The information in this publication has been carefully
checked and is believed to be entirely accurate at the
time of publication. Samsung assumes no
responsibility, however, for possible errors or
omissions, or for any consequences resulting from the
use of the information contained herein.
Samsung reserves the right to make changes in its
products or product specifications with the intent to
improve function or design at any time and without
notice and is not required to update this
documentation to reflect such changes.
This publication does not convey to a purchaser of
semiconductor devices described herein any license
under the patent rights of Samsung or others.
Samsung makes no warranty, representation, or
guarantee regarding the suitability of its products for
any particular purpose, nor does Samsung assume
any liability arising out of the application or use of any
product or circuit and specifically disclaims any and
all liability, including without limitation any
consequential or incidental damages.
"Typical" parameters can and do vary in different
applications. All operating parameters, including
"Typicals" must be validated for each customer
application by the customer's technical experts.
Samsung products are not designed, intended, or
authorized for use as components in systems
intended for surgical implant into the body, for other
applications intended to support or sustain life, or for
any other application in which the failure of the
Samsung product could create a situation where
personal injury or death may occur.
Should the Buyer purchase or use a Samsung product
for any such unintended or unauthorized application,
the Buyer shall indemnify and hold Samsung and its
officers, employees, subsidiaries, affiliates, and
distributors harmless against all claims, costs,
damages, expenses, and reasonable attorney fees
arising out of, either directly or indirectly, any claim of
personal injury or death that may be associated with
such unintended or unauthorized use, even if such
claim alleges that Samsung was negligent regarding
the design or manufacture of said product.
any form or by any means, electric or mechanical, by photocopying, recording, or otherwise, without the prior
written consent of Samsung Electronics.
Samsung Electronics' Microprocessor business has been awarded full ISO-14001
certification (BSI Certificate No. FM24653). All semiconductor products are designed
and manufactured in accordance with the highest quality standards and objectives.
Samsung Electronics Co., Ltd.
San #24 Nongseo-Ri, Kiheung-Eup
Yongin-City, Kyunggi-Do, Korea
C.P.O. Box #37, Suwon 449-900
1.2 Features ............................................................................................................................................ 1-2
1.6 Signal Description..............................................................................................................................1-12
1.7 Pad Type...........................................................................................................................................1-26
1.8 Special Registers...............................................................................................................................1-27
2.5 Data Types ........................................................................................................................................2-3
3.2 The Condition Field ........................................................................................................................... 3-4
3.3 Branch and Exchange (BX)............................................................................................................... 3-5
3.5 Data Processing ................................................................................................................................ 3-9
6.2 Features ............................................................................................................................................ 6-1
7.2 Features ............................................................................................................................................ 7-2
7.3 MAC Function Blocks.........................................................................................................................7-3
7.3.1 Media Independent Interface (MII)..........................................................................................7-3
10.2 Features ..........................................................................................................................................10-1
10.3 Console UART Special Registers.....................................................................................................10-3
10.3.1 Console UART Control Registers..........................................................................................10-4
10.3.2 Console UART Status Registers ...........................................................................................10-8
11.2 Features ..........................................................................................................................................11-1
11.3 High-Speed UART Special Registers...............................................................................................11-3
11.3.1 High-Speed UART Control Registers....................................................................................11-4
11.3.2 High-Speed UART Status Registers......................................................................................11-9
12.2 Features ..........................................................................................................................................12-1
12.3 I/O Port Special Register..................................................................................................................12-2
12.3.1 I/O Port Mode Select Register .............................................................................................. 12-2
12.3.2 I/O Port Function Control Register........................................................................................12-4
12.3.3 I/O Port Control Register for GDMA......................................................................................12-7
12.3.4 I/O Port Control Register for External Interrupt .....................................................................12-8
12.3.5 I/O Port External Interrupt Clear Register..............................................................................12-10
12.3.6 I/O Port Data Register ..........................................................................................................12-11
12.3.7 I/O Port Drive Control Register.............................................................................................12-11
15-3 D.C Electric Characteristics....................................................................................15-2
15-4 Operating Frequency ..............................................................................................15-4
15-5 Clock AC timing specification-................................................................................15-4
15-6 AC Electrical Characteristics for S3C2501X............................................................15-5
S3C2501Xxxv
S3C2501XPRODUCT OVERVIEW
1PRODUCT OVERVIEW
1.1 OVERVIEW
Samsung's S3C2501X 16/32-bit RISC microcontroller is a cost-effective, high-performance microcontroller
solution for Ethernet-based systems, for example, SOHO router, internet gateway, WLAN AP, etc.
A variety of communication features are embedded into S3C2501X required in many communication areas,
including two Ethernet MACs, a high speed UART, and a console UART. A security feature is also supported by
DES/3DES accelerator.
This highly integrated microcontroller enables customers to save system costs and increase performance
over other 32-bit microcontroller.
The S3C2501X is built based on an outstanding CPU core: The ARM940T cached processor is a member of the
ARM9 Thumb family of high-performance 32-bit system-on-a-chip processor solutions.
It provides a complete high performance CPU subsystem, including ARM9TDMI RISC integer CPU, 4KB
instruction/data caches, write buffer, and protection unit, with an AMBA bus interface.
The ARM9TDMI core within the ARM940T executes both the 32-bit ARM and 16-bit Thumb instruction sets,
allowing the user to trade off between high performance and high code density.
It is binary compatible with ARM7TDMI, ARM10TDMI, and Strong ARM processors, and is supported by a wide
range of tools, operating systems, and application software.
The following integrated on-chip functions are described in detail in this user's manual :
• ARM940T cached processor
• Ethernet Controller
• GDMA Controller
• UART Controller
• I2C Controller
• Programmable I/O ports
• Interrupt Controller
1-1
PRODUCT OVERVIEW S3C2501X
1.2 FEATURES
ARM940T Core processor
• Fully 16/32-bit RISC architecture.
• Harvard cache architecture with separate 4KB
Instruction and Data cache
• Protection unit to partition memory and set
individual protection attributes for each partition
• AMBA Bus architecture
• Up to 166MHz operating frequency
Memory Controller
• 24-bit External Address Pins
• 2 Banks for SDRAM with 16/32 bit external bus.
• 8 Banks for Flash/ROM/SRAM/External I/O with
8/16/32-bit external bus.
• One External Bus Master with Bus
Request/Acknowledge Pins
Low, PLL output clock is used as the system
clock. If CLKSEL is high, XCLK is used as the
system clock.
HCLKO1Ophbst24System clock output. The internal system
clock is monitored via HCLKO. If SDRAM is
used, this clock should be used SDRAM clock.
CLKSEL1IPhicClock Select for CPU PLL and system PLL.
If CLKSEL is low, CPU PLL clock is used as
ARM940T source clock and system PLL clock
is used system clock source, depending on
CLKMOD[1:0]. If CLKSEL is high, XCLK is
used both clock sources.
BUS_FILTER1Ipoar50_abbPLL filter pin for System PLL.
If the PLL is used, 320pF capacitor should be
connected between the pin and ground.
PHY_FREQ1IPhicPHY clock frequency select for PHY PLL.
0 = 20MHz, 1 = 25MHz
PHY_CLKSEL1IPhicClock Select for PHY PLL
If this pin is set to low, the PHY PLL generates
clock depending on PHY_FREQ state. The
PHY PLL goes into power down mode with
PHY_CLKSEL set to high.
PHY_FILTER1Opoar50_abbPLL filter pin for PHY PLL.
If the PLL is used, 320pF capacitor should be
connected between the pin and ground.
PHY_CLKO1Ophob8PHY clock Out
PHY PLL clock output can be monitored by
PHY_CLKO. This clock is used as the external
phy source clock.
CPU_FILTER1Opoar50_abbPLL filter pin for System PLL.
If the PLL is used, 320pF capacitor should be
connected between the pin and ground.
1-12
S3C2501XPRODUCT OVERVIEW
Table 1-1. S3C2501X Signal Descriptions (Continue)
scheme of S3C2501X. When CLKMOD is “00”,
the nfast clock mode is defined. In this mode,
the same clock is used as CPU clock and
system clock. When CLKMOD is “10”, the
sync mode is defined. In this mode, the system
clock is half frequency of the CPU clock.
When CLKMOD is "11", the async clock mode
is defined. In this mode, the CPU clock and
system clock can operate independently as
long as the CPU clock is faster than system
clock.
CPU_FREQ [2:0]3IphicCPU Clock Frequency Selection.
BUS_FREQ [2:0]3IphicSystem Bus Clock Frequency Selection.
nRESET1IphisNot Reset. NRESET is the global reset input
for the S3C2501X and nRESET must be held
to "low" for at least 64 clock cycles for digital
filtering.
TMODE1IphicdTest Mode. The TMODE pin setting is
interpreted as follows:
0 = normal operating mode
1 = chip test mode.
BIG1IphicdBIG endian mode select pin
When this pin is set to “0”, the S3C2501X
operates in litte endian mode. When this pin is
set to “1”, the S3C2501X operates in big
endian mode.
1-13
PRODUCT OVERVIEW S3C2501X
Table 1-1. S3C2501X Signal Descriptions (Continue)
GroupPin NamePinTypePad TypeDescription
Memory
Interface
(80)
ADDR[23:0]
ADDR[10]/AP
24OPhot20Address bus.
The 24-bit address bus covers the full 16 M
word address range of each ROM/SRAM
/FLASH and external I/O bank.
In the SDRAM interface, ADDR[14:13] is
always used as bank address of SDRAM
devices. If SDRAM devices with 2 internal
bank is used, ADDR[13] should be connected
to the BA of SDRAM. If SDRAM devices with
4 internal bank is used, ADDR[14:13] should
be connected to the BA[1:0] of SDRAM.
ADDR[10]/AP is the auto precharge control
pin. The auto precharge command is issued at
the same time as burst read or burst write by
asserting high on ADDR[10]/AP.
XDATA[31:0]32I/Ophbsut20External bi-directional 32bit data bus.
The S3C2501X supports 8 bit, 16bit, 32bit bus
with ROM/SRAM/Flash/Ext IO bank, but
supports 16 bit or 32 bit bus with SDRAM
bank.
nSDCS[1:0]2Ophot20Not chip select strobe for SDRAM.
Two SDRAM banks are supported.
nSDRAS1Ophot20Not row address strobe for SDRAM.
NSDRAS signal is used for both SDRAM
banks.
nSDCAS1Ophot20Not column address strobe for SDRAM.
NSDCAS signal is used for both SDRAM
banks.
CKE1Ophob12Clock Enable for SDRAM
CKE is clock enable signal for SDRAM.
nSDWE/nWE161Ophot20Not Write Enable for SDRAM or 16 bit
ROM/SRAM.
