Freescale Semiconductor, Inc.
Technical Infor mation Center, EL516
2100 East Elliot Road
Tempe, Arizona 85284
+1-800-521-6274 or
+1-480-768-2130
www.freescale.com/support
Japan:
Freescale Semiconductor Japan Ltd.
Headquarters
ARCO Tower 15F
1-8-1, Shimo-Meguro, Meguro-ku
Tokyo 153-0064
Japan
0120 191014 or
+81 3 5437 9125
support.japan@freescale.com
Asia/Pacific:
Freescale Semiconductor China Ltd.
Exchange Building 23F
No. 118 Jianguo Road
Chaoyang District
Beijing 100022
China
+86 010 5879 8000
support.asia@freescale.com
For Literature Requests Only:
Freescale Semiconductor
Literature Distribution Center
P.O. Box 5405
Denver, Colorado 80217
+1-800 441-2447 or
+1-303-675-2140
Fax: +1-303-675-2150
LDCForFreescaleSemiconductor
@hibbertgroup.com
Information in this document is provided solely to enable system and software
implementers to use Freescale Semiconductor products. There are no express or
implied copyright licenses granted hereunder to design or fabricate any integrated
circuits or integrated circuits based on the informat ion in this document.
Freescale Semiconductor reserves the right to make changes without further notice to
any products herein. Freescale Semiconductor makes no warranty, representation or
guarantee regarding the suitability of its products for any particular purpose, nor does
Freescale Semiconductor assume any liability arising out of the application or use of
any product or circuit, and specifically disclaims any and all liability, including without
limitation consequential or incidental damages. “Typical” parameters which may be
provided in Freescale Semiconductor data sheets and/or specifications can and do
vary in different applications and actual performance may vary over time. All operating
parameters, including “Typicals” must be validated for each customer application by
customer’s technical experts. Freescale Semiconductor does not convey any license
under its patent rights nor the rights of others. Freescale Semiconductor products are
not designed, intended, or authorized for use as components in systems intended for
surgical implant into the body, or other applications intended to support or sustain life,
or for any other application in which the failure of the Freescale Semiconductor product
could create a situation where personal injury or death may occur. Should Buyer
purchase or use Freescale Semiconductor products for any such unintended or
unauthorized application, Buyer shall indemnify and hold Freescale Semiconductor
and its officers, employees, subsidiaries, affiliates, and distributors har mless against all
claims, costs, damages, and expenses, and reasonable attorney fees arising out of,
directly or indirectly, any claim of personal injury or death associated with such
unintended or unauthorized use, even if such claim alleges that Freescale
Semiconductor was negligent regarding the design or manufacture of the part.
Freescale, the Freescale logo, and StarCore and the Freescale logo are
trademarks or registered trademarks of Freescale Semiconductor, Inc. in
the U.S. and other countries. All other product or service names are the
property of their respective owners. HyperTransport is a trademark of the
HyperTransport Technology Consortium. The Power Architecture and
Power.org word marks and the Power and Power.org logos and related
marks are trademarks and ser vice marks licensed by Power.org. The
PowerPC name is a trademark of IBM Corp. and is used under license.
RapidIO is a registered trademark of the RapidIO Trade Association. IEEE
nnn, nnn, and nnn are trademarks or registered trademarks of the Institute
of Electrical and Electronics Engineers, Inc. (IEEE). This product is not
endorsed or approved by the IEEE.
4-33MSR Setting Due t o In t errupt .................... ......................... ........................ ........................ .. 4-32
5-1TLB Ma i n t e n an ce Progra mming Model ..................... ........................ ................ .................... 5-2
5-2Page Size (for e200z3 Core) and EPN Field Comparison ...................................................... 5-5
5-3TLB Entry Bit Fields for e200z3 ............................... ............ ................ .............. .............. .....5-9
5-4tlbivax EA Bit Definitions .................................................................................................... 5-11
5-5TLB Entry 0 Values after Reset ............................................................................................ 5-13
5-6MMU As si st Re g i ster Field Upd ates ... ......................... ........................ ........................ ........ 5 -15
6-1Pi p el ine Stage s.. .......... .................... ............................. .................... .................... ...................6-4
6-2Instruction Class Cycle Counts........................................................... ................ .................. 6-17
6-3Ins t ru ction Timing by Mn e m o n i c .......... ......................... ................ ........................ .............. 6- 1 7
6-4Timing for Integer Simple Instructions................................................................................. 6-22
6-5SPE Load and Store Instruction Timing .................................. ...... ...... ...... ...... ........ ...... ...... .6-23
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor5
Tables
Table
NumberTitle
Page
Number
e200z3 Power Architecture Core Reference Manual, Rev. 2
6 Freescale Semiconductor
About This Book
The primary objective of this user’s manual is to describe the functionality of the e200z3 embedded
microprocessor core for software and hardware developers. This book is intended as a companion to the
EREF: A Programmer's Reference Manual for Freescale Book E Processors (hereafter referred to as
EREF).
Book E is a PowerPC™ architecture defini tion for embedded process ors that ensures binary c ompatibility
with the user-instruction set architecture (UISA) portion of the PowerPC architecture as it was jointly
developed by Apple, IBM, and Motorola (referred to as the AIM architecture).
This document distinguishes among the three levels of the architectural and implementation definition, as
follows:
•The Book E architecture—Book E defines a set of user-level instructions and registers that are
drawn from the user instruction set architecture (UISA) portion of the AIM definition PowerPC
architecture. Book E also includes numerous supervisor-level registers and instructions as they
were defined in the AIM version of the PowerPC architecture for the virtual environment
architecture (VEA) and the operating environment architecture (OEA).
Because the operating system resources (such as the MMU and interrupts) defined by Book E
differ greatly from those defined by the AIM architecture, Book E introduces many new registers
and instructions.
•Freescale Book E implementation standards (EIS)—In many cases, the Book E architecture
definition provides a general framework, leaving specific de tails up to the implementation. To
ensure consistency among its Book E implementations, Freescale has defined implementation
standards that provide an additional layer of architecture between Book E and the actual devices.
•e200z3 implementation details—Each processor typically defines instructions, registers, register
fields, and other aspects that are more detailed than either the Book E definition or the EIS. This
book describes all of the instructions and registers implemented on the e200z3, including those
defined by Book E and by the EIS, as well as those that are e200z3-specific.
Information in this book is subject to change without notice, as described in the disclaimers on the title
page of this book. As with any technical documentation, it is the readers’ responsibility to be sure t hey are
using the most recent version of the documentation.
Audience
It is assumed that the reader understands operating systems, microprocessor system design, and the basic
principles of RISC processing.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductorvii
Organization
Following is a summary and a brief description of the major sections of this manual:
•Chapter 1, “e200z335 Core Complex Overview,” provides a general description of e200z3
functionality.
•Chapter 2, “Register Model,” is useful for software engineers who need to understand the
programming model for the three programming environments and the functionality of each
register.
•Chapter 3, “Instruction Model,” provides an overview of the addressing modes and a description
of the instructions. Instructions are organized by function.
•Chapter 4, “Interrupts and Exceptions,” describes how the e200z3 implements the interrupt model
as it is defined by the Book E architecture.
•Chapter 5, “Memory Management Unit,” provides specific hardware and software details
regarding the e200z3 MMU implementation.
•Chapter 6, “Instruction Pipeline and Execution Timing,” describes how instructions are fetched,
decoded, issued, executed, and completed, and how instruction results are presented to the
processor and memory system. Tables are provided that indicate latency and throughput for each
of the instructions supported by the e200z3.
•Chapter 7, “External Core Complex Interfaces,” describes those aspects of the CCB that are
configurable or that provide status information through the programming interface. It provides a
glossary of signals mentioned throughout the book to offer a clearer understanding of how the core
is integrated as part of a larger device.
•Chapter 8, “Power Management,” describes the power management facilities as they are defined
by Book E and implemented in the e200z3 core.
•Chapter 9, “Debug Support,” describes the debug facilities as they are defined by Book E and
implemented in the e200z3 core.
•Chapter 10, “Nexus3/Nexus2+ Module,” describes the e200z3 Nexus3 module, which provides
real-time development capabilities for e200z3 processors in compliance with the IEEE-ISTO Nexus 5001-2003 standard.
•This book also includes an index.
Suggested Reading
This section lists additional reading that provides background for the information in this manual as well as
general information about the architecture.
General Information
The following documentation, published by Morgan-Kaufmann Publishers, 340 Pine Street, Sixth Floor,
San Francisco, CA, provides useful information about the PowerPC architecture and computer architecture
in general:
e200z3 Power Architecture Core Reference Manual, Rev. 2
viiiFreescale Semiconductor
•The PowerPC Architectur e: A Specification for a New Family of RISC Processors, Second Edition,
by International Business Machines, Inc.
For updates to the specification, see http://www.austin.ibm.com/tech/ppc-chg.html
•Computer Ar chitecture: A Quantitative Approach, Third Edition, by John L. Hennessy and David
A. Patterson.
•Computer Organization and Design: The Har dw are /Softwar e Int erface, Second Edition, David A.
Patterson and John L. Hennessy.
Related Documentation
Freescale documentation is available from the sources listed on the back cover of this manual; the
document order numbers are included in parentheses for ease in ordering:
•EREF: A Programmer's Reference Manual for Freescale Book E Processors (EREF)—This book
provides a higher-level view of the programming model as it is defined by Book E, the Freescale
Book E implementation standards, and the e200z3 microprocessor.
•Reference manuals—These books provide details about individual implementations and are
intended for use with the EREF.
•Addenda/errata to reference manuals—Because some processors have follow-on parts, an
addendum is provided that describes the additional features and functionality changes. These
addenda are intended for use with the corresponding reference manuals.
•Hardware specifications—Hardware specifications provide specific data regarding bus timing,
signal behavior, and AC, DC, and thermal characteristics, as well as other design considerations.
•Product briefs—Each device has a product brief that provides an overview of its features.
•Application notes—These short documents address specific design issues useful to programmers
and engineers working with Freescale processors.
Additional literature is published as new processors become available. For a current list of documentation,
refer to the website on the inside cover of this book.
Conventions
This document uses the following notational conventions:
cleared/setWhen a bit takes the value zero, it is said to be cleared; when it takes a value of
one, it is said to be set.
mnemonicsInstruction mnemonics are shown in lowercase bold.
italicsItalics indicate variable command paramete rs , fo r e xample, bcctrx.
Book titles in text are set in italics.
Internal signals are set in italics, for example, qual BG
0x0Prefix to denote hexadecimal number
.
0b0Prefix to denote binary number
rA, rBInstruction syntax used to identify a source GPR
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductorix
rDInstruction syntax used to identify a destination GPR
REG[FIELD]Abbreviations for registers are shown in uppercase text. Specific bits, fields, or
ranges appear in brackets. For e xample, MSR[LE] refer s to the little-endian mode
enable bit in the machine state register.
xIn some contexts, such as signal encodings, an unitalicized x indicates a don’t
care.
xAn italicized x indicates an alphanumeric variable.
nAn italicized n indicates a numeric variable.
Table ii contains acronyms and abbreviations that are used in this document.
Table ii. Acronyms and Abbreviated Terms
TermMeaning
CRCondition register
CTRCount register
DCRData control register
DTLBData translation lookaside buffer
EAEffective address
e200z3 Power Architecture Core Reference Manual, Rev. 2
xFreescale Semiconductor
Table ii. Acronyms and Abbreviated Terms (continued)
TermMeaning
ECCError checking and correction
FPRFloating-point register
GPRGeneral-purpose register
IEEEInstitute of Electrical and Electronics Engineers
ITLBInstruction translation lookaside buffer
L2Secondary cache
LIFOLast-in-first-out
LRLink register
LRULeast recently used
LSBLeast-significant byte
lsbLeast-significant bit
MMUMemory management unit
MSBMost-significant byte
msbMost-significant bit
MSRMachine state register
NaNNot a number
NIANext instruction address
No-opNo operation
PTEPage table entry
RISCReduced instruction set computing
RTLRegister transfer language
SIMMSigned immediate value
SPRSpecial-purpose register
TLBTranslation lookaside buffer
UIMMUnsigned immediate value
UISAUser instruction set architecture
VAVirtual address
VLEVariable-length encoding
XERRegister used primarily for indicating conditions such as carries and overflows for integer operations
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductorxi
e200z3 Power Architecture Core Reference Manual, Rev. 2
xiiFreescale Semiconductor
Chapter 1
e200z335 Core Complex Overview
This chapter provides an overview of the e200z3 and e200z335 microprocessor cores built on Power
Architecture™ technology for embedded processors. It includes the following:
•An overview of Power ISA™ (instruction set architecture) features for the embedded environment
that are implemented in this core
•A summary of the core feature set
•An overview of the programming model
•An overview of interrupts and exception handling
•A summary of instruction pipeline and flow
•A description of the memory-management architecture
•High-level details of the core memory and coherency model
•A summary of Power ISA compatibil ity and migration from the original ve rsion of the PowerPC™
architecture as defined by Apple, IBM, and Freescale (referred to as the AIM version of the
PowerPC architecture)
•Information regarding e200z3 and e200z335 features defined by the Freescale Book E
implementation standards (EIS)
1.1Overview of the e200z3 and e200z335
The e200z3 and e200z335 processor family is a set of CPU cores that are low-cost implementations of
Power Architecture technology for embedded processors. e200z3 and e200z335 processors are designed
for deeply embedded control applications that require low-cost solutions rather than maximum
performance. In this document the term ‘e200z3’ refers to the family of e200z3 families. The term
‘e200z335’ is also used when defining features that are different between the e200z3 and e200z335 cores.
The e200z3 core implements the variable-length encoding (VLE) category, providing improved code
density. See the EREF and the supplementary VLE PEM for more information about the VLE extension.
Figure 1-1 and Figure 1-2 show high-level block diagrams of the e200z3 and e200z335 core, respectively .
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor1-1
e200z335 Core Complex Overview
Instruction Bus Interface Unit
Software-Managed
Unified Memory Unit
MAS
Registers
32 GPRs
(64-Bit)
XER
CR
4-, 16-, 64-, 256-Kbyte;
1-, 4-, 16-, 64-,
256-Mbyte page sizes
Execution Units
SPRs
Integer
+ x ÷
Unit
SPE
+ x ÷
Unit
Embedded
+ x ÷
Scalar FPU
Embedded
+ x ÷
Vecto r F PU
Load/Store
Branch
Unit
Write-Back Stage
Tw o /F o u r
instructions
3264N
AddressDataControl
Additional Features
• OnCe/Nexus 1/Nexus 3
control logic
• AMBA AHB-Lite bus
• SPE (SIMD)
•VLE
• Embedded scalar/
vector floating-point
• Power management
• Time base/ dec rementer
counter
• Clock multiplier
+
L1 Unified MMU
Unit
CTR
LR
Single-instruction, in-order dispatch
Single-Instruction, In-Order Write Back
•
•
•
16-Entry
Fully Associative
TLB
EA Calc
Four-cycle,
single-path
execute stage
with overlapped
execution and
Fetch Unit
Branch Processing Unit
Instruction/Control Unit
Instruction Buffer
(7 instructions)
Decode
8-Entry Branch
Stage
+
EA Calc
Two - Cy cl e
Fetch St age
Program Counter
Target Buffer
Data Bus Interface Unit
3264N
AddressDataControl
Optional
Extension
VLE
Execute Stage
feed forwarding
1-2Freescale Semiconductor
Figure 1-1. e200z3 Block Diagram
e200z3 Power Architecture Core Reference Manual, Rev. 2
e200z335 Core Complex Overview
Instruction Bus Interface Unit
Software-Managed
Unified Memory Unit
MAS
Registers
32 GPRs
(64-Bit)
XER
CR
4-Kbyte to
4-MGbyte page sizes
Execution Units
SPRs
Integer
+ x ÷
Unit
SPE
+ x ÷
Unit
Embedded
+ x ÷
Scalar FPU
Embedded
+ x ÷
Vecto r F PU
Load/Store
Branch
Unit
Write-Back Stage
Tw o /F o u r
instructions
3264N
AddressDataControl
Additional Features
• OnCe/Nexus 1/Nexus
2+ control logic
• AMBA AHB-Lite bus
• SPE (SIMD)
•VLE
• Embedded scalar/
vector floating-point
• Power management
• Time base/ dec rementer
counter
• Clock multiplier
+
L1 Unified MMU
Unit
CTR
LR
Single-instruction, in-order dispatch
Single-Instruction, In-Order Write Back
•
•
•
8-Entry
Fully Associative
TLB
EA Calc
Four-cycle,
single-path
execute stage
with overlapped
execution and
Fetch Unit
Branch Processing Unit
Instruction/Control Unit
Instruction Buffer
(7 instructions)
Decode
8-Entry Branch
Stage
+
EA Calc
Two - Cy cl e
Fetch St age
Program Counter
Target Buffer
Data Bus Interface Unit
3264N
AddressDataControl
Optional
Extension
VLE
Execute Stage
feed forwarding
The e200z3 is a single-issue, 32-bit, Power ISA–compliant design with 64-bit, general-purpose registers
(GPRs).
Instructions of the signal processing extension (SPE) category, as well as of the embedded vector and
scalar floating-point categories, are provided to support real-time integer and single-precision embedded
floating-point operations using the GPRs. The e200z3 does not support Power ISA floating-point
instructions in hardware but traps them so they can be emulated by software.
All arithmetic instructions that execute in the core operate on data in the GPRs, which have been extended
to 64 bits to s upport vector instructions defined by the SPE and embedded vector floating-point categories.
These instructions operate on a vector pair of 16- or 32-bit data types and deliver vector and scalar results.
The e200z3 contains a memory management unit (MMU). A Nexus Class 3 module is also integrated in
the e200z3 and a Nexus Class 2+ module is integrated in the e200z335.
The e200z3 platform is specified in such a way that functional units can be added or removed. The e200z3
can be configured with a powerful vectored interrupt controller and one or more IP slave interfaces, as well
as support for configured memory units.
