set this bit just before the DMA requires access to normal memory, and clear it just afterward. This bit has read/write access. PCASID ASID Output During PC Trace 26 When this bit is set to 1, PC Trace outputs an 8-bit ASID as an extension to the program count. The 8-bit ASID field follows the 31-bit PC. When the PCASID bit is cleared, PC Trace does not output the ASID after the program count. This bit has read/write access. 00 Target PC Output Length [25:24] This field is hardwired to 0b00, because the EZ4021-FC supports PC Trace and the address is a 32-bit address (PhysAW = 0). This field has read-only access. EJTAG Debugging 3-43 3-44 Sync Synchronize PC Trace 23 This bit synchronizes entering PC Trace mode with the end of a processor instruction fetch from the probe. Setting this bit to 1 stalls the CPU until the EIR contains the PC Trace instruction and the TAP controller is in the Run-Test/Idle state. This bit sets only at the end of a processor read access. At all other times, attempts by the probe to set this bit are ignored. Hardware clears this bit after entering the PC Trace mode, or when the probe clears it by writing a 0 to the bit. This bit has read/write access. Doze Doze State 22 This bit reflects whether the CPU is in a sleeping state caused by execution of a WAITI instruction. This bit reflects the value of the CPU_EC_WAITI signal output from the EZ4021-FC. This bit has read-only access. 1 Run Cycle 21 This bit is set to 1 because the EZ4021-FC does not have a halt mode. This bit is not used and is read as 1. The EZ4021-FC ignores attempts to set this bit. However, software should write this bit to 1 to ensure compatibility with future versions of the software. This bit has read-only access. PerRst Peripheral Reset 20 Setting this bit to 1 causes the CPU peripherals to reset. Setting this bit to 1 in the DJ_TCKP domain eventually sets a similar bit in the PCLKP domain. The reset of the peripherals is sustained as long as this bit is set. Software must ensure that the PCLKP domain version of this signal is asserted for at least 3 clock cycles. This bit has read/write access. PRnW Processor Read not Write 19 The processor controls this bit. The bit is HIGH when the Processor Access to the probe is a write, and it is LOW when Processor Access to the probe is a read. PrAcc Processor Access 18 The processor sets this bit to 1 whenever the processor accesses the probe. The probe must clear this bit to 0 to acknowledge the end of the transaction. The probe cannot set this bit. This bit has read/write-0 access. Programmer's Model DmaAcc DMA Access 17 The probe sets this bit to 1 whenever a probe-initiated DMA access starts. The probe clears this bit when the DMA is completed. This bit has read/write access. PrRst Processor Reset 16 Setting this bit to 1 causes a Soft Reset to the CPU. Setting this bit to 1 in the DJ_TCKP domain eventually sets a similar bit in the PCLKP domain. The reset signal to the processor is sustained as long as this bit remains set. Software must ensure that the PCLKP domain version of this reset signal is asserted for at least 3 clock cycles. Assertion of this reset is not masked by the MRst bit in the Debug Control register. This bit has read/write access. ProbEn Probe Enable 15 The probe software sets this bit to 1 to indicate that the probe is present. When the bit is 0, any software accesses to the probe return 0s on a load or fetch, and they have no effect on a store. This bit also controls the Debug Exception Vector location. (See the table below.) In addition, when this bit is 0, it disables the DCLKP signal. If this bit is cleared while a probe access is in progress (for example, a CPU load from the probe), the access terminates gracefully with invalid data. This bit has read/write access. SetDEV ProbEn = 0 ProbEn = 1 SetDEV = 0 0xBFC0.0400 0xFF20.0200 SetDEV = 1 0xBFC0.0400 0xBFC0.0400 SetDEV Set Debug Exception Vector 14 Setting this bit to 1 overrides the ProbEn bit and forces the debug exception vector to 0xBFC0.0400. When the SetDEV bit is cleared, the ProbEn bit determines the debug exception vector. (See the table above.) The SetDEV bit has read/write access. 0 DMA Abort 13 This bit is hardwired to 0 because the EZ4021-FC does not support aborted DMA requests. Attempts to set this bit are ignored. This bit has read-only access. EJTAG Debugging 3-45 EjtagBrk EJTAG Break 12 When set, this bit causes a debug exception to the CPU. Any of the following conditions set this bit: * The probe writes 1 to this bit. * The probe asserts the DJ_TDIP_DINTN input signal when in PC Trace mode. * An external module asserts the DJ_DBGBRKP input signal. The probe can only set this bit when the system is not in debug mode; it cannot clear this bit to 0. Hardware clears this bit after the debug exception is taken. If the CPU is in the WAITI state when a debug exception occurs, the CPU wakes up. This bit has read/write-1 access. 3-46 Dstrt DMA Start/Busy 11 The probe writes to this bit to initiate the DMA. All other registers must be set up before asserting this bit. The probe can only write a 1 to this register, and only if DmaAcc (bit 17) is also set; a write of 0 is ignored. After this bit is set and DMA is initiated, the probe polls this bit to determine if the DMA has finished. Once the DMA is finished, the hardware clears the bit, which indicates the DMA completion. This bit has read/write-1 access. Derr DMA Error 10 The EZ4021-FC sets this bit to 1 if any device reports an error during a DMA transaction. Typically, this is done for a bus error condition, which is generated when the BIU detects a bus error on a DMA transaction. In addition, this bit is set if an illegal DMA size or alignment is detected. This bit has read-only access. Drwn DMA Read/Write Not 9 This bit indicates the transaction type for the next DMA. When set, it indicates a DMA read is next. When cleared, it indicates a DMA write is next. This bit has read/write access. Dsz Data Transfer Size [8:7] The bits in this field indicate which byte lanes are active for the DMA or for processor access of the EJTAG probe. These bits are combined with the endian setting and the Programmer's Model three LSBs of the EAR to determine the byte lanes for the transaction. The bits have the effect shown in Figure 3.32. All other combinations are reserved. These bits have read/write access. Figure 3.32 Byte Lane Significance and Dsz Definition EAR [2:0] 000 001 010 011 100 101 110 111 000 010 100 110 000 001 010 011 100 101 110 111 000 010 100 110 111 Little Endian Big Endian 0 63 Dsz 63 00 00 00 00 00 00 00 00 01 01 01 01 10 10 10 10 10 10 10 10 11 11 11 11 11 0 Dlock DMA Lock 5 When set to 1, this bit indicates that the next DMA transaction requires a bus lock (to support atomic operations). For an atomic operation, the BIU asserts a Quick Bus lock, and the CPU stalls to prevent corruption of caches, etc. by the CPU. This bit has read/write access. Dinc DMA Address Pre-Increment 4 When set, this bit causes the value in the EAR to increment once by a value of 8. Repetitive increments require repetitive setting of the bit. The value of the bit is saved to be read; it is not cleared after the increment. This bit has read/write access. EJTAG Debugging 3-47 3-48 BrkSt Break Status 3 This bit is a DJ_TCKP domain version of the DM bit in the CP0 Debug register. The bit is set upon entering debug mode, and it is cleared when executing the DERET instruction. This bit has read-only access. TIF DMA Test Input Flag 2 If DMA is required for a device not sitting on the bus, such as a CPU internal register, software must use semaphores to indicate properly when the DMA takes place. If data is available in the predefined memory location, the probe sets the TIF bit. The probe can only set the TIF bit; it cannot clear it. The TIF bit is only cleared after the data in the memory location is placed in the proper location. At this point, the CPU clears the TIF bit in the Debug Control register. (See page 3-60.) These two TIF bits are the same, but in different clock domains. The CPU can only clear the TIF bit; it cannot set the bit. This bit is also available for generic purposes that are independent of DMA operations. This bit has read/write-1 access. TOF DMA Test Output Flag 1 This bit is similar to the TIF bit, but it is for data transfers from the CPU to the probe. If data is available in the predefined memory location, the processor sets the TOF bit in the Debug Control register. (See page 3-61.) Only the processor can set the TOF bit, but the processor cannot clear the bit. This bit is not cleared until after the probe receives the memory data. At this point, the probe clears the TOF bit in the ECR. The two TOF bits are the same, but they are in different clock domains. The probe can only clear the TOF bit; it cannot set the bit. In addition, this bit is also available for generic purposes that are independent of DMA operations. This bit has read/write-0 access. ClkEn DCLKP Output Enable 0 This bit controls the EZ4021-FC DCLKP signal output. When set, the bit enables DCLKP toggling. When cleared, the bit forces the DCLKP pin to 0. This bit has read/write access. Programmer's Model 3.3.3 EJTAG CP0 Registers The following registers are additions to the System Coprocessor (CP0) register set: * Debug Register (23) (Debug) * Debug Exception Program Counter (DEPC) Register (24) * Debug Exception Save (DESAVE) Register (31) 3.3.3.1 Debug Register (23) (Debug) The Debug register controls and reports status on debug exceptions. Typically, the debug exception handler reads and interprets all the bits in this register when a debug exception occurs. All read-only status bits are updated every time a debug exception is taken. In Debug mode, the individual register bits determine register access; when not in Debug mode, access is read only. Some reserved bits are always read only. The Debug register has an initialization value of 0x0000.0000.0000.0000. Figure 3.33 shows the register format. EJTAG Debugging 3-49 Figure 3.33 Debug Register (23) (Debug) 63 48 R 47 32 R 31 30 29 28 27 DBD DM R0 LSNM 15 14 13 12 11 10 9 8 7 6 5 4 R0 NIS TRS OES TLF BsF R0 SSt ERst 0 DINT DIB R0 R 3-50 16 3 2 1 DDBS DDBL DBp 0 DSS Reserved [63:32] These bits contain different values depending on the instruction used to access them: Applicable Instructions Values or R/W Access MTCO Read-Only Access DMTCO Read-Only Access MFCO Contain Sign-Extended Value of DBD (Bit 31) DMFCO All 0s DBD Debug Branch Delay 31 This bit is set to a 1 if a debug exception occurs when executing an instruction in the branch delay slot. This bit is never set in conjunction with the DSS bit. (See bit 0.) This value is held from one debug exception to the next, even through nondebug operation. This bit has read-only access. DM Debug Mode Status 30 This bit is set when a debug exception is taken. It is cleared upon return from the debug exception (DERET instruction). When this bit is set, all interrupts (including NMI) and all exceptions (except reset) are masked, including TLB exceptions, Bus Error exceptions, and debug exceptions. In addition, the cache line locking function is disabled. A copy of this bit is available as the BrkSt bit (bit 3 of the ECR) and the DT_PCST1 and Programmer's Model DT_PCST2 status lines (although these are in different clock domains). This bit has read-only access. R0 Reserved and 0 29, [27:15], 9 These bits are hardwired to 0s and read as 0s. The EZ4021-FC ignores attempts to set these bits. However, software should write 0s to them to ensure compatibility with future versions of the software. These bits have read-only access. LSNM Load/Store Normal Memory 28 When set to 1, the LSNM bit allows the processor to access normal memory during Debug mode when accessing addresses 0xFF20.0000-0xFF3F.FFFF. In Debug mode, the EJTAG probe or the EJTAG registers normally intercept these addresses. However, because these addresses are mapped to real physical memory during normal mode, the CPU also needs access to real physical memory during Debug Mode. The LSNM bit is cleared to 0 upon entering Debug mode, which causes the EJTAG registers and the EJTAG Memory module to respond to these addresses. Software should set this bit before a load or store operation and clear it immediately afterward. If the bit remains set after returning to normal mode, the bit has no effect, because it is used only in Debug mode. In addition, this bit has no effect on instruction fetches. It is only relevant for loads and stores. This bit has read/write access. NIS Nonmaskable Interrupt Status 14 When set, this bit indicates that a nonmaskable interrupt (NMI) occurred in the same cycle and in the same instruction as a debug exception. The Status, Cause, EPC, and BadVAddr registers assume the usual status after the occurrence of an NMI interrupt, but the address in the DEPC is not the NMI exception vector address (0xBFC0.0000). Instead, 0xBFC0.0000 is placed in the DEPC by the debug exception handler software, after which processing returns directly from the debug exception to the NMI interrupt handler. The value is held from one debug exception to the next, even through regular operation. This bit has read-only access. EJTAG Debugging 3-51 TRS 3-52 TLB Refill Exception Status 13 When set, this bit indicates that an (X)TLB Refill exception occurred in the same cycle and in the same instruction as a debug exception. The Status, Cause, EPC, and BadVAddr registers assume the usual status after the occurrence of an (X)TLB Refill exception, but the address in the DEPC is not the (X)TLB Refill exception vector address. Instead, the debug exception handler places an address (see the table below) in the DEPC, after which processing returns directly from the debug exception to the (X)TLB Refill exception handler. The value is held from one debug exception to the next, even through regular operation. This bit has read-only access. EXL = 0 EXL = 1 BEV = 0 0x8000.0000 0x8000.0180 BEV = 1 0xBFC0.0200 0xBFC0.0380 OES Other Exception Status 12 When set, this bit indicates that an exception other than Reset, NMI, or (X)TLB Refill occurred in the same cycle and in the same instruction as a debug exception. The Status, Cause, EPC, and BadVAddr registers assume the usual status after the occurrence of such an exception, but the address in the DEPC is not the general exception vector address. Instead, the debug exception handler places 0xBFC0.0380 (BEV = 1) or 0x8000.0180 (BEV = 0) in the DEPC, after which processing returns directly from the debug exception to the general-purpose exception handler. The value is held from one debug exception to the next, even through regular operation. This bit has read-only access. TLF TLB Exception Flag 11 When the debug exception handler is running (DM =1), this bit is set to 1 if a TLB-related exception occurs during execution of a load or store instruction. Write 0 to this bit to clear it; writing a 1 is ignored. This bit has read/write-0 access. Programmer's Model BsF Bus Error Exception Flag 10 When the debug exception handler is running (DM = 1), this bit is set to 1 if a Bus Error exception occurs during execution of a load or store instruction. Write a 0 to this bit to clear it; writing a 1 is ignored. This bit has read/write-0 access. SSt Single Step Enable 8 Setting this bit to 1 enables the single step debug function. The function is disabled in Debug mode (DM = 1). Entering Debug mode while SSt is set disables the single step function, but does not clear the SSt bit at that time. This bit has read/write access. ERst EJTAG Reset 7 Setting this bit to 1 resets the EJTAG interface (except the TAP controller and the EIR), EJTAG memory interfaces, the hardware break function, and the PC Trace function. The reset to these modules remains active until software clears the bit. This bit has read/write access. 0 Debug Complex Break Status 6 This bit is reserved. It is cleared to 0 to indicate that complex break functionality did not cause the latest debug exception. The EZ4021-FC ignores attempts to set this bit. Software should write this bit to 0 to ensure compatibility with future versions of the software. This bit has read-only access. DINT Debug Break Exception Status 5 This bit is set to 1 when an EJTAG Break from the processor probe causes a debug exception. The bit value is held from one debug instruction to the next, even through regular operation. This bit has read-only access. DIB Debug Instr Address Break Exception Status 4 This bit is set to 1 when an Instruction Address Break causes a debug exception. The bit value is held from one debug instruction to the next, even through regular operation. This bit has read-only access. DDBS Debug Data Break Store Exception Status 3 This bit is set to 1 when a Data Address Break causes the debug exception during the execution of a store instruction. This bit has read-only access. EJTAG Debugging 3-53 DDBL Debug Data Break Load Exception Status 2 This bit is set to 1 when a Data Address Break causes the debug exception during the execution of a Load instruction. The bit value is held from one Debug instruction to the next, even through regular operation. This bit has read-only access. DBp Debug Breakpoint Exception Status 1 This bit is set to 1 when an SDBBP instruction causes the debug exception. The bit value is held from one debug instruction to the next, even through regular operation. This bit has read-only access. DSS Debug Single Step Exception Status 0 This bit is set to 1 when a single step causes the debug exception. The bit value is held from one debug instruction to the next, even through regular operation. The DSS bit never sets in conjunction with the DBD bit. The DSS bit has read-only access. 3.3.3.2 Debug Exception Program Counter (DEPC) Register (24) The DEPC register holds the address where processing resumes after the debug exception routine has finished, unless the NIS, OES, or TRS bits of the Debug register are set. (See the Debug register description for details.) The address in the DEPC register is the virtual address of the instruction that either caused the debug exception or was executing at the time of the debug exception. If the instruction is in a branch delay slot, the virtual address of the immediately preceding branch or jump instruction is placed into this register. Execution of the DERET instruction causes a jump to the address in the DEPC. If the DEPC address points to an SDBBP instruction, the DEPC value might need to be modified to avoid re-executing the SDBBP instruction. If the SDBBP was inserted in place of a regular instruction to cause a debug break, then replace the SDBBP with the original instruction, and no adjustment of the DEPC value is required. If the DEPC is both written from software (by MTC0) and by hardware (debug exception), then the DEPC holds the value generated by the hardware. The DEPC has no initialization value. 3-54 Programmer's Model The DEPC has read/write access in debug mode and read-only access in nondebug mode. Some reserved bits are read only. Figure 3.34 shows the register format. Figure 3.34 Debug Exception Program Counter (DEPC) Register (24) 63 32 R 31 2 DEPC R 1 0 RS DEI Reserved [63:32] These bits contain different values depending on the instruction used to access them: Applicable Instructions Values and R/W Access MTCO Read-Only Access DMTCO Read-Only Access MFCO Contain Sign-Extended Value of Bit 31 (Bits [63:32]) DMFCO All 0s (Bits [63:32]) DEPC Debug Exception Program Counter [31:2] These bits contains the virtual address of the instruction executing at the time of the debug instruction or the address of the immediately preceding branch or jump. If the TRS, OES, or NIS bit in the Debug register is set, an interpreted value must be placed in the DEPC instead. RS Reserved Special 1 This bit is reserved and not hardwired. It is cleared to 0 after the first debug exception. This bit has meaning in other EJTAG implementations, so software should write this bit to 0 to ensure compatibility with future versions of the software. Maintaining a value of X or setting this bit to 1 can cause undefined operation. DEI Debug Exception ISA Mode 0 This bit is reserved and not hardwired. It is cleared to 0 after the first debug exception. This bit has meaning in EJTAG Debugging 3-55 other EJTAG implementations, so software should write this bit to 0 to ensure compatibility with future versions of the software. An attempt to set this bit to 1 can cause undefined operation. 3.3.3.3 Debug Exception Save (DESAVE) Register (31) To make sure the debug exception handler is noninvasive, the entire General Purpose registers (GPR) set must be saved to memory before the handler executes. The debug exception handler uses the DESAVE register to save one of the GPRs. That GPR can hold the memory address where the debug exception handler saves the remaining context in a predetermined memory area. The DESAVE register enables safe debugging of exception handlers and other code in applications that do not have a valid stack for context saves. The DESAVE register has no initialization value. The register has read/write access in debug mode, and read-only access in nondebug mode. Figure 3.35 shows the register format. Figure 3.35 Debug Exception Save (DESAVE) Register (31) 63 32 DESAVE 31 0 DESAVE DESAVE 3-56 Debug Exception Save Register [63:0] The debug exception handler uses this register to save one of the GPRs. Programmer's Model Bits [63:32] of this register contain different values depending on the instruction used to access them as shown in the following table. Applicable Instructions Values and R/W Access MTCO Write all 64 bits DMTCO Write all 64 bits MFCO Bits 63:32 contain sign-extended value of bit 31 DMFCO Bits 63:32 are read directly 3.3.4 EJTAG Memory Mapped Registers Table 3.3 lists the EJTAG memory-mapped, 64-bit registers. These registers contain the data, address, control, and status of the break channels. Only the processor can access these registers when executing in Debug mode, but the EJTAG probe can access these registers at any time using DMA. The registers are noncached memory locations, although they fall into the kseg3 area. The virtual base address is the same as the physical base address (0xFF30.0000), plus the offset shown in Table 3.3. If an undefined register address within this address space is accessed and the processor is in debug mode, the result is undefined. Note: Some addresses that are unused on the EZ4021-FC have meaning in other EJTAG solutions. To assure correct operation on current and future systems, software should avoid writing to these registers because it can cause unexpected operation. If a write cannot be avoided, EJTAG Debugging 3-57 LS Logic recommends a write of all inactive register values as defined by the MIPS EJTAG Specification. Table 3.3 Memory-Mapped Registers Description Mnemonic Address Debug Control Register DCR 0xFF30.0000 Instruction Address Break Status IBS 0xFF30.0008 Data Address Break Status DBS 0xFF30.0010 ... ... ... Instruction Address Break 0 IBA0 0xFF30.0100 Instruction Address Break Control 0 IBC0 0xFF30.0108 Instruction Address Break Mask 0 IBM0 0xFF30.0110 Instruction Address Break 1 IBA1 0xFF30.0118 Instruction Address Break Control 1 IBC1 0xFF30.0120 Instruction Address Break Mask 1 IBM1 0xFF30.0128 Instruction Address Break 2 IBA2 0xFF30.0130 Instruction Address Break Control 2 IBC2 0xFF30.0138 Instruction Address Break Mask 2 IBM2 0xFF30.0140 Instruction Address Break 3 IBA3 0xFF30.0148 Instruction Address Break Control 3 IBC3 0xFF30.0150 Instruction Address Break Mask 3 IBM3 0xFF30.0158 ... ... ... Data Address Break 0 DBA0 0xFF30.0300 Data Address Break Control 0 DBC0 0xFF30.0308 (Sheet 1 of 2) 3-58 Programmer's Model Table 3.3 Memory-Mapped Registers (Cont.) Description Mnemonic Address Data Address Break Mask 0 DBM0 0xFF30.0310 Data Value Break 0 DB0 0xFF30.0318 Data Address Break 1 DBA1 0xFF30.0320 Data Address Break Control 1 DBC1 0xFF30.0328 Data Address Break Mask 1 DBM1 0xFF30.0330 Data Value Break 1 DB1 0xFF30.0338 (Sheet 2 of 2) 3.3.4.1 Debug Control Register (DCR) The DCR is part of the debug control mechanism that allows the processor and DMA to control debug operations. The DCR has an initialization value of 0b0000.0000.0000.0000.0000.0000.0000.0000.00x0.0000.0000.0000. 0000.0000.0001.1110, where x is don't care. The processor can access the DCR register only in Debug mode. Processor access requires using doubleword operations (such as LD or SD). Access is undefined for operations that are less than a doubleword. In either normal or Debug mode, the probe can do a DMA of this register when the DNM bit in the EJTAG Control register is cleared. In Debug mode bit access is defined individually. Figure 3.36 shows the register format. EJTAG Debugging 3-59 Figure 3.36 Debug Control Register (DCR) 63 32 R 31 30 29 DZS R ENM 28 7 R 6 4 3 2 TIF TOF MInt MNmi MP 1 0 R TM R Reserved [63:32], 30, [28:7], 1 These bits are hardwired to 0s and read as 0s. The EZ4021-FC ignores attempts to set these bits. However, software should write 0s to these bits to ensure compatibility with future versions of the software. These bits have read-only access. DZS Doze Status 31 The DZS bit indicates whether the EZ4021-FC was sleeping due to a WAITI instruction when the debug exception was taken. This bit has read-only access. ENM DZS Description 1 WAITI Active 0 WAITI Not Active Endian Setting 29 The ENM bit indicates the default endian setting. This bit has read-only access. ENM TIF Description 0 Little Endian 1 Big Endian Test Input Full 6 When set, this bit indicates that a Probe DMA write filled a predefined memory location (test input) that is known only to software. The processor can now read this memory location and write a 0 to this bit to indicate that the data was received. A write of 1 is ignored. This bit is one-half of the TIF mechanism, because the ECR also contains a TIF bit. This bit has read/write-0 access. 3-60 5 Programmer's Model TOF Test Output Full 5 When set, this bit indicates the CPU has filled a predefined memory location (test output) that is known only to software. The EJTAG probe can read this memory location. The processor can write a 1 to the TOF bit to indicate it initialized the memory location. Writing a 0 is ignored. The ECR also contains a TOF bit, which is the other half of the TOF mechanism. This bit has read/write-1 access. MInt Mask Interrupts 4 Setting MInt to 1 enables the EZ4021-FC interrupt inputs (int[5:0]). Clearing this bit to 0 disables the EZ4021-FC interrupt inputs (int[5:0]). In debug mode, the EZ4021-FC masks all interrupt inputs. This bit has read/write access. MNmi Mask Nonmaskable Interrupt 3 Setting MNmi to 1 enables the NMI interrupt input. Clearing the bit disables the NMI interrupt input. This bit only applies during nondebug mode. In debug mode, the NMI is masked. This bit is read/write. MP Memory Protection 2 In Debug mode, setting the MP bit to 1 inhibits writes to EJTAG memory-mapped registers or EJTAG-reserved areas (0xFF20.0000-0xFF3F.FFFF), except to the Debug Control register. Clearing this bit to 0 in Debug mode enables writes to these registers and reserved areas. In normal mode, the MP bit can be set or cleared, but the state of the bit has no effect. This bit has read/write access. TM Trace Mode 0 Setting this bit to 1 enables sending out the complete PC address as trace information on the DJ_TDOP_TPCP and DT_TPCLP[6:0] pins. In this case, real-time operation of the CPU cannot be guaranteed because pipeline stalls may be needed to output the complete address. When this bit is cleared, the PC trace information goes out in real time, but the output may be incomplete. This bit has read/write access. EJTAG Debugging 3-61 3.3.4.2 Instruction Address Break Status (IBS) The IBS register contains the status of the four possible Instruction Breakpoints (BS3, BS2, BS1, and BS0). The IBS has an initialization value of 0x0000.0000.4400.0000. The processor can access the IBS register only in Debug mode. Processor access requires using doubleword operations (such as LD or SD). Access is undefined for operations that are less than a doubleword. If the MP bit in the DCR register is set, processor writes in Debug mode have no effect. In either normal or Debug mode, the probe can do a DMA of this register when the DNM bit in the EJTAG Control register is cleared. In Debug mode, bit access is defined individually. Figure 3.37 shows the register format. Figure 3.37 Instruction Address Break Status (IBS) Register 63 32 R 31 30 29 28 27 R 1 3-62 R 24 23 4 0100 R 3 2 1 0 BS3 BS2 BS1 BS0 R Reserved [63:31], [29:28], [23:4] These bits are hardwired to 0s and read as 0s. The EZ4021-FC ignores attempts to set these bits. However, software should write 0s to them to ensure compatibility with future versions of the software. These bits have read-only access. 1 ASID Support in Instruction Break 30 This bit is hardwired to 1. It indicates that the EZ4021-FC supports comparison of the ASID value in Instruction Address Break to allow debug and breakpoints in a multitasking environment. 0100 Break Channel Number [27:24] These bits indicate the total number of channels implemented for an instruction address break. The EZ4021-FC supports four instruction address break channels, so it returns a value of 0b0100. These bits have read-only access. Programmer's Model BS3 Break Status Channel 3 3 When BS3 is set, it indicates that an instruction address break or instruction address trigger occurred for channel 3. To clear this bit to 0, write a 0 to BS3. Writing a 1 has no effect. This bit has read/write access. BS2 Break Status Channel 2 2 When BS2 is set, it indicates that an instruction address break or instruction address trigger occurred for channel 2. To clear this bit to 0, write a 0 to BS2. Writing a 1 has no effect. This bit has read/write access. BS1 Break Status Channel 1 1 When BS1 is set, it indicates that an instruction address break or instruction address trigger occurred for channel 1. To clear this bit to 0, write a 0 to BS1. Writing a 1 has no effect. This bit has read/write access. BS0 Break Status Channel 0 0 When BS0 is set, it indicates that an instruction address break or instruction address trigger occurred for channel 0. To clear this bit to 0, write a 0 to BS0. This bit has read/write access. 