EZ4021-FC - LSI Logic Corporation

MiniRISC® EZ4021-FC

EasyMACRO™

Microprocessor

Technical Manual

February 2001

Order No. R14018.A

This document contains proprietary information of LSI Logic Corporation. The

information contained herein is not to be used by or disclosed to third parties

without the express written permission of an ofﬁcer of LSI Logic Corporation.

Document DB15-000163-01, Second Edition (February 2001)

This document describes LSI Logic Corporation’s MiniRISC EZ4021-FC

Microprocessor and will remain the ofﬁcial reference source for all

revisions/releases of this product until rescinded by an update.

LSI Logic Corporation reserves the right to make changes to any products herein

at any time without notice. LSI Logic does not assume any responsibility or

liability arising out of the application or use of any product described herein,

except as expressly agreed to in writing by LSI Logic; nor does the purchase or

use of a product from LSI Logic convey a license under any patent rights,

copyrights, trademark rights, or any other of the intellectual property rights of

LSI Logic or third parties.

TRADEMARK ACKNOWLEDGMENT

The LSI Logic logo design, CoreWare, EasyMACRO, G12, MiniRISC, and

Right-First-Time are registered trademarks or trademarks of LSI Logic

Corporation. All other brand and product names may be trademarks of their

respective companies.

Preface iii

Preface

This book is the primary reference and technical manual for the

EZ4021-FC Subsystem.

Audience

This document assumes that you have some familiarity with

microprocessors and related support devices. The people who beneﬁt

from this book are:

•Engineers and managers who are evaluating the microprocessor for

possible use in a system

•Engineers who are designing the microprocessor into a system

Organization

This document has the following chapters:

•Chapter 1, Introduction, introduces the EZ4021-FC subsystem and

describes its key features.

•Chapter 2, Functional Description, describes the function of the

major blocks within the EZ4021-FC subsystem.

•Chapter 3, Programmer’s Model, describes the memory model and

operating modes of the EZ4021-FC subsystem, and discusses the

EZ4021-FC register set.

•Chapter 4, Instruction Set Architecture, describes the formats and

operation of the EZ4021-FC MIPS instruction set.

•Chapter 5, Signal Descriptions, discusses the function of each

EZ4021-FC interface signal.

iv Preface

•Chapter 6, Interface Operation, provides waveforms to illustrate

various operations of the EZ4021-FC subsystem, including QuickBus

and reset.

•Chapter 7, Error and Exception Handling, describes the events

that cause EZ4021-FC exceptions.

•Chapter 8, Memory Test, describes the cache test capabilities

provided for the instruction cache, data cache, and TLB.

•Chapter 9, Speciﬁcations, lists the AC and electrical parameters for

the EZ4021-FC subsystem.

Related Publications

MiniRISC

EZ4021-FC EasyMACRO Microprocessor Preliminary

Datasheet,

Document No. DB08-000138-00

MIPS RISC Architecture by Gerry Kane and Joe Heinrich,

Prentice-Hall

Conventions Used in This Manual

The ﬁrst time a word or phrase is deﬁned in this manual, it is

italicized.

The word

assert

means to drive a signal true or active. The word

deassert

means to drive a signal false or inactive.

Hexadecimal numbers are indicated by the preﬁx “0x”—for example,

0x32CF. Binary numbers are indicated by the preﬁx “0b”—for example,

0b0011.0010.1100.1111.

Contents v
Contents
Chapter 1 Introduction
1 Overview 1-1
2 Features 1-3
3 Application Examples 1-5
4 CoreWare Program 1-5
Chapter 2 Functional Description
1 EZ4021-FC CPU 2-2
1.1 CPU Data Path Control (CDC) Module 2-3
1.2 Integer Data Path (IDP) Module 2-3
1.3 System Coprocessor 0 (CP0) 2-3
1.4 Pipeline Architecture 2-3
2 Memory Management Unit 2-4
3 Cache Memory 2-5
3.1 Instruction Cache 2-5
3.2 Data Cache 2-7
3.3 Cache Maintenance Operations 2-11
4 Multiply/Divide Unit (MDU) 2-12
4.1 Standard Instructions 2-12
4.2 Extended Instructions 2-12
4.3 Performance 2-12
4.4 Pipeline Interlocks 2-13
5 Quick Bus Interface 2-13
6 Bus Interface Unit (BIU) 2-14
6.1 BIU Features 2-15
6.2 Instruction Cache Reﬁll Summary 2-17
6.3 Data Cache Reﬁll Summary 2-17
6.4 Quick Bus Access Priority 2-17
6.5 Programmable BIU Features 2-18

vi Contents
7 EJTAG Interface 2-18
8 Clocks 2-23
8.1 System Clock 2-23
8.2 EJTAG and Scan Clocks 2-24
8.3 Require External Synchronization to System
Clock 2-24
Chapter 3 Programmer’s Model
1 Memory Management 3-1
1.1 Operating Modes 3-1
1.2 Virtual Memory and the TLB 3-7
1.3 Memory and TLB-Support Registers 3-9
1.4 Virtual Address Translation 3-20
2 Exception Processing 3-22
2.1 Exception Vector Locations 3-23
2.2 CP0 Exception Processing Registers 3-23
3 EJTAG Debugging 3-34
3.1 EJTAG Debug Registers 3-35
3.2 EJTAG Serial-Access Registers 3-35
3.3 EJTAG CP0 Registers 3-49
3.4 EJTAG Memory Mapped Registers 3-57
4 System Conﬁguration Register 1 3-74
Chapter 4 Instruction Set Architecture
1 Instruction Set Formats 4-1
2 Load and Store Instructions 4-2
2.1 Scheduling a Load Delay Slot 4-2
2.2 Deﬁning Access Types 4-3
2.3 CPU Loads and Stores 4-5
2.4 Atomic Update Loads and Stores 4-9
2.5 Coprocessor Loads and Stores 4-9
3 Computational Instructions 4-10
3.1 ALU 4-11
3.2 Three-Operand, Register Type 4-13
3.3 Shift 4-14
3.4 Multiply and Divide 4-16
4 Jump and Branch Instructions 4-19

Contents vii
5 Exception Instructions 4-22
6 Serialization Instruction 4-24
7 Coprocessor Instructions 4-24
7.1 Coprocessor Data Movement and Conditional
Branch Instructions 4-24
7.2 System Control Coprocessor (CP0) Instructions 4-26
8 Cache Maintenance Instruction 4-27
9 EZ4021-FC Instruction Extensions 4-32
9.1 General 32-Bit Instruction Extensions 4-32
9.2 CP0 Instruction Extensions 4-33
10 CPU 32-Bit Instruction Opcode Encoding 4-42
Chapter 5 Signal Descriptions
1 Quick Bus Interface 5-1
2 Interrupt, Clock, and Reset Signals 5-5
3 EJTAG and PC Trace Signals 5-7
3.1 EJTAG Standard Signals 5-7
3.2 EJTAG Standard Support Signals 5-10
3.3 Nonmultiplexed EJTAG Signals 5-10
3.4 EJTAG External Module Signals 5-11
3.5 EJTAG Conﬁguration Signals 5-11
4 Global Test Mode Signals 5-13
5 BIST Signals 5-14
6 Miscellaneous Signals 5-15
Chapter 6 Interface Operation
1 Quick Bus Transactions 6-1
1.1 Basic Transactions 6-1
1.2 Advanced Transactions 6-7
2 Reset Behavior 6-14
2.1 Reset 6-14
2.2 Soft Reset 6-15
2.3 Modules Affected by Reset 6-15
3 Interrupt Behavior 6-17
3.1 Nonmaskable Interrupt 6-17
3.2 Maskable Interrupts 6-18
4 Wait States 6-19

viii Contents
Chapter 7 Error and Exception Handling
1 Overview 7-1
2 Exception Handling Registers 7-5
3 Standard Exception Operation 7-6
4 Standard Exception Processing Actions 7-7
5 Debug Exception Operation 7-8
6 Debug Exception Processing 7-9
7 Precision of Exceptions 7-9
8 Exception Vector Locations 7-10
9 Priority of Exceptions 7-11
9.1 Overriding Priority (Stage Independent) 7-11
9.2 W Stage Exceptions 7-12
9.3 M Stage Exceptions 7-12
9.4 X Stage Exceptions 7-12
9.5 R Stage Exceptions 7-12
10 Exception Descriptions 7-12
10.1 Reset Exception 7-13
10.2 Soft Reset Exception 7-14
10.3 Data Address Break Exception 7-16
10.4 Bus Error Exception 7-17
10.5 Floating-Point Exception 7-18
10.6 TLB Reﬁll Exception 7-19
10.7 TLB Invalid Exception 7-21
10.8 TLB Modiﬁed Exception 7-22
10.9 EJTAG Break Exception 7-23
10.10 Integer Overﬂow Exception 7-24
10.11 Trap Exception 7-25
10.12 Address Error Exception 7-26
10.13 Interrupt Exception 7-27
10.14 Software Debug Breakpoint Exception 7-28
10.15 Coprocessor Unusable Exception 7-29
10.16 System Call Exception 7-30
10.17 Breakpoint Exception 7-31
10.18 Reserved Instruction Exception 7-32
10.19 Debug Single Step Exception 7-33
10.20 Instruction Address Break Exception 7-35
11 Loss of PC Trace Information 7-36
12 Spurious Debug Mode Indications 7-37

Contents ix
Chapter 8 Memory Test
1 I-Cache BIST 8-1
2 D-Cache Test 8-3
2.1 D-Cache Tag/LRU RAMs 8-3
2.2 D-Cache Data RAMs 8-3
3 Register File Test 8-4
4 Translation Lookaside Buffer (TLB) Test 8-4
Chapter 9 Speciﬁcations
1 Physical Speciﬁcations 9-1
2 AC Timing and Loading 9-2
Customer Feedback
Figures 1.1 EZ4021-FC EasyMACRO Microprocessor Block Diagram 1-2
1 EZ4021-FC EasyMACRO Microprocessor
Block Diagram 2-2
2 EZ4021-FC Instruction Pipeline 2-3
3 I-Cache Line State Diagram 2-6
4 Address to I-Cache Tag and Line Number 2-7
5 Write Back Line State Transition Diagram 2-8
6 Write Through Line State Transition Diagram 2-9
7 Address to D-Cache Tag and Line Number 2-10
8 BIU I/O Block Diagram 2-15
9 TAP Controller 2-20
10 On-Chip SCLKP Generation 2-23
11 EZ4021-FC Clock Distribution 2-25
1 User Mode Memory Map 3-3
2 Supervisor Mode Memory Map 3-4
3 Kernel Mode Memory Map 3-5
4 EZ4021-FC Virtual Address Format 3-7
5 EZ4021-FC TLB Entry Format 3-8
6 Index Register (0) 3-10
7 Random Register (1) 3-11
8 EntryLo0/1 Register 3-12

x Contents
9 PageMask Register (5) 3-13
10 Wired Register Location 3-14
11 Wired Register 3-14
12 EntryHi Register (10) 3-15
13 PRId Register (15) 3-16
14 Conﬁg Register (16) 3-17
15 TagLo Register 3-20
16 EZ4021-FC TLB Address Translation Process 3-21
17 Context Register (4) 3-25
18 BadVAddr Register (8) 3-26
19 Count Register (9) 3-26
20 Compare Register (11) 3-27
21 Status Register (12) 3-27
22 Cause Register (13) 3-30
23 EPC Register (14) 3-33
24 ErrorEPC Register (30) 3-34
25 EJTAG Instruction Register (EIR) 3-36
26 EJTAG Bypass Register (EBR) 3-38
27 EJTAG Device Identiﬁcation Register (EDIR) 3-38
28 EJTAG Implementation Register (EIMR) 3-39
29 EJTAG Address Register (EAR) 3-41
30 EJTAG Data Register (EDR) 3-42
31 EJTAG Control Register (ECR) 3-43
32 Byte Lane Signiﬁcance and Dsz Deﬁnition 3-47
33 Debug Register (23) (Debug) 3-50
34 Debug Exception Program Counter (DEPC) Register (24) 3-55
35 Debug Exception Save (DESAVE) Register (31) 3-56
36 Debug Control Register (DCR) 3-60
37 Instruction Address Break Status (IBS) Register 3-62
38 Instruction Address Break n Register (IBAn) 3-64
39 Instruction Address Break Control n Register (IBCn) 3-65
40 Instruction Address Break Mask n Registers (IBMn) 3-66
41 Data Address Break Status Register (DBS) 3-68
42 Data Break Address n Registers (DBAn) 3-69
43 Data Break Control n Registers (DBCn) 3-70
44 Data Address Break Mask n Registers (DBMn) 3-73
45 Data Value Break n Registers (DVBn) 3-74
46 System Conﬁguration Register 1 3-74

Contents xi
1 Instruction Format 4-2
2 Byte Speciﬁcations for Loads/Store 4-4
3 Index Effective Address Format 4-28
1 Four-Doubleword Instruction Request 6-2
2 Instruction Burst Data Return 6-3
3 Single Doubleword Instruction Request and Return 6-4
4 Store Data Write 6-6
5 Store Burst 6-7
6 Quick Bus Slave Ready Operation 6-9
7 Burst Request of a Nonburstable Device 6-10
8 Multiple Requests 6-12
9 Reset Pipeline Behavior 6-14
10 NMI Pipeline Behavior (Detected Immediately) 6-17
11 NMI Pipeline Behavior (Detection Delayed due to Stall) 6-18
12 Interrupt Pipeline Behavior (Detected Immediately) 6-19
13 WAITI Pipeline Stall 6-20
1 Reset Exception 7-7
2 Soft Reset and NMI Exceptions 7-7
3 Common Exceptions 7-8
4 Debug Exceptions 7-9
1 I-Cache with BIST Block Diagram 8-2
1 AC Speciﬁcations 9-2
Tables 2.1 Write Back D-Cache Data Coherency 2-9
2 Write Through D-Cache Data Coherency 2-10
3 Cache Maintenance Operations 2-11
4 Execution Time of Multiply and Divide Instructions 2-13
5 Programmable Features 2-18
1 Exception Addresses 3-23
2 EJTAG Interface Instructions 3-37
3 Memory-Mapped Registers 3-58
1 Normal CPU Load/Store Instructions 4-6
2 Unaligned CPU Load/Store Instructions 4-8
3 Atomic Update CPU Load/Store Instructions 4-9
4 Coprocessor Load/Store Instructions 4-10
5 ALU Instructions with an Immediate Operand 4-12

xii Contents
6 Three-Operand, Register Type Instructions 4-13
7 Shift Instructions 4-15
8 Multiply and Divide Instructions 4-17
9 Execution Time of Multiply and Divide Instructions 4-18
10 Jump Instructions 4-20
11 PC-Relative Conditional Branch Instructions 4-20
12 PC-Relative Conditional Branch Likely Instructions 4-21
13 Breakpoint and System Call Instructions 4-22
14 Trap-on-Condition Instructions 4-23
15 Serialization Instruction 4-24
16 Coprocessor Data Movement and Conditional Branch
Instructions 4-25
17 CP0 Instructions 4-26
18 Cache Maintenance Instruction 4-27
19 Cache Operation Code Deﬁnitions 4-29
20 General Instruction Extensions 4-32
21 CP0 Instruction Extensions 4-33
22 MIPS III Major Opcode Bit Encoding 4-42
23 COPz rs Opcode Bit Encoding 4-43
24 COPz rt Opcode Bit Encoding 4-43
25 REGIMM Opcode rt Bit Encoding 4-43
26 SPECIAL Opcode Bit Encoding 4-44
27 SPECIAL 2 Opcode Bit Encoding 4-44
28 CP0 Opcode Bit Encoding 4-45
1 Reset Sensitivity 6-16
1 EZ4021-FC Standard Exception Summary 7-3
2 CP0 Exception Processing Registers 7-5
3 Current Processor Mode 7-7
4 Standard Exception Vector Base Addresses 7-10
5 Debug Exception Vector Base Addresses 7-11
6 Exception Vector Offset Addresses 7-11
1 EZ4021-FC Physical Layout Size 9-1
2 EZ4021-FC AC Timing Conditions 9-2
3 EZ4021-FC Core Timing Conditions for G12 9-3
4 EZ4021-FC Core Maximum Clock Frequency for AC
Timing 9-3
5 EZ4021-FC Core Input AC Timing (ns) and Loading 9-4
6 EZ4021-FC Core Output AC Timing (ns) and Loading 9-6

MiniRISC EZ4021-FC EasyMACRO Microprocessor 1-1

Chapter 1

Introduction

This chapter introduces the MiniRISC®EZ4021-FC EasyMACRO™

Microprocessor. This chapter contains the following sections:

•Section 1.1, “Overview”

•Section 1.2, “Features”

•Section 1.3, “Application Examples”

•Section 1.4, “CoreWare Program”

1.1 Overview

The MiniRISC EZ4021-FC EasyMACRO microprocessor is a compact,

high-performance, 64-bit microprocessor subsystem implemented in

G12™ CMOS technology. The EZ4021-FC uses LSI Logic CoreWare®

system-on-a-chip methodology and executes the MIPS III instruction set.

It is ideal for high-performance, cost-sensitive, embedded processor

applications. As shown in Figure 1.1, the EZ4021-FC includes the

following components:

•CPU includes a system coprocessor, an integer data path with

multiply divide unit, and a CPU data path controller

•Instruction and data caches

•Memory Management Unit (MMU)

•Bus Interface Unit (BIU)

•Quick Bus interface

•EJTAG Interface module

1-2 Introduction

Figure 1.1 EZ4021-FC EasyMACRO Microprocessor Block

Diagram

The EZ4021-FC CPU is a high-performance, RISC microprocessor that

is a successor to the LSI Logic CW4011 superscalar microprocessor

core. The EZ4021-FC CPU has a single-issue, ﬁve-stage pipeline.

Operating at 250 MHz, the EZ4021-FC provides more than twice the

performance of a CW4011, which operates at 92 MHz.

The I-Cache and D-Cache are both organized as two-way set associative

16-Kbyte caches with ﬁxed cache block (line) sizes of 8 words (32 bytes).

The caches are virtually indexed and physically tagged.

The Quick Bus is a split transaction bus that allows the overlap of

memory requests (fetch/load/store) and data returns. A Quick Bus design

operating at 125 MHz can achieve a peak bandwidth of 1.0 Gbytes/s.

The BIU passes address/data between the CPU and the Quick Bus and

arbitrates CPU-to-Quick Bus access. It provides a 64-bit, incoming data

path from the Quick Bus to the CPU and a 64-bit path for outgoing data.

Depending on the customer design, outgoing Quick Bus data can go to

a variety of destinations outside the EZ4021-FC.

The MMU performs virtual-to-physical address translation using a

32-entry joint translation lookaside buffer (TLB). The MMU supports a

variety of page sizes from 4 Kbytes to 16 Mbytes.

CPU

Coprocessor 0

(CP0)

Integer Data

Path

(IDP)

CPU Data Path

Control

(CDC)

Instruction

Cache

Data

Cache

Caches

Memory

Management Unit

(MMU)

Bus

Interface

Unit

(BIU)

Quick Bus Optional

Modules

EJTAG JTAG

EZ4021-FC

Interface

Instruction

Cache

Controller

Data

Cache

Controller

EasyMACRO

Features 1-3

The EZ4021-FC includes a Joint Test Action Group (JTAG) interface and

supports Enhanced JTAG (EJTAG) functions. EJTAG is a debug feature

of MIPS-based processors. You can use EJTAG to debug stand-alone

processors as well as 32-bit or 64-bit processors that are embedded in

a system like the EZ4021-FC.

The EZ4021-FC complies with these industry standards:

•MIPS III-compatible ISA, 32-bit width instruction code

•EJTAG 1.5.3 – MIPS standard debug support

1.2 Features

This section summarizes key features of the EZ4021-FC:

•High-performance RISC CPU

– Single issue, ﬁve-stage pipeline

– 250 native MIPS, 275 Dhrystone MIPS at 250 MHz

– 250 MHz operation at WCABS (Tj = 125 °C, VDD = 1.71 V, WC

process)

– Both big- and little-endian support for load and store operations

– R4000 standard, 32-bit timer/counter

– MIPS CPU standard interrupt exceptions (one NMI, one timer,

ﬁve hardware, two software)

•Integrated multiply and divide unit

– High-performance, 8-bit/cycle multiplier

◊32-bit, signed/unsigned multiply in 5 CPU clock cycles

◊64-bit, signed/unsigned multiply in 9 CPU clock cycles

– Compact 1 bit/cycle divider

◊32-bit, signed/unsigned divide in 34 CPU clock cycles

◊64-bit, signed/unsigned divide in 66 CPU clock cycles

•Windows CE-compatible MMU with 32 dual-entry page translations

•Integrated instruction and data caches

– Harvard architecture

1-4 Introduction

– 16 Kbytes, 2-way, set-associative instruction and data caches

◊LRU algorithm for replacement

◊Line level lock for instruction RAM and scratch-pad memory

◊Data cache has write-through or write-back update policy,

programmable on a page basis

•MIPS III Instruction Set Architecture

– MIPS III ISA supporting 64-bit integer operations

– Thirty-two 64-bit, general-purpose registers

– R4000-style status register and exception processing

– Wait for Interrupt (WAITI) instruction for power saving

– Supports SPECIAL2 Multiply-Accumulate extensions

•Advanced Debug Support

– MIPS EJTAG 1.5.3

– Instruction and data breakpoints

– Program Counter (PC) trace

– Processor single step and software debug breakpoints

•Technology

– 2.6 mW/MHz power consumption (includes caches)

–12mm

2core size

– 1.8 V Core VDD

– LSI Logic G12 CMOS technology (0.18 µL-drawn, 0.15 µ

L-effective)

Application Examples 1-5

1.3 Application Examples

The following list contains several applications that are ideal for the

EZ4021-FC microprocessor subsystem:

•Laser beam and multifunction printers

•Multifunction peripherals for ofﬁce automation

•Network controllers

This list is not complete; there are many other high-performance

applications that would beneﬁt from the power and ﬂexibility of the

EZ4021-FC.

1.4 CoreWare Program

The CoreWare program consists of three main elements:

•A library of cores

•A design development and simulation package

•Expert applications support

The CoreWare library contains a wide range of complex cores based on

accepted and emerging industry standards from high-speed interconnect

and digital video to DSP and MIPS microprocessors. LSI Logic provides

a complete framework for device and system development and

simulation. LSI Logic has advanced ASIC technologies that consistently

produce Right-First-Time™ silicon. LSI Logic in-house experts provide

design support from system architecture deﬁnition through chip layout

and test vector generation.

1-6 Introduction

MiniRISC EZ4021-FC EasyMACRO Microprocessor 2-1
Chapter 2
Functional Description
This chapter describes the major functional blocks of the EZ4021-FC. It
contains the following sections:
•Section 2.1, “EZ4021-FC CPU”
•Section 2.2, “Memory Management Unit”
•Section 2.3, “Cache Memory”
•Section 2.4, “Multiply/Divide Unit (MDU)”
•Section 2.5, “Quick Bus Interface”
•Section 2.6, “Bus Interface Unit (BIU)”
•Section 2.7, “EJTAG Interface”
•Section 2.8, “Clocks”
Figure 2.1 is a simpliﬁed block diagram of the EZ4021-FC.

2-2 Functional Description

Figure 2.1 EZ4021-FC EasyMACRO Microprocessor

Block Diagram

2.1 EZ4021-FC CPU

The EZ4021-FC CPU includes the:

•CPU Data Path Control (CDC) module

•Integer Data Path (IDP) module

•System Coprocessor 0 (CP0)

CPU

I-Cache Controller

|-Cache Tag, I-Cache Data

Integer

D-Cache Controller

D-Cache Tag, D-Cache Data

BIU

EZ4021-FC EasyMACRO Core

CP0

QuickBus

MMU

EJTAG

Interface

(16 Kbytes, 2-way)

Data Path Data Path

Control

EZ4021-FC CPU 2-3

2.1.1 CPU Data Path Control (CDC) Module

The CDC decodes instructions and controls the data path using control

signals and clock gating.

2.1.2 Integer Data Path (IDP) Module

The IDP includes a 64-bit data path, a 32 x 64-bit register ﬁle, and an

integrated Multiply/Divide Unit (MDU). The MDU supports:

•Accumulate operations (MADD, MADDU, MSUB, and MSUBU) and

3-operand multiply (MUL).

•8 bits/cycle multiply capability and 1 bit/cycle divide capability.

2.1.3 System Coprocessor 0 (CP0)

CP0 provides exception processing support to the CPU using the MIPS

R4000 exception model. It also provides processor state control that

includes kernel, user, and supervisor modes. In addition, CP0 has a

debugging capability with support for a software debug breakpoint

(SDBBP) instruction and single-step debugging.

2.1.4 Pipeline Architecture

The EZ4021-FC’s ﬁve-stage instruction pipeline is illustrated in

Figure 2.2.

Figure 2.2 EZ4021-FC Instruction Pipeline

Instruction Fetch Instruction Execution

XMR

2-4 Functional Description

Instruction fetch occurs during the ﬁrst two pipeline stages and

instruction execution during the last three stages. After a stage accepts

an instruction from the previous stage, it must hold the instruction for

re-execution in case the pipeline stalls. The function of each pipeline

stage is summarized below.

Instruction Fetch (F) – The EZ4021-FC fetches the instruction during

this ﬁrst stage.

operands from the Register ﬁle while decoding the instruction.

Execute (X) – Computational and logical instructions execute during the

X stage. The CPU resolves conditional branches during this stage, and

does the address calculations for load and store instructions.

Memory Access (M) – In this stage, the CPU accesses the cache for

load and store instructions. Data returns to the register bypass logic at

the end of the M stage.

Write-Back (W) – The CPU writes results into the Register ﬁle in the W

stage.

2.2 Memory Management Unit

The memory management unit (MMU) performs virtual-to-physical

address translation using a 32-entry joint translation lookaside buffer

(TLB). The MMU supports a variety of page sizes from 4 Kbytes to

16 Mbytes. To improve performance, the EZ4021-FC also includes two

4-entry micro-TLBs that reside between the MMU and the TLB. The

micro-TLBs serve a cache-like function for the larger 32-entry TLB, and

provide data and instruction cache address translation for the four most

recently used pages.

Cache Memory 2-5

2.3 Cache Memory

The EZ4021-FC has separate primary caches for instructions and data,

the I-Cache and D-Cache.

2.3.1 Instruction Cache

The I-Cache has these features:

•Two-way, set associative 16 Kbyte cache with a ﬁxed cache block

(line) size of 8 words (32 bytes).

•Virtually indexed and physically tagged.

•Least Recently Used (LRU) cache line replacement algorithm. When

a cacheable instruction fetch misses in the primary cache, an entire

cache line is reﬁlled from external memory starting with the missed

word.

•Instruction forwarding to the CPU to reduce external memory fetch

latency.

•Individual I-Cache line locking to prevent removal from the cache

•Individual valid bit for each cache line

2.3.1.1 I-Cache Line States

The I-Cache maintains state information on a line basis and supports

three line states: Invalid, Valid Clean, and Locked. At initialization, set all

I-Cache lines to the Invalid/Unlocked state using the CACHE Index Store

Tag instruction. For a description of cache operations, see

Section 4.8, “Cache Maintenance Instruction,” on page 4-27.

The I-Cache line state transitions from the Invalid to the Valid Clean state

if either of the following conditions occurs:

•A cacheable CPU instruction fetch misses in the I-Cache. Upon

return of valid data from system memory, the I-Cache line is updated

and set valid. This operation is referred to as a Fetch-Miss Reﬁll.

•A CACHE operation (Fill, Fetch and Lock, Store Tag with

TagLo bit [7] = 1) occurs.

2-6 Functional Description

The I-Cache line state transitions from the Valid Clean to Invalid state if

either of the following conditions occurs:

•A CACHE operation (Invalidate, Store Tag with TagLo bit [7] = 0).

•A Fetch-Miss Reﬁll with data error.

The V (valid) bit of each cache line indicates its state. V = 0 is Invalid

and V = 1 is Valid Clean. Figure 2.3 shows the state transition diagram

for I-Cache line states.

Figure 2.3 I-Cache Line State Diagram

The line locked bit can modify the behavior illustrated in Figure 2.3.

When this bit is set to 1 in an I-Cache Tag entry, the corresponding

I-Cache line is locked in its current state (Invalid or Valid Clean) and

cannot be displaced from the I-Cache by normal cache block

replacement activity. However, a CACHE Invalidate operation can clear

the lock bit. Refer to Section 4.8, “Cache Maintenance Instruction,” on

page 4-27 for more information on how to set or clear the locked state.

Note: Having the same index locked in both I-Cache sets is not

recommended. However, doing so does not prevent proper

operation of the EZ4021-FC.

2.3.1.2 Instruction Address and I-Cache Access

The address ﬁelds shown in Figure 2.4 illustrate the relationship between

an instruction address and its cache memory location. The MMU

translates the I-Cache Tag ID, address bits [31:13], and compares it with

the physical address bits contained within each I-Cache set Tag RAM to

determine which set, if any, contains the desired fetch data. The Line

Index ﬁeld, bits [12:5], addresses a line in each cache memory set, and

the Word Offset ﬁeld, bits [4:2], addresses a word within a line. Address

bits [1:0] are reserved.

Valid

Clean

Invalid Fetch-Miss Reﬁll, CACHE (Fill, Store Tag)

CACHE (Invalidate, Store Tag),

Fetch-Hit,

Fetch-Miss

Reﬁll

Fetch-Miss Reﬁll Error

Fetch-Miss

Reﬁll Error

Cache Memory 2-7

Figure 2.4 Address to I-Cache Tag and Line Number

As stated previously, the cache RAMs are indexed by the virtual address

and tagged using the translated physical address. Because the cache set

size is 8 Kbytes and the minimum MMU page size is 4 Kbytes, address

bit 12 of the virtual and physical address must be coincident for proper

cache operation.

2.3.1.3 Instruction RAM Mode

Individual I-Cache lines can be locked to prevent their replacement. This

feature provides a convenient means for setting up portions of the

I-Cache as instruction RAM.

Cache blocks can be ﬁlled and locked using the CACHE Fetch and Lock

command. For more information on this command, refer to Section 4.8,

“Cache Maintenance Instruction,” on page 4-27.

2.3.2 Data Cache

The D-Cache has these features:

•Two-way set associative 16 Kbyte cache with a ﬁxed cache block

(line) size of 8 words (32 bytes).

•Virtually indexed and physically tagged.

•Least Recently Used (LRU) cache line replacement algorithm. When

a cacheable data access misses in the primary cache, an entire

cache line is reﬁlled from external memory starting with the missed

doubleword.

•Load data forwarding to the CPU to reduce load-miss latency.

•Individual D-Cache line locking to prevent removal from the cache.

•Individual valid bit for each cache line.

•Both write-back and write-through update policies. The MMU

controls the update policy on a page basis. D-Cache does not

support store-allocate (store miss) operations.

31 13 12 5 4 2 1 0

I-Cache Tag ID Line Index Word Offset R

2-8 Functional Description

2.3.2.1 D-Cache Line States (Write-Back mode)

The Write-Back D-Cache implements four cache line states: Invalid, Valid

Clean, Dirty Exclusive, and Locked. The valid, dirty, and locked

information are maintained on a line basis. Figure 2.5 shows the line

state transition diagram for Write-Back D-Cache operations.