This signal is always used as write enable of
SDRAM and is used as write enable of only
16-bit ROM/SRAM/Flash.
(That is, It is not enabled for 8 bit Memory)
1-14
S3C2501XPRODUCT OVERVIEW
Table 1-1. S3C2501X Signal Descriptions (Continue)
GroupPin NamePinTypePad TypeDescription
Memory
Interface
(80)
nEWAIT1IphicuNot External wait signal.
This signal is activated when an external I/O
device or ROM/SRAM/Flash banks need more
access cycles than those defined in the
corresponding control register.
select. The S3C2501X supports upt to 8 banks
of ROM/SRAM/Flash/ External I/O. By
controlling the nRCS signals, you can map
CPU address into the physical memory banks.
B0SIZE[1:0]2IphicBank 0 Data Bus Access Size.
Bank0 is used for the boot program. You use
these pins to set the size of the bank 0 data
bus as follows: “01” = Byte, “10” = Half word,
“11” = Word, and “00” = reserved.
nOE1Ophot20Not output enable.
Whenever a memory read access occurs, the
nOE output controls the output enable port of
the specific memory device.
nWBE[3:0]/
nBE[3:0]/
DQM[3:0]
4Ophot20Not write byte enable or DQM for SDRAM
Whenever a memory write access occurs, the
nWBE output controls the write enable port of
the specific memory device. DQM is data
input/output mask signal for SDRAM.
1-15
PRODUCT OVERVIEW S3C2501X
Table 1-1. S3C2501X Signal Descriptions (Continue)
GroupPin NamePinTypePad TypeDescription
Memory
Interface
(80)
XBMREQ1IphicdExternal Master bus request.
An external bus master uses this pin to
request the external bus. When it activates the
XBMREQ, the S3C2501X drives the state of
external bus pins to high impedance. This lets
the external bus master take control of the
external bus. When it has control, the external
bus master assumes responsibity for SDRAM
refresh operation. The XBMREQ is
deactivated when the external bus master
releases the external bus. When this occurs,
the S3C2501X can get the control of the bus
and the XBMACK goes “low”.
XBMACK1Ophob8External bus Acknowledge.
TAP
Control
(5)
TCK1IphicJTAG Test Clock.
The JTAG test clock shifts state information
and test data into, and out of, the S3C2501X
during JTAG test operations.
TMS1IphicuJTAG Test Mode Select.
This pin controls JTAG test operations in the
S3C2501X. This pin is internally connected
pull-up.
TDI1IphicuJTAG Test Data In.
The TDI level is used to serially shift test data
and instructions into the S3C2501X during
JTAG test operations. This pin is internally
connected pull-up.
TDO1Ophot12JTAG Test Data Out.
The TDO level is used to serially shift test
data and instructions out of the S3C2501X
during JTAG test operations.
nTRST1IphicuJTAG Not Reset.
Asynchronous reset of the JTAG logic.
This pin is internally connected pull-up.
1-16
S3C2501XPRODUCT OVERVIEW
Table 1-1. S3C2501X Signal Descriptions (Continue)
GroupPin NamePinTypePad TypeDescription
Ethernet
Controller0
(18)
MDC_01Ophob12Management Data Clock.
The signal level at the MDC pin is used as a
timing reference for data transfers that are
controlled by the MDIO signal.
MDIO_01I/Ophbcut12Management Data I/O.
When a read command is being executed,
data that is clocked out of the PHY is
presented on this pin. When a write command
is being executed, data that is clocked out of
the controller is presented on this pin for the
Physical Layer Entity, PHY.
COL_01IphisCollision Detected/Collision Detected for 10M.
COL is asserted asynchronously with
minimum delay from the start of a collision on
the medium in MII mode. COL_10M is
asserted when a 10-Mbit/s PHY detects a
collision.
TX_CLK_01IphisTransmit Clock/Transmit Clock for 10M.
The controller drives TXD[3:0] and TX_EN
from the rising edge of TX_CLK. In MII mode,
the PHY samples TXD[3:0] and TX_EN on the
rising edge of TX_CLK. For data transfers,
TXCLK_10M is provided by the 10M-bit/s
PHY.
TXD0[3:0]/
TXD_10M/
LOOP_10M
4Ophob12Transmit Data/Transmit Data for 10M.
Transmit data is aligned on nibble boundaries.
TXD[0] corresponds to the first bit to be
transmitted on the physical medium, which is
the LSB of the first byte and the fifth bit of that
byte during the next clock. TXD_10M is
shared with TXD[0] and is a data line for
transmitting to the 10M-bit/s PHY. LOOP_10M
is shared with TXD[1] and is driven by the
loop-back bit in the control register.
1-17
PRODUCT OVERVIEW S3C2501X
Table 1-1. S3C2501X Signal Descriptions (Continue)
GroupPin NamePinTypePad TypeDescription
Ethernet
Controller0
(18)
TX_EN_01Ophob4Transmit Enable/Transmit Enable for 10M.
TX_EN provides precise framing for the data
carried on TXD[3:0]. This pin is active during
the clock periods in which TXD[3:0] contains
valid data to be transmitted from the preamble
stage through CRC. When the controller is
ready to transfer data, it asserts TXEN_10M.
TX_ERR_0/
PCOMP_10M
1Ophob4Transmit Error/Packet Compression Enable
for 10M. TX_ERR is driven synchronously to
TX_CLK and sampled continuously by the
Physical Layer Entity, PHY. If asserted for one
or more TX_CLK periods, TX_ERR causes the
PHY to emit one or more symbols which are
not part of the valid data, or delimiter set
located somewhere in the frame that is being
transmitted. PCOMP_10M is asserted
immediately after the packet’s DA field is
received. PCOMP_10M is used with the
Management Bus of the DP83950 Repeater
Interface Controller (from National
Semiconductor). The MAC can be
programmed to assert PCOMP if there is a
CAM match, or if there is not a match. The
RIC (Repeater Interface Controller) uses this
signal to compress (shorten) the packet
received for management purposes and to
reduce memory usage. (See the DP83950
Data Sheet, published by National
Semiconductor, for details on the RIC
Management Bus.) This pin is controlled by a
special register, with which you can define the
polarity and assertion method (CAM match
active or not match active) of the PCOMP
signal.
1-18
S3C2501XPRODUCT OVERVIEW
Table 1-1. S3C2501X Signal Descriptions (Continue)
GroupPin NamePinTypePad TypeDescription
Ethernet
Controller0
(18)
CRS_01IphisCarrier Sense/Carrier Sense for 10M.
CRS is asserted asynchronously with
minimum delay from the detection of a nonidle medium in MII mode. CRS_10M is
asserted when a 10-Mbit/s PHY has data to
transfer. A 10-Mbit/s transmission also uses
this signal.
RX_CLK_01IphisReceive Clock/Receive Clock for 10M.
RX_CLK is a continuous clock signal. Its
frequency is 25 MHz for 100-Mbit/s operation,
and 2.5 MHz for 10-Mbit/s. RXD[3:0], RX_DV,
and RX_ERR are driven by the PHY off the
falling edge of RX_CLK, and sampled on the
rising edge of RX_CLK. To receive data, the
RXCLK_10 M clock comes from the 10Mbit/s
PHY.
RXD0[3:0]/
RXD_10M
4IphisReceive Data/Receive Data for 10M.
RXD is aligned on nibble boundaries. RXD[0]
corresponds to the first bit received on the
physical medium, which is the LSB of the byte
in one clock period and the fifth bit of that byte
in the next clock. RXD_10M is shared with
RXD[0] and it is a line for receiving data from
the 10-Mbit/s PHY.
RX_DV_0/
LINK_10M
1IphisReceive Data Valid.
PHY asserts RX_DV synchronously, holding it
active during the clock periods in which
RXD[3:0] contains valid data received. PHY
asserts RX_DV no later than the clock period
when it places the first nibble of the start
frame delimiter (SFD) on RXD[3:0]. If PHY
asserts RX_DV prior to the first nibble of the
SFD, then RXD[3:0] carries valid preamble
symbols. LINK_10M is shared with RX_DV
and used to convey the link status of the 10Mbit/s endec. The value is stored in a status
register.
1-19
PRODUCT OVERVIEW S3C2501X
Table 1-1. S3C2501X Signal Descriptions (Continue)
GroupPin NamePinTypePad TypeDescription
Ethernet
Controller0
(18)
RX_ERR_01IphisdReceive Error.
PHY asserts RX_ERR synchronously
whenever it detects a physical medium error
(e.g., a coding violation). PHY asserts
RX_ERR only when it asserts RX_DV.
Ethernet
Controller1
(18)
MDC_11Ophob12Management Data Clock.
The signal level at the MDC pin is used as a
timing reference for data transfers that are
controlled by the MDIO signal.
MDIO_11I/Ophbcut12Management Data I/O.
When a read command is being executed,
data that is clocked out of the PHY is
presented on this pin. When a write command
is being executed, data that is clocked out of
the controller is presented on this pin for the
Physical Layer Entity, PHY.
COL_11IphisCollision Detected/Collision Detected for 10M.
COL is asserted asynchronously with
minimum delay from the start of a collision on
the medium in MII mode. COL_10M is
asserted when a 10-Mbit/s PHY detects a
collision.
TX_CLK_11IphisTransmit Clock/Transmit Clock for 10M.
The controller drives TXD[3:0] and TX_EN
from the rising edge of TX_CLK. In MII mode,
the PHY samples TXD[3:0] and TX_EN on the
rising edge of TX_CLK. For data transfers,
TXCLK_10M is provided by the 10-Mbit/s
PHY.
1-20
S3C2501XPRODUCT OVERVIEW
Table 1-1. S3C2501X Signal Descriptions (Continue)
GroupPin NamePinTypePad TypeDescription
Ethernet
Controller1
(18)
TXD1[3:0]/
TXD_10M/
LOOP_10M
4Ophob12Transmit Data/Transmit Data for 10M.
Transmit data is aligned on nibble boundaries.
TXD[0] corresponds to the first bit to be
transmitted on the physical medium, which is
the LSB of the first byte and the fifth bit of that
byte during the next clock. TXD_10M is
shared with TXD[0] and is a data line for
transmitting to the 10-Mbit/s PHY. LOOP_10M
is shared with TXD[1] and is driven by the
loop-back bit in the control register.
TX_EN_11Ophob4Transmit Enable/Transmit Enable for 10M.
TX_EN provides precise framing for the data
carried on TXD[3:0]. This pin is active during
the clock periods in which TXD[3:0] contains
valid data to be transmitted from the preamble
stage through CRC. When the controller is
ready to transfer data, it asserts TXEN_10M.