3.3.4.3 Instruction Address Break n Registers (IBAn) These registers contain the upper 31 bits of the instruction break address, which is a virtual address. There are four registers, one for each instruction address break channel. The IBAn registers have no initialization value. The processor can access the IBAn registers only in Debug mode. Processor access requires using doubleword operations (such as LD or SD). Access is undefined for operations that are less than a doubleword. In Debug mode, all bits except the reserved bits have read/write access. If the MP bit in the DCR register is set, processor writes in Debug mode have no effect. In either normal or Debug mode, the probe can do a DMA of these registers when the DNM bit in the EJTAG Control register is cleared. Figure 3.38 shows the register format. EJTAG Debugging 3-63 Figure 3.38 Instruction Address Break n Register (IBAn) 63 32 R 31 1 IBA 0 RS R R Reserved [63:32], 0 These bits are hardwired to 0s and read as 0s. The EZ4021-FC ignores attempts to set these bits. However, software should write 0s to them to ensure compatibility with future versions of the software. These bits have read-only access. IBA Instruction Break Address [31:2] This field contains the 30-bit instruction break address, which is a virtual address. These bits are read/write. RS Reserved Special 1 The RS bit is reserved and not hardwired. This bit has meaning in other EJTAG implementations, so software should write this bit to 0 to ensure compatibility with future versions of the software. Trying to set this bit to 1 can cause undefined operation. This bit has read/write access. 3.3.4.4 Instruction Address Break Control n Registers (IBCn) These registers select the instruction address match function to enable debug break or trace trigger. There are four IBCn registers, one for each Instruction Address Break channel. These registers have an initialization value of 0x0000.0000.0000.0000. The processor can access the IBCn registers only in Debug mode. Processor access requires using doubleword operations such as LD or SD. Access is undefined for operations that are less than a doubleword. If the MP bit in the DCR register is set, processor writes in Debug mode have no effect. In either normal or Debug mode, the probe can do a DMA of these registers when the DNM bit in the EJTAG Control register is cleared. In Debug mode all bits have read/write access except the reserved bits. Figure 3.39 shows the register format. 3-64 Programmer's Model Figure 3.39 Instruction Address Break Control n Register (IBCn) 63 32 R 31 24 ASID 23 22 3 ASIDuse R 2 1 0 TE R BE R Reserved [63:32], [22:3], 1 These bits are hardwired to 0s and read as 0s. The EZ4021-FC ignores attempts to set these bits. However, software should write 0s to them to ensure compatibility with future versions of the software. These bits have read-only access. ASID ASID Value [31:24] This field contains a value that is compared with the PID information from the MMU to qualify an instruction address break. This field has read/write access. ASIDuse ASID Use in Break 23 Setting this bit to 1 enables comparison of the value in the ASID field with the PID information from the MMU to qualify the instruction break address. When this bit is cleared, it disables the ASID-to-PID comparison. This bit has read/write access. TE Trace Trigger Enable 2 Setting this bit to 1 enables the instruction address trace trigger function. Clearing this bit to 0 disables the instruction address trace trigger function. This bit has read/write access. If the trace trigger function is enabled, and the CPU virtual instruction address matches the address set by the IBAn and IBMn registers, the trace trigger information - TST (0b010) or TSQ (0b001) - is output to the DT_PCST2[2:0] or DT_PCST1[2:0] pins. In addition the BSn bit in the Instruction Address Break Status register is set. When an address match occurs with both BE and TE equal to 1, the Instruction Address break exception is taken after the trace trigger information is output to the DT_PCST2[2:0] or DT_PCST1[2:0] pins. EJTAG Debugging 3-65 BE Break Enable 0 Setting this bit to 1 enables the instruction address break function. Clearing this bit to 0 disables the instruction address break function. This bit has read/write access. If the instruction address break function is enabled, and the CPU virtual instruction address matches the address set by the IBAn and IBMn registers, the hardware generates a debug exception to the CPU. The BSn bit in the Instruction Address Break Status register sets to 1, which indicates the cause of the debug exception. 3.3.4.5 Instruction Address Break Mask n Registers (IBMn) These four registers specify the mask values that apply to each corresponding Instruction Address Break register. These registers have no initialization value. The processor can access the IBMn registers only in Debug mode. Processor access requires using doubleword operations such as LD or SD. Access is undefined for operations that are less than a doubleword. If the MP bit in the DCR register is set, processor writes in Debug mode have no effect. In either normal or Debug mode, the probe can do a DMA of these registers when the DNM bit in the EJTAG Control register is cleared. In Debug mode all register bits except the reserved bits have read/write access. Figure 3.40 shows the register format. Figure 3.40 Instruction Address Break Mask n Registers (IBMn) 63 32 R 31 2 IBM R 3-66 1 0 RS R Reserved [63:32], 0 These bits are hardwired to 0s and read as 0s. The EZ4021-FC ignores attempts to set these bits. However, software should write 0s to them to ensure compatibility with future versions of the software. These bits have read-only access. Programmer's Model IBM Instruction Address Break Mask [31:2] This field contains the 30-bit instruction address break mask. Each bit corresponds to a bit in the address register (IBAn). When a mask bit is cleared, the EZ4021-FC compares the corresponding address bit in the IBAn register with the CPU virtual address bit. When a mask bit is set, the corresponding IBAn address bit is masked (not compared). These bits have read/write access. RS Reserved Special 1 The RS bit is reserved and not hardwired. This bit has meaning in other EJTAG implementations, so software should write this bit to 0 to ensure compatibility with future versions of the software. Trying to set this bit to 1 can cause undefined operation. This bit has read/write access. 3.3.4.6 Data Address Break Status Register (DBS) The Data Address Break Status register contains the status of the two possible Data Breakpoints, BS1 and BS0. This register has an initialization value of 0b0000.0000.0000.0000.0000.0000.0000.0000.0101.0010.0000.0000.00 00.0000.0000.0000 The processor can access the DBS register only in Debug mode. Processor access requires using doubleword operations such as LD or SD. Access is undefined for operations that are less than a doubleword. If the MP bit in the DCR register is set, processor writes in Debug mode have no effect. The probe can do a DMA of these registers in either Debug or normal mode when the DNM bit in the EJTAG Control register is cleared. In Debug mode the bits in this register are defined individually. Figure 3.41 shows the register format. EJTAG Debugging 3-67 Figure 3.41 Data Address Break Status Register (DBS) 63 32 R 31 30 29 28 27 R 1 R 1 24 23 2 0010 R 1 0 BS1 BS0 R Reserved [63:31], 29, [23:2] These bits are hardwired to 0s and read as 0s. The EZ4021-FC ignores attempts to set these bits. However, software should write 0s to them to ensure compatibility with future versions of the software. These bits have read-only access. 1 ASID Support in Data Break 30 This bit is hardwired to 1. It indicates that the EZ4021-FC supports using the ASID value (DBCn register, bits 31:24) for debugging and breakpoints in a multitasking environment. This bit has read-only access. 1 Data Break Enhancements 28 This bit is hardwired to 1. It indicates that the EZ4021-FC implements the data break enhancements. This bit has read-only access. 0010 Break Channel Number [27:24] These bits indicate the total number of channels implemented for a data address break. The bits are read-only. The EZ4021-FC supports two data address break channels and returns a value of 0b0010. 3-68 BS1 Break Status Channel 1 1 When set, this bit indicates that a data address break or data address trigger occurred for channel 1. To clear this bit to 0, write a 0 to BS1. This bit has read/write-0 access. BS0 Break Status Channel 0 0 When set, this bit indicates that a data address break or data address trigger occurred for channel 0. To clear this bit to 0, write a 0 to BS0. This bit has read/write-0 access. Programmer's Model 3.3.4.7 Data Break Address n Registers (DBAn) The DBAn registers contain the upper 29 bits of the data break address, which is a virtual address. There are two registers, one for each data break channel. Note that bits [2:0] of this register are tied to 0. It is therefore impossible to break on an address addressing less than a doubleword of data. Breaks on partial data are possible with use of the Byte Access Ignores. These registers have no initialization value. The processor can access the DBAn register only in Debug mode. Processor access requires using doubleword operations such as LD or SD. Access is undefined for operations that are less than a doubleword. If the MP bit in the DCR register is set, processor writes in Debug mode have no effect. In either normal or Debug mode, the probe can perform a DMA of this register when the DNM bit of the EJTAG Control register is cleared. In Debug mode all the bits in this register except the reserved bits have read/write access. Figure 3.42 shows the register format. Figure 3.42 Data Break Address n Registers (DBAn) 63 32 R 31 32 DBA R 0 R Reserved [63:32], [2:0] These bits are hardwired to 0s and read as 0s. The EZ4021-FC ignores attempts to set these bits. However, software should write 0s to them to ensure compatibility with future versions of the software. These bits have read-only access. These bits are not used in the address comparison because the EZ4021-FC uses 32-bit addressing. DBA Data Break Address [31:3] This field contains the 29-bit data break address, which is a virtual address and is doubleword aligned. These bits have read/write access. EJTAG Debugging 3-69 3.3.4.8 Data Break Control n Registers (DBCn) These registers select the data address match function to enable debug breaks or trace triggers. They also specify byte lane masks for data value comparison. There are two DBCn registers, one for each data break channel. These registers have an initialization value of 0x0000.0000.0000.0000. The processor can access these registers only in Debug mode. Processor access requires using doubleword operations (such as LD or SD). Access is undefined for operations that are less than a doubleword. If the MP bit in the DCR register is set, Debug mode processor writes have no effect. In normal or Debug mode, the probe can perform a DMA of these registers when the DNM bit of the EJTAG Control register is cleared. In Debug mode all the bits in these registers except the reserved bits have read/write access. Figure 3.43 shows the register format. Figure 3.43 Data Break Control n Registers (DBCn) 63 32 R 31 24 ASID 3-70 23 ASIDuse 22 21 R 14 BAI 13 12 NoSB NoLB 1 3 R 2 1 0 TE R BE R Reserved [63:32], 22, [11:3], 1 These bits are hardwired to 0s and read as 0s. The EZ4021-FC ignores attempts to set these bits. However, software should write 0s to them to ensure compatibility with future versions of the software. These bits have read-only access. ASID ASID Value [31:24] This field contains a value that is compared with the PID from the MMU to qualify a data break. This field has read/write access. ASIDuse ASID Use in Break 23 When set, this bit enables comparison of the value in the ASID field with the PID information from the MMU to qualify the data break address. When cleared, this bit disables the ASID-to-PID comparison. This bit has read/write access. Programmer's Model BAI Byte Access Ignored [21:14] Each bit in this field corresponds to a byte of the data being addressed. The BAI field is useful for accessing a portion of the data at the doubleword address. For example, when a word consists of four independent byte-wide control registers, it is desirable to set a break on writes to only one of the four registers, so the other three registers are set to be ignored using this field. When set to 1, the corresponding byte access is ignored and cannot result in a break, even if the data does not match. When cleared, the corresponding byte access can result in a break. The bits in this field have read/write access. BAI Bit Description BAI0 Byte Lane D[7:0] of the Data Value BAI1 Byte Lane D[15:8] of the Data Value ... BAI7 NoSB Byte Lane D[63:56] of the Data Value No Store Break 13 This bit disables data break store events. When set, the Data Break mechanism is disabled for stores, which results in no data break exceptions or trace triggers on store instructions. When cleared, these functions are enabled. This bit has read/write access. NoLB No Load Break 12 This bit disables data break load events. When set, the Data Break mechanism is disabled for loads, which results in no data break exceptions or trace triggers on load instructions. When cleared, these functions are enabled. This bit has read/write access. TE Trace Trigger Enable 2 When set, this bit enables the data trace trigger function. When cleared, this bit disables the data trace trigger function. This bit has read/write access. EJTAG Debugging 3-71 If the trace trigger function is enabled, and the CPU virtual data address matches the address set by the DBAn and DBMn registers, the trace trigger information - TST (0b010) or TSQ (0b001) - is output to the DT_PCST2[2:0] or DT_PCST1[2:0] pins. In addition, the BSn bit in the Data Address Break Status register is set. When an address match occurs with both BE and TE equal to 1, the Data Address break exception is taken after the trace trigger information is output to DT_PCST2[2:0] or DT_PCST1[2:0] pins. BE Break Enable 0 When set, this bit enables the data break function. When cleared, this bit disables the data break function. This bit has read/write access. If the data address break function is enabled and the CPU virtual data address matches the address set by the DBAn and DBMn registers, the hardware generates a debug exception to the CPU. The BSn bit in the Data Address Break Status register, along with the DDBS or DDBL bits in the Debug register, are set to indicate the cause of the debug exception. 3.3.4.9 Data Address Break Mask n Registers (DBMn) These registers specify the mask values that are applied to each corresponding Data Address Break register. There are two DBMn registers, one for each data break channel. These registers have no initialization value. The processor can access these registers only in Debug mode. Processor access requires using doubleword operations (such as LD or SD). Access is undefined for operations that are less than a doubleword. If the MP bit in the DCR register is set, processor writes in Debug mode have no effect. In either normal or Debug mode, the probe can do a DMA of these registers when the DNM bit of the EJTAG Control register is cleared. In Debug mode all the bits in these registers except the reserved bits have read/write access. Figure 3.44 shows the register format. 3-72 Programmer's Model Figure 3.44 Data Address Break Mask n Registers (DBMn) 63 32 R 31 32 DBM 0 R R Reserved [63:32], [2:0] These bits are hardwired to 0s and read as 0s. The EZ4021-FC ignores attempts to set these bits. However, software should write 0s to them to ensure compatibility with future versions of the software. These bits have read-only access. DBM Data Address Break Mask [31:3] This field contains the 29-bit data address break mask. Each bit corresponds to a bit in the address register (DBAn). When a mask bit is cleared, the EZ4021-FC compares the corresponding address bit in the DBAn register with the CPU virtual address bit. When a mask bit is set, the corresponding DBAn address bit is masked (not compared). These bits have read/write access. 3.3.4.10 Data Value Break n Registers (DVBn) The EZ4021-FC does not implement the data value comparison of the data address break. All registers that support that function are read-only and tied to 0. The processor can access these registers only in Debug mode. Processor access requires using doubleword operations (such as LD or SD). Access is undefined for operations that are less than a doubleword. If the MP bit in the DCR register is set, processor writes in Debug mode have no effect. In either normal or Debug mode, the probe can do a DMA of these registers when the DNM bit of the EJTAG Control register is cleared. In Debug mode all the bits in these registers are read/write. Figure 3.45 shows the register format. EJTAG Debugging 3-73 Figure 3.45 Data Value Break n Registers (DVBn) 63 32 R 31 0 R R Reserved [63:0] These bits are hardwired to 0 and read as 0s. The EZ4021-FC ignores attempts to set these bits. These bits have read-only access. 3.4 System Configuration Register 1 This read/write EZ4021-FC System Configuration register 1 is a memory-mapped register that allows for easy configuration of programmable system features. The lower word, bits [31:0], is output on the DHQ_SCR1[31:0] pins. Connect these output signals to system-level or EZ4021-FC configuration pins. The initialization value of this register is 0x0000.0000.0000.FFFF. Figure 3.46 shows the register format. Figure 3.46 System Configuration Register 1 63 32 SCR1 31 0 SCR1 SCR1 3-74 System Configuration [63:0] This register is located at physical address 0x1EFF.FFF0. Only the EZ4021-FC can read or write to the SCR1 register, and it must access the register using kseg1 Programmer's Model addresses per the table below. The upper word, bits [63:32], is reserved for future use. Big Endian Access Type Config[15] Address LW or SW 0 LW or SW 1 0xBEFF.FFF4 LD or SD x 0xBEFF.FFF0 System Configuration Register 1 0xBEFF.FFF0 3-75 3-76 Programmer's Model Chapter 4 Instruction Set Architecture This chapter provides the formats for the MIPS III ISA and describes the different instructions. It contains the following sections: * Section 4.1, "Instruction Set Formats" * Section 4.2, "Load and Store Instructions" * Section 4.3, "Computational Instructions" * Section 4.4, "Jump and Branch Instructions" * Section 4.5, "Exception Instructions" * Section 4.6, "Serialization Instruction" * Section 4.7, "Coprocessor Instructions" * Section 4.8, "Cache Maintenance Instruction" * Section 4.9, "EZ4021-FC Instruction Extensions" * Section 4.10, "CPU 32-Bit Instruction Opcode Encoding" 4.1 Instruction Set Formats Every instruction consists of a single word (32 bits) aligned on a word boundary. Figure 4.1 shows the three instruction formats: I-type (immediate), J-type (jump), and R-type (register). This restricted format approach simplifies instruction decoding. The compiler and assembler can synthesize more complicated operations and addressing modes. MiniRISC EZ4021-FC EasyMACRO Microprocessor 4-1 Figure 4.1 Instruction Format I-Type (Immediate) 31 26 25 op 21 20 rs 16 15 0 rt immediate J-Type (Jump) 31 26 25 0 target op R-Type (Register) 31 26 25 op 21 20 rs 16 15 rt 11 10 rd 6 shamt 5 0 funct op rs rt 6-bit operation code 5-bit source register specifier 5-bit target (source/destination register) immediate target rd shamt funct 16-bit immediate, branch displacement, or address displacement 26-bit jump target address 5-bit destination register specifier 5-bit shift amount 6-bit function field 4.2 Load and Store Instructions Load and Store are I-type instructions that move data between memory and general-purpose registers. The only addressing mode directly supported in the base R-Series architecture is base register plus 16-bit, signed immediate offset. 4.2.1 Scheduling a Load Delay Slot A delayed load instruction is a load instruction whose result cannot be used by the instruction that immediately follows it. The instruction slot immediately following a delayed load instruction is called the load delay slot. In the EZ4021-FC processor, the instruction immediately following a load instruction can use the contents of the loaded register; however, in such cases, hardware interlocks insert additional real cycles. Consequently, 4-2 Instruction Set Architecture scheduling load delay slots is desirable, both for performance and for compatibility with older MIPS R-Series processors. However, scheduling load delay slots is not required. 4.2.2 Defining Access Types The load/store instruction opcode determines the access type, which in turn indicates the size of the data item to be loaded or stored. Regardless of access type or byte-numbering order (endian setting), the address specifies the byte that has the smallest byte address of all the bytes in the addressed field. For a big-endian machine, this byte is the most-significant (left most) byte; for a little-endian machine, it is the least-significant (right most) byte. As Figure 4.2 shows, the access type and the 3 low-order bits of the address determine which bytes within the addressed word are used. Note that certain combinations of access type and low-order address bits can never occur; only the combinations shown in Figure 4.2 are permitted. Load and Store Instructions 4-3 Figure 4.2 Byte Specifications for Loads/Store Data Bus Big Endian Little Endian 63 Access Type Low-Order Address Bits A2 A1 A0 Doubleword Septibyte Sextibyte Quintibyte Word Tribyte Halfword Byte 4-4 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 1 1 0 0 0 1 0 0 0 0 0 0 0 1 1 0 0 1 0 1 0 0 0 0 1 0 1 0 0 1 1 0 0 0 0 0 0 1 0 0 1 1 0 1 1 0 0 1 0 1 1 1 1 1 0 1 0 63 0 Byte Numbers 0 1 MSB 2 3 4 5 Byte Numbers 6 Bytes Accessed Instruction Set Architecture 7 LSB 7 6 MSB 5 4 3 2 1 Bytes Accessed 0 LSB 4.2.3 CPU Loads and Stores There are different types of load and store instructions. The purpose of the different types are as follows: * Transferring various sized fields (for example, LB or SW) * Trading transferred data as signed or unsigned integers (for example, LHU) * Accessing unaligned fields (for example, LWR or SWL) * Performing atomic memory updates (read-modify-write, for example, LL/SC) Signed and unsigned integers of different sizes are supported by loads that either sign-extend or 0-extend the data loaded into the register. Table 4.1 describes the normal load and store instructions that the EZ4021-FC supports. The syntax for each instruction is shown in a typeface that differs from the surrounding text; for example, the Load Byte operation is shown as LB rt, offset(base). Load and Store Instructions 4-5 Table 4.1 Normal CPU Load/Store Instructions Instruction Format and Description Load Byte LB rt, offset(base) MIPS I Sign-extend the 16-bit offset and add to the contents of register base to form address. Sign-extend the contents of the addressed byte and load the result into rt. Load Byte Unsigned LBU rt, offset(base) MIPS I Sign-extend the 16-bit offset and add to the contents of register base to form address. Zero-extend the contents of the addressed byte and load the result into rt. Load Doubleword LD rt, offset(base) MIPS III Sign-extend the 16-bit offset and add to the contents of register base to form address. Load the addressed doubleword into rt. Load Halfword LH rt, offset(base) MIPS I Sign-extend the 16-bit offset and add to the contents of register base to form address. Sign-extend the contents of the addressed halfword and load the result into rt. Load Halfword Unsigned LHU rt, offset(base) MIPS I Sign-extend the 16-bit offset and add to the contents of register base to form address. Zero-extend the contents of the addressed halfword and load the result into rt. Load Word LW rt, offset(base) MIPS I Sign-extend the 16-bit offset and add to the contents of register base to form address. Sign-extend the contents of the addressed word and load the result into rt. Load Word Unsigned LWU rt, offset(base) MIPS III Sign-extend the 16-bit offset and add to the contents of register base to form address. Load the addressed word into rt. Store Byte SB rt, offset(base) MIPS I Sign-extend the 16-bit offset and add to the contents of register base to form address. Store the least-significant byte of register rt at the addressed location. Store Doubleword SD rt, offset(base) MIPS III Sign-extend the 16-bit offset and add to the contents of register base to form address. Store the contents of register rt at the addressed location. Store Halfword SH rt, offset(base) MIPS I Sign-extend the 16-bit offset and add to the contents of register base to form address. Store the least-significant halfword of register rt at the addressed location. Store Word SW rt, offset(base) MIPS I Sign-extend the 16-bit offset and add to the contents of register base to form address. Store the least-significant word of register rt at the addressed location. 4-6 Instruction Set Architecture A pair of special instructions make it possible to load or store unaligned words and doublewords in only two instructions. The load instructions read the left-side or right-side bytes (left or right side of register) from an aligned word and merge them into the correct bytes of the destination register. MIPS I, which prohibits other use of loaded data in the load delay slot, permits LWL and LWR instructions that target the same destination register to execute sequentially. Store instructions select the correct bytes from a source register and update only those bytes in an aligned memory word (or doubleword). Table 4.2 describes the unaligned load and store instructions that the EZ4021-FC supports. Load and Store Instructions 4-7 Table 4.2 Unaligned CPU Load/Store Instructions Instruction Format and Description Load Doubleword Left LDL rt, offset(base) MIPS III Sign-extend the 16-bit offset and add to the contents of register base to form address. Shift the addressed doubleword left so that the addressed byte is the rightmost byte of a doubleword. Merge the bytes from memory with the contents of register rt and load the result into register rt. Load Doubleword RIght LDR rt, offset(base) MIPS III Sign-extend the 16-bit offset and add to the contents of register base to form address. Shift addressed doubleword right so that the addressed byte is the leftmost byte of a doubleword. Merge bytes from memory with contents of register rt and load the result into register rt. Load Word Left LWL rt, offset(base) MIPS I Sign-extend the 16-bit offset and add to the contents of register base to form address. Shift the addressed word left so that the addressed byte is the leftmost byte of a word. Merge the bytes from memory with the contents of register rt and load the sign-extended result into register rt. Load Word Right LWR rt, offset(base) MIPS I Sign-extend the 16-bit offset and add to the contents of register base to form address. Shift the addressed word right so that the addressed byte is the rightmost byte of a word. Merge the bytes from memory with the contents of register rt and load the sign-extended result into register rt. Store Doubleword Left SDL rt, offset(base) MIPS III Sign-extend the 16-bit offset and add to the contents of register base to form address. Shift the contents of register rt left so that the leftmost byte of the doubleword is in the position of the addressed byte. Store the doubleword containing the shifted bytes into the doubleword at the addressed byte. Store Doubleword Right SDR rt, offset(base) MIPS III Sign-extend the 16-bit offset and add to the contents of register base to form address. Shift contents of register rt right so that the rightmost byte of the doubleword is in the position of the addressed byte. Store the doubleword containing the shifted bytes into the doubleword at the addressed byte. Store Word Left SWL rt, offset(base) MIPS I Sign-extend the 16-bit offset and add to the contents of register base to form address. Shift the contents of register rt left so that the leftmost byte of the word is in the position of the addressed byte. Store the word containing the shifted bytes into the word at the addressed byte. Store Word Right SWR rt, offset(base) MIPS I Sign-extend the 16-bit offset and add to the contents of register base to form address. Shift the contents of register rt right so that the rightmost byte of the word is in the position of the addressed byte. Store the word containing the shifted bytes into the word at the addressed byte. 4-8 Instruction Set Architecture 4.2.4 Atomic Update Loads and Stores The paired instructions, Load Linked and Store Conditional, can perform read-modify-writes of word and doubleword cached memory locations. When used in carefully-coded sequences, these instructions provide one of several synchronization primitives, including test-and-set, bit-level locks, semaphores, and sequencers/event counters. The LL and SC block size is 1 doubleword, and the data must be either uncached or cached coherent. Cached coherent means cached with write-through store updates. Table 4.3 describes the atomic update CPU load and store instructions that the EZ4021-FC supports. Table 4.3 Atomic Update CPU Load/Store Instructions Instruction Format and Description Load Linked Word LL rt, offset(base) MIPS II Sign-extend the 16-bit offset and add to the contents of register base to form address. Sign-extend the contents of the addressed word and load the result into rt. Load Linked Doubleword LLD rt, offset(base) MIPS III Sign-extend the 16-bit offset and add to the contents of register base to form address, and load the addressed doubleword into rt. Store Conditional Word SC rt, offset(base) MIPS II Sign-extend the 16-bit offset and add to the contents of register base to form address. Conditionally store the least-significant word of register rt at address, based on whether the load-link has been "broken." Store Conditional Doubleword SCD rt, offset(base) MIPS III Sign-extend the 16-bit offset and add to the contents of register base to form address. Conditionally store register rt at address, based on whether the load-link has been "broken." 4.2.5 Coprocessor Loads and Stores The coprocessor load and store instructions are included here instead of the coprocessor instruction group (page 4-24) because it is more useful to include all load and store instructions in the same section. If a particular coprocessor is not enabled, any loads and stores to that processor cannot execute and instead cause a Coprocessor Unusable exception. Load and Store Instructions 4-9 Table 4.4 describes the coprocessor load and store instructions that the EZ4021-FC supports. Table 4.4 Coprocessor Load/Store Instructions Instruction Format and Description Load Doubleword to Coprocessor LDCz rt, offset(base) MIPS II Extends the sign of the 16-bit offset and adds the offset to the contents of the general register base to form a 32-bit, unsigned effective address. The doubleword at the memory location specified is loaded into coprocessor register rt of the coprocessor unit z. Load Word to Coprocessor LWCz rt, offset(base) MIPS I Extends the sign of the 16-bit offset and adds the offset to the contents of the general register base to form a 32-bit, unsigned effective address. The word at the memory location specified is sign-extended and loaded into coprocessor register rt of the coprocessor unit z. Store Doubleword from Coprocessor SDCz rt, offset(base) MIPS II Extends the sign of the 16-bit offset and adds the offset to the contents of the general register base to form a 32-bit, unsigned effective address. The contents of coprocessor register rt of the coprocessor unit z are stored at the address specified by the 32-bit, unsigned effective address. Store Word from Coprocessor SWCz rt, offset(base) MIPS I Extends the sign of the 16-bit offset and adds the offset to the contents of the general register base to form a 32-bit, unsigned effective address. The least-significant word of coprocessor register rt of the coprocessor unit z is stored at the address specified by the 32-bit, unsigned effective address. 