Figure 2.5 Write-Back Line State Transition Diagram

A store operation is considered a D-Cache hit when the Tag matches the

physical address and the valid (V) bit is set. The physical address must

be in a cached area.

When a Store-Miss occurs, the state condition of the cache line is not

changed, and the store data is not written into D-Cache. Instead, the

store data is sent to the BIU, which passes it to the system main

memory.

The line locked (LL) bit can modify the behavior illustrated in Figure 2.5.

When this bit is set to 1 in a D-Cache Tag entry, the corresponding

D-Cache line is locked in its current state (Invalid, Valid Clean, Dirty

Exclusive) and cannot be displaced from the D-Cache by normal cache

block replacement activity. However, a CACHE Invalidate operation can

clear the lock bit. For more information on how to set or clear the locked

state, see Section 4.8, “Cache Maintenance Instruction,” on page 4-27.

Valid

Clean

Load-Miss Reﬁll,

Load-Hit

Load-Miss

CACHE (Invalidate, Store Tag),

Store-Hit

Load-Miss Write-Back and Reﬁll

Dirty

Exclusive

Invalid

Load-Hit,

Store-Hit

Load-Miss

Reﬁll Error

Reﬁll

Snoop Invalidate (Match)

CACHE (Hit Write-Back)

Cache Memory 2-9

Note: Having the same index locked in both D-Cache sets is not

recommended. However, doing so does not prevent proper

operation of the EZ4021-FC.

2.3.2.2 D-Cache Line States (Write-Through Mode)

The Write-Through D-Cache implements three cache line states: invalid,

valid clean, and locked. The valid, dirty, and locked information is

maintained on a line basis. Figure 2.6 shows the line state transition

diagram for Write-Through D-Cache operations.

Figure 2.6 Write-Through Line State Transition Diagram

A store operation is considered a D-Cache hit when the tag matches the

physical address and the valid (V) bit is set. The physical address must

be in a cached area.

When a Store-Miss occurs, the state condition of the cache line is not

changed, and the store data is not written into D-Cache. Instead, the

store data is sent to the BIU, which passes it to the system main

memory.

Table 2.1 Write-Back D-Cache Data Coherency

State V Bit D1Bit

1. The Dirty bit is maintained in the LRU RAM.

Condition

Invalid 0 X Cached line does not contain valid information.

Valid Clean 1 0 Cached line contains valid information

consistent with memory.

Dirty

Exclusive 1 1 Cached line contains valid information that may

not be consistent with memory.

Valid

Clean

Invalid Load-Miss Reﬁll

CACHE (Invalidate, Store Tag),

Snoop Invalidate (Match),

Load-Miss

Reﬁll Error

Load-Miss Reﬁll Error Load-Miss Reﬁll,

Load-Hit,

Store-Hit

2-10 Functional Description

The line locked (LL) bit can modify the behavior illustrated in Figure 2.6.

When this bit is set to 1 in a D-Cache tag entry, the corresponding

D-Cache line is locked in its current state (Invalid, Valid Clean) and

cannot be displaced from the D-Cache by normal cache block

replacement activity. However, a CACHE Invalidate operation can clear

the lock bit. For more information on how to set or clear the locked state,

refer to Section 4.8, “Cache Maintenance Instruction,” on page 4-27.

Note: Having the same index locked in both D-Cache sets is not

recommended. However, doing so does not prevent proper

operation of the EZ4021-FC.

2.3.2.3 Data Address and D-Cache Access

The address ﬁelds in Figure 2.7 illustrate the relationship between a data

access address and a cache memory location. The MMU translates the

D-Cache Tag ID, bits [31:13], and compares it with the physical address

bits contained within each D-Cache set Tag RAM to determine which set,

if any, contains the desired load data. The Line Index ﬁeld, bits [12:5],

addresses a line in each cache memory set, and the Byte Offset ﬁeld,

bits [4:0], addresses a byte within a line.

Figure 2.7 Address to D-Cache Tag and Line Number

Table 2.2 Write-Through D-Cache Data Coherency

State V Bit D1Bit

1. The Dirty bit is maintained in the LRU RAM.

Condition

Invalid 0 X Cached line does not contain valid

information.

Valid

Clean 1 0 Cached line contains valid information

consistent with memory.

31 13 12 5 4 0

D-Cache Tag ID Line Index Byte Offset

Cache Memory 2-11

As stated previously, the cache RAMs are indexed by the data virtual

address and tagged using the translated physical address. Because the

cache set size is 8 Kbytes and the minimum page size is 4 Kbytes,

address bit 12 of the virtual and physical addresses must be coincident

for proper cache operation.

2.3.2.4 Scratch-Pad RAM Mode

Individual D-Cache lines can be locked to prevent their replacement. This

feature provides a convenient way to set up part of the D-Cache as

scratch-pad RAM.

Entries can be locked using the CACHE Load and Lock command or a

combination of CACHE Creative Exclusive Dirty and Index Store Tag

operations. For more information on these commands, refer to

Section 4.8, “Cache Maintenance Instruction,” on page 4-27.

2.3.3 Cache Maintenance Operations

The EZ4021-FC supports several different cache maintenance

operations. All maintenance operations are supported using the CACHE

instruction as described in Section 4.8, “Cache Maintenance Instruction,”

on page 4-27.Table 2.3 highlights the maintenance operations supported

for both instruction and data caches.

Table 2.3 Cache Maintenance Operations

Maintenance

Operation CACHE Operation I-Cache

Support D-Cache

Support

Reset Store Tag Yes Yes

Invalidate Index Invalidate Yes No

Index Write-Back with Invalidate No Yes

Hit Invalidate Yes Yes

Write-Back Index Write-Back with Invalidate No Yes

Hit Write-Back No Yes

Hit Write-Back with Invalidate No Yes

2-12 Functional Description

2.4 Multiply/Divide Unit (MDU)

This section describes the MDU’s instructions and performance. It also

summarizes the types of pipeline interlocks the MDU can generate.

2.4.1 Standard Instructions

The EZ4021-FC implements the standard MIPS III multiply and divide

instructions, which includes instructions for both single and doubleword

operands as well as signed and unsigned values. Table 4.8 (page 4-17)

lists and brieﬂy describes each one of the MIPS III multiply and divide

instructions.

In addition to the multiply and divide instructions, the MDU also supports

the special data movement instructions: MTHI, MTLO, MFHI, and MFLO.

2.4.2 Extended Instructions

The EZ4021-FC MDU implements ﬁve extended instructions: MADD,

MADDU, MUL, MSUB, and MSUBU. The ﬁrst two instructions are signed

and unsigned, 32-bit, multiply-add instructions. The MUL instruction is a

three-operand, 32-bit, signed multiply that places the sign-extended,

least-signiﬁcant 32 bits of its result directly into the general-purpose

unsigned, 32-bit, multiply-subtract instructions.

For a description of these instructions, refer to Section 4.9.1, “General

32-Bit Instruction Extensions,” on page 4-32.

2.4.3 Performance

The performance of the MDU varies based on the type of operation and

the size of the operands.

Divide operations are processed at 1 bit/cycle. A 32-bit divide operation

takes 34 cycles to complete. A 64-bit divide operation takes

66 cycles until the results are posted in the special HI and LO registers.

Quick Bus Interface 2-13

Multiply operations are processed at a rate of 8 bits/cycle. A 32-bit

multiply operation takes a maximum of 6 cycles to complete. A 64-bit

multiply operation takes a maximum of 10 cycles until the results are

posted in the HI and LO registers.

Table 2.4 compares the MDU performance in cycles with that of other

MIPS RISC processors.

2.4.4 Pipeline Interlocks

The MDU generates three classes of hardware pipeline interlocks:

•An MFHI or MFLO instruction that follows a multiply or divide

operation (not including MUL) stalls in the X stage until the operation

completes and the HI and LO registers are updated with the ﬁnal

result.

•A multiply or divide instruction that ﬁnds the MDU busy in the

R stage stalls until the prior MDU operation is completed.

•The MUL instruction stalls the pipeline in the X stage the entire time

the MDU is processing the multiply. After the operation completes,

hardware removes the interlock, and the ﬁnal result passes to the

M stage for posting in the general-purpose register ﬁle.

2.5 Quick Bus Interface

The EZ4021-FC interface supports a new high-performance, on-chip bus

known as Quick Bus. The Quick Bus is a split transaction bus that allows

the overlap of memory requests (fetch/load/store) and data returns. A

Quick Bus design operating at 125 MHz can achieve a peak bandwidth

of 1.0 Gbytes/s.

Table 2.4 Execution Time of Multiply and Divide Instructions

Operation

32 Bit 64 Bit

R3000 CW33300 R4FC000 EZ4021-FC R4000 EZ4021-FC

Multiply 12 1 + (Bits/3) 10 5/6 20 9/10

Divide 34 34 69 34 133 66

2-14 Functional Description

The Quick Bus has the following features:

•Latency of main memory and other off-chip devices is hidden

•Split transaction operation with minimal latency from cache-miss to

Quick Bus request

•Independent interfaces that allow command request and read-return

operations to overlap

•Flexible cycle-by-cycle bus arbitration that you can customize for

each application

•Support for multiple bus masters using a 4-bit identiﬁer

•Support for burst transactions with bus locking

•Simple priority encoding that you can modify to support more

complex customer needs

2.6 Bus Interface Unit (BIU)

The Bus Interface Unit (BIU) passes addresses and data between the

CPU and the Quick Bus. The BIU arbitrates CPU-to-Quick Bus access

and Quick Bus response to the CPU. It provides a 64-bit, incoming data

path from the Quick Bus to the CPU and a 64-bit path for outgoing data.

Depending on the customer design, outgoing data can go to a variety of

destinations outside the EZ4021-FC. All the memory devices or their

controllers are connected to the Quick Bus.

Figure 2.8 shows the major BIU interfaces.

Bus Interface Unit (BIU) 2-15

Figure 2.8 BIU I/O Block Diagram

2.6.1 BIU Features

The BIU includes these key features:

•Four-doubleword bursts

•Eight-doubleword write buffers

•Speculative instruction fetching (prefetching)

•Bus Snooping

•Optional Read Priority over Write

2.6.1.1 Four Doubleword Bursts – Instruction Fetch and Data

The BIU services all cacheable read requests from the CPU by returning

four doublewords. From the CPU perspective, a 4-doubleword burst is

fetched for each cache miss. However, the BIU is not always granted a

burst transaction on the Quick Bus, especially if the device it is accessing

does not support bursting. In this case, the BIU generates four individual

doubleword read requests.

2.6.1.2 Eight Doubleword Write Buffer

The BIU contains an 8-doubleword write buffer for data queuing. Data is

output to the Quick Bus when there are no pending instruction fetch or

data read requests. Each write buffer entry is composed of data

32-Bit Quick Bus Addr

64-Bit Quick Bus Data

BIU Quick Bus

EZ4021-FC

32-Bit Quick Bus Addr

(Snooping)

EasyMACRO

Core

2-16 Functional Description

(64 bits), address (32 bits), and byte enables (8 bits). To disable the write

buffer, deassert the EZ4021-FC input pin WRITEBUF_ENABLEP. By

disabling the write buffer, the number of entries goes from 8 doublewords

to 1 doubleword. The CPU will stall if another store is executed before

the previous store is output on the Quick Bus.

Normally, write requests are the lowest priority, except when the CPU

issues a load and there is a partial address match (bits 5–7) with one of

the entries in the writer buffer. In this case, the load request is held

pending until the write buffer is ﬂushed (emptied) to the entry where its

address (partially) matches the pending load.

2.6.1.3 Speculative Instruction Fetching (Prefetching)

For instruction cache reﬁlls, the BIU issues a read request for the missed

word’s cache line and a speculative read request for the subsequent line.

Once the ﬁrst line comes back, the BIU issues a speculative request for

the next line (in this case, the third line). This process is broken when

the CPU informs the BIU that the instruction stream is broken. The BIU

stops issuing requests until the CPU indicates the next instruction fetch

miss.

Speculative fetching is limited to lines within any 4 Kbyte page. That is,

the BIU does not attempt to fetch a line speculatively that starts a new

4 Kbyte physical page. This method avoids problems when crossing from

a cached page to an uncached page and other potential exception

problems. A speculative fetch could attempt to access an invalid memory

location (for example, not present in the memory map). An error

response for such an event is not reﬂected to the CPU. The BIU simply

discards the erroneous data, and no exception is reported.

To disable speculative instruction fetching, deassert the EZ4021-FC input

pin, PREFETCH_ENABLEP.

2.6.1.4 Bus Snooping

Bus snooping helps maintain cache coherency. If an external device on

the Quick Bus writes to cacheable space, the BIU initiates a tag lookup

in the CPU Data Cache Controller (DCC). If there is a match, the DCC

invalidates the appropriate cache line. To disable this cache snooping

mechanism, deassert the EZ4021-FC input pin QB_WRITEP or

SNOOP_ENABLEP.

Bus Interface Unit (BIU) 2-17

2.6.1.5 Read Priority

When enabled, the BIU prioritizes data reads (loads) ahead of data

writes (stores) to the Quick Bus, resulting in out of order execution. To

disable this feature, deassert the EZ4021-FC input pin,

READPRI_ENABLEP.

2.6.2 Instruction Cache Reﬁll Summary

This section summarizes the instruction cache reﬁll policy:

•The I-Cache is ﬁlled with four doublewords (four doubleword blocks).

•Uncached instructions are single doubleword fetches where the

second word is sent to the CPU in the next cycle, if there is an

address match.

•Missed doubleword is returned ﬁrst.

•Data wraps around; that is, a line is always fetched.

•There is speculative instruction fetching (prefetching).

2.6.3 Data Cache Reﬁll Summary

This section summarizes the data cache reﬁll policy:

•The D-Cache is ﬁlled with four doublewords (four doubleword blocks).

•Uncached data are single fetches, depending on the byte enables

(an uncached load byte operation reads a single doubleword).

•Missed doubleword is returned ﬁrst.

•Data wraps around; that is, a line is always fetched.

2.6.4 Quick Bus Access Priority

The Quick Bus access priorities are listed below from highest to lowest:

1. Write-Back Store

2. EJTAG DMA (read/write)

3. CPU Instruction

2-18 Functional Description

4. CPU Write Data (entry matches load)

5. CPU Read Data (load)

6. CPU Write Data (whatever is in the write buffer)

2.6.5 Programmable BIU Features

Table 2.5 lists EZ4021-FC programmable features and the signals that

control them.

2.7 EJTAG Interface

The EZ4021-FC interface supports both Joint Test Action Group (JTAG)

and Enhanced JTAG (EJTAG) functions. JTAG provides a serial interface

and EJTAG supports debugging.

EJTAG is a debug feature of MIPS-based processors. You can use

EJTAG to debug stand-alone processors as well as 32- or 64-bit

processors that are embedded in a system like the EZ4021-FC.

EJTAG supports the following functions:

•Debugging for MIPS I, II, and III software code

•Standardized debugging that simpliﬁes and speeds up designing

systems based on the EZ4021-FC

Table 2.5 Programmable Features

Feature Signal1

Write Buffer Assert WRITEBUF_ENABLEP to enable the BIU

eight doubleword write buffer.

Instruction Prefetching Assert PREFETCH_ENABLEP to enable the BIU

speculative instruction prefetching.

Data Bus Snooping Assert SNOOP_ENABLEP to enable data bus

snooping.

Read Priority Assert READPRI_ENABLEP to enable data read

priority over data writes.1

1. These BIU inputs are registered. For most applications, tie these inputs either

HIGH or LOW.

EJTAG Interface 2-19

•Emulator connection with a small number of pins

•Real-Time Program Counter trace (PC Trace)

•Software breakpoints

•Program single stepping

•Simple DMA support

•Hardware signal for indicating debug mode

•Debug exception vector located in normal memory

The EJTAG interface provides memory-mapped registers and

serially-accessed registers for controlling EJTAG debugging operations.

These are in addition to the CP0 EJTAG registers. For a description of

all the EJTAG registers, see Section 3.3.1, “EJTAG Debug Registers,” on

page 3-35.

The EJTAG interface provides for attachment of an EJTAG probe, which

a debug host controls. The serially-accessed registers allow the probe to

control EJTAG resources through a serial TAP port and the associated

TAP controller state machine.

The probe uses the TMS (DJ_TMSP) and TCK (DJ_TCKP) input pins to

control the TAP controller in the EJTAG Interface. For each rising edge

on the TCK clock, the TAP controller changes its state according to the

state diagram shown in Figure 2.9.

2-20 Functional Description

Figure 2.9 TAP Controller

Test-Logic-

Reset

TMS = 1

Run-Test/

Select-DR-

Capture-DR

Shift-DR

Exit1-DR

Pause-DR

Exit2-DR

Update-DR

Select-IR-

Capture-IR

Update-IR

Idle Scan

Scan

Shift-IR

Exit1-IR

Pause-IR

Exit2-IR

EJTAG Interface 2-21

The TAP controller states are deﬁned as follows:

•Test-Logic-Reset

The EJTAG interface is reset and does not interfere with the normal

operation of the chip. The instruction register is set to the IDCODE.

Reset of the EJTAG interface by TRST puts the TAP controller in this

state. The TAP controller can always reach this state within 5 TCK

cycles if TMS equals 1.

•Run-Test/Idle

The TAP controller is idle and can be left in this state when not used.

If the PC_Trace instruction is given, and the TAP controller is taken

into the Run-Test/Idle state, the PC Trace output is enabled. As soon

as the TAP controller leaves the Run-Test/Idle state, the PC Trace

output is disabled.

•Select-IR-Scan and Select-DR-Scan

These serve as intermediate states on the path to selecting either an

instruction or data register update.

•Capture-DR

The selected data register (bypass, device ID, implementation,

control, address or data registers) is captured in the data

shift-through register. The register is selected by the contents of the

instruction register.

•Capture-IR

The value 0x1 is captured in the instruction shift-through register.

•Shift-DR

The data shift-through register is inserted in the TDI/TDO shift path

and shifted on each rising edge of TCK:

On each falling edge of TCK, the least signiﬁcant bit in the data

shift-through register is available on TDO to be sampled by the probe

on the next rising edge of TCK.

TDI

TDO

Data Shift-Through Register

0/31/95 0

2-22 Functional Description

On each rising edge of TCK, the TDI value is sampled and shifted

into the most signiﬁcant bit in the data shift-through register. The

length is 1, 32, 64, or 128 bits, depending on the instruction.

•Shift-IR

The instruction shift-through register is inserted in the TDI/TDO shift

path and shifted on each rising edge of TCK:

The instruction shift-through register operation is similar to the data

shift-through register operation.

The length of the instruction shift-through register is 5, 6, 7, or 8 bits,

depending on the length of the instruction register.

•Exit1-DR and Exit1-IR

These are temporary states, with no effect.

•Pause-DR and Pause-IR

These are temporary states, with no effect. They are used for

pausing.

•Exit2-DR and Exit2-IR

These are temporary states, with no effect.

•Update-DR

The data shift-through register is copied to the selected register

(bypass, device ID, implementation, control, address or data

registers). When a register is selected, and the Capture-DR state is

entered, the Update-DR state must also be entered and the selected

•Capture-IR

The instruction shift-through register is copied to the instruction

TDI

TDO

Instruction Shift-Through Register

4/5/6/7 0

Clocks 2-23

2.8 Clocks

The EZ4021-FC accepts these three clock inputs:

•PCLKP – processor clock. This clock generates all on-chip clocks

except DJ_TCKP and GSCAN_RAMCLKP.

•DJ_TCKP – EJTAG clock

•GSCAN_RAMCLKP – global scan mode RAM clock

2.8.1 System Clock

The EZ4021-FC generates the system clock (SCLKP) from PCLKP. The

BIU Quick Bus interface uses SCLKP inside the core. At the chip level,

the EZ_SCLK_GATEP output from the core is latched and ANDed with

PCLKP to generate SCLKP. This guarantees that SCLKP inside the core

is fully synchronous with SCLKP outside the core. Figure 2.10 illustrates

this principle for an SCLKP divider of 2.

Figure 2.10 On-Chip SCLKP Generation

SCLKP is synchronous with PCLKP, and operates at either the same,

1/2, or 1/3 of the PCLKP frequency.

In addition to PCLKP, the core accepts the inputs SCLKP_DIVP[1:0] and

CG_RESETP. SCLKP_DIVP[1:0] sets the ratio between PCLKP and

SCLKP. The CG_RESETP input forces the SCLKP divider to reload.

CG_RESETP is required during logic simulation to initialize the SCLKP

divider; in actual hardware the divider counts down and reloads

regardless of its power-up state.

SCLKP

Latch Output

EZ_SCLK_GATEP

PCLKP

2-24 Functional Description

Figure 2.11 shows the clock distribution for the various EZ4021-FC

clocks. If the insertion delay for the surrounding logic is much larger than

the EZ4021-FC, then EZ_SCLK_GATEP might not meet timing

requirements to the external SCLK clock generator module. The

recommended solution is to insert a synchronization module between the

EZ_SCLK_GATEP output and the external clock generator module. The

synchronization module in Figure 2.11 has three ﬂip-ﬂops in series.

The clock net going into the EZ4021-FC clocks the ﬁrst synchronizer

ﬂip-ﬂop (Sync 0). A clock net with an insertion delay less than the

EZ4021-FC PCLKP input and greater than the insertion delay to the

clock generator module clocks the second ﬂip-ﬂop (Sync 1). Ideally, the

same clock that goes to the clock generator also clocks the third

synchronizer ﬂip-ﬂop (Sync 2). The synchronization module holds the

EZ_SCLK_GATEP signal for use in the clock generator until the next

PCLKP cycle. If you use a synchronizer, you must assert reset for at

least three more clock cycles.

2.8.2 EJTAG and Scan Clocks

DJ_TCKP shifts data in and out of the EJTAG instruction register. This

clock may be fully asynchronous to PCLKP. For more information on

DJ_TCKP, refer to Section 5.3.1, “EJTAG Standard Signals,” on page 5-7.

Off-chip test equipment supplies GSCAN_RAMCLKP, which clocks the

RAMs in scan mode. Clocking the RAMs allows data to pass through

from the RAM inputs to outputs and improves scan test coverage.

2.8.3 Require External Synchronization to System Clock

The EZ4021-FC has a reset input, a nonmaskable interrupt (NMI) input,

and ﬁve hardware interrupt exception inputs. These signals must be

synchronized externally to the system clock (SCLKP).

Clocks 2-25

Figure 2.11 EZ4021-FC Clock Distribution

SCLKP_DIVP[1:0]

PCLKP

Divider

CG_RESETP

EZ_SCLK_GATEP

EZ4021-FC EasyMACRO Core

SCLKP

Sync0 Sync1 Sync2

SCLK_DIVP[1:0]

PCLKP1

PCLKP2

PCLKP3

Latch

BIU

SCLKP

Clock Generator

Chip-Level

Distribution

Core Clock

Distribution

Latch

Clock

Quick Bus

Interface

2-26 Functional Description

MiniRISC EZ4021-FC EasyMACRO Microprocessor 3-1

Chapter 3

Programmer’s Model

This chapter describes the programmer’s model for the EZ4021-FC. It

contains the following sections:

•Section 3.1, “Memory Management”

•Section 3.2, “Exception Processing”

•Section 3.3, “EJTAG Debugging”

•Section 3.4, “System Conﬁguration Register 1”

3.1 Memory Management

The EZ4021-FC memory model is based on an R4000 implementation.

The EZ4021-FC physical address space is 4 Gbytes and uses a 32-bit

address. The virtual address is also 32-bits wide, and it supports a user

process size of up to 2 Gbytes (231).

The virtual address is extended with an Address Space Identiﬁer (ASID)

to reduce the frequency of Translation Lookaside Buffer (TLB) ﬂushing

during context switches. The ASID is 8-bits wide and is contained in the

CP0 EntryHi register. (See Section 3.1.3.6, “EntryHi Register (10),” on

page 3-15.)

3.1.1 Operating Modes

This section describes the four modes of EZ4021-FC operation. The ﬁrst

three modes support

normal

processor operations and are always

available. The four modes are:

3-2 Programmer’s Model

•User mode – allows execution of nonsupervisory programs

•Supervisor mode – includes higher level operating system functions

that are layered on top of the kernel

•Kernel mode – provides the lowest level operating system (kernel)

functions

•Debug mode – supports system level debug operations that use an

external processor probe

The EZ4021-FC normally operates in User mode until an exception

forces a transition into Kernel mode. It remains in Kernel mode until an

Exception Return (ERET) instruction is executed, which restores the

processor to the operating mode that existed before the exception.

Debug mode can be entered from any other operating mode by the

taking of a debug exception. The EZ4021-FC remains in Debug mode

until a Debug Exception Return (DERET) instruction is executed to

restore the processor to the operating mode existing prior to the

exception.

Address mapping is different for Kernel, Supervisor, and User modes. To

simplify the management of User state from within the Kernel or

Supervisor, the User mode address space is a subset of both the Kernel

and Supervisor mode address spaces. The address mapping for Debug

mode is similar to that of Kernel mode, except for the redeﬁnition of an

address range as EJTAG probe and register addresses.

3.1.1.1 User Mode Operations

In User mode, a single, uniform virtual address space (

useg

) of 2 Gbytes

(231 bytes) is available. The User segment starts at address

0x0000.0000, and all valid accesses have the most-signiﬁcant bit cleared

to 0. Referencing an address with the most signiﬁcant bit set while in

User mode causes an Address Error exception. The TLB maps all

references to

useg

identically regardless of operating mode, and controls

cache accessibility on a per-page basis. Figure 3.1 shows User mode

address mapping.

Memory Management 3-3

Figure 3.1 User Mode Memory Map

Under normal operation (not debug mode), the processor executes in

User mode when the Status register contains the following bit values:

•KSU[1:0] = 0b10

•EXL = 0

•ERL = 0

For a description of the Status register, see Section 3.2.2.5, “Status

3.1.1.2 Supervisor Mode Operations

Supervisor mode is designed for layered operating systems in which a

true kernel runs in R4000 Kernel mode, and the rest of the operating

system runs in Supervisor mode.

During normal operation, the processor executes in Supervisor mode

when the Status register contains the following bit values:

0xFFFF.FFFF

0x80000000

0x7FFF.FFFF

0x0000.0000

User

Mapped

Cacheable

useg

0x0000.0000

Memory

0xFFFF.FFFF

(4 Gbytes)

Virtual Physical

Any

Address Error

3-4 Programmer’s Model

•KSU[1:0] = 0b01

•EXL = 0

•ERL = 0

The virtual address space is divided into two regions, differentiated by

the high-order bits of the address, as shown in Figure 3.2.

Figure 3.2 Supervisor Mode Memory Map

The two regions are suseg and sseg:

suseg – Starts at virtual address 0x00000000 and is 2 Gbytes long. This

segment allows selective caching and mapping on a per-page basis. This

segment overlaps Supervisor memory access and User memory access.

sseg – Starts at virtual address 0xC0000000 and is 512 Mbytes long.

Like suseg, this segment uses TLB entries to map virtual addresses to

arbitrary physical ones, with or without caching.

Accesses that fall outside of either

suseg

sseg

segments result in an

Address Error exception.

0xFFFF.FFFF

0xC0000000

0xBFFF.FFFF

0x8000.0000

0x7FFF.FFFF

0x0000.0000

Supervisor

Mapped

Cacheable

User

Mapped

Cacheable

suseg

Address Error

sseg

0x0000.0000

Memory

0xFFFF.FFFF

(4 Gbytes)

Virtual Physical

Any

Address Error

0xE000.0000

0xDFFF.FFFF

Memory Management 3-5

3.1.1.3 Kernel Mode Operations

During normal operation, the processor executes in Kernel mode when

the Status register contains one or more of the following bit values:

•KSU[1:0] = 0b00

•EXL = 1

•ERL = 1

The virtual address space is divided into ﬁve regions, differentiated by

the high-order bits of the address, as shown in Figure 3.3.

Figure 3.3 Kernel Mode Memory Map

The ﬁve regions are kuseg, kseg0, kseg1, ksseg, and kseg3.

kuseg – Starts at virtual address 0x0000.0000 and is 2 Gbytes long.

This segment allows selective caching and mapping on a per-page basis.

This segment overlaps Kernel memory access and User memory

access.

0xFFFF.FFFF

0xC000.0000

0xBFFF.FFFF

0xA000.0000

0x9FFF.FFFF

0x8000.0000

0x7FFF.FFFF

0x0000.0000

Kernel

Unmapped

Uncached

Kernel

Unmapped

Cached

Supervisor

Mapped

Cacheable

User

Mapped

Cacheable

kuseg

kseg0

kseg1

ksseg

0x0000.0000

0x1FFF.FFFF

0x2000.0000

Memory

0xFFFF.FFFF

(4 Gbytes)

512 Mbytes

Virtual Physical

Any

kseg3

0xE000.0000

0xDFFF.FFFF

Kernel

Mapped

Cacheable Any

3-6 Programmer’s Model

kseg0 – Starts at virtual address 0x8000.0000 and is 512 Mbytes long.

The EZ4021-FC direct maps references within kseg0 onto the ﬁrst

512 Mbytes of physical memory. These references use cache memory

but do not use the TLB for address translation. Thus, kseg0 is typically

used for kernel executable code and some kernel data.

kseg1 – Starts at virtual address 0xA000.0000 and is 512 Mbytes long.

The EZ4021-FC direct maps references within kseg1 onto the ﬁrst

512 Mbytes of physical memory. These references do not use cache

memory or the TLB for address translation. Thus, kseg1 is typically used

by operating systems for I/O registers, ROM code, and disk buffers.

ksseg – Starts at virtual address 0xC000.0000 and is 512 Mbytes long.

Like kuseg, this segment uses TLB entries to map virtual addresses to

arbitrary physical ones, with or without caching.

kseg3 – Starts at virtual address 0xE000.0000 and is 512 Mbytes long.

Like kuseg, this segment uses TLB entries to map virtual addresses to

arbitrary physical ones, with or without caching. An operating system

typically uses kseg3 for stacks and per-process data that must remap on

context switches. The operating system also uses kseg3 for user page

tables and some dynamically allocated data areas.

3.1.1.4 Debug Mode Operations

In debug mode, an Extended JTAG (EJTAG) interface typically controls

the built-in debug features. All operations – such as reads and writes to

internal registers, to external system memories, and to on-chip

peripherals – are performed using the EJTAG protocol.

The EZ4021-FC is in Debug mode when the Debug Mode (DM) bit sets

to 1 in the Debug register (23). During normal operation, the DM bit is 0.

The Debug register is part of the exception coprocessor (CP0) register

set. See Section 3.3.3.1, “Debug Register (23) (Debug),” on page 3-49

for more information.

The virtual address space is identical to that of Kernel mode with one

exception. Two special

kseg3

address ranges have been set aside for

debug mode use. These ranges are:

Memory Management 3-7

Probe Memory – Virtual address range 0xFF20.0000 to 0xFF2F.FFFF.

References to this memory segment do not use cache memory or the

TLB for address translation. The virtual address is passed directly to the

external memory subsystem and is used to access off-chip processor

probe memory.

EJTAG Register Map – Virtual address range 0xFF30.0000 to

0xFF3F.FFFF. References to this memory segment do not use cache

memory or the TLB for address translation. The virtual address is used

to directly access the EJTAG register map.

3.1.2 Virtual Memory and the TLB

Mapped virtual addresses are translated into physical addresses using

an on-chip TLB. The TLB is a fully associative memory. It holds 32

entries that provide mapping to 64 physical page frames. The address

range mapped by a page can vary from 4 Kbytes to 16 Mbytes in size.