Freescale Semiconductor1-3
Figure 1-2. e200z335 Block Diagram
e200z3 Power Architecture Core Reference Manual, Rev. 2
e200z335 Core Complex Overview
1.1.1Features
Key features of the e200z3 and e200z335 are summarized as follows:
•Single-issue, 32-bit Power ISA–compliant core
•Implementation of the VLE category for reduced code footprint
•In-order execution and retirement
•Precise interrupt handling
•Branch processing unit (BPU)
— Dedicated branch address calculation adder
— Branch acceleration using a branch target buffer (BTB)
•Load/store unit (LSU)
— 1-cycle load latency
— Fully pipelined
— Big- and little-endian support on a per-page basis
— Misaligned access support
— Zero load-to-use pipeline bubbles
•AMBA™ (advanced microcontroller bus architecture) AHB (advanced high-performance
bus)-Lite 64-bit system bus
•MMU with 16-entry (8-entry in the e200z335), fully associative TLB and multiple page-size
support
•Signal processing engine (SPE) category supporting integer operations using both halves of the
64-bit GPRs
•Single-precision embedded vector floating-point category that uses both halves of the 64-bit GPRs
•Nexus Class 3 (class 2+ in the e200z335) real-time development unit
•Power management
— Low-power design—extensive clock gating
— Power-saving modes: doze, nap, sleep
— Dynamic power management of execution units
•e200z3 and e200z335-specific debug interrupt. The e200z3 family implements the debug interrupt
as defined by the Power ISA with the following changes:
— When the debug instructions are enabled (HID0[DAPUEN] = 1), debug is no longer a critical
interrupt, but uses DSRR0 and DSRR1 for saving machine state on context switch.
— The Return from Debug Interrupt (rfdi) instruction supports the debug save/restore registers
(DSRR0 and DSRR1).
— A critical interrupt taken debug event allows critical interrupts to generate a debug event.
— A critical interrupt return debug event allows debug events to be generated for rfci instructions.
•Testability
— Synthesizable, full MuxD scan design
e200z3 Power Architecture Core Reference Manual, Rev. 2
1-4Freescale Semiconductor
e200z335 Core Complex Overview
— ABIST/MBIST for optional memory arra ys
1.2Programming Model
This section describes the register model, instruction model, and the interrupt model as they are defined
by the Power ISA, Freescale EIS, and the e200z3 and e200z335 implementation.
1.2.1Register Set
Figure 1-3 shows the e200z3 and e200z335 register set, indicating which registers are accessible in
supervisor mode and which are accessible in user mode. The number to the left of the special-purpose
registers (SPRs) is the decimal number used in the instruction syntax to access the register. (For example,
the integer exception register (XER) is SPR 1.)
GPRs are accessed through instruction operands. Access to other registers can be explicit (by using
instructions for that purpose such as the Move To Special Purpose Register (mtspr) and Move From
Special Purpose Register (mfspr) instructions) or implicit as part of the execution of an inst ruction. Some
registers are accessed both explicitly and implicitly .
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor1-5
e200z335 Core Complex Overview
User-Level Registers
General-Purpose RegistersInstruction-Accessible RegistersUser General SPR (Read/Write)
0 31 32 630 31 32 6332 63
User SPR
general 0
(upper) GPR0
1
(lower)
1
The 64-bit GPR registers are accessed by the SPE as separate 32-bit registers by SPE instructions. Only SPE vector instructions can access the upper word.
Generalpurpose
registers
CRCondition register
spr 256 USPRG0
2
2
USPRG0 is a separate physical register from SPRG0.
GPR1
spr 9
CTR
Count register
General SPRs (Read-Only)
GPR2
• • •
spr 8LRLink registerspr 260
SPRG4
SPR general
registers 4–7
GPR31spr 261SPRG5
spr 1 XER
Integer exception
register
spr 262SPRG6
L1 Cache (Read-Only)
spr 512 SPEFSCR3
3
EIS–specific registers; not part of the Power ISA.
SP/embedded FP
status/control register
spr 263SPRG7
L1 cache
configuration
register 0
spr 515
L1CFG0
3
ACC
3
Accumulator
Time-Base Registers (Read-Only)
spr 268
TBL
Time base
lower/upper
spr 269TBU
Supervisor-Level Registers
Interrupt RegistersConfiguration Registers
32 6332 6332 63
spr 63IVPR
Interrupt vector
prefix register
spr 400IVOR0
Interrupt vector offset
registers 0–15
4
4
IVOR9 (handles auxiliary processor unavailable interrupt) is defined by the EIS but not supported by the e200z335.
MSR
Machine state register
spr 401IVOR1
spr 26SRR0
Save/restore
registers 0/1
spr 1023SVR
3
System version
register
• • •
spr 27SRR1
spr 415IVOR15spr 286PIR Processor ID register
spr 58CSRR0
Critical SRR 0/1
Processor version
register
spr 528
IVOR32
3
Interrupt vector offset
registers 32–34
spr 287PVR
spr 59CSRR1
spr 529
IVOR33
3
spr 574
DSRR0
3
Debug interrupt
SRR 0/1
spr 530 IVOR34
3
Timer/Decrementer Registers
spr 575
DSRR1
3
Exception syndrome
register
spr 22DECDecrementer
spr 62
ESR
MMU Control and Status (Read/Write)
Decrementer
auto-reload register
MMU control a nd status
register 0
spr 54DECAR
spr 572 MCSR
3
Machine check
syndrome register
spr 1012 MMUCSR0
3
spr 284TBL
Time base
lower/upper
spr 61DEAR
Data exception
address register
spr 624MAS0
3
MMU assist registers
0–4 and 6
spr 285TBU
spr 625MAS1
3
Debug Registers
5
spr 626
MAS2
3
spr 340TCRTimer control register
spr 627
MAS3
3
spr 308DBCR0
Debug control
registers 0–3
spr 336TSRTimer status register
spr 628
MAS4
3
spr 309DBCR1
spr 630
MAS6
3
Miscellaneous Registers
spr 310
DBCR2
Process ID
register 0
spr 561DBCR3 spr 48PID0spr 1008HID0
3
Hardware
implementation
dependent 0–1
spr 1009
HID1
3
spr 304DBSR
Debug status register
MMU Control and Status (Read Only)
spr 1013
BUCSR
6
Branch control and
status register
spr 562
DBCNT
6
Debug count register
spr 1015 MMUCFG
3
MMU configuration
spr 272–279
SPRG0–7
General SPRs 0–7
spr 312IAC1
Instruction ad dress
compare
registers 1–4
spr 688 TLB0CFG
3
TLB configuration 0/1
spr 313IAC2spr 689 TLB1CFG
3
Context Control (Read/Write)
spr 314
IAC3
Context control
register
Parallel Signature Unit Registers6
spr 560
CTXCR
6
spr 315IAC4
Data address
compare
registers 1 and 2
dcr 272PSCRPS control
spr 316DAC1
dcr 273PSSRPS status
spr 317DAC2
dcr 274PSHRPS high
spr 318DVC1Data valued cr 275PSLRPS low
compare
spr 319DVC2registers 1 and 2dcr 276PSCTRPS counter
dcr 277PSUHRPS update high
dcr 278PSULRPS update low
1-6Freescale Semiconductor
e200z3 Power Architecture Core Reference Manual, Rev. 2
e200z335 Core Complex Overview
Figure 1-3. e200z3 Programmer’s Model
1.3Instruction Set
The e200z3 implements the following instructions:
•The Power ISA instruction set for 32-bit embedded implementations. This is composed primarily
of the user-level instructions defined by the user instruction set architecture (UISA). The e200z3
does not include the Power ISA floating-point, load string, or store string instructions.
•The e200z3 supports the following EIS-defined instructions:
— Integer select category. This category consists of the Integer Select instruction (isel), which
functions as an if-then-else statement that selects between two source registers by comparison
to a CR bit. This instruction eliminates conditional branches, takes fewer clock cycles than the
equivalent coding, and reduces the code footprint.
— Debug category . This category defines the Return from Debug Interrupt instruction (rfdi).
— SPE vector instructions. New vector instructions are defined that view the 64-bit GPRs as being
composed of a vector of two 32-bit elements (some of the instructions also read or write 16-bit
elements). Some scalar instructions are defined for DSP that produce a 64-bit scalar result.
— The embedded floating-point categories provide single-precision scalar and vector
floating-point instructions. Scalar floating-point instructions use only the lower 32 bits of the
GPRs for single-precision floating-point calculations. Table 1-1 lists embedded floating-point
instructions.
— Wait category in the e200z335 only. This category consists of the wait instruction that allows
software to cease all synchronous activity and wait for an asynchronous interrupt to occur.
— Volatile Context Save/Restore category in the e200z335 only. This category supports the
capability to quickly s ave and restore volatile register context on e ntry into an interrupt handler .
— e200z3 family implements eight additional (four scalar and four vector) floating-point
instructions.
Table 1-1. Scalar and Vector Embedded Floating-Point Instructions
Mnemonic
Instruction
ScalarVector
Convert Floating Point from Signed Fraction efscfsf evfscfsf rD,rB
Convert Floating Point from Signed Integer efscfsi evfscfsi rD,rB
Convert Floating Point from Unsigned Fraction efscfufevfscfufrD,rB
Convert Floating Point from Unsigned Integer efscfui evfscfui rD,rB
Convert Floating Point to Signed Fraction efsctsfevfsctsfrD,rB
Convert Floating Point to Signed Integer efsctsievfsctsirD,rB
Convert Floating Point to Signed Integer with Round Toward Zero efsctsizevfsctsizrD,rB
Convert Floating Point to Unsigned Fraction efsctufevfsctufrD,rB
Syntax
Convert Floating Point to Unsigned Integer efsctuievfsctuirD,rB
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor1-7
e200z335 Core Complex Overview
Table 1-1. Scalar and Vector Embedded Floating-Point Instructions (continued)
Mnemonic
Instruction
ScalarVector
Convert Floating Point to Unsigned Integer with Round Toward Zero efsctuizevfsctuizrD,rB
Floating-Point Absolute Value efsabs evfsabs rD,rA
This section describes the extensions to the architecture to support variable-length encoding (VLE).
•rfci, rfdi, rfi do not mask bit 62 of CSRR0, DSRR0, or SRR0. The destination address is
[D,C]SRR0[32–62] || 0b0.
•bclr, bclrl, bcctr, bcctrl do not mask bit 62 of the LR or CTR. The destination address is [LR,
CTR][32–62] || 0b0.
1.5Interrupts and Exception Handling
The core supports an extended exception handling model, with nested interrupt capability and extensive
interrupt vector programmability. The following sections define the interrupt model, including an
overview of interrupt handling as implemented on the e200z3 core, a brief description of the interrupt
classes, and an overview of the registers involved in the processes.
e200z3 Power Architecture Core Reference Manual, Rev. 2
1-8Freescale Semiconductor
e200z335 Core Complex Overview
1.5.1Interrupt Handling
In general, interrupt processing begins with an exception that occurs due to external conditions, errors, or
program execution problems. When an exception occur s, the processor checks whether interrupt
processing is enabled for that particular exception. If enabled, the interrupt causes the state of the processor
to be saved in the appropriate registers and prepares to begin execution of the handler located at the
associated vector address for that particular exception.
Once the handler is executing, the implementation may need to check bits in the exception syndrome
register (ESR), the machine check syndrome register (MCSR), or the signal processing and embedded
floating-point status and control register (SPEFSCR), depending on the exception type, to verify the
specific cause of the exception and take appropriate action.
The core complex supports the interrupts described in Section 1.5.4, “Interrupt Registers.”
1.5.2Interrupt Classes
All interrupts may be categorized as asynchronous/synchronous and critical/noncritical.
•Asynchronous interrupts (such as machine check, critical input, and external interrupts) are caused
by events that are independent of instruction execution. For asynchronous interrupts, the address
reported in a save/restore register is the address of the instruction that would have executed next
had the asynchronous interrupt not occurred.
•Synchronous interrupts are those that are caused directly by the execution or attempted execution
of instructions. Synchronous inputs are further divided into precise and imprecise types.
— Synchronous precise interrupts are those that precisely indicate the address of the instruction
causing the exception that generated the interrupt or, in some cases, the address of the
immediately following instruction. The interrupt type and status bits allow determination of
which of the two instructions has been addressed in the appropriate save/restore register.
— Synchronous imprecise interrupts are those that may indicate the address of the instruction
causing the exception that generated the interrupt, or some instruction after the instruction
causing the interrupt. If the interrupt was caused by either the context synchronizing
mechanism or the execution synchronizing mechanism, the address in the appropriate
save/restore register is the address of the interrupt-forcing instruction. If the interrupt was not
caused by either of those mechanisms, the address in the save/restore register is the last
instruction to start execution and may not have completed. No instruction following the
instruction in the save/restore register has executed.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor1-9
e200z335 Core Complex Overview
1.5.3Interrupt Types
The e200z3 core processes all interrupts as either debug, critical, or noncritical types. Separate control and
status register sets are provided for each type of interrupt. The core handles interrupts from these three
categories in the following order of priority:
1. Debug interrupt—The EIS defines a separate set of resources for the debug interrupt. The debug
save and restore registers (DSRR0/DSRR1) are used to save state when a debug interrupt is taken;
the rfdi instruction restores state when interrupt handling completes.The debug enable bit,
HID0[DAPUEN], determines what interrupt is taken when a debug exception occurs, as follows:
— If DAPUEN = 0, the debug interrupt is disabled. Debug interrupts use the critical interrupt
resources: CS RR0/CSRR1 and rfci; rfdi is treated as an illegal instruction. DCLREE,
DCLRCE, CICLRDE, and MCCLRDE settings are ignored and are assumed to be ones.
— If DAPUEN = 1, debug is enabled. Debug interrupts use DSRR0/DSRR1 for saving state, and
rfdi is available for returning from a debug interrupt.
2. Noncritical interrupts—First-level interrupts that allow the processor to change program flow to
handle conditions generated by external signals, errors, or unusual conditions arising from program
execution or from programmable timer events. These interrupts are largely identical to those
defined by the OEA portion of the architecture. They use the save and restore registers
(SRR0/SRR1) to save state when they are taken, and they use the rfi instruction to restore state.
Asynchronous noncritical interrupts can be masked by the external interrupt enable bit, MSR[EE].
3. Critical interrupts—Critical interrupts can be taken during a noncritical interr upt or during regular
program flow . They use the critical save and restore registers (CSRR0/CSRR1) to save state when
they are taken, and they use the rfci instruction to restore state. These interrupts can be masked by
the critical enable bit, MSR[CE]. The Power ISA defines the critical input, watchdog timer, and
machine check interrupts as critical interrupts, but the e200z3 core defines a third set of r esources
for the debug interrupt, as described in Table 1-2.
All interrupts except debug interrupts are ordered within the two categories of non critical and critical, such
that only one interrupt of each category is reported, and when it is processed (taken), no program state is
lost. Because save/restore register pairs are serially reusable, program state may be lost when an unordered
interrupt is taken.
1.5.4Interrupt Registers
The registers associated with interrupt handling are described in Table 1-2.
Table 1-2. Interrupt Registers
RegisterDescription
Noncritical Interrupt Registers
SRR0Save/restore register 0—Stores the address of the instruction causing the exception or the address of the instruction
that will execute after the rfi instruction.
SRR1Save/restore register 1—Saves machine state on noncritical interrupts and restores machine state after an rfi
instruction is executed.
Critical Interrupt Registers
e200z3 Power Architecture Core Reference Manual, Rev. 2
1-10Freescale Semiconductor
e200z335 Core Complex Overview
Table 1-2. Interrupt Registers (continued)
RegisterDescription
CSRR0 Critical save/restore register 0—On critical interrupts, stores either the address of the instruction causing the
exception or the address of the instruction that executes after the rfci.
CSRR1 Critical save/restore register 1—Saves machine state on critical interrupts and restores machine state after an rfci
instruction is executed.
Debug Interrupt Registers
DSRR0 Debug save/restore register 0—Used to store the address of the instruction that will execute after an rfdi instruction
is executed.
DSRR1 Debug save/restore register 1—Stores machine state on debug interrupts and restores machine state after an rfdi
instruction is executed.
Syndrome Registers
MCSRMachine check syndrome register—Saves machine check syndrome information on machine check interrupts.
ESRException syndrome register—Provides a syndrome to differentiate among the different kinds of exceptions that
generate the same interrupt type. Upon generation of a specific exception type, the associated bits are set and all
other bits are cleared.
SPE Interrupt Registers
SPEFSCR Signal processing and embedded floating-point status and control register—Provides interrupt control and status as
well as various condition bits associated with the operations performed by the SPE.
Other Interrupt Registers
DEARData exception address register—Contains the address that was referenced by a load, store, or cache management
instruction that caused an alignment, data TLB miss, or data storage interrupt.
IVPR
IVORs
Together, IVPR[32–47] || IVOR
Table 1-3 and Chapter 4, “Interrupts and Exceptions,” for more information.
n
[48–59] || 0b0000 define the address of an interrupt-processing routine. See
Each interrupt has an associated interrupt vector address, obtained by concatenating IVPR[32–47] with the
address index in the associated IVOR (that is, IVPR[32–47] || IVORn[48–59] || 0b0000). The resulting
address is that of the instruction to be executed when that interrupt occurs. IVPR and IVOR values are
indeterminate on reset and must be initialized by the system software using mtspr. Table 1-2 lists IVOR
registers implemented on the e200z335 core and the associated interrupts.
Table 1-3. Exceptions and Conditions
IVORnInterrupt TypeIVORnInterrupt Type
1
None
0
1Machine check12Watchdog timer
2Data storage13Data TLB error
3Instruction storage14Instruction TLB error
4
5Alignment6–31Reserved
6Program32SPE unavailable
7Floating-point unavailable33SPE data exception
System reset (not an interrupt)10Decrementer
2
Critical input11Fixed-interval timer
2
External input15Debug
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor1-11
e200z335 Core Complex Overview
Table 1-3. Exceptions and Conditions (continued)
IVORnInterrupt TypeIVORnInterrupt Type
8System call34SPE round exception
9Unit unavailable
1
Vector to [
2
Autovectored external and critical input interrupts use this IVOR. Vectored interrupts supply an interrupt vector offset directly.
p_rstbase[0:19]
] || 0xFFC.