4.3 Computational Instructions Computational instructions perform signed/unsigned arithmetic, logical, and shift operations. Computational instructions use both R-type (both operands are registers) and I-type (one operand is an immediate). There are four categories of computational instructions: 4-10 * ALU Immediate (Table 4.5) * Three-Operand, Register Type (Table 4.6) * Shift (Table 4.7) * Multiply and Divide (Table 4.8) Instruction Set Architecture MIPS I provides for 32-bit integers and 32-bit arithmetic operands. MIPS III adds 64-bit integers and provides separate arithmetic and shift instructions for 64-bit operands. Separate instructions for 64-bit logical operations are not needed, because logical operations are not sensitive to the register width. The EZ4021-FC performs twos-complement arithmetic on integers represented in twos-complement notation. The EZ4021-FC includes instructions for signed versions of add, subtract, multiply, and divide. The unsigned add and subtract operations are actually modulo arithmetic without overflow detection. 4.3.1 ALU Some arithmetic and logical instructions operate on one operand from a register and the other from a 16-bit immediate value in the instruction word. The immediate operand is treated as signed for the arithmetic and compare instructions, and treated as logical (0-extended to register length) for the logical instructions. Computational Instructions 4-11 Table 4.5 describes the ALU instructions with immediate operands supported by the EZ4021-FC. Table 4.5 ALU Instructions with an Immediate Operand Instruction Format and Description Add Immediate ADDI rt, rs, immediate MIPS I Add the 16-bit, sign-extended immediate to the 32-bit value in register rs and place the 32-bit, sign-extended result into register rt. Trap on 32-bit, twos-complement overflow. Add Immediate Unsigned ADDIU rt, rs, immediate MIPS I Add the 16-bit, sign-extended immediate to the 32-bit value in register rs and place the 32-bit, sign-extended result into register rt. Do not trap on overflow. Doubleword Add Immediate DADDI rt, rs, immediate MIPS III Add the 16-bit, sign-extended immediate to the 64-bit value in register rs and place the 64-bit result into register rt. Trap on 64-bit, twos-complement overflow. Doubleword Add Immediate Unsigned DADDIU rt, rs, immediate MIPS III Add the 16-bit, sign-extended immediate to the 64-bit value in register rs and place the 64-bit, sign-extended result into register rt. Do not trap on overflow. AND Immediate ANDI rt, rs, immediate MIPS I Zero-extend the 16-bit immediate and perform a bit-wise AND with the contents of register rs. Place the result into register rt. Load Upper Immediate LUI rt, immediate MIPS I The 16-bit immediate is shifted left 16 bits and concatenated with 16 bits of low-order 0s. The 32-bit result is sign-extended and placed into register rt. OR Immediate ORI rt, rs, immediate MIPS I Zero-extend the 16-bit immediate and perform a bit-wise OR with contents of register rs. Place the result into register rt. Set on Less Than Immediate SLTI rt, rs, immediate MIPS I Compare the 16-bit, sign-extended immediate with register rs as signed integers. Result = 1 if rs is less than immediate; otherwise, the result = 0. Place the result into register rt. Set on Less Than Immediate Unsigned SLTIU rt, rs, immediate MIPS I Compare the 16-bit, sign-extended immediate with register rs as unsigned integers. Result = 1 if rs is less than immediate; otherwise the result = 0. Place the result into register rt. Exclusive OR Immediate XORI rt, rs, immediate MIPS I Zero-extend the 16-bit immediate and perform a bit-wise exclusive OR with the contents of register rs. Place the result into register rt. 4-12 Instruction Set Architecture 4.3.2 Three-Operand, Register Type Table 4.6 describes the EZ4021-FC ALU instructions that require three operands. Table 4.6 Three-Operand, Register Type Instructions Instruction Format and Description Add ADD rd, rs, rt MIPS I Add the 32-bit contents of registers rs and rt, then place the 32-bit, sign-extended result into register rd. Trap on 32-bit, twos-complement overflow. Add Unsigned ADDU rd, rs, rt MIPS I Add the 32-bit contents of registers rs and rt, then place the 32-bit, sign-extended result into register rd. Do not trap on overflow. AND AND rd, rs, rt MIPS I Bitwise AND the contents of registers rs and rt, then place the result into register rd. Doubleword Add DADD rd, rs, rt MIPS III Add the 64-bit contents of registers rs and rt, then place the 64-bit result into register rd. Trap on 64-bit, twos-complement overflow. Doubleword DADDU rd, rs, rt MIPS III Add Unsigned Add the 64-bit contents of registers rs and rt, then place the 64-bit result into register rd. Do not trap on overflow. Doubleword Subtract DSUB rd, rs, rt MIPS III Subtract the 64-bit contents of register rt from rs, then place the 64-bit result into register rd. Trap on 64-bit, twos-complement overflow. Doubleword Subtract Unsigned DSUBU rd, rs, rt MIPS III Subtract the 64-bit contents of register rt from rs, then place the 64-bit result into register rd. Do not trap on overflow. NOR NOR rd, rs, rt MIPS I Bitwise NOR the contents of registers rs and rt, then place the result into register rd. OR OR rd, rs, rt MIPS I Bitwise OR the contents of registers rs and rt, then place the result into register rd. Set on Less Than SLT rd, rs, rt MIPS I Compare the contents of register rt to register rs (as signed integers). If register rs is less than rt, rd = 1; otherwise, rd = 0. (Sheet 1 of 2) Computational Instructions 4-13 Table 4.6 Three-Operand, Register Type Instructions (Cont.) Instruction Format and Description Set on Less Than Unsigned SLTU rd, rs, rt MIPS I Compare the contents of register rt to register rs (as unsigned integers). If register rs is less than rt, rd = 1; otherwise, rd = 0. Subtract SUB rd, rs, rt MIPS I Subtract the 32-bit contents of register rt from rs, then place the 32-bit, sign-extended result into register rd. Trap on 32-bit, twos-complement overflow. Subtract Unsigned SUBU rd, rs, rt MIPS I Subtract the 32-bit contents of register rt from rs, then place the 32-bit, sign-extended result into register rd. Do not trap on overflow. Exclusive OR XOR rd, rs, rt MIPS I Bitwise exclusive OR the contents of registers rs and rt, then place the result into register rd. (Sheet 2 of 2) 4.3.3 Shift The EZ4021-FC instruction set includes shift instructions that get the shift amount from a 5-bit field in the instruction word and other shift instructions that get the shift amount from the low-order bits of a general register. The instructions with a fixed shift amount are limited to a 5-bit shift count, so there are separate instructions for doubleword shifts of 0 to 31 bits and of 32 to 63 bits (for example, DSLL and DSLL32). 4-14 Instruction Set Architecture Table 4.7 describes the EZ4021-FC shift instructions. Table 4.7 Shift Instructions Instruction Format and Description Doubleword Shift Left Logical DSLL rd, rt, shamt MIPS III Shift the 64-bit, doubleword contents of register rt left by shamt bits, inserting 0s into the low-order bits. The bit shift count specified in shamt is in the range of 0 to 31 bits. The 64-bit result is placed into register rd. Doubleword Shift Left Logical Plus 32 DSLL32 rd, rt, shamt MIPS III Shift the 64-bit, doubleword contents of register rt left by shamt+32 bits, inserting 0s into the low-order bits. The bit shift count specified in shamt+32 is in the range of 32 to 63 bits. The 64-bit result is placed into register rd. Doubleword Shift Right Arithmetic DSRA rd, rt, shamt MIPS III Shift the 64-bit, doubleword contents of register rt right by shamt bits, sign-extending the high-order bits. The bit shift count specified in shamt is in the range of 0 to 31 bits. The 64-bit result is placed into register rd. Doubleword Shift Right Arithmetic Plus 32 DSRA32 rd, rt, shamt MIPS III Shift the 64-bit, doubleword contents of register rt right by shamt+32 bits, sign-extending the high-order bits. The bit shift count specified in shamt+32 is in the range of 32 to 63 bits. The 64-bit result is placed into register rd. Doubleword Shift Right Logical DSRL rd, rt, shamt MIPS III Shift the 64-bit, doubleword contents of register rt right by shamt bits, inserting 0s into the high-order bits. The bit shift count specified in shamt is in the range of 0 to 31 bits. The 64-bit result is placed into register rd. Doubleword Shift Right Logical Plus 32 DSRL32 rd, rt, shamt MIPS III Shift the 64-bit, doubleword contents of register rt right by shamt+32, inserting 0s into the high-order bits. The bit shift count specified in shamt+32 is in the range of 32 to 63 bits. The 64-bit result is placed into register rd. Doubleword Shift Left Logical Variable DSLLV rd, rt, rs MIPS III Shift the 64-bit, doubleword contents of register rt left. The low-order 6 bits of register rs specify the number of bits to shift, inserting 0s into the low-order bits of rt. The 64-bit result is placed into register rd. Doubleword Shift Right Logical Variable DSRLV rd, rt, rs MIPS III Shift the contents of the low-order, 32-bit word of register rt right. The low-order 5 bits of register rs specify the number of bits to shift, inserting 0s into the high-order bits of rt. The 32-bit result is sign-extended and placed into register rd. Doubleword Shift Right Arithmetic Variable DSRAV rd, rt, rs MIPS III Shift the 64-bit, doubleword contents of register rt right. The low-order 6 bits of register rs specify the number of bits to shift while sign-extending the high-order bits of rt. The 64-bit result is placed into register rd. (Sheet 1 of 2) Computational Instructions 4-15 Table 4.7 Shift Instructions (Cont.) Instruction Format and Description Shift Word Left Logical SLL rd, rt, shamt MIPS I Shift the contents of the low-order, 32-bit word of register rt left by shamt bits, inserting 0s into the low-order bits. The 32-bit result is sign-extended and placed into register rd. Shift Word Right Logical SRL rd, rt, shamt MIPS I Shift the contents of the low-order, 32-bit word of register rt right by shamt bits, inserting 0s into the high-order bits. The 32-bit result is sign-extended and placed into register rd. Shift Word Right Arithmetic SRA, rd, rt, shamt MIPS I Shift the contents of the low-order, 32-bit word of register rt right by shamt bits, sign-extending the high-order bits. The 32-bit result is sign-extended and placed into register rd. Shift Word Left Logical Variable SLLV rd, rt, rs MIPS I Shift the contents of the low-order, 32-bit word of register rt left. The low-order 5 bits of register rs specify the number of bits to shift, inserting 0s into the loworder bits of rt. The 32-bit result is sign-extended and placed into register rd. Shift Word Right Arithmetic Variable SRAV rd, rt, rs MIPS I Shift the contents of the low-order, 32-bit word of register rt right. The low-order 5 bits of register rs specify the number of bits to shift while sign-extending the high-order bits of rt. The 32-bit result is sign-extended and placed into register rd. Shift Word Right Logical Variable SRLV rd, rt, rs MIPS I Shift the contents of the low-order, 32-bit word of register rt right. The low-order 5 bits of register rs specify the number of bits to shift, inserting 0s into the high-order bits of rt. The 32-bit result is sign-extended and placed into register rd. (Sheet 2 of 2) 4.3.4 Multiply and Divide The multiply and divide instructions produce twice as many result bits as is typical with other instructions, and they deliver their results into the HI and LO special registers. Multiply produces a full-width product that is twice the width of the input operands; the low half of the product is put in LO and the high half is put in HI. Divide produces both a quotient in LO and a remainder in HI. The results are accessed by instructions that transfer data between HI/LO and the general-purpose registers. 4-16 Instruction Set Architecture Table 4.8 describes the integer multiply and divide instructions along with the HI/LO data movement instructions supported by the EZ4021-FC. Table 4.8 Multiply and Divide Instructions Instruction Format and Description Doubleword Divide DDIV rs, rt MIPS III Divide the 64-bit word value in register rs by the 64-bit word value in rt, treating both as twos-complement values. The 64-bit quotient is placed into special register LO. The 64-bit remainder is placed into special register HI. Doubleword DDIVU rs, rt MIPS III Divide Unsigned Divide the 64-bit word value in register rs by the 64-bit word value in rt, treating both as unsigned values. The 64-bit quotient is placed into special register LO. The 64-bit remainder is placed into special register HI. Divide Word DIV rs, rt MIPS I Divide the 32-bit word value in register rs by the 32-bit word value in rt, treating both as twos-complement values. The 32-bit quotient is sign-extended and placed into special register LO. The 32-bit remainder is sign-extended and placed into special register HI. Divide Word Unsigned DIVU rs, rt MIPS I Divide the 32-bit word value in register rs by the 32-bit word value in rt, treating both as unsigned values. The 32-bit quotient is sign-extended and placed into special register LO. The 32-bit remainder is sign-extended and placed into special register HI. Doubleword Multiply DMULT rs, rt MIPS III Multiply the 64-bit word values in registers rs and rt as twos-complement values. The low-order, 64-bit doubleword of the result is placed into special register LO. The high-order, 64-bit word is placed into special register HI. Doubleword Multiply Unsigned DMULTU rs, rt MIPS III Multiply the 64-bit word values in registers rs and rt as unsigned values. The low-order, 64-bit word of the result is placed into special register LO. The high-order, 64-bit word is placed into special register HI. (Sheet 1 of 2) Computational Instructions 4-17 Table 4.8 Multiply and Divide Instructions (Cont.) Instruction Format and Description Move from HI MFHI rd Move contents of special register HI to register rd. MIPS I Move from LO MFLO rd Move contents of special register LO to register rd. MIPS I Move to HI MTHI rs Move contents of register rs to special register HI. MIPS I Move to LO MTLO rs Move contents of register rs to special register LO. MIPS I Multiply Word MULT rs, rt MIPS I Multiply the 32-bit word values in registers rs and rt as twos-complement values. The low-order, 32-bit word of the result is sign-extended and placed into special register LO. The high-order, 32-bit word is sign-extended and placed into special register HI. Multiply Word Unsigned MULTU rs, rt MIPS I Multiply the 32-bit word values in registers rs and rt as unsigned values. The low-order, 32-bit word of the result is sign-extended and placed into special register LO. The high-order, 32-bit word is sign-extended and placed into special register HI. (Sheet 2 of 2) Table 4.9 shows the execution times (in clock cycles) of the multiply and divide instructions. Table 4.9 Execution Time of Multiply and Divide Instructions 32 Bit Operation 64 Bit R3000 CW33300 R4000 EZ4021-FC R4000 EZ4021-FC Multiply 12 1 + (Bits/3) 10 5/6 20 9/10 Divide 34 34 69 34 133 66 4-18 Instruction Set Architecture 4.4 Jump and Branch Instructions Jump and branch instructions change the control flow of a program. MIPS I jump and branch instructions always occur with a one-instruction delay. The instruction immediately following the jump or branch is always executed while the target instruction is being fetched from storage. There may be additional cycle penalties, depending on circumstances and implementation, but the penalties are interlocked in hardware. The MIPS II ISA extensions add the branch likely class of instructions that operate exactly like their unlikely counterparts, except that when the branch is not taken, the instruction following the branch is cancelled. The J-type instruction format is used for both jump and jump-and-link instructions for subroutine calls. In the J-type format, the 26-bit target address is shifted left 2 bits and combined with the 4 high-order bits of the current program counter to form a 32-bit absolute address. The R-type instruction format, which takes a 32-bit byte address contained in a register, is used for returns, dispatches, and cross-page jumps. Branches have 16-bit signed offsets relative to the program counter (I-type). Jump-and-link and branch-and-link instructions save a return address in register 31. Jump and Branch Instructions 4-19 Table 4.10 summarizes the R-Series jump instructions, Table 4.11 summarizes the branch instructions, and Table 4.12 summarizes the Branch Likely instructions. Table 4.10 Jump Instructions Instruction Format and Description Jump J target MIPS I Shift the 26-bit, target address left 2 bits, combine with the 4 high-order bits of PC, and jump to the address with a one-instruction delay. Jump and Link JAL target MIPS I Shift the 26-bit, target address left 2 bits, combine with the 4 high-order bits of PC, and jump to the address with a one-instruction delay. Place the address of the instruction following the delay slot in register 31 (link register). Jump and Link Register JALR rs, rd MIPS I Jump to the address contained in register rs with a one-instruction delay. Place the address of the instruction following the delay slot in rd. Jump Register JR rs MIPS I Jump to the address contained in register rs with a one-instruction delay. Table 4.11 PC-Relative Conditional Branch Instructions Instruction Format and Description Branch on Equal BEQ rs, rt, offset MIPS I Branch to the target address1 if register rs is equal to register rt. Branch on Greater Than or Equal to Zero BGEZ rs, offset MIPS I Branch to the target address if register rs is greater than or equal to 0. Branch on Greater Than or Equal to Zero and Link BGEZAL rs, offset MIPS I Place the address of the instruction following the delay slot into register 31 (link register). Branch to the target address if register rs is greater than or equal to 0. Branch on Greater Than Zero BGTZ rs, offset Branch to the target address if register rs is greater than 0. Branch on Less Than or Equal to Zero BLEZ rs, offset MIPS I Branch to the target address if register rs is less than or equal to 0. Branch on Less Than Zero BLTZ rs, offset Branch to the target address if register rs is less than 0. 4-20 Instruction Set Architecture MIPS I MIPS I Table 4.11 PC-Relative Conditional Branch Instructions Instruction Format and Description Branch on Less Than Zero and Link BLTZAL rs, offset MIPS I Place the address of the instruction following the delay slot into register 31 (link register). Branch to the target address if register rs is less than 0. Branch on Not Equal BNE rs, rt, offset MIPS I Branch to the target address if register rs does not equal register rt. 1. All branch-instruction target addresses are computed as follows: add the address of the instruction in the delay slot and the 16-bit offset (shifted left 2 bits and sign-extended to 32 bits). All branches occur with a delay of one instruction. Table 4.12 PC-Relative Conditional Branch Likely Instructions Instruction Format and Description Branch on Equal Likely BEQL rs, rt, offset MIPS II Branch to the target address1 if register rs is equal to register rt. Branch on Greater than or Equal to Zero and Link Likely BGEZALL rs, offset MIPS II Place the address of the instruction following the delay slot into register 31 (link register). Branch to the target address if register rs is greater than or equal to 0. Branch on Greater than or Equal to Zero Likely BGEZL rs, offset MIPS II Branch to the target address if register rs is greater than or equal to 0. Branch on Greater Than Zero Likely BGTZL rs, offset Branch to the target address if register rs is greater than 0. Branch on Less than or Equal to Zero Likely BLEZL rs, offset MIPS II Branch to the target address if register rs is less than or equal to 0. Branch on Less Than Zero And Link Likely BLTZALL rs, offset MIPS II Place the address of the instruction following the delay slot into register 31 (link register). Branch to the target address if register rs is less than 0. Jump and Branch Instructions MIPS II 4-21 Table 4.12 PC-Relative Conditional Branch Likely Instructions Instruction Format and Description Branch on Less BLTZL rs, offset Than Zero Likely Branch to the target address if register rs is less than 0. Branch on Not Equal Likely MIPS II BNEL rs, rt, offset MIPS II Branch to the target address if register rs does not equal register rt. 1. All branch-instruction target addresses are computed as follows: add the address of the instruction in the delay slot and the 16-bit offset (shifted left 2 bits and sign-extended to 32 bits). All branches occur with a delay of one instruction. 4.5 Exception Instructions Exception instructions cause an exception that transfers control to a software exception handler in the kernel. System call and breakpoint instructions cause exceptions unconditionally. The trap instructions cause exceptions conditionally based on the result of a comparison. Table 4.13 describes the Break and Syscall instructions, and Table 4.14 summarizes the trap instructions. Table 4.13 Breakpoint and System Call Instructions Instruction Format and Description System Call SYSCALL MIPS I Initiates system call trap, immediately transferring control to exception handler. Breakpoint BREAK MIPS I Initiates breakpoint trap, immediately transferring control to exception handler. 4-22 Instruction Set Architecture Table 4.14 Trap-on-Condition Instructions Instruction Format and Description Trap on Equal TEQ rs, rt Trap if register rs is equal to register rt. MIPS II Trap on Equal Immediate TEQI rs, immediate Trap if register rs is equal to the immediate value. MIPS II Trap on Greater Than or Equal TGE rs, rt Trap if register rs is greater than or equal to register rt. MIPS II Trap on Greater Than or Equal Immediate TGEI rs, immediate MIPS II Trap if register rs is greater than or equal to the immediate value. Trap on Greater Than or Equal Unsigned TGEU rs, rt Trap if register rs is greater than or equal to register rt. Trap on Greater Than or Equal Immediate Unsigned TGEIU rs, immediate MIPS II Trap if register rs is greater than or equal to the immediate value. Trap on Less Than TLT rs, rt Trap if register rs is less than register rt. MIPS II Trap on Less Than Immediate TLTI rs, immediate Trap if register rs is less than the immediate value. MIPS II Trap on Less Than Unsigned TLTU rs, rt Trap if register rs is less than register rt. MIPS II Trap on Less Than Immediate Unsigned TLTIU rs, immediate Trap if register rs is less than the immediate value. MIPS II MIPS II Trap If Not Equal TNE rs, rt Trap if register rs is not equal to rt. MIPS II Trap If Not Equal Immediate MIPS II TNEI rs, immediate Trap if register rs is not equal to the immediate value. Exception Instructions 4-23 4.6 Serialization Instruction The architecture does not specify the order in which memory accesses from load and store instructions appear outside the processor executing them. The Sync instruction creates a point in the executing instruction stream where the relative order of some loads and stores is known. Loads and stores executed before the Sync are completed before loads and stores after the Sync can start, as shown in Table 4.15. Table 4.15 Serialization Instruction Instruction Format and Description Synchronize Shared Memory SYNC MIPS II Complete all outstanding load and store instructions before allowing any new load or store instructions to start. 4.7 Coprocessor Instructions Coprocessors are alternate execution units with register files separate from the CPU. The EZ4021-FC supports external (on-chip) coprocessors and implements the coprocessor instruction set. This section includes descriptions of coprocessor data movement and conditional branch instructions, as well as the System Control Coprocessor (CP0) instructions. For descriptions of the Coprocessor load and store instructions, see Table 4.4 on page 4-10. 4.7.1 Coprocessor Data Movement and Conditional Branch Instructions Table 4.16 summarizes the general coprocessor to/from CPU data movement and conditional branch instructions. 4-24 Instruction Set Architecture Table 4.16 Coprocessor Data Movement and Conditional Branch Instructions Instruction Format and Description Branch on Coprocessor z False (Likely) BCzF offset, (BCzFL offset) Compute a branch target address by adding the address of the instruction to the 16-bit offset (shifted left 2 bits and sign-extended to 32 bits). Branch to the target address (with a delay of one instruction) if the coprocessor z's condition line is false. In the case of Branch Likely, the delay slot instruction is not executed when the branch is not taken. Branch on Coprocessor z True (Likely) BCzT offset, (BCzTL offset) Compute a branch target address by adding the address of the instruction to the 16-bit offset (shifted left 2 bits and sign-extended to 32 bits). Branch to the target address (with a delay of one instruction) if coprocessor z's condition line is true. In the case of Branch Likely, the delay slot instruction is not executed when the branch is not taken. Move Control from Coprocessor CFCz rt, rd Loads the contents of the control register rd of coprocessor unit z into general register rt. Coprocessor Operation COPz cofun Initiates a coprocessor operation that may specify and reference the coprocessor's internal registers or change the state of the coprocessor's condition line, but does not change the state within the processor or the cache memory. Move Control to Coprocessor CTCz rt, rd Loads the contents of general register rt into the control register rd of coprocessor unit z. Doubleword Move to Coprocessor DMTCz rt, rd Loads the 64-bit contents of general register rt into the rd register of coprocessor unit z. Doubleword Move from Coprocessor DMFCz rt, rd Loads the 64-bit contents of the rd register of coprocessor unit z into general register rt. Move to Coprocessor MTCz rt, rd Loads the contents of general register rt into the rd register of coprocessor unit z. Move from Coprocessor MFCz rt, rd Loads the sign-extended contents of the rd register of coprocessor unit z into general register rt. Coprocessor Instructions 4-25 4.7.2 System Control Coprocessor (CP0) Instructions Coprocessor 0 instructions perform operations on the system control coprocessor (CP0) registers to manipulate the memory management and exception-handling facilities of the processor. Table 4.17 summarizes the CP0 instructions. Table 4.17 CP0 Instructions Instruction Format and Description Exception Return ERET Loads the PC from ErrorEPC (SR2 = 1: Error Exception) or EPC (SR2 = 0: Exception) and clear ERL bit (SR2 = 1) or EXL bit (SR2 = 0) in the Status register. SR2 is Status register bit 2. Move from CP0 MFC0 rt, rd Loads the sign-extended contents of CP0 register rd into CPU register rt. Move to CP0 MTC0 rt, rd Loads contents of CPU register rt into CP0 register rd. Probe TLB for Matching Entry1 TLBP Loads the Index register with the address of the TLB entry whose contents match the EntryHi and EntryLo registers. If no TLB entry matches, sets the high-order bit of the Index register. Read Indexed TLB Entry1 TLBR Loads EntryHi and EntryLo with the TLB entry pointed to by the Index register. Write Indexed TLB Entry1 TLBWI Loads TLB entry pointed to by the Index register with the contents of the EntryHi and EntryLo registers. Write Random TLB Entry1 TLBWR Loads TLB entry pointed to by the Random register with the contents of the EntryHi and EntryLo registers. 1. If the MMU is disabled, these instructions effectively become NOPs. 4-26 Instruction Set Architecture 4.8 Cache Maintenance Instruction The cache maintenance instruction uses an I-type format. A 16-bit offset is sign-extended and added to the 32-bit word contents of a base register value to form a virtual address. The TLB translates this virtual address to a physical address, and the 5-bit subopcode specifies a cache operation for that address. Table 4.18 summarizes this instruction. Table 4.18 Cache Maintenance Instruction Instruction Format and Description CACHE CACHE op, offset(base) The 16-bit offset is sign-extended and added to the 32-bit word contents of a base register value to form an effective address. The effective address can be translated to a physical address using the TLB, and the 5-bit op field specifies a cache operation. The following pages provide more detail on the cache maintenance operations supported by the EZ4021-FC processor. Cache Maintenance Instruction 4-27 CACHE Cache Maintenance Instruction Format 31 26 25 21 20 16 15 0 CACHE base op offset 101111 base op offset Syntax CACHE op, offset(base) Description The 16-bit offset is sign-extended and added to the 32-bit contents of a base register value to form an effective address (EAddr). The effective address is used in one of two ways depending on the operation to be performed. * Index Operations Index operations use part of the effective address to specify a cache block (line). The EZ4021-FC primary instruction and data caches are two-way set-associative, 16 Kbyte memories (8 Kbytes per set) with eight 32-bit words (32 bytes) per cache block. Therefore, to index a cache block, effective address bits EAddr[12:5] specify the desired block within a cache set while EAddr13 specifies which cache set to access. Figure 4.3 shows the format of an Index effective address. Figure 4.3 Index Effective Address Format 31 14 13 12 unused * way 54 block index 0 byte index Address Operations Address operations use the effective address to access the cache if there is a cache hit. To check for a cache hit or miss, the effective address is translated into a physical address (PAddr) and compared with the cache tag. For a cache hit, the specified block must be present in the cache and valid; otherwise, no operation is performed. 4-28 Instruction Set Architecture TLB Refill and TLB Invalid exceptions can occur on any operation. For Index operations (where the physical address is used to index the cache but need not match the cache tag), unmapped addresses can be used to avoid TLB exceptions. Using the CACHE instruction on an uncached address produces undefined results. Bits [20:16] of the CACHE instruction specify the cache operation. Table 4.19 defines the cache operation codes. Using the CACHE instruction with any operation code other than those listed in Table 4.19 produces undefined results. Cache write-back operations from a primary cache go to memory. Note: Table 4.19 All Invalidate operations also clear the Line Lock bit. Cache Operation Code Definitions Op Value Op Type Description 0b00000 Index I-Cache Index Invalidate Sets the cache state of the specified cache block to invalid. 