When address mapping is indicated, each TLB entry is simultaneously

matched against the virtual address extended by the current ASID stored

in the EntryHi register.

If there is a match (hit), the physical page number is read from the TLB

and concatenated with the offset to form the physical address, as shown

in Figure 3.4.

Figure 3.4 EZ4021-FC Virtual Address Format

Offset

OffsetASID

ASID

3139 32 28 1112

81217

88 24

Offset passed

unchanged

Offset passed

unchanged

Virtual to

physical

translation

Bits [31:29] select

User or Kernel

address spaces

Virtual address

Virtual address 039 32 24 23

32-Bit Physical Address

VPN

with 4 Kbyte

page size

with 16 Mbyte

page size

Virtual to

physical

translation

31 29 28

3-8 Programmer’s Model

If no match occurs (a page miss), an exception is taken. Typically,

software reﬁlls the TLB from a page table maintained by the system.

Software can write over a selected TLB entry or use a hardware

mechanism to write into a random location.

The EZ4021-FC does not support the TLB-shutdown (TS) bit in the

Status register, which indicates that more than one entry in the TLB

matches the virtual address being translated. If more than one TLB entry

matches the virtual address, the virtual address may be translated to an

incorrect physical address.

System software must ensure that this

situation is never created

3.1.2.1 TLB Entry Format

Figure 3.5 shows the format of the 32-bit, TLB entry. Each ﬁeld of an

entry has a corresponding ﬁeld in the EntryHi, EntryLo0, EntryLo1, or

PageMask registers.

Figure 3.5 EZ4021-FC TLB Entry Format

R Reserved [127:121], [108:96], [75:72], [63:58], [32:26], 0

These bits are read as 0s. The EZ4021-FC ignores

attempts to set these bits.

MASK Page Mask [120:109]

This ﬁeld holds a comparison mask that deﬁnes the page

size for the corresponding TLB entry.

127 109 108 96

MASK R

VPN2 R ASID

PFN DCVR

75 72 71 64

58 57

38 37 34 33 32

3111

R PFN DCVR

26 25

65 2 1 0

3111

121 120

Memory Management 3-9

VPN2 Virtual Page Number Divided by 2 [95:77]

This ﬁeld contains the Virtual Page Number divided by 2.

Each TLB entry maps two pages.

G Global 76

When this bit is set to 1, the contents of the ASID ﬁeld

are ignored during TLB lookup.

ASID Address Space Identiﬁer [71:64]

This ﬁeld contains the Address Space Identiﬁer.

PFN Page Frame Number [57:38, 25:6]

This ﬁeld contains the Page Frame Number. These bits

are the upper bits of the physical address.

C Cache [37:35, 5:3]

This ﬁeld speciﬁes the cache coherency algorithm for

references to the page. If the references are to be

cached, you can select one of two update algorithms:

write-back or write-through.

D Dirty 34, 2

When this bit is set to 1, the page is marked dirty and

writable.

V Valid 33, 1

When this bit is set to 1, the TLB entry is valid.

3.1.3 Memory and TLB-Support Registers

The registers described in the following subsections are used in

association with the memory management and CP0 TLB support:

C Bits Algorithm

Ob000 Reserved

Ob001 Reserved

Ob010 Uncached

Ob011 Cacheable – write-back

Ob100 Reserved

Ob101 Reserved

Ob110 Reserved

Ob111 Cacheable – write-through

3-10 Programmer’s Model

•Index Register (0)

•Random Register (1)

•EntryLo0 (2) and EntryLo1 (3) Registers

•PageMask Register (5)

•Wired Register (6)

•EntryHi Register (10)

•PRId Register (15)

•TagLo (28) and TagHi (29) Registers

3.1.3.1 Index Register (0)

The Index register is a 32-bit, read/write register containing 6 bits that

index an entry in the TLB.

The Index register also speciﬁes the TLB entry that is read or written by

the TLB Read (TLBR) or TLB Write (TLBWI) instruction. Figure 3.6

shows the register format.

Figure 3.6 Index Register (0)

P Probe 31

When this bit is set to 1, the last TLB probe (TLBP)

instruction failed to ﬁnd a match.

R Reserved [30:6]

These bits are read as 0s. The EZ4021-FC ignores

attempts to set these bits; however, software should write

these bits as 0 to ensure compatibility with future

versions of the software.

Index Index [5:0]

This ﬁeld contains the index to the TLB entry. The TLBR

and TLBWI instructions use this index. The range of legal

Index values is 0–31 because the TLB implements 32

entries.

31 30 65 0

P R Index

Memory Management 3-11

3.1.3.2 Random Register (1)

The 32-bit, read-only Random register contains 6 bits that are used to

index an entry in the TLB. The register decrements as each instruction

executes. The values range between a lower boundary set by the

number of TLB entries reserved for exclusive use by the operating

system (deﬁned in the Wired register), and an upper boundary set by the

total number of TLB entries (31 maximum).

The TLB Write Random (TLBWR) instruction loads the contents of the

EntryHi and EntryLo registers into the TLB entry speciﬁed in the Random

To simplify testing, the Random register is set to the value of the upper

boundary when the system is reset. It is also set to its upper boundary

when the Wired register is written. Figure 3.7 shows the register format.

Figure 3.7 Random Register (1)

R Reserved [31:6]

These bits are read as 0s. The EZ4021-FC ignores

attempts to set these bits; however, software should write

these bits as 0 to ensure compatibility with future

versions of the software.

Random Random [5:0]

This ﬁeld contains the index to the TLB entry that the

TLBWR instruction loads. The range of legal Random

values is 0–31 because the TLB has 32 entries.

3.1.3.3 EntryLo0 (2) and EntryLo1 (3) Registers

The EntryLo0 and EntryLo1 registers contain address translation

information that software reads from or writes into the TLB.

•EntryLo0 – contains TLB entries for even virtual pages

•EntryLo1 – contains TLB entries for odd virtual pages

31 65 0

R Random

3-12 Programmer’s Model

Both registers have read/write access and use the format shown in

Figure 3.8.

Figure 3.8 EntryLo0/1 Register

R Reserved [31:26]

These bits are read as 0s. The EZ4021-FC ignores

attempts to set these bits; however, software should write

these bits as 0 to ensure compatibility with future

versions of the software.

PFN Physical Page Frame Number [25:6]

This ﬁeld contains the Physical Page Frame Number.

C Cache [5:3]

This ﬁeld speciﬁes the cache coherency algorithm for

references to the page. If the references are to be

cached, you can select one of two update algorithms:

write-back or write-through. The following table shows

how the Cache bits are encoded:

D Dirty 2

When this bit is set, the page marked is dirty and

writable.

V Valid 1

When this bit is set, the TLB entry is valid.

31 26 25 6 5 3 2 1 0

R PFN C D V G

C Bits Algorithm

Ob000 Reserved

Ob001 Reserved

Ob010 Uncached

Ob011 Cacheable – write-back

Ob100 Reserved

Ob101 Reserved

Ob110 Reserved

Ob111 Cacheable – write-through

Memory Management 3-13

G Global 0

When this bit is set, ignore the contents of the ASID ﬁeld

during TLB lookup. Mapping is globally available to all

ASIDs.

3.1.3.4 PageMask Register (5)

The read/write PageMask register is used to access the TLB. It

implements a variable page size by holding a per-entry comparison

mask. When virtual addresses are presented for translation, the

corresponding PageMask bits in the TLB specify which of the virtual

address bits [24:13] to use in the comparison. Figure 3.9 shows the

Figure 3.9 PageMask Register (5)

R Reserved [31:25], [12:0]

These bits are read as 0s. The EZ4021-FC ignores

attempts to set these bits; however, software should write

these bits as 0 to ensure compatibility with future

versions of the software.

M Mask [24:13]

This ﬁeld contains the PageMask.

31 25 24 13 12 0

R MASK R

Page Size

Bit

24 23 22 21 20 19 18 17 16 15 14 13

4 Kbytes 000000000000

16 Kbytes 000000000011

64 Kbytes 000000001111

256 Kbytes 000000111111

1 Mbyte 000011111111

4 Mbytes 001111111111

16 Mbytes 111111111111

3-14 Programmer’s Model

3.1.3.5 Wired Register (6)

The read/write Wired register speciﬁes the boundary between the wired

(ﬁxed, nonreplaceable entries that cannot be overwritten by a TLBWR

operation) and random entries of the TLB. Figure 3.10 shows the location

of the Wired register.

Figure 3.10 Wired Register Location

When the system is reset, the Wired register is set to 0. Writing the

Figure 3.11 shows the register format.

Figure 3.11 Wired Register

R Reserved [31:6]

These bits are read as 0s. The EZ4021-FC ignores

attempts to set these bits; however, software should write

these bits as 0 to ensure compatibility with future

versions of the software.

Wired Wired [5:0]

This ﬁeld deﬁnes the

number of Wired TLB entries.

Wired entries have indices from 0 to N – 1; random

replaceable entries have indices from N to 31. The range

of legal Wired values is 0–31 because the TLB has 32

entries.

TLB

Wired

Range of

Random Entries

Range of

Wired Entries

31 65 0

R Wired

Memory Management 3-15

3.1.3.6 EntryHi Register (10)

The read/write EntryHi register is used to access the TLB. In addition,

this register contains the current ASID value for the processor. The ASID

value is used to match the virtual address with a TLB entry during virtual

address translation. Typically, the operating system assigns a unique

ASID value to each known process. In this way, mappings held in the

TLB are made unique to the process whose ASID they match.

The EntryHi register holds the high-order bits of a TLB entry when

performing TLB read and write operations. When either a TLB reﬁll, TLB

invalid, or TLB modiﬁed exception occurs, the EntryHi register is loaded

with the Virtual Page Number (VPN2) and the ASID of the virtual address

that failed to have a matching TLB entry.

The TLBP, TLBW, TLBWI, and TLBR instructions can access the EntryHi

Figure 3.12 EntryHi Register (10)

VPN2 Virtual Page Number Divided by 2 [31:13]

This ﬁeld contains the Virtual Page Number divided by 2.

Each TLB entry maps two pages.

R Reserved [12:8]

These bits are read as 0s. The EZ4021-FC ignores

attempts to set these bits; however, software should write

these bits as 0 to ensure compatibility with future

versions of the software.

ASID Address Space ID [7:0]

This ﬁeld contains the Address Space Identiﬁer.

3.1.3.7 PRId Register (15)

The Processor Revision Identiﬁer (PRId) is a 32-bit, read-only register

that contains information identifying the implementation and revision level

of the EZ4021-FC EasyMACRO core. Figure 3.13 shows the register

format.

31 13 12 8 7 0

VPN2 R ASID

3-16 Programmer’s Model

Figure 3.13 PRId Register (15)

R Reserved [31:16]

These bits are read as 0s. The EZ4021-FC ignores

attempts to set these bits; however, software should write

these bits to 0 to ensure compatibility with future versions

of the software.

IMP Implementation Number [15:8]

The value in this ﬁeld represents the core implementation

number. For the EZ4021-FC, this value is 0x35.

REV Revision Number [7:0]

The value in this ﬁeld is a revision number for the core.

The upper four bits [7:4] represent the major revision

number, which is 0x0000 for the EZ4021-FC. The least

signiﬁcant four bits [3:0] are the minor revision number.

Use the PRID_REV [3:0] signals at the core interface

to program bits [3:0].

Important: LSI Logic does not guarantee that changes to the

EZ4021-FC are reﬂected in the PRId register, nor does it

guarantee that changes to the revision number reﬂect real

core changes. For that reason, revision numbers are not

listed here, and software should not rely on the revision

number in the PRId register to characterize the core.

3.1.3.8 Conﬁg Register (16)

The Conﬁg register speciﬁes various conﬁguration options for the

EZ4021-FC processor.

At reset, the hardware sets the options in the Conﬁg bits [31:3]. The

software has read-only access to the information in these bit ﬁelds.

Software controls the K0 ﬁeld, bits [2:0], which have read-write access.

At reset, the K0 ﬁeld is undeﬁned. Figure 3.14 shows the register format.

31 16 15 8 7 0

R IMP REV

Memory Management 3-17

Figure 3.14 Conﬁg Register (16)

R Reserved [31, 27:18, 16, 14:12, 3]

These bits are read as 0s. The EZ4021-FC ignores

attempts to set these bits.

EC System Clock Ratio [30:28]

This ﬁeld reﬂects the value of the EZ4021-FC core input

pins SCLKP_DIVP[1:0].

SC Secondary Cache Not Present 17

The EZ4021-FC does not support a secondary cache, so

this bit is hardwired to a 1.

BE Big Endian Memory 15

This ﬁeld reﬂects the value of EZ4021-FC core input pin

BIG_ENDIANP.

When this bit is 0, memory is little endian. When this bit

is 1, memory is big endian.

31 30 28 27 18 17 16 15 14 12 11 9 8 6 5 4 3 2 0

R EC R SC R BE R IC DC IB DB R K0

EC SCLKP_DIVP Sys Clock Ratio

0 10 SCLKP = PCLKP/2

1 11 SCLKP = PCLKP/3

2–6 – Reserved

7 01 SCLKP = PCLKP

3-18 Programmer’s Model

IC Instruction Cache Size [11:9]

The EZ4021-FC sets this ﬁeld to 0x2 (16 Kbytes).

DC Data Cache Size [8:6]

The EZ4021-FC sets this ﬁeld to 0x2 (16 Kbytes).

IB Instruction Cache Block Size 5

The EZ4021-FC sets this bit to 1 to indicate that the

instruction cache block (cache line) size is 32 bytes.

DB Data Cache Block Size 4

The EZ4021-FC sets this bit to 1 to indicate that the data

cache block (cache line) size is 32 bytes.

K0 Kseg0 Coherency Algorithm [2:0]

This ﬁeld speciﬁes the cache coherency algorithm for

references to kseg0 address space, and all other

cacheable accesses when the MMU is disabled. If the

IC I-Cache Size

(KBytes)

000 4

001 8

010 16

011 32

100 64

101 128

110 256

111 512

DC D-Cache Size

(KBytes)

000 4

001 8

010 16

011 32

100 64

101 128

110 256

111 512

Memory Management 3-19

references are to be cached, you can select one of two

update algorithms: write-back or write-through.

3.1.3.9 TagLo (28) and TagHi (29) Registers

The 32-bit, read/write TagLo and TagHi registers hold the primary cache

tag during cache initialization or diagnostics. The Tag registers are

written by the CACHE Index Load Tag and MTC0 instructions.

Note: If a CACHE D-Cache Index Store Tag or D-Cache Hit

Invalidate instruction precedes a D-Cache Index Load Tag

instruction, make sure there is at least one instruction

between the Store Tag/Hit Invalidate and the Load Tag

instruction. Otherwise, the D, LL, and LRU bits in the TagLo

The TagHi register is not used by the EZ4021-FC when not in cache test

mode and returns 0s when read. Figure 3.15 shows the register format.

C Bits Algorithm

000 Reserved

001 Reserved

010 Uncached

011 Cacheable – write-back

100 Reserved

101 Reserved

110 Reserved

111 Cacheable – write-through

3-20 Programmer’s Model

Figure 3.15 TagLo Register

R Reserved [31:28], [3:0]

These bits are not used and read as 0s. The EZ4021-FC

ignores attempts to set these bits; however, software

should write these bits as 0 to ensure compatibility with

future versions of the software.

PAddr[31:12] Tag Physical Address [27:8]

This ﬁeld is used to read and write the physical address

Tag ID.

V Line Valid 7

This bit is used to read and write the line valid bit.

D Line Dirty 6

This bit is used to read and write the cache line dirty bit.

For I-Cache Store Tag operations, this bit is ignored. For

I-Cache Load Tag operations, this bit always reads as 0.

LL Line Locked 5

This bit is used to read and write the line locked bit.

When

not

operating in cache test mode, this bit will

always return a value of 0 following a CACHE Index Load

Tag operation.

LRU Least Recently Used 4

This bit is used to read and write the Least Recently

Used (LRU) bit. When

not

operating in cache test mode,

this bit will always return a value of 0 following a CACHE

Index Load Tag operation.

3.1.4 Virtual Address Translation

During virtual-to-physical address translation, the CPU compares the

ASID and, depending upon the page size, the highest 7–19 bits of the

virtual address to the contents of the TLB. Figure 3.16 illustrates the TLB

address translation process.

31 28 27 8 7 6 5 4 3 0

R PAddr[31:12] V D LL LRU R

Memory Management 3-21

Figure 3.16 EZ4021-FC TLB Address Translation Process

Yes Yes

Yes

No No

Yes

Output

Physical

Address

Indicates an exception

VPN

and

ASID

User

Mode?

VPN

Match?

G = 1? ASID

Match?

V = 1?

Write? D = 1?

TLB

Mod C =

0b010?

Access

Main

Memory

TLB

Invalid TLB

Reﬁll

Valid

Address?

No Supr

Mode?

No Valid

Address?

Address

Error No

Unmapped

Access

No Yes

Address

Error

Yes kseg0

kseg1?

Access

Cache

Note: Bits A, V, D, and C are bits in the TLB entry.

Yes

3-22 Programmer’s Model

A virtual address matches a TLB entry when:

•VPN2 ﬁeld of the virtual address equals the VPN2 ﬁeld of the entry

•Gbit of the TLB entry is set, or the ASID held in the EntryHi register

matches the ASID ﬁeld in the TLB entry

The V bit in the TLB entry must be set to 1 for a valid translation to occur.

However, the V bit is not used when checking for a match between the

virtual address and the TLB entry.

If a TLB entry matches, the physical address and access control bit

(C, D, and V) are retrieved from the entry. If no match is found, a TLB

miss exception occurs. If the access control bits (D and V) indicate that

the access is not valid, a TLB modiﬁcation or TLB invalid exceptions

occurs, respectively. If the C bits equal 0b010, the physical address that

is retrieved is used to bypass the cache and access main memory

directly.

3.2 Exception Processing

The processor receives exceptions from a number of sources, including

TLB misses, arithmetic overﬂow, I/O interrupts, system calls, and debug

events.

When the processor detects one of these exceptions, it suspends the

normal sequence of instruction execution and enters either Kernel or

Debug mode depending on the type of exception. The processor then

disables interrupts and forces execution of a software exception handler

located at a ﬁxed address.

The exception handler saves the context of the processor, including the

contents of the program counter, the current operating mode, and the

status of the interrupts (enabled or disabled). This context is saved so it

can be restored after the exception is serviced.

When a debug exception occurs, the CPU loads the Debug Exception

Program Counter (DEPC) register with a location where execution can

restart after the exception is serviced. For all other exceptions, except

Reset, Soft Reset/NMI, the Exception Program Counter (EPC) register is

loaded with the restart location. The restart location in the EPC or DEPC

the instruction was executing in a branch delay slot, the address of the

branch instruction preceding the delay slot.

Exception Processing 3-23

The registers described later in this section assist in this exception

processing by retaining address, cause, and status information.

For detailed descriptions of the exception handling process, refer to

Chapter 7.

3.2.1 Exception Vector Locations

The EZ4021-FC deﬁnes the placement of exception processing code.

The Reset, Soft Reset, and NMI exceptions always vector to virtual

address location 0xBFC0.0000.

Debug exceptions vector to either 0xFF20.0200 or to 0xBFC0.0200 if the

ProbEn and SetDEV (EJTAG Control Register [15:14]) bits are 0.

Addresses for other exceptions are a combination of a vector offset and

a base address, and they are determined by the BEV bit of the Status

3.2.2 CP0 Exception Processing Registers

This section describes the System Coprocessor (CP0) registers that are

used in exception processing:

•Context Register (4)

•BadVAddr Register (8)

•Count Register (9)

•Compare Register (11)

•Status Register (12)

•Cause Register (13)

•EPC Register (14)

Table 3.1 Exception Addresses

Exception

Base Address

OffsetBEV=0 BEV=1

TLB Reﬁll (EXL = 0) 0x8000.0000 0xBFC0.0200 0x000

All Others 0x8000.0000 0xBFC0.0200 0x180

3-24 Programmer’s Model

•ErrorEPC Register (30)

There are three additional CP0 registers used for EJTAG debugging.

These registers are described in Section 3.3.3, “EJTAG CP0 Registers,”

on page 3-49.

•Debug Register (23)

•DEPC Register (24)

•DESAVE Register (31)

3.2.2.1 Context Register (4)

The read/write Context register contains a pointer to an entry in the Page

Table Entry (PTE) array. This array is an operating system data structure

that stores virtual-to-physical address translations. When there is a TLB

miss, operating system software handles the miss by loading the TLB

with the missing translation from the PTE array.

The BadVPN ﬁeld is not writable. It contains the VPN of the most

recently translated virtual address that did not have a valid translation

(TLBL or TLBS). The PTEBase ﬁeld is both writable and readable, and

indicates the base address of the PTE table of the current user address

space.

The Context register duplicates part of the address information provided

in the BadVAddr register, and the information is in a form that is more

useful for a software TLB exception handler.

The Context register is provided solely for the operating system to use.

The operating system can use this register to hold a pointer into the PTE

array. The operating system sets the PTE base ﬁeld register as needed.

Normally, the operating system uses the Context register to address the

current page map, which resides in the kernel-mapped segment, kseg3.

Figure 3.17 shows the register format.

Exception Processing 3-25

Figure 3.17 Context Register (4)

PTEBase Page Table Entry Base [31:23]

This ﬁeld is the pointer into the current Page Table Entry

(PTE) in memory. It is maintained by the operating

system.

BadVPN2 Bad Virtual Page Number Divided by 2 [22:4]

Hardware writes this ﬁeld on a TLB miss. It contains the

VPN of the most recently translated virtual address that

did not have a valid translation.

This 19-bit BadVPN2 ﬁeld contains bits [31:13] of the

virtual address that caused the TLB miss; bit 12 is

excluded because a single TLB entry maps an even-odd

page pair. This format can be used directly as an address

in a table of pairs of 8-byte PTEs, for a 4 Kbyte page size.

For other page and PTE sizes, shifting and masking this

value produces an appropriate address.

R Reserved [3:0]

These bits are read as 0s. The EZ4021-FC ignores

attempts to set these bits; however, software should write

these bits as 0 to ensure compatibility with future

versions of the software.

3.2.2.2 BadVAddr Register (8)

The Bad Virtual Address register (BadVAddr) is a read-only register that

contains the most recently translated virtual address that failed to have

a valid translation or that caused an address error. Figure 3.18 shows the

Note: When a bus error occurs, the Bad Virtual Address register

does not save any information about it, because it is not an

address error.

31 23 22 4 3 0

PTEBase BadVPN2 R

3-26 Programmer’s Model

Figure 3.18 BadVAddr Register (8)

3.2.2.3 Count Register (9)

The Count register acts as a timer. It increments at a constant rate equal

to one-half the maximum instruction issue rate (which is one-half PCLKP)

regardless of whether an instruction is executed, retried, or has made

any forward progress.

The Count register is a read/write register; it can be written to either for

diagnostic purposes or during system initialization to synchronize two

processors operating in lock step. Figure 3.19 shows the register format.

Figure 3.19 Count Register (9)

3.2.2.4 Compare Register (11)

The Compare register acts as a timer (see also the Count register).

When the Count register reaches a value that equals the Compare

that a timer/compare interrupt is pending. When enabled, an interrupt is

taken on the next execution cycle. Writing a value to the Compare

For diagnostic purposes, the Compare register is a read/write register.

During normal operation, the Compare register is write only. Figure 3.20

shows the register format.

31 0

BadVAddr

31 0

Count

Exception Processing 3-27

Figure 3.20 Compare Register (11)

3.2.2.5 Status Register (12)

The read/write Status register contains the operating mode, interrupt

enabling, and the diagnostic states of the processor.

The EZ4021-FC processor implements the MIPS III ISA, which is always

enabled across all operating modes. Although the EZ4021-FC supports

64-bit data operations, it only supports 32-bit addressing. Note that the

EZ4021-FC does not support the MIPS KX, SX, and UX ﬁelds (bits [7:5]).

These bits are reserved and read as 0s.

The 8-bit Interrupt Mask ﬁeld (Int[5:0], SW[1:0]) controls the enabling of

eight interrupt conditions. Interrupts must be enabled before they can be

asserted, and the corresponding bits are set in both the Interrupt Mask

ﬁeld of the Status register and the Interrupt Pending ﬁeld of the Cause

The 2-bit KSU ﬁeld, along with the ERL and EXL bits, deﬁne the normal

operating modes of the EZ4021-FC processor. Figure 3.21 shows the

Figure 3.21 Status Register (12)

CU[3:0] Coprocessor Usability Bits [31:28]

This 4-bit ﬁeld individually controls the usability of the four

coprocessors. When a bit is set to 1, the corresponding

coprocessor is marked as usable; for example, CU[1] = 1

indicates that coprocessor 1 is usable. Regardless of the

setting of the CU[0] bit, CP0 is always considered usable

when in kernel mode.

R Reserved [27:23], 21, [19:16], [7:5]

These bits are read as 0s. The EZ4021-FC ignores

attempts to set these bits; however, software should write

31 0

Compare

31 28 27 23 22 21 20 19 16 15 10 9 8 7 5 4 3 2 1 0

CU[3:0] R BEV R SR R Int[5:0] SW

[1:0] RKSU

[1:0] ERL EXL IE

3-28 Programmer’s Model

these bits to 0 to ensure compatibility with future versions

of the software.

BEV Bootstrap Exception Vector 22

This bit controls the location of the TLB reﬁll and general

exception vectors. Setting the bit to 1 indicates a

bootstrap operation, and bootstrap vector locations are

used. When the bit is cleared to 0, the general exception

vectors are used.

SR Soft Reset 20

When this bit is set, it indicates that a soft reset or

nonmaskable interrupt occurred.

Int[5:0] Hardware Interrupt Mask [15:10]

This 6-bit ﬁeld deﬁnes the hardware interrupt mask.

Setting a bit to 1 enables the corresponding hardware

interrupt. For example, setting bit 15 (Int5) to 1 enables

the Count/Compare timer interrupt. Clearing bit 0, the

Interrupt Enable (IE) bit, disables all interrupts.

SW[1:0] Software Interrupt Mask [9:8]

This 2-bit ﬁeld deﬁnes the software interrupt mask.

Setting bits 1 and 0 to a 1 enables software interrupts 1

and 0, respectively.

KSU[1:0] Kernel/Supervisor/User Mode [4:3]

This ﬁeld speciﬁes the EZ4021-FC base operating mode

as shown below:

ERL Error Level 2

The ERL bit speciﬁes the EZ4021-FC error level. Reset

and Soft Reset/NMI set this bit to a 1. When set, the ERL

bit overrides the KSU mode setting and forces kernel

operation. When cleared, the ERL bit indicates normal

operation.

KSU[1:0] Description

00 Kernel

01 Supervisor

10 User

11 Undeﬁned

Exception Processing 3-29

EXL Exception Level 1

The EXL bit speciﬁes the exception level of the

EZ4021-FC. All exceptions, except Reset and Soft

Reset/NMI, set the EXL bit to a 1. When EXL is set, it

overrides the KSU mode setting and forces kernel

operation. When cleared, the EXL bit indicates normal

operation.

IE Interrupt Enable 0

Setting the IE bit to 1 enables interrupts. Clearing the bit

to 0 disables interrupts.

Status Register Modes and Access States – The Status register

enables the following modes and access states:

•Interrupt Enable

INT[5:0] and SW[1:0] enable their corresponding hardware and

software interrupts when all of the following conditions are true:

– IE=1

– EXL=0

– ERL=0

•Operating Mode

The following CPU Status register bit settings are required for User,

Kernel, and Supervisor modes. For more information about operating

modes, refer to Section 3.1.1, “Operating Modes,” on page 3-1.

– The processor is in User mode when KSU = 0b10, EXL = 0, and

ERL=0.

– The processor is in Supervisor mode when KSU = 0b01,

EXL = 0, and ERL = 0.

– The processor is in Kernel mode when KSU = 0b00, or EXL = 1,

or ERL = 1.

•Kernel Address Space

Access to the kernel address space is allowed when the processor

is in Kernel mode.

•Supervisor Address Space

Access to the supervisor address space is allowed when the

processor is in Kernel or Supervisor mode, as described above.

3-30 Programmer’s Model

•User Address Space

Access to the user address space is allowed in any of the above

operating modes.

Status Register Reset – The contents of the Status register are

undeﬁned at reset, except for the following bits in the Diagnostic Status

ﬁeld:

•ERL =1

•BEV=1

The SR bit distinguishes between the Reset exception and the Soft

Reset exception (caused by either Reset or Nonmaskable Interrupt

[NMI]).

3.2.2.6 Cause Register (13)

The read/write Cause register describes the nature of the last exception.

A 5-bit exception code indicates the cause, and the remaining ﬁelds

contain detail information relevant to the handling of certain types of

exceptions.

The contents of this register are undeﬁned at reset. All bits in the

shows the register format.

Figure 3.22 Cause Register (13)

BD Branch Delay 31

When set, this bit indicates that the last exception

occurred while the EZ4021-FC was executing an

instruction in the branch delay slot.

R Reserved 30, [27:16], 7, [1:0]

These bits are read as 0s.

31 30 29 28 27 16 15 10 9 8 7 6 2 1 0

BD R CE

[1:0] R IP[5:0] SI

[1:0] R ExcCode[4:0] R

Exception Processing 3-31

CE[1:0] Coprocessor Error [29:28]

The value in this ﬁeld indicates which coprocessor unit

was being referenced when a Coprocessor Unusable

exception occurred.

IP[5:0] Interrupt Pending [15:10]

The EZ4021-FC sets these bits to indicate that an

external interrupt is pending. Bit 15 corresponds to the

Count/Compare timer interrupt, and bits [14:10]

correspond to the external hardware interrupts,

INTP[4:0].

SI[1:0] Software Interrupts [9:8]

When setting either of these bits, software can cause the

EZ4021-FC to transfer control to the general exception

handler. The exception routine can determine which bit is

set by examining this ﬁeld. The exception routine must

clear the SI[1:0] bits to 0 before returning control to the

interrupted program.

CE[1:0] Coprocessor Referenced

11 Coprocessor 3

10 Coprocessor 2

01 Coprocessor 1

00 Coprocessor 0

3-32 Programmer’s Model

ExcCode[4:0] Exception Code [6:2]

The EZ4021-FC sets this ﬁeld to indicate the type of

event that caused the last general exception.

ExcCode Mnemonic Description

0x00 Int Interrupt

0x01 TLBMOD TLB Modiﬁcation Exception

0x02 TLBL TLB Exception, Load, or Inst Fetch

0x03 TLBS TLB Exception, Store

0x04 AdEL Address Error Exception, Load, or

Fetch

0x05 AdES Address Error Exception, Store

0x06 IBE Bus Error Exception—Instruction Fetch

0x07 DBE Bus Error Exception—Load or Store

0x08 Sys System Call Exception

0x09 Bp Breakpoint Exception

0x0A RI Reserved Instruction Exception

0x0B CpU Coprocessor Unusable Exception

0x0C Ov Arithmetic Overﬂow Exception

0x0D Tr Trap Exception

0x0E – Reserved

0x0F FPE Floating Point Exception

0x10–

0x1F – Reserved

Exception Processing 3-33

3.2.2.7 EPC Register (14)

The read/write Exception Program Counter (EPC) contains the address

at which instruction processing can resume after servicing an exception.