1.6Microarchitecture Summary
The e200z3 processor has a four-stage pipeline for instruction execution.
These stages are pipelined, allowing single-clock instruction throughput for most instructions.
The integer execution unit consists of a 32-bit arithmetic unit, a logic unit, a 32-bit barrel shifter, a
mask-insertion unit, a condition register manipulation unit, a count-leading-zeros unit, a 32 × 32 hardware
multiplier array, result feed-forward hardware, and support hardware for division.
Most arithmetic and logical operations are executed in a single cycle with the exception of the divide
instructions. A count-leading-zeros unit operates in a single clock cycle.
The instruction unit contains a program counter incrementer and a dedicated branch address adder to
minimize delays during change-of-flow operations. Sequential prefetching is performed to ensure a supply
of instructions into the execution pipeline. Branch target prefetching is performed to accelerate taken
branches. Prefetched instructions are placed into an instruction buffer capable of holding six instructions.
Conditional branches that are not taken and not folded execute in a single cycle. Branches with successful
target prefetching that are not folded have an effective execution time of 1 cycle. All other taken branches
have an execution time of 2 clocks.
Memory load and store operations are provided for byte, half-word, word (32-bit), and double-word data
with automatic zero or sign extension of byte and half-word load data as well as optional byte reversal of
data. These instructions can be pipelined to allow ef fective single-cycle throughput. Load and store
multiple word instructions allow low-overhead context save and restore operations. The load/store unit
(LSU) contains a dedicated effective address adder to optimize effective address generation.
The condition register unit supports the condition register (CR) and condition register operations defined
by the architecture. The CR consists of eight 4-bit fields that reflect the results of certain operations
generated by instructions such as move, integer and floating-point compare, arithmetic, and logical
instructions. The CR also provides a mechanism for testing and branching.
Vectored and autovectored interrupts are supported by the CPU. Vectored interrupt support is provided to
allow multiple interrupt sources to have unique interrupt handlers invoked with no software overhead.
e200z3 Power Architecture Core Reference Manual, Rev. 2
1-12Freescale Semiconductor
e200z335 Core Complex Overview
The SPE category supports vector instructions operating on 16- and 32-bit integer and fractional data
types. The vector and scalar floating-point instructions operate on 32-bit IEEE-754 single-precision
floating-point formats, and support single-precision floating-point operations in a pipelined fashion.
The 64-bit GPRs are used for source and destination operands for all vector instructions, and there is a
unified storage model for single-precision floating-point data types of 32 bits and the nor mal integer type.
Low-latency integer and floating-point add, subtract, multiply , divide, compare, and conversion operations
are provided, and most operations can be pipeline d.
1.6.1Instruction Unit Features
The e200z3 instruction unit implements the following:
•64-bit fetch path that supports fetching of two 32-bit or up to four 16-bit VLE instructions per clock
•Instruction buffer that holds up to seven sequential instructions
•Dedicated PC (program counter) incrementer supporting instruction fetches
•Branch processing unit with dedicated branch address adder and branch target buffer (BTB)
supporting single-cycle execution of successfully predicted branches
•Target instruction buffer that holds up to two prefetched branch target instructions
1.6.2Integer Unit Features
The integer unit supports single-cycle execution of most integer instructions:
•32-bit AU for arithmetic and comparison operations
•32-bit LU for logical operations
•32-bit priority encoder for count-leading-zer os function
•32-bit single-cycle barrel shifter for static shifts and rotates
•32-bit mask unit for data masking and insertion
•Divider logic for signed and unsigned divide in 6–16 clocks with minimized execution timing
•32 × 32 hardware multiplier array that supports single cycle 32 × 32 > 32 multiply
1.6.3Load/Store Unit (LSU) Features
The e200z3 LSU supports load, store, and load multiple/store multiple instructions:
•32-bit effective address adder for data memory address calculations
•Pipelined operation supports throughput of one load or store operation per cycle
•Dedicated 64-bit interface to memory supports saving and restoring of up to two registers per cycle
for load multiple and store multiple word instructions
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor1-13
e200z335 Core Complex Overview
1.6.4Memory Management Unit (MMU) Features
The MMU is an implementation of the embedded.MMU category of the Power ISA, with the following
feature set:
•32-bit effective-to-r eal addre ss tra nslation
•8-bit process identifier (PID)
•16-entry, fully associative TLB (8-entry in the e200z335)
•Support for multiple page sizes from 4 Kbytes to 256 Mbytes (4 Kbyte to 4 Gbyte in the e200z335)
•Hardware assist for TLB miss exceptions
•Software managed by tlbre, tlbwe, tlbsx, tlbsync, and tlbivax instructions
•Entry flush protection
•Byte ordering (endianness) configurable on a per-page basis
1.6.5System Bus (Core Complex Interface) Features
The features of the core complex interface are as follows:
•Independent instruction and data buses
•Advanced microcontroller bus architecture (AMBA) and advanced high-performance bus
(AHB2.v6)-Lite protocol
•32-bit address bus plus attributes and control on each bus
•Instruction interface has 64-bit read data bus
•Data interface has separate unidirectional 64-bit read data bus and 64-bit write data bus
•Pipelined, in-order access es for both buses.
1.6.6Nexus 32+ Module Features
The Nexus 3 (Nexus 2+ in e200z335) module provides real-time development capabilities for e200z3 and
e200z335 processors in compliance with the IEEE-I STO Nexus 5001-2003 standard. This module
provides development support capabilities without requiring the use of address and data pins for internal
visibility.
A portion of the pin interface (the JTAG port) is shared with the OnCE/Nexus1 unit. The IEEE-ISTO
5001-2003 standard defines an extensible auxiliary port, which is used in conjunction with the JT AG port
in e200z3 and e200z335 processors.
1.7Legacy Support of PowerPC Architecture
This section provides an overview of the architectural differences and compatibilities of the e200z3 core
compared with the original PowerPC architecture. The two levels of the e200z3 core programming
environment are as follows:
•User level—This defines the base user-level instruction set, registers, data types, memory
conventions, and the memory and programming models seen by application programmers.
e200z3 Power Architecture Core Reference Manual, Rev. 2
1-14Freescale Semiconductor
e200z335 Core Complex Overview
•Supervisor level—This defines supervisor-level resources typically required by an operating
system, the memory management model, supervisor-level registers, and the exception model.
In general, the e200z3 core supports the user-level architecture from the original PowerPC architecture.
The following sections are inte nded to highlight the main dif ferences . For spe cific implementation deta ils
refer to the relevant chapter.
1.7.1Instruction Set Compatibility
The following sections describe the user and supervisor instruction sets.
1.7.1.1User Instruction Set
The e200z3 core family executes legacy user-mode binaries and object files except for the following:
•The e200z3 core supports vector and scalar single-precision floating-point operations. These
instructions have different encoding than the original definition of the PowerPC architecture.
Additionally, the e200z3 core uses GPRs for floating-point operations, rather than the FPRs
defined by the UISA. Most porting of floating-point operations can be handled by recompiling.
•String instructions are not implemented on the e200z3 core; therefore, trap emulation must be
provided to ensure backward compatibility.
1.7.1.2Supervisor Instruction Set
The supervisor-mode instruction set in the original PowerPC architecture is compatible with the e200z3
core with the following exceptions:
•The MMU architecture is different, so some TLB manipulation instructions have different
semantics.
•Instructions that support BATs and segment registers are not implemented.
1.7.2Memory Subsystem
Both the Power ISA and the original version of the PowerPC architecture provide separate instruction and
data memory resources. The e200z3 core provides optional additional cache control features, including
cache locking. Note that the core implementations described in this document do not implement caches.
1.7.3Interrupt Handling
Exception handling is generally the same as that defined in the original version of the PowerPC
architecture for the e200z3 core, with the following differences:
•The Power ISA defines a new critical interrupt, providing an interrupt nesting. The critical interrupt
includes critical input and watchdog timer time-out inputs.
•The debug interrupt, originally implementation-specific, is now included in the Power ISA. It
defines the Return from Debug Interrupt instruction, rfdi, and two debug save/restore registers,
DSRR0 and DSRR1.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor1-15
e200z335 Core Complex Overview
•Processors built on the Power ISA can use IVPR and the IVORs to set exception vectors
individually , but they can be set to the a ddress off sets defined in the OEA t o provide compatibility.
•Unlike the original version of the PowerPC architecture, the Power ISA does not define a reset
vector; execution begins at a fixed virtual address, 0xFFFF_FFFC. The e200z3 allows this to be
hard-wired to any page.
•Some Power ISA and e200z3 core-specific SPRs are different from those defined in the original
PowerPC architecture, particularly those related to MMU functions. Much of this information has
been moved to the new exception syndrome register (ESR).
•Timer services are generally compatible. However , the Power ISA defines a decrementer
auto-reload feature, and two critical-type interrupts—the fixed-interval timer and the watchdog
timer interrupts—all of which are implemented in the e200z3 core.
An overview of the interrupt and exception handling capabilities of the e200z3 core can be found in
Section 1.5, “Interrupts and Exception Handling.”
1.7.4Memory Management
The e200z3 core implements a straightforward virtual address space that complies with the Power ISA
MMU definition, which eliminates se gment re gis ters and bloc k addre ss tr anslation resources. The Power
ISA defines resources for multiple, variable page sizes that can be configured in a single implementation.
TLB management is provided with new instructions and SPRs.
1.7.5Reset
Cores built on the Powe r ISA do not share a common reset vector with the original PowerPC archit ecture.
Instead, at reset, fetching begins at address 0xFFFF_FFFC. In addition to the Power I SA reset definiti on,
the EIS and the e200z3 core define specific aspects of the MMU page translation and protection
mechanisms. Unlike the original PowerPC core, as soon as instruction fetching begins, the e200z3 core is
in virtual mode with a hardware-initialized TLB entry.
1.7.6Little-Endian Mode
Unlike the original PowerPC architecture, where little-endian mode is controlled on a system basis, the
Power ISA allows control of byte ordering on a memory-page basis. Additionally, the little-endian mode
used in the Power ISA is true little-endian byte ordering (byte invariance).
e200z3 Power Architecture Core Reference Manual, Rev. 2
1-16Freescale Semiconductor
Chapter 2
Register Model
This chapter describes the registers of the e200z3 and e200z335 cores. It includes an overview of registers
defined by the Book E architecture, highlighting differences in how these registers are implemented in the
e200z3 core, and it describes the e200z3-specific registers in detail. Full descriptions of the
architecture-defined register set are provided in the EREF .
The Book E architecture defines register-to-register operations for all computational instructions. Source
data for these instructions is accessed from the on-chip registers or as immediate values embedded in the
opcode. The three-register instruction format allows specification of a target register distinct f rom the two
source registers, thus preserving the original data for use by other instructions. Data is transferred between
memory and registers with explicit load and store instructions only.
The e200z3 extends the general-purpose registers (GPRs) to 64 bits to support SPE APU operations.
PowerPC Book E instructions operate on the lower 32 bits of the GPRs only, and the upper 32 bits are
unaffected by these instructions. SPE vector instructions operate on the entire 64-bit register. The SPE
APU defines load and store instructions for transferring 64-bit values to/from memory.
Figure 2-1 shows the complete e200z3 register set, indicating which registers are accessible in supervisor
mode and which in user mode. The number to the left of the special-purpose registers (SPRs) is the decimal
number used in the instruction syntax to access the register . For example, the integer exception register
(XER) is SPR 1.
GPRs are accessed through instruction operands. Access to other registers can be explicit, using
instructions such as Move to Special-Purpose Register (mtspr) and Move from Special-Purpose Register
(mfspr), or implicit as part of the execution of an instruction. Some r egisters are accessed both explicitly
and implicitly.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-1
Register Model
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-2Freescale Semiconductor
User-Level Registers
General-Purpose RegistersInstruction-Accessible RegistersUser General SPR (Read/Write)
0 31 32 630 31 32 6332 63
User SPR
general 0
(upper) GPR0
1
(lower)
1
The 64-bit GPR registers are accessed by the SPE as separate 32-bit registers by SPE instructions. Only SPE vector instructions can access the upper word.
Generalpurpose
registers
CRCondition register spr 256 USPRG0
2
2
USPRG0 is a separate physical register from SPRG0.
GPR1
spr 9
CTR
Count register
General SPRs (Read-Only)
GPR2
• • •
spr 8LRLink regis terspr 260
SPRG4
SPR general
registers 4–7
GPR31spr 261SPRG5
spr 1 XER
Integer exception
register
spr 262SPRG6
L1 Cache (Read-Only)
spr 512 SPEFSCR3
3
EIS-specific registers; not part of the Book E architecture.
SP/embedded FP
status/control register
spr 263SPRG7
L1 cache
configuration
register 0
spr 515
L1CFG0
3
Time-Base Registers (Read-Only)
spr 268TBL
Time base
lower/upper
spr 269TBU
Supervisor-Level Registers
Interrupt RegistersConfiguration Registers
32 6332 6332 63
spr 63IVPR
Interrupt vector
prefix register
spr 400IVOR0
Interrupt vector offset
registers 0–15
4
4
IVOR9 (handles auxiliary processor unavailable interrupt) is defined by the EIS but not supported by the e200z3.
MSR
Machine state register
spr 401IVOR1
spr 26SRR0
Save/restore
registers 0/1
spr 1023SVR
3
System version
register
• • •
spr 27SRR1
spr 415IVOR15
spr 286PIR Processor ID register
spr 58CSRR0
Critical SRR 0/1
Processor version
register
spr 528 I VOR32
3
Interrupt vector offset
registers 32–34
spr 287PVR
spr 59CSRR1
spr 529
IVOR33
3
spr 574
DSRR0
3
Debug interrupt
SRR 0/1
spr 530 I VOR34
3
Timer/Decrementer Registers
spr 575
DSRR1
3
Exception syndrome
register
spr 22DECDecrementer
spr 62
ESR
MMU Control and Status (Read/Write)
Decrementer
auto-reload register
MMU control a nd status
register 0
spr 54DECAR
spr 572 MCSR
3
Machine check
syndrome register
spr 1012 MMUCSR0
3
spr 284TBL
Time base
lower/upper
spr 61DEAR
Data exception
address register
spr 624MAS0
3
MMU assist registers
0–4 and 6
spr 285TBU
spr 625MAS1
3
Debug Registers
5
5
DVC1, DVC2, DBCR4, and DBERC0 are implemented in e200z335 only.
spr 626
MAS2
3
spr 340TCRTimer control register
spr 627
MAS3
3
spr 308DBCR0
Debug control
registers 0–4
spr 336TSRTimer status register
spr 628MAS4
3
spr 309DBCR1
spr 630
MAS6
3
Miscellaneous Registers
spr 310
DBCR2
Process ID
register 0
spr 561
DBCR3
spr 48
PID0
spr 1008
HID0
3
Hardware
implementation
dependent 0–1
spr 563DBCR4
spr 1009HID1
3
spr 304
DBSRDebug status register
MMU Control and Status (Read Only)
spr 1013
BUCSR
6
Branch control and
status register
spr 562
DBCNT
3
Debug count register
spr 1015 MMUCFG
3
MMU configuration
spr 272–279
SPRG0–7
General SPRs 0–7
spr 312IAC1
Instruction ad dress
compare
registers 1–4
spr 688
TLB0CFG
3
TLB configuration 0/1
spr 313IAC2spr 689 TLB1CFG
3
Context Control (Read/Write)
spr 314IAC3
Context control
register
Parallel Signature Unit6 Debug Registers
spr 560
CTXCR
3
spr 315
IAC4
spr 316DAC1Data addressd cr 272PSCRPS control
spr 317DAC2comp are registers 1–2d cr 273PSSRPS status
dcr 274
PSHR
PS high
spr 318DVC1Data value
comparedcr 275PSLRPS low
spr 319DVC2registers 1 and 2
dcr 276
PSCTR
PS counter
spr 569
DBERC0
Debug status register
dcr 277PSUHR
PS update high
dcr 278PSULRPS update low
Freescale Semiconductor2-3
e200z3 Power Architecture Core Reference Manual, Rev. 2
Register Model
Register Model
Figure 2-1. e200z3 Programmer’s Model
2.1PowerPC Book E Registers
The e200z3 supports most of the registers defined by Book E architecture. Notable exceptions are the
floating-point registers FPR0–FPR31 and the FPSCR. The e200z3 does not support the Book E
floating-point architecture in hardwar e. The GPRs are extended to 64 bits. The Book E registers in the
e200z3 are as follows:
•User-level registers, which are accessible to all softwar e with eit her use r or supervisor privil eges :
— General-purpose registers (GPRs). Thirty-two 64-bit GPRs (GPR0–GPR31) serve as data
source or destination registers for integer instructions and provide data to generate addresses.
PowerPC Book E instructions affect only the lower 32 bits of the GPRs. SPE APU instructions
operate on the entire 64-bit register.
— Condition register (CR). Eight 4-bit fields, CR0–CR7, reflect results of certain arithmetic
operations and provide a mechanism for testing and branching.
The remaining user-level registers are SPRs. In the PowerPC architecture, the mtspr and mfspr
instructions are for accessing SPRs.
— Integer exception register (XER). Indicates overflow and carries for integer operations.
— Link register (LR). Provides the branch target address for the branch conditional to link register
(bclr, bclrl) instructions and holds the address of the instruction that follows a branch and link
instruction, typically for linking to subroutines.
— Count register (CTR). Holds a loop count that can be decremented during execution of
appropriately coded branch instructions. CTR also provides the branch target address for the
branch conditional to count register (bcctr, bcctrl) instruc tion s .
— The time base facility (TB) consists of two 32-bit registers, time base upper (TBU) and time
base lower (TBL). User-level software can read (but not write) to these two registers.
— SPRG4–SPRG7. Software-use special-purpose registers (SPRGs). SPRG4–SPRG7 are read
only by user-level software. The e200z3 does not allow user-mode access to SPRG3. Book E
defines such access as implementat ion-depe ndent .
— USPRG0. User-software-use SPR USPRG0, which is read-write acces si ble to user-level
software.