0b00001 Index D-Cache Index Write-Back and Invalidate For write-back cache operation: If the state of the cache block at the specified index is valid and the dirty bit is set, write the block back to memory. The system address to write is taken from the primary cache tag. Set the cache state of the primary cache block to invalid. If the block is valid but not dirty, set the state of the block to invalid. For write-through cache operation: Set the state of the cache block at the specified index to invalid. 0b00100 Index I-Cache Index Load Tag Read the tag from the instruction cache block at the specified index and place into the TagLo and TagHi CP0 registers. 0b00101 Index D-Cache Index Load Tag Read the tag from the data cache block at the specified index and place into the TagLo and TagHi CP0 registers. If a D-Cache Index Store Tag or D-Cache Hit Invalidate instruction precedes a D-Cache Index Load Tag instruction, make sure there is at least one instruction between the Store Tag/Hit Invalidate and the load tag instruction. Otherwise, the D, LL, and LRU bits in the TagLo register are corrupted. (Sheet 1 of 3) Cache Maintenance Instruction 4-29 Table 4.19 Cache Operation Code Definitions (Cont.) Op Value Op Type Description 0b01000 Index I-Cache Index Store Tag Write the tag for the instruction cache block at the specified index from the TagLo and TagHi CP0 registers. 0b01001 Index D-Cache Index Store Tag Write the tag for the data cache block at the specified index from the TagLo and TagHi CP0 registers. 0b01101 Address D-Cache Create Dirty Exclusive This operation is used to avoid loading data needlessly from memory when writing new contents into an entire cache block. If the cache block does not contain the specified address and the block is dirty, write it back to memory. In all cases, set the cache block tag to the specified physical address, and set the cache state to Dirty Exclusive. 0b10000 Address I-Cache Hit Invalidate If the instruction cache block contains the specified address, mark the cache block invalid. 0b10001 Address D-Cache Hit Invalidate If the data cache block contains the specified address, mark the cache block invalid. 0b10100 Address Fill Primary I-Cache Block Fill the primary instruction cache block from the specified address. If the instruction cache already contains a valid block at the specified address, set the state to locked. 0b10101 Address D-Cache Hit Write-Back and Invalidate For write-back cache operation: If the cache block contains the specified address and is valid and dirty, write-back the data to memory and mark the block invalid. If the block is valid but not dirty, set the state of the block to invalid. For write-through cache operation: If the cache block contains the specified address, set the state of the cache block to invalid. 0b11001 Address D-Cache Hit Write-Back For write-back cache operation: If the cache block contains the specified address and is valid and dirty, write the contents back to memory. After the operation is complete, leave the state of the block valid, but clear the dirty state. For write-through cache operation: This operation may be considered as an NOP. (Sheet 2 of 3) 4-30 Instruction Set Architecture Table 4.19 Cache Operation Code Definitions (Cont.) Op Value Op Type Description 0b11100 Address I-Cache Fetch and Lock If the instruction cache does not contain the specified address, fill it from memory and set the state of the block to valid and locked. If the instruction cache already contains a valid block at the specified address, set the state to locked. The locked state may be cleared by executing an Index Invalidate or Hit Invalidate to the locked block, or through an Index Store Tag operation that clears the Lock bit. 0b11101 Address D-Cache Load and Lock If the data cache does not contain the specified address, fill it from memory, performing a write-back if required, and set the state of the block to valid and locked. If the data cache already contains a valid block at the specified address, set its state to locked. The lock state may be cleared by executing an Index Invalidate, Hit Invalidate, or Hit Write-Back Invalidate to the locked block, or using an Index Store Tag operation that clears the Lock bit. (Sheet 3 of 3) Operation T: vAddr <- ((offset15)16 || offset15..0) + GPR[base]31..0 pAddr, uncached) <- Address Translation(vAddr, DataReadRef) CacheOp(op,vAddr,pAddr) Exceptions Coprocessor Unusable TLB Refill TLB Invalid Cache Maintenance Instruction 4-31 4.9 EZ4021-FC Instruction Extensions This section describes the EZ4021-FC instruction extensions. The extensions consist of EJTAG, Multiply-Accumulate, and power savings support instructions. Tables 4.20 and 4.21 provide a summary of the general and CP0 instruction extensions. A full description of each instruction follows the summary tables. 4.9.1 General 32-Bit Instruction Extensions Table 4.20 summarizes the non-CP0 specific instruction extensions added to the EZ4021-FC. Table 4.20 General Instruction Extensions Instruction Format and Description Multiply Add MADD rs, rt Multiply the values in registers rs and rt as 32-bit, twos-complement values. When the operation completes, the doubleword result is added to the special register pair HI/LO. The low-order, 32 bits of the addition result are sign-extended and placed into special register LO. The high-order, 32 bits are sign-extended and placed into special register HI. Multiply Add Unsigned MADDU rs, rt Multiply the values in registers rs and rt as 32-bit, unsigned values. When the operation completes, the doubleword result is added to the special register pair HI/LO. The low-order, 32 bits of the addition result are sign-extended and placed into special register LO. The high-order, 32 bits are sign-extended and placed into special register HI. Multiply MUL rd, rs, rt Multiply the 32-bit word values in registers rs and rt as twos-complement values. When the operation completes, the low-order, 32-bit word of the result is sign-extended and placed back into the general-purpose register specified by rd. Multiply Subtract MSUB rs, rt Multiply the values in registers rs and rt as 32-bit, twos-complement values. When the operation completes, the doubleword result is subtracted from the special register pair HI/LO. The low-order, 32 bits of the subtract result are sign-extended and placed into special register LO. The high-order, 32 bits are sign-extended and placed into special register HI. (Sheet 1 of 2) 4-32 Instruction Set Architecture Table 4.20 General Instruction Extensions (Cont.) Instruction Format and Description Multiply Subtract Unsigned MSUBU rs, rt Multiply the values in registers rs and rt as 32-bit, unsigned values. When the operation completes, the doubleword result is subtracted from the special register pair HI/LO. The low-order, 32 bits of the subtract result are sign-extended and placed into special register LO. The high-order, 32 bits are sign-extended and placed into special register HI. Software Debug Breakpoint SDBBP This instruction raises a Debug Breakpoint exception, passing control to an exception handler. (Sheet 2 of 2) 4.9.2 CP0 Instruction Extensions Table 4.21 summarizes the two new CP0 extensions. Table 4.21 CP0 Instruction Extensions Instruction Format and Description Debug Exception Return DERET The return address stored in the DEPC register is copied to the PC, and processing returns to the original program. The Debug Mode bit (bit 30 in the Debug Register) and the BrkSt bit (bit 3 in the EJTAG Control register) are cleared. Wait for Interrupt WAITI Stops execution of instructions and puts the processor in a power save (stall) condition until a hardware interrupt, NMI, or reset occurs. EZ4021-FC Instruction Extensions 4-33 MADD Multiply Add Format 31 26 25 21 20 16 15 6 5 0 SPECIAL2 rs rt 0 MADD 011100 rs rt 0000000000 000000 Syntax MADD rs, rt Description The contents of general register rs and rt are multiplied, treating both operands as 32-bit, twos-complement values. No integer overflow exception occurs under any circumstances. In 64-bit mode the operands must be valid 32-bit, sign-extended values. When the operation completes, the doubleword result is added to the special register pair HI/LO. The low-order, 32 bits of the addition result are sign-extended and placed into special register LO. The high-order, 32 bits are sign-extended and placed into special register HI. MADD executes in 5 to 6 cycles, depending on the operand data. Operation T: temp <- (HI31..0 || LO31..0) + ((rs31)32 || rs31..0) x ((rt31)32 || rt31..0) HI <- (temp63)32 || temp63..32 LO <- (temp31)32 || temp31..0 Exceptions None 4-34 Instruction Set Architecture MADDU Multiply Add Unsigned Format 31 26 25 21 20 16 15 6 5 0 SPECIAL2 rs rt 0 MADDU 011100 rs rt 0000000000 000001 Syntax MADDU rs, rt Description The contents of general register rs and rt are multiplied, treating both operands as unsigned values. No integer overflow exception occurs under any circumstances. In 64-bit mode the operands must be valid 32-bit, sign-extended values. When the operation completes, the doubleword result is added to the special register pair HI/LO. The low-order, 32 bits of the addition result are sign-extended and placed into special register LO. The high-order, 32 bits are sign-extended and placed into special register HI. MADDU executes in 5 to 6 cycles, depending on the operand data. Operation T: temp <- (HI31..0 || LO31..0) + ((031)32 || rs31..0) x ((031)32 || rt31..0) HI <- (temp63)32 || temp63..32 LO <- (temp31)32 || temp31..0 Exceptions None EZ4021-FC Instruction Extensions 4-35 MUL Multiply Format 31 26 25 21 20 16 15 11 10 6 5 0 SPECIAL2 rs rt rd 0 MUL 011100 rs rt rd 00000 000010 Syntax MUL rd, rs, rt Description The contents of general register rs and rt are multiplied, treating both operands as 32-bit, twos-complement values. No integer overflow exception occurs under any circumstances. In 64-bit mode the operands must be valid 32-bit, sign-extended values. When the operation completes, the low-order, 32 bits of the doubleword result are sign-extended and placed into general register rd. MUL executes in 5 cycles. Operation T: temp <- rs31..0 x rt31..0 rd <- (temp31)32 || temp31..0 HI <- undefined LO <- undefined Exceptions None 4-36 Instruction Set Architecture MSUB Multiply Subtract Format 31 26 25 21 20 16 15 6 5 0 SPECIAL2 rs rt 0 MSUB 011100 rs rt 0000000000 000100 Syntax MSUB rs, rt Description The contents of general register rs and rt are multiplied, treating both operands as 32-bit, twos-complement values. No integer overflow exception occurs under any circumstances. In 64-bit mode the operands must be valid 32-bit, sign-extended values. When the operation completes, the doubleword result is subtracted from the special register pair HI/LO. The low-order, 32 bits of the subtract result are sign-extended and placed into special register LO. The high-order, 32 bits are sign-extended and placed into special register HI. MSUB executes in 5 to 6 cycles, depending on the operand data. Operation T: temp <- (HI31..0 || LO31..0) - ((rs31)32 || rs31..0) x ((rt31)32 || rt31..0) HI <- (temp63)32 || temp63..32 LO <- (temp31)32 || temp31..0 Exceptions None EZ4021-FC Instruction Extensions 4-37 MSUBU Multiply Subtract Unsigned Format 31 26 25 21 20 16 15 6 5 0 SPECIAL2 rs rt 0 MSUBU 011100 rs rt 0000000000 000101 Syntax MADDU rs, rt Description The contents of general register rs and rt are multiplied, treating both operands as unsigned values. No integer overflow exception occurs under any circumstances. In 64-bit mode, the operands must be valid 32-bit, sign-extended values. When the operation completes, the doubleword result is subtracted from the special register pair HI/LO. The low-order, 32 bits of the subtraction result are sign-extended and placed into special register LO. The high-order, 32 bits are sign-extended and placed into special register HI. MSUBU executes in 5 to 6 cycles, depending on the operand data. Operation T: temp <- (HI31..0 || LO31..0) - ((031)32 || rs31..0) x ((031)32 || rt31..0) HI <- (temp63)32 || temp63..32 LO <- (temp31)32 || temp31..0 Exceptions None 4-38 Instruction Set Architecture SDBBP Software Debug Breakpoint Format 31 26 25 6 5 0 SPECIAL2 code SDBBP 011100 code 111111 Syntax SDBBP Description This instruction raises a Debug Breakpoint exception and passes control to an exception handler. The code field can be used for passing information to the exception handler. To access this field, the exception handler must load the contents of the memory word containing this instruction by using the DEPC register. The SDBBP instruction acts as a NOP when it is used in Debug mode. Operation T: PC <- Exception Handler Vector if (DBD='0') then DEPC <- Address of SDBBP instruction else DEPC <- Address of branch instruction DM <- `1' BrkSt <- `1' DBp <- `1' Exceptions Debug Breakpoint EZ4021-FC Instruction Extensions 4-39 DERET Debug Exception Return Format 31 26 25 21 20 16 15 11 10 6 5 0 COP0 rs 0 0 0 DERET 010000 10000 00000 00000 00000 011111 Syntax DERET Description This instruction executes a return from a debug exception. It has a branch delay slot, the same as a branch or jump instruction. The DERET instruction cannot be used in a branch or jump delay slot. The return address stored in the DEPC register is copied to the PC, and processing returns to the original program. The Debug Mode bit (Debug register [30]) and the BrkSt bit (EJTAG Control register [3]) are cleared. Operation T: temp <- DEPC T+1:PC <- temp DM <- `0' BrkSt <- `0' Exceptions Coprocessor Unusable 4-40 Instruction Set Architecture WAITI Wait for Interrupt Format 31 26 25 21 20 16 15 11 10 6 5 0 COP0 rs 0 0 0 WAITI 010000 10000 00000 00000 00000 100000 Syntax WAITI Description When this instruction is executed, the main processor clock stops and instruction execution halts. Execution resumes when a hardware interrupt, NMI, or reset exception occurs. While in wait mode, the processor is saving power because the clock to most circuits is turned off. Exceptions None EZ4021-FC Instruction Extensions 4-41 4.10 CPU 32-Bit Instruction Opcode Encoding Tables 4.22-4.28 show the EZ4021-FC opcode bit encoding for 32-bit (MIPS III ISA) instructions. The following keys are used in the tables: rxf - These op codes cause reserved instruction exceptions in all current implementations and are reserved for future versions of the architecture. nrx - These op codes are invalid but do not cause reserved instruction exceptions. x1 - CACHE op codes are always valid in Kernel mode and cause a reserved instruction exception (User or Supervisor mode) with CP0 disabled. Subopcode bits [20:16] define cache maintenance functions. These functions are compatible with R4000 style processors. Undefined subopcodes of the CACHE instruction do not cause reserved instruction exceptions. n1 - These CP0 opcodes effectively become NOPs when the MMU is disabled. Table 4.22 MIPS III Major Opcode Bit Encoding [28:26] MIPS III Major Opcodes [31:29] 0 0 1 SPECIAL REGIMM 2 3 4 5 6 7 J JAL BEQ BNE BLEZ BGTZ 1 ADDI ADDIU SLTI SLTIU ANDI ORI XORI LUI 2 COP0 COP1 COP2 rxf BEQL BNEL BLEZL BGTZL 3 DADDI DADDIU LDL LDR SPECIAL2 rxf rxf rxf 4 LB LH LWL LW LBU LHU LWR LWU 5 SB SH SWL SW SDL SDR SWR CACHEx1 6 LL LWC1 LWC2 rxf LLD LDC1 LDC2 LD 7 SC SWC1 SWC2 rxf SCD SDC1 SDC2 SD 4-42 Instruction Set Architecture Table 4.23 COPz rs Opcode Bit Encoding [23:21] COPz rs [25:24] 0 1 2 3 4 5 6 7 0 MFCz DMFCz CFCz rxf MTCz DMTCz CTCz rxf 1 BC rxf rxf rxf rxf rxf rxf rxf 2 COPz (Coprocessor-Defined Instructions) 3 Table 4.24 COPz rt Opcode Bit Encoding [18:16] COPz rt [20:19] 0 1 2 3 4 5 6 7 0 BCF BCT BCFL BCTL rxf rxf rxf rxf 1 rxf rxf rxf rxf rxf rxf rxf rxf 2 rxf rxf rxf rxf rxf rxf rxf rxf 3 rxf rxf rxf rxf rxf rxf rxf rxf Table 4.25 REGIMM Opcode rt Bit Encoding [18:16] REGIMM rt [20:19] 0 1 2 3 4 5 6 7 0 BLTZ BGEZ BLTZL BGEZL rxf rxf rxf rxf 1 TGEI TGEIU TLTI TLTIU TEQI rxf TNEI rxf 2 BLTZAL BGEZAL BLTZALL BGEZALL rxf rxf rxf rxf 3 rxf rxf rxf rxf rxf rxf rxf rxf CPU 32-Bit Instruction Opcode Encoding 4-43 Table 4.26 SPECIAL Opcode Bit Encoding [2:0] SPECIAL Functions [5:3] 0 1 2 3 4 5 6 7 0 SLL rxf SRL SRA SLLV rxf SRLV SRAV 1 JR JALR rxf rxf SYSCALL BREAK rxf SYNC 2 MFHI MTHI MFLO MTLO DSLLV rxf DSRLV DSRAV 3 MULT MULTU DIV DIVU DMULT DMULTU DDIV DDIVU 4 ADD ADDU SUB SUBU AND OR XOR NOR 5 rxf rxf SLT SLTU DADD DADDU DSUB DSUBU 6 TGE TGEU TLT TLTU TEQ rxf TNE rxf 7 DSLL rxf DSRL DSRA DSLL32 rxf DSRL32 DSRA32 Table 4.27 SPECIAL 2 Opcode Bit Encoding [2:0] SPECIAL2 Functions [5:3] 0 1 2 3 4 5 6 7 0 MADD MADDU MUL rxf MSUB MSUBU rxf rxf 1 rxf rxf rxf rxf rxf rxf rxf rxf 2 rxf rxf rxf rxf rxf rxf rxf rxf 3 rxf rxf rxf rxf rxf rxf rxf rxf 4 rxf rxf rxf rxf rxf rxf rxf rxf 5 rxf rxf rxf rxf rxf rxf rxf rxf 6 rxf rxf rxf rxf rxf rxf rxf rxf 7 rxf rxf rxf rxf rxf rxf rxf SDBBP 4-44 Instruction Set Architecture Table 4.28 CP0 Opcode Bit Encoding [2:0] CP0 Functions [5:3] 0 1 2 3 4 5 6 7 0 nrx TLBRn1 TLBWIn1 nrx nrx nrx TLBWRn1 nrx 1 TLBPn1 nrx nrx nrx nrx nrx nrx nrx 2 rxf nrx nrx nrx nrx nrx nrx nrx 3 ERET nrx nrx nrx nrx nrx nrx DERET 4 WAITI nrx nrx nrx nrx nrx nrx nrx 5 nrx nrx nrx nrx nrx nrx nrx nrx 6 nrx nrx nrx nrx nrx nrx nrx nrx 7 nrx nrx nrx nrx nrx nrx nrx nrx CPU 32-Bit Instruction Opcode Encoding 4-45 4-46 Instruction Set Architecture Chapter 5 Signal Descriptions This chapter describes the EZ4021-FC external interface signals and includes the following sections: * Section 5.1, "Quick Bus Interface" * Section 5.2, "Interrupt, Clock, and Reset Signals" * Section 5.3, "EJTAG and PC Trace Signals" * Section 5.4, "Global Test Mode Signals" * Section 5.5, "BIST Signals" * Section 5.6, "Miscellaneous Signals" In the signal descriptions, the verb assert means to drive TRUE or active. The verb deassert means to drive FALSE or inactive. The P at the end of signal names indicates a signal that is active (TRUE) when HIGH. The signals are arranged in alphabetical order within each section. 5.1 Quick Bus Interface There is no default master for the Quick Bus. The bus arbitration logic is external to the EZ4021-FC, so the EZ4021-FC must request use of the bus, just like any other device on the bus. BC_D_QB_BREQP Bus Request for Data Access Output The EZ4021-FC asserts this signal to request a load/store data access on the Quick Bus. BC_E_QB_BREQP Bus Request for EJTAG DMA Output The EZ4021-FC asserts this signal to request an EJTAG DMA access on the Quick Bus. MiniRISC EZ4021-FC EasyMACRO Microprocessor 5-1 BC_I_QB_BREQP Bus Request for Instruction Fetch Output The EZ4021-FC asserts this signal to request an instruction fetch access on the Quick Bus. BC_QB_ADDRP[31:3] Address Output This 29-bit bus outputs the EZ4021-FC memory request address. BC_QB_BURSTREQP Burst Request Output The EZ4021-FC asserts this signal to request a burst access of the target memory device. BC_QB_BYTEP[7:0] Byte Enable Signals Output The EZ4021-FC asserts these signals, as required, to indicate which bytes are valid on the 64-bit data bus. The following table shows the correspondence between the byte enable signals and the valid data bytes. Byte Enable Valid Data Byte Byte Enable Valid Data Byte BC_QB_BYTE[7] [63:56] BC_QB_BYTE[3] [31:24] BC_QB_BYTE[6] [55:48] BC_QB_BYTE[2] [23:16] BC_QB_BYTE[5] [47:40] BC_QB_BYTE[1] [15:8] BC_QB_BYTE[4] [39:32] BC_QB_BYTE[0] [7:0] BC_QB_CMDLOCKP Command Lock Output The EZ4021-FC asserts this signal to guarantee access to the Quick Bus for multiple consecutive cycles. The signal is used to guarantee the EJTAG access to the Quick Bus for atomic DMAs or data cache write-back stores. BC_QB_RDACKP Read Data Acknowledge Output The EZ4021-FC asserts this signal to acknowledge that it can accept read data being returned from a slave device. 5-2 Signal Descriptions BC_QB_READP Read Request Output The EZ4021-FC asserts this signal to indicate a read operation. BC_QB_WRDATAP[63:0] Write Data Output The EZ4021-FC drives write data on this 64-bit bus during EZ4021-FC write requests. BC_QB_WRITEP Write Request Output The EZ4021-FC asserts this signal to indicate a write operation. QB_ADDRP[31:3] Address (Snooping) Input This 29-bit bus contains an address from an external (non-CPU) device. When the EZ4021-FC snoops for external (non-CPU) writes to memory, the data cache uses this address to generate cache invalidate operations to the data cache to maintain data coherency. QB_BADADDRP Bad Address Error Input The Quick Bus asserts this signal, in conjunction with QB_GRANT_BC_DP, QB_GRANT_BC_IP, or QB_GRANT_BC_EP to indicate that the EZ4021-FC attempted to access an invalid address. QB_BOFFP Back Off (Snooping) Input The Quick Bus asserts this signal. The EZ4021-FC Quick Bus snooping mechanism uses this input in conjunction with QB_WRITEP for proper bus snooping. QB_BURSTACKP Burst Request Acknowledge Input An external device asserts this signal to acknowledge the EZ4021-FC's request for a burst operation. QB_CMDRDYP Command Ready Input The Quick Bus asserts this signal in conjunction with QB_GRANT_BC_DP, QB_GRANT_BC_EP, or QB_GRANTP_BC_IP to indicate that the target slave can accept the corresponding request. Quick Bus Interface 5-3 QB_GRANT_BC_DP Data Access Command Bus Grant Input Quick Bus arbitration logic asserts this signal to indicate that the EZ4021-FC has been granted ownership of the command request bus for a data access. QB_GRANT_BC_EP EJTAG DMA Command Bus Grant Input Quick Bus arbitration logic asserts this signal to indicate that the EZ4021-FC has been granted ownership of the command request bus for an EJTAG DMA operation. QB_GRANT_BC_IP Instruction Fetch Command Bus Grant Input Quick Bus arbitration logic asserts this signal to indicate that the EZ4021-FC has been granted ownership of the command request bus for an instruction fetch. QB_RDDATAP[63:0] Read Data Input This 64-bit data bus contains read data requested by the EZ4021-FC. The data is valid when the Quick Bus asserts one of the following signals: QB_RDRDY_BC_DP, QB_RDRDY_BC_EP, or QB_RDRDY_BC_IP. QB_RDERRP Read Data Error Input The Quick Bus asserts this signal, in conjunction with QB_RDRDY_BC_DP, QB_RDRDY_BC_EP, or QB_RDRDY_BC_IP to indicate that a read operation to a slave device failed. QB_RDRDY_BC_DP Read Data Ready for Data Read Input The Quick Bus asserts this signal to indicate that data access read data requested by the EZ4021-FC is available on QB_RDATA[63:0]. QB_RDRDY_BC_EP Read Data Ready for EJTAG Read Input The Quick Bus asserts this signal to indicate that EJTAG read data requested by the EZ4021-FC is available on QB_RDATA[63:0]. 5-4 Signal Descriptions QB_RDRDY_BC_IP Read Data Ready for Instruction Fetch Input The Quick Bus asserts this signal to indicate that instruction fetch data requested by the EZ4021-FC is available on QB_RDDATAP[63:0]. QB_SLRDY_BC_DP Slave Ready for Data Access Input The Quick Bus asserts this signal to indicate that the target slave for a data access request is now ready. QB_SLRDY_BC_EP Slave Ready for EJTAG DMA Input The Quick Bus asserts this signal to indicate that the target slave for an EJTAG DMA request is now ready. QB_SLRDY_BC_IP Slave Ready for Instruction Fetch Input The Quick Bus asserts this signal to indicate that the target slave for an instruction fetch is now ready. QB_WRITEP Snoop Request (Snooping) Input The EZ4021-FC monitors this signal to determine when to snoop the current address on the Quick Bus. To snoop all non-EZ4021-FC writes on the Quick Bus, connect this signal to QB_WRITEP. 5.2 Interrupt, Clock, and Reset Signals This section describes the interrupt, clock, and reset signals. CG_RESETP Clock Generator Reset Input Asserting this signal synchronously resets the SCLKP divider. CG_RESETP must be asserted synchronously with respect to PCLKP. Interrupt, Clock, and Reset Signals 5-5 EZ_SCLK_GATEP System/Secondary Clock Gate Output This signal generates the system clock, SCLKP, from PCLKP. Refer to Section 2.8, "Clocks," on page 2-23 for information. The EZ4021-FC asserts EZ_SCLK_GATEP when the SCLKP divider counts down to 1. EZ_SCLK_GATEP is also forced active when GSCAN_MODEP is asserted, so that SCLKP == PCLKP in scan mode. 5-6 INTP[4:0] External Hardware Interrupts Input External logic asserts these input signals, which cause CP0 to generate the corresponding interrupt exception. The Cause register IP[4:0] field indicates when these inputs are asserted. The interrupting logic should assert its interrupt continuously until the exception routine services it. NMI Nonmaskable Interrupt Input When asserted, this signal causes the EZ4021-FC CP0 to generate a Soft Reset/NMI exception at a valid instruction boundary. Processor state information is preserved. Assert this input for only 1 cycle. PCLKP Primary CPU Clock Input This is the processor system clock input, which defines the EZ4021-FC CPU operating frequency. All other clocks, except GSCAN_RAMCLKP and DJ_TCKP, are generated from PCLKP. All modules that are part of the EZ4021-FC use this clock, and internal logic operates synchronously with the rising edge of PCLKP. RESETP System Reset Input Asserting this signal synchronously resets the EZ 4021-FC. RESETP must be asserted synchronously with respect to PCLKP. Asserting this signal initializes all internal state information. When RESETP is deasserted, EZ4021-FC CP0 generates a Reset exception and sets the Program Counter to 0xBFC0.0000. Signal Descriptions SCLKP_DIVP[1:0] SCLKP Divide Ratio Input The data on SCLKP_DIVP is the SCLKP divisor value; for example: SCLKP_DIVP == 2, then SCLKP = PCLKP/2. Acceptable values of SCLKP_DIVP are 1, 2, and 3. 5.3 EJTAG and PC Trace Signals The EJTAG (EJTAG) interface consists of the following five signal groups: * EJTAG Standard Signals * EJTAG Standard Support Signals * Nonmultiplexed EJTAG Signals * EJTAG External Module Signals * EJTAG Configuration Signals In this section, inputs and outputs are arranged in alphabetical order, and are referenced to the EJTAG module. Signals output from the debug support/PC trace submodule are indicated by the prefix `DT' and outputs from the EJTAG Interface submodule are prefixed with `DJ'. 5.3.1 EJTAG Standard Signals The standard EJTAG interface consists of the following signals. DJ_TCKP EJTAG Test Clock Input This signal is the TCK clock from the off-chip EJTAG probe. This is the input clock used to shift data into or out of the EJTAG registers. The TCK clock may be fully asynchronous with respect to PCLKP, the processor clock. DJ_TDIP_DINTN Test Data Input/Debug Interrupt Input When PC Trace mode is off and depending on the TAP controller state, this signal is the TDI/DINT serial data input from the EJTAG probe. This signal shifts data into the EJTAG registers on the rising edge of the DJ_TCKP clock. EJTAG and PC Trace Signals 5-7 When PC Trace mode is on, asserting this signal LOW (asynchronous to any clock) acts as an interrupt and switches PC Trace mode off. DJ_TDOP_TPCP Test Data Output/Target PC Output Output This signal is the TDO/TPC serial data output to the EJTAG probe. When PC Trace mode is off, this signal shifts data out of the EJTAG registers on the falling edge of the DJ_TCKP clock. When no data is shifted out, this signal is Hi-Z. When PC Trace mode is on, this signal provides nonsequential program counter output (TPC) at the DCLKP rate. DJ_TMSP Test Mode Select Input This signal is the TMS input from the EJTAG probe. The TAP controller decodes this signal for test operation control. DJ_TMSP is sampled on the rising edge of TCK. DJ_TRSTN Test Reset Input This signal is the TRST input from the EJTAG probe. This active LOW signal provides an asynchronous reset for the EJTAG Interface module that is independent of the processor logic. DCLKP EJTAG PC Trace Clock Output This signal is the DCLK output to the EJTAG probe. DCLKP is a 50% duty cycle clock generated from PCLKP. During PC Trace this signal helps capture address and data from the DJ_TDOP_TPCP pin at the processor clock speed divided by 2. DCLKP is LOW when the ClkEn bit in the ECR is 0 or when no probe is present (ProbEn bit equals 0 in ECR register). DT_PCST1[2:0] PC Trace Status Information 1 Output This 3-bit bus provides one-half the PCST output to the EJTAG probe. During PC Trace mode, this bus drives PC Status information to the EJTAG probe. This bus contains the status of the most recent instruction of the two presented. See also the DT_PCST2[2:0] signal description. 5-8 Signal Descriptions DP_PCST Settings Symbol Status 000 DBM Debug mode 001 TSQ Trace trigger output at execution time 010 TST Trace trigger information Is output when the pipeline is stalled 011 SEQ Execution of nonjump instructions 100 EXP Exception generated 101 BRT Execution of a taken direct jump instruction or PC relative instruction 110 JMP Execution of a taken Jump instruction 111 STL Pipeline stall DT_PCST2[2:0] PC Trace Status Information 2 Output This 3-bit bus provides one-half the PCST output to the EJTAG probe. During PC Trace mode, this bus drives PC Status information to the EJTAG probe. This bus contains the status of the least-recent instruction of the two presented. See also the DT_PCST1[2:0] signal description. DP_PCST Settings Symbol Status 000 DBM Debug mode 001 TSQ Trace trigger output at execution time 010 TST Trace trigger information is output when the pipeline is stalled 011 SEQ Execution of nonjump instructions 100 EXP Exception generated 101 BRT Execution of a taken direct jump instruction or PC relative instruction 110 JMP Execution of a taken jump instruction 111 STL Pipeline stall DT_TPCPLP[6:0] TPC Plus Output When PC Trace is on, this bus functions similar to the DJ_TDIP_DINTN signal. It outputs another 7 bits of the target PC information for PC Trace. EJTAG and PC Trace Signals 5-9 5.3.2 EJTAG Standard Support Signals These signals are necessary to implement the Standard EJTAG signals listed in Section 5.3.1, "EJTAG Standard Signals." DJ_JTAGALSOP Parallel JTAG Present Input When HIGH, this signal indicates that a JTAG interface coexists with the EJTAG on the same chip, and that the DJ_JTAGTDOP signal is relevant. DJ_JTAGTDOP Parallel JTAG TDO Input This signal makes it possible to daisy chain an external JTAG controller to the EJTAG Interface, so both JTAG and EJTAG coexist on one chip. To do this, connect TDO from the external JTAG controller to the DJ_JTAGTDOP input. DJ_TDO_DRIVEN TDO Output Enable Output When LOW, this signal enables the DJ_TDOP_TPCP signal output buffer. In PC Trace mode, this signal is always active. When not in PC Trace mode, this signal is only active while data is shifting out. 5.3.3 Nonmultiplexed EJTAG Signals Use these signals if not multiplexing TPC with TDO. The LSB of the TPC interface, as well as the TDO value, are output independently. DJ_PURETDO_DRN Pure TDO Output Enable Output When LOW, this signal enables the DJ_PURETDOP signal output buffer. Unlike DJ_TDO_DRIVEN, this signal is not active in PC Trace mode. The purpose of DJ_PURETDO_DRN is to enable the output of the DJ_PURETDOP signal when multiplexing TDO and TPC1 is not desired. DJ_PURETDOP Pure TDO Output This signal is the pure test data output from the EJTAG Interface module without the multiplexed TPC1. 