For synchronous exceptions, the EPC register contains either of the

following:

•The virtual address of the instruction that was the direct cause of the

exception

•The virtual address of the immediately preceding branch or jump

instruction, when the instruction is in a branch delay slot

If the exception is caused by a recoverable, temporary condition (such

as a TLB miss), the EPC contains the virtual address of the instruction

that caused the exception. After correcting the exception condition, the

address in the EPC serves as a pointer to the instruction where

execution can resume.

The EPC is not updated if the Status register EXL bit is set to 1.

Figure 3.23 shows the EPC register format.

Figure 3.23 EPC Register (14)

EPC Virtual Address [31:0]

This register contains the virtual address of the

exception-causing instruction or the address of the

immediately preceding branch or jump.

3.2.2.8 ErrorEPC Register (30)

The Error Exception Program Counter (ErrorEPC) is a read/write register

similar to the EPC register. It stores the Program Counter (PC) on Reset,

Soft Reset, and NMI exceptions.

The contents of this register can be:

•The virtual address of the ﬁrst instruction (victim) that did not

complete due to the exception

31 0

EPC

3-34 Programmer’s Model

•The virtual address of the immediately preceding branch or jump

instruction – if the victim instruction was in a branch delay slot

•Invalid, if a Reset or Soft Reset exception occurs when there is no

valid instruction in the CPU pipeline

Figure 3.24 shows the register format.

Note: There is no branch delay slot indication for the ErrorEPC

Figure 3.24 ErrorEPC Register (30)

Error EPC Virtual Address [31:0]

This register contains the virtual address of the

exception-causing instruction or the address of the

immediately preceding branch or jump.

3.3 EJTAG Debugging

The EZ4021-FC includes the following EJTAG debug features:

•Instruction Address Matching

•Data Address Matching

•PC Trace

•EJTAG DMA

•Software Debug Breakpoint (SDBBP) instruction and Debug

Exception Return (DERET) instruction. The EZ4021-FC implements

these two new instruction extensions to the standard MIPS ISA. For

details on these new instructions, refer to Chapter 4,“Instruction Set

Architecture.”

31 0

Error EPC

EJTAG Debugging 3-35

3.3.1 EJTAG Debug Registers

The EJTAG Debug registers are grouped as follows and described in the

sections that follow:

•EJTAG Serial-Access Registers

•EJTAG CP0 Registers

•EJTAG Memory Mapped Registers

3.3.2 EJTAG Serial-Access Registers

The following registers are accessed serially through the EJTAG

interface:

•EJTAG Instruction Register (EIR)

•EJTAG Bypass Register (EBR)

•EJTAG Device Identiﬁcation Register (EDIR)

•EJTAG Implementation Register (EIMR)

•EJTAG Address Register (EAR)

•EJTAG Data Register (EDR)

•EJTAG Control Register (ECR)

Data shifts into each of the registers through the DJ_TDIP_DINTN input

pin and shifts out through the DJ_TDOP_TPCP output pin. The state of

the EJTAG TAP controller and the value of the EJTAG instruction register

determine which register is selected. Data shifts in and out with the

least-signiﬁcant-byte (LSB) ﬁrst.

The CPU cannot read or write these registers. They are only accessible

through the EJTAG pins of the EZ4021-FC.

3-36 Programmer’s Model

3.3.2.1 EJTAG Instruction Register (EIR)

The EJTAG Instruction register is addressable through the EJTAG TAP

Controller. The EIR has an initialization value of 0x01. Access is write

only (reads as 0x01). Figure 3.25 shows the register format.

Figure 3.25 EJTAG Instruction Register (EIR)

PI Possible Instruction [7:5]

The EIR has a variable length in order to match the

maximum JTAG length of 8 bits. The bits exist under the

deﬁnition of the DJ_EJTAGIRBITS[1:0] bus, as shown in

the table below. These bits are always 0 when imple-

mented unless the INST ﬁeld contains a Bypass instruc-

tion, in which case they contain a 1, as explained below.

INST Instruction [4:0]

These bits contain the EJTAG interface instruction.

The table above shows the eight valid EJTAG instruc-

tions. For detailed descriptions of the instructions, refer to

the MIPS EJTAG Speciﬁcation.

754 0

PI INST

DJ_EJTAGIRBITS[1:0] EIR Length

00 5 bits

01 6 bits

10 7 bits

11 8 bits

EJTAG Debugging 3-37

3.3.2.2 EJTAG Bypass Register (EBR)

The EJTAG Bypass register is a single bit, connecting TDI to TDO using

one register element. The EBR has no initialization value. Access is write

only (reads as a 0). Figure 3.26 shows the register format.

Note: This register is bypassed if the Bypass instruction is active

and the DJ_JTAGALSOP pin is asserted, because it

connects DJ_JTAGTDOP directly to DJ_TDO_TPCP. If this

pin is not asserted, this register connects DJ_TDIP_DINTN

and DJ_TDO_TPCP.

Table 3.2 EJTAG Interface Instructions

INST[4:0] Instruction Function

0x01 IDCODE Select Device ID Register

0x03 ImpCode Select Implementation Register

0x08 EJTAG_ADDRESS_IR Select EJTAG Address Register

0x09 EJTAG_DATA_IR Select EJTAG Data Register

0x0A EJTAG_CONTROL_IR Select EJTAG Control Register

0x0B EJTAG_ALL_IR1

1. The connection order for the EJTAG_ALL_IR instruction is TDI to high-order

bit of EJTAG Address register, low-order bit of EJTAG Address register to

high-order bit of EJTAG Data register, and low-order bit of EJTAG Data

the low-order bit of the EJTAG Control register.

Select EJTAG Address, Data, and

Control Registers

0x10 PC_Trace Issue PC Trace Command and Select

Bypass Register

0x1F2

2. For this INST code only, the PI bits, however many are selected, are set to 1

so that all bits in the EIR are 1. Otherwise, when implemented, these bits

are 0.

BYPASS3

3. All undeﬁned instructions map to Bypass.

Select Bypass Register

3-38 Programmer’s Model

Figure 3.26 EJTAG Bypass Register (EBR)

B Bypass Bit 0

When the instruction register contains a Bypass

instruction, this bit connects the EJTAG TDI and TDO

pins. When the TAP Controller enters the Capture-DR

state, this bit is loaded with a 0.

3.3.2.3 EJTAG Device Identiﬁcation Register (EDIR)

The EDIR identiﬁes LSI Logic as the EJTAG component manufacturer. In

addition, it includes a user-deﬁned value controlled by the DJ_PON[19:0]

input pins. This value can serve as a customer part number. The value

that shifts in while the EDIR value shifts out is not used.

The EJTAG part number is equivalent to the part number that would be

used if a JTAG controller were present.

The EDIR has an initialization value of

0bhhhh.hhhh.hhhh.hhhh.hhhh.0000.0110.1101,

where h is determined by hardwired customer inputs

The EDIR has read-only access. Figure 3.27 shows the register format.

Figure 3.27 EJTAG Device Identiﬁcation Register (EDIR)

PONUM Part Order Number [31:12]

This ﬁeld is tied to the DJ_PON[19:0] input pins. The

input value is user-deﬁned.

00000110110 Manufacturer Identity [11:1]

This ﬁeld identiﬁes LSI Logic as the component

manufacturer.

31 12 11 1 0

PONUM 00000110110 R

EJTAG Debugging 3-39

R Reserved 0

This bit is hardwired to 1. The EZ4021-FC ignores

attempts to set or clear this bit. However, software should

write a 1 to this bit to ensure compatibility with future

versions of the software.

3.3.2.4 EJTAG Implementation Register (EIMR)

The EIMR speciﬁes the EJTAG features implemented on the EZ4021-FC.

The value that shifts in while the EDIR value shifts out is not used.

The EIMR’s initial value is

0b0000.0000.1100.0h01.h001.1001.1000.0001,

where h is controlled by a hardwired pin.

The EIMR has read-only access. Figure 3.28 shows the register format.

Figure 3.28 EJTAG Implementation Register (EIMR)

R Reserved [31:26]

These bits are hardwired to 0s and read as 0s. The

EZ4021-FC ignores attempts to set these bits. However,

software should write 0s to them to ensure compatibility

with future versions of the software.

00 Proﬁling Support [25:24]

This ﬁeld is hardwired to 0b00 to indicate that the

EZ4021-FC does not support simple proﬁling.

1 SDBBP Uses SPECIAL2 Opcode 23

This bit is hardwired to 1 to indicate that the EZ4021-FC

decodes the SPECIAL2 SDBBP instruction, not the

previous SDBBP opcode speciﬁed in the MIPS EJTAG

Speciﬁcation (version 1.3 and earlier).

31 26 25 24 23 22 21 20 19 18 17 16

R0011000

Cache

C01

15 14 13 11 10 8 7 6 5 4 1 0

NoPC

Trace 0 011 001 1 0 0 0000 1

3-40 Programmer’s Model

10 ASID Size [22:21]

This ﬁeld is hardwired to 0b10, which speciﬁes an 8-bit

ASID size.

0 Complex Break Support 20

This bit is hardwired to 0 to indicate that the EZ4021-FC

does not support complex break.

0 Physical Address Width 19

This bit is hardwired to 0 to indicate that the EZ4021-FC

has 32-bit addressing.

DCacheC Data Cache Coherency 18

This bit connects to the VCED_ENABLEP input signal,

which is tied to 0. Since the DCacheC bit is always 0, it

indicates that the EJTAG debug solution in the

EZ4021-FC does not maintain data cache coherency with

EJTAG-initiated DMA operations. Before doing an EJTAG

DMA, LSI Logic recommends that you issue CACHE Hit

Write-Back Invalidate instructions to properly ﬂush all

occurrences of the DMA target line from the data cache.

0 Instruction Cache Coherency 17

This bit is hardwired to 0 to indicate that the EJTAG

debug solution in the EZ4021-FC does not maintain

instruction-cache coherency with EJTAG-initiated DMA

operations. Before doing an EJTAG DMA, LSI Logic

recommends that you issue CACHE Hit Invalidate

instructions to properly ﬂush all occurrences of the DMA

target line from the instruction cache.

1 MIPS16 Support 16

This bit is hardwired to 1 to indicate that the EZ4021-FC

supports the MIPS16 debug features. Although the

EZ4021-FC does not execute the MIPS16 ASE, hardware

registers and data output formats are consistent with

implementation of the MIPS16 ASE.

NoPCTrace No PC Trace Support 15

This bit indicates whether PC Trace is enabled or

disabled. When the DT_PCTEN input signal is driven

LOW, it disables PC Trace and sets this bit to 1. When

DT_PCTEN is HIGH, it enables PC Trace and clears this

bit.

EJTAG Debugging 3-41

0 No EJTAG DMA Support 14

This bit is hardwired to 0 to indicate that the EZ4021-FC

supports DMA with EJTAG.

011 Trace PC Width [13:11]

This ﬁeld is hardwired to 0b011, which speciﬁes an 8-bit

PC Trace width.

001 PCST Width and DCLK Division Factor [10:8]

This ﬁeld is hardwired to 0b001, which speciﬁes a 6-bit

PCST width and a DCLK division factor of 2.

1 No Processor Bus Break Support 7

This bit is hardwired to 1 to specify that the EZ4021-FC

does not support the Processor Bus Break.

0 No Data Break Support 6

This bit is hardwired to 0 to specify that the EZ4021-FC

supports the Data Break.

0 No Instruction Address Break Support 5

This bit is hardwired to 0 to specify that the EZ4021-FC

supports the Instruction Address Break.

0000 Obsolete Field [4:1]

This ﬁeld is hardwired to 0.

1 MIPS 32-Bit or 64-Bit 0

This ﬁeld is hardwired to 1 to specify that the EZ4021-FC

is a 64-bit machine (data).

3.3.2.5 EJTAG Address Register (EAR)

The EAR has no initialization value and has read/write access.

Figure 3.29 shows the register format.

Figure 3.29 EJTAG Address Register (EAR)

EA EJTAG Address [31:0]

This register contains either the address for an

EJTAG-initiated DMA or, for a processor access of probe

memory.

31 0

3-42 Programmer’s Model

3.3.2.6 EJTAG Data Register (EDR)

The EDR has no initialization value and has read/write access.

Figure 3.30 shows the register format.

Figure 3.30 EJTAG Data Register (EDR)

ED EJTAG Data [63:0]

This register holds data destined for the probe due to an

EJTAG-initiated DMA load or processor-initiated probe

store. The register also can hold data from the probe due

to an EJTAG-initiated DMA store or processor-initiated

load from probe space.

3.3.2.7 EJTAG Control Register (ECR)

The ECR controls operation of the hardware resources accessible by the

EJTAG probe. In addition, the ECR contains status information as well

as hardware semaphores that are polled to determine real-time status.

The ECR has an initialization value of

0b0000.0000.0x10.0000.0000.0000.0000.0000,

where x is don’t care.

ECR access is deﬁned individually for each bit or ﬁeld in the register.

Figure 3.31 shows the register format.

63 32

31 0

EJTAG Debugging 3-43

Figure 3.31 EJTAG Control Register (ECR)

R Reserved [31:29], 27, 6

These bits are hardwired to 0s and read as 0s. The

EZ4021-FC ignores attempts to set these bits. However,

software should write 0s to them to ensure compatibility

with future versions of the software. These bits have

read-only access.

DNM DMA Normal Memory Access 28

Processor accesses to locations 0xFF20.0000–

0xFF3F.FFFF map to the EJTAG registers of the EJTAG

Memory module only in Debug mode; in normal mode,

these accesses go to normal memory. Valuable data may

therefore reside in the normal memory at those

addresses that the debug software must access. The

DMA must have access to the real memory, not the

debug overlay. When set, this bit allows the probe-based

DMA to access the normal memory at locations

0xFF20.0000–0xFF3F.FFFF. When cleared to 0, the

EJTAG probe or the EJTAG registers claim the DMA

access to this address range.

Software should set this bit just before the DMA requires

access to normal memory, and clear it just afterward.

This bit has read/write access.

PCASID ASID Output During PC Trace 26

When this bit is set to 1, PC Trace outputs an 8-bit ASID

as an extension to the program count. The 8-bit ASID

ﬁeld follows the 31-bit PC. When the PCASID bit is

cleared, PC Trace does not output the ASID after the

program count. This bit has read/write access.

00 Target PC Output Length [25:24]

This ﬁeld is hardwired to 0b00, because the EZ4021-FC

supports PC Trace and the address is a 32-bit address

(PhysAW = 0). This ﬁeld has read-only access.

31 29 28 27 26 25 24 23 22 21 20 19 18 17 16

R DNM R PCAS

ID 00 Sync Doze 1 Per

Rst PRnW PrAcc Dma

Acc PrRst

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Prob

En Set

DEV 0Ejtag

Brk Dstrt Derr Drwn Dsz R Dlock Dinc BrkSt TIF TOF ClkEn

3-44 Programmer’s Model

Sync Synchronize PC Trace 23

This bit synchronizes entering PC Trace mode with the

end of a processor instruction fetch from the probe.

Setting this bit to 1 stalls the CPU until the EIR contains

the PC Trace instruction and the TAP controller is in the

Run-Test/Idle state. This bit sets only at the end of a

processor read access. At all other times, attempts by the

probe to set this bit are ignored. Hardware clears this bit

after entering the PC Trace mode, or when the probe

clears it by writing a 0 to the bit. This bit has read/write

access.

Doze Doze State 22

This bit reﬂects whether the CPU is in a sleeping state

caused by execution of a WAITI instruction. This bit

reﬂects the value of the CPU_EC_WAITI signal output

from the EZ4021-FC. This bit has read-only access.

1 Run Cycle 21

This bit is set to 1 because the EZ4021-FC does not have

a halt mode. This bit is not used and is read as 1. The

EZ4021-FC ignores attempts to set this bit. However,

software should write this bit to 1 to ensure compatibility

with future versions of the software. This bit has

read-only access.

PerRst Peripheral Reset 20

Setting this bit to 1 causes the CPU peripherals to reset.

Setting this bit to 1 in the DJ_TCKP domain eventually

sets a similar bit in the PCLKP domain. The reset of the

peripherals is sustained as long as this bit is set.

Software must ensure that the PCLKP domain version of

this signal is asserted for at least 3 clock cycles. This bit

has read/write access.

PRnW Processor Read not Write 19

The processor controls this bit. The bit is HIGH when the

Processor Access to the probe is a write, and it is LOW

when Processor Access to the probe is a read.

PrAcc Processor Access 18

The processor sets this bit to 1 whenever the processor

accesses the probe. The probe must clear this bit to 0 to

acknowledge the end of the transaction. The probe

cannot set this bit. This bit has read/write-0 access.

EJTAG Debugging 3-45

DmaAcc DMA Access 17

The probe sets this bit to 1 whenever a probe-initiated

DMA access starts. The probe clears this bit when the

DMA is completed. This bit has read/write access.

PrRst Processor Reset 16

Setting this bit to 1 causes a Soft Reset to the CPU.

Setting this bit to 1 in the DJ_TCKP domain eventually

sets a similar bit in the PCLKP domain. The reset signal

to the processor is sustained as long as this bit remains

set. Software must ensure that the PCLKP domain

version of this reset signal is asserted for at least 3 clock

cycles. Assertion of this reset is not masked by the MRst

bit in the Debug Control register. This bit has read/write

access.

ProbEn Probe Enable 15

The probe software sets this bit to 1 to indicate that the

probe is present. When the bit is 0, any software

accesses to the probe return 0s on a load or fetch, and

they have no effect on a store. This bit also controls the

Debug Exception Vector location. (See the table below.)

In addition, when this bit is 0, it disables the DCLKP sig-

nal. If this bit is cleared while a probe access is in

progress (for example, a CPU load from the probe), the

access terminates gracefully with invalid data. This bit

has read/write access.

SetDEV Set Debug Exception Vector 14

Setting this bit to 1 overrides the ProbEn bit and forces

the debug exception vector to 0xBFC0.0400. When the

SetDEV bit is cleared, the ProbEn bit determines the

debug exception vector. (See the table above.) The Set-

DEV bit has read/write access.

0 DMA Abort 13

This bit is hardwired to 0 because the EZ4021-FC does

not support aborted DMA requests. Attempts to set this

bit are ignored. This bit has read-only access.

SetDEV ProbEn = 0 ProbEn = 1

SetDEV = 0 0xBFC0.0400 0xFF20.0200

SetDEV = 1 0xBFC0.0400 0xBFC0.0400

3-46 Programmer’s Model

EjtagBrk EJTAG Break 12

When set, this bit causes a debug exception to the CPU.

Any of the following conditions set this bit:

•The probe writes 1 to this bit.

•The probe asserts the DJ_TDIP_DINTN input signal

when in PC Trace mode.

•An external module asserts the DJ_DBGBRKP input

signal.

The probe can only set this bit when the system is not in

debug mode; it cannot clear this bit to 0. Hardware clears

this bit after the debug exception is taken.

If the CPU is in the WAITI state when a debug exception

occurs, the CPU wakes up. This bit has read/write-1

access.

Dstrt DMA Start/Busy 11

The probe writes to this bit to initiate the DMA. All other

registers must be set up before asserting this bit. The

probe can only write a 1 to this register, and only if

DmaAcc (bit 17) is also set; a write of 0 is ignored. After

this bit is set and DMA is initiated, the probe polls this bit

to determine if the DMA has ﬁnished. Once the DMA is

ﬁnished, the hardware clears the bit, which indicates the

DMA completion. This bit has read/write-1 access.

Derr DMA Error 10

The EZ4021-FC sets this bit to 1 if any device reports an

error during a DMA transaction. Typically, this is done for

a bus error condition, which is generated when the BIU

detects a bus error on a DMA transaction. In addition, this

bit is set if an illegal DMA size or alignment is detected.

This bit has read-only access.

Drwn DMA Read/Write Not 9

This bit indicates the transaction type for the next DMA.

When set, it indicates a DMA read is next. When cleared,

it indicates a DMA write is next. This bit has read/write

access.

Dsz Data Transfer Size [8:7]

The bits in this ﬁeld indicate which byte lanes are active

for the DMA or for processor access of the EJTAG probe.

These bits are combined with the endian setting and the

EJTAG Debugging 3-47

three LSBs of the EAR to determine the byte lanes for the

transaction. The bits have the effect shown in

Figure 3.32. All other combinations are reserved. These

bits have read/write access.

Figure 3.32 Byte Lane Signiﬁcance and Dsz Deﬁnition

Dlock DMA Lock 5

When set to 1, this bit indicates that the next DMA

transaction requires a bus lock (to support atomic

operations). For an atomic operation, the BIU asserts a

Quick Bus lock, and the CPU stalls to prevent corruption

of caches, etc. by the CPU. This bit has read/write

access.

Dinc DMA Address Pre-Increment 4

When set, this bit causes the value in the EAR to

increment once by a value of 8. Repetitive increments

require repetitive setting of the bit. The value of the bit is

saved to be read; it is not cleared after the increment.

This bit has read/write access.

000 00

001 00

010 00

011 00

100 00

101 00

110 00

111 00

000 01

010 01

100 01

110 01

000 10

001 10

010 10

011 10

100 10

101 10

110 10

111 10

000 11

010 11

100 11

110 11

111 11

Little Endian Big Endian

63 063 0

EAR

[2:0] Dsz

3-48 Programmer’s Model

BrkSt Break Status 3

This bit is a DJ_TCKP domain version of the DM bit in

the CP0 Debug register. The bit is set upon entering

debug mode, and it is cleared when executing the

DERET instruction. This bit has read-only access.

TIF DMA Test Input Flag 2

If DMA is required for a device not sitting on the bus,

such as a CPU internal register, software must use

semaphores to indicate properly when the DMA takes

place. If data is available in the predeﬁned memory

location, the probe sets the TIF bit. The probe can only

set the TIF bit; it cannot clear it. The TIF bit is only

cleared after the data in the memory location is placed in

the proper location. At this point, the CPU clears the TIF

bit in the Debug Control register. (See page 3-60.) These

two TIF bits are the same, but in different clock domains.

The CPU can only clear the TIF bit; it cannot set the bit.

This bit is also available for generic purposes that are

independent of DMA operations. This bit has

read/write-1 access.

TOF DMA Test Output Flag 1

This bit is similar to the TIF bit, but it is for data transfers

from the CPU to the probe. If data is available in the

predeﬁned memory location, the processor sets the TOF

bit in the Debug Control register. (See page 3-61.) Only

the processor can set the TOF bit, but the processor

cannot clear the bit. This bit is not cleared until after the

probe receives the memory data. At this point, the probe

clears the TOF bit in the ECR. The two TOF bits are the

same, but they are in different clock domains. The probe

can only clear the TOF bit; it cannot set the bit. In

addition, this bit is also available for generic purposes

that are independent of DMA operations. This bit has

read/write-0 access.

ClkEn DCLKP Output Enable 0

This bit controls the EZ4021-FC DCLKP signal output.

When set, the bit enables DCLKP toggling. When

cleared, the bit forces the DCLKP pin to 0. This bit has

read/write access.

EJTAG Debugging 3-49

3.3.3 EJTAG CP0 Registers

The following registers are additions to the System Coprocessor (CP0)

•Debug Register (23) (Debug)

•Debug Exception Program Counter (DEPC) Register (24)

•Debug Exception Save (DESAVE) Register (31)

3.3.3.1 Debug Register (23) (Debug)

The Debug register controls and reports status on debug exceptions.

Typically, the debug exception handler reads and interprets all the bits in

this register when a debug exception occurs. All read-only status bits are

updated every time a debug exception is taken.

In Debug mode, the individual register bits determine register access;

when not in Debug mode, access is read only. Some reserved bits are

always read only.

The Debug register has an initialization value of 0x0000.0000.0000.0000.

Figure 3.33 shows the register format.

3-50 Programmer’s Model

Figure 3.33 Debug Register (23) (Debug)

R Reserved [63:32]

These bits contain different values depending on the

instruction used to access them:

DBD Debug Branch Delay 31

This bit is set to a 1 if a debug exception occurs when

executing an instruction in the branch delay slot. This bit

is never set in conjunction with the DSS bit. (See bit 0.)

This value is held from one debug exception to the next,

even through nondebug operation. This bit has read-only

access.

DM Debug Mode Status 30

This bit is set when a debug exception is taken. It is

cleared upon return from the debug exception (DERET

instruction). When this bit is set, all interrupts (including

NMI) and all exceptions (except reset) are masked,

including TLB exceptions, Bus Error exceptions, and

debug exceptions. In addition, the cache line locking

function is disabled. A copy of this bit is available as the

BrkSt bit (bit 3 of the ECR) and the DT_PCST1 and

63 48

47 32

31 30 29 28 27 16

DBD DM R0 LSNM R0

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

R0 NIS TRS OES TLF BsF R0 SSt ERst 0 DINT DIB DDBS DDBL DBp DSS

Applicable

Instructions Values or R/W Access

MTCO Read-Only Access

DMTCO Read-Only Access

MFCO Contain Sign-Extended Value of DBD (Bit 31)

DMFCO All 0s

EJTAG Debugging 3-51

DT_PCST2 status lines (although these are in different

clock domains). This bit has read-only access.

R0 Reserved and 0 29, [27:15], 9

These bits are hardwired to 0s and read as 0s. The

EZ4021-FC ignores attempts to set these bits. However,

software should write 0s to them to ensure compatibility

with future versions of the software. These bits have

read-only access.

LSNM Load/Store Normal Memory 28

When set to 1, the LSNM bit allows the processor to

access normal memory during Debug mode when

accessing addresses 0xFF20.0000–0xFF3F.FFFF. In

Debug mode, the EJTAG probe or the EJTAG registers

normally intercept these addresses. However, because

these addresses are mapped to real physical memory

during normal mode, the CPU also needs access to real

physical memory during Debug Mode.

The LSNM bit is cleared to 0 upon entering Debug mode,

which causes the EJTAG registers and the EJTAG

Memory module to respond to these addresses. Software

should set this bit before a load or store operation and

clear it immediately afterward. If the bit remains set after

returning to normal mode, the bit has no effect, because

it is used only in Debug mode. In addition, this bit has no

effect on instruction fetches. It is only relevant for loads

and stores. This bit has read/write access.

NIS Nonmaskable Interrupt Status 14

When set, this bit indicates that a nonmaskable interrupt

(NMI) occurred in the same cycle and in the same

instruction as a debug exception. The Status, Cause,

EPC, and BadVAddr registers assume the usual status

after the occurrence of an NMI interrupt, but the address

in the DEPC is not the NMI exception vector address

(0xBFC0.0000). Instead, 0xBFC0.0000 is placed in the

DEPC by the debug exception handler software, after

which processing returns directly from the debug

exception to the NMI interrupt handler. The value is held

from one debug exception to the next, even through

regular operation. This bit has read-only access.

3-52 Programmer’s Model

TRS TLB Reﬁll Exception Status 13

When set, this bit indicates that an (X)TLB Reﬁll

exception occurred in the same cycle and in the same

instruction as a debug exception. The Status, Cause,

EPC, and BadVAddr registers assume the usual status

after the occurrence of an (X)TLB Reﬁll exception, but the

address in the DEPC is not the (X)TLB Reﬁll exception

vector address. Instead, the debug exception handler

places an address (see the table below) in the DEPC,

after which processing returns directly from the debug

exception to the (X)TLB Reﬁll exception handler. The

value is held from one debug exception to the next, even

through regular operation. This bit has read-only access.

OES Other Exception Status 12

When set, this bit indicates that an exception other than

Reset, NMI, or (X)TLB Reﬁll occurred in the same cycle

and in the same instruction as a debug exception. The

Status, Cause, EPC, and BadVAddr registers assume the

usual status after the occurrence of such an exception,

but the address in the DEPC is not the general exception

vector address. Instead, the debug exception handler

places 0xBFC0.0380 (BEV = 1) or 0x8000.0180

(BEV = 0) in the DEPC, after which processing returns

directly from the debug exception to the general-purpose

exception handler. The value is held from one debug

exception to the next, even through regular operation.

This bit has read-only access.

TLF TLB Exception Flag 11

When the debug exception handler is running (DM =1),

this bit is set to 1 if a TLB-related exception occurs during

execution of a load or store instruction. Write 0 to this bit

to clear it; writing a 1 is ignored. This bit has

read/write-0 access.

EXL=0 EXL=1

BEV = 0 0x8000.0000 0x8000.0180

BEV = 1 0xBFC0.0200 0xBFC0.0380

EJTAG Debugging 3-53

BsF Bus Error Exception Flag 10

When the debug exception handler is running (DM = 1),

this bit is set to 1 if a Bus Error exception occurs during

execution of a load or store instruction. Writea0tothis

bit to clear it; writing a 1 is ignored. This bit has

read/write-0 access.

SSt Single Step Enable 8

Setting this bit to 1 enables the single step debug

function. The function is disabled in Debug mode

(DM = 1). Entering Debug mode while SSt is set disables

the single step function, but does not clear the SSt bit at

that time. This bit has read/write access.

ERst EJTAG Reset 7

Setting this bit to 1 resets the EJTAG interface (except

the TAP controller and the EIR), EJTAG memory

interfaces, the hardware break function, and the PC Trace

function. The reset to these modules remains active until

software clears the bit. This bit has read/write access.

0 Debug Complex Break Status 6

This bit is reserved. It is cleared to 0 to indicate that

complex break functionality did not cause the latest

debug exception. The EZ4021-FC ignores attempts to set

this bit. Software should write this bit to 0 to ensure

compatibility with future versions of the software. This bit

has read-only access.

DINT Debug Break Exception Status 5

This bit is set to 1 when an EJTAG Break from the

processor probe causes a debug exception. The bit value

is held from one debug instruction to the next, even

through regular operation. This bit has read-only access.

DIB Debug Instr Address Break Exception Status 4

This bit is set to 1 when an Instruction Address Break

causes a debug exception. The bit value is held from one

debug instruction to the next, even through regular

operation. This bit has read-only access.

DDBS Debug Data Break Store Exception Status 3

This bit is set to 1 when a Data Address Break causes

the debug exception during the execution of a store

instruction. This bit has read-only access.

3-54 Programmer’s Model

DDBL Debug Data Break Load Exception Status 2

This bit is set to 1 when a Data Address Break causes

the debug exception during the execution of a Load

instruction. The bit value is held from one Debug

instruction to the next, even through regular operation.

This bit has read-only access.

DBp Debug Breakpoint Exception Status 1

This bit is set to 1 when an SDBBP instruction causes the

debug exception. The bit value is held from one debug

instruction to the next, even through regular operation.

This bit has read-only access.

DSS Debug Single Step Exception Status 0

This bit is set to 1 when a single step causes the debug

exception. The bit value is held from one debug

instruction to the next, even through regular operation.

The DSS bit never sets in conjunction with the DBD bit.

The DSS bit has read-only access.

3.3.3.2 Debug Exception Program Counter (DEPC) Register (24)

The DEPC register holds the address where processing resumes after

the debug exception routine has ﬁnished, unless the NIS, OES, or TRS

bits of the Debug register are set. (See the Debug register description

for details.) The address in the DEPC register is the virtual address of

the instruction that either caused the debug exception or was executing

at the time of the debug exception. If the instruction is in a branch delay

slot, the virtual address of the immediately preceding branch or jump

instruction is placed into this register. Execution of the DERET instruction

causes a jump to the address in the DEPC.

If the DEPC address points to an SDBBP instruction, the DEPC value

might need to be modiﬁed to avoid re-executing the SDBBP instruction.