•Supervisor-level registers, which are control and status registers acce ssible to supervisor-level
software. An operating system might use these registers for configuration, exception handling, and
other operating system functions:
— Processor con t ro l regist e r s
– M achine state register (MSR). Defines the state of the processor. The MSR can be modified
by the move to machine state register (mtmsr), system call (sc), and return from interrupt
(rfi, rfci, rfdi) instructions. It can be read by the move from machine state register (mfmsr)
instruction. When an interrupt occurs, the contents of the MSR are saved to one of the
machine state save/res t ore re gist er s (SRR1, CSRR1, DSRR1).
– Processor version register (PVR). A read-only register that identifies the version (model)
and revision level of the PowerPC processor.
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-4Freescale Semiconductor
Register Model
– Processor identification register (PIR). A read-only register to distinguish the processor
from other processors in the system.
— Storage control registers
– Process ID register (PID0, also referred to as PID). Indicates the cu rrent proces s or task
identifier. The MMU uses it as an extension to the effective address, and the external Nexus
2 module uses it for ownership trace message generation. PowerPC Book E allows multiple
PIDs; the e200z3 implements only one.
— Interrupt registers
– Data exception address register (DEAR). After most data storage interrupts (DSIs), or on an
alignment interrupt or data TLB interrupt, DEAR is set to the effective address (EA)
generated by the faulting instruction.
– SPRG0–S PRG7, USPRG0. For software use. See Section 2.10, “Software-Use SPRs
(SPRG0–SPRG7 a nd USPR G 0), ” for details on these registers. The e200z3 does no t allow
user-mode access to the SPRG3 register. Book E define s acces s t o SPRG3 as
implementation-dependent.
– E xception syndrome register (ESR). A syndrome to differentiate between the different kinds
of exceptions that can generate the same interrupt.
– I nterrupt vector prefix register (IVPR) and interrupt-specific interrupt vector offset registers
(IVORs). Provide the address of the interrupt handler for different classes of interrupts.
– Save/r estore register 0 (SRR0). Saves machine state on a non-critical interrupt and contains
the address of the instruction at which execution resumes when an rfi instruction executes
at the end of a non-critical-class interrupt handler routine.
– Save/r estore register 1 (SRR1). Saves machine state from the MSR on non-critical
interrupts and restores machine state when rfi executes.
– C riti cal save/restore register 0 (CSRR0). Saves machine state on a critical interrupt and
contains the address of the instruction at which execution resumes when an rfci instruction
executes at the end of a critical-class interrupt handler routine.
– C ritical save/restore register 1 (CSRR1). Saves machine state from the MSR on critical
interrupts and restores machine state when rfci executes.
— Debug facility registers
– Debug control registers (DBCR0–DBCR2). Provide control for enabling and configuring
specify instruction address compare debug events.
– Data address compare registers (DAC1–DAC2). Contain addresses and/or masks to specify
data address compare debug events.
– Data value compare registers (DVC1-DVC2). Contain data values to specify data value
compare debug events.
— Timer registers
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-5
Register Model
– T i me base (TB). Maintains the time of day and operates interval timer s. The TB consists of
two 32-bit registers, time base upper (TBU) and time base lower (TBL). Only
supervisor-level software can write to the time base registers, but both user and
supervisor-level software can read them.
– Decrementer register (DEC). A 32-bit decrementing counter for causing a decrementer
exception after a programmable delay.
– Decrementer auto-reload (DECAR). Supports the auto-reload feature of the decrementer.
– T imer control register (TCR). Controls the decrementer, fixed-interval timer, and watchdog
timer options.
– Timer status register (TSR). Contains status on timer events and the most recent
watchdog-timer-initiated processor reset.
2.2e200z3-Specific Registers
Book E allows implementation-specific registers. Those in the e200z3 core are as follows:
•User-level registers, which are accessible to all softwar e with eit her use r or supervisor privil eges :
— Signal processing/embedded floating-point status and control register (SPEFSCR). Contains
all integer and floating-point exception signal bits, exception summary bits, exception enable
bits, and rounding control bits for compliance with the IEEE 754 standard.
— L1 cache configuration register (L1CFG0). A read-only register that allows software to query
the configuration of the L1 cache. For the e200z3, this register returns all zeros.
— The EIS-defined accumulator, which is part of the SPE APU. See Section 2.7.2, “Accumulator
(ACC).”
•Supervisor-level registers, which are defined in the e200z3 in addition to the Book E registers
described in Section 2.1, “PowerPC Book E Registers:
— Configuration registers—Hardware implementation-dependent registers 0 and 1 (HID0 and
HID1). Control various processor and system functions.
— Exception handling and control registers:
– M achine check syndrome register (MCSR). A syndrome to differentiate between the
different kinds of conditions that can generate a machine check.
– Debug s ave/restore register 0 (DSRR0). When the debug APU is enabled, DSRR0 saves the
address of the instruction at which execution continues when rfdi executes at the end of a
debug interrupt handler routine.
– Debug save/restore register 1 (DSRR1). When the debug APU is enabled,
(HID0[DAPUEN] = 1), DSRR1 saves machine state from the MSR on debug interrupts and
restores machine state when rfdi executes.
— Debug facility registers
– Debug control register 3 (DBCR3). Control for debug functions not described in Book E
– Debug counter register (DBCNT). Counter capability for debug functions
— Context control registers
– Context control register (CTXCR). Control for register context selection.
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-6Freescale Semiconductor
Register Model
— Branch unit control and status register (BUCSR). Controls operation of the branch target buffer
(BTB).
— Cache registers. This e200z3-specific register may not be supported by other PowerPC
processors.
– L 1 cache configuration register (L1CFG0). A read-only register that allows software to
query the configuration of the L1 cache. This register returns all zeros for e200z3 core.
— Memory management unit (MMU) registers:
– M MU configuration register (MMUCFG). A read-only register that allows software to
query the configuration of the MMU.
– MMU assi s t (MAS0–MAS4, MAS6) registers. The interface to the e200z3 core from the
MMU.
– M MU control and status register (MMUCSR0). Controls MMU invalidation.
– TLB configuration registers (TLB0CFG and TLB1CFG). Read-only registers that allow
software to query the configuration of the TLBs.
— System version register (SVR). A read-only register that identifies the version (model) and
revision level of the system that includes an e200z3 processor.
NOTE
Although other processors may implement similar or identical registers, it is
not guaranteed that the implementation of e200z3-core-specific registers is
consistent among PowerPC processors.
All e200z3 SPR definitions comply with the Freescale Book E definitions.
2.3e200z3-Specific Device Control Registers
In addition to the SPRs, implementations may also implement one or more device control registers
(DCRs). The e200z3 core implements a set of device control registers to perform a parallel signature in
the parallel signature unit (PSU). These registers may not be supported by other PowerPC processors. For
details, see Section 2.19, “Parallel Signature Unit Registers.”
2.4Processor Control Registers
This section discusses machine state, processor ID, processor version, and system version registers.
2.4.1Machine State Register (MSR)
The MSR, shown in Figure 2-2, defines the state of the processor. Chapter 4, “Interrupts and Exceptions,”
describes how the MSR is affected by interrupts.
e200z3 Power Architecture Core Reference Manual, Rev. 2
0 Critical input and watchdog timer interrupts are disabled.
1 Critical input and watchdog timer interrupts are enabled.
47—Preserved.
48EEExternal interrupt enable
0 External input, decrementer, and fixed-interval timer interrupts are disabled.
1 External input, decrementer, and fixed-interval timer interrupts are enabled.
49PRProblem state.
0 The processor is in supervisor mode, can execute any instruction, and can access any resource (for example,
GPRs, all SPRs, and the MSR).
1 The processor is in user mode, cannot execute any privileged instruction, and cannot access any privileged
resource.
50FPFloating-point available.
0 Floating-point unit is unavailable. The processor cannot execute floating-point instructions, including
floating-point loads, stores, and moves. (An FP unavailable interrupt is generated on attempted execution of
floating-point instructions).
1 Floating-point unit is available. The processor can execute floating-point instructions. (Note that for the
e200z3, the floating-point unit is not supported; an unimplemented operation exception is generated for
attempted execution of floating-point instructions when FP is set).
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-8Freescale Semiconductor
Table 2-1. MSR Field Descriptions (continued)
BitsNameDescription
51MEMachine check enable.
0 Machine check interrupts are disabled. Checkstop mode is entered when the
asserted or an ISI or ITLB exception occurs on a fetch of the first instruction of an exception handler.
1 Machine check interrupts are enabled.
52FE0 Floating-point exception mode 0 (not used by the e200z3).
53—Reserved, should be cleared.
54DEDebug interrupt enable.
0 Debug interrupts are disabled.
1 Debug interrupts are enabled if DBCR0[IDM] is set.
55FE1 Floating-point exception mode 1 (not used by the e200z3)
56–57—Reserved, should be cleared.
58ISInstruction address space.
0 The processor directs all instruction fetches to address space 0 (TS = 0 in the relevant TLB entry).
1 The processor directs all instruction fetches to address space 1 (TS = 1 in the relevant TLB entry).
59DSData address space.
0 The core directs all data storage accesses to address space 0 (TS = 0 in the relevant TLB entry).
1 The core directs all data storage accesses to address space 1 (TS = 1 in the relevant TLB entry).
p_mcp_b
Register Model
input is recognized
60–61—Reserved, should be cleared.
62RIRecoverable Interrupt (used in e200z335 only)
0 Machine Check interrupt is not recoverable.
1 Machine Check interrupt may be recoverable.
This bit is cleared when a Machine check interrupt is taken, or when a critical class interrupt using CSRR0/1 is
taken. It is not set by hardware, and does not affect processor operation. It is provided as a software assist.
63—Reserved, should be cleared.
2.4.2Processor ID Register (PIR)
The processor ID for the CPU core is contained in the processor ID register (PIR), shown in Figure 2-3.
The contents of PIR reflect the hardware input signals to the e200z3 core.
3255 5663
Field—
Reset0000_0000_0000_0000_0000_0000
R/WRead only
SPRSPR 286
Figure 2-3. Processor ID Register (PIR)
PIR fields are described in Table 2-2.
PID
p_cpuid[0:7]
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-9
Register Model
Table 2-2. PIR Field Descriptions
BitsNameDescription
32–55—These bits always read as 0.
56–63PIDThese bit reflect the values on the
p_cpuid[0:7]
input signals.
2.4.3Processor Version Register (PVR)
The processor version register (PVR), shown in Figure 2-4, contains the processor version number for the
CPU core.
323536 37 3843 44474855 5659 6063
Field Manufacturer ID—TypeVersionMBG UseMajor Rev MBG ID
Reset10000001_00010010
R/WRead only
SPRSPR 287
Figure 2-4. Processor Version Register (PVR)
The PVR contains fields to specify a particular implementation of an e200z3 family member. Interface
signals p_pvrin[16:31] provide the contents of bits 48–63.
Table 2-3. PVR Field Descriptions
BitsNameDescription
32–35 Manufacturer ID Manufacturer ID. Freescale is 0b1000.
p_pvrin[16:31]
36–37—Reserved, should be cleared.
38–43TypeIdentifies the processor type. For the e200z3, this field has a value of 0b01_0001.
44–47VersionIdentifies the version of the processor and any optional elements. For e200z3, this field has a value
of 0010.
48–55MBG UseDistinguishes different system variants; provided by the
56–59Major RevDistinguishes different implementations of the version; provided by the
60–63MBG IDProvided by the
p_pvrin[28:31]
input signals.
p_pvrin[16:23]
inputs.
p_pvrin[24:27]
inputs.
2.4.4System Version Register (SVR)
The system version register (SVR) contains system version information for an e200z3-based SoC.
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-10Freescale Semiconductor
3263
FieldVersion
Register Model
ResetSoC-dependent value (determined by
R/WRead only
SPRSPR 1023
Figure 2-5. System Version Register (SVR)
p_sysvers[0:31]
on the e200z3 core)
SVR specifies a particular implementation of an e200z3-based system.
Table 2-4. SVR Field Description
BitsNameDescription
32–63Version Distinguishes different system variants, and is provided by the
p_sysvers[0:31]
inputs.
2.5Registers for Integer Operations
This section describes the registers for integer operations.
2.5.1General-Purpose Registers (GPRs)
Book E implementations provide 32 GPRs (GPR0–GPR31) for integer operations. The i nstruction formats
provide 5-bit fields for specifying the GPRs for use in executing the instruction. Each GPR is a 64-bit
register and can contain address and integer data, although all instructions except SPE APU vector
instructions use and return 32-bit values in GPR bits 32–63.
2.5.2Integer Exception Register (XER)
The XER, shown in Figure 2-6, tracks exception conditions for integer operations.
323334 35565763
Field SO OV CA—Number of bytes
ResetAll zeros
R/WR/W
SPRSPR 1
Figure 2-6. Integer Exception Register (XER)
XER fields are described in Table 2-5.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-11
Register Model
Table 2-5. XER Field Descriptions
BitsNameDescription
32SOSummary overflow. Set when an instruction (except mtspr) sets the overflow bit (OV). SO remains set until it
is cleared by mtspr[XER] or mcrxr. SO is not altered by compare instructions or other instructions that cannot
overflow (except mtspr[XER] and mcrxr). Executing mtspr[XER] with the values 0 for SO and 1 for OV clears
SO and sets OV.
33OVOverflow. X-form add, subtract from, and negate instructions with OE=1 set OV if the carry out of bit 32 is not
equal to the carry out of bit 33. Otherwise, they clear OV to indicate a signed overflow. X-form multiply low word
and divide word instructions with OE=1 set OV if the result cannot be represented in 32 bits (mullwo, divwo,
and divwuo) and clear OV otherwise. OV is not altered by compare instructions or other instructions that
cannot overflow (except mtspr[XER] and mcrxr).
34CACarry. Add carrying, subtract from carrying, add extended, and subtract from extended instructions set CA if
there is a carry out of bit 32 and clear it otherwise. CA can be used to indicate unsigned overflow for add and
subtract operations that set CA. Shift right algebraic word instructions set CA if any 1 bits are shifted out of a
negative operand and clear CA otherwise. Compare instructions and instructions that cannot carry (except
Shift Right Algebraic Word, mtspr[XER], and mcrxr) do not affect CA.
35–56—Reserved, should be cleared.
57–63 Number
of bytes
Supports emulation of load and store string instructions. Specifies the number of bytes to be transferred by a
load string indexed or store string indexed instruction.
2.6Registers for Branch Operations
This section describes registers used by Book E branch and CR operations.
2.6.1Condition Register (CR)
CR, shown in Figure 2-7, reflects the result of certain operations and provides a mechanism for testing and
branching.
3235 3639 4043 4447 4851 5255 5659 6063
FieldCR0CR1CR2CR3CR4CR5CR6CR7
ResetUndefined on
R/WR/W
CR bits are grouped into eight 4-bit fields, CR0–CR7, which are set as follows:
•Specified CR fields are set by a move to the CR from a GPR (mtcrf).
•A specified CR field is set by a move to the CR from another CR field (mcrf), or from the XER
(mcrxr).
•CR0 may be set as the implicit result of an integer instruction.
m_por
assertion, unchanged on
p_reset_b
Figure 2-7. Condition Register (CR)
assertion
•A specified CR field may be set as the result of either an integer or a floating-point compare
instruction (including SPE and SPFP compare instructions).
Instructions are provided to perform logical operations on individual CR bits and to test individual CR bits.
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-12Freescale Semiconductor
Register Model
Note that Book E instructions that access CR bits, such as Branch Conditional (bc), CR logicals, and Move
to Condition Register Field (mtcrf), determine the bit position by adding 32 to the value of the operand.
For example, the BI operand accesses the bit BI + 32, as shown in Table 2-6.
Table 2-6. BI Operand Settings for CR Fields
CRn
Bits
CR0[0]3200000 Negative (LT)—Set when the result is negative.
CR0[1]3300001 Positive (GT)—Set when the result is positive (and not zero).
CR0[2]3400010 Zero (EQ)—Set when the result is zero. For SPE compare and test instructions:
CR0[3]3500011 Summary overflow (SO). Copy of XER[SO] at the instruction’s completion.
CR1[0]3600100 Negative (LT)—For SPE and SPFP compare and test instructions:
CR1[1]3700101 Positive (GT)—For SPE and SPFP compare and test instructions:
CR1[2]3800110 Zero (EQ)—For SPE and SPFP compare and test instructions:
CR1[3]3900111 Summary overflow (SO)—For SPE and SPFP compare and test instructions:
CR
CR
CR
CR
n
[0]40
n
[1]41
n
[2]42
n
[3]43
CR
Bits
44
48
52
56
60
45
49
53
57
61
46
50
54
58
62
47
51
55
59
63
BIDescription
For SPE compare and test instructions:
Set if the high-order element of rA is equal to the high-order element of rB; cleared otherwise.
For SPE compare and test instructions:
Set if the low-order element of rA is equal to the low-order element of rB; cleared otherwise.
Set to the OR of the result of the compare of the high and low elements.
For SPE compare and test instructions:
Set to the AND of the result of the compare of the high and low elements.
Set if the high-order element of rA is equal to the high-order element of rB; cleared otherwise.
Set if the low-order element of rA is equal to the low-order element of rB; cleared otherwise.
Set to the OR of the result of the compare of the high and low elements.
Set to the AND of the result of the compare of the high and low elements.
01000
01100
10000
10100
11000
11100
01001
01101
10001
10101
11001
11101
01010
01110
10010
10110
11010
11110
01011
01111
10011
10111
11011
11111
Less than (LT)
For integer compare instructions:
rA < SIMM or rB (signed comparison) or rA < UIMM or rB (unsigned comparison).
For SPE and SPFP compare and test instructions:
Set if the high-order element of rA is equal to the high-order element of rB; cleared otherwise.
Greater than (GT)
For integer compare instructions:
rA > SIMM or rB (signed comparison) or rA > UIMM or rB (unsigned comparison).
For SPE and SPFP compare and test instructions:
Set if the low-order element of rA is equal to the low-order element of rB; cleared otherwise.
Equal (EQ)
For integer compare instructions: rA = SIMM, UIMM, or rB.