5-10 Signal Descriptions DT_TPC1P TPC Bit 1 Output This signal is the pure TPC1 from the PC Trace module without the multiplexed TDO. 5.3.4 EJTAG External Module Signals These EJTAG output signals are for use by modules outside the EZ4021-FC. BC_DMP Debug Mode Output When this signal is active HIGH, it indicates that the CPU instruction fetch active at the rising edge of SCLK was a debug mode instruction fetch. This bit is cleared on the first SCLK rising edge after the W-stage execution of the instruction in the DERET slot, indicating that the processor is no longer in Debug mode. When this signal is LOW, the processor is not in Debug mode. DJ_DBGBRKP Debug Break Input When asserted, this signal causes an EJTAG Break Debug exception and sets the EjtagBrk bit in the ECR register. This bit stays set until the signal is deasserted. This bit asynchronously causes the EJTAG Break condition. Deassert this signal before the processor leaves the debug exception handler, or else another EJTAG Break condition will occur. DJ_PERRSTN Peripheral Reset Output When driven LOW, this signal resets all peripherals on the chip. 5.3.5 EJTAG Configuration Signals These signals are used to configure the EZ4021-FC EJTAG interface. DJ_DBRKDEMUXP Disable DTIP_DINTN Break Output When HIGH, this signal prevents the multiplexed DJ_TDIP_DINTN pin from causing an EJTAG Break condition while the system is in PC Trace mode. This function is controlled only by the dedicated EJTAG and PC Trace Signals 5-11 DJ_DBGBRKP signal. When LOW, asserting either DJ_DBGBRKP or DJ_TDIP_DINTN causes an EJTAG break condition. DJ_EJTAGIRBITS[1:0] EIR Extension Width Input This 2-bit bus extends the width of the EJTAG Instruction register by the amounts shown below: DJ_EJTAGIRBITS[1:0] EIR Length 00 5 bits 01 6 bits 10 7 bits 11 8 bits DJ_PON[19:0] Part Number Input Hardwire this 20-bit bus to indicate the JTAG part number consistent with the JTAG ID register. This part number/device revision number/location indicator must be unique among all LSI Logic manufactured parts, and software uses it to identify the unique characteristics of the hardware. DT_PCTEN PC Trace Enable Input When driven LOW, this signal enables PC Trace. When driven HIGH, it disables PC Trace. MMU_CNTALWYSP MMU Increment Count Reg in Debug Mode Input When asserted, this signal indicates that the CP0 Count register continues to increment even when in Debug mode. If this signal is deasserted, then upon entering Debug mode the Count register stops incrementing. Counting resumes upon return to normal operation. The recommended setting for this input is 0. 5-12 Signal Descriptions 5.4 Global Test Mode Signals This section describes the global test mode signals. GSCAN_ENABLEP Core Scan Enable Input When asserted, this signal enables the EZ4021-FC scan chain shift operation. For normal operation, this input must be deasserted. GSCAN_IN1P Core Scan Chain 1 Input Input This signal is the EZ4021-FC scan chain No. 1 input. GSCAN_IN2P Core Scan Chain 2 Input Input This signal is the EZ4021-FC scan chain No. 2 input. GSCAN_IN3P Core Scan Chain 3 Input Input This signal is the EZ4021-FC scan chain No. 3 input. GSCAN_IN4P Core Scan Chain 4 Input Input This signal is the EZ4021-FC scan chain No. 4 input. GSCAN_IN5P Core Scan Chain 5 Input Input This signal is the EZ4021-FC scan chain No. 5 input. GSCAN_IN6P Core Scan Chain 6 Input Input This signal is the EZ4021-FC scan chain No. 6 input. GSCAN_MODEP Global Test Mode Input When asserted, the EZ4021-FC operates in global test mode. For normal operation, this input must be deasserted. GSCAN_OUT1P Core Scan Chain 1 Output Output This signal is the EZ4021-FC scan chain No. 1 output. GSCAN_OUT2P Core Scan Chain 2 Output Output This signal is the EZ4021-FC scan chain No. 2 output. GSCAN_OUT3P Core Scan Chain 3 Output Output This signal is the EZ4021-FC scan chain No. 3 output. Global Test Mode Signals 5-13 GSCAN_OUT4P Core Scan Chain 4 Output Output This signal is the EZ4021-FC scan chain No. 4 output. GSCAN_OUT5P Core Scan Chain 5 Output Output This signal is the EZ4021-FC scan chain No. 5 output. GSCAN_OUT6P Core Scan Chain 6 Output Output This signal is the EZ4021-FC scan chain No. 6 output. GSCAN_RAMCLKP Scan Test RAM Clock and BIST Clock Input This signal clocks data into the EZ4021-FC RAMs during scan test (when GSCAN_MODEP is asserted). GSCAN_RAMCLKP is supplied by off-chip test equipment. Clocking the RAMs allows data to pass through from RAM input to output, which improves scan test coverage. In scan mode GSCAN_RAMCLKP serves as the scan test clock for the RAMs, and PCLKP is the scan clock for all other logic, including the BIST logic. In BIST mode, GSCAN_RAMCLKP serves as the BIST clock. 5.5 BIST Signals The BIST signals are the I/O signals to/from the MemBIST Controller and a user-supplied external TAP controller. All signals are referenced to the MemBIST Controller. 5-14 Signal Descriptions The BIST signals are created automatically when the MemBIST Controller is generated using the Logic Vision memBIST IC tools. For an overview of I-Cache BIST, see Section 8.1, "I-Cache BIST," on page 8-1.The BIST signals are listed as follows: Signal Mnemonic Function Direction BIST_DIAG_EN BIST Diag Enable Input BIST_HOLD BIST Hold Command Input BIST_SETUP[1:0] BIST Setup Input BIST_SHIFT BIST Shift Command Input BIST_SI BIST Shift Data In Input BIST_SO BIST Shift Data Out Output MBIST_DONE BIST Test Completion Output MBIST_EN BIST Controller Enable Input MBIST_GO BIST Test Failure Indication Output TCK BIST TAP Controller Clock Input TCK_MODE BIST TCK Mode Input 5.6 Miscellaneous Signals This section describes the remaining EZ4021-FC signals. BIG_ENDIANP Big Endian Mode Input BIG_ENDIANP is a static input (typically hardwired) to the EZ4021-FC. When this signal is asserted, the EZ4021-FC operates in big-endian addressing mode. The endian mode affects byte positions for load and store data alignment. CACHE_TESTP Cache Test Mode Input When asserted, this signal enables the EZ4021-FC cache test mode. Miscellaneous Signals 5-15 COP_CP0COND CP0 Branch Condition Input This input can be tested using the BCzF, BCzFL, and BCzT branch instructions (z=0). If asserted, and a BCzT (z = 0) branch is encountered, the branch is taken. CPU_EC_WAITI Wait for Interrupt Output When asserted, this signal indicates a WAITI instruction was executed. This signal is deasserted when the core receives an interrupt or EJTAG break. DCACHE_ENABLEP Data Cache Enable Input When asserted, this signal enables the EZ4021-FC data cache. DHQ_SCR1[31:0] System Configuration Register Output This 32-bit bus outputs the contents of the System Configuration Register 1. It provides for easy software configuration of various system parameters. ICACHE_ENABLEP Instruction Cache Enable Input When asserted, this signal enables the EZ4021-FC instruction cache. LOADSCHED_ENABLEP Load Scheduling Enable Input When asserted, this signal enables one data load scheduling in the CPU. MMU_ENABLEP MMU Enable Input When asserted, this signal enables virtual-to-physical address mapping through the MMU. PREFETCH_ENABLEP Instruction Prefetch Enable Input When asserted, this signal enables the BIU speculative instruction prefetch mechanism. 5-16 Signal Descriptions PRID_REV[3:0] Processor Revision Identifier Input These 4 inputs to the EZ4021-FC are static and define the least significant 4 bits of the REV field, which is part of the PRId register. These bits enable you to change the PRId REV number without requiring a change to the EZ4021-FC. PSTALLP EZ4021-FC Global Stall Output The EZ4021-FC asserts this signal to indicate when the CPU is stalled. This signal is the registered version of the internal CPU stall signal. SNOOP_ENABLEP Data Cache Snoop Enable When asserted, this signal enables data cache invalidation through Quick Bus snooping. Input READPRI_ENABLEP Read Priority Enable Input When asserted, the EZ4021-FC prioritizes load requests ahead of store requests on the Quick Bus. VCED_ENABLEP Virtual Coherency Exception Data Enable Input This signal, which must be tied to 0, connects to the DCacheC bit in the EJTAG Implementation register. The 0 state of this register bit indicates that the EJTAG debug solution in the EZ4021-FC does not maintain instruction cache coherency with EJTAG-initiated, DMA operations. The DCacheC bit is described on page 3-40. WRITEBUF_ENABLEP Write Buffer Enable Input When asserted, this signal enables the BIU's 8-doubleword write buffer. Otherwise, the write buffer is one-entry deep. Miscellaneous Signals 5-17 5-18 Signal Descriptions Chapter 6 Interface Operation This chapter provides waveforms that depict the operation of the EZ4021-FC's signals. This chapter contains the following sections: * Section 6.1, "Quick Bus Transactions" * Section 6.2, "Reset Behavior" * Section 6.3, "Interrupt Behavior" * Section 6.4, "Wait States" 6.1 Quick Bus Transactions The EZ4021-FC performs reads and writes to on-chip devices through the Quick Bus. The Quick Bus is a split transaction bus that implements a nonblocking bus protocol. Requests for data and the return of data are independent of each other. The EZ4021-FC can make a read request for data on the Quick Bus to a slave device and not have to wait for the data to be returned before making another request on the Quick Bus to the same or another device. In this document, Quick Bus transactions are categorized into basic and advanced transactions. 6.1.1 Basic Transactions The three basic Quick Bus transactions are fetch (read), load data (read), and store data (write). 6.1.1.1 Instruction Fetch (Read) There are two types of instruction fetches: cached and noncached. For cached instruction fetches, the EZ4021-FC requests a 4-doubleword burst of data from the Quick Bus. For noncached instruction fetches, a single doubleword of instruction data is requested from the Quick Bus. MiniRISC EZ4021-FC EasyMACRO Microprocessor 6-1 The data is returned to the EZ4021-FC when the slave has processed the request and accessed the required data. This read transaction is dual phased: a request phase and then a data return phase. Four-Doubleword (Burst) Instruction Request - Figure 6.1 depicts two instruction fetch burst requests. The Quick Bus can grant the bus (QB_GRANT_BC_IP) in the same cycle as the request seen at time Tn + 1, or can take any number of cycles. (Three are shown in the figure from time T1 to T3.). If the Quick Bus decodes an address error, QB_BADADDRP is asserted instead of QB_CMDRDYP. In this case, the EZ4021-FC interprets the Quick Bus address error as an Instruction Bus Error. Figure 6.1 Four-Doubleword Instruction Request T1 T2 T3 Clock Cycles T4 Tn Tn+1 Tn+2 SCLKP BC_I_QB_BREQP BC_QB_READP BC_QB_BURSTREQP BC_QB_ADDRP addr[32] addr[32] QB_GRANT_BC_IP QB_CMDRDYP QB_BURSTACKP QB_BADADDRP Return of Instruction Burst Data - After the EZ4021-FC makes an instruction request on the Quick Bus, the target of the request (slave) accesses the requested data. When the data is retrieved, the slave places the data on the Quick Bus and indicates ready. The EZ4021-FC does not have to take the ready data; it can deassert BC_QB_RDACKP until it is ready for the next doubleword (for example, at time T4 and T5 in Figure 6.2). The EZ4021-FC then gets the data from the Quick Bus. 6-2 Interface Operation The assertion of QB_RDERRP signifies the slave was unable to successfully access the requested data. An error is returned along with the 4 doublewords. The EZ4021-FC interprets this as an Instruction Bus Error. Figure 6.2 Instruction Burst Data Return T1 T2 T3 Clock Cycles T4 T5 T6 T7 SCLKP QB_RDRDY_BC_IP QB_RDDATAP 0 1 2 3 BC_QB_RDACKP QB_RDERRP Single Doubleword Instruction Request - The single doubleword instruction fetch is a simplified version of the burst instruction fetch. (See Figure 6.3.) The only difference is in the request phase where the BC_QB_BURSTREQP signal is LOW, indicating a single doubleword request. The Quick Bus returns QB_BADADDRP if the address requested is not mapped in the Quick Bus address decoder. The EZ4021-FC interprets this occurrence as an Instruction Bus Error. The return of data is shown to be a single cycle event. The data is ready, and the EZ4021-FC immediately acknowledges the data (see Tn + 1 in Figure 6.3). Or, as shown in T5 of Figure 6.8, the EZ4021-FC may not immediately acknowledge the data when the Quick Bus is ready. Only when BC_QB_RDACKP is asserted will the Quick Bus know the EZ4021-FC received the data. The returned data may be in error, so the Quick Bus will assert QB_RDERRP along with the data ready signal (QB_RDRDY_BC_IP). Quick Bus Transactions 6-3 Figure 6.3 Single Doubleword Instruction Request and Return T1 T2 T3 Clock Cycles T4 Tn Tn + 1 Tn + 2 SCLKP BC_I_QB_BREQP BC_QB_READP BC_QB_BURSTREQP BC_QB_ADDRP addr[32] QB_GRANT_BC_IP QB_CMDRDYP QB_BURSTACKP QB_BADADDRP QB_RDRDY_BC_IP QB_RDDATAP datazero BC_QB_RDACKP QB_RDERRP 6.1.1.2 Load Data (Read) The mechanism for requesting load or EJTAG data is exactly the same as requesting instruction data. The return of load data is exactly the same as the return of instruction data. The difference in the request phase is that instead of asserting BC_I_QB_BREQP (Instruction Cache), BC_D_QB_BREQP (Data Cache), or BC_E_QB_BREQP (EJTAG) is asserted. The Quick Bus grants the bus by asserting QB_GRANT_BC_DP or QB_GRANT_BC_EP instead of QB_GRANT_BC_IP. QB_RDRDY_BC_DP signifies the Quick Bus has data ready for the Data Cache, and QB_RDRDY_BC_EP signifies the Quick Bus has data ready for EJTAG. (For example, see Figure 6.8, time T9.) 6-4 Interface Operation As in instruction fetches, the Quick Bus can return an error on requests or data returns by asserting QB_BADADDRP or QB_RDERRP, respectively. For load data fetches, the EZ4021-FC interprets the assertion of these signals as Data Bus Errors. 6.1.1.3 Store Data (Write) A store data has one of two Quick Bus IDs: D for data cache or E for EJTAG. The store data (write) transaction is single phased, while load data (read) transactions are dual phased. The store request is similar to a load request, except the BC_QB_WRITEP is asserted instead of BC_QB_READP, and the data to be written is on BC_QB_WRDATAP. Byte enables accompany all writes on BC_QB_BYTEP. When the Quick Bus asserts QB_CMDRDYP to acknowledge the request, the target slave device has already latched the data to be written, so at this point the EZ4021-FC no longer needs to drive the request or data lines. The EZ4021-FC can request a burst write (see Section 6.1.1.4, "Store Burst (Burst Write)," on page 6-6); that is, it can lock the bus by asserting BC_QB_CMDLOCKP and perform four consecutive writes to the Quick Bus. As depicted, back-to-back writes are possible. DMA writes from the EJTAG module look like store writes from the Data Cache (see Figure 6.4), except that BC_E_QB_BREQP and QB_GRANT_BC_EP are relevant instead of BC_D_QB_BREQP and QB_GRANT_BC_DP. Quick Bus Transactions 6-5 Figure 6.4 Store Data Write T1 T2 T3 Clock Cycles T4 T5 T6 T7 SCLKP BC_D_QB_BREQP BC_QB_WRITEP BC_QB_BURSTREQP BC_QB_ADDRP addr0[32] addr1[32] addr2[32] BC_QB_WRDATAP data0[64] data1[64] data2[64] BC_QB_BYTEP data0[8] data1[8] data2[8] QB_GRANT_BC_DP QB_CMDRDYP QB_BADADDRP 6.1.1.4 Store Burst (Burst Write) Figure 6.5 shows the waveforms for a burst write operation. Burst writes transfer four doublewords to the Quick Bus. For a burst write, the EZ4021-FC asserts the burst request signal (BC_QB_BURSTREQP) for the first write. If the request is acknowledged, then the EZ4021-FC asserts the bus lock (BC_QB_CMDLOCKP) for the following three writes. If the burst request is not acknowledged, then the bus lock signal is not asserted, and the burst write operation does not occur at this time. Instead, four normal write operations are performed without locking the bus. 6-6 Interface Operation Figure 6.5 Store Burst T1 T2 T3 Clock Cycles T4 T5 T6 T7 SCLKP BC_D_QB_BREQP BC_QB_WRITEP BC_QB_BURSTREQP BC_QB_ADDRP 0 1 2 3 BC_QB_WRDATAP 0 1 2 3 BC_QB_BYTEP QB_GRANT_BC_DP QB_CMDRDYP QB_BURSTACKP BC_QB_CMDLOCKP 6.1.2 Advanced Transactions This section discusses more advanced Quick Bus transactions that involve protocol between the Quick Bus and the EZ4021-FC. The transactions described here consist of a busy target slave, nonburstable slave, and multiple requests occurring while data is returning. 6.1.2.1 Quick Bus Slave Ready Mechanism In the basic transactions described in Section 6.1.1, "Basic Transactions," the target slave is always ready to accept the request and data. In normal operation, the slave might not be ready. The EZ4021-FC has a slave ready mechanism in place to handle this situation. Quick Bus Transactions 6-7 The example in Figure 6.6 shows an EJTAG request (BC_E_QB_BREQP) at T1/T2 followed by a data request at T3/T4. Although the Quick Bus asserts QB_GRANT_BC_EP and grants the bus to the EZ4021-FC, the slave is not ready to accept the EJTAG request (T2). In this case, QB_CMDRDYP is deasserted in the cycle the Quick Bus was granted to the EZ4021-FC. In the next cycle, the EZ4021-FC deasserts the denied request, BC_E_QB_BREQP, and monitors the slave ready signal, QB_SLRDY_BC_EP (T3). Although the slave for the EJTAG request is busy, the target slave for the data cache request is ready and accepts the request (T4). Then the EJTAG slave asserts the ready signal (T5), indicating the EZ4021-FC should resend the request (T6). The slave ready mechanism prevents unnecessary requests from wasting bus bandwidth. In this example, the data cache request was able to use the bus while the EJTAG request was waiting for its slave to become ready. 6-8 Interface Operation Figure 6.6 Quick Bus Slave Ready Operation T1 T2 T3 Clock Cycles T4 T5 T6 T7 SCLKP BC_E_QB_BREQP BC_D_QB_BREQP BC_QB_WRITEP BC_QB_READP BC_QB_BURSTREQP BC_QB_ADDRP addr0[32] addr1[32] BC_QB_WRDATAP data1[64] BC_QB_BYTEP data1[8] addr0[32] QB_GRANT_BC_EP QB_GRANT_BC_DP QB_BURSTACKP QB_CMDRDYP QB_SLRDY_BC_EP Quick Bus Transactions 6-9 6.1.2.2 Burst Request of a Nonburstable Device The EZ4021-FC always attempts a burst (four doubleword) request of a target slave if the access is in cacheable space. In some cases, a slave cannot perform burst operations. (See Figure 6.7.) In that case the EZ4021-FC manually makes a burst request; that is, it makes four individual requests of that device, incrementing the address for each doubleword. Initially, the EZ4021-FC makes a request, the bus is granted, and the request is accepted by the target slave, except the burst request is not acknowledged (T1). The EZ4021-FC then manually requests the remaining three doublewords of the burst. (See Figure 6.7.) Figure 6.7 Burst Request of a Nonburstable Device T1 T2 T3 Clock Cycles T4 T5 T6 SCLKP BC_I_QB_BREQP BC_QB_READP BC_QB_BURSTREQP BC_QB_ADDRP QB_GRANT_BC_IP QB_CMDRDYP QB_BURSTACKP QB_BADADDRP 6-10 Interface Operation addr0 addr1 addr2 addr3 T7 6.1.2.3 Multiple Requests and Return of Data This subsection presents a scenario where multiple events occur as in a real simulation or system, except the slaves are always ready and there are no errors. (Thus, QB_SLRDY_BC_<I/D/E>P, QB_BADADDRP, and QB_RDERRP are not used.) In Figure 6.8 the EZ4021-FC requests a burst (4 doublewords) of instructions (T1), and the target slave accepts the request (T2). The requested data is returned one cycle later (T4) and, while executing the requested instructions, a store is decoded and sent to the Quick Bus from the EZ4021-FC (T6). The Quick Bus processes the store write request while returning data for the instruction read. Two cycles later, the EZ4021-FC makes a load data read request of the Quick Bus (T9). The QuickBus returns a bus grant (QB_GRANT_BC_DP) and command ready (QB_CMDRDYP), signaling that the load request was accepted by the QuickBus, passed on to the target slave, and accepted by the target slave. While data is returning for the load read, an EJTAG Write DMA request is asserted on the QuickBus by the EZ4021-FC (T11). Notice the EJTAG write was not granted to the bus until T13. This occurred because the Quick Bus was busy servicing another master (not shown); the delay had nothing to do with data returning for the Data Cache. Quick Bus Transactions 6-11 Figure 6.8 Multiple Requests T1 T2 T3 Clock Cycles T4 T5 T6 T7 SCLKP BC_I_QB_BREQP BC_D_QB_BREQP BC_E_QB_BREQP BC_QB_WRITEP BC_QB_READP BC_QB_BURSTREQP BC_QB_ADDRP addr0[32] addr1[32] BC_QB_WRDATAP data1[64] BC_QB_BYTEP data1[8] QB_GRANT_BC_IP QB_GRANT_BC_DP QB_GRANT_BC_EP QB_BURSTACKP QB_CMDRDYP QB_RDRDY_BC_IP QB_RDRDY_BC_DP QB_RDRDY_BC_EP QB_RDDATAP BC_QB_RDACKP 6-12 Interface Operation data0+0 data0+1 data0+2 Figure 6.8 Multiple Requests (Cont.) T8 T9 T10 Clock Cycles T11 T12 T13 T14 SCLKP BC_I_QB_BREQP BC_D_QB_BREQP BC_E_QB_BREQP BC_QB_WRITEP BC_QB_READP BC_QB_BURSTREQP BC_QB_ADDRP addr2[32] addr3[32] BC_QB_WRDATAP data3[64] BC_QB_BYTEP data3[8] QB_GRANT_BC_IP QB_GRANT_BC_DP QB_GRANT_BC_EP QB_BURSTACKP QB_CMDRDYP QB_RDRDY_BC_IP QB_RDRDY_BC_DP QB_RDRDY_BC_EP QB_RDDATAP data0+3 data2+0 data2+1 data2+2 data2+3 BC_QB_RDACKP Quick Bus Transactions 6-13 6.2 Reset Behavior This section describes the two reset types and the affect each has on modules in the EZ4021-FC. The two reset types are reset and soft reset. 6.2.1 Reset The primary purpose of a Reset is to initialize the EZ4021-FC EasyMACRO core at power up. When asserted, the RESETP signal initializes the internal states and control registers in the EZ4021-FC. However, RESETP does not initialize the general-purpose registers, the I-Cache, or the D-Cache. The RESETP signal must be asserted and deasserted on the rising edge of the system clock (SCLKP). It must remain active for at least four SCLKP clock cycles. The EZ4021-FC considers RESETP a nonmaskable exception and remains in idle mode while RESETP is asserted. Figure 6.9 shows the timing for a reset and the start of an instruction fetch after RESETP is deasserted. Figure 6.9 Reset Pipeline Behavior SCLKP RESETP EG_CPURSTP CPU_CD_IVA Instruction 0 Instruction 1 Instruction 2 Reset Instruction 0 Reset Instruction 1 Reset Instruction 2 A F A+4 BCF0 0000 R X F Killed M +4 +8 W Killed F R X F R F For more information on reset exception handling, refer to sections 7.10.1 and 7.10.2, which begin on page 7-13. 6-14 Interface Operation 6.2.2 Soft Reset The primary purpose of the Soft Reset exception is to reinitialize the processor after a fatal error. When asserted, Soft Reset initializes the EZ4021-FC internal states and control registers. However, Soft Reset does not initialize the general-purpose registers, the I-Cache, the D-Cache, or the MMU TLB. The Soft Reset exception occurs when the EZ4021-FC deasserts the Processor Reset bit (PrRst) in the EJTAG Control Register (ECR). The Soft Reset exception is nonmaskable, and the EZ4021-FC is in idle mode during the period ECR[PrRst] is asserted. The start of the instruction fetch after ECR[PrRst] is deasserted is the same as that of RESETP, as shown in Figure 6.9. For more details on the Soft Reset exception handling, refer to Section 7.10.2, "Soft Reset Exception," on page 7-14. 6.2.3 Modules Affected by Reset Table 6.1 lists the reset sources and the modules that they affect. Note: The system must reach a known steady state before either PrRst, ERst, or DJ_TRSTN is asserted (or the TAP controller achieves the Test-Logic-Reset state). If the protocol between modules is in an intermediate state in which asserting a reset to 1 module and not another causes a protocol violation (for example, asserting ERst resets the EJTAG Probe DMA and CPU Probe Access Logic but not the CPU), undefined operation will occur. Reset Behavior 6-15 Table 6.1 Reset Sensitivity EJTAG Reset (ERst)2 Test Reset (DJ_TRSTN)3 TAP Controller Test Logic Reset4 Module Reset Soft Reset Processor Reset (PrRst)1 CPU Yes Yes Yes No No No CP0 Yes Yes Yes No No No ICC Yes Yes Yes No No No DCC Yes Yes Yes No No No BIU Yes Yes Yes No No MMU Yes No No No No No MDU Yes Yes Yes No No No Yes Yes Yes Yes Yes Yes Yes5 No No Yes5 Yes Yes Yes Yes No No No No Yes Yes No No No No EJTAG Interface - EJTAG Probe DMA and CPU Probe Access Logic - EJTAG Protocol Engine, TAP Controller, and Serial Registers - EJTAG Breakpoint Logic - EJTAG PC Trace Logic No 1. Processor Reset, bit 16, in the EJTAG Control register. Note that PrRst is identical to the CPU Soft Reset. Setting PrRst causes a soft reset. 2. EJTAG Reset, bit 7, in the EJTAG Control register. 3. EasyMACRO core input signal. 4. This reset is identical to the assertion of DJ_TRSTN and has the same effect. 5. In this case, the registers and the TAP Controller are not reset. 6-16 Interface Operation 6.3 Interrupt Behavior The EZ4021-FC supports maskable and nonmaskable interrupts. 6.3.1 Nonmaskable Interrupt The Nonmaskable Interrupt input signal (NMIP) must be asserted and deasserted on the rising edge of the system clock and should not be active for more than 1 SCLKP cycle. When NMIP is sampled and found to be active on the rising edge of the clock, CP0 provides a nonmaskable exception vector (0xBFC0.0000). Figure 6.10 shows the timing diagram for the fastest detected case. Figure 6.11 shows the case in which NMIP is not serviced immediately because of a pipeline stall. The EZ4021-FC latches the NMIP signal until it is ready to service the interrupt. Figure 6.10 NMI Pipeline Behavior (Detected Immediately) T1 T2 Clock Cycles T3 T4 T5 F R X M Killed F R X Killed F R Killed F Killed T6 PCLKP SCLKP NMIP Latched Internal NMI Kill Stall Instruction 0 Instruction 1 Instruction 2 Instruction 3 Exception Handler 0 Interrupt Behavior F 6-17 Figure 6.11 NMI Pipeline Behavior (Detection Delayed due to Stall) T1 T2 T3 Clock Cycles T4 T5 T6 T7 Instruction 0 M M M M M M Killed Instruction 1 X X X X X X Killed Instruction 2 R R R R R R Killed F Killed T8 T9 PCLKP SCLKP NMIP Latched Internal NMI Kill Stall Instruction 3 Exception Handler 0 F For more details on the Soft Reset exception handling, refer to Section 7.10.2, "Soft Reset Exception," on page 7-14. 6.3.2 Maskable Interrupts The EZ4021-FC has five external interrupt inputs, INTP[4:0], which must be asserted and deasserted on the rising edge of the system clock. To mask all five external interrupts at once, clear the IE bit of the Status register. To mask each interrupt individually, program the INT bits in the Status register. For more information about this register, refer to Section 3.2.2.5, "Status Register (12)." The instruction fetch for the exception handler starts two clocks after an external interrupt is detected, provided that the pipeline is not in a stall state and that there is no higher priority exception. Figure 6.12 shows the timing diagram when an interrupt is detected immediately. 6-18 Interface Operation Figure 6.12 Interrupt Pipeline Behavior (Detected Immediately) Clock Cycles T3 T4 T1 T2 T5 F R X M Killed F R X Killed F R Killed F Killed T6 PCLKP INTP Kill Stall Instruction 0 Instruction 1 Instruction 2 Instruction 3 Exception Handler 0 F An INTP exception is similar to an NMI exception, except that external interrupts are not latched internally, and must be asserted until they are serviced. If the pipeline is in a stall cycle, the EZ4021-FC does not service interrupts until the stall condition is resolved. For more information on the Interrupt exception handling, refer to Section 7.10.13, "Interrupt Exception," on page 7-27. 6.4 Wait States The EZ4021-FC uses the WAITI instruction, which is one of its extended instructions, to enter a power-saving wait state. In this state, the EZ4021-FC stalls the pipeline and reduces power consumption during the period that the EZ4021-FC is inactive. The EZ4021-FC wakes up when it detects an external exception input (enabled interrupt, NMIP, reset, soft reset, or bus error). Figure 6.13 shows the timing diagram for the WAITI instruction. Wait States 6-19 Figure 6.13 WAITI Pipeline Stall Clock Cycles T4 T5 T1 T2 T3 WAITI Instruction X M W Instruction 1 R X M M Instruction 2 F R X X T6 T7 T8 M M M Killed X X X Killed T9 PCLKP CPU_EC_WAITI INTP Kill Exception Handler 0 F At T1 the CP0 starts executing a WAITI instruction. At T3 (which occurs in the WB stage of the pipeline), the CP0 requests a pipeline stall and the EZ4021-FC asserts P_STALLP. At T6 an external interrupt input is asserted and the EZ4021-FC wakes up during T7. At T8 the instructions in the pipeline stages are killed, and the IF stage for the exception handler starts at T9. 6-20 Interface Operation Chapter 7 Error and Exception Handling This chapter describes how the EZ4021-FC handles errors and exceptions. It includes information that explains how the EZ4021-FC handles standard (nondebug) exceptions as well as debug exceptions during normal mode operation. The EZ4021-FC has no special provisions for error detection or processing other than what is described here. This chapter includes the following sections: * Section 7.1, "Overview" * Section 7.2, "Exception Handling Registers" * Section 7.3, "Standard Exception Operation" * Section 7.4, "Standard Exception Processing Actions" * Section 7.5, "Debug Exception Operation" * Section 7.6, "Debug Exception Processing" * Section 7.7, "Precision of Exceptions" * Section 7.8, "Exception Vector Locations" * Section 7.9, "Priority of Exceptions" * Section 7.10, "Exception Descriptions" * Section 7.11, "Loss of PC Trace Information" * Section 7.12, "Spurious Debug Mode Indications" 7.1 Overview When the EZ4021-FC detects a standard exception, it suspends the normal sequence of instruction execution, exits from the current mode, and enters Kernel mode, where it can handle exceptions. The EZ4021- MiniRISC EZ4021-FC EasyMACRO Microprocessor 7-1 FC reverts to Kernel mode, regardless of the mode at the time of the exception. The processor then disables interrupts and forces a software handler located at a fixed address in memory to execute. The handler saves the context of the processor. The original context must be restored after the exception is handled. When a standard exception occurs, the System Coprocessor (CP0) loads the Exception Program Counter (EPC) with a restart location where execution can resume after the exception is serviced. The restart location in the EPC is the address of the instruction that caused the exception or, if the instruction was executing in a Branch Delay slot, the address of the branch instruction immediately preceding the delay slot. The instruction causing the exception and all the instructions following it in the pipeline are aborted. They are refetched after returning from the exception handler. When the EZ4021-FC detects a debug exception, it suspends the normal sequence of instruction execution, exits from User, Supervisor or Kernel mode, and enters Debug mode, where it handles debug exceptions. The processor then disables all exceptions, standard or debug, with the exception of reset, and forces a software handler located at a fixed address in memory to execute. The handler saves the context of the processor. The original context must be restored when the exception has been handled. When a debug exception occurs, the System Coprocessor (CP0) loads the Debug Exception Program Counter (DEPC) with a restart location where execution can resume after the exception is serviced. The restart location in the DEPC is the address of the instruction that was executing at the time of the exception or that caused the exception or, if the instruction was executing in a Branch Delay slot, the address of the branch instruction immediately preceding the delay slot. The instruction causing the exception and all the instructions following it in the pipeline are aborted. They are refetched after returning from the debug exception handler. Table 7.1 summarizes the events that can initiate exception processing. 