If the SDBBP was inserted in place of a regular instruction to cause a

debug break, then replace the SDBBP with the original instruction, and

no adjustment of the DEPC value is required.

If the DEPC is both written from software (by MTC0) and by hardware

(debug exception), then the DEPC holds the value generated by the

hardware.

The DEPC has no initialization value.

EJTAG Debugging 3-55

The DEPC has read/write access in debug mode and read-only access

in nondebug mode. Some reserved bits are read only.

Figure 3.34 shows the register format.

Figure 3.34 Debug Exception Program Counter (DEPC) Register (24)

R Reserved [63:32]

These bits contain different values depending on the

instruction used to access them:

DEPC Debug Exception Program Counter [31:2]

These bits contains the virtual address of the instruction

executing at the time of the debug instruction or the

address of the immediately preceding branch or jump. If

the TRS, OES, or NIS bit in the Debug register is set, an

interpreted value must be placed in the DEPC instead.

RS Reserved Special 1

This bit is reserved and not hardwired. It is cleared to 0

after the ﬁrst debug exception. This bit has meaning in

other EJTAG implementations, so software should write

this bit to 0 to ensure compatibility with future versions of

the software. Maintaining a value of X or setting this bit

to 1 can cause undeﬁned operation.

DEI Debug Exception ISA Mode 0

This bit is reserved and not hardwired. It is cleared to 0

after the ﬁrst debug exception. This bit has meaning in

63 32

31 21 0

DEPC RS DEI

Applicable

Instructions Values and R/W Access

MTCO Read-Only Access

DMTCO Read-Only Access

MFCO Contain Sign-Extended Value of Bit 31

(Bits [63:32])

DMFCO All 0s (Bits [63:32])

3-56 Programmer’s Model

other EJTAG implementations, so software should write

this bit to 0 to ensure compatibility with future versions of

the software. An attempt to set this bit to 1 can cause

undeﬁned operation.

3.3.3.3 Debug Exception Save (DESAVE) Register (31)

To make sure the debug exception handler is noninvasive, the entire

General Purpose registers (GPR) set must be saved to memory before

the handler executes. The debug exception handler uses the DESAVE

address where the debug exception handler saves the remaining context

in a predetermined memory area. The DESAVE register enables safe

debugging of exception handlers and other code in applications that do

not have a valid stack for context saves.

The DESAVE register has no initialization value.

The register has read/write access in debug mode, and read-only access

in nondebug mode. Figure 3.35 shows the register format.

Figure 3.35 Debug Exception Save (DESAVE) Register (31)

DESAVE Debug Exception Save Register [63:0]

The debug exception handler uses this register to save

one of the GPRs.

63 32

DESAVE

31 0

DESAVE

EJTAG Debugging 3-57

Bits [63:32] of this register contain different values

depending on the instruction used to access them as

shown in the following table.

3.3.4 EJTAG Memory Mapped Registers

Table 3.3 lists the EJTAG memory-mapped, 64-bit registers. These

registers contain the data, address, control, and status of the break

channels. Only the processor can access these registers when executing

in Debug mode, but the EJTAG probe can access these registers at any

time using DMA.

The registers are noncached memory locations, although they fall into

the kseg3 area. The virtual base address is the same as the physical

base address (0xFF30.0000), plus the offset shown in Table 3.3.

If an undeﬁned register address within this address space is accessed

and the processor is in debug mode, the result is undeﬁned.

Note: Some addresses that are unused on the EZ4021-FC have

meaning in other EJTAG solutions. To assure correct

operation on current and future systems, software should

avoid writing to these registers because it can cause

unexpected operation. If a write cannot be avoided,

Applicable

Instructions Values and R/W Access

MTCO Write all 64 bits

DMTCO Write all 64 bits

MFCO Bits 63:32 contain sign-extended value of bit 31

DMFCO Bits 63:32 are read directly

3-58 Programmer’s Model

LS Logic recommends a write of all inactive register values

as deﬁned by the MIPS EJTAG Speciﬁcation.

Table 3.3 Memory-Mapped Registers

Description Mnemonic Address

Debug Control Register DCR 0xFF30.0000

Instruction Address Break Status IBS 0xFF30.0008

Data Address Break Status DBS 0xFF30.0010

... ... ...

Instruction Address Break 0 IBA0 0xFF30.0100

Instruction Address Break Control 0 IBC0 0xFF30.0108

Instruction Address Break Mask 0 IBM0 0xFF30.0110

Instruction Address Break 1 IBA1 0xFF30.0118

Instruction Address Break Control 1 IBC1 0xFF30.0120

Instruction Address Break Mask 1 IBM1 0xFF30.0128

Instruction Address Break 2 IBA2 0xFF30.0130

Instruction Address Break Control 2 IBC2 0xFF30.0138

Instruction Address Break Mask 2 IBM2 0xFF30.0140

Instruction Address Break 3 IBA3 0xFF30.0148

Instruction Address Break Control 3 IBC3 0xFF30.0150

Instruction Address Break Mask 3 IBM3 0xFF30.0158

... ... ...

Data Address Break 0 DBA0 0xFF30.0300

Data Address Break Control 0 DBC0 0xFF30.0308

(Sheet 1 of 2)

EJTAG Debugging 3-59

3.3.4.1 Debug Control Register (DCR)

The DCR is part of the debug control mechanism that allows the

processor and DMA to control debug operations.

The DCR has an initialization value of

0b0000.0000.0000.0000.0000.0000.0000.0000.00x0.0000.0000.0000.

0000.0000.0001.1110, where x is don’t care.

The processor can access the DCR register only in Debug mode.

Processor access requires using doubleword operations (such as LD or

SD). Access is undeﬁned for operations that are less than a doubleword.

In either normal or Debug mode, the probe can do a DMA of this register

when the DNM bit in the EJTAG Control register is cleared. In Debug

mode bit access is deﬁned individually. Figure 3.36 shows the register

format.

Data Address Break Mask 0 DBM0 0xFF30.0310

Data Value Break 0 DB0 0xFF30.0318

Data Address Break 1 DBA1 0xFF30.0320

Data Address Break Control 1 DBC1 0xFF30.0328

Data Address Break Mask 1 DBM1 0xFF30.0330

Data Value Break 1 DB1 0xFF30.0338

Table 3.3 Memory-Mapped Registers (Cont.)

Description Mnemonic Address

(Sheet 2 of 2)

3-60 Programmer’s Model

Figure 3.36 Debug Control Register (DCR)

R Reserved [63:32], 30, [28:7], 1

These bits are hardwired to 0s and read as 0s. The

EZ4021-FC ignores attempts to set these bits. However,

software should write 0s to these bits to ensure

compatibility with future versions of the software. These

bits have read-only access.

DZS Doze Status 31

The DZS bit indicates whether the EZ4021-FC was

sleeping due to a WAITI instruction when the debug

exception was taken. This bit has read-only access.

ENM Endian Setting 29

The ENM bit indicates the default endian setting. This bit

has read-only access.

TIF Test Input Full 6

When set, this bit indicates that a Probe DMA write ﬁlled

a predeﬁned memory location (test input) that is known

only to software. The processor can now read this

memory location and write a 0 to this bit to indicate that

the data was received. A write of 1 is ignored. This bit is

one-half of the TIF mechanism, because the ECR also

contains a TIF bit.

This bit has read/write-0 access.

63 32

31 30 29 28 7 6 5 4 3 2 1 0

DZS R ENM R TIF TOF MInt MNmi MP R TM

DZS Description

1 WAITI Active

0 WAITI Not Active

ENM Description

0 Little Endian

1 Big Endian

EJTAG Debugging 3-61

TOF Test Output Full 5

When set, this bit indicates the CPU has ﬁlled a

predeﬁned memory location (test output) that is known

only to software. The EJTAG probe can read this memory

location.

The processor can write a 1 to the TOF bit to indicate it

initialized the memory location. Writing a 0 is ignored.

The ECR also contains a TOF bit, which is the other half

of the TOF mechanism. This bit has read/write-1 access.

MInt Mask Interrupts 4

Setting MInt to 1 enables the EZ4021-FC interrupt inputs

(int[5:0]). Clearing this bit to 0 disables the EZ4021-FC

interrupt inputs (int[5:0]). In debug mode, the EZ4021-FC

masks all interrupt inputs. This bit has read/write access.

MNmi Mask Nonmaskable Interrupt 3

Setting MNmi to 1 enables the NMI interrupt input.

Clearing the bit disables the NMI interrupt input. This bit

only applies during nondebug mode. In debug mode, the

NMI is masked. This bit is read/write.

MP Memory Protection 2

In Debug mode, setting the MP bit to 1 inhibits writes to

EJTAG memory-mapped registers or EJTAG-reserved

areas (0xFF20.0000–0xFF3F.FFFF), except to the Debug

Control register. Clearing this bit to 0 in Debug mode

enables writes to these registers and reserved areas. In

normal mode, the MP bit can be set or cleared, but the

state of the bit has no effect. This bit has read/write

access.

TM Trace Mode 0

Setting this bit to 1 enables sending out the complete PC

address as trace information on the DJ_TDOP_TPCP

and DT_TPCLP[6:0] pins. In this case, real-time

operation of the CPU cannot be guaranteed because

pipeline stalls may be needed to output the complete

address. When this bit is cleared, the PC trace

information goes out in real time, but the output may be

incomplete. This bit has read/write access.

3-62 Programmer’s Model

3.3.4.2 Instruction Address Break Status (IBS)

The IBS register contains the status of the four possible Instruction

Breakpoints (BS3, BS2, BS1, and BS0).

The IBS has an initialization value of 0x0000.0000.4400.0000.

The processor can access the IBS register only in Debug mode.

Processor access requires using doubleword operations (such as LD or

SD). Access is undeﬁned for operations that are less than a doubleword.

If the MP bit in the DCR register is set, processor writes in Debug mode

have no effect. In either normal or Debug mode, the probe can do a DMA

of this register when the DNM bit in the EJTAG Control register is

cleared. In Debug mode, bit access is deﬁned individually. Figure 3.37

shows the register format.

Figure 3.37 Instruction Address Break Status (IBS) Register

R Reserved [63:31], [29:28], [23:4]

These bits are hardwired to 0s and read as 0s. The

EZ4021-FC ignores attempts to set these bits. However,

software should write 0s to them to ensure compatibility

with future versions of the software. These bits have

read-only access.

1 ASID Support in Instruction Break 30

This bit is hardwired to 1. It indicates that the EZ4021-FC

supports comparison of the ASID value in Instruction

Address Break to allow debug and breakpoints in a

multitasking environment.

0100 Break Channel Number [27:24]

These bits indicate the total number of channels

implemented for an instruction address break. The

EZ4021-FC supports four instruction address break

channels, so it returns a value of 0b0100. These bits

have read-only access.

63 32

31 30 29 28 27 24 23 4 3 2 1 0

R 1 R 0100 R BS3 BS2 BS1 BS0

EJTAG Debugging 3-63

BS3 Break Status Channel 3 3

When BS3 is set, it indicates that an instruction address

break or instruction address trigger occurred for

channel 3. To clear this bit to 0, write a 0 to BS3. Writing

a 1 has no effect. This bit has read/write access.

BS2 Break Status Channel 2 2

When BS2 is set, it indicates that an instruction address

break or instruction address trigger occurred for

channel 2. To clear this bit to 0, write a 0 to BS2. Writing

a 1 has no effect. This bit has read/write access.

BS1 Break Status Channel 1 1

When BS1 is set, it indicates that an instruction address

break or instruction address trigger occurred for

channel 1. To clear this bit to 0, write a 0 to BS1. Writing

a 1 has no effect. This bit has read/write access.

BS0 Break Status Channel 0 0

When BS0 is set, it indicates that an instruction address

break or instruction address trigger occurred for

channel 0. To clear this bit to 0, write a 0 to BS0. This bit

has read/write access.

3.3.4.3 Instruction Address Break n Registers (IBAn)

These registers contain the upper 31 bits of the instruction break

address, which is a virtual address. There are four registers, one for each

instruction address break channel.

The IBAn registers have no initialization value.

The processor can access the IBAn registers only in Debug mode.

Processor access requires using doubleword operations (such as LD or

SD). Access is undeﬁned for operations that are less than a doubleword.

In Debug mode, all bits except the reserved bits have read/write access.

If the MP bit in the DCR register is set, processor writes in Debug mode

have no effect. In either normal or Debug mode, the probe can do a DMA

of these registers when the DNM bit in the EJTAG Control register is

cleared. Figure 3.38 shows the register format.

3-64 Programmer’s Model

Figure 3.38 Instruction Address Break n Register (IBAn)

R Reserved [63:32], 0

These bits are hardwired to 0s and read as 0s. The

EZ4021-FC ignores attempts to set these bits. However,

software should write 0s to them to ensure compatibility

with future versions of the software. These bits have

read-only access.

IBA Instruction Break Address [31:2]

This ﬁeld contains the 30-bit instruction break address,

which is a virtual address. These bits are read/write.

RS Reserved Special 1

The RS bit is reserved and not hardwired. This bit has

meaning in other EJTAG implementations, so software

should write this bit to 0 to ensure compatibility with

future versions of the software. Trying to set this bit to 1

can cause undeﬁned operation. This bit has read/write

access.

3.3.4.4 Instruction Address Break Control n Registers (IBCn)

These registers select the instruction address match function to enable

debug break or trace trigger. There are four IBCn registers, one for each

Instruction Address Break channel.

These registers have an initialization value of 0x0000.0000.0000.0000.

The processor can access the IBCn registers only in Debug mode.

Processor access requires using doubleword operations such as LD or

SD. Access is undeﬁned for operations that are less than a doubleword.

If the MP bit in the DCR register is set, processor writes in Debug mode

have no effect. In either normal or Debug mode, the probe can do a DMA

of these registers when the DNM bit in the EJTAG Control register is

cleared. In Debug mode all bits have read/write access except the

reserved bits. Figure 3.39 shows the register format.

63 32

31 10

IBA RS R

EJTAG Debugging 3-65

Figure 3.39 Instruction Address Break Control n Register (IBCn)

R Reserved [63:32], [22:3], 1

These bits are hardwired to 0s and read as 0s. The

EZ4021-FC ignores attempts to set these bits. However,

software should write 0s to them to ensure compatibility

with future versions of the software. These bits have

read-only access.

ASID ASID Value [31:24]

This ﬁeld contains a value that is compared with the PID

information from the MMU to qualify an instruction

address break. This ﬁeld has read/write access.

ASIDuse ASID Use in Break 23

Setting this bit to 1 enables comparison of the value in

the ASID ﬁeld with the PID information from the MMU to

qualify the instruction break address. When this bit is

cleared, it disables the ASID-to-PID comparison. This bit

has read/write access.

TE Trace Trigger Enable 2

Setting this bit to 1 enables the instruction address trace

trigger function. Clearing this bit to 0 disables the

instruction address trace trigger function. This bit has

read/write access.

If the trace trigger function is enabled, and the CPU

virtual instruction address matches the address set by

the IBAn and IBMn registers, the trace trigger information

– TST (0b010) or TSQ (0b001) – is output to the

DT_PCST2[2:0] or DT_PCST1[2:0] pins. In addition the

BSn bit in the Instruction Address Break Status register

is set.

When an address match occurs with both BE and TE

equal to 1, the Instruction Address break exception is

taken after the trace trigger information is output to the

DT_PCST2[2:0] or DT_PCST1[2:0] pins.

63 32

31 24 23 22 3 2 1 0

ASID ASIDuse R TE R BE

3-66 Programmer’s Model

BE Break Enable 0

Setting this bit to 1 enables the instruction address break

function. Clearing this bit to 0 disables the instruction

address break function. This bit has read/write access.

If the instruction address break function is enabled, and

the CPU virtual instruction address matches the address

set by the IBAn and IBMn registers, the hardware

generates a debug exception to the CPU. The BSn bit in

the Instruction Address Break Status register sets to 1,

which indicates the cause of the debug exception.

3.3.4.5 Instruction Address Break Mask n Registers (IBMn)

These four registers specify the mask values that apply to each

corresponding Instruction Address Break register.

These registers have no initialization value.

The processor can access the IBMn registers only in Debug mode.

Processor access requires using doubleword operations such as LD or

SD. Access is undeﬁned for operations that are less than a doubleword.

If the MP bit in the DCR register is set, processor writes in Debug mode

have no effect. In either normal or Debug mode, the probe can do a DMA

of these registers when the DNM bit in the EJTAG Control register is

cleared. In Debug mode all register bits except the reserved bits have

read/write access. Figure 3.40 shows the register format.

Figure 3.40 Instruction Address Break Mask n Registers (IBMn)

R Reserved [63:32], 0

These bits are hardwired to 0s and read as 0s. The

EZ4021-FC ignores attempts to set these bits. However,

software should write 0s to them to ensure compatibility

with future versions of the software. These bits have

read-only access.

63 32

31 210

IBM RS R

EJTAG Debugging 3-67

IBM Instruction Address Break Mask [31:2]

This ﬁeld contains the 30-bit instruction address break

mask. Each bit corresponds to a bit in the address

EZ4021-FC compares the corresponding address bit in

the IBAn register with the CPU virtual address bit. When

a mask bit is set, the corresponding IBAn address bit is

masked (not compared). These bits have read/write

access.

RS Reserved Special 1

The RS bit is reserved and not hardwired. This bit has

meaning in other EJTAG implementations, so software

should write this bit to 0 to ensure compatibility with

future versions of the software. Trying to set this bit to 1

can cause undeﬁned operation. This bit has read/write

access.

3.3.4.6 Data Address Break Status Register (DBS)

The Data Address Break Status register contains the status of the two

possible Data Breakpoints, BS1 and BS0.

This register has an initialization value of

0b0000.0000.0000.0000.0000.0000.0000.0000.0101.0010.0000.0000.00

00.0000.0000.0000

The processor can access the DBS register only in Debug mode.

Processor access requires using doubleword operations such as LD or

SD. Access is undeﬁned for operations that are less than a doubleword.

If the MP bit in the DCR register is set, processor writes in Debug mode

have no effect. The probe can do a DMA of these registers in either

Debug or normal mode when the DNM bit in the EJTAG Control register

is cleared. In Debug mode the bits in this register are deﬁned individually.

Figure 3.41 shows the register format.

3-68 Programmer’s Model

Figure 3.41 Data Address Break Status Register (DBS)

R Reserved [63:31], 29, [23:2]

These bits are hardwired to 0s and read as 0s. The

EZ4021-FC ignores attempts to set these bits. However,

software should write 0s to them to ensure compatibility

with future versions of the software. These bits have

read-only access.

1 ASID Support in Data Break 30

This bit is hardwired to 1. It indicates that the EZ4021-FC

supports using the ASID value (DBCn register, bits

31:24) for debugging and breakpoints in a multitasking

environment. This bit has read-only access.

1 Data Break Enhancements 28

This bit is hardwired to 1. It indicates that the EZ4021-FC

implements the data break enhancements. This bit has

read-only access.

0010 Break Channel Number [27:24]

These bits indicate the total number of channels

implemented for a data address break. The bits are

read-only.

The EZ4021-FC supports two data address break

channels and returns a value of 0b0010.

BS1 Break Status Channel 1 1

When set, this bit indicates that a data address break or

data address trigger occurred for channel 1. To clear this

bit to 0, write a 0 to BS1. This bit has read/write-0

access.

BS0 Break Status Channel 0 0

When set, this bit indicates that a data address break or

data address trigger occurred for channel 0. To clear this

bit to 0, write a 0 to BS0. This bit has read/write-0

access.

63 32

31 30 29 28 27 24 23 2 1 0

R 1 R 1 0010 R BS1 BS0

EJTAG Debugging 3-69

3.3.4.7 Data Break Address n Registers (DBAn)

The DBAn registers contain the upper 29 bits of the data break address,

which is a virtual address. There are two registers, one for each data

break channel.

Note that bits [2:0] of this register are tied to 0. It is therefore impossible

to break on an address addressing less than a doubleword of data.

Breaks on partial data are possible with use of the Byte Access Ignores.

These registers have no initialization value.

The processor can access the DBAn register only in Debug mode.

Processor access requires using doubleword operations such as LD or

SD. Access is undeﬁned for operations that are less than a doubleword.

If the MP bit in the DCR register is set, processor writes in Debug mode

have no effect. In either normal or Debug mode, the probe can perform

a DMA of this register when the DNM bit of the EJTAG Control register

is cleared. In Debug mode all the bits in this register except the reserved

bits have read/write access. Figure 3.42 shows the register format.

Figure 3.42 Data Break Address n Registers (DBAn)

R Reserved [63:32], [2:0]

These bits are hardwired to 0s and read as 0s. The

EZ4021-FC ignores attempts to set these bits. However,

software should write 0s to them to ensure compatibility

with future versions of the software. These bits have

read-only access.

These bits are not used in the address comparison

because the EZ4021-FC uses 32-bit addressing.

DBA Data Break Address [31:3]

This ﬁeld contains the 29-bit data break address, which

is a virtual address and is doubleword aligned. These bits

have read/write access.

63 32

31 32 0

DBA R

3-70 Programmer’s Model

3.3.4.8 Data Break Control n Registers (DBCn)

These registers select the data address match function to enable debug

breaks or trace triggers. They also specify byte lane masks for data value

comparison. There are two DBCn registers, one for each data break

channel.

These registers have an initialization value of 0x0000.0000.0000.0000.

The processor can access these registers only in Debug mode.

Processor access requires using doubleword operations (such as LD or

SD). Access is undeﬁned for operations that are less than a doubleword.

If the MP bit in the DCR register is set, Debug mode processor writes

have no effect. In normal or Debug mode, the probe can perform a DMA

of these registers when the DNM bit of the EJTAG Control register is

cleared. In Debug mode all the bits in these registers except the reserved

bits have read/write access. Figure 3.43 shows the register format.

Figure 3.43 Data Break Control n Registers (DBCn)

R Reserved [63:32], 22, [11:3], 1

These bits are hardwired to 0s and read as 0s. The

EZ4021-FC ignores attempts to set these bits. However,

software should write 0s to them to ensure compatibility

with future versions of the software. These bits have

read-only access.

ASID ASID Value [31:24]

This ﬁeld contains a value that is compared with the PID

from the MMU to qualify a data break. This ﬁeld has

read/write access.

ASIDuse ASID Use in Break 23

When set, this bit enables comparison of the value in the

ASID ﬁeld with the PID information from the MMU to

qualify the data break address. When cleared, this bit

disables the ASID-to-PID comparison. This bit has

read/write access.

63 32

31 24 23 22 21 14 13 12 1 3 2 1 0

ASID ASI-

Duse R BAI NoSB NoLB R TE R BE

EJTAG Debugging 3-71

BAI Byte Access Ignored [21:14]

Each bit in this ﬁeld corresponds to a byte of the data

being addressed. The BAI ﬁeld is useful for accessing a

portion of the data at the doubleword address. For

example, when a word consists of four independent

byte-wide control registers, it is desirable to set a break

on writes to only one of the four registers, so the other

three registers are set to be ignored using this ﬁeld.

When set to 1, the corresponding byte access is ignored

and cannot result in a break, even if the data does not

match. When cleared, the corresponding byte access can

result in a break. The bits in this ﬁeld have read/write

access.

NoSB No Store Break 13

This bit disables data break store events. When set, the

Data Break mechanism is disabled for stores, which

results in no data break exceptions or trace triggers on

store instructions.

When cleared, these functions are enabled. This bit has

read/write access.

NoLB No Load Break 12

This bit disables data break load events. When set, the

Data Break mechanism is disabled for loads, which

results in no data break exceptions or trace triggers on

load instructions.

When cleared, these functions are enabled. This bit has

read/write access.

TE Trace Trigger Enable 2

When set, this bit enables the data trace trigger function.

When cleared, this bit disables the data trace trigger

function. This bit has read/write access.

BAI Bit Description

BAI0 Byte Lane D[7:0] of the Data Value

BAI1 Byte Lane D[15:8] of the Data Value

...

BAI7 Byte Lane D[63:56] of the Data

Value

3-72 Programmer’s Model

If the trace trigger function is enabled, and the CPU

virtual data address matches the address set by the

DBAn and DBMn registers, the trace trigger information

– TST (0b010) or TSQ (0b001) – is output to the

DT_PCST2[2:0] or DT_PCST1[2:0] pins. In addition, the

BSn bit in the Data Address Break Status register is set.

When an address match occurs with both BE and TE

equal to 1, the Data Address break exception is taken

after the trace trigger information is output to

DT_PCST2[2:0] or DT_PCST1[2:0] pins.

BE Break Enable 0

When set, this bit enables the data break function. When

cleared, this bit disables the data break function. This bit

has read/write access.

If the data address break function is enabled and the

CPU virtual data address matches the address set by the

DBAn and DBMn registers, the hardware generates a

debug exception to the CPU. The BSn bit in the Data

Address Break Status register, along with the DDBS or

DDBL bits in the Debug register, are set to indicate the

cause of the debug exception.

3.3.4.9 Data Address Break Mask n Registers (DBMn)

These registers specify the mask values that are applied to each

corresponding Data Address Break register. There are two

DBMn registers, one for each data break channel.

These registers have no initialization value.

The processor can access these registers only in Debug mode.

Processor access requires using doubleword operations (such as LD or

SD). Access is undeﬁned for operations that are less than a doubleword.

If the MP bit in the DCR register is set, processor writes in Debug mode

have no effect. In either normal or Debug mode, the probe can do a DMA

of these registers when the DNM bit of the EJTAG Control register is

cleared. In Debug mode all the bits in these registers except the reserved

bits have read/write access. Figure 3.44 shows the register format.

EJTAG Debugging 3-73

Figure 3.44 Data Address Break Mask n Registers (DBMn)

R Reserved [63:32], [2:0]

These bits are hardwired to 0s and read as 0s. The

EZ4021-FC ignores attempts to set these bits. However,

software should write 0s to them to ensure compatibility

with future versions of the software. These bits have

read-only access.

DBM Data Address Break Mask [31:3]

This ﬁeld contains the 29-bit data address break mask.

Each bit corresponds to a bit in the address register

(DBAn). When a mask bit is cleared, the EZ4021-FC

compares the corresponding address bit in the DBAn

bit is set, the corresponding DBAn address bit is masked

(not compared). These bits have read/write access.

3.3.4.10 Data Value Break n Registers (DVBn)

The EZ4021-FC does not implement the data value comparison of the

data address break. All registers that support that function are read-only

and tied to 0.

The processor can access these registers only in Debug mode.

Processor access requires using doubleword operations (such as LD or

SD). Access is undeﬁned for operations that are less than a doubleword.

If the MP bit in the DCR register is set, processor writes in Debug mode

have no effect. In either normal or Debug mode, the probe can do a DMA

of these registers when the DNM bit of the EJTAG Control register is

cleared. In Debug mode all the bits in these registers are read/write.

Figure 3.45 shows the register format.

63 32

31 32 0

DBM R

3-74 Programmer’s Model

Figure 3.45 Data Value Break n Registers (DVBn)

R Reserved [63:0]

These bits are hardwired to 0 and read as 0s. The

EZ4021-FC ignores attempts to set these bits. These bits

have read-only access.

3.4 System Conﬁguration Register 1

This read/write EZ4021-FC System Conﬁguration register 1 is a

memory-mapped register that allows for easy conﬁguration of

programmable system features. The lower word, bits [31:0], is output on

the DHQ_SCR1[31:0] pins. Connect these output signals to system-level

or EZ4021-FC conﬁguration pins.

The initialization value of this register is 0x0000.0000.0000.FFFF.

Figure 3.46 shows the register format.

Figure 3.46 System Conﬁguration Register 1

SCR1 System Conﬁguration [63:0]

This register is located at physical address 0x1EFF.FFF0.

Only the EZ4021-FC can read or write to the SCR1 reg-

ister, and it must access the register using kseg1

63 32

31 0

63 32

SCR1

31 0

SCR1

System Conﬁguration Register 1 3-75

addresses per the table below. The upper word, bits

[63:32], is reserved for future use.

Access Type Big Endian

Conﬁg[15] Address

LW or SW 0 0xBEFF.FFF0

LW or SW 1 0xBEFF.FFF4

LD or SD x 0xBEFF.FFF0

3-76 Programmer’s Model

MiniRISC EZ4021-FC EasyMACRO Microprocessor 4-1
Chapter 4
Instruction Set
Architecture
This chapter provides the formats for the MIPS III ISA and describes the
different instructions. It contains the following sections:
•Section 4.1, “Instruction Set Formats”
•Section 4.2, “Load and Store Instructions”
•Section 4.3, “Computational Instructions”
•Section 4.4, “Jump and Branch Instructions”
•Section 4.5, “Exception Instructions”
•Section 4.6, “Serialization Instruction”
•Section 4.7, “Coprocessor Instructions”
•Section 4.8, “Cache Maintenance Instruction”
•Section 4.9, “EZ4021-FC Instruction Extensions”
•Section 4.10, “CPU 32-Bit Instruction Opcode Encoding”
4.1 Instruction Set Formats
Every instruction consists of a single word (32 bits) aligned on a word
boundary. Figure 4.1 shows the three instruction formats:
I-type
(immediate),
J-type
(jump), and
R-type
(register). This restricted format
approach simpliﬁes instruction decoding. The compiler and assembler
can synthesize more complicated operations and addressing modes.

4-2 Instruction Set Architecture

Figure 4.1 Instruction Format

4.2 Load and Store Instructions

Load and Store are I-type instructions that move data between memory

and general-purpose registers. The only addressing mode directly

supported in the base R-Series architecture is base register plus 16-bit,

signed immediate offset.

4.2.1 Scheduling a Load Delay Slot

delayed load

instruction is a load instruction whose result cannot be

used by the instruction that immediately follows it.

The instruction slot immediately following a delayed load instruction is

called the

load delay slot

In the EZ4021-FC processor, the instruction immediately following a load

instruction can use the contents of the loaded register; however, in such

cases, hardware interlocks insert additional real cycles. Consequently,

I-Type (Immediate)

immediateop rs rt

J-Type (Jump)

31 26 25 21 20 16 15

031 26 25

target

R-Type (Register)

031 26 25 21 20 16 15 11 10 6 5

op rs rt rd shamt funct

op 6-bit operation code

rs 5-bit source register speciﬁer

rt 5-bit target (source/destination register)

immediate 16-bit immediate, branch displacement, or address displacement

target 26-bit jump target address

rd 5-bit destination register speciﬁer

shamt 5-bit shift amount

funct 6-bit function ﬁeld

Load and Store Instructions 4-3

scheduling load delay slots is desirable, both for performance and for

compatibility with older MIPS R-Series processors. However, scheduling

load delay slots is not required.

4.2.2 Deﬁning Access Types

The load/store instruction opcode determines the access type, which in

turn indicates the size of the data item to be loaded or stored.

Regardless of access type or byte-numbering order (endian setting), the

address speciﬁes the byte that has the smallest byte address of all the

bytes in the addressed ﬁeld. For a big-endian machine, this byte is the

most-signiﬁcant (left most) byte; for a little-endian machine, it is the

least-signiﬁcant (right most) byte.

As Figure 4.2 shows, the access type and the 3 low-order bits of the

address determine which bytes within the addressed word are used.

Note that certain combinations of access type and low-order address bits

can never occur; only the combinations shown in Figure 4.2 are

permitted.