1-21
PRODUCT OVERVIEW S3C2501X
Table 1-1. S3C2501X Signal Descriptions (Continue)
GroupPin NamePinTypePad TypeDescription
Ethernet
Controller1
(18)
TX_ERR_1/
PCOMP_10M
1Ophob4Transmit Error/Packet Compression Enable
for 10M.
TX_ERR is driven synchronously to TX_CLK
and sampled continuously by the Physical
Layer Entity, PHY. If asserted for one or more
TX_CLK periods, TX_ERR causes the PHY to
emit one or more symbols which are not part
of the valid data, or delimiter set located
somewhere in the frame that is being
transmitted. PCOMP_10M is asserted
immediately after the packet‘s DA field is
received. PCOMP_10M is used with the
Management Bus of the DP83950 Repeater
Interface Controller (from National
Semiconductor). The MAC can be
programmed to assert PCOMP if there is a
CAM match, or if there is not a match. The
RIC (Repeater Interface Controller) uses this
signal to compress (shorten) the packet
received for management purposes and to
reduce memory usage. (See the DP83950
Data Sheet, published by National
Semiconductor, for details on the RIC
Management Bus.) This pin is controlled by a
special register, with which you can define the
polarity and assertion method (CAM match
active or not match active) of the PCOMP
signal.
CRS_11IphisCarrier Sense/Carrier Sense for 10M.
CRS is asserted asynchronously with
minimum delay from the detection of a nonidle medium in MII mode. CRS_10M is
asserted when a 10-Mbit/s PHY has data to
transfer. A 10-Mbit/s transmission also uses
this signal.
1-22
S3C2501XPRODUCT OVERVIEW
Table 1-1. S3C2501X Signal Descriptions (Continue)
GroupPin NamePinTypePad TypeDescription
Ethernet
Controller1
(18)
RX_CLK_11IphisReceive Clock/Receive Clock for 10M.
RX_CLK is a continuous clock signal. Its
frequency is 25 MHz for 100-Mbit/s operation,
and 2.5 MHz for 10-Mbit/s. RXD[3:0], RX_DV,
and RX_ERR are driven by the PHY off the
falling edge of RX_CLK, and sampled on the
rising edge of RX_CLK. To receive data, the
RXCLK_10 M clock comes from the 10Mbit/s
PHY.
RXD1[3:0]/
RXD_10M
4IphisReceive Data/Receive Data for 10M.
RXD is aligned on nibble boundaries. RXD[0]
corresponds to the first bit received on the
physical medium, which is the LSB of the byte
in one clock period and the fifth bit of that byte
in the next clock. RXD_10M is shared with
RXD[0] and it is a line for receiving data from
the 10-Mbit/s PHY.
RX_DV_1
LINK_10M
1IphisReceive Data Valid.
PHY asserts RX_DV synchronously, holding it
active during the clock periods in which
RXD[3:0] contains valid data received. PHY
asserts RX_DV no later than the clock period
when it places the first nibble of the start
frame delimiter (SFD) on RXD[3:0]. If PHY
asserts RX_DV prior to the first nibble of the
SFD, then RXD[3:0] carries valid preamble
symbols. LINK_10M is shared with RX_DV
and used to convey the link status of the 10Mbit/s endec. The value is stored in a status
register.
RX_ERR_11IphisdReceive Error.
PHY asserts RX_ERR synchronously
whenever it detects a physical medium error
(e.g., a coding violation). PHY asserts
RX_ERR only when it asserts RX_DV.
1-23
PRODUCT OVERVIEW S3C2501X
Table 1-1. S3C2501X Signal Descriptions (Continue)
GroupPin NamePinTypePad TypeDescription
CUART
CURXD1IphisConsole UART Receive Data.
(2)
CUTXD1Ophob8Console UART Transmit Data.
HUART
UCLK1IPhisHUART External Clock
(7)
HURXD/GPIO351I/Ophbst8HUART Receive Data.
HURXD is the HUART input signal for
receiving serial data.
General I/O Port
HUTXD/GPIO361I/Ophbst8HUART Transmit Data.
HUTXD is the HUART output signal for
transmitting serial data.
General I/O Port
HUnDTR/GPIO371I/Ophbst8Not HUART Data Terminal Ready..
This output signals the host (or peripheral) that
HUART is ready to transmit or receive serial
data.
General I/O Port
HUnDSR/GPIO381I/Ophbst8Not HUART Data Set Ready.
This input signals in the HUART that the
peripheral (or host) is ready to transmit or
receive serial data
General I/O Port
HUnRTS/GPIO391I/Ophbst8Not request to send.
This pin output state goes Low or High
according to the transmit data is in Tx buffer
or Tx FIFO when hardware flow control bit
value set to one in HUART control register. If
Tx buffer or Tx FIFO has data to send, this pin
state goes low. If hardware flow control bit is
zero, this pin output can be controlled directly
by HUART control register.
General I/O Port
1-24
S3C2501XPRODUCT OVERVIEW
Table 1-1. S3C2501X Signal Descriptions (Continue)
GroupPin NamePinTypePad TypeDescription
HUART
(7)
HUnCTS/GPIO401I/Ophbst8Not Clear to send
This input pin function controlled by hardware
flow control bit value in HUART control
register. If hardware flow control bit set to one,
HUART can transmit the transmitting data only
when this pin state is active.
General I/O Port
HUnDCD/GPIO411I/Ophbst8Not Data Carrier Detect.
This input pin function is determined by
hardware flow control bit value in HUART
control register. If hardware flow control bit set
to one, HUART can receive the receiving data
only when this pin state is active.
General I/O Port
NOTE: For the detail information about the pad type. Input/Output Cells of the STD130/MDL130 0.18µm 3.3V Standard
Cell Library Data Book” which is produced by Samsung Electronics Co., Ltd, ASIC Team.
1-26
S3C2501XPRODUCT OVERVIEW
1.8 SPECIAL REGISTERS
Table 1-3. S3C2501X System Configuration
RegistersAddressR/WDescriptionReset Value
SYSCFG0xF0000000R/WSystem configuration register–
PDCODE0xF0000004RProduct code and revision number register0x25010000
CLKCON0xF0000008R/WSystem clock control register0x00000000
PCLKDIS0xF000000CR/WPeripheral clock disable register0xF0005000
CLKST0xF0000010RClock Status register
HPRIF0xF0000014R/WAHB bus master fixed priority register0x00543210
HPRIR0xF0000018R/WAHB bus master round-robin priority register0x00000000
CPLL0xF000001CR/WCore PLL Configuration Register0x0001039E
SPLL0xF0000020R/WSystem BUS PLL Configuration Register0x00010370
PPLL0xF0000028R/WPHY PLL Configuration Register0x000103111
Table 1-4. S3C2501X Memory Controller
RegistersAddressR/WDescriptionReset Value
B0CON0xF0010000R/WBank 0 control register0xC514E488
B1CON0xF0010004R/WBank 1 control register0xC514E488
B2CON0xF0010008R/WBank 2 control register0xC514E488
B3CON0xF001000CR/WBank 3 control register0xC514E488
B4CON0xF0010010R/WBank 4 control register0xC514E488
B5CON0xF0010014R/WBank 5 control register0xC514E488
B6CON0xF0010018R/WBank 6 control register0xC514E488
B7CON0xF001001CR/WBank 7 control register0xC514E488
MUXBCON0xF0010020R/WMuxed bus control register0x006DB6DB
WAITCON0xF0010024R/WWait control register0x00000000
0×00000000
DESSTA0xF0090004RDES/3DES status register0x00000231
DESINT0xF0090008R/WDES/3DES interrupt enable register0x00000000
DESRUN0xF009000CWDES/3DES run enable register0x00000000
DESKEY1L0xF0090010R/WKey 1 left half0x00000000
DESKEY1R0xF0090014R/WKey 1 right half0x00000000
DESKEY2L0xF0090018R/WKey 2 left half0x00000000
DESKEY2R0xF009001CR/WKey 2 right half0x00000000
DESKEY3L0xF0090020R/WKey 3 left half0x00000000
DESKEY3R0xF0090024R/WKey 3 right half0x00000000
DESIVL0xF0090028R/WIV left half0x00000000
DESIVR0xF009002CR/WIV right half0x00000000
DESINFIFO0xF0090030WDES/3DES input FIFO0xXXXXXXXX
DESOUTFIFO0xF0090034RDES/3DES output FIFO0xXXXXXXXX
CUCON0xF0060000R/WConsole UART control register0x00000000
CUSTAT0xF0060004R/WConsole UART status register0x00060800
CUINT0xF0060008R/WConsole UART interrupt enable register0x00000000
CUTXBUF0xF006000CWConsole UART transmit data register–
CURXBUF0xF0060010RConsole UART receive data register–
CUBRD0xF0060014R/WConsole UART baud rate divisor register0x0000
CUCHAR10xF0060018R/WConsole UART control character register 10x00000000
CUCHAR20xF006001CR/WConsole UART control character register 20x00000000
Table 1-12. S3C2501X High speed UART Controller
RegisterAddressR/WDescriptionReset Value
HUCON0xF0080000R/WHigh-Speed UART control register0x00000000
HUSTAT0xF0080004R/WHigh-Speed UART status register–
HUINT0xF0080008R/WHigh-Speed UART interrupt enable register0x00000000
HUTXBUF0xF008000CWHigh-Speed UART transmit data register–
HURXBUF0xF0080010RHigh-Speed UART receive data register–
HUBRD0xF0080014R/WHigh-Speed UART baud rate divisor register0x00000000
HUCHAR10xF0080018R/WHigh-Speed UART control character register 10x00000000
HUCHAR20xF008001CR/WHigh-Speed UART control character register 20x00000000
HUABB0xF0080100R/WHigh-Speed UART autobaud boundary register0x1F0F0703
HUABT0xF0080104R/WHigh-Speed UART autobaud table register0x170B0502
1-32
S3C2501XPRODUCT OVERVIEW
Table 1-13. S3C2501X I/O Port Controller
RegisterAddressR/WDescriptionReset Value
IOPMODE10xF0030000R/WI/O port mode select register for port 31 to 00xF003FFFF
IOPMODE20xF0030004R/WI/O port mode select register for port 63 to 320xFFFFFFFF
IOPCON10xF0030008R/WI/O port function control register for port 31 to 00xFFFFFF00
IOPCON20xF003000CR/WI/O port function control register for port 63 to 32 0xFFFFFC07
IOPGDMA0xF0030010R/WI/O port special function register for GDMA0x00000000
IOPEXTINT0xF0030014R/WI/O port special function register for external
0x00000000
interrupt
IOPEXTINTPND0xF0030018R/WI/O port external interrupt clear register0x00000000
IOPDATA10xF003001CR/WI/O port data register for port 31 to 0Undefined
IOPDATA20xF0030020R/WI/O port data register for port 63 to 32Undefined
IOPDRV10xF0030024R/WI/O port drive control register for port 31 to 00x00000000
IOPDRV20xF0030028R/WI/O port drive control register for port 63 to 320x00000000
TMOD0xF0040000R/WTimer mode register0x00000000
TIC0xF0040004R/WTimer Interrupt Clear0x00000000
WDT0xF0040008R/WWatchdog Timer Register0x00000000
TDATA00xF0040010R/WTimer 0 data register0x00000000
TCNT00xF0040014R/WTimer 0 count register0xFFFFFFFF
TDATA10xF0040018R/WTimer 1 data register0x00000000
TCNT10xF004001CR/WTimer 1 count register0xFFFFFFFF
TDATA20xF0040020R/WTimer 2 data register0x00000000
TCNT20xF0040024R/WTimer 2 count register0xFFFFFFFF
TDATA30xF0040028R/WTimer 3 data register0x00000000
TCNT30xF004002CR/WTimer 3 count register0xFFFFFFFF
TDATA40xF0040030R/WTimer 4 data register0x00000000
TCNT40xF0040034R/WTimer 4 count register0xFFFFFFFF
TDATA50xF0040038R/WTimer 5 data register0x00000000
TCNT50xF004003CR/WTimer 5 count register0xFFFFFFFF
1-34
S3C2501XPROGRAMMER'S MODEL
2PROGRAMMER′′S MODEL
2.1 OVERVIEW
S3C2501X was developed using the advanced ARM9TDMI core designed by advanced RISC machines, Ltd.