For SPE and SPFP compare and test instructions:
Set to the OR of the result of the compare of the high and low elements.
Summary overflow (SO).
For integer compare instructions, this is a copy of XER[SO] at the completion of the instruction.
For SPE and SPFP vector compare and test instructions:
Set to the AND of the result of the compare of the high and low elements.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-13
Register Model
2.6.1.1CR Setting for Integer Instructions
For all integer word instructions with the Rc bit defined and set, and for addic., andi., and andis.,
CR0[32–34] are set by signed comparison of bits 32–63 of the result to zero; CR[35] is copied from the
final state of XER[SO]. The Rc bit is not defined for double-word integer operations.
if (target_register)
else if (target_register)
else
CR0 ← c || XER
SO
< 0 then c ← 0b100
32–63
> 0 then c ← 0b010
32–63
c ← 0b001
The value of any undefined portion of the result is undefined, and the value placed into the first three bits
of CR0 is undefined. CR0 bits are interpreted as described in Table 2-7.
Table 2-7. CR0 Field Descriptions
CR BitName Description
32Negative (LT) Bit 32 of the result is equal to 1.
33Positive (GT) Bit 32 of the result is equal to 0 and at least one of bits 33–63 of the result is non-zero.
34Zero (EQ) Bits 32–63 of the result are equal to 0.
35Summary overflow (SO) This is a copy of the final state of XER[SO] at the completion of the instruction.
Note that CR0 may not reflect the true (infinitely precise) result if overflow occurs. For further details,
refer to the EREF.
2.6.1.2CR Setting for Store Conditional Instructions
CR0 is also set by the integer store conditional instruction, stwcx.. See instruction descriptions in
Chapter 3, “Instruction Model,” for details on how CR0 is set.
2.6.1.3CR Setting for Compare Instructions
For compare instructions, a CR field specified by the BI field in the instruction is set to reflect the result
of the comparison, as shown in Table 2-8.
A complete description of how the bits are set is given in the EREF.
4 * cr1 + so
4 * cr2 + so
4 * cr3 + so
4 * cr4 + so
4 * cr5 + so
4 * cr6 + so
4 * cr7 + so
CR BitsBI
Book E0–23–4
33
37
41
45
49
53
57
61
34
38
42
46
50
54
58
62
35
39
43
47
51
55
59
63
000
001
010
011
100
101
110
111
000
001
010
011
100
101
110
111
000
001
010
011
100
101
110
111
01Greater than (GT).
10Equal (EQ).
11Summary overflow (SO).
Description
For integer compare instructions:
rA > SIMM or rB (signed comparison) or rA > UIMM
or rB (unsigned comparison).
For integer compare instructions: rA = SIMM, UIMM,
or rB.
For integer compare instructions, this is a copy of
XER[SO] at instruction completion.
2.6.2Count Register (CTR)
CTR can be used to hold a loop count that can be decremented and tested during execution of branch
instructions that contain an appropriately encoded BO field. If the CTR value is 0 before i t is decremented,
it is –1 afterward. The entire CTR can hold the branch target address for a Branch Conditional to CTR
(bcctrx) instruction.
3263
FieldCount value
ResetUndefined on
R/WR/W
SPRSPR 9
m_por
assertion, unchanged on
p_reset_b
Figure 2-8. Count Register (CTR)
assertion
2.6.3Link Register (LR)
The link register, shown in Figure 2-9, provides the branch target address for the branch conditional to LR
instructions, and it holds the return address after branch and link instructions.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-15
Register Model
High-Word Error Bits
Status Bits
Enable Bits
3263
FieldLink address
ResetUndefined on
R/WR/W
SPRSPR 8
m_por
assertion, unchanged on
p_reset_b
assertion
Figure 2-9. Link Register (LR)
LR contents are read into a GPR using mfspr. The contents of a GPR can be written to LR using mtspr.
LR[62–63] are ignored by bclr instructions.
2.7SPE and SPFP APU Registers
The SPE and SPFP include the signal processing and embedded floating-point status and control register
(SPEFSCR). The SPE implements a 64-bit accumulator that is described in Section 2.7.2, “Accumulator
(ACC).”
2.7.1Signal Processing/Embedded Floating-Point Status and Control
Register (SPEFSCR)
SPEFSCR, shown in Figure 2-10, is used for status and control of SPE and embedded floating-point
instructions.
Field SOV OV FG FX FINV FDBZ FUNF FOVF — FINXE FINVE FDBZE FUNFE FOVFEFRMC
Reset0000_0000_0000_0000
R/W R/W
SPRSPR 512
Figure 2-10. Signal Processing and Embedded Floating-Point Status and Control
Register (SPEFSCR)
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-16Freescale Semiconductor
Register Model
Table 2-9 describes SPEFSCR fields.
Table 2-9. SPEFSCR Field Descriptions
BitsNameDescription
32SOVH Summary integer overflow high. Set whenever an instruction sets OVH and remains set until it is cleared by
an mtspr specifying the SPEFSCR.
33OVHInteger overflow high. Set whenever an integer or fractional SPE instruction signals an overflow in the upper
half of the result.
34FGHEmbedded floating-point guard bit high. For use by the floating-point round exception handler. It is cleared by
a floating-point data exception for the high elements. FGH corresponds to the high element result. FGH is
cleared by a scalar floating-point instruction.
35FXHEmbedded floating-point sticky bit high. Supplied for use by the floating-point round exception handler.
Zeroed if a floating-point data exception occurred for the high elements. FXH corresponds to the high element
result. FXH is cleared by a scalar floating point instruction.
In mode 0, set if the A or B high element operand of a floating-point instruction is Infinity, NaN, or Denorm, or
if the operation is a divide and the high element dividend and divisor are both 0.
In mode 1, FINVH is set on an IEEE754 invalid operation (IEEE754-1985 sec7.1) in the high element. Cleared
by a scalar floating-point instruction.
37FDBZH Embedded floating-point divide by zero high. Set when a floating-point divide instruction executes with a high
element divisor of 0 and the high element dividend is a finite non-zero number. Cleared by a scalar
floating-point instruction.
38FUNFH Embedded floating-point underflow high. Set when the execution of a floating-point instruction results in an
underflow in the high element. FUNFH is cleared by a scalar floating-point instruction.
39FOVFH Embedded floating-point overflow high. Set when the execution of a floating-point instruction results in an
overflow in the high element. Cleared by a scalar floating point instruction.
40–41—Reserved, should be cleared.
42FINXS Embedded floating-point inexact sticky flag. Set under one of the following conditions:
• The execution of a floating-point instruction delivers an inexact result for either the low or high element and
no floating-point data exception is taken for either element
• A floating-point instruction causes overflow (FOVF=1 or FOVFH=1), but floating-point overflow exceptions
are disabled (FOVFE=0)
• A floating-point instruction results in underflow (FUNF=1 or FUNFH=1), but floating-point underflow
exceptions are disabled (FUNFE=0) and no floating-point data exception occurs.
FINXS remains set until it is cleared by an mtspr specifying SPEFSCR.
43FINVS Embedded floating-point invalid operation sticky flag. Set when a floating-point instruction sets FINVH or
FINV. FINVS remains set until it is cleared by an mtspr instruction specifying SPEFSCR.
44FDBZS Embedded floating-point divide by zero sticky flag. Set when a floating-point divide instruction sets FDBZH
or FDBZ. FDBZS remains set until it is cleared by an mtspr specifying SPEFSCR.
45FUNFS Embedded floating-point underflow sticky flag. Set when a floating-point instruction sets FUNFH or FUNF.
FUNFS remains set until it is cleared by an mtspr specifying SPEFSCR.
46FOVFS Embedded floating-point overflow sticky flag. Set when a floating-point instruction sets FOVFH or FOVF.
FOVFS remains set until it is cleared by an mtspr specifying SPEFSCR.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-17
Register Model
Table 2-9. SPEFSCR Field Descriptions (continued)
BitsNameDescription
47MODE Embedded floating-point operating mode.
0 Default hardware results operating mode. The e200z3 supports only mode 0.
1 IEEE754 hardware results operating mode (not supported by the e200z3).
Controls the operating mode of the embedded floating-point APU. Software should read the value of this bit
after writing it to determine whether the implementation supports the selected mode. Implementations return
the value written if the selected mode is supported. Otherwise, the value read indicates the
hardware-supported mode.
48SOVSummary integer overflow. Set when an instruction sets OV. SOV remains set until it is cleared by an mtspr
specifying SPEFSCR.
49OVInteger overflow. Set whenever an integer or fractional SPE instruction signals an overflow in the low element
result.
50FGEmbedded floating-point guard bit. Used by the floating-point round exception handler. Cleared if a
floating-point data exception occurs for the low elements. Corresponds to the low element result.
51FXEmbedded floating-point sticky bit. For use by the floating-point round exception handler. FX is cleared if a
floating-point data exception occurs for the low elements. FX corresponds to the low element result.
52FINVEmbedded floating-point invalid operation/input error. In mode 0, FINV is set if the A or B low element operand
of a floating-point instruction is Infinity, NaN, or Denorm, or if the operation is a divide and the low element
dividend and divisor are both 0. In mode 1, FINV is set on an IEEE754 invalid operation (IEEE754-1985
sec7.1) in the low element.
53FDBZ Embedded floating-point divide by zero. Set when a floating-point divide instruction executes with a low
element divisor of 0 and the low element dividend is a finite non-zero number.
54FUNF Embedded floating-point underflow. Set when the execution of a floating-point instruction results in an
underflow in the low element.
55FOVF Embedded floating-point overflow. Set when the execution of a floating-point instruction results in an overflow
in the low element.
56—Reserved, should be cleared.
57FINXE Embedded floating-point inexact exception enable. If the exception is enabled, a floating-point round
exception is taken under one of the following conditions:
• For both elements, the result of a floating-point instruction does not result in overflow or underflow, and the
result for either element is inexact (FG | FX = 1.
•FGH | FXH =1)
• The result of a floating-point instruction does result in overflow (FOVF=1 or FOVFH=1) for either element,
but floating-point overflow exceptions are disabled (FOVFE=0)
• The result of a floating-point instruction results in underflow (FUNF=1 or FUNFH=1), but floating-point
underflow exceptions are disabled (FUNFE=0), and no floating-point data exception occurs.
The 64-bit architectural accumulator register holds the results of the multiply accumulate (MAC) forms of
SPE integer instructions. The accumulator allows back-to-back execution of dependent MAC instructions,
as in the inner loops of DSP code such as finite impulse response (FIR) fi lters. The accumulator is partially
visible to the programmer in that its results do not have to be explicitly read to use them. Instead, they are
always copied into a 64-bit destination GPR specified as part of the instruction. However, the accumulator
must be explicitly initialized when a new MAC loop starts. Based upon the type of instruction, an
accumulator can hold either a single 64-bit value or a vector of two 32-bit elements.
The Initialize Accumulator instruction (evmra) initializes the accumulator. This instruction is described
in the EREF.
2.8Interrupt Registers
This section describes the registers for interrupt handling.
2.8.1Interrupt Registers Defined by Book E
This section describes the following registers and their fields:
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-19
Register Model
2.8.1.1Save/Restore Register 0 (SRR0)
During a non-critical interrupt, SRR0, shown in Figure 2-11, holds the address of the instruction where the
interrupted process should resume. The instruction is interrupt-specific, although for instruction-caused
exceptions, the address of the instruction typically causes the interrupt. When rfi executes, instruction
execution continues at the address in SRR0. SRR0 and SRR1 are not affected by rfci or rfdi.
3263
FieldNext instruction address
ResetUndefined on
R/WR/W
SPRSPR 26
Figure 2-11. Save/Restore Register 0 (SRR0)
m_por
assertion, unchanged on
p_reset_b
assertion
2.8.1.2Save/Restore Register 1 (SRR1)
SRR1, shown in Figure 2-12, is used to save and restore machine state during non-critical interrupts. When
a non-critical interrupt is taken, MSR contents are placed into SRR1. When rfi executes, the contents of
SRR1 are restored into MSR. SRR1 bits that correspond to reserved MSR bits are also reserved. (See
Section 2.4.1, “Machine State Register (MSR)”.) SRR0 and SRR1 are not affected by rfci or rfdi.
Reserved MSR bits can be altered by rfi, rfci, or rfdi.
3263
FieldMSR state information
ResetUndefined on
R/WR/W
SPRSPR 27
Figure 2-12. Save/Restore Register 1 (SRR1)
m_por
assertion, unchanged on
p_reset_b
assertion
2.8.1.3Critical Save/Restore Register 0 (CSRR0)
CSRR0 is used to save and restore machine state during critical interrupts in the same way SRR0 is used
for non-critical interrupts: to hold the address of the i nstruction to which control is passed at the end of the
interrupt handler . CSRR0, shown in Figure 2-13, holds the address of the instruction where the interrupted
process should resume. The instruction is interrupt-specific; for details, see Chapter 4, “Interrupts and
Exceptions.” When rfci executes, instruction execution continues at the address in CSRR0. CSRR0 and
CSRR1 are not affected by rfi or rfdi.
e200z3 Power Architecture Core Reference Manual, Rev. 2
CSRR1, shown in Figure 2-14, is used to save and restore machine state during critical interrupts. MSR
contents are placed into CSRR1. When rfci executes, the contents of CSRR1 are restored into MSR.
CSRR1 bits that correspond to reserved MSR bits are also reserved. (See Section 2.4.1, “Machine State
Register (MSR).”) CSRR0 and CSRR1 are not affected by rfi or rfdi. Reserved MSR bits can be altered
DEAR, shown in Figure 2-15, is loaded with the effective address of a data access (caused by a load, store,
or cache management instruction) that results in an alignment, data TLB miss, or data storage interrupt.
.
3263
FieldException address
ResetUndefined on
R/WR/W
SPRSPR 61
Figure 2-15. Data Exception Address Register (DEAR)
m_por
assertion, unchanged on
p_reset_b
assertion
2.8.1.6Interrupt Vector Prefix Register (IVPR)
The IVPR, shown in Figure 2-16, is used during interrupt processing to determine the starting address for
the software interrupt handler. The value contained in the vector offset field of the IVOR selected for a
particular interrupt type is concatenated with the value in the IVPR to form an instruction address from
which execution is to begin.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Defines the base location of the vector table, aligned to a 64-Kbyte boundary. Provides the high-order 16
bits of the location of all interrupt handlers. IVPR || IVOR
the handler in memory.
n
values are concatenated to form the address of
2.8.1.7Interrupt Vector Offset Registers (IVORs)
IVORs, shown in Figure 2-17, hold the quad-word index from the base address provided by the IVPR for
each interrupt type.
48–59 Vector offset Provides a quad-word index from the base address provided by the IVPR to locate an interrupt handler.
60—Reserved, should be cleared.
61–63CSContext selector (e200z3-specific). When multiple hardware contexts are supported, this field is used
to select an operating context for the interrupt handler. This value is loaded into the CURCTX field of
the context control register (CTXCR) as part of the interrupt vectoring process. When multiple hardware
contexts are not supported, CS is not implemented and is read as zero.
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-22Freescale Semiconductor
Register Model
SPR numbers corresponding to IVOR16–IVOR31 are reserved. IVOR32–IVOR47 and IVOR60–IVOR63
are reserved. SPR numbers for IVOR32–IVOR63 are allocated for implementation-dependent use
(IVOR32–IVOR34 (SPR 528–530) are defined by the EIS). IVOR assignments are shown in Table 2-12.
Table 2-12. IVOR Assignments
IVOR NumberSPRInterrupt Type
IVOR0400 Critical input
IVOR1401 Machine check
IVOR2402 Data storage
IVOR3403 Instruction storage
IVOR4404 External input
IVOR5405 Alignment
IVOR6406 Program
IVOR7407 Floating-point unavailable
IVOR8408 System call
IVOR9409 Auxiliary processor unavailable. (Defined by the EIS but not supported in the e200z3.)
IVOR10410 Decrementer
IVOR11411 Fixed-interval timer interrupt
IVOR12412 Watchdog timer interrupt
IVOR13413 Data TLB error
IVOR14414 Instruction TLB error
IVOR15415 Debug
IVOR16–IVOR31—Reserved for future architectural use
IVOR32528 SPE APU unavailable (EIS–defined)
IVOR33529 SPE floating-point data exception (EIS–defined)
IVOR35–IVOR63—Allocated for implementation-dependent use
2.9Exception Syndrome Register (ESR)
The ESR, shown in Figure 2-18, provides a syndrome to distinguish exceptions that can generate the same
interrupt type. The e200z3 adds implementa tion-specific bits to this register.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Field—PIL PPR PTR FP ST — DLK ILK AP PUO BO PIE— SPE — VLEMI—MIF XTE
ResetAll zeros
R/WR/W
SPRSPR 62
Figure 2-18. Exception Syndrome Register (ESR)
NOTE
ESR information is incomplete, so system software may need to identify the
type of instruction that caused the interrupt and examine the TLB entry and
the ESR to identify the exception or exceptions fully. For example, a data
storage interrupt can be caused by both a protection violation exception and
a byte-ordering exception. System software must check beyond ESR[BO],
such as the state of MSR[PR] in SRR1 and the TLB entry page protection
bits, to determine whether a protection violation also occurred.
The ESR fields are described in Table 2-13.
Table 2-13. ESR Field Descriptions
BitsNameDescriptionAssociated Interrupt Type
32–35—Reserved, should be cleared. —
36PILIllegal instruction exceptionProgram
37PPRPrivileged instruction exceptionProgram
38PTRTrap exceptionProgram
39FPFloating-point operationAlignment, data storage, data TLB, program
40STStore operationAlignment, data storage, data TLB
41—Reserved, should be cleared. —
42DLKData cache locking
43ILKInstruction cache lockingData storage`
44APAuxiliary processor operation. (unused in the e200z3) Alignment, data storage, data TLB, program
45PUO Unimplemented operation exceptionProgram
46BOByte ordering exceptionData storage
47PIEProgram imprecise exception. Unused in the e200z3
(Reserved, should be cleared.)