7-2 Error and Exception Handling Table 7.1 EZ4021-FC Standard Exception Summary Exception Cause Address Error Triggered by: - Load or store doubleword not aligned on a doubleword boundary. - Load, fetch, or store word that is not aligned on a word boundary. - Load or store halfword that is not aligned on a halfword boundary. - Reference Kernel address space from User or Supervisor mode. - Reference Supervisor address space from User mode. Bus Error (Data) Assertion of the external data bus error input, BC_DBUS_ERR. Bus Error (Instruction) Assertion of the external bus error input, BC_IBUS_ERR. Coprocessor Unusable, System Call, Breakpoint, Reserved Instruction Coprocessor Unusable - Execution of a coprocessor instruction where the Coprocessor Usable (Cu) bit is not set for the target coprocessor SYSCALL - attempts to execute the System Call instruction BREAK - attempts to execute the Breakpoint instruction Reserved Instruction - attempts to execute instruction with an undefined opcode Data Address Break (Load) Occurs if all of the following are true: - BE bit in the Data Break Control n Register is set - Processor's virtual data address matches the DBA n register (including any mask bits in the DBA Mask n register) - Processor is executing a Load instruction Data Address Break (Store) Same as Data Address Break (Load), except occurs during Store instruction. Debug Single Step Single-step mode is enabled. EJTAG Break Occurs if any of the following are true: - Probe sets EJTAG Break bit in the EJTAG Control Register. - DJ_DBGBRKP is asserted. - DJ_TDIP_DINTN is asserted during PC Trace. Reset Deassertion of the reset input, RESETP. Instruction Address Break Occurs if both of the following are true: - Break Enable bit in Instruction Address Control n register is set, and - Virtual address matches the value in the Instruction Address Break n Register. (Sheet 1 of 2) Overview 7-3 Table 7.1 EZ4021-FC Standard Exception Summary (Cont.) Exception Cause Interrupt Assertion of one of the EZ4021-FC's five hardware interrupt inputs, timer interrupt, or the setting of one of the 2 software interrupt bits in the Cause register. Interrupts must be enabled in both the Status register and the Debug Control register. Nonmaskable Interrupt Assertion of the nonmaskable interrupt input (NMIP), while the MNmi bit of the Debug Control register is set. Overflow, Trap, Floating-Point Integer Overflow - Twos-complement overflow during an add or subtract. Trap - One of the Trap instructions results in a "true" condition. Floating-Point - Used by an external floating-point coprocessor. Soft Reset Deassertion of the soft reset input, SOFT_RESETP. Software Debug Breakpoint Execution of the SDBBP instruction. TLB Invalid A virtual address reference matches a TLB entry that is marked invalid. TLB Modified The virtual address reference of a store operation matches a TLB entry that is marked valid, but is not dirty/writable. TLB Refill There is no TLB entry to match a reference to a mapped address space. (Sheet 2 of 2) 7-4 Error and Exception Handling 7.2 Exception Handling Registers Table 7.2 lists the CP0 registers used during standard exception processing. Software examines these registers during exception processing to determine the cause of an exception and the state of the CPU at the time the exception occurred. For more information about register contents and function, refer to Section 3.2.2, "CP0 Exception Processing Registers," page 3-23. Table 7.2 CP0 Exception Processing Registers Register Name CP0 Register Number Context 4 BadVAddr 8 Count 9 Compare 11 Status 12 Cause 13 Exception Program Counter (EPC) 14 Debug 23 Debug Exception Program Counter (DEPC) 24 Error Program Counter (ErrorEPC) 30 Debug Save (DESAVE) 31 The Move to Coprocessor 0 (MTC0) instruction sets these register values, and Move from Coprocessor 0 (MFC0) reads the register contents except for the DESAVE register, which can be accessed by both single-word coprocessor instructions and their doubleword counterparts, DMFC0 and DMTC0. Exception Handling Registers 7-5 7.3 Standard Exception Operation To handle a standard exception, the processor saves the current operating state, enters Kernel mode, disables interrupts, and forces execution of a handler at a fixed address. To resume normal operation, the original operating state must be restored and interrupts enabled. When an exception occurs, the EPC register is loaded with the restart location at which execution can resume after the exception has been serviced. The EPC register contains the address of the instruction associated with the exception, or, if the instruction was executing in a Branch Delay slot, the EPC register contains the address of the branch instruction immediately preceding the delay slot. The EZ4021-FC processor uses the following mechanisms for saving and restoring the operating mode and interrupt status: * A single interrupt enable bit (IE) located in the Status register * A base operating mode (Kernel, Supervisor, User) located in the KSU field of the Status register * An exception level (normal, exception) located in the EXL field of the Status register * An error level (normal, error) located in the ERL field of the Status register Interrupts are enabled by setting the Status register IE bit to 1 and both levels (EXL, ERL) to 0 (normal). Table 7.3 shows how the current processor operating mode is defined. 7-6 Error and Exception Handling Table 7.3 Current Processor Mode Status Current Mode KSU[1:0] Status EXL Status ERL Kernel 00 0 0 Supervisor 01 0 0 User 10 0 0 Kernel xx 1 0 Kernel xx 0 1 Exceptions set the exception level to exception (EXL = 1). The exception handler typically resets the exception level to normal (EXL = 0) after saving the appropriate state. It sets it back to exception while restoring that state. Returning from an exception (ERET instruction) resets the exception level to normal. 7.4 Standard Exception Processing Actions Figures 7.1-7.3 show the basic set of actions taken for each of the EZ4021-FC standard exception classes: Reset, Soft Reset or Nonmaskable Interrupt, and Common. Figure 7.1 Reset Exception Random TLBENTRIES - 1 Wired 06 ErrorEPC RestartPC SR 04 || SR27..23 || 1 || 0 || 0 || SR19..3 || 1 || SR1..0 PC 0xBFC0 0000 Figure 7.2 Soft Reset and NMI Exceptions ErrorEPC RestartPC SR SR31..23 || 1 || 0 || 1 || SR19..3 || 1 || SR1..0 PC 0xBFC0 0000 Standard Exception Processing Actions 7-7 Figure 7.3 Common Exceptions Cause BD || 0 || CE || 012 || Cause15..8 || 0 || ExcCode || 02 if ((SR1 = 0) then EPC RestartPC endif SR SR31..2 || 1 || SR0 if (SR22 = 1) then PC 0xBFC0 0200 + vector offset else PC 0x8000 0000 + vector offset endif 7.5 Debug Exception Operation To handle a debug exception, the processor enters Debug mode, disables all exceptions except reset, and forces execution of a handler at a fixed address. To resume normal operation, the original operating state is restored. When an exception occurs, the DEPC register is loaded with the restart location where execution resumes after the exception is serviced. The DEPC register contains the address of the instruction associated with the exception, or, if the instruction was executing in a Branch Delay slot, the DEPC register contains the address of the branch instruction immediately preceding the delay slot. Because the Debug mode hardware resources exist on top of the normal operating hardware, there is no need for the EZ4021-FC to save the current operating mode when a debug exception is taken. Software must use the DESAVE register to save the current general-purpose register (GPR) contents to a buffer and must restore it before leaving the debug exception handler. No other state restoration is necessary, nor performed by hardware. When entering Debug mode, the EZ4021-FC sets the Debug Mode bit of the Debug register (bit 30 of CP0 register 24). Returning from an exception (DERET instruction) resets the bit. 7-8 Error and Exception Handling 7.6 Debug Exception Processing Figure 7.4 shows the basic set of actions taken for EZ4021-FC debug exception classes. If a debug exception and a standard exception occur simultaneously, the standard exception resources are updated as shown in Section 7.4, "Standard Exception Processing Actions," while the debug exception resources are updated as shown in Figure 7.4. Figure 7.4 Debug Exceptions Debug[31] DBD Debug[30:29] 2b10 Debug[28] Debug[28] Debug[27:15] 013 Debug[14:12] [NIS,TRS,OES (based on simultaneous standard exc)] Debug[11:10] Debug[11:10] Debug[9] 0 Debug[8:0] Debug Exception Cause DEPC RestartPC if (ECR[15] = 1 and ECR[14] = 0) then PC 0xFF20 0200 else PC 0xBFC0 0400 endif Due to pipelined execution, the debug exception vector might be fetched before some debug exception cause and status bits are set. This is not an issue for logic within pipelined structures. However, the EJTAG probe is not a pipelined structure. It views execution as single-cycle in nature. As a result, the instruction fetch for the debug exception vector and the setting of the cause and status bits visible to the probe can appear out of order. 7.7 Precision of Exceptions Exceptions are logically precise, which means the instruction that causes an exception and all those that follow it are aborted, generally before committing to any state. Execution picks up where it left off before the exception, and the instruction can be re-executed after the exception is serviced. When the instructions that follow an exception are killed, exceptions associated with those instructions are also killed, so that exceptions are not taken in the order detected, but in the instruction fetch order. Debug Exception Processing 7-9 Interrupts generated by external devices attached to the processor have a variety of meanings that depend on the system environment where the EZ4021-FC resides. Variations in memory system design can affect the meaning of bus error exceptions and the location and means of accessing relevant parameters to service them. As far as possible, this architectural description of the exception handling system identifies which state information is reliable or unreliable. In some cases, however, the characteristics of the pipeline staging cannot guarantee that all states in the processor and associated system will remain completely unchanged. State changes that may occur include the following: * Instructions may be read from memory and loaded into the instruction cache. * The multiply/divide registers (HI and LO) may be altered by a multiply/divide or MTHI/MTLO instruction. Normally, these changes can be ignored because the state of the machine is sufficiently restored to allow execution to resume. 7.8 Exception Vector Locations The Reset, Soft Reset, and Nonmaskable Interrupt exceptions always vector to location 0xBFC0.0000. Addresses for all other exceptions are a combination of a base address and a vector offset. Table 7.4 and Table 7.5 show the standard and debug exception vector base addresses, respectively. Table 7.6 shows the vector offset addresses. Table 7.4 Standard Exception Vector Base Addresses BEV1 Vector Base 0 0x80000000 1 0xBFC00200 1. Status register bit 22. 7-10 Error and Exception Handling Table 7.5 Debug Exception Vector Base Addresses ProbEn1 SetDEV2 Vector Base 0 X 0xBFC00200 1 0 0xFF200000 1 1 0xBFC00200 1. EJTAG Control register bit 15. 2. EJTAG Control register bit 14. Table 7.6 Exception Vector Offset Addresses Exception Vector Offset TLB Refill (EXL = 0) 0x000 All Others Standard 0x180 Debug 0x200 7.9 Priority of Exceptions Exceptions are prioritized within a pipeline stage, within an instruction, and from instruction to instruction. An exception for any given instruction always has a higher priority than exceptions occurring in a subsequent instruction. If two exceptions occur in the same instruction, priority is given to the exception that occurs in the earliest pipeline stage. Exceptions that occur in the same instruction and in the same pipeline stage have defined priorities. Exceptions are prioritized within the stage in which they are taken. They are listed in descending priority order (highest priority first) as follows: 7.9.1 Overriding Priority (Stage Independent) 1. Reset 2. Soft Reset Priority of Exceptions 7-11 7.9.2 W Stage Exceptions 1. Data Address Break 2. Data Bus Error 3. Floating Point 4. TLB Refill/TLB Invalid (Data) 5. TLB Modified (Data Access) 7.9.3 M Stage Exceptions 1. EJTAG Break 2. Nonmaskable Interrupt 3. Overflow, Trap 4. Address Error (Data Access) 5. Interrupt 7.9.4 X Stage Exceptions 1. Software Debug Breakpoint 2. Coprocessor Unusable, SYSCALL, BREAK, Reserved Instruction 7.9.5 R Stage Exceptions 1. Debug Single Step 2. Instruction Address Break 3. Address Error (Instruction) 4. TLB Refill/TLB Invalid (Instruction Fetch) 5. Bus Error (Instruction Fetch) 7.10 Exception Descriptions This section describes the cause, handling, and servicing of each EZ4021-FC exception, The exceptions are presented in the same order as listed in Section 7.9, "Priority of Exceptions." 7-12 Error and Exception Handling 7.10.1 Reset Exception The primary purpose of Reset is to initialize the EZ4021-FC EasyMACRO core at power up. 7.10.1.1 Cause The Reset exception occurs when the RESETP input signal is asserted and then deasserted. This exception is not maskable. 7.10.1.2 Handling The CPU provides a special exception vector (0xBFC0.0000) for this exception. The reset vector resides in unmapped and uncached CPU address space, so the hardware need not initialize the TLB or the caches to handle the exception. The processor can fetch and execute instructions while the caches and virtual memory are in an undefined state. The contents of all registers in the CPU are undefined when the Reset exception occurs, except for the following: * In the Status register, the SR and TS bits are cleared, and the ERL and BEV bits are set. All other bits are undefined. * The Random register is initialized to the value of its upper boundary. * The Wired register is initialized to 0. * The Debug register is initialized to 0. 7.10.1.3 Servicing The Reset exception is serviced by: * Initializing all processor registers, coprocessor registers, caches and memory system * Performing diagnostic tests * Bootstrapping the operating system Exception Descriptions 7-13 7.10.2 Soft Reset Exception This section describes the Soft Reset/Nonmaskable Interrupt (NMI) exception cause and response. 7.10.2.1 Cause The Soft Reset exception occurs in response to either the setting of the PrRst bit in the EJTAG Control register or a Nonmaskable Interrupt input (NMIP). This exception is not maskable under normal operation. 7.10.2.2 Handling Regardless of the cause, when this exception occurs, the SR bit in the Status register is set, which distinguishes this exception from a Reset exception. The EZ4021-FC does not indicate any distinction between an exception caused by the PrRst bit or the NMIP signal. 7-14 * An exception caused by an NMIP is taken only if the processor is processing instructions; the exception is taken at the instruction boundary. It does not abort any state machines and preserves the state of the processor for diagnosis. This exception can be masked if the MNmi bit in the Debug Control register is cleared. * An exception caused by setting the PrRst bit performs a subset of the full reset. After a Reset Exception (caused by RESETP) completely initializes the processor, PrRst can be asserted to the processor in any state, even if the processor is no longer processing instructions. In this situation, the processor does not read or set processor configuration parameters. However, it does initialize all other processor state that requires hardware initialization (for instance, state machines and registers), so the CPU can fetch and execute the Reset exception handler located in uncached and unmapped space. Although no other processor state is changed unnecessarily, a soft reset sequence can alter some state because the exception may occur arbitrarily on a cycle boundary and abort any multicycle operation in progress. Because bus, cache, or other operations can be interrupted, portions of the cache, memory, or other processor state can be inconsistent. Error and Exception Handling For both PrRst and NMIP, the processor jumps to the Reset exception vector (0xBFC0.0000). The vector resides within unmapped and uncached CPU address space, so the hardware need not initialize the TLB or the cache to handle the PrRst or NMI interrupt. As previously noted, state machines interrupted by PrRst may cause some register contents to be inconsistent with the other processor state. Otherwise, the contents of all registers are preserved when this exception occurs, except for the following: * ErrorEPC register - contains the restart PC * BEV, SR, and ERL bits of the Status register - set to 1 * Status register TS bit - cleared to 0 * Registers that support debug breakpoints (such as DCR, IBS, IBCn, DBCn and DBS) - initialized to the their reset value * Debug Register - cleared to 0 7.10.2.3 Servicing PrRst-initiated exceptions give the debug host the capability to reset the processor without resetting the entire system. This might become necessary if the processor is not responding to debug commands or if the processor is executing at an unknown address. The NMIP signal might be useful for other than resetting the processor while preserving cache and memory contents. For example, if the system detects an impending power failure, it could use NMIP to cause an immediate, controlled shutdown. Exceptions that are due to either PrRst or NMIP appear identical to software; both exceptions jump to the Reset exception vector and set the Status register SR bit. Unless external hardware provides a way to distinguish between the two, both are serviced by saving the current user-visible processor state for diagnostic purposes and reinitializing (the same as for the Reset exception). Normally, it is not possible to continue program execution after returning from this exception, because PrRst can happen at any time and a nonmaskable interrupt can occur in the midst of another error exception. Exception Descriptions 7-15 7.10.3 Data Address Break Exception This section describes the Data Address Break exception cause and response. 7.10.3.1 Cause The Data Address Break exception occurs when all of the following occur: * The virtual address generated by the CPU for a load or store instruction matches the value in any of the DBAn registers, as masked by the corresponding DBMn register. * If the ASIDuse bit in the DBCn register is active, and the MMU-generated ASID in the EntryHi Register matches the ASID field in the DBCn register. * If this is a Store instruction, and the NoSB bit in the DBCn register is cleared. * If this is a Load instruction, and the NoLB bit in the DBCn register is cleared. * The BAI bits specified in the DBCn register allow a break on the bytes selected by the Load or Store instruction. * The BE bit of the DBCn register is set to enable the hardware break. The Data Address Break exception is not maskable under normal operation. 7.10.3.2 Handling The debug exception vector is used for this exception. In the Debug register the DM bit is set, and either the DDBL bit or DDBS bit is set to indicate the debug exception occurred during a Load or Store instruction, respectively. The DEPC register points to the Load or Store instruction that caused the exception unless this instruction is in a branch delay slot. If it is in a branch delay slot, then the DEPC register points to the branch instruction that precedes the delay slot, and the Debug register DBD bit is set. 7-16 Error and Exception Handling When the Data Address Break exception occurs, the EJTAG Control register BrkSt bit is set to 1, which indicates to the probe that the processor is in Debug mode. In addition, the debug exception vector can be fetched from the probe. Either action indicates to the debug host software that the expected breakpoint occurred, and that the debug software can begin executing. 7.10.3.3 Servicing Move one of the GPRs to the DESAVE register. Load this liberated GPR with a buffer address to which the entire GPR set should be stored in memory. Then store the value in the DESAVE register as well. Before returning from the debug exception handler, restore the GPR set just before executing the DERET instruction. 7.10.4 Bus Error Exception This section describes the Bus Error exception cause and response. 7.10.4.1 Cause The Bus Error exception is raised for events such as bus time-out, bus parity errors, and invalid physical memory accesses. This exception is not maskable under normal operation. This exception occurs when a cache miss refill, uncached reference, or an unbuffered write is terminated with a Quick Bus error response (QB_BADADDRP or QB_RDERRP). A write operation that is accepted by a Quick Bus slave device, but that later cannot complete due to an error, must generate an interrupt (INTP) to the EZ4021-FC EasyMACRO core to indicate the failing condition. 7.10.4.2 Handling The common exception vector is used for this exception. The Cause register ExcCode field is set to IBE or DBE to indicate whether an instruction fetch or Load/Store instruction caused the exception. For instruction fetch bus errors (IBE), the EPC register points to the instruction that caused the exception, unless this instruction is in a branch delay slot. If it is in a branch delay slot, the EPC register points to the preceding branch instruction, and the Cause register BD bit is set. Exception Descriptions 7-17 Data access bus errors (DBE) in the EZ4021-FC can be asynchronous events with respect to CPU instruction processing. For that reason, the EPC register is not guaranteed to point to the instruction that caused the exception. 7.10.4.3 Servicing The physical address where the fault occurred can be computed from information available in the CP0 registers: * If the Cause register exception code is set to IBE, the virtual address of the instruction that caused the bus error exception is either in the EPC register or it is EPC + 4 (if the Cause register BD bit is set). The physical address is obtained by using the TLBP instruction and reading the EntryLo register to compute the physical page number. * If the Cause register exception code is set to DBE, the EPC register is not guaranteed to contain the virtual address of the instruction that caused the bus error exception. Therefore, a register outside the EZ4021-FC must capture the failing physical address. The process currently executing is handed a bus error indication, which is usually fatal to the process. 7.10.5 Floating-Point Exception This section describes the floating-point exception cause and response. 7.10.5.1 Cause The Floating-Point Coprocessor (if installed) uses the Floating-Point exception. The contents of the Floating-Point Control Status register (inside CP1) indicate the cause of the exception. This exception is not maskable under normal operation. 7-18 Error and Exception Handling 7.10.5.2 Handling The common exception vector is used for this exception. The Cause register exception code is set to FPE. The EPC register points to the first instruction for which processing was not completed unless this instruction is in a Branch Delay slot. If it is in a Branch Delay slot, the EPC register points at the preceding branch instruction, and the BD bit of the Cause register is set. 7.10.5.3 Servicing This exception is cleared by resetting to 0 the appropriate bit in the Floating-Point Control Status register. For an unimplemented instruction exception, the Kernel must emulate the instruction. For other exceptions, the Kernel should pass the exception to the user process that caused the exception. 7.10.6 TLB Refill Exception This section describes the TLB Refill exception cause and response. 7.10.6.1 Cause The TLB Refill exception occurs when there is no TLB entry to match a reference to a mapped address space. This exception is not maskable under normal operation. 7.10.6.2 Handling The EZ4021-FC uses a special TLB Refill exception vector when the exception level in the Status register (at the time the TLB miss is detected) is set for normal operation (EXL = 0). If the exception level at the time of detection is set for exception (EXL = 1), then the common exception vector is used. The Cause register exception code is set to TLBL if the exception occurred during an instruction fetch or data load. It is set to TLBS if the exception was during a data Store instruction. Exception Descriptions 7-19 When the TLB Refill exception occurs, the BadVAddr, Context, and EntryHi registers hold the virtual address that failed translation. The EntryHi register also contains the ASID from which the translation fault occurred. The Random register normally contains a valid location in which to place the replacement TLB entry. The contents of the EntryLo registers are undefined. The EPC register points to the instruction that caused the exception unless the instruction is in a branch delay slot. If it is in a branch delay slot, the EPC register points to the preceding branch instruction, and the Cause register BD bit is set. 7.10.6.3 Servicing To service this exception, the contents of the Context register are used as a virtual address to fetch memory locations containing the physical page frame and access control bits for a pair of TLB entries. This information is placed in the EntryHi, EntryLo0, and EntryLo1 registers and is written into the TLB. It is possible that the virtual address used to obtain the physical address and access control information is on a page that is not resident in the TLB. In this case, a TLB Refill exception is allowed inside the TLB Refill handler. While the first exception goes to a special exception vector offset (0x000), this second exception goes to the common exception vector offset (0x180). The second TLB Refill exception obscures the contents of the BadVAddr, Context, and EntryHi registers within the TLB Refill handler. As a result, the exact virtual address whose translation caused the first fault is not known unless the TLB Refill handler specifically saved this address. It is possible to observe only the failing PTE virtual address. The BadVAddr register now contains the original contents of the Context register within the TLB Refill handler, which is the PTE address for the original failing address. The operating system can determine the original virtual page number that caused the fault, but not the complete address. The operating system uses this information to fetch the PTE that contains the physical address and to access control information. It also writes the entry into the TLB and returns to the original user program. 7-20 Error and Exception Handling Returning to the TLB Refill handler should be avoided at this point. When the EXL bit is set, it prevents the EPC from the first TLB Refill exception from being overwritten by the second TLB Refill exception. Consequently, the appropriate return address can be determined from the values of the current EPC and the Status register BD bit. 7.10.7 TLB Invalid Exception This section describes the TLB Invalid exception cause and response. 7.10.7.1 Cause The TLB invalid exception occurs when a virtual address reference matches a TLB entry that is marked invalid. This exception is not maskable under normal operation. 7.10.7.2 Handling The common exception vector is used for this exception. If the cause of the exception was an instruction fetch or data load, the Cause register exception code is set to TLBL. If the cause is a data store, the exception code is set to TLBS. When the TLB invalid exception occurs, the BadVAddr, Context, and EntryHi registers hold the virtual address that failed translation. The EntryHi register also contains the ASID from which the translation fault occurred. The contents of the EntryLo registers are undefined. The EPC register points to the instruction that caused the exception, unless this instruction is in a branch delay slot. If it is in a branch delay slot, the EPC register points to the preceding branch instruction, and the Cause register BD bit is set. 7.10.7.3 Servicing A TLB entry is typically marked invalid when one of the following is true: * A virtual address does not exist * The virtual address exists, but is not in main memory (a page fault) * A trap is desired on any reference to the page (for example, to maintain a reference bit) Exception Descriptions 7-21 After servicing the cause of the TLB invalid exception, the TLB entry is located using the TLBP instruction, and replaced by an entry with the valid bit set. For a brief description of the TLBP instruction, see Table 4.17 on page 4-26. 7.10.8 TLB Modified Exception This section describes the TLB Modified exception cause and response. 7.10.8.1 Cause The TLB modified exception occurs during a store operation when the virtual address reference to memory matches a TLB entry that is valid but is not marked dirty and therefore writable. This exception is not maskable under normal operation. 