4-4 Instruction Set Architecture

Figure 4.2 Byte Speciﬁcations for Loads/Store

111

110

Data Bus

63 0 63 0

MSB LSBLSB MSB

Byte Numbers Byte Numbers

Low-Order

Address Bits

A2 A1 A0

Access

Type

Doubleword

Word

Tribyte

Halfword

Byte

Bytes Accessed Bytes Accessed

000

001

010

011

100

101

000

010

100

110

000

001

100

101

000

Little EndianBig Endian

76543210

100

76543210

Septibyte 000

001

Sextibyte 000

010

Quintibyte 000

011

Load and Store Instructions 4-5

4.2.3 CPU Loads and Stores

There are different types of load and store instructions. The purpose of

the different types are as follows:

•Transferring various sized ﬁelds (for example, LB or SW)

•Trading transferred data as signed or unsigned integers (for example,

LHU)

•Accessing unaligned ﬁelds (for example, LWR or SWL)

•Performing atomic memory updates (read-modify-write, for example,

LL/SC)

Signed and unsigned integers of different sizes are supported by loads

that either sign-extend or 0-extend the data loaded into the register.

Table 4.1 describes the normal load and store instructions that the

EZ4021-FC supports. The syntax for each instruction is shown in a

typeface that differs from the surrounding text; for example, the Load

Byte operation is shown as LB rt, offset(base).

4-6 Instruction Set Architecture

Table 4.1 Normal CPU Load/Store Instructions

Instruction Format and Description

Load Byte LB rt, offset(base) MIPS I

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Sign-extend the contents of the addressed byte and load the result into rt.

Load Byte

Unsigned LBU rt, offset(base) MIPS I

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Zero-extend the contents of the addressed byte and load the result into rt.

Load

Doubleword LD rt, offset(base) MIPS III

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Load the addressed doubleword into rt.

Load Halfword LH rt, offset(base) MIPS I

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Sign-extend the contents of the addressed halfword and load the result

into rt.

Load Halfword

Unsigned LHU rt, offset(base) MIPS I

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Zero-extend the contents of the addressed halfword and load the result

into rt.

Load Word LW rt, offset(base) MIPS I

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Sign-extend the contents of the addressed word and load the result into

rt.

Load Word

Unsigned LWU rt, offset(base) MIPS III

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Load the addressed word into rt.

Store Byte SB rt, offset(base) MIPS I

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Store the least-signiﬁcant byte of register rt at the addressed location.

Store

Doubleword SD rt, offset(base) MIPS III

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Store the contents of register rt at the addressed location.

Store Halfword SH rt, offset(base) MIPS I

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Store the least-signiﬁcant halfword of register rt at the addressed

location.

Store Word SW rt, offset(base) MIPS I

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Store the least-signiﬁcant word of register rt at the addressed location.

Load and Store Instructions 4-7

A pair of special instructions make it possible to load or store unaligned

words and doublewords in only two instructions. The load instructions

read the left-side or right-side bytes (left or right side of register) from an

aligned word and merge them into the correct bytes of the destination

delay slot, permits LWL and LWR instructions that target the same

destination register to execute sequentially. Store instructions select the

correct bytes from a source register and update only those bytes in an

aligned memory word (or doubleword).

Table 4.2 describes the unaligned load and store instructions that the

EZ4021-FC supports.

4-8 Instruction Set Architecture

Table 4.2 Unaligned CPU Load/Store Instructions

Instruction Format and Description

Load

Doubleword

Left

LDL rt, offset(base) MIPS III

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Shift the addressed doubleword left so that the addressed byte is the

rightmost byte of a doubleword. Merge the bytes from memory with the contents of

Load

Doubleword

RIght

LDR rt, offset(base) MIPS III

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Shift addressed doubleword right so that the addressed byte is the

leftmost byte of a doubleword. Merge bytes from memory with contents of register

rt and load the result into register rt.

Load Word

Left LWL rt, offset(base) MIPS I

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Shift the addressed word left so that the addressed byte is the leftmost

byte of a word. Merge the bytes from memory with the contents of register rt and

load the sign-extended result into register rt.

Load Word

Right LWR rt, offset(base) MIPS I

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Shift the addressed word right so that the addressed byte is the rightmost byte

of a word. Merge the bytes from memory with the contents of register rt and load the

sign-extended result into register rt.

Store

Doubleword

Left

SDL rt, offset(base) MIPS III

Sign-extend the 16-bit offset and add to the contents of register base to form address.

Shift the contents of register rt left so that the leftmost byte of the doubleword is in the

position of the addressed byte. Store the doubleword containing the shifted bytes into

the doubleword at the addressed byte.

Store

Doubleword

Right

SDR rt, offset(base) MIPS III

Sign-extend the 16-bit offset and add to the contents of register base to form address.

Shift contents of register rt right so that the rightmost byte of the doubleword is in the

position of the addressed byte. Store the doubleword containing the shifted bytes into

the doubleword at the addressed byte.

Store Word

Left SWL rt, offset(base) MIPS I

Sign-extend the 16-bit offset and add to the contents of register base to form address.

Shift the contents of register rt left so that the leftmost byte of the word is in the position

of the addressed byte. Store the word containing the shifted bytes into the word at the

addressed byte.

Store Word

Right SWR rt, offset(base) MIPS I

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Shift the contents of register rt right so that the rightmost byte of the word

is in the position of the addressed byte. Store the word containing the shifted bytes

into the word at the addressed byte.

Load and Store Instructions 4-9

4.2.4 Atomic Update Loads and Stores

The paired instructions, Load Linked and Store Conditional, can perform

read-modify-writes of word and doubleword cached memory locations.

When used in carefully-coded sequences, these instructions provide one

of several synchronization primitives, including test-and-set, bit-level

locks, semaphores, and sequencers/event counters.

The LL and SC block size is 1 doubleword, and the data must be either

uncached or cached coherent. Cached coherent means cached with

write-through store updates.

Table 4.3 describes the atomic update CPU load and store instructions

that the EZ4021-FC supports.

4.2.5 Coprocessor Loads and Stores

The coprocessor load and store instructions are included here instead of

the coprocessor instruction group (page 4-24) because it is more useful

to include all load and store instructions in the same section.

If a particular coprocessor is not enabled, any loads and stores to that

processor cannot execute and instead cause a Coprocessor Unusable

exception.

Table 4.3 Atomic Update CPU Load/Store Instructions

Instruction Format and Description

Load Linked

Word LL rt, offset(base) MIPS II

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Sign-extend the contents of the addressed word and load the result into

rt.

Load Linked

Doubleword LLD rt, offset(base) MIPS III

Sign-extend the 16-bit offset and add to the contents of register base to form

address, and load the addressed doubleword into rt.

Store

Conditional

Word

SC rt, offset(base) MIPS II

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Conditionally store the least-signiﬁcant word of register rt at address,

based on whether the load-link has been “broken.”

Store

Conditional

Doubleword

SCD rt, offset(base) MIPS III

Sign-extend the 16-bit offset and add to the contents of register base to form

address. Conditionally store register rt at address, based on whether the load-link

has been “broken.”

4-10 Instruction Set Architecture

Table 4.4 describes the coprocessor load and store instructions that the

EZ4021-FC supports.

4.3 Computational Instructions

Computational instructions perform signed/unsigned arithmetic, logical,

and shift operations. Computational instructions use both R-type (both

operands are registers) and I-type (one operand is an immediate). There

are four categories of computational instructions:

•ALU Immediate (Table 4.5)

•Three-Operand, Register Type (Table 4.6)

•Shift (Table 4.7)

•Multiply and Divide (Table 4.8)

Table 4.4 Coprocessor Load/Store Instructions

Instruction Format and Description

Load

Doubleword to

Coprocessor

LDCz rt, offset(base) MIPS II

Extends the sign of the 16-bit offset and adds the offset to the contents of the

general register base to form a 32-bit, unsigned effective address. The doubleword

at the memory location speciﬁed is loaded into coprocessor register rt of the

coprocessor unit z.

Load Word to

Coprocessor LWCz rt, offset(base) MIPS I

Extends the sign of the 16-bit offset and adds the offset to the contents of the

general register base to form a 32-bit, unsigned effective address. The word at the

memory location speciﬁed is sign-extended and loaded into coprocessor register rt

of the coprocessor unit z.

Store

Doubleword

from

Coprocessor

SDCz rt, offset(base) MIPS II

Extends the sign of the 16-bit offset and adds the offset to the contents of the

general register base to form a 32-bit, unsigned effective address. The contents of

coprocessor register rt of the coprocessor unit zare stored at the address

speciﬁed by the 32-bit, unsigned effective address.

Store Word

from

Coprocessor

SWCz rt, offset(base) MIPS I

Extends the sign of the 16-bit offset and adds the offset to the contents of the

general register base to form a 32-bit, unsigned effective address. The

least-signiﬁcant word of coprocessor register rt of the coprocessor unit zis stored

at the address speciﬁed by the 32-bit, unsigned effective address.

Computational Instructions 4-11

MIPS I provides for 32-bit integers and 32-bit arithmetic operands.

MIPS III adds 64-bit integers and provides separate arithmetic and shift

instructions for 64-bit operands. Separate instructions for 64-bit logical

operations are not needed, because logical operations are not sensitive

to the register width.

The EZ4021-FC performs twos-complement arithmetic on integers

represented in twos-complement notation. The EZ4021-FC includes

instructions for signed versions of add, subtract, multiply, and divide. The

unsigned

add and subtract operations are actually modulo arithmetic

without overﬂow detection.

4.3.1 ALU

Some arithmetic and logical instructions operate on one operand from a

word. The immediate operand is treated as signed for the arithmetic and

compare instructions, and treated as logical (0-extended to register

length) for the logical instructions.

4-12 Instruction Set Architecture

Table 4.5 describes the ALU instructions with immediate operands

supported by the EZ4021-FC.

Table 4.5 ALU Instructions with an Immediate Operand

Instruction Format and Description

Add Immediate ADDI rt, rs, immediate MIPS I

Add the 16-bit, sign-extended immediate to the 32-bit value in register rs and

place the 32-bit, sign-extended result into register rt. Trap on 32-bit,

twos-complement overﬂow.

Add Immediate

Unsigned ADDIU rt, rs, immediate MIPS I

Add the 16-bit, sign-extended immediate to the 32-bit value in register rs and

place the 32-bit, sign-extended result into register rt. Do not trap on overﬂow.

DoublewordAdd

Immediate DADDI rt, rs, immediate MIPS III

Add the 16-bit, sign-extended immediate to the 64-bit value in register rs and

place the 64-bit result into register rt. Trap on 64-bit, twos-complement

overﬂow.

DoublewordAdd

Immediate

Unsigned

DADDIU rt, rs, immediate MIPS III

Add the 16-bit, sign-extended immediate to the 64-bit value in register rs and

place the 64-bit, sign-extended result into register rt. Do not trap on overﬂow.

AND Immediate ANDI rt, rs, immediate MIPS I

Zero-extend the 16-bit immediate and perform a bit-wise AND with the

contents of register rs. Place the result into register rt.

Load Upper

Immediate LUI rt, immediate MIPS I

The 16-bit immediate is shifted left 16 bits and concatenated with 16 bits of

low-order 0s. The 32-bit result is sign-extended and placed into register rt.

OR Immediate ORI rt, rs, immediate MIPS I

Zero-extend the 16-bit immediate and perform a bit-wise OR with contents of

Set on Less

Than

Immediate

SLTI rt, rs, immediate MIPS I

Compare the 16-bit, sign-extended immediate with register rs as signed

integers. Result=1ifrs is less than immediate; otherwise, the result = 0.

Place the result into register rt.

Set on Less

Than

Immediate

Unsigned

SLTIU rt, rs, immediate MIPS I

Compare the 16-bit, sign-extended immediate with register rs as unsigned

integers. Result = 1 if rs is less than immediate; otherwise the result = 0. Place

the result into register rt.

Exclusive OR

Immediate XORI rt, rs, immediate MIPS I

Zero-extend the 16-bit immediate and perform a bit-wise exclusive OR with the

contents of register rs. Place the result into register rt.

Computational Instructions 4-13

4.3.2 Three-Operand, Register Type

Table 4.6 describes the EZ4021-FC ALU instructions that require three

operands.

Table 4.6 Three-Operand, Register Type Instructions

Instruction Format and Description

Add ADD rd, rs, rt MIPS I

Add the 32-bit contents of registers rs and rt, then place the 32-bit, sign-extended

result into register rd. Trap on 32-bit, twos-complement overﬂow.

Add Unsigned ADDU rd, rs, rt MIPS I

Add the 32-bit contents of registers rs and rt, then place the 32-bit, sign-extended

result into register rd. Do not trap on overﬂow.

AND AND rd, rs, rt MIPS I

Bitwise AND the contents of registers rs and rt, then place the result into register rd.

Doubleword

Add DADD rd, rs, rt MIPS III

Add the 64-bit contents of registers rs and rt, then place the 64-bit result into

Doubleword

Add Unsigned DADDU rd, rs, rt MIPS III

Add the 64-bit contents of registers rs and rt, then place the 64-bit result into

Doubleword

Subtract DSUB rd, rs, rt MIPS III

Subtract the 64-bit contents of register rt from rs, then place the 64-bit result into

Doubleword

Subtract

Unsigned

DSUBU rd, rs, rt MIPS III

Subtract the 64-bit contents of register rt from rs, then place the 64-bit result into

NOR NOR rd, rs, rt MIPS I

Bitwise NOR the contents of registers rs and rt, then place the result into register rd.

OR OR rd, rs, rt MIPS I

Bitwise OR the contents of registers rs and rt, then place the result into register rd.

Set on Less

Than SLT rd, rs, rt MIPS I

Compare the contents of register rt to register rs (as signed integers). If register rs

is less than rt,rd = 1; otherwise, rd =0.

(Sheet 1 of 2)

4-14 Instruction Set Architecture

4.3.3 Shift

The EZ4021-FC instruction set includes shift instructions that get the

shift amount from a 5-bit ﬁeld in the instruction word and other shift

instructions that get the shift amount from the low-order bits of a general

shift count, so there are separate instructions for doubleword shifts of

0 to 31 bits and of 32 to 63 bits (for example, DSLL and DSLL32).

Set on Less

Than

Unsigned

SLTU rd, rs, rt MIPS I

Compare the contents of register rt to register rs (as unsigned integers). If register rs

is less than rt,rd = 1; otherwise, rd =0.

Subtract SUB rd, rs, rt MIPS I

Subtract the 32-bit contents of register rt from rs, then place the 32-bit, sign-extended

result into register rd. Trap on 32-bit, twos-complement overﬂow.

Subtract

Unsigned SUBU rd, rs, rt MIPS I

Subtract the 32-bit contents of register rt from rs, then place the 32-bit, sign-extended

result into register rd. Do not trap on overﬂow.

Exclusive OR XOR rd, rs, rt MIPS I

Bitwise exclusive OR the contents of registers rs and rt, then place the result into

Table 4.6 Three-Operand, Register Type Instructions (Cont.)

Instruction Format and Description

(Sheet 2 of 2)

Computational Instructions 4-15

Table 4.7 describes the EZ4021-FC shift instructions.

Table 4.7 Shift Instructions

Instruction Format and Description

Doubleword

Shift

Left Logical

DSLL rd, rt, shamt MIPS III

Shift the 64-bit, doubleword contents of register rt left by shamt bits, inserting 0s

into the low-order bits. The bit shift count speciﬁed in shamt is in the range of 0 to

31 bits. The 64-bit result is placed into register rd

Doubleword

Shift

Left Logical

Plus 32

DSLL32 rd, rt, shamt MIPS III

Shift the 64-bit, doubleword contents of register rt left by shamt+32 bits, inserting

0s into the low-order bits. The bit shift count speciﬁed in shamt+32 is in the range

of 32 to 63 bits. The 64-bit result is placed into register rd

Doubleword

Shift

Right Arithmetic

DSRA rd, rt, shamt MIPS III

Shift the 64-bit, doubleword contents of register rt right by shamt bits,

sign-extending the high-order bits. The bit shift count speciﬁed in shamt is in the

range of 0 to 31 bits. The 64-bit result is placed into register rd

Doubleword

Shift

Right Arithmetic

Plus 32

DSRA32 rd, rt, shamt MIPS III

Shift the 64-bit, doubleword contents of register rt right by shamt+32 bits,

sign-extending the high-order bits. The bit shift count speciﬁed in shamt+32 is in

the range of 32 to 63 bits. The 64-bit result is placed into register rd

Doubleword

Shift

Right Logical

DSRL rd, rt, shamt MIPS III

Shift the 64-bit, doubleword contents of register rt right by shamt bits, inserting 0s

into the high-order bits. The bit shift count speciﬁed in shamt is in the range of 0

to 31 bits. The 64-bit result is placed into register rd

Doubleword

Shift

Right Logical

Plus 32

DSRL32 rd, rt, shamt MIPS III

Shift the 64-bit, doubleword contents of register rt right by shamt+32, inserting 0s

into the high-order bits. The bit shift count speciﬁed in shamt+32 is in the range of

32 to 63 bits. The 64-bit result is placed into register rd

Doubleword

Shift

Left Logical

Variable

DSLLV rd, rt, rs MIPS III

Shift the 64-bit, doubleword contents of register rt left. The low-order 6 bits of

of rt. The 64-bit result is placed into register rd

Doubleword

Shift

Right Logical

Variable

DSRLV rd, rt, rs MIPS III

Shift the contents of the low-order, 32-bit word of register rt right. The low-order

5 bits of register rs specify the number of bits to shift, inserting 0s into the

high-order bits of rt. The 32-bit result is sign-extended and placed into register rd

Doubleword

Shift

Right Arithmetic

Variable

DSRAV rd, rt, rs MIPS III

Shift the 64-bit, doubleword contents of register rt right. The low-order 6 bits of

bits of rt. The 64-bit result is placed into register rd

(Sheet 1 of 2)

4-16 Instruction Set Architecture

4.3.4 Multiply and Divide

The multiply and divide instructions produce twice as many result bits as

is typical with other instructions, and they deliver their results into the HI

and LO special registers. Multiply produces a full-width product that is

twice the width of the input operands; the low half of the product is put

in LO and the high half is put in HI. Divide produces both a quotient in

LO and a remainder in HI. The results are accessed by instructions that

transfer data between HI/LO and the general-purpose registers.

Shift Word Left

Logical SLL rd, rt, shamt MIPS I

Shift the contents of the low-order, 32-bit word of register rt left by shamt bits,

inserting 0s into the low-order bits. The 32-bit result is sign-extended and placed

into register rd

Shift Word Right

Logical SRL rd, rt, shamt MIPS I

Shift the contents of the low-order, 32-bit word of register rt right by shamt bits,

inserting 0s into the high-order bits. The 32-bit result is sign-extended and placed

into register rd

Shift Word Right

Arithmetic SRA, rd, rt, shamt MIPS I

Shift the contents of the low-order, 32-bit word of register rt right by shamt bits,

sign-extending the high-order bits. The 32-bit result is sign-extended and placed

into register rd

Shift Word Left

Logical Variable SLLV rd, rt, rs MIPS I

Shift the contents of the low-order, 32-bit word of register rt left. The low-order

5 bits of register rs specify the number of bits to shift, inserting 0s into the low-

order bits of rt. The 32-bit result is sign-extended and placed into register rd

Shift Word Right

Arithmetic

Variable

SRAV rd, rt, rs MIPS I

Shift the contents of the low-order, 32-bit word of register rt right. The low-order

5 bits of register rs specify the number of bits to shift while sign-extending the

high-order bits of rt. The 32-bit result is sign-extended and placed into register rd

Shift Word Right

Logical Variable SRLV rd, rt, rs MIPS I

Shift the contents of the low-order, 32-bit word of register rt right. The low-order

5 bits of register rs specify the number of bits to shift, inserting 0s into the

high-order bits of rt. The 32-bit result is sign-extended and placed into register rd

Table 4.7 Shift Instructions (Cont.)

Instruction Format and Description

(Sheet 2 of 2)

Computational Instructions 4-17

Table 4.8 describes the integer multiply and divide instructions along with

the HI/LO data movement instructions supported by the EZ4021-FC.

Table 4.8 Multiply and Divide Instructions

Instruction Format and Description

Doubleword

Divide DDIV rs, rt MIPS III

Divide the 64-bit word value in register rs by the 64-bit word value in rt, treating

both as twos-complement values. The 64-bit quotient is placed into special register

LO. The 64-bit remainder is placed into special register HI

Doubleword

Divide Unsigned DDIVU rs, rt MIPS III

Divide the 64-bit word value in register rs by the 64-bit word value in rt, treating

both as unsigned values. The 64-bit quotient is placed into special register LO. The

64-bit remainder is placed into special register HI

Divide Word DIV rs, rt MIPS I

Divide the 32-bit word value in register rs by the 32-bit word value in rt, treating

both as twos-complement values. The 32-bit quotient is sign-extended and placed

into special register LO. The 32-bit remainder is sign-extended and placed into

special register HI

Divide Word

Unsigned DIVU rs, rt MIPS I

Divide the 32-bit word value in register rs by the 32-bit word value in rt, treating

both as unsigned values. The 32-bit quotient is sign-extended and placed into

special register LO. The 32-bit remainder is sign-extended and placed into special

Doubleword

Multiply DMULT rs, rt MIPS III

Multiply the 64-bit word values in registers rs and rt as twos-complement values.

The low-order, 64-bit doubleword of the result is placed into special register LO.

The high-order, 64-bit word is placed into special register HI

Doubleword

Multiply

Unsigned

DMULTU rs, rt MIPS III

Multiply the 64-bit word values in registers rs and rt as unsigned values. The

low-order, 64-bit word of the result is placed into special register LO. The

high-order, 64-bit word is placed into special register HI

(Sheet 1 of 2)

4-18 Instruction Set Architecture

Table 4.9 shows the execution times (in clock cycles) of the multiply and

divide instructions.

Move from HI MFHI rd MIPS I

Move contents of special register HI to register rd.

Move from LO MFLO rd MIPS I

Move contents of special register LO to register rd.

Move to HI MTHI rs MIPS I

Move contents of register rs to special register HI.

Move to LO MTLO rs MIPS I

Move contents of register rs to special register LO.

Multiply Word MULT rs, rt MIPS I

Multiply the 32-bit word values in registers rs and rt as twos-complement values.

The low-order, 32-bit word of the result is sign-extended and placed into special

Multiply Word

Unsigned MULTU rs, rt MIPS I

Multiply the 32-bit word values in registers rs and rt as unsigned values. The

low-order, 32-bit word of the result is sign-extended and placed into special register

LO. The high-order, 32-bit word is sign-extended and placed into special register

Table 4.8 Multiply and Divide Instructions (Cont.)

Instruction Format and Description

(Sheet 2 of 2)

Table 4.9 Execution Time of Multiply and Divide Instructions

Operation

32 Bit 64 Bit

R3000 CW33300 R4000 EZ4021-FC R4000 EZ4021-FC

Multiply 12 1 + (Bits/3) 10 5/6 20 9/10

Divide 34 34 69 34 133 66

Jump and Branch Instructions 4-19

4.4 Jump and Branch Instructions

Jump and branch instructions change the control ﬂow of a program.

MIPS I jump and branch instructions always occur with a one-instruction

delay. The instruction immediately following the jump or branch is always

executed while the target instruction is being fetched from storage. There

may be additional cycle penalties, depending on circumstances and

implementation, but the penalties are interlocked in hardware. The

MIPS II ISA extensions add the branch likely class of instructions that

operate exactly like their unlikely counterparts, except that when the

branch is

not

taken, the instruction following the branch is cancelled.

The J-type instruction format is used for both jump and jump-and-link

instructions for subroutine calls. In the J-type format, the 26-bit target

address is shifted left 2 bits and combined with the 4 high-order bits of

the current program counter to form a 32-bit absolute address.

The R-type instruction format, which takes a 32-bit byte address

contained in a register, is used for returns, dispatches, and cross-page

jumps.

Branches have 16-bit signed offsets relative to the program counter

(I-type). Jump-and-link and branch-and-link instructions save a return

address in register 31.

4-20 Instruction Set Architecture

Table 4.10 summarizes the R-Series jump instructions, Table 4.11

summarizes the branch instructions, and Table 4.12 summarizes the

Branch Likely instructions.

Table 4.10 Jump Instructions

Instruction Format and Description

Jump J target MIPS I

Shift the 26-bit, target address left 2 bits, combine with the 4 high-order bits of

PC, and jump to the address with a one-instruction delay.

Jump and Link JAL target MIPS I

Shift the 26-bit, target address left 2 bits, combine with the 4 high-order bits of

PC, and jump to the address with a one-instruction delay. Place the address of the

instruction following the delay slot in register 31 (link register).

Jump and Link

Jump to the address contained in register rs with a one-instruction delay. Place

the address of the instruction following the delay slot in rd.

Jump Register JR rs MIPS I

Jump to the address contained in register rs with a one-instruction delay.

Table 4.11 PC-Relative Conditional Branch Instructions

Instruction Format and Description

Branch on Equal BEQ rs, rt, offset MIPS I

Branch to the target address1if register rs is equal to register rt.

Branch on

Greater Than or

Equal to Zero

BGEZ rs, offset MIPS I

Branch to the target address if register rs is greater than or equal to 0.

Branch on

Greater Than or

Equal to Zero

and Link

BGEZAL rs, offset MIPS I

Place the address of the instruction following the delay slot into register 31

(link register). Branch to the target address if register rs is greater than or

equal to 0.

Branch on

Greater

Than Zero

BGTZ rs, offset MIPS I

Branch to the target address if register rs is greater than 0.

Branch on Less

Than or Equal to

Zero

BLEZ rs, offset MIPS I

Branch to the target address if register rs is less than or equal to 0.

Branch on Less

Than Zero BLTZ rs, offset MIPS I

Branch to the target address if register rs is less than 0.

Jump and Branch Instructions 4-21

Branch on Less

Than Zero and

Link

BLTZAL rs, offset MIPS I

Place the address of the instruction following the delay slot into register 31

(link register). Branch to the target address if register rs is less than 0.

Branch on Not

Equal BNE rs, rt, offset MIPS I

Branch to the target address if register rs does not equal register rt.

1. All branch-instruction target addresses are computed as follows: add the address of the instruc-

tion in the delay slot and the 16-bit offset (shifted left 2 bits and sign-extended to 32 bits). All

branches occur with a delay of one instruction.

Table 4.11 PC-Relative Conditional Branch Instructions

Instruction Format and Description

Table 4.12 PC-Relative Conditional Branch Likely Instructions

Instruction Format and Description

BranchonEqual

Likely BEQL rs, rt, offset MIPS II

Branch to the target address1if register rs is equal to register rt.

Branch on

Greater than

or Equal to Zero

and Link Likely

BGEZALL rs, offset MIPS II

Place the address of the instruction following the delay slot into register 31 (link

Branch on

Greater than or

Equal to Zero

Likely

BGEZL rs, offset MIPS II

Branch to the target address if register rs is greater than or equal to 0.

Branch on

Greater Than

Zero Likely

BGTZL rs, offset MIPS II

Branch to the target address if register rs is greater than 0.

Branch on Less

than or Equal to

Zero Likely

BLEZL rs, offset MIPS II

Branch to the target address if register rs is less than or equal to 0.

Branch on Less

Than Zero And

Link Likely

BLTZALL rs, offset MIPS II

Place the address of the instruction following the delay slot into register 31 (link

4-22 Instruction Set Architecture

4.5 Exception Instructions

Exception instructions cause an exception that transfers control to a

software exception handler in the kernel. System call and breakpoint

instructions cause exceptions unconditionally. The trap instructions

cause exceptions conditionally based on the result of a comparison.

Table 4.13 describes the Break and Syscall instructions, and Table 4.14

summarizes the trap instructions.

Branch on Less

Than Zero Likely BLTZL rs, offset MIPS II

Branch to the target address if register rs is less than 0.

Branch on Not

Equal Likely BNEL rs, rt, offset MIPS II

Branch to the target address if register rs does not equal register rt.

1. All branch-instruction target addresses are computed as follows: add the address of the instruc-

tion in the delay slot and the 16-bit offset (shifted left 2 bits and sign-extended to 32 bits). All

branches occur with a delay of one instruction.

Table 4.12 PC-Relative Conditional Branch Likely Instructions

Instruction Format and Description

Table 4.13 Breakpoint and System Call Instructions

Instruction Format and Description

System Call SYSCALL MIPS I

Initiates system call trap, immediately transferring control to exception handler.

Breakpoint BREAK MIPS I

Initiates breakpoint trap, immediately transferring control to exception handler.

Exception Instructions 4-23

Table 4.14 Trap-on-Condition Instructions

Instruction Format and Description

Trap on Equal TEQ rs, rt MIPS II

Trap if register rs is equal to register rt.

Trap on Equal

Immediate TEQI rs, immediate MIPS II

Trap if register rs is equal to the immediate value.

Trap on Greater

Than or Equal TGE rs, rt MIPS II

Trap if register rs is greater than or equal to register rt.

Trap on Greater

Than or Equal

Immediate

TGEI rs, immediate MIPS II

Trap if register rs is greater than or equal to the immediate value.

Trap on Greater

Than or Equal

Unsigned

TGEU rs, rt MIPS II

Trap if register rs is greater than or equal to register rt.

Trap on Greater

Than or Equal

Immediate

Unsigned

TGEIU rs, immediate MIPS II

Trap if register rs is greater than or equal to the immediate value.

Trap on Less

Than TLT rs, rt MIPS II

Trap if register rs is less than register rt.

Trap on Less

Than Immediate TLTI rs, immediate MIPS II

Trap if register rs is less than the immediate value.

Trap on Less

Than Unsigned TLTU rs, rt MIPS II

Trap if register rs is less than register rt.

Trap on Less

Than Immediate

Unsigned

TLTIU rs, immediate MIPS II

Trap if register rs is less than the immediate value.

Trap If Not Equal TNE rs, rt MIPS II

Trap if register rs is not equal to rt.

TrapIfNotEqual

Immediate TNEI rs, immediate MIPS II

Trap if register rs is not equal to the immediate value.

4-24 Instruction Set Architecture

4.6 Serialization Instruction

The architecture does not specify the order in which memory accesses

from load and store instructions appear outside the processor executing

them. The Sync instruction creates a point in the executing instruction

stream where the relative order of some loads and stores is known.

Loads and stores executed before the Sync are completed before loads

and stores after the Sync can start, as shown in Table 4.15.

4.7 Coprocessor Instructions

Coprocessors are alternate execution units with register ﬁles separate

from the CPU. The EZ4021-FC supports external (on-chip) coprocessors

and implements the coprocessor instruction set.

This section includes descriptions of coprocessor data movement and

conditional branch instructions, as well as the System Control

Coprocessor (CP0) instructions. For descriptions of the Coprocessor

load and store instructions, see Table 4.4 on page 4-10.

4.7.1 Coprocessor Data Movement and Conditional Branch Instructions

Table 4.16 summarizes the general coprocessor to/from CPU data

movement and conditional branch instructions.

Table 4.15 Serialization Instruction

Instruction Format and Description

Synchronize

Shared Memory SYNC MIPS II

Complete all outstanding load and store instructions before allowing any new load

or store instructions to start.

Coprocessor Instructions 4-25

Table 4.16 Coprocessor Data Movement and Conditional Branch Instructions

Instruction Format and Description

Branch on

Coprocessor z

False (Likely)

BCzF offset, (BCzFL offset)

Compute a branch target address by adding the address of the instruction to the

16-bit offset (shifted left 2 bits and sign-extended to 32 bits). Branch to the target

address (with a delay of one instruction) if the coprocessor z’s condition line is

false. In the case of Branch Likely, the delay slot instruction is not executed when

the branch is not taken.