48–55—Reserved, should be cleared. —
1
Data storage
—
56SPESPE APU operationSPE unavailable, SPE floating-point data exception,
SPE floating-point round exception, alignment, data
storage, data TLB
57—Reserved, should be cleared.—
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-24Freescale Semiconductor
Register Model
Table 2-13. ESR Field Descriptions (continued)
BitsNameDescriptionAssociated Interrupt Type
58VLEMI VLE mode instructionSPE unavailable, SPE floating-point data exception,
SPE floating-point round exception, data storage, data
TLB, instruction storage, alignment, program, and
system call
ESR[VLEMI] indicates when an interrupt is caused by a VLE instruction. This syndrome bit is set on an
exception associated with execution or attempted execution of a VLE instruction. This bit is updated for
the interrupt types in Table 2-13.
2.9.2Misaligned Instruction Fetch Syndrome
The ESR[MIF] bit indicates an Instruction Storage Interrupt caused by an attempt to fetch an instruction
from a Book E page that is not aligned on a word boundary. The fetch may have been caused by one of the
following:
•Execution of a Branch to LR instruction with LR[62]=1
•A Branch to CTR instruction with CTR[62]=1
•Execution of an rfi or se_rfi instruction with SRR0[62]=1
•Execution of an rfci or se_rfci instruction with CSRR0[62]=1
•Execution of an rfdi or se_rfdiinstruction with DSRR0[62]=1, where the destination address
corresponds to an instruction page not marked as a VLE page.
The ESR[MIF] bit also indicates an Instructio n TLB Interrupt caused by a TLB miss on the second half of
a misaligned 32-bit VLE Instruction. SRR0 points to the f irst half of the instr uction, which resides on the
previous page from the miss at page offset 0xFFE. The ITLB handler may need to note that the miss
corresponds to the next page, although MMU MAS2 contents correctly reflect the page corresponding to
the miss.
2.9.3Precise External Termination Error Syndrome
The ESR[XTE] bit indicates a precise external termination error DSI or ISI interrupt caused by an
instruction. This syndrome bit is set on an external termination error exception reported in a precise way
via a DSI or ISI as opposed to a machine check.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-25
Register Model
2.9.4e200z3-Specific Interrupt Registers
In addition to the Book E-defined interrupt registers, the e200z3 implements DSRR0 and DSRR1 to
facilitate handling debug interrupts and the EIS-defined MCSR to facilitate handling machine check
interrupts.
2.9.4.1Debug Save/Restore Register 0 (DSRR0)
During a debug interrupt, DSRR0, shown in Figure 2-19, holds the address of the instruction where the
interrupted process should resume. The instruction is interrupt-specific; see Section 4.6.16, “Debug
Interrupt (IVOR15),” and particularly Table 4-25. When rfdi executes, instruction execution continues at
the address in DSRR0. DSRR0 and DSRR1 are not affected by rfi or rfci.
DSRR1, shown in Figure 2-20, saves and restores machine state during debug interrupts. MSR contents
are placed into DSRR1. When rfdi executes, the contents of DSRR1 are restored into MSR. DSRR1 bits
that correspond to reserved MSR bits are also reserved. (See Section 2.4.1, “Machine State Register
(MSR).”) DSRR0 and DSRR1 are not affected by rfi or rfci. Reserved MSR bi ts can be altered by rfi, rfci,
When the core complex takes a machine check interrupt, it updates the machine check syndrome register
(MCSR) to differentiate between machine check conditions. The MCSR is shown in Figure 2-21.
e200z3 Power Architecture Core Reference Manual, Rev. 2
MCSR fields, described in Table 2-14, indicate whether the source of a machine check condition is
recoverable. When an MCSR bit is set, the core complex asserts p_mcp_out for system information .
BitsNameDescriptionRecoverable
32MCPMachine check input signalMaybe
33—Reserved, should be cleared.—
34CP_PERRCache push parity errorUnlikely
Table 2-14. MCSR Field Descriptions
Register Model
BUS_IRERR BUS_DRERR BUS_WRERR—
35CPERRCache parity errorPrecise
36EXCP_ERRISI, ITLB, or bus error on first instruction fetch for an exception handlerPrecise
37–42—Reserved, should be cleared.—
43NMINon-maskable interrupt input signal (e200z335 only)Maybe
44–58—Reserved, should be cleared.—
59BUS_IRERR Read bus error on Instruction fetchUnlikely
60BUS_DRERR Read bus error on data loadUnlikely
44–60—Reserved, should be cleared.—
61BUS_WRERR Write bus error on buffered store or cache line pushUnlikely
62–63—Reserved, should be cleared.—
2.10Software-Use SPRs (SPRG0–SPRG7 and USPRG0)
Software-use SPR s ( SPR G0–SPR G 7 and U SPR G0 , shown in Figure 2-22) have no defined functionality:
•SPRG0–SPRG2—Accessible only in supervisor mode.
•SPRG3—Written only in supervisor mode. It is readable in supervisor mode, but whether it can be
read in user mode depends on the implementation. It is not readable in user mode on the e200z3.
•SPRG4–SPRG7—Written only in supervisor mode. The y are readable in supervisor or use r mode .
•USPRG0—Accessible in supervisor or user mode.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-27
Register Model
Timer Clock
Time Base (incrementer)
Decrementer event = 0/1 detect
31
DECAR
0
Auto-reload
310
TBL
310
TBU
Watchdog timer events based on one of the TB bits
selected by the Book E–defined TCR[WP] concatenated
with the EIS-defined TCR[WPEXT] (WPEXT||WP).
Fixed-interval timer events based on one of TB bits
selected by the Book E–defined TCR[FP] concatenated
with the EIS-defined TCR[FPEXT] (FPEXT||FP).
Figure 2-22. Software-Use SPRs (SPRG0–SPRG7 and USPRG0)
1
User-mode access to SPRG3 is defined by Book E as implementation-dependent. It is not supported in the e200z3.
Software-use SPRs are read into a GPR using mfspr and are written using mtspr.
2.11Timer Registers
The time base (TB), decrementer (DEC), fixed-interval timer (FIT), and watchdog timer provide timing
functions for the system. The relationship of these timers to each other is shown in Figure 2-23.
Figure 2-23. Relationship of Timer Facilities to the Time Base
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-28Freescale Semiconductor
Register Model
•The TB is a long-period counter driven at an implementation-dependent frequency.
•The decrementer, updated at the same rate as the TB, signals an exception after a specified period
unless one of the following occurs:
— Software alters DEC in the interim.
— The TB update frequency changes.
The DEC is typically used as a general-purpose software timer.
•The time base for the TB and DEC is selected by the time base enable ( TBEN) and select time base
clock (SEL_TBCLK) bits in HID0, as follows:
— If HID0[TBEN] = 1 and HID0[SEL_TBCLK] = 0, the time base and decrementer are based on
processor clock.
— If HID0[TBEN] = 1 and HID0[SEL_TBCLK] = 1, the time base and decrementer are based on
the p_tbclk input.
•Software can select one from of four TB bits to signal a fixed-interval interrupt when the bit
transitions from 0 to 1. It typically triggers periodic system maintenance functions. Bits that can be
selected are implementation-dependent.
•The watchdog timer, also a selected TB bit, signals a critical exception when the selected bit
transitions from 0 to 1. It is typically used for system error recovery. If software does not respond
in time to the initial interrupt by clearing the associated status bits in the TSR before the next
expiration of the watchdog timer interval, a watchdog timer-generated processor reset may result,
if so enabled.
All timer facilities must be initialized during start-up.
2.11.1Timer Control Register (TCR)
TCR, shown in Figure 2-24, provides control information for the C PU timer facilities. The EREF describes
the TCR in detail. TCR[WRC] functions are impleme ntation-dependent. In addition, the co re implem ents
two implementation-specific fields, TCR[WPEXT] and TCR[FPEXT].
32 33 34 35 3637 38 39 4041 42 4346 4750 5163
Field WP WRC WIE DIE FP FIE ARE — WPEXTFPEXT—
ResetAll zeros
R/WR/W
SPRSPR 340
Figure 2-24. Timer Control Register (TCR)
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-29
Register Model
The TCR fields are described in Table 2-15.
BitsNameDescription
32–33WPWatchdog timer period, When concatenated with WPEXT, specifies one of 64 bit locations of the time base
used to signal a watchdog timer exception on a transition from 0 to 1.
TCR[WPEXT]||TCR[WP] == 000000 selects TBU[32] (msb of TBU).
TCR[WPEXT]||TCR[WP] == 111111 selects TBL[63] (lsb of TBL).
34–35WRCWatchdog timer reset control. Software can set WRC but cannot clear it except by a software-induced reset.
After WRC is written to a non-zero value, software can no longer alter it.
00 No watchdog timer reset can occur.
01 Force processor checkstop on second time-out of the watchdog timer.
10 Assert processor reset output (
11 Reserved.
38–39FPFixed-interval timer period. When concatenated with FPEXT, specifies one of 64 bit locations of the time
base to signal a fixed-interval timer exception on a transition from 0 to 1.
TCR[FPEXT]||TCR[FP] == 000000 selects TBU[32] (msb of TBU).
TCRFP[EXT]||TCR[FP] == 111111 selects TBL[63] (lsb of TBL).
43–46WPEXT Watchdog timer period extension (see above description for WP). WPEXT | WP select one of the 64 TB bits
used to signal a watchdog timer exception.
47–50FPEXT Fixed-interval timer period extension (see description for FP). FPEXT | FP select one of the 64 TB bits used
to signal a fixed-interval timer exception.
51–63—Reserved, should be cleared.
2.11.2Timer Status Register (TSR)
TSR, shown in Figure 2-25, provides status information for the CPU timer facilitie s. EREF describes the
TSR in detail. TSR[WRS] is defined as implementation-dependent.
NOTE
Register fields designated as write-1-to-clear are cleared only by writing
ones to them. Writing zeros to them has no effect.
e200z3 Power Architecture Core Reference Manual, Rev. 2
32ENW Enable next watchdog time. When a watchdog timer time-out occurs while WIS = 0 and the next watchdog
time-out is enabled (ENW = 1), a watchdog timer exception is generated and logged by setting WIS. This is a
watchdog timer first time out. A watchdog timer interrupt occurs if enabled by TCR[WIE] and MSR[CE]. To avoid
another watchdog timer interrupt when MSR[CE] is reenabled (assuming TCR[WIE] is not cleared instead), the
interrupt handler must reset TSR[WIS] by executing an mtspr, setting WIS and any other bits to be cleared and
a 0 in all other bits. The data written to the TSR is not direct data, but is a mask. A 1 causes the bit to be cleared;
a 0 has no effect.
0 Action on next watchdog timer time-out is to set TSR[ENW].
1 Action on next watchdog timer time-out is governed by TSR[WIS].
Table 2-16. Timer Status Register Field Descriptions
33WIS Watchdog timer interrupt status. See the ENW description for details on how WIS is used.
0 No watchdog timer event.
1 A watchdog timer event. When MSR[CE] = 1 and TCR[WIE] = 1, a watchdog timer interrupt is taken.
34–35 WRS Watchdog timer reset status.
00 No second time-out of watchdog timer.
01 Force processor checkstop on second time-out of watchdog timer.
10 Assert processor reset output (
11 Reserved.
36DIS Decrementer interrupt status.
0 No decrementer event.
1 Decrementer event. When MSR[EE] = TCR[DIE] = 1, a decrementer interrupt is taken.
37FISFixed-interval timer interrupt status.
0 No fixed-interval timer event.
1 Fixed-interval timer event. When MSR[EE] = 1 and TCR[FIE] = 1, a fixed-interval timer interrupt is taken.
38–63—Reserved, should be cleared.
p_resetout_b
) on second time-out of watchdog timer.
NOTE
The TSR can be read using mf spr rD,TSR. The TSR cannot be directly
written. Instead, TSR bits corresponding to 1 bits in GPR(rS ) can be cleared
using mtspr TS R ,rS.
2.11.3Time Base (TBU and TBL)
The time base (TB), seen in Figure 2-26, is composed of two 32-bit registers, the time base upper (TBU)
concatenated on the right with the time base lower (TBL). The time base registers provide timing functions
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-31
Register Model
(approximately 187,000 years)
for the system and are enabled by setting HID0[TBEN]. The decrementer (DEC) updates at the same
frequency, which is selected in HID0[SEL_TBCLK]. TB is a volatile resource and must be initialized
during start-up. For details, see Section 2.11, “T imer Regis ters .”
Figure 2-26. Time Base Upper/Lower Registers (TBU/TBL)
assertion
Undefined on
m_por
assertion, unchanged on
p_reset_b
assertion
The TB is interpreted as a 64-bit unsigne d integer that is periodically inc remented. Each inc rement adds 1
to the least-significant bit. The frequency at which the integer is updated is implementation-dependent.
32
TBL increments until its value becomes 0xFFFF_FFFF (2
– 1). At the next increment, its value becomes
0x0000_0000 and TBU is incremented. This process continues until the TBU value becomes
0xFFFF_FFFF and the TBL value becomes 0xFFFF_FFFF (TB is interprete d as
0xFFFF_FFFF_FFF F_FFFF (264– 1)). At the next increment, the TBU value becomes 0x0000_0000 and
the TBL value becomes 0x0000_0000. There is no interrupt (or any other indication).
The period depends on the driving f requency . For example, if TB is driven by 100 MHz divided by 32, the
TB period is as follows:
The TB is implemented to satisfy the following requirements:
•Loading a GPR from the TB has no effect on the accuracy of the TB.
•Storing a GPR to the TB replaces the value in the TB with the value in the GPR.
Book E does not specify a relationship between the TB update frequency and other frequencies, such as
the CPU clock or bus clock. The TB update frequency does not have to be constant. One of the following
is required to ensure that system software can keep time of day and operate interval timers:
•The system provides an (implementation-dependent) interrupt to software when the update
frequency of the TB changes and a way to determine the current update frequency.
•The update frequency of the TB is under the control of system software.
NOTE
Disabling the TB or making reading the time base privileged prevents the
TB from being used to implement a covert channel in a secure system. If the
operating system initializes the TB on power-on to some reasonable value
and the update frequency of the TB is constant, the TB can be used as a
source of values that increase at a constant rate, such as for time stamps in
trace entries.
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-32Freescale Semiconductor
Register Model
Even if the update frequency is not constant, values read from the TB are
monotonically increasing (except when the TB wraps from 264– 1 to 0). If
a trace entry is recorded each time the update frequency changes, the
sequence of TB values can be post-processed to become actual time values.
Successive readings of the TB may return identical values.
The TB is useful for timing reasonably short sequences of code (a few hundred instructions) and for
low-overhead time stamps for tracing.
2.11.4Decrementer Register
DEC, shown in Figure 2-27, is a decrementing counter that is enabled by setting HID0[TBEN]. The
decrementer and time base update at the same frequency , which is selected in HID0[SEL_TBCL K]. It
provides way to signal a decrementer interrupt af ter a specified period unl ess one of the f ollowing occurs:
•Software alters DEC in the interim.
•The TB update frequency changes.
DEC is typically used as a general-purpose softwar e timer. The decrementer auto-reload r egister (DECAR)
automatically reloads a programmed value into DEC.
3263
FieldDecrementer value
ResetUndefined on
R/WR/W
SPRSPR 22
Figure 2-27. Decrementer Register (DEC)
m_por
assertion, unchanged on
p_reset_b
assertion
2.11.5Decrementer Auto-Reload Register (DECAR)
If the auto-reload function is enabled (TCR[ARE] = 1), the auto-reload value in DECAR, shown in
Figure 2-28, is written to DEC when DEC decrements from 0x0000_0001 to 0x0000_0000. W riting DEC
with zeros by using an mtspr does not automatically generate a decrementer interrupt.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-33
Register Model
2.12Debug Registers
This section describes software-accessible debug registers for use by special debug tools and debug
software, not by general application code. Software access to these registers is conditioned by the external
debug mode control bit (DBCR0[EDM]), which can be set by the hardware debug port. If DBCR0[EDM]
is set, software is prevented from modifying debug register values. Execution of an mtspr instruction
targeting a debug register does not cause modifications to occur. In addition, since the external debugger
hardware may be manipulating debug register values, the state of these registers is not guaranteed to be
consistent if read by software with an mfspr instruction other than DBCR0[EDM].
2.12.1Debug Address and Value Registers
Instruction address compare registers IAC1–IAC4 hold instruction addresses for comparison. In addition,
IAC2 and IAC4 hold mask information for IAC1 and IAC3, respectively , when address bit match compare
modes are selected.
NOTE
During instruction address comparisons, the low-order two address bits of
the instruction address and the corresponding IAC register are ignored.
Data address compare registers DAC1 and DAC2 hold data access addresses for comparison. In addition,
DAC2 holds mask information for DAC1 when address bit match compare mode is selected.
A debug event can be enabled when there is an attempt to execute an instruction from an address in one of
the following contexts:
•In an IAC
•Inside or outside a range specified by IAC1 and IAC2
•Inside or outside a range specified by IAC3 and IAC4
•To blocks of addresses specified by the combination of the IAC1 and IAC2
•To blocks of addresses specified by the combination of the IAC3 and IAC4.
Because all instruction addresses must be word-aligned, the two low-order bits of the IACs are reserved
and do not participate in the comparison with the instruction address.
e200z3 Power Architecture Core Reference Manual, Rev. 2
The data address compare 1 register (DAC1) and data address compare 2 register (DAC2), shown in
Figure 2-30, are each 32 bits. A debug event can be enabled by loads, stores, or cache operations to an
address specified in either DAC1 or DAC2, inside or outside a range specified by the DAC1 and DAC2,
or blocks of addresses specified by the combination of the DAC1 and DAC2.
3263
FieldData address
ResetAll zeros
R/WR/W
SPRSPR 316 (DAC1); SPR 317 (DAC2)
Figure 2-30. Data Address Compare Registers (DAC1–DAC2)
The contents of DAC1 or DAC2 are compared to the address generated by a data access instruction.
2.12.1.3Data Value Compare Registers (DVC1–DVC2) (e200z335 only)
The data value compare 1 register (DVC1) and data value compare 2 register (DVC2), shown in
Figure 2-31, are each 64 bits. Data value compare registers are used to hold data values for data
comparison purposes. Data value comparisons are used to qualify data address compare debug events.