— Processor Operating States
From the programmer′s point of view, the ARM9TDMI can be in one of two states:
— ARM state which executes 32-bit, word-aligned ARM instructions.
— THUMB state which operates with 16-bit, half-word-aligned THUMB instructions. In this state, the PC uses
bit 1 to select between alternate half-words.
NOTE
Transition between these two states does not affect the processor mode or the contents of the registers.
2.2 SWITCHING STATE
2.2.1 ENTERING THUMB STATE
Entry into THUMB state can be achieved by executing a BX instruction with the state bit (bit 0) set in the operand
register.
Transition to THUMB state will also occur automatically on return from an exception (IRQ, FIQ, UNDEF, ABORT,
SWI etc.), if the exception was entered with the processor in THUMB state.
2.2.2 ENTERING ARM STATE
Entry into ARM state happens:
1. On execution of the BX instruction with the state bit clear in the operand register.
2. On the processor taking an exception (IRQ, FIQ, RESET, UNDEF, ABORT, SWI etc.). In this case, the PC is
placed in the exception mode′s link register, and execution commences at the exception′s vector address.
2-1
PROGRAMMER'S MODELS3C2501X
2.3 MEMORY FORMATS
ARM9TDMI views memory as a linear collection of bytes numbered upwards from zero. Bytes 0 to 3 hold the first
stored word, bytes 4 to 7 the second and so on. ARM9TDMI can treat words in memory as being stored either in
Big-Endian or Little-Endian format.
2.3.1 BIG-ENDIAN FORMAT
In Big-Endian format, the most significant byte of a word is stored at the lowest numbered byte and the least
significant byte at the highest numbered byte. Byte 0 of the memory system is therefore connected to data lines
31 through 24.
Higher Address
Lower Address
31
8
4
0
Most significant byte is at lowest address.
Word is addressed by byte address of most significant byte.
23
241516
9
5
1
10
6
2
870
11
7
3
Word Address
8
4
0
Figure 2-1. Big-Endian Addresses of Bytes within Words
NOTE
The data locations in the external memory are different with Figure 2-1 in the S3C2501X. Please refer to
the chapter 4, system manager.
2.3.2 LITTLE-ENDIAN FORMAT
In Little-Endian format, the lowest numbered byte in a word is considered the word′s least significant byte, and
the highest numbered byte the most significant. Byte 0 of the memory system is therefore connected to data lines
7 through 0.
2-2
Higher Address
Lower Address
3123870
11
7
3
241516
10
6
2
Least significant byte is at lowest address.
Word is addressed by byte address of least significant byte.
9
5
1
8
4
0
Figure 2-2. Little-Endian Addresses of Bytes Words
Word Address
8
4
0
S3C2501XPROGRAMMER'S MODEL
2.4 INSTRUCTION LENGTH
Instructions are either 32 bits long (in ARM state) or 16 bits long (in THUMB state).
2.5 DATA TYPES
ARM9TDMI supports byte (8-bit), half-word (16-bit) and word (32-bit) data types. Words must be aligned to fourbyte boundaries and half words to two-byte boundaries.
2.6 OPERATING MODES
ARM9TDMI supports seven modes of operation:
User (usr): The normal ARM program execution state
FIQ (fiq):Designed to support a data transfer or channel process
IRQ (irq): Used for general-purpose interrupt handling
Supervisor (svc):Protected mode for the operating system
Abort mode (abt):Entered after a data or instruction prefetch abort
System (sys): A privileged user mode for the operating system
Undefined (und): Entered when an undefined instruction is executed
Mode changes may be made under software control, or may be brought about by external interrupts or exception
processing. Most application programs will execute in User mode. The non-user modes known as privileged
modes-are entered in order to service interrupts or exceptions, or to access protected resources.
2-3
PROGRAMMER'S MODELS3C2501X
2.7 REGISTERS
ARM9TDMI has a total of 37 registers-31 general-purpose 32-bit registers and six status registers - but these
cannot all be seen at once. The processor state and operating mode dictate which registers are available to the
programmer.
2.7.1 The ARM State Register Set
In ARM state, 16 general registers and one or two status registers are visible at any one time. In privileged (nonUser) modes, mode-specific banked registers are switched in. Figure 2-3 shows which registers are available in
each mode: the banked registers are marked with a shaded triangle.
The ARM state register set contains 16 directly accessible registers: R0 to R15. All of these except R15 are
general-purpose, and may be used to hold either data or address values. In addition to these, there is a
seventeenth register used to store status information.
Register 14 is used as the subroutine link register. This receives a copy of R15 when a branch
and link (BL) instruction is executed. At all other times it may be treated as a
general-purpose register. The corresponding banked registers R14_svc, R14_irq,
R14_fiq, R14_abt and R14_und are similarly used to hold the return values of
R15 when interrupts and exceptions arise, or when branch and link instructions are
executed within interrupt or exception routines.
Register 15
Register 16
holds the Program Counter (PC). In ARM state, bits [1:0] of R15 are zero and bits
[31:2] contain the PC. In THUMB state, bit [0] is zero and bits [31:1] contain the PC.
is the CPSR (Current Program Status Register). This contains condition code flags
and the current mode bits.
FIQ mode has seven banked registers mapped to R8-14 (R8_fiq-R14_fiq). In ARM state, many FIQ handlers do
not need to save any registers. User, IRQ, Supervisor, Abort and Undefined each have two banked registers
mapped to R13 and R14, allowing each of these modes to have a private stack pointer and link registers.
2.7.2 The THUMB State Register Set
The THUMB state register set is a subset of the ARM state set. The programmer has direct access to eight
general registers, R0–R7, as well as the Program Counter (PC), a stack pointer register (SP), a link register (LR),
and the CPSR. There are banked stack pointers, link registers and Saved Process Status Registers (SPSRs) for
each privileged mode. This is shown in Figure 2-4.
THUMB State General Registers and Program Counter
System & UserFIQSupervisorAboutIRQUndefined
R0
R1
R2
R3
R4
R5
R6
R7
SP
LR
PC
CPSRCPSR
= banked register
R0
R1
R2
R3
R4
R5
R6
R7
SP_fiq
LR_fiq
PC
SPSR_fiq
Figure 2-4. Register Organization in THUMB State
R0
R1
R2
R3
R4
R5
R6
R7
SP_svg
LR_svc
PC
THUMB State Program Status Registers
CPSR
SPSR_svc
R0
R1
R2
R3
R4
R5
R6
R7
SP_abt
LR_abt
PC
CPSR
SPSR_abt
R0
R1
R2
R3
R4
R5
R6
R7
SP_irq
LR_irq
PC
CPSR
SPSR_irq
R0
R1
R2
R3
R4
R5
R6
R7
SP_und
LR_und
PC
CPSR
SPSR_und
2-6
S3C2501XPROGRAMMER'S MODEL
Lo-registersHi-registers
2.7.3 THE RELATIONSHIP BETWEEN ARM AND THUMB STATE REGISTERS
The THUMB state registers relate to the ARM state registers in the following way:
— THUMB state R0–R7 and ARM state R0–R7 are identical
— THUMB state CPSR and SPSRs and ARM state CPSR and SPSRs are identical
— THUMB state SP maps onto ARM state R13
— THUMB state LR maps onto ARM state R14
The THUMB state program counter maps onto the ARM state program counter (R15)
This relationship is shown in Figure 2-5.
THUMB StateARM State
R0
R1
R2
R3
R4
R5
R6
R7
Stack Pointer (SP)
Link Register (LR)
Program Counter (PC)
CPSR
SPSR
R0
R1
R2
R3
R4
R5
R6
R7
R8
R9
R10
R11
R12
Stack Pointer (R13)
Link Register (R14)
Program Counter (R15)
CPSR
SPSR
Figure 2-5. Mapping of THUMB State Registers onto ARM State Registers
2-7
PROGRAMMER'S MODELS3C2501X
2.7.4 ACCESSING HI-REGISTERS IN THUMB STATE
In THUMB state, registers R8–R15 (the Hi registers) are not part of the standard register set. However, the
assembly language programmer has limited access to them, and can use them for fast temporary storage.
A value may be transferred from a register in the range R0–R7 (a Lo register) to a Hi register, and from a Hi
register to a Lo register, using special variants of the MOV instruction. Hi register values can also be compared
against or added to Lo register values with the CMP and ADD instructions. For more information, refer to Figure
3-34.
2.8 THE PROGRAM STATUSREGISTERS
The ARM9TDMI contains a Current Program Status Register (CPSR), plus five Saved Program Status Registers
(SPSRs) for use by exception handlers. These register′s functions are:
— Hold information about the most recently performed ALU operation
— Control the enabling and disabling of interrupts
— Set the processor operating mode
The arrangement of bits is shown in Figure 2-6.
Condition Code Flags(Reserved)
3130292827262524876543210
NZCV......IFTM4M3M2M1M0
Overflow
Carry/Borrow/Extend
Zero
Negative/Less Than
Control Bits
Figure 2-6. Program Status Register Format
Mode bits
State bit
FIQ disable
FRQ disable
2-8
S3C2501XPROGRAMMER'S MODEL
2.8.1 THE CONDITION CODE FLAGS
The N, Z, C and V bits are the condition code flags. These may be changed as a result of arithmetic and logical
operations, and may be tested to determine whether an instruction should be executed.