7.10.8.2 Handling The common exception vector is used for this exception. The ExcCode field in the Cause register is set to Mod. When the TLB modified exception occurs, the BadVAddr, Context, and EntryHi registers hold the virtual address that failed translation. The EntryHi register also contains the ASID from which the translation fault occurred. The contents of the EntryLo registers are undefined. The EPC register points to the instruction that caused the exception, unless this instruction is in a branch delay slot. If it is in a branch delay slot, the EPC register points to the preceding branch instruction, and the Cause register BD bit is set. 7.10.8.3 Servicing The Kernel uses the failed virtual address and virtual page number to identify the corresponding access control information. The page identified may or may not permit write access. If write accesses are not permitted, a Write Protection Violation occurs. If write accesses are permitted, the Kernel marks the page frame as dirty/writable in the Kernel's own data structure. The TLBP instruction places the index of the TLB entry that must be altered into the Index register. The Kernel loads the EntryLo registers with updated page frame information and writes them to the TLB. 7-22 Error and Exception Handling 7.10.9 EJTAG Break Exception This section describes the EJTAG Break exception cause and response. 7.10.9.1 Cause The EJTAG Break exception occurs when any of the following occur: * EJTAG Control register EjtagBrk bit is set. * EZ4021-FC is actively outputting PC Trace information and the DJ_TDIP_DINTN input signal is driven LOW. Note that PC Trace is active when the EIR contains the PC Trace instruction and the TAP Controller is in the Run-Test-Idle State. * DJ_DBGBRKP input signal is driven HIGH. EJTAG Break is incapable of breaking a system stall unless that stall is caused by a WAITI instruction. If the system is hung, EJTAG Break is not able to break the stall. Typically, the EZ4021-FC system software does not create conditions where a system hang can occur. It is recommended that the exception cause (listed above) remain asserted until it is verified that the break occurred. Spurious assertion and removal of the cause of EJTAG Break before it is verified can produce undefined operation. This recommendation is consistent with the use of standard interrupts. The EJTAG Break exception is not maskable under normal operation. 7.10.9.2 Handling The debug exception vector is used for this exception. The Debug register DM and DINT bits are set. The DEPC register points to the instruction executing when the EJTAG Break condition occurred unless this instruction is in a Branch Delay slot. If the instruction is in a Branch Delay slot, the DEPC register points to the preceding branch instruction and the DBD bit of the Debug register is set. Exception Descriptions 7-23 When the EJTAG break exception occurs, the EJTAG Control register BrkSt bit is set to 1, which indicates to the probe that the processor is in Debug mode. In addition, the debug exception vector can be fetched from the probe. Either action indicates to the debug host software that the expected breakpoint occurred, and that the debug software can begin executing. 7.10.9.3 Servicing Move one of the GPRs to the DESAVE register. Load this liberated GPR with a buffer address to which the entire GPR set should be stored in memory. Then store the value in the DESAVE register as well. Before returning from the debug exception handler, restore the GPR set just before executing the DERET instruction. Use EJTAG Break either to take control of the system and enter debug mode, or to discontinue PC Trace so the EJTAG pins are available for scanning information in and out of the EZ4021-FC core. Normal response to an EJTAG Break exception is to probe memory, the GPRs and the CP0 registers, including the DEPC, to determine where in code the core is executing. After these steps, if needed, more resources can be set up for more extensive debugging. 7.10.10 Integer Overflow Exception This section describes the Integer Overflow exception cause and response. 7.10.10.1 Cause The Integer Overflow exception occurs when an ADD, ADDI, SUB, DADD, DADDI, or DSUB instruction results in a twos-complement overflow. This exception is not maskable under normal operation. 7-24 Error and Exception Handling 7.10.10.2 Handling The common exception vector is used for this exception. The ExcCode field in the Cause register is set to OV. The EPC register points to the instruction that caused the exception unless the instruction is in a branch delay slot. If it is in a branch delay slot, the EPC register points to the preceding branch instruction, and the Cause register BD bit is set. 7.10.10.3 Servicing The process executing at the time of the exception is handed an integer overflow indication. This error is usually fatal to the process that caused the exception. 7.10.11 Trap Exception This section describes the Trap exception cause and response. 7.10.11.1 Cause The Trap exception occurs when a TGE, TGEU, TLT, TLTU, TEQ, TNE, TGEI, TGEUI, TLTI, TLTUI, TEQI, or TNEI instruction results in a TRUE condition. This exception is not maskable under normal operation. 7.10.11.2 Handling The common exception vector is used for this exception. The ExcCode field in the Cause register is set to TR. The EPC register points to the instruction that caused the exception unless the instruction is in a branch delay slot. If it is in a branch delay slot, the EPC register points to the preceding branch instruction, and the Cause register BD bit is set. 7.10.11.3 Servicing The process executing at the time of the exception is handed a trap indication. This error is usually fatal to the process that caused the exception. Exception Descriptions 7-25 7.10.12 Address Error Exception This section describes the Address Error exception cause and response. 7.10.12.1 Cause The Address Error exception occurs if the processor attempts to: * Load or store a doubleword that is not aligned on a doubleword boundary * Fetch, load, or store a word that is not aligned on a word boundary * Load or store a halfword that is not aligned on a halfword boundary * Reference Kernel address space while in either User or Supervisor mode * Reference Supervisor address space while in User mode The Address Error exception is not maskable under normal operation. 7.10.12.2 Handling The common exception vector is used for this exception. The Cause register ExcCode is set to either AdEL or AdES to indicate the exception occurred during an instruction fetch/data load or data store, respectively. When the Address Error exception occurs, the BadVAddr register holds the virtual address that was improperly aligned or that referenced protected address space. The EPC register points to the instruction that caused the exception unless the instruction is in a branch delay slot. If it is in a branch delay slot, the EPC register points to the preceding branch instruction, and the Cause register BD bit is set. 7.10.12.3 Servicing The process executing at the time of the exception is handed a segmentation violation indication. This error is usually fatal to the process that caused the exception. 7-26 Error and Exception Handling 7.10.13 Interrupt Exception This section describes the Interrupt exception cause and response. 7.10.13.1 Cause The Interrupt exception occurs when one of the eight interrupt conditions is asserted. The significance of these interrupts depends on the specific system implementation. There are six hardware interrupts and two software interrupts. Each of the eight interrupts can be masked by clearing the corresponding bit in the Int and SW mask fields of the Status register. All eight interrupts can be masked at once by clearing the Status register IE bit. 7.10.13.2 Handling The common exception vector is used for this exception. The ExcCode field in the Cause register is set to INT. The Cause register IP field indicates the current interrupt requests. It is possible that more than one bit may be set at the same time. It is also possible that none of the Cause register bits are set if an interrupt is asserted and then deasserted before the Cause register is read. The EPC register points to the first instruction for which processing was not completed unless the instruction is in a branch delay slot. If it is in a branch delay slot, the EPC register points to the preceding branch instruction, and the Cause register BD bit is set as an indicator. 7.10.13.3 Servicing If the interrupt is caused by one of the two software interrupt conditions, the interrupt condition is cleared by setting the corresponding Cause register bit to 0. If the interrupt is hardware generated, the interrupt condition is cleared by correcting the condition causing the interrupt. How this is accomplished is implementation dependent. Exception Descriptions 7-27 7.10.14 Software Debug Breakpoint Exception This section describes the Software Debug Breakpoint exception cause and response. 7.10.14.1 Cause The Software Debug Breakpoint exception occurs when an attempt is made to execute the SDBBP instruction. This exception is not maskable under normal operation. 7.10.14.2 Handling The debug exception vector is used for this exception. The Debug register DM and DBp bits are set. The DEPC register points to the SDBBP instruction, unless this instruction is in a branch delay slot. If it is in a branch delay slot, the DEPC register points to the preceding branch instruction, and the Debug register DBD bit is set. When the SDBBP break exception occurs, the EJTAG Control register BrkSt bit is set to 1, which indicates to the probe that the processor is in Debug mode. In addition, the debug exception vector can be fetched from the probe. Either action indicates to the debug host software that the expected breakpoint occurred, and that the debug software can begin executing. 7.10.14.3 Servicing Move one of the general-purpose registers to the DESAVE register. Load this liberated GPR with a buffer address to which the entire GPR set should be stored in memory. Then store the DESAVE register value as well. Before returning from the debug exception handler, restore the GPR set just before executing the DERET instruction. When the Software Debug Breakpoint exception occurs, control transfers to the debug exception handler. The code field (bits [25:6]) in the SDBBP instruction can hold additional information for the exception handler. To obtain this information, load the contents of the instruction to which the DEPC register points. If the instruction resides in a branch delay slot, then add 4 to the DEPC register value. 7-28 Error and Exception Handling The SDBBP instruction may reside in its current location because the compiler put it there or because it was swapped with another instruction. For example, a swap might occur if the debug host wanted to initiate a breakpoint. If an instruction in memory was swapped, then invalidate the cache line and restore the original instruction in memory. In this case, no adjustment of the DEPC value is necessary. If the SDBBP instruction was placed in its current location during compile time, then address calculations must be made when returning from the exception handler. It is important that the SDBBP not be executed again upon returning from the handler. The restart address can be computed by using the DEPC register and the Cause register BD bit along with knowing whether the Branch was taken or not. * If BD = 0, then Restart_PC = DEPC + 4 * If BD = 1 and branch was not taken, then Restart_PC = DEPC + 8 * If BD = 1 and branch was taken, then Restart_PC = Branch Target Address When the SDBBP instruction resides in a Branch Delay slot, it is up to the exception handler to obtain the Branch Target Address from the prior branch and determine whether the branch was taken. 7.10.15 Coprocessor Unusable Exception This section describes the Coprocessor Unusable exception cause and response. 7.10.15.1 Cause The Coprocessor Unusable exception occurs when an attempt is made to execute a coprocessor instruction for either of the following: * A coprocessor that is not marked usable * CP0 when it is not marked usable and the process is executing in Supervisor or User mode This exception is not maskable under normal operation. Exception Descriptions 7-29 7.10.15.2 Handling The common exception vector is used for this exception. The ExcCode field in the Cause register is set to CPU. The contents of the Cause register CE field indicate the coprocessor to which an attempted reference was made. The EPC register points to the instruction that caused the exception unless this instruction is in a branch delay slot. If it is in a branch delay slot, the EPC register points to the preceding branch instruction, and the Cause register BD bit is set as an indicator. 7.10.15.3 Servicing The coprocessor to which an attempted reference was made is identified in the Cause register CE field. The result is one of the following: * If the process is entitled to access, the coprocessor is marked usable and the corresponding user state is restored. * If the process is entitled to access the coprocessor, but the coprocessor does not exist or has failed, then interpret the coprocessor instruction. * If the process is not entitled to access the coprocessor, give an Illegal/Privileged Instruction indication to the process executing at the time. This error is usually fatal. 7.10.16 System Call Exception This section describes the System Call exception cause and response. 7.10.16.1 Cause The System Call exception occurs when there is an attempt to execute the SYSCALL instruction. This exception is not maskable under normal operation. 7.10.16.2 Handling The common exception vector is used for this exception. The ExcCode field in the Cause register is set to Sys. 7-30 Error and Exception Handling The EPC register points to the SYSCALL instruction that caused the exception unless this instruction is in a branch delay slot. If it is in a branch delay slot, the EPC register points to the preceding branch instruction, and the Cause register BD bit is set as an indicator. 7.10.16.3 Servicing When this exception occurs, control is transferred to the applicable system routine. To resume execution, the routine must restart instruction execution after the SYSCALL instruction. This restart address can be computed by using the EPC register and the Cause register BD bit along with knowing whether the Branch was taken. * If BD = 0, then Restart_PC = EPC + 4 * If BD = 1 and branch was not taken, then Restart_PC = EPC + 8 * If BD = 1 and branch was taken, then Restart_PC = Branch Target Address When the SYSCALL instruction resides in a Branch Delay slot, it is up to the exception handler to obtain the Branch Target Address from the prior branch and determine whether the branch was taken. 7.10.17 Breakpoint Exception This section describes the Breakpoint exception cause and response. 7.10.17.1 Cause The Breakpoint exception occurs when there is an attempt to execute the BREAK instruction. This exception is not maskable under normal operation. 7.10.17.2 Handling The common exception vector is used for this exception. The ExcCode field in the Cause register is set to BP. The EPC register points to the BREAK instruction that caused the exception unless this instruction is in a branch delay slot. If it is in a branch delay slot, the EPC register points to the preceding branch instruction, and the Cause register BD bit is set as an indicator. Exception Descriptions 7-31 7.10.17.3 Servicing When the Breakpoint exception occurs, control transfers to the exception handler. The code field (bits [25:6]) in the BREAK instruction can hold additional information for the exception handler. To obtain this information, load the contents of the instruction to which the EPC register points. If the instruction resides in a branch delay slot, then add 4 to the EPC register value. To resume execution, the routine must restart instruction execution after the BREAK instruction. This restart address can be computed by using the EPC register and the Cause register BD bit along with knowing whether the Branch was taken. * If BD = 0, then Restart_PC = EPC + 4 * If BD = 1 and branch was not taken, then Restart_PC = EPC + 8 * If BD = 1 and branch was taken, then Restart_PC = Branch Target Address When the BREAK instruction resides in a Branch Delay slot, it is up to the exception handler to obtain the Branch Target Address from the prior branch and determine whether the branch was taken. 7.10.18 Reserved Instruction Exception This section describes the Reserved Instruction exception cause and response. 7.10.18.1 Cause The Reserved Instruction exception occurs when an attempt is made to execute one of the following instructions with the conditions indicated: * An instruction whose major opcode (bits [31:26]) is undefined * A SPECIAL instruction whose minor opcode (bits [5:0]) is undefined * A REGIMM instruction whose minor opcode (bits [20:16]) is undefined For the EZ4021-FC, 64-bit operations are always valid in all processor modes. This exception is not maskable under normal operation. 7-32 Error and Exception Handling 7.10.18.2 Handling The common exception vector is used for this exception. The ExcCode field in the Cause register is set to RI. The EPC register contains the address of the Reserved instruction that caused the exception unless this instruction is in a branch delay slot. If it is in a Branch Delay slot, the EPC register points at the preceding branch instruction, and the Cause register BD bit is set as an indicator. 7.10.18.3 Servicing Use the Reserved Instruction exception to trap to emulation routines for instructions not supported in the EZ4021-FC instruction set. After emulation is completed, resume execution as described below. If there is no emulation routine, give the process executing at the time of the exception an Illegal Instruction indication. This error is usually fatal. To resume execution after emulation is completed, the routine must restart instruction execution after the Reserved instruction. This restart address can be computed by using the EPC register and the Cause register BD bit along with knowing whether the Branch was taken. * If BD = 0, then Restart_PC = EPC + 4 * If BD = 1 and branch was not taken, then Restart_PC = EPC + 8 * If BD = 1 and branch was taken, then Restart_PC = Branch Target Address When the Reserved instruction resides in a Branch Delay slot, it is up to the exception handler to obtain the Branch Target Address from the prior branch and determine whether the branch was taken. 7.10.19 Debug Single Step Exception This section describes the Debug Single Step exception cause and response. 7.10.19.1 Cause The Debug Single Step exception occurs when the SSt bit of the Debug Register (Debug[8]) is set and an instruction is executed in normal mode Exception Descriptions 7-33 (not Debug mode) before the next instruction is killed. This allows code to be executed one instruction at a time with a call to the debug exception handler between each instruction. The following exceptions exist: * An instruction in a branch delay slot is not killed by a single step exception. It is executed in tandem with the jump or branch. * An instruction that is the target of a DERET is not killed by a single step exception. This exception is not maskable under normal operation. 7.10.19.2 Handling The debug exception vector is used for this exception. The Debug register DM and DSS bits are set. The DEPC register points to the instruction killed by the single step. Because no instruction in the branch delay slot can be killed by a single step exception, the DBD and the DSS bits can never be set simultaneously. When the Debug Single Step exception occurs, the EJTAG Control register BrkSt bit is set to 1, which indicates to the probe that the processor is in Debug mode. In addition, the debug exception vector can be fetched from the probe. Either action indicates to the debug host software that the expected break occurred, and that the debug software can begin executing. 7.10.19.3 Servicing Move one of the general-purpose registers to the DESAVE register. Load this liberated GPR with a buffer address to which the entire GPR set should be stored in memory. Then store the DESAVE register value as well. Before returning from the debug exception handler, restore the GPR set just before executing the DERET instruction. The debug single step exception is used to do detailed debugging of faulty code. After each instruction is executed, specific hardware resources are polled and inspected for change. When single step mode is enabled, load scheduling is disabled in order to ensure that the system state is current when the debug exception handler examines the hardware resources. 7-34 Error and Exception Handling 7.10.20 Instruction Address Break Exception This section describes the Instruction Address Break exception cause and response. 7.10.20.1 Cause The Instruction Address Break exception occurs when all of the following occur: * The virtual address generated by the CPU for an instruction fetch matches the value in any of the IBAn registers, as masked by the corresponding IBMn register. * If the ASIDuse bit in the IBCn register is active, and the MMU-generated ASID in the EntryHi register matches the ASID field in the IBCn register. * The BE bit of the IBCn register is set to enable the hardware break. The Instruction Address Break exception is not maskable under normal operation. 7.10.20.2 Handling The debug exception vector is used for this exception. The Debug register DIB and DM bits are set. The DEPC register points to the instruction that caused the exception unless this instruction is in a branch delay slot. If it is in a branch delay slot, the DEPC register points to the preceding branch instruction, and the Debug register DBD bit is set. When the Instruction Address Break exception occurs, the EJTAG Control register BrkSt bit is set to 1, which indicates to the probe that the processor is in Debug mode. In addition, the debug exception vector can be fetched from the probe. Either action indicates to the debug host software that the expected break occurred, and that the debug software can begin executing. 7.10.20.3 Servicing Move one of the general-purpose registers to the DESAVE register. Load this liberated GPR with a buffer address to which the entire GPR set Exception Descriptions 7-35 should be stored in memory. Then store the DESAVE register value as well. Before returning from the debug exception handler, restore the GPR set just before executing the DERET instruction. 7.11 Loss of PC Trace Information In certain cases, encountering a debug exception while PC Trace is active can cause the loss of some trace information. These cases and their solutions are explained as follows: * Entering debug mode using the SDBBP instruction can cause loss of the last valid trace code prior to the SDBBP instruction. To avoid this problem, put breakpoints at the end of sequential blocks of instructions. Because SDBBP is typically used to enter debug mode, only the trace data prior to the last prior instruction is lost. To reconstruct this lost value, use the last probe trace entry, the DEPC value, and the DBD bit located in the CP0 Debug register. * Entering debug mode using an Instruction Address Break can cause the loss of the last two valid trace codes prior to the instruction that matched the break. This situation only occurs when using hardware instruction address breaks. Whenever possible, use software breakpoints instead. You can use software breakpoints in almost all cases except uncached ROM space. If you must use hardware instruction address breaks, you can reconstruct lost data using one of the following methods: - 7-36 If the lost trace data is for sequential instructions, you can easily identify the data by looking at the last recorded trace entry from the probe, the contents of the DEPC register, and a source code listing. Error and Exception Handling - If the lost trace data is a branch/jump and its delay slot instruction, you can identify this information by looking at the last probe trace entry, the DEPC value, and a source code listing. Very little information is actually lost, which makes it much easier to reconstruct the lost data. 7.12 Spurious Debug Mode Indications Under certain conditions, a spurious debug mode (DBM) indication is sent to the probe. DBM is part of the PC Trace Status signal described on page 5-8. This spurious indication only occurs when both of the following conditions are true: 1. The CPU attempts to enter debug mode due to an Instruction Address Break. 2. A Floating Point or Data Bus Error is encountered by the instruction prior to the instruction that matches the Instruction Address Break. Sending spurious debug break indications to the probe only occurs in very obscure situations. For example, the EZ4021-FC does not have a Floating-Point Unit, so generation of a Floating-Point exception is not a problem. Also, because generation of a Data Bus Error is almost always fatal to all systems, the spurious generation of a debug mode indication at that time is typically going to be a don't care. The generation of a spurious debug mode indication can be avoided by not using hardware instruction address breakpoints. Whenever possible, use software breakpoints instead. The probe software can work around the problem of spurious debug indications if it uses hardware polling. Hardware polling helps the probe detect spurious debug indications, which the probe can then safely ignore. Spurious Debug Mode Indications 7-37 7-38 Error and Exception Handling Chapter 8 Memory Test This chapter contains information on testing the instruction cache, data cache, register file, and TLB RAMs. This chapter includes the following sections: * Section 8.1, "I-Cache BIST" * Section 8.2, "D-Cache Test" * Section 8.3, "Register File Test" * Section 8.4, "Translation Lookaside Buffer (TLB) Test" 8.1 I-Cache BIST The I-Cache consists of Tag, LRU, and Data RAMs. The I-Cache RAMs have a built-in self-test (BIST) capability that uses a checkerboard test pattern and indicates a go/no go test result to an external I/O signal pin on the EZ4021-FC. See Section 5.5, "BIST Signals," page 5-14, for BIST signal information. Figure 8.1 provides a functional block diagram of the I-Cache and the associated BIST logic. MiniRISC EZ4021-FC EasyMACRO Microprocessor 8-1 Figure 8.1 I-Cache with BIST Block Diagram EZ4021-FC I-Cache Data Set 0 I-Cache Data Set 1 I-Cache Tag Set 0 I-Cache Tag Set 1 I-Cache LRU Collar Collar Collar Collar Collar MemBIST Controller User-Provided External TAP Controller The MemBIST controller generates the test vectors, cycles the tests through the RAMs, checks the results, and generates a go/no go indication to the external TAP controller. Each I-Cache RAM includes interface logic, called a collar, through which the MemBIST controller interfaces with the RAM. The user must supply the external TAP controller. You can generate a TAP controller to interface with MemBIST controllers using the Logic Vision tool, chiptesta. For information on using this tool, contact your LSI Logic Applications engineer. 8-2 Memory Test 8.2 D-Cache Test The D-Cache consists of Tag, LRU, and Data RAMs. 8.2.1 D-Cache Tag/LRU RAMs The D-Cache Tag and LRU RAMs are tested using the CACHE Index Load Tag and Index Store Tag instructions in a special cache test mode. Asserting the CACHE_TESTP core input signal enables this special test mode. While operating in cache test mode, you can read the Line Locked (LL) and LRU bits in the CP0 TagLo register. Refer to Section 3.1.3.9, "TagLo (28) and TagHi (29) Registers," page 3-19 for a description of the TagLo register and its operation. Use this register along with the CACHE Index Tag operations to write/read patterns to/from the Tag and LRU RAMs to verify their operation. 8.2.2 D-Cache Data RAMs After the D-Cache Tag and LRU RAMs have been verified, the Data RAMs can be tested using standard load and store operations. First, set up the D-Cache Tag RAMs with valid entries using a simple physical Tag ID progression. Do this using the CACHE Index Store Tag or Create Exclusive Dirty commands. Once the Tags are setup, the test program simply steps through the physical Tag ID progression using store data and load data operations to write and read data patterns to/from the Data RAMs. To avoid TLB translations, use virtual addresses in the kseg0 address range. D-Cache Test 8-3 8.3 Register File Test The register file test uses CPU instructions (such as LUI and XORI) to write and read data patterns to/from the register file. Neither the register file nor the EZ4021-FC core requires a special test mode during the register file testing. Fixed patterns are written to the 32 registers. After all 32 registers are written, the data is read out to external memory using Store instructions. The test uses six data patterns to test the register file: walking 1s, walking 0s, checkerboard, inverse checkerboard, solid 1s, and solid 0s. 8.4 Translation Lookaside Buffer (TLB) Test The TLB test uses the TLB Write (TLBW), TLB Read (TLBR), and TLB probe (TLBP) instructions along with the following CP0 registers: Index (0), EntryLo0 (2), EntryLo1 (3), PageMask (5), and EntryHi (10). For information about these registers, refer to Section 3.1.3, "Memory and TLB-Support Registers." The test sequence involves writing and verifying data patterns to/from the TLB. First, the test writes a pattern of entries to the TLB using the TLBW instruction, and then uses the TLBR instruction to read the results in the associated CP0 register. Finally, the test probes the entries using the TLBP instruction and verifies the results in the Index register. Note that the TLB instructions function even when the MMU is disabled. 