DVC1 is associated with DAC1, and DVC2 is associated with DAC2.
The most significant byte of the DVCn register (labeled B0 in Figure 9-2) corresponds to the byte data
value transferred to/from memory byte of fset 0, and the least significant byte of the register (labeled B7 in
Figure 2-31) corresponds to byte offset 7. When enabled for performing data value comparisons, each
enabled byte in DVCn is compared with the memory value transferred on the corresponding active byte
lane of the data memory interface to determine if a match occurs. Inactive byte lanes do not participate in
the comparison, they are implicitly masked. S oftware must also program the DVCn register byte positions
based on the endian mode and alignment of the access. Misaligned accesses are not fully supported, since
the data address and data value comparisons are only performed on the initial access in the case of a
misaligned access. Thus, accesses which cross a 64-bit boundary cannot be fully matched. For address and
size combinations which involve two transfers, only the initial transfer is used for data address and value
matching. DVCn may be read or written using mtspr and mfspr instructions. All 64-bits of the GPR will
be accessed, regardless of the value of the MSR[SPE] bit.
063
FieldData
address B0
ResetAll zeros
R/WR/W
SPRSPR 318 (DVC1); SPR 319 (DVC2)
Data
address B1
Figure 2-31. Data Value Compare Registers (DVC1–DVC2)
Data
address B2
Data
address B3
Data
address B4
Data
address B5
Data
address B6
Data address
B7
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-35
Register Model
2.12.2Debug Counter Register (DBCNT)
The debug counter register (DBCNT) contains two 16-bit counters (CNT1 and CNT2) that can be
configured to operate independently or concatenated into a single 32-bit counter. Each counter can be
configured to count down (decrement) when one or more count-enabled events occur. The counters
operate regardless of whether counters are enabled to generate debug exceptions. When a count value
reaches zero, a debug count event is signaled and a debug event can be generated (if enabled). Upon
reaching zero, the counter is frozen. A debug counter signals an event on the transition from a value of one
to a final value of zero. Loading a value of zero into the counter prevents the counter from counting. The
debug counter is configured by the contents of DBCR3. DBCNT is shown in Figure 2-32.
3247 4863
FieldCNT1CNT2
ResetUndefined on
R/WR/W
SPRSPR 562
m_por
assertion, unchanged on
Figure 2-32. DBCNT Register
p_reset_b
assertion
Refer to Section 2.12.3.4, “Debug Control Register 3 (DBCR3),” for details on updates to the DBCNT
register. There are restrictions on how the DBCNT and DBCR3 register are modified when one or more
counters are enabled.
2.12.3Debug Control and Status Registers (DBCR0–DBCR3)
DBCR0–DBCR3 enable debug events, reset the processor, control timer operation during debug events
and set the debug mode of the processor. The debug status register (DBSR) records debug exceptions while
internal or external debug mode is enabled.
To ensure that any alterations enabling/disabling debug events are effective, the e200z3 requires that a
context synchronizing instruction follow an mtspr that updates a DBCR or DBSR. The context
synchronizing instruction may or may not be affected by t he alteration. T ypically , an isync is used to create
a synchronization boundary beyond which it can be guaranteed that the newly written control values are
in effect. For watchpoint generation and counter operation, configuration settings in DBCR1–DBCR3 are
used, even though the corresponding events can be disabled (via DBCR0) from setting DBSR flags.
2.12.3.1Debug Control Register 0 (DBCR0)
DBCR0 is used to enable debug modes and controls which debug events are allowed to set DBSR flags .
The e200z3 adds bits to this register, as shown in Figure 2-33.
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-36Freescale Semiconductor
323334 35363738394041424344 45 46 47
Field EDM IDM RST ICMPBRTIRPTTRAPIAC1IAC2IAC3IAC4 DAC1 DAC2
ResetAll zeros
R/WR/W
4849525354555657585962 63
RET—DEVT1 DEVT2 DCNT1 DCNT2 CIRPT CRET VLES—FT
ResetAll zeros
R/WR/W
SPRSPR 308
1
1
Figure 2-33. DBCR0 Register
1
DBCR0[EDM] is affected by
All other bits are reset by processor reset
j_trst_b
or
m_por
assertion, and while in the test_logic_reset state, but not by
p_reset_b
as well as by
m_por
.
Table 2-17 provides field definitions for DBCR0.
Table 2-17. DBCR0 Field Descriptions
Register Model
p_reset_b
.
BitsNameDescription
32EDMExternal debug mode. For software, this bit is read-only. Software can use EDM to determine whether external
debug has control over debug registers. The hardware debugger must set EDM before other DBCR0 bits (and
other debug registers) can be altered. On the initial setting of EDM, all other bits are unchanged. EDM is
writable only through the OnCE port.
0 External debug mode is disabled. Internal debug events not mapped into external debug events.
1 External debug mode is enabled. Events do not cause the CPU to vector to interrupt code. Software is not
permitted to write to debug registers (DBCR0
permitted by settings in DBERC0.
Note: DBSR status bits should be cleared before external debug mode is disabled to avoid internal imprecise
debug interrupts.
When external debug mode is enabled, hardware-owned resources in debug registers are not affected by
processor reset p_reset_b. This allows the debugger to set up hardware debug events which remain active
across a processor reset.
33IDMInternal debug mode.
0 Debug exceptions are disabled. Debug events do not affect DBSR.
1 Debug exceptions are enabled. Enabled debug events update the DBSR. If MSR[DE] = 1, a debug event or
the recording of an earlier debug event in the DBSR when MSR[DE] was cleared causes a debug interrupt.
34–35RSTReset control.
00 No function.
01 Reserved.
10
p_resetout_b
11 Reserved.
set by debug reset control. Allows external device to initiate processor reset.
–DBCR3, DBSR, DBCNT, IAC1–IAC4, DAC1–DAC2) unless
36ICMP Instruction complete debug event enable.
0 ICMP debug events are disabled.
1 ICMP debug events are enabled.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-37
Register Model
Table 2-17. DBCR0 Field Descriptions (continued)
BitsNameDescription
37BRTBranch taken debug event enable.
0 BRT debug events are disabled.
1 BRT debug events are enabled.
38IRPTInterrupt taken debug event enable.
0 IRPT debug events are disabled.
1 IRPT debug events are enabled.
39TRAP Trap taken debug event enable.
0 TRAP debug events are disabled.
1 TRAP debug events are enabled.
0 IAC4 debug events are disabled.
1 IAC4 debug events are enabled.
44–45 DAC1 Data address compare 1 debug event enable
00 DAC1 debug events are disabled.
01 DAC1 debug events are enabled only for store
10 DAC1 debug events are enabled only for load
11 DAC1 debug events are enabled for load
46–47 DAC2 Data address compare 2 debug event enable.
00 DAC2 debug events are disabled.
01 DAC2 debug events are enabled only for store
10 DAC2 debug events are enabled only for load
11 DAC2 debug events are enabled for load
48RETReturn debug event enable.
0 RET debug events are disabled.
1 RET debug events are enabled.
49–52—Reserved.
53DEVT1 External debug event 1 enable.
0 DEVT1 debug events are disabled.
1 DEVT1 debug events are enabled.
54DEVT2 External debug event 2 enable.
0 DEVT2 debug events are disabled.
1 DEVT2 debug events are enabled.
-type or store-type data storage accesses.
-type or store-type data storage accesses.
-type data storage accesses.
-type data storage accesses.
-type data storage accesses.
-type data storage accesses.
55DCNT1 Debug counter 1 debug event enable.
0 counter 1 debug events are disabled.
1 counter 1 debug events are enabled.
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-38Freescale Semiconductor
Register Model
Table 2-17. DBCR0 Field Descriptions (continued)
BitsNameDescription
56DCNT2 Debug counter 2 debug event enable.
0 counter 2 debug events are disabled.
1 counter 2 debug events are enabled.
57CIRPT Critical interrupt taken debug event enable.
0 CIRPT debug events are disabled.
1 CIRPT debug events are enabled.
58CRET Critical return debug event enable.
0 CRET debug events are disabled.
1 CRET debug events are enabled.
59VLESVLE status, Set if an ICMP, BRT, TRAP, RET, CRET, IAC, or DAC debug event occurred on a VLE instruction.
Undefined for IRPT, CIRPT, DEVT[1,2], DCNT[1,2], and UDE events.
60–62—Reserved.
63FTFreeze timers on debug event.
0 Timebase timers are unaffected by set DBSR bits.
1 Disable clocking of timebase timers if any DBSR bit is set (except MRR or CNT1TRG).
2.12.3.2Debug Control Register 1 (DBCR1)
DBCR1, shown in Figure 2-34, is used to configure instruction address compare operation.
Field IAC1US IAC1ER IAC2US IAC2ER IAC12M—IAC3US IAC3ER IAC4US IAC4ER IAC34M—
ResetAll zeros
R/WR/W
SPRSPR 309
Figure 2-34. Debug Control Register 1 (DBCR1)
1
Reset by processor reset p_reset_b if DBCR0[EDM]=0, as well as unconditionally by m_por. If DBCR0[EDM]=1,
DBERC0 masks off hardware-owned resources from reset by p_reset_b and only software-owned resources indicated
by DBERC0 will be reset by p_reset_b.
1
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-39
Register Model
Table 2-18 describes debug control register 1 fields.
00 IAC1 debug events are not affected by MSR[PR].
01 Reserved.
10 IAC1 debug events can occur only if MSR[PR] = 0 (supervisor mode).
11 IAC1 debug events can occur only if MSR[PR] = 1 (user mode).
00 IAC1 debug events are based on effective address.
01 Unimplemented in the e200z3 (Book E real address compare), no match can occur.
10 IAC1 debug events are based on effective address and can occur only if MSR[IS] = 0.
11 IAC1 debug events are based on effective address and can occur only if MSR[IS] = 1.
00 IAC2 debug events are not affected by MSR[PR].
01 Reserved.
10 IAC2 debug events can occur only if MSR[PR] = 0 (supervisor mode).
11 IAC2 debug events can occur only if MSR[PR] = 1 (user mode).
00 IAC2 debug events are based on effective address.
01 Unimplemented in the e200z3 (Book E real address compare), no match can occur.
10 IAC2 debug events are based on effective address and can occur only if MSR[IS] = 0.
11 IAC2 debug events are based on effective address and can occur only if MSR[IS] = 1.
40–41IAC12M Instruction address compare 1/2 mode.
00 Exact address compare. IAC1 debug events can occur only if the address of the instruction fetch is
equal to the value specified in IAC1. IAC2 debug events can occur only if the address of the instruction
fetch is equal to the value specified in IAC2.
01 Address bit match. IAC1 debug events can occur only if the address of the instruction fetch ANDed with
the contents of IAC2 is equal to the contents of IAC1, also ANDed with the contents of IAC2. IAC2 debug
events do not occur. IAC1US and IAC1ER settings are used.
10 Inclusive address range compare. IAC1 debug events can occur only if the address of the instruction
fetch is greater than or equal to the value specified in IAC1 and less than the value specified in IAC2.
IAC2 debug events do not occur. IAC1US and IAC1ER settings are used.
11 Exclusive address range compare. IAC1 debug events can occur only if the address of the instruction
fetch is less than the value specified in IAC1 or is greater than or equal to the value specified in IAC2.
IAC2 debug events do not occur. IAC1US and IAC1ER settings are used.
00 IAC3 debug events are not affected by MSR[PR].
01 Reserved.
10 IAC3 debug events can occur only if MSR[PR] = 0 (supervisor mode).
11 IAC3 debug events can occur only if MSR[PR] = 1 (user mode).
00 IAC3 debug events are based on effective address.
01 Unimplemented in the e200z3 (Book E real address compare), no match can occur.
10 IAC3 debug events are based on effective address and can occur only if MSR[IS] = 0.
11 IAC3 debug events are based on effective address and can occur only if MSR[IS] = 1.
e200z3 Power Architecture Core Reference Manual, Rev. 2
00 IAC4 debug events are not affected by MSR[PR].
01 Reserved.
10 IAC4 debug events can occur only if MSR[PR] = 0 (supervisor mode).
11 IAC4 debug events can occur only if MSR[PR] = 1 (user mode).
00 IAC4 debug events are based on effective address.
01 Unimplemented in the e200z3 (Book E real address compare), no match can occur.
10 IAC4 debug events are based on effective address and can occur only if MSR[IS] = 0.
11 IAC4 debug events are based on effective address and can occur only if MSR[IS] = 1.
56–57IAC34M Instruction address compare 3/4 mode.
00 Exact address compare. IAC3 debug events can occur only if the address of the instruction fetch is
equal to the value specified in IAC3. IAC4 debug events can occur only if the address of the instruction
fetch is equal to the value specified in IAC4.
01 Address bit match. IAC3 debug events can occur only if the address of the instruction fetch ANDed with
the contents of IAC4 is equal to the contents of IAC3, also ANDed with the contents of IAC4. IAC4 debug
events do not occur. IAC3US and IAC3ER settings are used.
10 Inclusive address range compare. IAC3 debug events can occur only if the address of the instruction
fetch is greater than or equal to the value specified in IAC3 and less than the value specified in IAC4.
IAC4 debug events do not occur. IAC3US and IAC3ER settings are used.
11 Exclusive address range compare. IAC3 debug events can occur only if the address of the instruction
fetch is less than the value specified in IAC3 or is greater than or equal to the value specified in IAC4.
IAC4 debug events do not occur. IAC3US and IAC3ER settings are used.
Register Model
58–63—Reserved
2.12.3.3Debug Control Register 2 (DBCR2)
DBCR2, shown in Figure 2-35, is used to configure data address compare operations.
3233343536373839404142434463
Field DAC1US DAC1ER DAC2US DAC2ER DAC12M DAC1LNK DAC2LNK —
ResetAll zeros
R/WR/W
SPRSPR 310
Figure 2-35. DBCR2 Register
1
Reset by processor reset p_reset_b if DBCR0[EDM]=0, as well as unconditionally by m_por. If DBCR0[EDM]=1,
DBERC0 masks off hardware-owned resources from reset by p_reset_b and only software-owned resources
indicated by DBERC0 will be reset by p_reset_b.
1
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-41
Register Model
Table 2-19 describes DBCR2 fields.
Table 2-19. DBCR2 Field Descriptions
BitsNameDescription
32–33DAC1US Data address compare 1 user/supervisor mode.
00 DAC1 debug events are not affected by MSR[PR].
01 Reserved.
10 DAC1 debug events can occur only if MSR[PR] = 0 (supervisor mode).
11 DAC1 debug events can occur only if MSR[PR] = 1 (User mode).
34–35DAC1ER Data address compare 1 effective/real mode.
00 DAC1 debug events are based on effective address.
01 Unimplemented in the e200z3 (Book E real address compare), no match can occur.
10 DAC1 debug events are based on effective address and can occur only if MSR[DS] = 0.
11 DAC1 debug events are based on effective address and can occur only if MSR[DS] = 1.
36–37DAC2US Data Address compare 2 user/supervisor mode.
00 DAC2 debug events are not affected by MSR[PR].
01 Reserved
10 DAC2 debug events can occur only if MSR[PR] = 0 (supervisor mode).
11 DAC2 debug events can occur only if MSR[PR] = 1 (user mode).
38–39DAC2ER Data address compare 2 effective/real mode.
00 DAC2 debug events are based on effective address.
01 Unimplemented in the e200z3 (Book E real address compare), no match can occur.
10 DAC2 debug events are based on effective address and can occur only if MSR[DS] = 0.
11 DAC2 debug events are based on effective address and can occur only if MSR[DS] = 1.
40–41DAC12M Data address compare 1/2 mode.
00 Exact address compare. DAC1 debug events can occur only if the address of the data access is equal
to the value specified in DAC1. DAC2 debug events can occur only if the address of the data access
is equal to the value specified in DAC2.
01 Address bit match. DAC1 debug events can occur only if the address of the data access ANDed with
the contents of DAC2 is equal to the contents of DAC1, also ANDed with the contents of DAC2. DAC2
debug events do not occur. DAC1US and DAC1ER settings are used.
10 Inclusive address range compare. DAC1 debug events can occur only if the address of the data
access is greater than or equal to the value specified in DAC1 and less than the value specified in
DAC2. DAC2 debug events do not occur. DAC1US and DAC1ER settings are used.
11 Exclusive address range compare. DAC1 debug events can occur only if the address of the data
access is less than the value specified in DAC1 or is greater than or equal to the value specified in
DAC2. DAC2 debug events do not occur. DAC1US and DAC1ER settings are used.
42DAC1LNK Data address compare 1 linked.
0No effect.
1 DAC1 debug events are linked to IAC1 debug events. IAC1 debug events do not affect DBSR.
When linked to IAC1, DAC1 debug events are conditioned based on whether the instruction also
generated an IAC1 debug event.
43DAC2LNK Data address compare 2 linked
0No effect.
1 DAC 2 debug events are linked to IAC3 debug events. IAC3 debug events do not affect DBSR.
When linked to IAC3, DAC2 debug events are conditioned based on whether the instruction also
generated an IAC3 debug event. DAC2 can only be linked if DAC12M specifies exact address
compare because DAC2 debug events are not generated in the other compare modes.
44–63—Reserved for data value compare control (not supported by the e200z3).
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-42Freescale Semiconductor
Register Model
2.12.3.4Debug Control Register 3 (DBCR3)
DBCR3, shown in Figure 2-36, is an e200z3 implementation-specific register to enable and configure the
debug counter and debug counter events. For counter operation, the specific debug events that cause
counters to decrement are specified in DBCR3.
NOTE
Corresponding events do not need to be (and probably should not be)
enabled in DBCR0.
The IAC1–IAC4 and DAC1–DAC2 control fields in DBCR0 are ignored for counter operations and the
control fields in DBCR3 determine when counting is enabled. DBCR1 and DBCR2 control fields are also
used to determine the configuration of IAC1–IAC4 and DAC1–DAC2 operations for counting, even
though the setting of bits in DBSR by corresponding events can be disabled via DBCR0. Multiple
count-enabled events that occur during execution of an instruction typically cause only one decrement of
a counter. For example, if more than one IAC or DAC register hits and is enabled for counting, only one
count can occur per counter. During execution of lmw and stmw instruc tions , multiple DACn hits can
occur. If the instruction is not interrupted before completion, a single decrement of a counter occurs.