In ARM state, all instructions may be executed conditionally: see Table 3-2 for details.
In THUMB state, only the branch instruction is capable of conditional execution: see Figure 3-46 for details.
2.8.2 THE CONTROL BITS
The bottom 8 bits of a PSR (incorporating I, F, T and M[4:0]) are known collectively as the control bits. These will
change when an exception arises. If the processor is operating in a privileged mode, they can also be
manipulated by software.
The T bitThis reflects the operating state. When this bit is set, the processor is executing in
THUMB state, otherwise it is executing in ARM state. This is reflected on the TBIT
external signal.
Note that the software must never change the state of the TBIT in the CPSR. If this
happens, the processor will enter an unpredictable state.
Interrupt disable bits
The I and F bits are the interrupt disable bits. When set, these disable the IRQ and
FIQ interrupts respectively.
The mode bits
The M4, M3, M2, M1 and M0 bits (M[4:0]) are the mode bits. These determine the
processor′s operating mode, as shown in Table 2-1. Not all combinations of the
mode bits define a valid processor mode. Only those explicitly described shall be
used. The user should be aware that if any illegal value is programmed into the
mode bits, M[4:0], then the processor will enter an unrecoverable state. If this
occurs, reset should be applied.
2-9
PROGRAMMER'S MODELS3C2501X
Table 2-1. PSR Mode. Bit Values
M[4:0]ModeVisible THUMB State RegistersVisible ARM State Registers
The remaining bits in the PSRs are reserved. When changing a PSR′s flag or
control bits, you must ensure that these unused bits are not altered. Also, your
program should not rely on them containing specific values, since in future
processors they may read as one or zero.
S3C2501XPROGRAMMER'S MODEL
2.9 EXCEPTIONS
Exceptions arise whenever the normal flow of a program has to be halted temporarily, for example to service an
interrupt from a peripheral. Before an exception can be handled, the current processor state must be preserved
so that the original program can resume when the handler routine has finished.
It is possible for several exceptions to arise at the same time. If this happens, they are dealt with in a fixed order.
See Exception Priorities on page 2-15.
2.9.1 ACTION ON ENTERING AN EXCEPTION
When handling an exception, the ARM9TDMI:
1. Preserves the address of the next instruction in the appropriate Link Register. If the exception has been
entered from ARM state, then the address of the next instruction is copied into the Link Register (that is,
current PC + 4 or PC + 8 depending on the exception. See Table 2-2 on for details). If the exception has
been entered from THUMB state, then the value written into the Link Register is the current PC offset by a
value such that the program resumes from the correct place on return from the exception. This means that
the exception handler need not determine which state the exception was entered from. For example, in the
case of SWI, MOVS PC, R14_svc will always return to the next instruction regardless of whether the SWI
was executed in ARM or THUMB state.
2. Copies the CPSR into the appropriate SPSR
3. Forces the CPSR mode bits to a value which depends on the exception
4. Forces the PC to fetch the next instruction from the relevant exception vector
It may also set the interrupt disable flags to prevent otherwise unmanageable nesting of exceptions.
If the processor is in THUMB state when an exception occurs, it will automatically switch into ARM state when the
PC is loaded with the exception vector address.
2.9.2 ACTION ON LEAVING AN EXCEPTION
On completion, the exception handler:
1. Moves the Link Register, minus an offset where appropriate, to the PC. (The offset will vary depending on the
type of exception.)
2. Copies the SPSR back to the CPSR
3. Clears the interrupt disable flags, if they were set on entry
NOTE
An explicit switch back to THUMB state is never needed, since restoring the CPSR from the SPSR
automatically sets the T bit to the value it held immediately prior to the exception.
2-11
PROGRAMMER'S MODELS3C2501X
2.9.3 EXCEPTION ENTRY/EXIT SUMMARY
Table 2-2 summarizes the PC value preserved in the relevant R14 on exception entry, and the recommended
instruction for exiting the exception handler.
1. Where PC is the address of the BL/SWI/Undefined Instruction fetch which had the prefetch abort.
2. Where PC is the address of the instruction which did not get executed since the FIQ or IRQ took priority.
3. Where PC is the address of the Load or Store instruction which generated the data abort.
4. The value saved in R14_svc upon reset is unpredictable.
2.9.4 FIQ
The FIQ (Fast Interrupt Request) exception is designed to support a data transfer or channel process, and in
ARM state has sufficient private registers to remove the need for register saving (thus minimizing the overhead
of context switching).
FIQ is externally generated by taking the nFIQ input LOW. This input can except either synchronous or
asynchronous transitions, depending on the state of the ISYNC input signal. When ISYNC is LOW, nFIQ and
nIRQ are considered asynchronous, and a cycle delay for synchronization is incurred before the interrupt can
affect the processor flow.
Irrespective of whether the exception was entered from ARM or Thumb state, a FIQ handler should leave the
interrupt by executing
SUBS PC,R14_fiq,#4
FIQ may be disabled by setting the CPSR's F flag (but note that this is not possible from User mode). If the F flag
is clear, ARM9TDMI checks for a LOW level on the output of the FIQ synchroniser at the end of each instruction.
2-12
S3C2501XPROGRAMMER'S MODEL
2.9.5 IRQ
The IRQ (Interrupt Request) exception is a normal interrupt caused by a LOW level on the nIRQ input. IRQ has a
lower priority than FIQ and is masked out when a FIQ sequence is entered. It may be disabled at any time by
setting the I bit in the CPSR, though this can only be done from a privileged (non-User) mode.
Irrespective of whether the exception was entered from ARM or Thumb state, an IRQ handler should return from
the interrupt by executing
SUBSPC,R14_irq,#4
2.9.6 ABORT
An abort indicates that the current memory access cannot be completed. It can be signalled by the external
ABORT input. ARM9TDMI checks for the abort exception during memory access cycles.
There are two types of abort:
— Prefetch abort: occurs during an instruction prefetch.
— Data abort: occurs during a data access.
If a prefetch abort occurs, the prefetched instruction is marked as invalid, but the exception will not be taken until
the instruction reaches the head of the pipeline. If the instruction is not executed - for example because a branch
occurs while it is in the pipeline - the abort does not take place.
If a data abort occurs, the action taken depends on the instruction type:
— Single data transfer instructions (LDR, STR) write back modified base registers: the Abort handler must
be aware of this.
— The swap instruction (SWP) is aborted as though it had not been executed.
— Block data transfer instructions (LDM, STM) complete. If write-back is set, the base is updated. If the
instruction would have overwritten the base with data (ie it has the base in the transfer list), the overwriting is
prevented. All register overwriting is prevented after an abort is indicated, which means in particular that R15
(always the last register to be transferred) is preserved in an aborted LDM instruction.
The abort mechanism allows the implementation of a demand paged virtual memory system. In such a system
the processor is allowed to generate arbitrary addresses. When the data at an address is unavailable, the
Memory Management Unit (MMU) signals an abort. The abort handler must then work out the cause of the abort,
make the requested data available, and retry the aborted instruction. The application program needs no
knowledge of the amount of memory available to it, nor is its state in any way affected by the abort.
After fixing the reason for the abort, the handler should execute the following irrespective of the state (ARM or
Thumb):
SUBS PC,R14_abt,#4; for a prefetch abort, or
SUBS PC,R14_abt,#8; for a data abort
This restores both the PC and the CPSR, and retries the aborted instruction.
2-13
PROGRAMMER'S MODELS3C2501X
2.9.7 SOFTWARE INTERRUPT
The software interrupt instruction (SWI) is used for entering Supervisor mode, usually to request a particular
supervisor function. A SWI handler should return by executing the following irrespective of the state (ARM or
Thumb):
MOV PC,R14_svc
This restores the PC and CPSR, and returns to the instruction following the SWI.
NOTE
nFIQ, nIRQ, ISYNC, LOCK, BIGEND, and ABORT pins exist only in the ARM9TDMI CPU core.
2.9.8 UNDEFINED INSTRUCTION
When ARM9TDMI comes across an instruction which it cannot handle, it takes the undefined instruction trap.
This mechanism may be used to extend either the THUMB or ARM instruction set by software emulation.
After emulating the failed instruction, the trap handler should execute the following irrespective of the state (ARM
or Thumb):
MOVS PC,R14_und
This restores the CPSR and returns to the instruction following the undefined instruction.
2.10 EXCEPTION VECTORS
The following table shows the exception vector addresses.
When multiple exceptions arise at the same time, a fixed priority system determines the order in which they are
handled:
Highest priority:
1. Reset
2. Data abort
3. FIQ
4. IRQ
5. Prefetch abort
Lowest priority:
6. Undefined Instruction, Software interrupt.
2.10.2 NOT ALL EXCEPTIONS CAN OCCUR AT ONCE:
Undefined Instruction and Software Interrupt are mutually exclusive, since they each correspond to particular
(non-overlapping) decoding of the current instruction.
If a data abort occurs at the same time as a FIQ, and FIQs are enabled (ie the CPSR's F flag is clear),
ARM9TDMI enters the data abort handler and then immediately proceeds to the FIQ vector. A normal return from
FIQ will cause the data abort handler to resume execution. Placing data abort at a higher priority than FIQ is
necessary to ensure that the transfer error does not escape detection. The time for this exception entry should be
added to worst-case FIQ latency calculations.
2-15
PROGRAMMER′′S MODELS3C2501X
2.11 INTERRUPT LATENCIES
The worst case latency for FIQ, assuming that it is enabled, consists of the longest time the request can take to
pass through the synchroniser (Tsyncmax if asynchronous), plus the time for the longest instruction to complete
(Tldm, the longest instruction is an LDM which loads all the registers including the PC), plus the time for the data
abort entry (Texc), plus the time for FIQ entry (Tfiq). At the end of this time ARM9TDMI will be executing the
instruction at 0x1C.
Tsyncmax is 3 processor cycles, Tldm is 20 cycles, Texc is 3 cycles, and Tfiq is 2 cycles. The total time is
therefore 28 processor cycles. This is just over 1.4 microseconds in a system which uses a continuous 20 MHz
processor clock. The maximum IRQ latency calculation is similar, but must allow for the fact that FIQ has higher
priority and could delay entry into the IRQ handling routine for an arbitrary length of time. The minimum latency
for FIQ or IRQ consists of the shortest time the request can take through the synchroniser (Tsyncmin) plus Tfiq.
This is 4 processor cycles.
2.12 RESET
When the nRESET signal goes LOW, ARM9TDMI abandons the executing instruction and then continues to fetch
instructions from incrementing word addresses.