Branch on

Coprocessor z

True (Likely)

BCzT offset, (BCzTL offset)

Compute a branch target address by adding the address of the instruction to the

16-bit offset (shifted left 2 bits and sign-extended to 32 bits). Branch to the target

address (with a delay of one instruction) if coprocessor z’s condition line is true. In

the case of Branch Likely, the delay slot instruction is not executed when the branch

is not taken.

Move Control

from

Coprocessor

CFCz rt, rd

Loads the contents of the control register rd of coprocessor unit zinto general

Coprocessor

Operation COPz cofun

Initiates a coprocessor operation that may specify and reference the coprocessor’s

internal registers or change the state of the coprocessor’s condition line, but does

not change the state within the processor or the cache memory.

Move Control

to Coprocessor CTCz rt, rd

Loads the contents of general register rt into the control register rd of coprocessor

unit z.

Doubleword

Move to

Coprocessor

DMTCz rt, rd

Loads the 64-bit contents of general register rt into the rd register of coprocessor

unit z.

Doubleword

Move from

Coprocessor

DMFCz rt

Loads the 64-bit contents of the rd register of coprocessor unit zinto general

Move to

Coprocessor MTCz rt, rd

Loads the contents of general register rt into the rd register of coprocessor unit z.

Move from

Coprocessor MFCz rt

Loads the sign-extended contents of the rd register of coprocessor unit zinto

general register rt.

4-26 Instruction Set Architecture

4.7.2 System Control Coprocessor (CP0) Instructions

Coprocessor 0 instructions perform operations on the system control

coprocessor (CP0) registers to manipulate the memory management and

exception-handling facilities of the processor. Table 4.17 summarizes the

CP0 instructions.

Table 4.17 CP0 Instructions

Instruction Format and Description

Exception

Return ERET

Loads the PC from ErrorEPC (SR2 = 1: Error Exception) or EPC (SR2 = 0:

Exception) and clear ERL bit (SR2 = 1) or EXL bit (SR2 = 0) in the Status register.

SR2 is Status register bit 2.

Move from CP0 MFC0 rt, rd

Loads the sign-extended contents of CP0 register rd into CPU register rt.

Move to CP0 MTC0 rt, rd

Loads contents of CPU register rt into CP0 register rd.

Probe TLB for

Matching Entry1TLBP

Loads the Index register with the address of the TLB entry whose contents match

the EntryHi and EntryLo registers. If no TLB entry matches, sets the high-order bit

of the Index register.

Read Indexed

TLB Entry1TLBR

Loads EntryHi and EntryLo with the TLB entry pointed to by the Index register.

Write Indexed

TLB Entry1TLBWI

Loads TLB entry pointed to by the Index register with the contents of the EntryHi

and EntryLo registers.

Write Random

TLB Entry1TLBWR

Loads TLB entry pointed to by the Random register with the contents of the

EntryHi and EntryLo registers.

1. If the MMU is disabled, these instructions effectively become NOPs.

Cache Maintenance Instruction 4-27

4.8 Cache Maintenance Instruction

The cache maintenance instruction uses an I-type format. A 16-bit offset

is sign-extended and added to the 32-bit word contents of a base register

value to form a virtual address. The TLB translates this virtual address

to a physical address, and the 5-bit subopcode speciﬁes a cache

operation for that address. Table 4.18 summarizes this instruction.

The following pages provide more detail on the cache maintenance

operations supported by the EZ4021-FC processor.

Table 4.18 Cache Maintenance Instruction

Instruction Format and Description

CACHE CACHE op, offset(base)

The 16-bit offset is sign-extended and added to the 32-bit word contents of a

base register value to form an effective address. The effective address can be

translated to a physical address using the TLB, and the 5-bit op ﬁeld speciﬁes a

cache operation.

4-28 Instruction Set Architecture

CACHE Cache Maintenance Instruction

Format

Syntax CACHE op, offset(base)

Description The 16-bit offset is sign-extended and added to the 32-bit contents of a

base register value to form an effective address (EAddr).

The effective address is used in one of two ways depending on the

operation to be performed.

•Index Operations

Index operations use part of the effective address to specify a cache

block (line). The EZ4021-FC primary instruction and data caches are

two-way set-associative, 16 Kbyte memories (8 Kbytes per set) with

eight 32-bit words (32 bytes) per cache block. Therefore, to index a

cache block, effective address bits EAddr[12:5] specify the desired

block within a cache set while EAddr13 speciﬁes which cache set to

access. Figure 4.3 shows the format of an Index effective address.

Figure 4.3 Index Effective Address Format

•Address Operations

Address operations use the effective address to access the cache if

there is a cache hit. To check for a cache hit or miss, the effective

address is translated into a physical address (PAddr) and compared

with the cache tag. For a cache hit, the speciﬁed block must be

present in the cache and valid; otherwise, no operation is performed.

31 26 25 21 20 16 15 0

CACHE base op offset

101111 base op offset

31 14 13 12 5 4 0

unused way block index byte index

Cache Maintenance Instruction 4-29

TLB Reﬁll and TLB Invalid exceptions can occur on any operation. For

Index operations (where the physical address is used to index the cache

but need not match the cache tag), unmapped addresses can be used

to avoid TLB exceptions.

Using the CACHE instruction on an uncached address produces

undeﬁned results.

Bits [20:16] of the CACHE instruction specify the cache operation.

Table 4.19 deﬁnes the cache operation codes. Using the CACHE

instruction with any operation code other than those listed in Table 4.19

produces undeﬁned results. Cache write-back operations from a primary

cache go to memory.

Note: All Invalidate operations also clear the Line Lock bit.

Table 4.19 Cache Operation Code Deﬁnitions

Value Op Type Description

0b00000 Index I-Cache Index Invalidate

Sets the cache state of the speciﬁed cache block to invalid.

0b00001 Index D-Cache Index Write-Back and Invalidate

For write-back cache operation: If the state of the cache block at the

speciﬁed index is valid and the dirty bit is set, write the block back to

memory. The system address to write is taken from the primary cache tag.

Set the cache state of the primary cache block to invalid. If the block is valid

but not dirty, set the state of the block to invalid.

For write-through cache operation: Set the state of the cache block at the

speciﬁed index to invalid.

0b00100 Index I-Cache Index Load Tag

Read the tag from the instruction cache block at the speciﬁed index and

place into the TagLo and TagHi CP0 registers.

0b00101 Index D-Cache Index Load Tag

Read the tag from the data cache block at the speciﬁed index and place into

the TagLo and TagHi CP0 registers.

If a D-Cache Index Store Tag or D-Cache Hit Invalidate instruction precedes

a D-Cache Index Load Tag instruction, make sure there is at least one

instruction between the Store Tag/Hit Invalidate and the load tag instruction.

Otherwise, the D, LL, and LRU bits in the TagLo register are corrupted.

(Sheet 1 of 3)

4-30 Instruction Set Architecture

0b01000 Index I-Cache Index Store Tag

Write the tag for the instruction cache block at the speciﬁed index from the

TagLo and TagHi CP0 registers.

0b01001 Index D-Cache Index Store Tag

Write the tag for the data cache block at the speciﬁed index from the TagLo

and TagHi CP0 registers.

0b01101 Address D-Cache Create Dirty Exclusive

This operation is used to avoid loading data needlessly from memory when

writing new contents into an entire cache block. If the cache block does not

contain the speciﬁed address and the block is dirty, write it back to memory.

In all cases, set the cache block tag to the speciﬁed physical address, and

set the cache state to Dirty Exclusive.

0b10000 Address I-Cache Hit Invalidate

If the instruction cache block contains the speciﬁed address, mark the cache

block invalid.

0b10001 Address D-Cache Hit Invalidate

If the data cache block contains the speciﬁed address, mark the cache block

invalid.

0b10100 Address Fill Primary I-Cache Block

Fill the primary instruction cache block from the speciﬁed address. If the

instruction cache already contains a valid block at the speciﬁed address, set

the state to locked.

0b10101 Address D-Cache Hit Write-Back and Invalidate

For write-back cache operation: If the cache block contains the speciﬁed

address and is valid and dirty, write-back the data to memory and mark the

block invalid. If the block is valid but not dirty, set the state of the block to

invalid.

For write-through cache operation: If the cache block contains the speciﬁed

address, set the state of the cache block to invalid.

0b11001 Address D-Cache Hit Write-Back

For write-back cache operation: If the cache block contains the speciﬁed

address and is valid and dirty, write the contents back to memory. After the

operation is complete, leave the state of the block valid, but clear the dirty

state.

For write-through cache operation: This operation may be considered as an

NOP.

Table 4.19 Cache Operation Code Deﬁnitions (Cont.)

Value Op Type Description

(Sheet 2 of 3)

Cache Maintenance Instruction 4-31

Operation T: vAddr <- ((offset15)16 || offset15..0) + GPR[base]31..0

pAddr, uncached) <- Address Translation(vAddr, DataReadRef)

CacheOp(op,vAddr,pAddr)

Exceptions Coprocessor Unusable

TLB Reﬁll

TLB Invalid

0b11100 Address I-Cache Fetch and Lock

If the instruction cache does not contain the speciﬁed address, ﬁll it from

memory and set the state of the block to valid and locked. If the instruction

cache already contains a valid block at the speciﬁed address, set the state

to locked.

The locked state may be cleared by executing an Index Invalidate or Hit

Invalidate to the locked block, or through an Index Store Tag operation that

clears the Lock bit.

0b11101 Address D-Cache Load and Lock

If the data cache does not contain the speciﬁed address, ﬁll it from memory,

performing a write-back if required, and set the state of the block to valid and

locked.

If the data cache already contains a valid block at the speciﬁed address, set

its state to locked.

The lock state may be cleared by executing an Index Invalidate,

Hit Invalidate, or Hit Write-Back Invalidate to the locked block, or using an

Index Store Tag operation that clears the Lock bit.

Table 4.19 Cache Operation Code Deﬁnitions (Cont.)

Value Op Type Description

(Sheet 3 of 3)

4-32 Instruction Set Architecture

4.9 EZ4021-FC Instruction Extensions

This section describes the EZ4021-FC instruction extensions. The

extensions consist of EJTAG, Multiply-Accumulate, and power savings

support instructions. Tables 4.20 and 4.21 provide a summary of the

general and CP0 instruction extensions. A full description of each

instruction follows the summary tables.

4.9.1 General 32-Bit Instruction Extensions

Table 4.20 summarizes the non-CP0 speciﬁc instruction extensions

added to the EZ4021-FC.

Table 4.20 General Instruction Extensions

Instruction Format and Description

Multiply Add MADD rs, rt

Multiply the values in registers rs and rt as 32-bit, twos-complement values. When

the operation completes, the doubleword result is added to the special register pair

HI/LO. The low-order, 32 bits of the addition result are sign-extended and placed

into special register LO. The high-order, 32 bits are sign-extended and placed into

special register HI

Multiply Add

Unsigned MADDU rs, rt

Multiply the values in registers rs and rt as 32-bit, unsigned values. When the

operation completes, the doubleword result is added to the special register pair

HI/LO. The low-order, 32 bits of the addition result are sign-extended and placed

into special register LO. The high-order, 32 bits are sign-extended and placed into

special register HI

Multiply MUL rd, rs, rt

Multiply the 32-bit word values in registers rs and rt as twos-complement values.

When the operation completes, the low-order, 32-bit word of the result is

sign-extended and placed back into the general-purpose register speciﬁed by rd.

Multiply Subtract MSUB rs, rt

Multiply the values in registers rs and rt as 32-bit, twos-complement values. When

the operation completes, the doubleword result is subtracted from the special

and placed into special register LO. The high-order, 32 bits are sign-extended and

placed into special register HI

(Sheet 1 of 2)

EZ4021-FC Instruction Extensions 4-33

4.9.2 CP0 Instruction Extensions

Table 4.21 summarizes the two new CP0 extensions.

MultiplySubtract

Unsigned MSUBU rs, rt

Multiply the values in registers rs and rt as 32-bit, unsigned values. When the

operation completes, the doubleword result is subtracted from the special register

pair HI/LO. The low-order, 32 bits of the subtract result are sign-extended and

placed into special register LO. The high-order, 32 bits are sign-extended and

placed into special register HI

Software Debug

Breakpoint SDBBP

This instruction raises a Debug Breakpoint exception, passing control to an

exception handler.

Table 4.20 General Instruction Extensions (Cont.)

Instruction Format and Description

(Sheet 2 of 2)

Table 4.21 CP0 Instruction Extensions

Instruction Format and Description

Debug Exception

Return DERET

The return address stored in the DEPC register is copied to the PC, and

processing returns to the original program. The Debug Mode bit (bit 30 in the

Debug Register) and the BrkSt bit (bit 3 in the EJTAG Control register) are

cleared.

Wait for Interrupt WAITI

Stops execution of instructions and puts the processor in a power save

(stall) condition until a hardware interrupt, NMI, or reset occurs.

4-34 Instruction Set Architecture

MADD Multiply Add

Format

Syntax MADD rs, rt

Description The contents of general register rs and rt are multiplied, treating both

operands as 32-bit, twos-complement values. No integer overﬂow

exception occurs under any circumstances. In 64-bit mode the operands

must be valid 32-bit, sign-extended values.

When the operation completes, the doubleword result is added to the

special register pair HI/LO. The low-order, 32 bits of the addition result

are sign-extended and placed into special register LO. The high-order,

32 bits are sign-extended and placed into special register HI.

MADD executes in 5 to 6 cycles, depending on the operand data.

Operation

T: temp <- (HI31..0 || LO31..0) + ((rs31)32 || rs31..0) x ((rt31)32 || rt31..0)

HI <- (temp63)32 || temp63..32

LO <- (temp31)32 || temp31..0

Exceptions None

31 26 25 21 20 16 15 6 5 0

SPECIAL2 rs rt 0 MADD

011100 rs rt 0000000000 000000

EZ4021-FC Instruction Extensions 4-35

MADDU Multiply Add Unsigned

Format

Syntax MADDU rs, rt

Description The contents of general register rs and rt are multiplied, treating both

operands as unsigned values. No integer overﬂow exception occurs

under any circumstances. In 64-bit mode the operands must be valid

32-bit, sign-extended values.

When the operation completes, the doubleword result is added to the

special register pair HI/LO. The low-order, 32 bits of the addition result

are sign-extended and placed into special register LO. The high-order,

32 bits are sign-extended and placed into special register HI.

MADDU executes in 5 to 6 cycles, depending on the operand data.

Operation

T: temp <- (HI31..0 || LO31..0) + ((031)32 || rs31..0) x ((031)32 || rt31..0)

HI <- (temp63)32 || temp63..32

LO <- (temp31)32 || temp31..0

Exceptions None

31 26 25 21 20 16 15 6 5 0

SPECIAL2 rs rt 0 MADDU

011100 rs rt 0000000000 000001

4-36 Instruction Set Architecture

MUL Multiply

Format

Syntax MUL rd, rs, rt

Description The contents of general register rs and rt are multiplied, treating both

operands as 32-bit, twos-complement values. No integer overﬂow

exception occurs under any circumstances. In 64-bit mode the operands

must be valid 32-bit, sign-extended values.

When the operation completes, the low-order, 32 bits of the doubleword

result are sign-extended and placed into general register rd.

MUL executes in 5 cycles.

Operation T: temp <- rs31..0 x rt31..0

rd <- (temp31)32 || temp31..0

HI <- undefined

LO <- undefined

Exceptions None

31 26 25 21 20 16 15 11 10 6 5 0

SPECIAL2 rs rt rd 0 MUL

011100 rs rt rd 00000 000010

EZ4021-FC Instruction Extensions 4-37

MSUB Multiply Subtract

Format

Syntax MSUB rs, rt

Description The contents of general register rs and rt are multiplied, treating both

operands as 32-bit, twos-complement values. No integer overﬂow

exception occurs under any circumstances. In 64-bit mode the operands

must be valid 32-bit, sign-extended values.

When the operation completes, the doubleword result is subtracted from

the special register pair HI/LO. The low-order, 32 bits of the subtract

result are sign-extended and placed into special register LO. The

high-order, 32 bits are sign-extended and placed into special register HI.

MSUB executes in 5 to 6 cycles, depending on the operand data.

Operation

T: temp <- (HI31..0 || LO31..0) - ((rs31)32 || rs31..0) x ((rt31)32 || rt31..0)

HI <- (temp63)32 || temp63..32

LO <- (temp31)32 || temp31..0

Exceptions None

31 26 25 21 20 16 15 6 5 0

SPECIAL2 rs rt 0 MSUB

011100 rs rt 0000000000 000100

4-38 Instruction Set Architecture

MSUBU Multiply Subtract Unsigned

Format

Syntax MADDU rs, rt

Description The contents of general register rs and rt are multiplied, treating both

operands as unsigned values. No integer overﬂow exception occurs

under any circumstances. In 64-bit mode, the operands must be valid

32-bit, sign-extended values.

When the operation completes, the doubleword result is subtracted from

the special register pair HI/LO. The low-order, 32 bits of the subtraction

result are sign-extended and placed into special register LO. The

high-order, 32 bits are sign-extended and placed into special register HI.

MSUBU executes in 5 to 6 cycles, depending on the operand data.

Operation

T: temp <- (HI31..0 || LO31..0) - ((031)32 || rs31..0) x ((031)32 || rt31..0)

HI <- (temp63)32 || temp63..32

LO <- (temp31)32 || temp31..0

Exceptions None

31 26 25 21 20 16 15 6 5 0

SPECIAL2 rs rt 0 MSUBU

011100 rs rt 0000000000 000101

EZ4021-FC Instruction Extensions 4-39

SDBBP Software Debug Breakpoint

Format

Syntax SDBBP

Description This instruction raises a Debug Breakpoint exception and passes control

to an exception handler. The code ﬁeld can be used for passing

information to the exception handler. To access this ﬁeld, the exception

handler must load the contents of the memory word containing this

instruction by using the DEPC register. The SDBBP instruction acts as a

NOP when it is used in Debug mode.

Operation T: PC <- Exception Handler Vector

if (DBD=’0’)

then DEPC <- Address of SDBBP instruction

else DEPC <- Address of branch instruction

DM <- ‘1’

BrkSt <- ‘1’

DBp <- ‘1’

Exceptions Debug Breakpoint

31 26 25 6 5 0

SPECIAL2 code SDBBP

011100 code 111111

4-40 Instruction Set Architecture

DERET Debug Exception Return

Format

Syntax DERET

Description This instruction executes a return from a debug exception. It has a

branch delay slot, the same as a branch or jump instruction. The DERET

instruction cannot be used in a branch or jump delay slot. The return

address stored in the DEPC register is copied to the PC, and processing

returns to the original program. The Debug Mode bit (Debug register

[30]) and the BrkSt bit (EJTAG Control register [3]) are cleared.

Operation T: temp <- DEPC

T+1:PC <- temp

DM <- ‘0’

BrkSt <- ‘0’

Exceptions Coprocessor Unusable

31 26 25 21 20 16 15 11 10 6 5 0

COP0 rs 0 0 0 DERET

010000 10000 00000 00000 00000 011111

EZ4021-FC Instruction Extensions 4-41

WAITI Wait for Interrupt

Format

Syntax WAITI

Description When this instruction is executed, the main processor clock stops and

instruction execution halts. Execution resumes when a hardware

interrupt, NMI, or reset exception occurs. While in wait mode, the

processor is saving power because the clock to most circuits is turned

off.

Exceptions None

31 26 25 21 20 16 15 11 10 6 5 0

COP0 rs 0 0 0 WAITI

010000 10000 00000 00000 00000 100000

4-42 Instruction Set Architecture

4.10 CPU 32-Bit Instruction Opcode Encoding

Tables 4.22–4.28 show the EZ4021-FC opcode bit encoding for 32-bit

(MIPS III ISA) instructions. The following keys are used in the tables:

rxf – These op codes cause reserved instruction exceptions in all current

implementations and are reserved for future versions of the architecture.

nrx – These op codes are invalid but do not cause reserved instruction

exceptions.

x1 – CACHE op codes are always valid in Kernel mode and cause a

reserved instruction exception (User or Supervisor mode) with CP0

disabled. Subopcode bits [20:16] deﬁne cache maintenance functions.

These functions are compatible with R4000 style processors. Undeﬁned

subopcodes of the CACHE instruction do not cause reserved instruction

exceptions.

n1 – These CP0 opcodes effectively become NOPs when the MMU is

disabled.

Table 4.22 MIPS III Major Opcode Bit Encoding

[28:26]

MIPS III Major Opcodes

[31:29] 0 1 2 3 4 5 6 7

0SPECIAL REGIMM J JAL BEQ BNE BLEZ BGTZ

1ADDI ADDIU SLTI SLTIU ANDI ORI XORI LUI

2COP0 COP1 COP2 rxf BEQL BNEL BLEZL BGTZL

3DADDI DADDIU LDL LDR SPECIAL2 rxf rxf rxf

4LB LH LWL LW LBU LHU LWR LWU

5SB SH SWL SW SDL SDR SWR CACHEx1

6LL LWC1 LWC2 rxf LLD LDC1 LDC2 LD

7SC SWC1 SWC2 rxf SCD SDC1 SDC2 SD

CPU 32-Bit Instruction Opcode Encoding 4-43

Table 4.23 COPz rs Opcode Bit Encoding

[25:24]

[23:21]

COPz rs

01234567

0MFCz DMFCz CFCz rxf MTCz DMTCz CTCz rxf

1BC rxf rxf rxf rxf rxf rxf rxf

2COPz (Coprocessor-Deﬁned Instructions)

Table 4.24 COPz rt Opcode Bit Encoding

[18:16]

COPz rt

[20:19] 0 1 2 3 4 5 6 7

0BCF BCT BCFL BCTL rxf rxf rxf rxf

1rxf rxf rxf rxf rxf rxf rxf rxf

2rxf rxf rxf rxf rxf rxf rxf rxf

3rxf rxf rxf rxf rxf rxf rxf rxf

Table 4.25 REGIMM Opcode rt Bit Encoding

[18:16]

REGIMM rt

[20:19] 0 1 2 3 4 5 6 7

0BLTZ BGEZ BLTZL BGEZL rxf rxf rxf rxf

1TGEI TGEIU TLTI TLTIU TEQI rxf TNEI rxf

2BLTZAL BGEZAL BLTZALL BGEZALL rxf rxf rxf rxf

3rxf rxf rxf rxf rxf rxf rxf rxf

4-44 Instruction Set Architecture

Table 4.26 SPECIAL Opcode Bit Encoding

[2:0]

SPECIAL Functions

[5:3] 0 1 2 3 4 5 6 7

0SLL rxf SRL SRA SLLV rxf SRLV SRAV

1JR JALR rxf rxf SYSCALL BREAK rxf SYNC

2MFHI MTHI MFLO MTLO DSLLV rxf DSRLV DSRAV

3MULT MULTU DIV DIVU DMULT DMULTU DDIV DDIVU

4ADD ADDU SUB SUBU AND OR XOR NOR

5rxf rxf SLT SLTU DADD DADDU DSUB DSUBU

6TGE TGEU TLT TLTU TEQ rxf TNE rxf

7DSLL rxf DSRL DSRA DSLL32 rxf DSRL32 DSRA32

Table 4.27 SPECIAL 2 Opcode Bit Encoding

[2:0]

SPECIAL2 Functions

[5:3] 0 1 2 3 4 5 6 7

0MADD MADDU MUL rxf MSUB MSUBU rxf rxf

1rxf rxf rxf rxf rxf rxf rxf rxf

2rxf rxf rxf rxf rxf rxf rxf rxf

3rxf rxf rxf rxf rxf rxf rxf rxf

4rxf rxf rxf rxf rxf rxf rxf rxf

5rxf rxf rxf rxf rxf rxf rxf rxf

6rxf rxf rxf rxf rxf rxf rxf rxf

7rxf rxf rxf rxf rxf rxf rxf SDBBP

CPU 32-Bit Instruction Opcode Encoding 4-45

Table 4.28 CP0 Opcode Bit Encoding

[2:0]

CP0 Functions

[5:3] 0 1 2 3 4 5 6 7

0nrx TLBRn1 TLBWIn1 nrx nrx nrx TLBWRn1 nrx

1TLBPn1 nrx nrx nrx nrx nrx nrx nrx

2rxf nrx nrx nrx nrx nrx nrx nrx

3ERET nrx nrx nrx nrx nrx nrx DERET

4WAITI nrx nrx nrx nrx nrx nrx nrx

5nrx nrx nrx nrx nrx nrx nrx nrx

6nrx nrx nrx nrx nrx nrx nrx nrx

7nrx nrx nrx nrx nrx nrx nrx nrx

4-46 Instruction Set Architecture

MiniRISC EZ4021-FC EasyMACRO Microprocessor 5-1

Chapter 5

Signal Descriptions

This chapter describes the EZ4021-FC external interface signals and

includes the following sections:

•Section 5.1, “Quick Bus Interface”

•Section 5.2, “Interrupt, Clock, and Reset Signals”

•Section 5.3, “EJTAG and PC Trace Signals”

•Section 5.4, “Global Test Mode Signals”

•Section 5.5, “BIST Signals”

•Section 5.6, “Miscellaneous Signals”

In the signal descriptions, the verb

assert

means to drive TRUE or active.

The verb

deassert

means to drive FALSE or inactive. The P at the end

of signal names indicates a signal that is active (TRUE) when HIGH.

The signals are arranged in alphabetical order within each section.

5.1 Quick Bus Interface

There is no default master for the Quick Bus. The bus arbitration logic is

external to the EZ4021-FC, so the EZ4021-FC must request use of the

bus, just like any other device on the bus.

BC_D_QB_BREQP

Bus Request for Data Access Output

The EZ4021-FC asserts this signal to request a

load/store data access on the Quick Bus.

BC_E_QB_BREQP

Bus Request for EJTAG DMA Output

The EZ4021-FC asserts this signal to request an EJTAG

DMA access on the Quick Bus.

5-2 Signal Descriptions

BC_I_QB_BREQP

Bus Request for Instruction Fetch Output

The EZ4021-FC asserts this signal to request an

instruction fetch access on the Quick Bus.

BC_QB_ADDRP[31:3]

Address Output

This 29-bit bus outputs the EZ4021-FC memory request

address

BC_QB_BURSTREQP

Burst Request Output

The EZ4021-FC asserts this signal to request a burst

access of the target memory device.

BC_QB_BYTEP[7:0]

Byte Enable Signals Output

The EZ4021-FC asserts these signals, as required, to

indicate which bytes are valid on the 64-bit data bus.

The following table shows the correspondence between

the byte enable signals and the valid data bytes.

BC_QB_CMDLOCKP

Command Lock Output

The EZ4021-FC asserts this signal to guarantee access

to the Quick Bus for multiple consecutive cycles. The

signal is used to guarantee the EJTAG access to the

Quick Bus for atomic DMAs or data cache write-back

stores.

BC_QB_RDACKP

Read Data Acknowledge Output

The EZ4021-FC asserts this signal to acknowledge that

it can accept read data being returned from a slave

device.

Byte Enable Valid

Data Byte Byte Enable Valid

Data Byte

BC_QB_BYTE[7] [63:56] BC_QB_BYTE[3] [31:24]

BC_QB_BYTE[6] [55:48] BC_QB_BYTE[2] [23:16]

BC_QB_BYTE[5] [47:40] BC_QB_BYTE[1] [15:8]

BC_QB_BYTE[4] [39:32] BC_QB_BYTE[0] [7:0]

Quick Bus Interface 5-3

BC_QB_READP

Read Request Output

The EZ4021-FC asserts this signal to indicate a read

operation.

BC_QB_WRDATAP[63:0]

Write Data Output

The EZ4021-FC drives write data on this 64-bit bus

during EZ4021-FC write requests.

BC_QB_WRITEP

Write Request Output

The EZ4021-FC asserts this signal to indicate a write

operation.

QB_ADDRP[31:3]

Address (Snooping) Input

This 29-bit bus contains an address from an external

(non-CPU) device. When the EZ4021-FC snoops for

external (non-CPU) writes to memory, the data cache

uses this address to generate cache invalidate operations

to the data cache to maintain data coherency.

QB_BADADDRP

Bad Address Error Input

The Quick Bus asserts this signal, in conjunction with

QB_GRANT_BC_DP, QB_GRANT_BC_IP, or

QB_GRANT_BC_EP to indicate that the EZ4021-FC

attempted to access an invalid address.

QB_BOFFP Back Off (Snooping) Input

The Quick Bus asserts this signal. The EZ4021-FC Quick

Bus snooping mechanism uses this input in conjunction

with QB_WRITEP for proper bus snooping.

QB_BURSTACKP

Burst Request Acknowledge Input

An external device asserts this signal to acknowledge the

EZ4021-FC’s request for a burst operation.

QB_CMDRDYPCommand Ready Input

The Quick Bus asserts this signal in conjunction with

QB_GRANT_BC_DP, QB_GRANT_BC_EP, or

QB_GRANTP_BC_IP to indicate that the target slave can

accept the corresponding request.

5-4 Signal Descriptions

QB_GRANT_BC_DP

Data Access Command Bus Grant Input

Quick Bus arbitration logic asserts this signal to indicate

that the EZ4021-FC has been granted ownership of the

command request bus for a data access.

QB_GRANT_BC_EP

EJTAG DMA Command Bus Grant Input

Quick Bus arbitration logic asserts this signal to indicate

that the EZ4021-FC has been granted ownership of the

command request bus for an EJTAG DMA operation.

QB_GRANT_BC_IP

Instruction Fetch Command Bus Grant Input

Quick Bus arbitration logic asserts this signal to indicate

that the EZ4021-FC has been granted ownership of the

command request bus for an instruction fetch.

QB_RDDATAP[63:0]

Read Data Input

This 64-bit data bus contains read data requested by the

EZ4021-FC. The data is valid when the Quick Bus

asserts one of the following signals:

QB_RDRDY_BC_DP, QB_RDRDY_BC_EP, or

QB_RDRDY_BC_IP.

QB_RDERRP Read Data Error Input

The Quick Bus asserts this signal, in conjunction with

QB_RDRDY_BC_DP, QB_RDRDY_BC_EP, or

QB_RDRDY_BC_IP to indicate that a read operation to a

slave device failed.

QB_RDRDY_BC_DP

Read Data Ready for Data Read Input

The Quick Bus asserts this signal to indicate that data

access read data requested by the EZ4021-FC is

available on QB_RDATA[63:0].

QB_RDRDY_BC_EP

Read Data Ready for EJTAG Read Input

The Quick Bus asserts this signal to indicate that EJTAG

read data requested by the EZ4021-FC is available on

QB_RDATA[63:0].

Interrupt, Clock, and Reset Signals 5-5

QB_RDRDY_BC_IP

Read Data Ready for Instruction Fetch Input

The Quick Bus asserts this signal to indicate that

instruction fetch data requested by the EZ4021-FC is

available on QB_RDDATAP[63:0].

QB_SLRDY_BC_DP

Slave Ready for Data Access Input

The Quick Bus asserts this signal to indicate that the

target slave for a data access request is now ready.

QB_SLRDY_BC_EP

Slave Ready for EJTAG DMA Input

The Quick Bus asserts this signal to indicate that the

target slave for an EJTAG DMA request is now ready.

QB_SLRDY_BC_IP

Slave Ready for Instruction Fetch Input

The Quick Bus asserts this signal to indicate that the

target slave for an instruction fetch is now ready.