NOTE
If the counters operate independently, both may count for the same
instruction.
The debug counter register (DBCNT) is configured by DBCR3[CONFIG] to operate either as separate
16-bit counter 1 and counter 2 or as a combined 32-bit counter (using control bits in DBCR3 for counter
1). Counters are enabled when any of their respective count enable event control bits are set and either
DBCR0 or DBCR0[EDM] is set. Counter 1 can be configured to count down on a number of different
debug events. Counter 2 is also configurable to count down on instruction complete, instruction or data
address compare events, and external events.
Special capability is provided for counter 1 to be triggered to begin counting down by a subset of events
(IAC1, IAC3, DAC1R, DAC1W , DEVT1, DEVT2, and counter 2). When one or more of the counter 1
trigger bits is set (IAC1T1, IAC3T1, DAC1RT1, DAC1WT1, DEVT1T1, DEVT2T1, CNT2T1), counter
1 is frozen until at least one of the triggering events occurs and is then enabled to begin operation.
Triggering status for counter 1 is provided in the debug status register. Triggering mode is enabled by an
mtspr DBCR3 which sets one or more of the trigger enable bits and also enables counter 1. The trigger
can be re-armed by clearing the DBSR[CNT1TRG] status bit.
Most combinations of enables do not make sense and should be avoided. For example, if DBCR3[ICMP]
is set for counter 1, no other count enable should be set for counter 1. Conversely, multiple instruction
address compare count enables are allowed to be set and can be useful.
Due to instruction pipelining issues and other constraints, most combinations of events are not supported
for event counting. Only the following combinations are for use; other combinations are not supported:
•Any combination of IAC[1–4]
•Any combination of DAC[1–2] including linking
•Any combination of DEVT[1–2]
•Any combination of IRPT and RET
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-43
Register Model
Limited support is provided for any combination of IAC[1–4] with DAC[1–2] (linked or unlinked).
Due to pipelining and detection of IAC events early in the pipeline and DAC events late in the pipeline,
no guarantee is made on the exact instruction boundary that a debug exception is generated when IAC and
DAC events are combined for counting. This also applies when counter 1 is triggered by counter 2, and a
combination of IAC and DAC events is enabled for the counters, even if only one of these types is enabled
for a particular counter. In general, when an IAC event logically follows a DAC event within several
instructions, it cannot be recognized immediately because the DAC event may not be generated in the
pipeline at the time the IAC appears. Thus, the counter may not decrement to zero for the IAC event until
after the instruction with the IAC (and perhaps several additional instructions) proceeds down the
execution pipeline. The instruction boundary where the debug exception is actually generated typically
follows the IAC by up to several instructions.
Note that the counters operate regardless of whether counters are enabled to generate debug exceptions.
If counter 2 is used to trigger counter 1, counter 2 events should not normally be enabled in DBCR0 and
are not blocked.
NOTE
Multiple IAC or DAC events are not counted during an lmw or stmw
instruction, and no count occurs if either is interrupted by a critical input or
external input interrupt before completion.
0 Counting ICMP debug events by counter 1 is disabled.
1 Counting ICMP debug events by counter 1 is enabled.
ICMP events are masked by MSR[DE] = 0 when operating in internal debug mode.
0 Counting DEVT2 debug events by counter 2 is disabled.
1 Counting DEVT2 debug events by counter 2 is enabled.
0 Counting ICMP debug events by counter 2 is disabled.
1 Counting ICMP debug events by counter 2 is enabled.
ICMP events are masked by MSR[DE] = 0 when operating in internal debug mode.
0 Counting IAC1 debug events by counter 2 is disabled.
1 Counting IAC1 debug events by counter 2 is enabled.
0 Counting IAC2 debug events by counter 2 is disabled.
1 Counting IAC2 debug events by counter 2 is enabled.
0 Counting IAC3 debug events by counter 2 is disabled.
1 Counting IAC3 debug events by counter 2 is enabled.
0 Counting IAC4 debug events by counter 2 is disabled.
1 Counting IAC4 debug events by counter 2 is enabled.
1
.
0 Counting DAC1R debug events by counter 2 is disabled.
1 Counting DAC1R debug events by counter 2 is enabled.
1
.
0 Counting DAC1W debug events by counter 2 is disabled.
1 Counting DAC1W debug events by counter 2 is enabled.
1
.
0 Counting DAC2R debug events by counter 2 is disabled.
1 Counting DAC2R debug events by counter 2 is enabled.
1
.
0 Counting DAC2W debug events by counter 2 is disabled.
1 Counting DAC2W debug events by counter 2 is enabled.
0 Counter 1 and counter 2 are independent counters.
1 Counter 1 and counter 2 are concatenated into a single 32-bit counter. The event count
control bits for counter 1 are used and the event count control bits for counter 2 are
ignored.
1
If the DACx field in DBCR0 is set to restrict events to only reads or only writes, only those events are counted
if enabled in DBCR3. In general, DAC events should be disabled in DBCR0.
NOTE
Register Model
Perform updates to DBCR0, DBSR, DBCR3, and DBCNT carefully if the
counters are enabled for counting ICMP events. An ins truction that updates
the counters or control over the counters can cause one or more counter
events (DCNT1, DCNT2, CNT1TRG), even if the result of the instruction
is to modify the counter value or control value to a state where counter
events are not expected. This is due to the pipelined nature of the counter
and control operation.
•For DBCNT, if a counter is enabled to count ICMP events,
MSR[DE] = 1, and the counter value is 1 before execution of an mtspr
that loads the counter with a different value, a counter event is generated
after the mtspr completes, even though the counter is loaded with a new
value. When the mtspr finishes executing, a debug event is posted, but
the counter holds the newly written value. The new counter value is
assigned at the completion of an mtspr that modifies a counter,
regardless of whether a debug event is generated based on the old
counter value. To avoid this, modify DBCNT and DBCR3 only when
there is no possibility of a counter-related debug event on the mtspr.
•For DBCR3, if a counter is enabled to count ICMP events,
MSR[DE] = 1, and the counter value is 1 before execution of an mtspr
that is loading DBCR3 with a different value, a counter event may be
generated after the mtspr completes, even though DBCR3 is loaded
with a value that prevents the particular event from being counted.
When the mtspr finishes executing, a debug event is posted, but the
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-47
Register Model
DBCR3 value reflects the newly established control, which may
indicate that the particular event is not to cause a counter update.
Modifying DBCR0 to affect counter event enabling/disabling may have
similar issues, as may modifying DBSR[CNT1TRG].
2.12.3.5 Debug Control Register 4 (DBCR4) (e200z335 only)
Debug Control Register 4 is used to enable debug modes and controls which debug events are allowed to
set DBSR flags. The core adds some implementation specific bits to this register, as seen in Figure 2-33.
DBCR4 is reset by processor reset p_reset_b if DBCR0[EDM]=0, as well as unconditionally by m_por. If
DBCR0[EDM]=1, DBERC0 masks off hardware-owned resources from reset by p_reset_b and only
software-owned resources indicated by DBERC0 will be reset by p_reset_b.
Table 2-17 provides bit definitions for Debug Control Register 4.
DVC1C controls whether DVC1 data value comparisons utilize the normal BookE operation,
or an alternate "inverted compare" operation. In inverted polarity mode, data value
compares perform a not-equal comparison. See details in the DBCR2 register definition
DVC2C controls whether DVC2 data value comparisons utilize the normal BookE operation,
or an alternate "inverted compare" operation. In inverted polarity mode, data value
compares perform a not-equal comparison. See details in the DBCR2 register definition
4:31—Reserved
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-48Freescale Semiconductor
Register Model
2.12.4Debug Status Register (DBSR)
DBSR, shown in Figure 2-38, contains status on debug events and the most recent processor reset.
Hardware sets DBSR, and s oftware reads and clea rs it by writing a 1 in any bit position t hat is to be cleared
and 0 in all other bit positions. The wr ite data to t he debug status register is not direct data, but a mask. A
1 causes the bit to be cleared, and a 0 has no effect. Debug status bits are set by debug events only while
internal debug mode is enabled or external debug mode is enabled. When debug interrupts are enabled
(MSR[DE] = 1, DBCR0[IDM] = 1, and DBCR0[EDM] = 0), a set bit in DBSR causes a debug interrupt
to be generated.
When debug interrupts are enabled (MSR[DE]=1, DBCR0[IDM]=1, and DBCR0[EDM]=0), a set bit in
DBSR other than MRR or VLES causes a debug interrupt. The debug interrupt handler clears DBSR bits
before returning to normal execution. The PowerPC VLE APU adds the DBSR[VLES] status bit to
indicate debug events occurring due to a PowerPC VLE instruction.
3233 34 35363738394041424344454647
Field IDE UDE MRR ICMP BRTIRPT TRAPIAC1IAC2 IAC3 IAC4 DAC1R DAC1W DAC2R DAC2W
Reset 0001_0000_0000_0000
R/WRead/Clear
48495253545556575859616263
Field RET—DEVT1 DEVT2 DCNT1 DCNT2 CIRPT CRET—DAC_OFSTCNT1TRG
Reset 0000_0000_0000_0000
R/WRead/Clear
SPRSPR 304
Figure 2-38. DBSR Register
Table 2-22 provides field definitions for the debug status register.
Table 2-22. DBSR Field Descriptions
BitsNameDescription
32IDEImprecise debug event. Set if MSR[DE] = 0 and DBCR0[EDM] = 0 and a debug event causes its respective
debug status register bit to be set. IDE can also be set if DBCR0[EDM] = 1 and an imprecise debug event
occurs due to a DAC event on a load or store that is terminated with error, or if an ICMP event occurs in
conjunction with a SPE FP round exception.
33UDEUnconditional debug event. Set when an unconditional debug event occurs.
34–35MRRMost recent reset.
00 No reset since software last cleared these bits.
01 A hard reset occurred since software last cleared these bits.
1
x
Reserved.
36ICMPInstruction complete debug event. Set if an instruction complete debug event occurs.
37BRTBranch taken debug event. Set if an branch taken debug event occurs.
38IRPTInterrupt taken debug event. Set if an interrupt taken debug event occurs.
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-49
Register Model
Table 2-22. DBSR Field Descriptions (continued)
BitsNameDescription
39TRAPTrap taken debug event. Set if a trap taken debug event occurs.
40IAC1Instruction address compare 1 debug event. Set if an IAC1 debug event occurs.
41IAC2Instruction address compare 2 debug event. Set if an IAC2 debug event occurs.
42IAC3Instruction address compare 3 debug event. Set if an IAC3 debug event occurs.
43IAC4Instruction address compare 4 debug event. Set if an IAC4 debug event occurs.
44DAC1RData address compare 1 read debug event. Set if a read-type DAC1 debug event occurs while
DBCR0[DAC1] = 0b10 or DBCR0[DAC1] = 0b11.
45DAC1WData address compare 1 write debug event. Set if a write-type DAC1 debug event occurs while
DBCR0[DAC1] = 0b01 or DBCR0[DAC1] = 0b11.
46DAC2RData address compare 2 read debug event. Set if a read-type DAC2 debug event occurs while
DBCR0[DAC2] = 0b10 or DBCR0[DAC2] = 0b11.
47DAC2WData address compare 2 write debug event. Set if a write-type DAC2 debug event occurs while
DBCR0[DAC2] = 0b01 or DBCR0[DAC2] = 0b11.
48RETReturn debug event. Set if a Return debug event occurs.
49–52—Reserved, should be cleared.
53DEVT1External debug event 1 debug event. Set if a DEVT1 debug event occurs.
54DEVT2External debug event 2 debug event. Set if a DEVT2 debug event occurs.
55DCNT1Debug counter 1 debug event. Set if a DCNT1 debug event occurs.
56DCNT2Debug counter 2 debug event. Set if a DCNT2 debug event occurs.
57CIRPTCritical interrupt taken debug event. Set if a critical interrupt taken debug event occurs.
58CRETCritical return debug event. Set if a critical return debug event occurs.
59–60—Reserved, should be cleared.
61–62 DAC_OFSTData Address Compare Offset (e200z335 only, reserved on e200z3)
Indicates offset-1 of saved DSRR0 value from the address of the load or store instruction which took a DAC
Debug exception, unless a simultaneous DTLB or DSI error occurs, in which case this field is set to 2‘b00
and DBSR[IDE] is set to 1. Normally set to 2‘b00. A DVC DAC will set this field to 2’b01.
63CNT1TRG Counter 1 triggered. Set if debug counter 1 is triggered by a trigger event.
2.12.5 Debug External Resource Control Register (DBERC0)
The Debug External Resource Control Register (DBERC0) controls resource allocation when
DBCR0[EDM] is set to ‘1’. DBERC0 provides a mechanism for the hardware debugger to share debug
resources with software. Individual resources are allocated based on the settings of DBERC0 when
DBCR0[EDM]=1. DBERC0 settings are ignored when DBCR0[EDM]=0.
Hardware-owned resources which generate debug events cause entry into debug mode, while
software-owned resources which generate debug events act as if they occurred in internal debug mode,
thus causing debug interrupts to occur if DBCR0[IDM]=1 and MSR[DE]=1. DBERC0 is controlled via
the OnCE port hardware, and is read-only to software.
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-50Freescale Semiconductor
Register Model
Debug Status bits in DBSR are set by software-owned debug events only w hile Internal Debug Mode is
enabled. When debug interrupts are enabled (MSR[DE]=1 DBCR0[IDM]=1 and DBCR0[EDM]=0, or
MSR[DE]=1, DBCR0[IDM]=1 and DBCR0[EDM]=1 and software is allocated resource(s) via
DBERC0), a set bit in DBSR which is software-owned other than MRR or VLES will cause a debug
interrupt to be generated.
Debug Status bits in DBSR are set by hardware-owned debug events only while External Debug Mode is
enabled (DBCR0[EDM]=1).
If DBERC0[IDM]=1, all DBSR status bits corresponding to hardware-owned debug events are masked to
0 when accessed by software. The actual values in the DBSR register is always visible to hardware when
accessed via the OnCE port.
Software-owned resources may be modified by software, but only the corresponding control and status
bits in DBCR0-4 and DBSR are affected by execution of a mtspr, thus only a portion of these registers
may be affected, depending on the allocation settings in DBERC0. The debug interrupt handler is still
responsible for clearing software-owned DBSR bits prior to returning to normal execution. Hardware
always has full access to all registers and all register fields through the OnCE register acce ss mechanism,
and it is up to the debug firmware to properly implement modifications to these registers with
read-modify-write operations to implement any control sharing with software. Settings in DBERC0
should be considered by the debug firmware in order to preserve softwar e settings of control and status
registers as appropriate when hardware modifications to the debug registers is performed.
SPR - 569; Read-only by Software; Reset - Unaffected by p_reset_b, cleared by m_por or while in the test-logic-reset
UDE
BRT
ICMP
IRPT
IAC1
TRAP
IAC2
IAC3
0
IAC4
DAC1
OnCE controller state
0
DAC2
RET
0
DEVT1
DEVT2
DCNT1
DCNT2
CIRPT
BKPT
CRET
Figure 2-39. DBERC0 Register
FT
e200z3 Power Architecture Core Reference Manual, Rev. 2
Freescale Semiconductor2-51
Register Model
Table 2-22 provides bit definitions for the Debug External Resource Control Register . Note that DBERC0
controls are disabled when DBCR0[EDM]=0.
Table 2-23. DBERC0 Bit Definitions
Bit(s)NameDescription
0—Reserved
Internal Debug Mode control
0 - Internal Debug mode may not be enabled by software. DBCR0[IDM] is owned exclusively
by hardware. mtspr DBCR0-4, DBCNT or DBSR is always ignored. No resource sharing
occurs, regardless of the settings of other fields in DBERC0. Hardware exclusively owns
all resources.
1IDM
2RST
1 - Internal Debug mode may be enabled by software. DBCR0[IDM], DBSR[IDE], and
DBSR[MRR] are owned by software. DBCR0[IDM], DBSR[IDE], and DBSR[MRR] are
software readable/writeable.
When DBERC0[IDM]=1, hardware-owned status and control bits in DBSR are masked from
software access and read as 0. Software writes to hardware-owned bits in DBCR0-4,
DBCNT, and DBSR via mtspr are ignored.
Reset Field Control
0 - DBCR0[RST] owned exclusively by hardware debug. No mtspr access by software to
DBCR0[RST] field.
1 - DBCR0[RST] accessible by software debug. DBCR0[RST] is software readable/writeable.
3UDE
4ICMP
5BRT
6IRPT
7TRAP
Unconditional Debug Event
0 - Event owned by hardware debug. No mtspr access by software to DBSR[UDE] field.
1 - Event owned by software debug. DBSR[UDE] is software readable/writeable.
Instruction Complete Debug Event
0 - Event owned by hardware debug. No mtspr access by software to DBCR0[ICMP] or
DBSR[ICMP] fields.
1 - Event owned by software debug. DBCR0[ICMP] and DBSR[ICMP] are software
readable/writeable.
Branch Taken Debug Event
0 - Event owned by hardware debug. No mtspr access by software to DBCR0[BRT] or
DBSR[BRT] fields.
1 - Event owned by software debug. DBCR0[BRT] and DBSR[BRT] are software
readable/writeable.
Interrupt Taken Debug Event
0 - Event owned by hardware debug. No mtspr access by software to DBCR0[IRPT] or
DBSR[IRPT] fields.
1 - Event owned by software debug. DBCR0[IRPT] and DBSR[IRPT] are software
readable/writeable.
Trap Taken Debug Event
0 - Event owned by hardware debug. No mtspr access by software to DBCR0[TRAP] or
DBSR[TRAP] fields.
1 - Event owned by software debug. DBCR0[TRAP] and DBSR[TRAP] are software
readable/writeable.
e200z3 Power Architecture Core Reference Manual, Rev. 2
2-52Freescale Semiconductor
Loading...
+ hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.