When nRESET goes HIGH again, ARM9TDMI:
1. Overwrites R14_svc and SPSR_svc by copying the current values of the PC and CPSR into them. The value
of the saved PC and SPSR is not defined.
2. Forces M[4:0] to 10011 (Supervisor mode), sets the I and F bits in the CPSR, and clears the CPSR's T bit.
3. Forces the PC to fetch the next instruction from address 0x00.
4. Execution resumes in ARM state.
2-16
S3C2501XPROGRAMMER′′S MODEL
2.13 INTRODUCTION FOR ARM940T
The ARM940T cached processor macrocell is a member of the ARM9 Thumb Family of high-performance 32-bit
system-on-a-chip processor solutions. It is targeted at a wide range of embedded control applications where high
performance, low system cost, small die size, and low power are key considerations.
The ARM940T processor macrocell provides a complete high performance CPU subsystem, including
ARM9TDMI RISC integer CPU, caches, write buffer, and protection unit, with an AMBA ASB bus interface.
Providing a complete high-frequency CPU subsystem frees the system-on-a-chip designer to concentrate on
design issues unique to their system.
The ARM9TDMI core within the ARM940T macrocell executes both the 32-bit ARM and 16-bit Thumb instruction
sets, allowing the user to trade off between high performance and high code density. It is binary compatible with
ARM7TDMI, ARM10TDMI, and StrongARM processors, and is supported by a wide range of tools, operating
systems, and application software.
The ARM940T processor macrocell is designed to be integrated into larger chips. It supports EmbeddedICE
software and hardware debug and efficient production test when embedded in larger devices. The Advanced
Microcontroller Bus Architecture (AMBA) provides a high performance 32-bit System Bus (ASB) and a low power
peripheral bus (APB). The ASB is re-used to provide a channel for production test vectors with low silicon and pin
overhead. The ASB is a multi-master on-chip bus interface designed specifically to address the needs of systemon-a-chip designs.
The EmbeddedICE software and hardware debug features of the ARM940T macrocell are accessed via a
standard 5-pin JTAG port, and are supported by ARM's Software Development Toolkit and Multi-ICE interface
hardware. The EmbeddedICE features allow software download and debug of the final production system with no
cost overhead (there is no monitor code or other use of target resident RAM or ROM).
The ARM940T processor has a Harvard cache architecture with separate 4KB instruction and 4KB data caches,
each with a 4-word line length. A protection unit allows 8 regions of memory to be defined, each with individual
cache and write buffer configurations and access permissions. The cache system is software configurable to
provide highest average performance or to meet the needs of real-time systems.
Software configurable options include:
• Random or round robin replacement algorithm
• Write-through or write-back cache operation (independently selectable for each memory region)
• Cache locking with granularity 1/64 th of cache size.
Overall, the cache and write buffers improve CPU performance and minimize accesses to the AMBA bus and to
any off-chip memory, thus reducing overall system power consumption.
The ARM940T includes support for coprocessors, allowing a floating point unit or other application specific
hardware acceleration to be added.
To minimize die size and power consumption the ARM940T does not provide virtual to physical address mapping
as this is not required in most embedded applications. For systems requiring virtual memory capability, ARM
provides an alternative product, the ARM920T cached processor macrocell. The ARM940T also features a
TrackingICE mode which allows an approach similar to a conventional ICE mode of operation.
2-17
PROGRAMMER′′S MODELS3C2501X
2.14 ARM940T BLOCK DIAGRAM
CPID[31:0] CPDIN[31:0] CPDOUT[31:0]
ID[31:0]
I Cache
Control
Instruction
Cache
4K
JTAG
Interface[4:0]
IA[31:0]
Coprocessor
Interface
Protection Unit
CP15
ARM9TDMI
Processor Core
(Integral EmbeddedICE)
AMBA Interface
BA[31:0]BcontrolBD[31:0]
DA[31:0]
DD[31:0]
D Cache
Control
Data
Cache
4K
2-18
Figure 2-7. ARM940T Block Diagram
S3C2501XPROGRAMMER′′S MODEL
2.15 ABOUT THE ARM940T PROGRAMMER'S MODEL
The ARM940T cached processor macrocell includes the ARM9TDMI microprocessor core, instruction and data
caches, a write-buffer, and a protection unit for defining the attributes of regions of memory.
The ARM940T incorporates two coprocessors:
• CP14 which allows software access to the debug communications channel
• CP15 which allows configuration of the caches, protection unit, and other system options such as big or little
endian operation.
The ARM940T also features an external coprocessor interface which allows the attachment of a closely coupled
coprocessor on the same chip, for example, a floating point unit.
The programmer's model of the ARM940T consists of the programmer's model of the ARM9TDMI with the
following additions and modifications:
• Memory accesses for instruction fetches and data loads and stores may be cached or buffered. Cache and
write buffer configuration and operation is described in detail in following chapters.
• The registers defined in CP14 are accessible with MCR and MRC instructions.
• The registers defined in CP15 are accessible with MCR and MRC instructions.
• Registers and operations provided by any coprocessors attached to the external coprocessor interface will be
accessible with appropriate coprocessor instructions.
The ARM9TDMI processor core implements ARM Architecture v4T, and so executes the ARM 32-bit instruction
set and the compressed Thumb 16-bit instruction set. The programmer's model is fully described in the ARM
Architecture Reference Manual.
The ARM v4T architecture specifies a small number of implementation options. The options selected in the
ARM9TDMI implementation are listed in Table 2-4. For comparison, the options selected for the ARM9TDMI
implementation are also shown.
Table 2-4. ARM9TDMI Implementation Option
Processor Core ARM
Architecture
ARM7TDMI v4T Base updatd Address of Inst + 12
ARM9TDMI v4T Base restored Address of Inst + 12
The ARM9TDMI is code-compatible with the ARM7TDMI, with two exceptions:
• The ARM9TDMI implements the base restored data abort model, which significantly simplifies the software
data abort handler.
Data Abort Mode Value Stored by Direct
STR, STRT, STM of PC
• The ARM9TDMI fully implements the instruction set extension spaces added to the ARM (32-bit) instruction
set in architecture v4 and v4T.
These differences are explained in more detail below.
2-19
PROGRAMMER′′S MODELS3C2501X
2.15.1 DATA ABORT MODEL
The base restored data abort model differs from the base updated data abort model implemented by ARM7TDMI.
The difference in the data abort model affects only a very small section of operating system code, the data abort
handler. It does not affect user code. With the base restored data abort model, when a data abort exception
occurs during the execution of a memory access instruction, the base register is always restored by the processor
hardware to the value the register contained before the instruction was executed. This removes the need for the
data abort handler to unwind any base register update which may have been specified by the aborted instruction.
The base restored data abort model significantly simplifies the software data abort handler.
2.15.2 INSTRUCTION SET EXTENSION SPACES
All ARM processors implement the undefined instruction space as one of the entry mechanisms for the undefined
instruction exception. That is, ARM instructions with opcode[27:25] = 0b011 and opcode[4] = 1 are undefined on
all ARM processors including the ARM9TDMI and ARM7TDMI.
ARM Architecture v4 and v4T also introduced a number of instruction set extension spaces to the ARM
instruction set. These are:
• Arithmetic instruction extension space
• Control instruction extension space
• Coprocessor instruction extension space
• Load/store instruction extension space.
Instructions in these spaces are undefined (they cause an undefined instruction exception). The ARM9TDMI fully
implements all the instruction set extension spaces defined in ARM Architecture v4T as undefined instructions,
allowing emulation of future instruction set additions.
2-20
S3C2501XPROGRAMMER′′S MODEL
2.16 ARM940T CP15 REGISTERS
2.16.1 CP15 REGISTER MAP SUMMARY
The ARM940T incorporates CP15 for system control. The register map for C15 is shown in Table 2-5.
Table 2-5. CP15 Register Map
RegisterFunctionAccess
0ID code/Cache typeSee note below
1ControlRead/write
2CacheableSee note below
3Write buffer controlRead/write
4ResevedUndefined
5Protection region access permissionsSee note below
6Protection region base/size controlSee note below
7Cache operationsWrite only. Reads unpredictable
8ReservedUndefined
9Cache lockdownRead/write
10-14ReservedUndefined
15TestNot accessed in normal operations
NOTE: Register locations 0, 2, 5, and 6 each provide access to more than one register. The register accessed depends
upon the value of the opcode_2 field. See the register descriptions that follow for further information.
2.16.1.1 Register 0: ID code
This is a read-only register which returns a 32-bit device ID code. The ID code register is accessed by reading
CP15 register 0 with the opcode_2 field set to any value other than 1. For example:
MRC p15, 0, rd, c0, c0,{0,2-7}; returns ID register
The contents of the ID code are shown in Table 2-6.
This is a read-only register which allows operating systems to establish how to perform operations such as cache
cleaning and lockdown. Future ARM cached processors will contain this register, allowing RTOS vendors to
produce future-proof versions of their operating systems.
The cache type register is accessed by reading CP15 register 0 with the opcode_2 field set to 1. For example:
The register contains information about the size and architecture of the caches. The format of the register is
shown in Table 2-7.
Table 2-7. Cache Type Register Format
Register BitsMeaningValue
31:29Reserved000
28:25Cache type0111
24Harvard/Unified1 (defines Harvard cache)
23:21Reserved000
20:18DCache size011 (defines 4KB)
17:15DCache associativity110 (defines 64 way)
14DCache base size0 (defines 1x base parameters)
13:12DCache words per line01 (defines 4 words per line)
11:9Reserved000
8:6ICache size011 (defines 4KB)
5:3ICache Associativity110 (defines 64 way)
2ICache base size0 (defines 1x base parameters)
1:0ICache words per line01 (defines 4 words per line)
2-22
S3C2501XPROGRAMMER′′S MODEL
2.16.1.3 Register 1: Control register
This contains the global control bits of the ARM940T. All reserved bits should either be written with zero or one,
as indicated, or written using read-modify-write. The reserved bits have an unpredictable value when read.
All defined bits in the control registers are set to zero at reset.
Table 2-8. CP15 Register 1
Register BitsFunctions
31Asynchronous clocking select (iA)
30nFastBus select (nF)
29:14Reserved (should be zero)
13Alternate vectors select (V)
12ICache enable bit (1)
11:8Reserved (should be zero)
7Big-end bit (E)
6:3Reserved (should be one)
2DCache enable bit (D)
1Reserved (should be zero)
0Protection unit enable (P)
The bits in the control register have the following functions:
• Bits 31:30 Control the clocking mode of the processor, as shown in Table 2-9. Clocking modes are
• Bit 13 Selects the location of the vector table. During reset, the bit is cleared and the vector
table is located at address 0x00000000. When bit 13 is set, the vector table is relocated
to address 0xffff0000.