8-4 Memory Test Chapter 9 Specifications This chapter specifies the EZ4021-FC's AC timing and electrical characteristics. This chapter has the following sections: * Section 9.1, "Physical Specifications" * Section 9.2, "AC Timing and Loading" 9.1 Physical Specifications The EZ4021-FC EasyMACRO Microprocessor core has a single 1x clock input. Clock duty cycles may vary from 30% to 70% at maximum frequency. Variance is greater at lower frequencies. The EZ4021-FC operates at 250 MHz tested under worst-case conditions, 1.71 V, 125 C. Table 9.1 shows the size of the EZ4021-FC in G12-p, four-layer metal technology. Table 9.1 EZ4021-FC Physical Layout Size Parameter Value Technology LCBG12P (4LM) Width 3.32 mm Height 3.56 mm Total Area 12 mm2 MiniRISC EZ4021-FC EasyMACRO Microprocessor 9-1 9.2 AC Timing and Loading The AC timing values given in this section are based on the conditions given in Table 9.2. Table 9.2 EZ4021-FC AC Timing Conditions Reference Clock Operating Conditions Insertion Delay PCLKP WCABS 2.2 ns BCCOM 1.0 ns WCABS 0.7 ns BCCOM 0.3 ns DJ_TCKP Input setup time is measured from the time the signal is valid to the rising edge of the clock. Input hold time is measured from the rising edge of the clock to the time the signal goes invalid. For input setup times, the driver must drive the signal valid before any receivers need it. For input hold times, the driver must hold the signal valid longer than needed by any receiver. The maximum and minimum delay times for outputs are measured from the rising edge of the clock to the time the signal is valid. Figure 9.1 shows how AC timing is measured. Table 9.3 shows the EZ4021-FC timing conditions, and Table 9.4 shows the AC timing for maximum clock frequency. Tables 9.5 and 9.6 show the AC timing values and loading for the EZ4021-FC. Note that all timing in Tables 9.5 and 9.6 is measured in nanoseconds. Figure 9.1 AC Specifications Clock Period PCLKP Setup Input Signal Max Delay Output Signal Min Delay 9-2 Specifications Hold Load is the total load on the net measured in standard loads visible to the output driver or to the input gate. The I/O loading values shown in Tables 9.5 and 9.6 are derived from internal loading only, that is, with the EZ4021-FC as part of a system-on-a-chip design. Table 9.3 EZ4021-FC Core Timing Conditions for G12 AC Timing Process VDD (V) Junction Temperature (C) NOM 1.00 1.8 25 BCCOM 0.80 1.89 -40 WCABS 1.17 1.71 125 Table 9.4 EZ4021-FC Core Maximum Clock Frequency for AC Timing AC Timing Clock Period (ns) Frequency (MHz) NOM 4.00 250.0 BCCOM 4.00 250.0 WCABS 4.00 250.0 AC Timing and Loading 9-3 Table 9.5 gives the AC timing for the EZ4021-FC input pins. Table 9.6 gives the AC timing for the EZ4021-FC output pins. In the tables, a tilde (~) preceding a clock name means the signal is referenced from the falling clock edge. Table 9.5 EZ4021-FC Core Input AC Timing (ns) and Loading Signal Name WCABS Setup BCCOM Hold Standard Loads, Internal Reference Clock BIG_ENDIANP static static 6 PCLKP/DJ_TCKP BIST_ALGO_MODE[1:0] 2.7 -0.3 4 PCLKP BIST_DIAG_EN 1.1 -0.1 4 PCLKP BIST_HOLD 2.7 -0.1 4 PCLKP BIST_SETUP[1:0] 3.1 -0.2 4 PCLKP BIST_SHIFT 3.1 -0.3 4 PCLKP BIST_SI 1.4 -0.2 4 PCLKP CACHE_TESTP 0.9 0.0 8 PCLKP CG_RESETP 1.3 -0.2 4 PCLKP COP_CP0COND 1.0 -0.1 6 PCLKP DCACHE_ENABLEP 1.0 0.0 6 PCLKP DJ_DBGBRKP 0.7 0.0 8 DJ_TCKP DJ_DBRKDEMUXP 0.8 0.0 10 DJ_TCKP DJ_EJTAGIRBITS[1:0] 2.1 0.0 8 DJ_TCKP DJ_JTAGALSOP 0.8 0.1 6 ~DJ_TCKP DJ_JTAGTDOP passthrough path passthrough path 4 DJ_TCKP DJ_PON[19:0] 1.7 -0.2 6 DJ_TCKP DJ_TDIP_DINTN 2.0 0.0 8 DJ_TCKP DJ_TMSP 2.0 0.0 6 DJ_TCKP (Sheet 1 of 3) 9-4 Specifications Table 9.5 EZ4021-FC Core Input AC Timing (ns) and Loading (Cont.) Signal Name WCABS Setup BCCOM Hold Standard Loads, Internal Reference Clock DJ_TRSTN 0.5 0.2 4 DJ_TCKP DJ_PCTEN static static 6 PCLKP/DJ_TCKP ICACHE_ENABLEP 0.8 0.0 10 PCLKP INTP[4:0] 2.4 -0.1 8 PCLKP LOADSCHED_ENABLEP 0.9 0.0 10 PCLKP MBIST_EN 3.8 -0.3 4 PCLKP MMU_CNTALWYSP 0.8 0.0 4 PCLKP MMU_ENABLEP 1.3 -0.1 4 PCLKP NMI 1.4 -0.2 4 PCLKP PREFETCH_ENABLEP 0.6 0.1 6 PCLKP PRID_REV[3:0] 2.2 0.0 6 PCLKP QB_ADDRP[31:3] 1.5 0.0 4 PCLKP QB_BADADDRP 2.2 -0.1 4 PCLKP QB_BOFFP 2.3 0.0 4 PCLKP QB_BURSTACKP 1.1 0.0 4 PCLKP QB_CMDRDYP 2.3 -0.1 4 PCLKP QB_GRANT_BC_DP 2.5 0.0 4 PCLKP QB_GRANT_BC_EP 2.5 0.0 4 PCLKP QB_GRANT_BC_IP 1.5 0.0 4 PCLKP QB_RDDATAP[63:0] 0.6 0.1 4 PCLKP QB_RDERRP 0.7 0.0 4 PCLKP QB_RDRDY_BC_DP 1.9 -0.1 4 PCLKP QB_RDRDY_BC_EP 1.9 0.0 4 PCLKP QB_RDRDY_BC_IP 1.9 -0.1 4 PCLKP (Sheet 2 of 3) AC Timing and Loading 9-5 Table 9.5 EZ4021-FC Core Input AC Timing (ns) and Loading (Cont.) Signal Name WCABS Setup BCCOM Hold Standard Loads, Internal Reference Clock QB_SLRDY_BC_DP 0.8 0.0 4 PCLKP QB_SLRDY_BC_EP 0.7 0.1 4 PCLKP QB_SLRDY_BC_IP 0.7 0.0 4 PCLKP QB_WRITEP 1.1 0.0 4 PCLKP READPRI_ENABLEP 0.7 0.1 4 PCLKP RESETP 0.6 0.1 4 PCLKP SCLKP_DIVP[1:0] 2.6 0.0 6 PCLKP SNOOP_ENABLEP 0.7 0.1 4 PCLKP VCED_ENABLEP static static 4 PCLKP/DJ_TCKP WRITEBUF_ENABLEP 0.7 0.1 10 PCLKP (Sheet 3 of 3) Table 9.6 EZ4021-FC Core Output AC Timing (ns) and Loading Signal Name BCCOM Min WCABS Max Standard Loads (n1a) Reference Clock BC_D_QB_BREQP 0.4 1.9 50 PCLKP BC_DMP 0.4 1.0 50 PCLKP BC_E_QB_BREQP 0.4 1.8 50 PCLKP BC_I_QB_BREQP 0.4 1.6 50 PCLKP BC_QB_ADDRP[31:3] 0.3 2.3 50 PCLKP BC_QB_BURSTREQP 0.3 2.2 50 PCLKP BC_QB_BYTEP[7:0] 0.3 2.2 50 PCLKP BC_QB_CMDLOCKP 0.3 0.9 50 PCLKP (Sheet 1 of 3) 9-6 Specifications Table 9.6 EZ4021-FC Core Output AC Timing (ns) and Loading (Cont.) Signal Name BCCOM Min WCABS Max Standard Loads (n1a) Reference Clock BC_QB_RDACKP 0.4 1.1 50 PCLKP BC_QB_READP 0.5 1.8 50 PCLKP BC_QB_WRDATAP[63:0] 0.2 0.7 50 PCLKP BC_QB_WRITEP 0.4 1.4 50 PCLKP BIST_SO 0.4 1.0 50 PCLKP CPU_EC_WAITI 0.6 1.6 50 PCLKP DCLKP1, 2 0.2 0.7 50 PCLKP DHQ_SCR1[31:0] 0.3 1.0 50 PCLKP DJ_PERRSTN2 0.2 0.7 50 PCLKP DJ_PURETDO_DRN2 0.3 0.8 50 DJ_TCKP DJ_PURETDOP2 0.3 0.9 50 ~DJ_TCKP DJ_PURETDOP from DJ_JTAGTDOP2 0.3 1.0 50 N/A DJ_TDO_DRIVEN2 0.5 1.0 50 DJ_TCKP DJ_TDOP_TPCP2 0.5 1.1 50 ~DJ_TCKP DJ_TDOP_TPCP from DJ_JTAGTDOP2 0.3 1.0 50 N/A DT_PCST1[2:0]2 0.3 0.9 50 PCLKP DT_PCST2[2:0]2 0.3 0.9 50 PCLKP (Sheet 2 of 3) AC Timing and Loading 9-7 Table 9.6 EZ4021-FC Core Output AC Timing (ns) and Loading (Cont.) Signal Name BCCOM Min WCABS Max Standard Loads (n1a) Reference Clock DT_TPC1P2 0.4 1.1 50 PCLKP DT_TPCPLP[6:0]2 0.3 1.0 50 PCLKP MBIST_CMP_STAT 0.6 3.0 50 PCLKP MBIST_DONE 0.4 1.1 50 PCLKP MBIST_GO 0.5 2.7 50 PCLKP PSTALLP 0.4 0.9 50 PCLKP (Sheet 3 of 3) 1. DCLKP timing is with respect to the rising edge of PCLKP at PCLKP input. 2. The maximum allowable loads on EJTAG output is 64 standard loads. . 9-8 Specifications Customer Feedback We would appreciate your feedback on this document. Please copy the following page, add your comments, and fax it to us at the number shown. If appropriate, please also fax copies of any marked-up pages from this document. Important: Please include your name, phone number, fax number, and company address so that we may contact you directly for clarification or additional information. Thank you for your help in improving the quality of our documents. Reader's Comments Fax your comments to: LSI Logic Corporation Technical Publications M/S E-198 Fax: 408.433.4333 Please tell us how you rate this document: MiniRISC(R) EZ4021-FC EasyMACROTM Microprocessor. Place a check mark in the appropriate blank for each category. Excellent Good Average Completeness of information Clarity of information Ease of finding information Technical content Usefulness of examples and illustrations Overall manual Fair Poor ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ What could we do to improve this document? If you found errors in this document, please specify the error and page number. If appropriate, please fax a marked-up copy of the page(s). Please complete the information below so that we may contact you directly for clarification or additional information. Name Telephone Title Department Company Name Street City, State, Zip Customer Feedback Date Fax Mail Stop U.S. Distributors by State A. E. Avnet Electronics http://www.hh.avnet.com B. M. Bell Microproducts, Inc. (for HAB's) http://www.bellmicro.com I. E. Insight Electronics http://www.insight-electronics.com W. E. Wyle Electronics http://www.wyle.com Alabama Daphne I. E. Tel: 334.626.6190 Huntsville A. E. Tel: 256.837.8700 B. M. Tel: 256.705.3559 I. E. Tel: 256.830.1222 W. E. Tel: 800.964.9953 Alaska A. E. Tel: 800.332.8638 Arizona Phoenix A. E. Tel: 480.736.7000 B. M. Tel: 602.267.9551 W. E. Tel: 800.528.4040 Tempe I. E. Tel: 480.829.1800 Tucson A. E. Tel: 520.742.0515 Arkansas W. E. Tel: 972.235.9953 California Agoura Hills B. M. Tel: 818.865.0266 Granite Bay B. M. Tel: 916.523.7047 Irvine A. E. Tel: 949.789.4100 B. M. Tel: 949.470.2900 I. E. Tel: 949.727.3291 W. E. Tel: 800.626.9953 Los Angeles A. E. Tel: 818.594.0404 W. E. Tel: 800.288.9953 Sacramento A. E. Tel: 916.632.4500 W. E. Tel: 800.627.9953 San Diego A. E. Tel: 858.385.7500 B. M. Tel: 858.597.3010 I. E. Tel: 800.677.6011 W. E. Tel: 800.829.9953 San Jose A. E. Tel: 408.435.3500 B. M. Tel: 408.436.0881 I. E. Tel: 408.952.7000 Santa Clara W. E. Tel: 800.866.9953 Woodland Hills A. E. Tel: 818.594.0404 Westlake Village I. E. Tel: 818.707.2101 Colorado Denver A. E. Tel: 303.790.1662 B. M. Tel: 303.846.3065 W. E. Tel: 800.933.9953 Englewood I. E. Tel: 303.649.1800 Idaho Springs B. M. Tel: 303.567.0703 Illinois North/South A. E. Tel: 847.797.7300 Tel: 314.291.5350 Chicago B. M. Tel: 847.413.8530 W. E. Tel: 800.853.9953 Schaumburg I. E. Tel: 847.885.9700 Connecticut Cheshire A. E. Tel: 203.271.5700 I. E. Tel: 203.272.5843 Wallingford W. E. Tel: 800.605.9953 Indiana Fort Wayne I. E. Tel: 219.436.4250 W. E. Tel: 888.358.9953 Indianapolis A. E. Tel: 317.575.3500 Delaware North/South A. E. Tel: 800.526.4812 Tel: 800.638.5988 B. M. Tel: 302.328.8968 W. E. Tel: 856.439.9110 Iowa W. E. Tel: 612.853.2280 Cedar Rapids A. E. Tel: 319.393.0033 Florida Altamonte Springs B. M. Tel: 407.682.1199 I. E. Tel: 407.834.6310 Boca Raton I. E. Tel: 561.997.2540 Bonita Springs B. M. Tel: 941.498.6011 Clearwater I. E. Tel: 727.524.8850 Fort Lauderdale A. E. Tel: 954.484.5482 W. E. Tel: 800.568.9953 Miami B. M. Tel: 305.477.6406 Orlando A. E. Tel: 407.657.3300 W. E. Tel: 407.740.7450 Tampa W. E. Tel: 800.395.9953 St. Petersburg A. E. Tel: 727.507.5000 Georgia Atlanta A. E. Tel: 770.623.4400 B. M. Tel: 770.980.4922 W. E. Tel: 800.876.9953 Duluth I. E. Tel: 678.584.0812 Hawaii A. E. Tel: 800.851.2282 Idaho A. E. W. E. Tel: 801.365.3800 Tel: 801.974.9953 Kansas W. E. Tel: 303.457.9953 Kansas City A. E. Tel: 913.663.7900 Lenexa I. E. Tel: 913.492.0408 Kentucky W. E. Tel: 937.436.9953 Central/Northern/ Western A. E. Tel: 800.984.9503 Tel: 800.767.0329 Tel: 800.829.0146 Louisiana W. E. Tel: 713.854.9953 North/South A. E. Tel: 800.231.0253 Tel: 800.231.5775 Maine A. E. W. E. Tel: 800.272.9255 Tel: 781.271.9953 Maryland Baltimore A. E. Tel: 410.720.3400 W. E. Tel: 800.863.9953 Columbia B. M. Tel: 800.673.7461 I. E. Tel: 410.381.3131 Massachusetts Boston A. E. Tel: 978.532.9808 W. E. Tel: 800.444.9953 Burlington I. E. Tel: 781.270.9400 Marlborough B. M. Tel: 800.673.7459 Woburn B. M. Tel: 800.552.4305 Michigan Brighton I. E. Tel: 810.229.7710 Detroit A. E. Tel: 734.416.5800 W. E. Tel: 888.318.9953 Clarkston B. M. Tel: 877.922.9363 Minnesota Champlin B. M. Tel: 800.557.2566 Eden Prairie B. M. Tel: 800.255.1469 Minneapolis A. E. Tel: 612.346.3000 W. E. Tel: 800.860.9953 St. Louis Park I. E. Tel: 612.525.9999 Mississippi A. E. Tel: 800.633.2918 W. E. Tel: 256.830.1119 Missouri W. E. Tel: 630.620.0969 St. Louis A. E. Tel: 314.291.5350 I. E. Tel: 314.872.2182 Montana A. E. Tel: 800.526.1741 W. E. Tel: 801.974.9953 Nebraska A. E. Tel: 800.332.4375 W. E. Tel: 303.457.9953 Nevada Las Vegas A. E. Tel: 800.528.8471 W. E. Tel: 702.765.7117 New Hampshire A. E. Tel: 800.272.9255 W. E. Tel: 781.271.9953 New Jersey North/South A. E. Tel: 201.515.1641 Tel: 609.222.6400 Mt. Laurel I. E. Tel: 856.222.9566 Pine Brook B. M. Tel: 973.244.9668 W. E. Tel: 800.862.9953 Parsippany I. E. Tel: 973.299.4425 Wayne W. E. Tel: 973.237.9010 New Mexico W. E. Tel: 480.804.7000 Albuquerque A. E. Tel: 505.293.5119 U.S. Distributors by State (Continued) New York Hauppauge I. E. Tel: 516.761.0960 Long Island A. E. Tel: 516.434.7400 W. E. Tel: 800.861.9953 Rochester A. E. Tel: 716.475.9130 I. E. Tel: 716.242.7790 W. E. Tel: 800.319.9953 Smithtown B. M. Tel: 800.543.2008 Syracuse A. E. Tel: 315.449.4927 North Carolina Raleigh A. E. Tel: 919.859.9159 I. E. Tel: 919.873.9922 W. E. Tel: 800.560.9953 North Dakota A. E. Tel: 800.829.0116 W. E. Tel: 612.853.2280 Ohio Cleveland A. E. Tel: 216.498.1100 W. E. Tel: 800.763.9953 Dayton A. E. Tel: 614.888.3313 I. E. Tel: 937.253.7501 W. E. Tel: 800.575.9953 Strongsville B. M. Tel: 440.238.0404 Valley View I. E. Tel: 216.520.4333 Oklahoma W. E. Tel: 972.235.9953 Tulsa A. E. Tel: 918.459.6000 I. E. Tel: 918.665.4664 Oregon Beaverton B. M. Tel: 503.524.1075 I. E. Tel: 503.644.3300 Portland A. E. Tel: 503.526.6200 W. E. Tel: 800.879.9953 Pennsylvania Mercer I. E. Tel: 412.662.2707 Philadelphia A. E. Tel: 800.526.4812 B. M. Tel: 877.351.2355 W. E. Tel: 800.871.9953 Pittsburgh A. E. Tel: 412.281.4150 W. E. Tel: 440.248.9996 Rhode Island A. E. 800.272.9255 W. E. Tel: 781.271.9953 South Carolina A. E. Tel: 919.872.0712 W. E. Tel: 919.469.1502 South Dakota A. E. Tel: 800.829.0116 W. E. Tel: 612.853.2280 Tennessee W. E. Tel: 256.830.1119 East/West A. E. Tel: 800.241.8182 Tel: 800.633.2918 Texas Arlington B. M. Tel: 817.417.5993 Austin A. E. Tel: 512.219.3700 B. M. Tel: 512.258.0725 I. E. Tel: 512.719.3090 W. E. Tel: 800.365.9953 Dallas A. E. Tel: 214.553.4300 B. M. Tel: 972.783.4191 W. E. Tel: 800.955.9953 El Paso A. E. Tel: 800.526.9238 Houston A. E. Tel: 713.781.6100 B. M. Tel: 713.917.0663 W. E. Tel: 800.888.9953 Richardson I. E. Tel: 972.783.0800 Rio Grande Valley A. E. Tel: 210.412.2047 Stafford I. E. Tel: 281.277.8200 Utah Centerville B. M. Tel: 801.295.3900 Murray I. E. Tel: 801.288.9001 Salt Lake City A. E. Tel: 801.365.3800 W. E. Tel: 800.477.9953 Vermont A. E. Tel: 800.272.9255 W. E. Tel: 716.334.5970 Virginia A. E. Tel: 800.638.5988 W. E. Tel: 301.604.8488 Haymarket B. M. Tel: 703.754.3399 Springfield B. M. Tel: 703.644.9045 Washington Kirkland I. E. Tel: 425.820.8100 Maple Valley B. M. Tel: 206.223.0080 Seattle A. E. Tel: 425.882.7000 W. E. Tel: 800.248.9953 West Virginia A. E. Tel: 800.638.5988 Wisconsin Milwaukee A. E. Tel: 414.513.1500 W. E. Tel: 800.867.9953 Wauwatosa I. E. Tel: 414.258.5338 Wyoming A. E. Tel: 800.332.9326 W. E. Tel: 801.974.9953 Sales Offices and Design Resource Centers LSI Logic Corporation Corporate Headquarters 1551 McCarthy Blvd Milpitas CA 95035 Tel: 408.433.8000 Fax: 408.433.8989 Fort Collins 2001 Danfield Court Fort Collins, CO 80525 Tel: 970.223.5100 Fax: 970.206.5549 New Jersey Red Bank 125 Half Mile Road Suite 200 Red Bank, NJ 07701 Tel: 732.933.2656 Fax: 732.933.2643 NORTH AMERICA Florida Boca Raton Cherry Hill - Mint Technology California Irvine 2255 Glades Road Suite 324A Boca Raton, FL 33431 Tel: 561.989.3236 Fax: 561.989.3237 Tel: 856.489.5530 Fax: 856.489.5531 Georgia Alpharetta New York Fairport 2475 North Winds Parkway Suite 200 Alpharetta, GA 30004 550 Willowbrook Office Park Fairport, NY 14450 18301 Von Karman Ave Suite 900 Irvine, CA 92612 Tel: 949.809.4600 Fax: 949.809.4444 Pleasanton Design Center 5050 Hopyard Road, 3rd Floor Suite 300 Pleasanton, CA 94588 Tel: 925.730.8800 Fax: 925.730.8700 Tel: 770.753.6146 Fax: 770.753.6147 Illinois Oakbrook Terrace 215 Longstone Drive Cherry Hill, NJ 08003 Tel: 716.218.0020 Fax: 716.218.9010 North Carolina Raleigh Phase II 4601 Six Forks Road Suite 528 Raleigh, NC 27609 Tel: 630.954.2234 Fax: 630.954.2235 Tel: 919.785.4520 Fax: 919.783.8909 Kentucky Bowling Green Oregon Beaverton 1551 McCarthy Blvd Sales Office M/S C-500 Milpitas, CA 95035 1262 Chestnut Street Bowling Green, KY 42101 15455 NW Greenbrier Parkway Suite 235 Beaverton, OR 97006 Fax: 408.954.3353 Maryland Bethesda 7585 Ronson Road Suite 100 San Diego, CA 92111 Tel: 858.467.6981 Fax: 858.496.0548 Silicon Valley Tel: 408.433.8000 Design Center M/S C-410 Tel: 408.433.8000 Fax: 408.433.7695 Wireless Design Center 11452 El Camino Real Suite 210 San Diego, CA 92130 Tel: 858.350.5560 Fax: 858.350.0171 Colorado Boulder 4940 Pearl East Circle Suite 201 Boulder, CO 80301 Tel: 303.447.3800 Fax: 303.541.0641 Colorado Springs Tel: 270.793.0010 Fax: 270.793.0040 6903 Rockledge Drive Suite 230 Bethesda, MD 20817 Tel: 301.897.5800 Fax: 301.897.8389 Massachusetts Waltham 200 West Street Waltham, MA 02451 Tel: 781.890.0180 Fax: 781.890.6158 Tel: 503.645.0589 Fax: 503.645.6612 Texas Austin 9020 Capital of TX Highway North Building 1 Suite 150 Austin, TX 78759 Tel: 512.388.7294 Fax: 512.388.4171 Plano 500 North Central Expressway Suite 440 Plano, TX 75074 Tel: 972.244.5000 Burlington - Mint Technology Fax: 972.244.5001 77 South Bedford Street Burlington, MA 01803 Houston Tel: 781.685.3800 Fax: 781.685.3801 20405 State Highway 249 Suite 450 Houston, TX 77070 4420 Arrowswest Drive Colorado Springs, CO 80907 Minnesota Minneapolis Tel: 719.533.7000 Fax: 719.533.7020 8300 Norman Center Drive Suite 730 Minneapolis, MN 55437 Tel: 612.921.8300 Fax: 612.921.8399 260 Hearst Way Suite 400 Kanata, ON K2L 3H1 Tel: 613.592.1263 Fax: 613.592.3253 Two Mid American Plaza Suite 800 Oakbrook Terrace, IL 60181 San Diego Canada Ontario Ottawa Tel: 281.379.7800 Fax: 281.379.7818 INTERNATIONAL France Paris LSI Logic S.A. Immeuble Europa 53 bis Avenue de l'Europe B.P. 139 78148 Velizy-Villacoublay Cedex, Paris Tel: 33.1.34.63.13.13 Fax: 33.1.34.63.13.19 Germany Munich LSI Logic GmbH Orleansstrasse 4 81669 Munich Tel: 49.89.4.58.33.0 Fax: 49.89.4.58.33.108 Stuttgart Mittlerer Pfad 4 D-70499 Stuttgart Tel: 49.711.13.96.90 Fax: 49.711.86.61.428 Italy Milan LSI Logic S.P.A. Centro Direzionale Colleoni Palazzo Orione Ingresso 1 20041 Agrate Brianza, Milano Tel: 39.039.687371 Fax: 39.039.6057867 Japan Tokyo LSI Logic K.K. Rivage-Shinagawa Bldg. 14F 4-1-8 Kounan Minato-ku, Tokyo 108-0075 Tel: 81.3.5463.7821 Fax: 81.3.5463.7820 Osaka Crystal Tower 14F 1-2-27 Shiromi Chuo-ku, Osaka 540-6014 Tel: 81.6.947.5281 Fax: 81.6.947.5287 Sales Offices and Design Resource Centers (Continued) Korea Seoul LSI Logic Corporation of Korea Ltd 10th Fl., Haesung 1 Bldg. 942, Daechi-dong, Kangnam-ku, Seoul, 135-283 Tel: 82.2.528.3400 Fax: 82.2.528.2250 The Netherlands Eindhoven LSI Logic Europe Ltd World Trade Center Eindhoven Building `Rijder' Bogert 26 5612 LZ Eindhoven Tel: 31.40.265.3580 Fax: 31.40.296.2109 Singapore Singapore LSI Logic Pte Ltd 7 Temasek Boulevard #28-02 Suntec Tower One Singapore 038987 Tel: 65.334.9061 Fax: 65.334.4749 Sweden Stockholm LSI Logic AB Finlandsgatan 14 164 74 Kista Tel: 46.8.444.15.00 Fax: 46.8.750.66.47 Taiwan Taipei LSI Logic Asia, Inc. Taiwan Branch 10/F 156 Min Sheng E. Road Section 3 Taipei, Taiwan R.O.C. Tel: 886.2.2718.7828 Fax: 886.2.2718.8869 United Kingdom Bracknell LSI Logic Europe Ltd Greenwood House London Road Bracknell, Berkshire RG12 2UB Tel: 44.1344.426544 Fax: 44.1344.481039 Sales Offices with Design Resource Centers International Distributors Australia New South Wales Reptechnic Pty Ltd Hong Kong Hong Kong AVT Industrial Ltd 3/36 Bydown Street Neutral Bay, NSW 2089 Unit 608 Tower 1 Cheung Sha Wan Plaza 833 Cheung Sha Wan Road Kowloon, Hong Kong Tel: 612.9953.9844 Fax: 612.9953.9683 Belgium Acal nv/sa Lozenberg 4 1932 Zaventem Tel: 32.2.7205983 Fax: 32.2.7251014 China Beijing LSI Logic International Services Inc. Beijing Representative Office Room 708 Canway Building 66 Nan Li Shi Lu Xicheng District Beijing 100045, China Tel: 86.10.6804.2534 to 38 Fax: 86.10.6804.2521 France Rungis Cedex Azzurri Technology France 22 Rue Saarinen Sillic 274 94578 Rungis Cedex Tel: 33.1.41806310 Fax: 33.1.41730340 Germany Haar EBV Elektronik Tel: 852.2428.0008 Fax: 852.2401.2105 Serial System (HK) Ltd 2301 Nanyang Plaza 57 Hung To Road, Kwun Tong Kowloon, Hong Kong Tel: 852.2995.7538 Fax: 852.2950.0386 India Bangalore Spike Technologies India Private Ltd 951, Vijayalakshmi Complex, 2nd Floor, 24th Main, J P Nagar II Phase, Bangalore, India 560078 Tel: 91.80.664.5530 Fax: 91.80.664.9748 Macnica Corporation Tel: 44.1628.826826 Fax: 44.1628.829730 Hakusan High-Tech Park 1-22-2 Hadusan, Midori-Ku, Yokohama-City, 226-8505 Milton Keynes Ingram Micro (UK) Ltd Tel: 81.45.939.6140 Fax: 81.45.939.6141 The Netherlands Eindhoven Acal Nederland b.v. Japan Tokyo Daito Electron Tel: 49.89.4600980 Fax: 49.89.46009840 Munich Avnet Emg GmbH Global Electronics Corporation Stahlgruberring 12 81829 Munich Nichibei Time24 Bldg. 35 Tansu-cho Shinjuku-ku, Tokyo 162-0833 Tel: 49.89.45110102 Fax: 49.89.42.27.75 Tel: 81.3.3260.1411 Fax: 81.3.3260.7100 Technical Center Tel: 81.471.43.8200 Tel: 81.3.5778.8662 Fax: 81.3.5778.8669 Shinki Electronics Myuru Daikanyama 3F 3-7-3 Ebisu Minami Shibuya-ku, Tokyo 150-0022 Tel: 81.3.3760.3110 Fax: 81.3.3760.3101 Tel: 44.1908.260422 Swindon EBV Elektronik Tel: 31.40.2.502602 Fax: 31.40.2.510255 12 Interface Business Park Bincknoll Lane Wootton Bassett, Swindon, Wiltshire SN4 8SY Switzerland Brugg LSI Logic Sulzer AG Mattenstrasse 6a CH 2555 Brugg 14F, No. 145, Sec. 2, Chien Kuo N. Road Taipei, Taiwan, R.O.C. Tel: 886.2.2516.7303 Fax: 886.2.2505.7391 Lumax International Corporation, Ltd 7th Fl., 52, Sec. 3 Nan-Kang Road Taipei, Taiwan, R.O.C. Tel: 886.2.2788.3656 Fax: 886.2.2788.3568 Prospect Technology Corporation, Ltd 4Fl., No. 34, Chu Luen Street Taipei, Taiwan, R.O.C. Tel: 886.2.2721.9533 Fax: 886.2.2773.3756 Marubeni Solutions 1-26-20 Higashi Shibuya-ku, Tokyo 150-0001 Garamonde Drive Wymbush Milton Keynes Buckinghamshire MK8 8DF Beatrix de Rijkweg 8 5657 EG Eindhoven Taiwan Taipei Avnet-Mercuries Corporation, Ltd Tel: 81.3.3264.0326 Fax: 81.3.3261.3984 Tel: 49.2957.79.1692 Fax: 49.2957.79.9341 16 Grove Park Business Estate Waltham Road White Waltham Maidenhead, Berkshire SL6 3LW 11 Rozanis Street P.O. Box 39300 Tel Aviv 61392 Tel: 972.3.6458777 Fax: 972.3.6458666 United Kingdom Maidenhead Azzurri Technology Ltd Tel: 81.45.474.9037 Fax: 81.45.474.9065 Tel: 41.32.3743232 Fax: 41.32.3743233 Sogo Kojimachi No.3 Bldg 1-6 Kojimachi Chiyoda-ku, Tokyo 102-8730 Graf-Zepplin-Str 14 D-33181 Wuennenberg-Haaren 2-15-10 Shin Yokohama Kohoku-ku Yokohama-City, 222-8580 Israel Tel Aviv Eastronics Ltd Hans-Pinsel Str. 4 D-85540 Haar Wuennenberg-Haaren Peacock AG Yokohama-City Innotech Wintech Microeletronics Co., Ltd 7F., No. 34, Sec. 3, Pateh Road Taipei, Taiwan, R.O.C. Tel: 886.2.2579.5858 Fax: 886.2.2570.3123 Tel: 44.1793.849933 Fax: 44.1793.859555 Sales Offices with Design Resource Centers Chapter 1 Introduction 1.1 Overview 1.2 Features 1.3 Application Examples 1.4 CoreWare Program Chapter 2 Functional Description 2.1 EZ4021-FC CPU 2.1.1 CPU Data Path Control (CDC) Module 2.1.2 Integer Data Path (IDP) Module 2.1.3 System Coprocessor 0 (CP0) 2.1.4 Pipeline Architecture 2.2 Memory Management Unit 2.3 Cache Memory 2.3.1 Instruction Cache 2.3.2 Data Cache 2.3.3 Cache Maintenance Operations 2.4 Multiply/Divide Unit (MDU) 2.4.1 Standard Instructions 2.4.2 Extended Instructions 2.4.3 Performance 2.4.4 Pipeline Interlocks 2.5 Quick Bus Interface 2.6 Bus Interface Unit (BIU) 2.6.1 BIU Features 2.6.2 Instruction Cache Refill Summary 2.6.3 Data Cache Refill Summary 2.6.4 Quick Bus Access Priority 2.6.5 Programmable BIU Features 2.7 EJTAG Interface 2.8 Clocks 2.8.1 System Clock 2.8.2 EJTAG and Scan Clocks 2.8.3 Require External Synchronization to System Clock 1-1 1-3 1-5 1-5 2-2 2-3 2-3 2-3 2-3 2-4 2-5 2-5 2-7 2-11 2-12 2-12 2-12 2-12 2-13 2-13 2-14 2-15 2-17 2-17 2-17 2-18 2-18 2-23 2-23 2-24 2-24 Chapter 3 Programmer's Model 3.1 Memory Management 3.1.1 Operating Modes 3.1.2 Virtual Memory and the TLB 3.1.3 Memory and TLB-Support Registers 3.1.4 Virtual Address Translation 3.2 Exception Processing 3.2.1 Exception Vector Locations 3.2.2 CP0 Exception Processing Registers 3.3 EJTAG Debugging 3.3.1 EJTAG Debug Registers 3.3.2 EJTAG Serial-Access Registers 3.3.3 EJTAG CP0 Registers 3.3.4 EJTAG Memory Mapped Registers 3.4 System Configuration Register 1 3-1 3-1 3-7 3-9 3-20 3-22 3-23 3-23 3-34 3-35 3-35 3-49 3-57 3-74 Chapter 4 Instruction Set Architecture 4.1 Instruction Set Formats 4-1 4.2 Load and Store Instructions 4-2 4.2.1 Scheduling a Load Delay Slot 4-2 4.2.2 Defining Access Types 4-3 4.2.3 CPU Loads and Stores 4-5 4.2.4 Atomic Update Loads and Stores 4-9 4.2.5 Coprocessor Loads and Stores 4-9 4.3 Computational Instructions 4-10 4.3.1 ALU 4-11 4.3.2 Three-Operand, Register Type 4-13 4.3.3 Shift 4-14 4.3.4 Multiply and Divide 4-16 4.4 Jump and Branch Instructions 4-19 4.5 Exception Instructions 4-22 4.6 Serialization Instruction 4-24 4.7 Coprocessor Instructions 4-24 4.7.1 Coprocessor Data Movement and Conditional Branch Instructions4-24 4.7.2 System Control Coprocessor (CP0) Instructions 4-26 4.8 4.9 4.10 Cache Maintenance Instruction EZ4021-FC Instruction Extensions 4.9.1 General 32-Bit Instruction Extensions 4.9.2 CP0 Instruction Extensions CPU 32-Bit Instruction Opcode Encoding 4-27 4-32 4-32 4-33 4-42 Chapter 5 Signal Descriptions 5.1 Quick Bus Interface 5.2 Interrupt, Clock, and Reset Signals 5.3 EJTAG and PC Trace Signals 5.3.1 EJTAG Standard Signals 5.3.2 EJTAG Standard Support Signals 5.3.3 Nonmultiplexed EJTAG Signals 5.3.4 EJTAG External Module Signals 5.3.5 EJTAG Configuration Signals 5.4 Global Test Mode Signals 5.5 BIST Signals 5.6 Miscellaneous Signals 5-1 5-5 5-7 5-7 5-10 5-10 5-11 5-11 5-13 5-14 5-15 Chapter 6 Interface Operation 6.1 Quick Bus Transactions 6.1.1 Basic Transactions 6.1.2 Advanced Transactions 6.2 Reset Behavior 6.2.1 Reset 6.2.2 Soft Reset 6.2.3 Modules Affected by Reset 6.3 Interrupt Behavior 6.3.1 Nonmaskable Interrupt 6.3.2 Maskable Interrupts 6.4 Wait States 6-1 6-1 6-7 6-14 6-14 6-15 6-15 6-17 6-17 6-18 6-19 Chapter 7 Error and Exception Handling 7.1 Overview 7-1 7.2 7.3 7.4 7.5 7.6 7.7 7.8 7.9 7.10 7.11 7.12 Exception Handling Registers Standard Exception Operation Standard Exception Processing Actions Debug Exception Operation Debug Exception Processing Precision of Exceptions Exception Vector Locations Priority of Exceptions 7.9.1 Overriding Priority (Stage Independent) 7.9.2 W Stage Exceptions 7.9.3 M Stage Exceptions 7.9.4 X Stage Exceptions 7.9.5 R Stage Exceptions Exception Descriptions 7.10.1 Reset Exception 7.10.2 Soft Reset Exception 7.10.3 Data Address Break Exception 7.10.4 Bus Error Exception 7.10.5 Floating-Point Exception 7.10.6 TLB Refill Exception 7.10.7 TLB Invalid Exception 7.10.8 TLB Modified Exception 7.10.9 EJTAG Break Exception 7.10.10 Integer Overflow Exception 7.10.11 Trap Exception 7.10.12 Address Error Exception 7.10.13 Interrupt Exception 7.10.14 Software Debug Breakpoint Exception 7.10.15 Coprocessor Unusable Exception 7.10.16 System Call Exception 7.10.17 Breakpoint Exception 7.10.18 Reserved Instruction Exception 7.10.19 Debug Single Step Exception 7.10.20 Instruction Address Break Exception Loss of PC Trace Information Spurious Debug Mode Indications 7-5 7-6 7-7 7-8 7-9 7-9 7-10 7-11 7-11 7-12 7-12 7-12 7-12 7-12 7-13 7-14 7-16 7-17 7-18 7-19 7-21 7-22 7-23 7-24 7-25 7-26 7-27 7-28 7-29 7-30 7-31 7-32 7-33 7-35 7-36 7-37 Chapter 8 Memory Test 8.1 I-Cache BIST 8.2 D-Cache Test 8.2.1 D-Cache Tag/LRU RAMs 8.2.2 D-Cache Data RAMs 8.3 Register File Test 8.4 Translation Lookaside Buffer (TLB) Test 8-1 8-3 8-3 8-3 8-4 8-4 Chapter 9 Specifications 9.1 Physical Specifications 9.2 AC Timing and Loading 9-1 9-2 Customer Feedback 1.1 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 2.11 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 3.17 3.18 3.19 3.20 3.21 3.22 3.23 3.24 3.25 EZ4021-FC EasyMACRO Microprocessor Block Diagram EZ4021-FC EasyMACRO Microprocessor Block Diagram EZ4021-FC Instruction Pipeline I-Cache Line State Diagram Address to I-Cache Tag and Line Number Write Back Line State Transition Diagram Write Through Line State Transition Diagram Address to D-Cache Tag and Line Number BIU I/O Block Diagram TAP Controller On-Chip SCLKP Generation EZ4021-FC Clock Distribution User Mode Memory Map Supervisor Mode Memory Map Kernel Mode Memory Map EZ4021-FC Virtual Address Format EZ4021-FC TLB Entry Format Index Register (0) Random Register (1) EntryLo0/1 Register PageMask Register (5) Wired Register Location Wired Register EntryHi Register (10) PRId Register (15) Config Register (16) TagLo Register EZ4021-FC TLB Address Translation Process Context Register (4) BadVAddr Register (8) Count Register (9) Compare Register (11) Status Register (12) Cause Register (13) EPC Register (14) ErrorEPC Register (30) EJTAG Instruction Register (EIR) 1-2 2-2 2-3 2-6 2-7 2-8 2-9 2-10 2-15 2-20 2-23 2-25 3-3 3-4 3-5 3-7 3-8 3-10 3-11 3-12 3-13 3-14 3-14 3-15 3-16 3-17 3-20 3-21 3-25 3-26 3-26 3-27 3-27 3-30 3-33 3-34 3-36 3.26 3.27 3.28 3.29 3.30 3.31 3.32 3.33 3.34 3.35 3.36 3.37 3.38 3.39 3.40 3.41 3.42 3.43 3.44 3.45 3.46 4.1 4.2 4.3 6.1 6.2 6.3 6.4 6.5 6.6 6.7 6.8 6.9 6.10 6.11 6.12 6.13 7.1 EJTAG Bypass Register (EBR) EJTAG Device Identification Register (EDIR) EJTAG Implementation Register (EIMR) EJTAG Address Register (EAR) EJTAG Data Register (EDR) EJTAG Control Register (ECR) Byte Lane Significance and Dsz Definition Debug Register (23) (Debug) Debug Exception Program Counter (DEPC) Register (24) Debug Exception Save (DESAVE) Register (31) Debug Control Register (DCR) Instruction Address Break Status (IBS) Register Instruction Address Break n Register (IBAn) Instruction Address Break Control n Register (IBCn) Instruction Address Break Mask n Registers (IBMn) Data Address Break Status Register (DBS) Data Break Address n Registers (DBAn) Data Break Control n Registers (DBCn) Data Address Break Mask n Registers (DBMn) Data Value Break n Registers (DVBn) System Configuration Register 1 Instruction Format Byte Specifications for Loads/Store Index Effective Address Format Four-Doubleword Instruction Request Instruction Burst Data Return Single Doubleword Instruction Request and Return Store Data Write Store Burst Quick Bus Slave Ready Operation Burst Request of a Nonburstable Device Multiple Requests Reset Pipeline Behavior NMI Pipeline Behavior (Detected Immediately) NMI Pipeline Behavior (Detection Delayed due to Stall) Interrupt Pipeline Behavior (Detected Immediately) WAITI Pipeline Stall Reset Exception 3-38 3-38 3-39 3-41 3-42 3-43 3-47 3-50 3-55 3-56 3-60 3-62 3-64 3-65 3-66 3-68 3-69 3-70 3-73 3-74 3-74 4-2 4-4 4-28 6-2 6-3 6-4 6-6 6-7 6-9 6-10 6-12 6-14 6-17 6-18 6-19 6-20 7-7 7.2 7.3 7.4 8.1 9.1 Soft Reset and NMI Exceptions Common Exceptions Debug Exceptions I-Cache with BIST Block Diagram AC Specifications 7-7 7-8 7-9 8-2 9-2 2.1 2.2 2.3 2.4 2.5 3.1 3.2 3.3 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 4.10 4.11 4.12 4.13 4.14 4.15 4.16 4.17 4.18 4.19 4.20 4.21 4.22 4.23 4.24 4.25 4.26 4.27 4.28 6.1 7.1 Write Back D-Cache Data Coherency 2-9 Write Through D-Cache Data Coherency 2-10 Cache Maintenance Operations 2-11 Execution Time of Multiply and Divide Instructions 2-13 Programmable Features 2-18 Exception Addresses 3-23 EJTAG Interface Instructions 3-37 Memory-Mapped Registers 3-58 Normal CPU Load/Store Instructions 4-6 Unaligned CPU Load/Store Instructions 4-8 Atomic Update CPU Load/Store Instructions 4-9 Coprocessor Load/Store Instructions 4-10 ALU Instructions with an Immediate Operand 4-12 Three-Operand, Register Type Instructions 4-13 Shift Instructions 4-15 Multiply and Divide Instructions 4-17 Execution Time of Multiply and Divide Instructions 4-18 Jump Instructions 4-20 PC-Relative Conditional Branch Instructions 4-20 PC-Relative Conditional Branch Likely Instructions 4-21 Breakpoint and System Call Instructions 4-22 Trap-on-Condition Instructions 4-23 Serialization Instruction 4-24 Coprocessor Data Movement and Conditional Branch Instructions4-25 CP0 Instructions 4-26 Cache Maintenance Instruction 4-27 Cache Operation Code Definitions 4-29 General Instruction Extensions 4-32 CP0 Instruction Extensions 4-33 MIPS III Major Opcode Bit Encoding 4-42 COPz rs Opcode Bit Encoding 4-43 COPz rt Opcode Bit Encoding 4-43 REGIMM Opcode rt Bit Encoding 4-43 SPECIAL Opcode Bit Encoding 4-44 SPECIAL 2 Opcode Bit Encoding 4-44 CP0 Opcode Bit Encoding 4-45 Reset Sensitivity 6-16 EZ4021-FC Standard Exception Summary 7-3 7.2 7.3 7.4 7.5 7.6 9.1 9.2 9.3 9.4 9.5 9.6 CP0 Exception Processing Registers 7-5 Current Processor Mode 7-7 Standard Exception Vector Base Addresses 7-10 Debug Exception Vector Base Addresses 7-11 Exception Vector Offset Addresses 7-11 EZ4021-FC Physical Layout Size 9-1 EZ4021-FC AC Timing Conditions 9-2 EZ4021-FC Core Timing Conditions for G12 9-3 EZ4021-FC Core Maximum Clock Frequency for AC Timing 9-3 EZ4021-FC Core Input AC Timing (ns) and Loading 9-4 EZ4021-FC Core Output AC Timing (ns) and Loading 9-6