• Bits 12 and 2 Enable the caches
• Bit 7 Selects the endian configuration of the ARM940T. Setting bit 7 selects a big-endian
configuration. Clearing bit 7 selects a little-endian configuration. Bit 7 is cleared during
reset.
• Bit 0 Enables the protection unit
2-23
PROGRAMMER′′S MODELS3C2501X
2.16.1.4 Register 2: Instruction and data cacheable registers
This location provides access to two registers which contain the cacheable attributes for each of eight memory
areas. The two registers provide individual control for the I and D address spaces. The opcode_2 field determines
whether the instruction-or data-cacheable attributes are programmed:
If the opcode_2 field = 0, the data-cacheable bits are programmed. For example:
The format for the data and instruction cacheable bits is similar, as shown in Table2-10. Setting a bit makes an
area cacheable, clearing it makes it non-cacheable.
All defined bits in the cacheable registers are set to zero at reset.
Table 2-10. Cacheable Register Format
Register BitsFunctions
7Cacheable bit (C_7) for area 7
6Cacheable bit (C_6) for area 6
5Cacheable bit (C_5) for area 5
4Cacheable bit (C_4) for area 4
3Cacheable bit (C_3) for area 3
2Cacheable bit (C_2) for area 2
1Cacheable bit (C_1) for area 1
0Cacheable bit (C_0) for area 0
2-24
S3C2501XPROGRAMMER′′S MODEL
2.16.1.5 Register 3: Write buffer control register
This register contains a write buffer control (bufferable) attribute bit for each of the eight areas of memory. Each
bit is used in conjunction with the cacheable bit to control write-buffer operation.
Setting a bit makes an area bufferable, clearing a bit makes an area unbuffered. For example:
The opcode_2 field should be 0 because the write buffer only operates on data regions. The following
table, therefore, only applies to the DCache.
All defined bits in the write buffer control register are set to zero at reset.
Table 2-11. Write Buffer Control Register
Register BitsFunctions
7Write buffer control bit (B_d7) for data area 7
6Write buffer control bit (B_d6) for data area 6
5Write buffer control bit (B_d5) for data area 5
4Write buffer control bit (B_d4) for data area 4
3Write buffer control bit (B_d3) for data area 3
2Write buffer control bit (B_d2) for data area 2
1Write buffer control bit (B_d1) for data area 1
0Write buffer control bit (B_d0) for data area 0
2.16.1.6 Register 5: Instruction and data space protection registers
These registers contain the access permission bits for the instruction and data protection regions. The opcode_2
field determines whether the instruction or data access permissions are programmed.
If the opcode_2 field = 0, the data space bits are programmed. For example:
MCR p15,0,Rd,c5,c0,0; Write data space access permissions
MCR p15,0,Rd,c5,c0,0; Read data space access permissions
If the opcode_2 field =1, the instruction space bits are programmed. For example:
MCR p15,0,Rd,c5,c0,1; Write instruction space access permissions
MRC p15,0,Rd,c5,c0,1; Read instruction space access permissions
2-25
PROGRAMMER′′S MODELS3C2501X
Each register contains the access permission bits, apn[1:0], for the eight areas of instruction or data memory, as
shown in Table 2-12.
All defined bits in the protection registers are set to zero at reset.
Table 2-12. Protection Space Register Format
Register BitsFunctions
15:14ap7[1:0] bits of area 7
13:12ap6[1:0] bits of area 6
11:10ap5[1:0] bits of area 5
9:8ap4[1:0] bits of area 4
7:6ap3[1:0] bits of area 3
5:4ap2[1:0] bits of area 2
3:2ap1[1:0] bits of area 1
1:0ap0[1:0] bits of area 0
The values of the Iapn[1:0] and Dapn[1:0] bits define the access permission for each area of memory.
The encoding is shown in Table 2-13.
NOTE
On reset, the values of the Iapn[1:0] and Dapn[1:0] bits for all areas are undefined. However, as on reset,
the protection unit is disabled and all areas are effectively set to no access. The protection space
registers therefore, must be programmed before the protection unit is enabled.
Table 2-13. Permission Encoding
I/Dapn[1:0]Permission
00No access.
01Privileged mode access only.
10Privileged mode full access, user mode read only.
11Full access.
2-26
S3C2501XPROGRAMMER′′S MODEL
2.16.1.7 Register 6: Protection region base and size registers
This register is used to define 16 programmable regions (eight instruction, eight data) in memory. These registers
define the base and size of each of the eight areas of memory. Individual control is provided for the instruction
and data memory regions. The values are ignored when the protection unit is disabled.
On reset, only the region enable bit for each region is reset to 0, all other bits are undefined. At least one
instruction and data memory region must be programmed before the protection unit is enabled.
The opcode_2 field defines whether the data or instruction protection regions are to be programmed. The CRm
field selects the region number.
Table 2-14. CP15 Data Protection Region Registers
ARM instructionProtection region register
MCR/MRC p15, 0, Rd, c6, c7, 0Data memory region 7
MCR/MRC p15, 0, Rd, c6, c6, 0Data memory region 6
MCR/MRC p15, 0, Rd, c6, c5, 0Data memory region 5
MCR/MRC p15, 0, Rd, c6, c4, 0Data memory region 4
MCR/MRC p15, 0, Rd, c6, c3, 0Data memory region 3
MCR/MRC p15, 0, Rd, c6, c2, 0Data memory region 2
MCR/MRC p15, 0, Rd, c6, c1, 0Data memory region 1
MCR/MRC p15, 0, Rd, c6, c0, 0Data memory region 0
Table 2-15. CP15 Instruction Protection Region Registers
ARM instructionProtection region register
MCR/MRC p15, 0, Rd, c6, c7, 1Instruction memory region 7
MCR/MRC p15, 0, Rd, c6, c6, 1Instruction memory region 6
MCR/MRC p15, 0, Rd, c6, c5, 1Instruction memory region 5
MCR/MRC p15, 0, Rd, c6, c4, 1Instruction memory region 4
MCR/MRC p15, 0, Rd, c6, c3, 1Instruction memory region 3
MCR/MRC p15, 0, Rd, c6, c2, 1Instruction memory region 2
MCR/MRC p15, 0, Rd, c6, c1, 1Instruction memory region 1
MCR/MRC p15, 0, Rd, c6, c0, 1Instruction memory region 0
2-27
PROGRAMMER′′S MODELS3C2501X
Each protection region register has the format shown in Table 2-16.
Table 2-16. CP15 Protection Region Register Format
Register bitFunction
31:12Base address
11:6Unused
5:1Area size (See Table2-17)
0Region enable. Reset to disable (0).
The region base must be aligned to an area size boundary, where the area size is defined in its respective
protection region register. The behavior is undefined if this is not the case. Area sizes are given in Table 2-17.
An 8KB size region aligned to the 8KB boundary at 0x00002000 (covering the address range 0x00002000–
0x00003fff) would be programmed to 0x00002019.
2-28
S3C2501XPROGRAMMER′′S MODEL
2.16.1.8 Register 7: Cache operations
A write to this register can be used to perform the following operations:
• Flush ICache and Dcache
• Prefetch an ICache line
• Wait for interrupt
• Drain the write buffer
• Clean and flush the DCache.
The ARM940T uses a subset of the architecture V4 functions (defined in the ARM Architecture Reference
Manual). The available operations are summarized in Table 2-18 and described below.
Table 2-18. Cache Operations Writing to Register 7
ARM instruction Data Protection region register
MCR p15, 0, Rd, c7, c5, 0 should be zero Flush ICache.
MCR p15, 0, Rd, c7, c5, 2 Index/segment Flush ICache single entry.
MCR p15, 0, Rd, c7, c6, 0 should be zero Flush DCache.
MCR p15, 0, Rd, c7, c6, 2 Index/segment Flush DCache single entry.
MCR p15, 0, Rd, c7, c10, 2 Index/segment Clean DCache single entry.
MCR p15, 0, Rd, c7, c13, 1 Address Prefetch ICache line.
MCR p15, 0, Rd, c7, c14, 2 Index/segment Clean and flush DCache single entry.
MCR p15, 0, Rd, c7, c8, 2 should be zero Wait for interrupt.
MCR p15, 0, Rd, c7, c10, 4 should be zero Drain write buffer.
"Should be zero" means the value transferred in the Rd.
A read from this register returns an unpredictable value.
2-29
PROGRAMMER′′S MODELS3C2501X
2.16.1.8.1 Index/Segment Format
Where the required value is an index/segment, the format is:
Table 2-19. CP15 Register 7 Index/Segment Data Format
Rd bit position Function
31:26 Index
25:6 Should be zero
5:4 Segment
3:0 Should be zero
2.16.1.8.2 ICache Prefetch Data Format
For the ICache prefetch operation, the data format is:
Table 2-20. CP15 Register 7 Prefetch Address Format
Rd bit position Function
31:6 Address bits 31:6
5:4 Cache segment
3:0 Should be zero
2.16.1.8.3 Wait for interrupt
This operation allows the ARM940T to be placed in a low-power standby mode. When the operation is invoked,
all clocks in the processor are frozen until either an interrupt or a debug request occurs. This function is invoked
by a write to register 7. The following ARM instruction causes this to occur:
MCR p15, 0, Rd, c7, c0, 4
The following instruction causes the same affect and has been added for backward compatibility with StrongARM
SA-1
MCR p15, 0, Rd, c15, c8, 2
This stalls the processor, with internal clocks held high from the time that this instruction is executed until one of
the signals nFIQ, nIRQ, or EDBGRQ is asserted. Also, if the debugger sets the debug request bit in the
EmbeddedICE unit control register, the wait-for-interrupt condition is terminated.
In the case of nFIQ and nIRQ, the processor is woken up regardless of whether the interrupts are enabled or
disabled (that is, independent of the I and F bits in the processor CPSR). The debug related waking only occurs if
DBGEN is HIGH, that is, only when debug is enabled.
If the interrupts are enabled, the ARM is guaranteed to take the interrupt before executing the instruction after the
wait-for-interrupt. If debug request is used to wake up the system, the processor will enter debug-state before
executing any further instructions.
2-30
S3C2501XPROGRAMMER′′S MODEL
2.16.1.8.4 Drain Write Buffer
This CP15 operation causes instruction execution to be stalled until the write buffer is emptied. This operation is
useful in real time applications where the processor needs to be sure that a write to a peripheral has completed
before program execution continues. An example would be where a peripheral in a bufferable region is the
source of an interrupt. Once the interrupt has been serviced, the request must be removed before interrupts can
be re-enabled. This can be ensured if a drain write buffer operation separates the store to the peripheral and the
enable interrupt functions.
The drain write buffer function is invoked by a write to CP15 register 7 using the following ARM instruction:
MCR p15, 0, Rd, c7, c10, 4
This stalls the processor core, with CPnWAIT asserted until any outstanding accesses in the write buffer have
been completed (that is, until all data has been written to memory).
2.16.1.9 Register 9: Instruction and data lockdown registers
These registers allow regions of the cache to be locked down. The opcode_2 field determines whether the
instruction or data caches are programmed.
• If the opcode_2 field = 0, the data lockdown bits are programmed. For example:
MCR/MRC p15, 0, Rd, c9, c0, 0; data lockdown control
• If the opcode_2 field = 1, the instruction lockdown bits are programmed. For example:
MCR/MRC p15, 0, Rd, c9, c0, 1; instruction lockdown control
The format of the registers, Rd, transferred during this operation, is shown below:
All defined bits in the lockdwon registers are set to zero at reset.
Table 2-21. Lockdown Register Format
Register bitFunction
31Load bit
30:6Reserved
5:0Cache index
NOTE: The segment number is not specified because cache lines are locked down across all four segments
(16-word granularity).
2-31
PROGRAMMER′′S MODELS3C2501X
2.16.1.10 Register 15: Test/debug register
The DTRRobin and ITRRobin bits set the respective caches into a pseudo round-robin replacement mode.
All defined bits in the test registers are set to zero at reset.
Table 2-22. CP15 Register 15
Register bitFunction
31:4Reserved
3ITRRobin
2DTRRobin
1:0Reserved
2.16.1.11 Reserved Registers
Accessing a reserved register is unpredictable.
2-32
S3C2501XINSTRUCTION SET
3INSTRUCTION SET
3.1 INSTRUCTION SET SUMMAY
This chapter describes the ARM instruction set and the THUMB instruction set in the ARM9TDMI core.
Multiply
Cond0 0 0 0 1 U A SRdHiRnLoRn1 0 0 1Rm
Cond0 0 0 1 0 B 0 0RnRdRm0 0 0 0 1 0 0 1
Cond0 0 0 1 0 0 1 0 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0 1Rn
Cond0 0 0 P U 0 W LRnRd0 0 0 0 1 S H 1Rm
Cond0 0 0 P U 1 W LRnRdOffset1 S H 1Offset
Cond0 1 1 P U B W LRnRdOffset
Cond0 1 11
Cond1 0 0 P U S W LRnRegister List
Cond1 0 1 LOffset
Cond1 1 0 P U N W LRnCRdCP#Offset
Cond1 1 1 0CRnCRdCP OpcCP#CP#0CRm
Cond1 1 1 0CRnRdCP Opc LCP#CP#1CRm
Cond1 1 1 1Ignored by processor
Some instruction codes are not defined but do not cause the Undefined instruction trap to be taken, for
instance a Multiply instruction with bit 6 changed to a 1. These instructions should not be used, as their
action may change in future ARM implementations.
3-1
INSTRUCTION SETS3C2501X
3.1.2 INSTRUCTION SUMMARY
Table 3-1. The ARM Instruction Set
MnemonicInstructionAction
ADCAdd with carryRd: = Rn + Op2 + Carry
ADDAddRd: = Rn + Op2
ANDANDRd: = Rn AND Op2
BBranchR15: = address
BICBit clearRd: = Rn AND NOT Op2
BLBranch with linkR14: = R15, R15: = address
BXBranch and exchangeR15: = Rn, T bit: = Rn[0]
CDPCoprocessor data processing(coprocessor-specific)
CMNCompare negativeCPSR flags: = Rn + Op2
CMPCompareCPSR flags: = Rn - Op2
EORExclusive ORRd: = (Rn AND NOT Op2)
MCRMove CPU register to coprocessor registercRn: = rRn {<op>cRm}
MLAMultiply accumulateRd: = (Rm * Rs) + Rn
MOVMove register or constantRd: = Op2
MRCMove from coprocessor register to CPU registerRn: = cRn {<op>cRm}
MRSMove PSR status/flags to registerRn: = PSR
MSRMove register to PSR status/flagsPSR: = Rm
SWPSwap register with memoryRd: = [Rn], [Rn] := Rm
TEQTest bit-wise equalityCPSR flags: = Rn EOR Op2
TSTTest bitsCPSR flags: = Rn AND Op2
3-3
INSTRUCTION SETS3C2501X
3.2 THE CONDITION FIELD
In ARM state, all instructions are conditionally executed according to the state of the CPSR condition codes and
the instruction′s condition field. This field (bits 31:28) determines the circumstances under which an instruction is
to be executed. If the state of the C, N, Z and V flags fulfils the conditions encoded by the field, the instruction is
executed, otherwise it is ignored.
There are sixteen possible conditions, each represented by a two-character suffix that can be appended to the
instruction′s mnemonic. For example, a branch (B in assembly language) becomes BEQ for "Branch if "Equal",
which means the branch will only be taken if the Z flag is set.
In practice, fifteen different conditions may be used: these are listed in Table 3-2. The sixteenth (1111) is
reserved, and must not be used.
In the absence of a suffix, the condition field of most instructions is set to “Always" (suffix AL). This means the
instruction will always be executed regardless of the CPSR condition codes.
Table 3-2. Condition Code Summary
CodeSuffixFlagsMeaning
0000EQZ setEqual
0001NEZ clearNot equal
0010CSC setUnsigned higher or same
0011CCC clearUnsigned lower
0100MIN setNegative
0101PLN clearPositive or zero
0110VSV setOverflow
0111VCV clearNo overflow
1000HIC set and Z clearUnsigned higher
1001LSC clear or Z setUnsigned lower or same
1010GEN equals VGreater or equal
1011LTN not equal to VLess than
1100GTZ clear AND (N equals V)Greater than
1101LEZ set OR (N not equal to V)Less than or equal
1110AL(Ignored)Always
3-4
S3C2501XINSTRUCTION SET
3.3 BRANCH AND EXCHANGE (BX)
This instruction is only executed if the condition is true. The various conditions are defined in Table 3-2.
This instruction performs a branch by copying the contents of a general register, Rn, into the program counter,
PC. The branch causes a pipeline flush and refill from the address specified by Rn. This instruction also permits
the instruction set to be exchanged. When the instruction is executed, the value of Rn[0] determines whether the
instruction stream will be decoded as ARM or THUMB instructions.
31242719158 70
2816111223204 3
CondRn
00 0110 0011 1111 1111 1100 01
[3:0] Operand Register
If bit0 of Rn = 1, subsequent instructions decoded as THUMB instructions
If bit0 of Rn =0, subsequent instructions decoded as ARM instructions
[31:28] Condition Field
Figure 3-2. Branch and Exchange Instructions
3.3.1 INSTRUCTION CYCLE TIMES
The BX instruction takes 2S + 1N cycles to execute, where S and N are defined as sequential (S-cycle) and nonsequential (N-cycle), respectively.
3.3.2 ASSEMBLER SYNTAX
BX - branch and exchange.
BX {cond} Rn
{cond}Two character condition mnemonic. See Table 3-2.
Rnis an expression evaluating to a valid register number.
3.3.3 USING R15 AS AN OPERAND
If R15 is used as an operand, the behaviour is undefined.
; and set bit 0 high - hence
; arrive in THUMB state.
BXR0; Branch and change to THUMB
; state.
CODE16; Assemble subsequent code as
Into_THUMB; THUMB instructions
•
•
•
ADR R5, Back_to_ARM; Generate branch target to word aligned address
; - hence bit 0 is low and so change back to ARM state.
BX R5; Branch and change back to ARM state.
•
•
•
ALIGN; Word align
CODE32; Assemble subsequent code as ARM instructions
Back_to_ARM
3-6
S3C2501XINSTRUCTION SET
3.4 BRANCH AND BRANCH WITH LINK (B, BL)
The instruction is only executed if the condition is true. The various conditions are defined Table 3-2. The
instruction encoding is shown in Figure 3-3, below.
312427
2823
CondOffset
101
25
L
0
[24] Link Bit
0 = Branch1 = Branch with link
[31:28] Condition Field
Figure 3-3. Branch Instructions
Branch instructions contain a signed 2’s complement 24 bit offset. This is shifted left two bits, sign extended to 32
bits, and added to the PC. The instruction can therefore specify a branch of +/- 32Mbytes. The branch offset must
take account of the pre-fetch operation, which causes the PC to be 2 words (8 bytes) ahead of the current
instruction.
3.4.1 THE LINK BIT
Branch with Link (BL) writes the old PC into the link register (R14) of the current bank. The PC value written into
R14 is adjusted to allow for the pre-fetch, and contains the address of the instruction following the branch and link
instruction. Note that the CPSR is not saved with the PC and R14[1:0] are always cleared.
To return from a routine called by branch with link use MOV PC,R14 if the link register is still valid or LDM
Rn!,{..PC} if the link register has been saved onto a stack pointed to by Rn.
3.4.2 INSTRUCTION CYCLE TIMES
Branch and branch with link instructions take 2S + 1N incremental cycles, where S and N are defined as
sequential (S-cycle) and internal (I-cycle).
3-7
INSTRUCTION SETS3C2501X
3.4.3 ASSEMBLER SYNTAX
Items in {} are optional. Items in < > must be present.
B{L}{cond} <expression>
{L} Used to request the branch with link form of the instruction. If absent, R14 will not be
affected by the instruction.
{cond} A two-character mnemonic as shown in Table 3-2. If absent then AL (Always) will be
used.
<expression> The destination. The assembler calculates the offset.
Examples
hereBALhere; Assembles to 0xEAFFFFFE (note effect of PC offset).
Bthere; Always condition used as default.
CMP R1,#0 ; Compare R1 with zero and branch to fred
; if R1 was zero, otherwise continue.
BEQ fred; Continue to next instruction.
BL sub+ROM; Call subroutine at computed address.
ADDS R1,#1; Add 1 to register 1, setting CPSR flags
; on the result then call subroutine if
BLCC sub; the C flag is clear, which will be the
; case unless R1 held 0xFFFFFFFF.
3-8
S3C2501XINSTRUCTION SET
3.5 DATA PROCESSING
The data processing instruction is only executed if the condition is true. The conditions are defined in Table 3-2.
The instruction encoding is shown in Figure 3-4.
3124271915
2816111221
26 25
CondOperand2
00L20OpcodeSRnRd
[15:12] Destination Register
0 = Branch1 = Branch with Link
[19:16] 1st operand Register
0 = Branch1 = Branch with Link
[20] Set condition Codes
0 = Do not after condition codes1 = Set condition codes