QB_WRITEP Snoop Request (Snooping) Input

The EZ4021-FC monitors this signal to determine when

to snoop the current address on the Quick Bus. To snoop

all non-EZ4021-FC writes on the Quick Bus, connect this

signal to QB_WRITEP.

5.2 Interrupt, Clock, and Reset Signals

This section describes the interrupt, clock, and reset signals.

CG_RESETP Clock Generator Reset Input

Asserting this signal synchronously resets the SCLKP

divider. CG_RESETP must be asserted synchronously

with respect to PCLKP.

5-6 Signal Descriptions

EZ_SCLK_GATEP

System/Secondary Clock Gate Output

This signal generates the system clock, SCLKP, from

PCLKP. Refer to Section 2.8, “Clocks,” on page 2-23 for

information. The EZ4021-FC asserts EZ_SCLK_GATEP

when the SCLKP divider counts down to 1.

EZ_SCLK_GATEP is also forced active when

GSCAN_MODEP is asserted, so that SCLKP == PCLKP

in scan mode.

INTP[4:0] External Hardware Interrupts Input

External logic asserts these input signals, which cause

CP0 to generate the corresponding interrupt exception.

The Cause register IP[4:0] ﬁeld indicates when these

inputs are asserted. The interrupting logic should assert

its interrupt continuously until the exception routine

services it.

NMI Nonmaskable Interrupt Input

When asserted, this signal causes the EZ4021-FC CP0

to generate a Soft Reset/NMI exception at a valid

instruction boundary. Processor state information is

preserved. Assert this input for only 1 cycle.

PCLKP Primary CPU Clock Input

This is the processor system clock input, which deﬁnes

the EZ4021-FC CPU operating frequency. All other

clocks, except GSCAN_RAMCLKP and DJ_TCKP, are

generated from PCLKP. All modules that are part of the

EZ4021-FC use this clock, and internal logic operates

synchronously with the rising edge of PCLKP.

RESETP System Reset Input

Asserting this signal synchronously resets the

EZ 4021-FC. RESETP must be asserted synchronously

with respect to PCLKP. Asserting this signal initializes all

internal state information. When RESETP is deasserted,

EZ4021-FC CP0 generates a Reset exception and sets

the Program Counter to 0xBFC0.0000.

EJTAG and PC Trace Signals 5-7

SCLKP_DIVP[1:0]

SCLKP Divide Ratio Input

The data on SCLKP_DIVP is the SCLKP divisor value;

for example: SCLKP_DIVP == 2, then

SCLKP = PCLKP/2. Acceptable values of SCLKP_DIVP

are 1, 2, and 3.

5.3 EJTAG and PC Trace Signals

The EJTAG (EJTAG) interface consists of the following ﬁve signal groups:

•EJTAG Standard Signals

•EJTAG Standard Support Signals

•Nonmultiplexed EJTAG Signals

•EJTAG External Module Signals

•EJTAG Conﬁguration Signals

In this section, inputs and outputs are arranged in alphabetical order, and

are referenced to the EJTAG module. Signals output from the debug

support/PC trace submodule are indicated by the preﬁx ‘DT’ and outputs

from the EJTAG Interface submodule are preﬁxed with ‘DJ’.

5.3.1 EJTAG Standard Signals

The standard EJTAG interface consists of the following signals.

DJ_TCKP EJTAG Test Clock Input

This signal is the TCK clock from the off-chip EJTAG

probe. This is the input clock used to shift data into or out

of the EJTAG registers. The TCK clock may be fully

asynchronous with respect to PCLKP, the processor

clock.

DJ_TDIP_DINTN

Test Data Input/Debug Interrupt Input

When PC Trace mode is off and depending on the TAP

controller state, this signal is the TDI/DINT serial data

input from the EJTAG probe. This signal shifts data into

the EJTAG registers on the rising edge of the DJ_TCKP

clock.

5-8 Signal Descriptions

When PC Trace mode is on, asserting this signal LOW

(asynchronous to any clock) acts as an interrupt and

switches PC Trace mode off.

DJ_TDOP_TPCP

Test Data Output/Target PC Output Output

This signal is the TDO/TPC serial data output to the

EJTAG probe. When PC Trace mode is off, this signal

shifts data out of the EJTAG registers on the falling edge

of the DJ_TCKP clock. When no data is shifted out, this

signal is Hi-Z.

When PC Trace mode is on, this signal provides

nonsequential program counter output (TPC) at the

DCLKP rate.

DJ_TMSP Test Mode Select Input

This signal is the TMS input from the EJTAG probe. The

TAP controller decodes this signal for test operation

control. DJ_TMSP is sampled on the rising edge of TCK.

DJ_TRSTN Test Reset Input

This signal is the TRST input from the EJTAG probe. This

active LOW signal provides an asynchronous reset for

the EJTAG Interface module that is independent of the

processor logic.

DCLKP EJTAG PC Trace Clock Output

This signal is the DCLK output to the EJTAG probe.

DCLKP is a 50% duty cycle clock generated from PCLKP.

During PC Trace this signal helps capture address and

data from the DJ_TDOP_TPCP pin at the processor

clock speed divided by 2. DCLKP is LOW when the

ClkEn bit in the ECR is 0 or when no probe is present

(ProbEn bit equals 0 in ECR register).

DT_PCST1[2:0]

PC Trace Status Information 1 Output

This 3-bit bus provides one-half the PCST output to the

EJTAG probe. During PC Trace mode, this bus drives PC

Status information to the EJTAG probe. This bus contains

the status of the most recent instruction of the two

presented. See also the DT_PCST2[2:0] signal

description.

EJTAG and PC Trace Signals 5-9

DT_PCST2[2:0]

PC Trace Status Information 2 Output

This 3-bit bus provides one-half the PCST output to the

EJTAG probe. During PC Trace mode, this bus drives PC

Status information to the EJTAG probe. This bus contains

the status of the least-recent instruction of the two

presented. See also the DT_PCST1[2:0] signal

description.

DT_TPCPLP[6:0]

TPC Plus Output

When PC Trace is on, this bus functions similar to the

DJ_TDIP_DINTN signal. It outputs another 7 bits of the

target PC information for PC Trace.

DP_PCST

Settings Symbol Status

000 DBM Debug mode

001 TSQ Trace trigger output at execution time

010 TST Trace trigger information Is output when

the pipeline is stalled

011 SEQ Execution of nonjump instructions

100 EXP Exception generated

101 BRT Execution of a taken direct jump

instruction or PC relative instruction

110 JMP Execution of a taken Jump instruction

111 STL Pipeline stall

DP_PCST

Settings Symbol Status

000 DBM Debug mode

001 TSQ Trace trigger output at execution time

010 TST Trace trigger information is output when

the pipeline is stalled

011 SEQ Execution of nonjump instructions

100 EXP Exception generated

101 BRT Execution of a taken direct jump

instruction or PC relative instruction

110 JMP Execution of a taken jump instruction

111 STL Pipeline stall

5-10 Signal Descriptions

5.3.2 EJTAG Standard Support Signals

These signals are necessary to implement the Standard EJTAG signals

listed in Section 5.3.1, “EJTAG Standard Signals.”

DJ_JTAGALSOP

Parallel JTAG Present Input

When HIGH, this signal indicates that a JTAG interface

coexists with the EJTAG on the same chip, and that the

DJ_JTAGTDOP signal is relevant.

DJ_JTAGTDOP

Parallel JTAG TDO Input

This signal makes it possible to daisy chain an external

JTAG controller to the EJTAG Interface, so both JTAG

and EJTAG coexist on one chip. To do this, connect TDO

from the external JTAG controller to the DJ_JTAGTDOP

input.

DJ_TDO_DRIVEN

TDO Output Enable Output

When LOW, this signal enables the DJ_TDOP_TPCP

signal output buffer. In PC Trace mode, this signal is

always active. When not in PC Trace mode, this signal is

only active while data is shifting out.

5.3.3 Nonmultiplexed EJTAG Signals

Use these signals if not multiplexing TPC with TDO. The LSB of the TPC

interface, as well as the TDO value, are output independently.

DJ_PURETDO_DRN

Pure TDO Output Enable Output

When LOW, this signal enables the DJ_PURETDOP

signal output buffer. Unlike DJ_TDO_DRIVEN, this signal

is not active in PC Trace mode. The purpose of

DJ_PURETDO_DRN is to enable the output of the

DJ_PURETDOP signal when multiplexing TDO and

TPC1 is not desired.

DJ_PURETDOP

Pure TDO Output

This signal is the pure test data output from the EJTAG

Interface module without the multiplexed TPC1.

EJTAG and PC Trace Signals 5-11

DT_TPC1P TPC Bit 1 Output

This signal is the pure TPC1 from the PC Trace module

without the multiplexed TDO.

5.3.4 EJTAG External Module Signals

These EJTAG output signals are for use by modules outside the

EZ4021-FC.

BC_DMP Debug Mode Output

When this signal is active HIGH, it indicates that the CPU

instruction fetch active at the rising edge of SCLK was a

debug mode instruction fetch. This bit is cleared on the

ﬁrst SCLK rising edge after the W-stage execution of the

instruction in the DERET slot, indicating that the

processor is no longer in Debug mode. When this signal

is LOW, the processor is not in Debug mode.

DJ_DBGBRKPDebug Break Input

When asserted, this signal causes an EJTAG Break

Debug exception and sets the EjtagBrk bit in the ECR

This bit asynchronously causes the EJTAG Break

condition. Deassert this signal before the processor

leaves the debug exception handler, or else another

EJTAG Break condition will occur.

DJ_PERRSTN Peripheral Reset Output

When driven LOW, this signal resets all peripherals on

the chip.

5.3.5 EJTAG Conﬁguration Signals

These signals are used to conﬁgure the EZ4021-FC EJTAG interface.

DJ_DBRKDEMUXP

Disable DTIP_DINTN Break Output

When HIGH, this signal prevents the multiplexed

DJ_TDIP_DINTN pin from causing an EJTAG Break

condition while the system is in PC Trace mode. This

function is controlled only by the dedicated

5-12 Signal Descriptions

DJ_DBGBRKP signal. When LOW, asserting either

DJ_DBGBRKP or DJ_TDIP_DINTN causes an EJTAG

break condition.

DJ_EJTAGIRBITS[1:0]

EIR Extension Width Input

This 2-bit bus extends the width of the EJTAG Instruction

DJ_PON[19:0] Part Number Input

Hardwire this 20-bit bus to indicate the JTAG part number

consistent with the JTAG ID register. This part

number/device revision number/location indicator must be

unique among all LSI Logic manufactured parts, and

software uses it to identify the unique characteristics of

the hardware.

DT_PCTEN PC Trace Enable Input

When driven LOW, this signal enables PC Trace. When

driven HIGH, it disables PC Trace.

MMU_CNTALWYSP

MMU Increment Count Reg in Debug Mode Input

When asserted, this signal indicates that the CP0 Count

mode. If this signal is deasserted, then upon entering

Debug mode the Count register stops incrementing.

Counting resumes upon return to normal operation. The

recommended setting for this input is 0.

DJ_EJTAGIRBITS[1:0] EIR Length

00 5 bits

01 6 bits

10 7 bits

11 8 bits

Global Test Mode Signals 5-13

5.4 Global Test Mode Signals

This section describes the global test mode signals.

GSCAN_ENABLEP

Core Scan Enable Input

When asserted, this signal enables the EZ4021-FC scan

chain shift operation. For normal operation, this input

must be deasserted.

GSCAN_IN1P Core Scan Chain 1 Input Input

This signal is the EZ4021-FC scan chain No. 1 input.

GSCAN_IN2P Core Scan Chain 2 Input Input

This signal is the EZ4021-FC scan chain No. 2 input.

GSCAN_IN3P Core Scan Chain 3 Input Input

This signal is the EZ4021-FC scan chain No. 3 input.

GSCAN_IN4P Core Scan Chain 4 Input Input

This signal is the EZ4021-FC scan chain No. 4 input.

GSCAN_IN5P Core Scan Chain 5 Input Input

This signal is the EZ4021-FC scan chain No. 5 input.

GSCAN_IN6P Core Scan Chain 6 Input Input

This signal is the EZ4021-FC scan chain No. 6 input.

GSCAN_MODEP

Global Test Mode Input

When asserted, the EZ4021-FC operates in global test

mode. For normal operation, this input must be

deasserted.

GSCAN_OUT1P

Core Scan Chain 1 Output Output

This signal is the EZ4021-FC scan chain No. 1 output.

GSCAN_OUT2P

Core Scan Chain 2 Output Output

This signal is the EZ4021-FC scan chain No. 2 output.

GSCAN_OUT3P

Core Scan Chain 3 Output Output

This signal is the EZ4021-FC scan chain No. 3 output.

5-14 Signal Descriptions

GSCAN_OUT4P

Core Scan Chain 4 Output Output

This signal is the EZ4021-FC scan chain No. 4 output.

GSCAN_OUT5P

Core Scan Chain 5 Output Output

This signal is the EZ4021-FC scan chain No. 5 output.

GSCAN_OUT6P

Core Scan Chain 6 Output Output

This signal is the EZ4021-FC scan chain No. 6 output.

GSCAN_RAMCLKP

Scan Test RAM Clock and BIST Clock Input

This signal clocks data into the EZ4021-FC RAMs during

scan test (when GSCAN_MODEP is asserted).

GSCAN_RAMCLKP is supplied by off-chip test

equipment. Clocking the RAMs allows data to pass

through from RAM input to output, which improves scan

test coverage.

In scan mode GSCAN_RAMCLKP serves as the scan

test clock for the RAMs, and PCLKP is the scan clock for

all other logic, including the BIST logic.

In BIST mode, GSCAN_RAMCLKP serves as the BIST

clock.

5.5 BIST Signals

The BIST signals are the I/O signals to/from the MemBIST Controller and

a user-supplied external TAP controller. All signals are referenced to the

MemBIST Controller.

Miscellaneous Signals 5-15

The BIST signals are created automatically when the MemBIST

Controller is generated using the Logic Vision memBIST IC tools. For an

overview of I-Cache BIST, see Section 8.1, “I-Cache BIST,” on

page 8-1.The BIST signals are listed as follows:

5.6 Miscellaneous Signals

This section describes the remaining EZ4021-FC signals.

BIG_ENDIANPBig Endian Mode Input

BIG_ENDIANP is a static input (typically hardwired) to

the EZ4021-FC. When this signal is asserted, the

EZ4021-FC operates in big-endian addressing mode.

The endian mode affects byte positions for load and store

data alignment.

CACHE_TESTP

Cache Test Mode Input

When asserted, this signal enables the EZ4021-FC

cache test mode.

Signal Mnemonic Function Direction

BIST_DIAG_EN BIST Diag Enable Input

BIST_HOLD BIST Hold Command Input

BIST_SETUP[1:0] BIST Setup Input

BIST_SHIFT BIST Shift Command Input

BIST_SI BIST Shift Data In Input

BIST_SO BIST Shift Data Out Output

MBIST_DONE BIST Test Completion Output

MBIST_EN BIST Controller Enable Input

MBIST_GO BIST Test Failure Indication Output

TCK BIST TAP Controller Clock Input

TCK_MODE BIST TCK Mode Input

5-16 Signal Descriptions

COP_CP0COND

CP0 Branch Condition Input

This input can be tested using the BCzF, BCzFL, and

BCzT branch instructions (z=0). If asserted, and a BCzT

(z = 0) branch is encountered, the branch is taken.

CPU_EC_WAITI

Wait for Interrupt Output

When asserted, this signal indicates a WAITI instruction

was executed. This signal is deasserted when the core

receives an interrupt or EJTAG break.

DCACHE_ENABLEP

Data Cache Enable Input

When asserted, this signal enables the EZ4021-FC data

cache.

DHQ_SCR1[31:0]

System Conﬁguration Register Output

This 32-bit bus outputs the contents of the System

Conﬁguration Register 1. It provides for easy software

conﬁguration of various system parameters.

ICACHE_ENABLEP

Instruction Cache Enable Input

When asserted, this signal enables the EZ4021-FC

instruction cache.

LOADSCHED_ENABLEP

Load Scheduling Enable Input

When asserted, this signal enables one data load

scheduling in the CPU.

MMU_ENABLEP

MMU Enable Input

When asserted, this signal enables virtual-to-physical

address mapping through the MMU.

PREFETCH_ENABLEP

Instruction Prefetch Enable Input

When asserted, this signal enables the BIU speculative

instruction prefetch mechanism.

Miscellaneous Signals 5-17

PRID_REV[3:0]

Processor Revision Identiﬁer Input

These 4 inputs to the EZ4021-FC are static and deﬁne

the least signiﬁcant 4 bits of the REV ﬁeld, which is part

of the PRId register. These bits enable you to change the

PRId REV number without requiring a change to the

EZ4021-FC.

PSTALLP EZ4021-FC Global Stall Output

The EZ4021-FC asserts this signal to indicate when the

CPU is stalled. This signal is the registered version of the

internal CPU stall signal.

SNOOP_ENABLEP

Data Cache Snoop Enable Input

When asserted, this signal enables data cache

invalidation through Quick Bus snooping.

READPRI_ENABLEP

Read Priority Enable Input

When asserted, the EZ4021-FC prioritizes load requests

ahead of store requests on the Quick Bus.

VCED_ENABLEP

Virtual Coherency Exception Data Enable Input

This signal, which must be tied to 0, connects to the

DCacheC bit in the EJTAG Implementation register. The

0 state of this register bit indicates that the EJTAG debug

solution in the EZ4021-FC does not maintain instruction

cache coherency with EJTAG-initiated, DMA operations.

The DCacheC bit is described on page 3-40.

WRITEBUF_ENABLEP

Write Buffer Enable Input

When asserted, this signal enables the BIU’s

8-doubleword write buffer. Otherwise, the write buffer is

one-entry deep.

5-18 Signal Descriptions

MiniRISC EZ4021-FC EasyMACRO Microprocessor 6-1

Chapter 6

Interface Operation

This chapter provides waveforms that depict the operation of the

EZ4021-FC’s signals. This chapter contains the following sections:

•Section 6.1, “Quick Bus Transactions”

•Section 6.2, “Reset Behavior”

•Section 6.3, “Interrupt Behavior”

•Section 6.4, “Wait States”

6.1 Quick Bus Transactions

The EZ4021-FC performs reads and writes to on-chip devices through

the Quick Bus. The Quick Bus is a split transaction bus that implements

a nonblocking bus protocol. Requests for data and the return of data are

independent of each other. The EZ4021-FC can make a read request for

data on the Quick Bus to a slave device and not have to wait for the data

to be returned before making another request on the Quick Bus to the

same or another device. In this document, Quick Bus transactions are

categorized into basic and advanced transactions.

6.1.1 Basic Transactions

The three basic Quick Bus transactions are fetch (read), load data (read),

and store data (write).

6.1.1.1 Instruction Fetch (Read)

There are two types of instruction fetches: cached and noncached. For

cached instruction fetches, the EZ4021-FC requests a 4-doubleword

burst of data from the Quick Bus. For noncached instruction fetches, a

single doubleword of instruction data is requested from the Quick Bus.

6-2 Interface Operation

The data is returned to the EZ4021-FC when the slave has processed

the request and accessed the required data. This read transaction is dual

phased: a request phase and then a data return phase.

Four-Doubleword (Burst) Instruction Request – Figure 6.1 depicts

two instruction fetch burst requests. The Quick Bus can grant the bus

(QB_GRANT_BC_IP) in the same cycle as the request seen at time

Tn + 1, or can take any number of cycles. (Three are shown in the ﬁgure

from time T1 to T3.). If the Quick Bus decodes an address error,

QB_BADADDRP is asserted instead of QB_CMDRDYP. In this case, the

EZ4021-FC interprets the Quick Bus address error as an Instruction Bus

Error.

Figure 6.1 Four-Doubleword Instruction Request

Return of Instruction Burst Data – After the EZ4021-FC makes an

instruction request on the Quick Bus, the target of the request (slave)

accesses the requested data. When the data is retrieved, the slave

places the data on the Quick Bus and indicates ready. The EZ4021-FC

does not have to take the ready data; it can deassert BC_QB_RDACKP

until it is ready for the next doubleword (for example, at time T4 and T5

in Figure 6.2). The EZ4021-FC then gets the data from the Quick Bus.

T1 T2 T3 T4 Tn Tn+1 Tn+2

Clock Cycles

addr[32] addr[32]

QB_BADADDRP

QB_BURSTACKP

QB_CMDRDYP

QB_GRANT_BC_IP

BC_QB_ADDRP

BC_QB_BURSTREQP

BC_QB_READP

BC_I_QB_BREQP

SCLKP

Quick Bus Transactions 6-3

The assertion of QB_RDERRP signiﬁes the slave was unable to

successfully access the requested data. An error is returned along with

the 4 doublewords. The EZ4021-FC interprets this as an Instruction Bus

Error.

Figure 6.2 Instruction Burst Data Return

Single Doubleword Instruction Request – The single doubleword

instruction fetch is a simpliﬁed version of the burst instruction fetch. (See

Figure 6.3.) The only difference is in the request phase where the

BC_QB_BURSTREQP signal is LOW, indicating a single doubleword

request. The Quick Bus returns QB_BADADDRP if the address

requested is not mapped in the Quick Bus address decoder. The

EZ4021-FC interprets this occurrence as an Instruction Bus Error.

The return of data is shown to be a single cycle event. The data is ready,

and the EZ4021-FC immediately acknowledges the data (see Tn + 1 in

Figure 6.3). Or, as shown in T5 of Figure 6.8, the EZ4021-FC may not

immediately acknowledge the data when the Quick Bus is ready. Only

when BC_QB_RDACKP is asserted will the Quick Bus know the

EZ4021-FC received the data. The returned data may be in error, so the

Quick Bus will assert QB_RDERRP along with the data ready signal

(QB_RDRDY_BC_IP).

SCLKP

QB_RDRDY_BC_IP

QB_RDDATAP

QB_RDERRP

T1 T2 T3 T4 T5 T6 T7

Clock Cycles

BC_QB_RDACKP

0 312

6-4 Interface Operation

Figure 6.3 Single Doubleword Instruction Request and Return

6.1.1.2 Load Data (Read)

The mechanism for requesting load or EJTAG data is exactly the same

as requesting instruction data. The return of load data is exactly the

same as the return of instruction data. The difference in the request

phase is that instead of asserting BC_I_QB_BREQP (Instruction Cache),

BC_D_QB_BREQP (Data Cache), or BC_E_QB_BREQP (EJTAG) is

asserted. The Quick Bus grants the bus by asserting

QB_GRANT_BC_DP or QB_GRANT_BC_EP instead of

QB_GRANT_BC_IP. QB_RDRDY_BC_DP signiﬁes the Quick Bus has

data ready for the Data Cache, and QB_RDRDY_BC_EP signiﬁes the

Quick Bus has data ready for EJTAG. (For example, see Figure 6.8,

time T9.)

T1 T2 T3 T4 Tn Tn + 1 Tn + 2

Clock Cycles

addr[32]

datazero

SCLKP

BC_I_QB_BREQP

BC_QB_READP

BC_QB_BURSTREQP

BC_QB_ADDRP

QB_GRANT_BC_IP

QB_CMDRDYP

QB_BURSTACKP

QB_BADADDRP

QB_RDRDY_BC_IP

QB_RDDATAP

BC_QB_RDACKP

QB_RDERRP

Quick Bus Transactions 6-5

As in instruction fetches, the Quick Bus can return an error on requests

or data returns by asserting QB_BADADDRP or QB_RDERRP,

respectively. For load data fetches, the EZ4021-FC interprets the

assertion of these signals as Data Bus Errors.

6.1.1.3 Store Data (Write)

A store data has one of two Quick Bus IDs: D for data cache or E for

EJTAG. The store data (write) transaction is single phased, while load

data (read) transactions are dual phased. The store request is similar to

a load request, except the BC_QB_WRITEP is asserted instead of

BC_QB_READP, and the data to be written is on BC_QB_WRDATAP.

Byte enables accompany all writes on BC_QB_BYTEP. When the Quick

Bus asserts QB_CMDRDYP to acknowledge the request, the target slave

device has already latched the data to be written, so at this point the

EZ4021-FC no longer needs to drive the request or data lines. The

EZ4021-FC can request a burst write (see Section 6.1.1.4, “Store Burst

(Burst Write),” on page 6-6); that is, it can lock the bus by asserting

BC_QB_CMDLOCKP and perform four consecutive writes to the Quick

Bus. As depicted, back-to-back writes are possible. DMA writes from the

EJTAG module look like store writes from the Data Cache (see

Figure 6.4), except that BC_E_QB_BREQP and QB_GRANT_BC_EP

are relevant instead of BC_D_QB_BREQP and QB_GRANT_BC_DP.

6-6 Interface Operation

Figure 6.4 Store Data Write

6.1.1.4 Store Burst (Burst Write)

Figure 6.5 shows the waveforms for a burst write operation. Burst writes

transfer four doublewords to the Quick Bus. For a burst write, the

EZ4021-FC asserts the burst request signal (BC_QB_BURSTREQP) for

the ﬁrst write. If the request is acknowledged, then the EZ4021-FC

asserts the bus lock (BC_QB_CMDLOCKP) for the following three writes.

If the burst request is not acknowledged, then the bus lock signal is not

asserted, and the burst write operation does not occur at this time.

Instead, four normal write operations are performed without locking the

bus.

T1 T2 T3 T4 T5 T6 T7

Clock Cycles

addr0[32] addr2[32]

data0[64] data2[64]

addr1[32]

data1[64]

data0[8] data2[8]data1[8]

SCLKP

BC_D_QB_BREQP

BC_QB_WRITEP

BC_QB_BURSTREQP

BC_QB_ADDRP

BC_QB_WRDATAP

BC_QB_BYTEP

QB_GRANT_BC_DP

QB_CMDRDYP

QB_BADADDRP

Quick Bus Transactions 6-7

Figure 6.5 Store Burst

6.1.2 Advanced Transactions

This section discusses more advanced Quick Bus transactions that

involve protocol between the Quick Bus and the EZ4021-FC. The

transactions described here consist of a busy target slave, nonburstable

slave, and multiple requests occurring while data is returning.

6.1.2.1 Quick Bus Slave Ready Mechanism

In the basic transactions described in Section 6.1.1, “Basic Transactions,”

the target slave is always ready to accept the request and data. In normal

operation, the slave might not be ready. The EZ4021-FC has a slave

ready mechanism in place to handle this situation.

T1 T2 T3 T4 T5 T6 T7

Clock Cycles

021

SCLKP

BC_D_QB_BREQP

BC_QB_WRITEP

BC_QB_BURSTREQP

BC_QB_ADDRP

BC_QB_WRDATAP

BC_QB_BYTEP

QB_GRANT_BC_DP

QB_CMDRDYP

QB_BURSTACKP

0213

BC_QB_CMDLOCKP

6-8 Interface Operation

The example in Figure 6.6 shows an EJTAG request

(BC_E_QB_BREQP) at T1/T2 followed by a data request at T3/T4.

Although the Quick Bus asserts QB_GRANT_BC_EP and grants the bus

to the EZ4021-FC, the slave is not ready to accept the EJTAG request

(T2). In this case, QB_CMDRDYP is deasserted in the cycle the Quick

Bus was granted to the EZ4021-FC. In the next cycle, the EZ4021-FC

deasserts the denied request, BC_E_QB_BREQP, and monitors the

slave ready signal, QB_SLRDY_BC_EP (T3).

Although the slave for the EJTAG request is busy, the target slave for the

data cache request is ready and accepts the request (T4). Then the

EJTAG slave asserts the ready signal (T5), indicating the EZ4021-FC

should resend the request (T6).

The slave ready mechanism prevents unnecessary requests from

wasting bus bandwidth. In this example, the data cache request was able

to use the bus while the EJTAG request was waiting for its slave to

become ready.

Quick Bus Transactions 6-9

Figure 6.6 Quick Bus Slave Ready Operation

T1 T2 T3 T4 T5 T6 T7

Clock Cycles

addr0[32] addr0[32]

data1[64]

addr1[32]

data1[8]

SCLKP

BC_E_QB_BREQP

BC_D_QB_BREQP

BC_QB_WRITEP

BC_QB_READP

BC_QB_BURSTREQP

BC_QB_ADDRP

BC_QB_WRDATAP

BC_QB_BYTEP

QB_GRANT_BC_EP

QB_GRANT_BC_DP

QB_BURSTACKP

QB_CMDRDYP

QB_SLRDY_BC_EP

6-10 Interface Operation

6.1.2.2 Burst Request of a Nonburstable Device

The EZ4021-FC always attempts a burst (four doubleword) request of a

target slave if the access is in cacheable space. In some cases, a slave

cannot perform burst operations. (See Figure 6.7.) In that case the

EZ4021-FC manually makes a burst request; that is, it makes four

individual requests of that device, incrementing the address for each

doubleword. Initially, the EZ4021-FC makes a request, the bus is

granted, and the request is accepted by the target slave, except the burst

request is not acknowledged (T1). The EZ4021-FC then manually

requests the remaining three doublewords of the burst. (See Figure 6.7.)

Figure 6.7 Burst Request of a Nonburstable Device

T1 T2 T3 T4 T5 T6 T7

Clock Cycles

addr0 addr3addr2addr1

SCLKP

BC_I_QB_BREQP

BC_QB_READP

BC_QB_BURSTREQP

BC_QB_ADDRP

QB_GRANT_BC_IP

QB_BURSTACKP

QB_BADADDRP

QB_CMDRDYP

Quick Bus Transactions 6-11

6.1.2.3 Multiple Requests and Return of Data

This subsection presents a scenario where multiple events occur as in a

real simulation or system, except the slaves are always ready and there

are no errors. (Thus, QB_SLRDY_BC_<I/D/E>P, QB_BADADDRP, and

QB_RDERRP are not used.) In Figure 6.8 the EZ4021-FC requests a

burst (4 doublewords) of instructions (T1), and the target slave accepts

the request (T2). The requested data is returned one cycle later (T4)

and, while executing the requested instructions, a store is decoded and

sent to the Quick Bus from the EZ4021-FC (T6). The Quick Bus

processes the store write request while returning data for the instruction

read. Two cycles later, the EZ4021-FC makes a load data read request

of the Quick Bus (T9). The QuickBus returns a bus grant

(QB_GRANT_BC_DP) and command ready (QB_CMDRDYP), signaling

that the load request was accepted by the QuickBus, passed on to the

target slave, and accepted by the target slave. While data is returning for

the load read, an EJTAG Write DMA request is asserted on the QuickBus

by the EZ4021-FC (T11). Notice the EJTAG write was not granted to the

bus until T13. This occurred because the Quick Bus was busy servicing

another master (not shown); the delay had nothing to do with data

returning for the Data Cache.

6-12 Interface Operation

Figure 6.8 Multiple Requests

T1 T2 T3 T4 T5 T6 T7

Clock Cycles

addr0[32] addr1[32]

data1[64]

data1[8]

data0+1data0+0 data0+2

SCLKP

BC_I_QB_BREQP

BC_D_QB_BREQP

BC_E_QB_BREQP

BC_QB_WRITEP

BC_QB_READP

BC_QB_BURSTREQP

BC_QB_ADDRP

BC_QB_WRDATAP

BC_QB_BYTEP

QB_GRANT_BC_IP

QB_GRANT_BC_DP

QB_GRANT_BC_EP

QB_BURSTACKP

QB_CMDRDYP

QB_RDRDY_BC_IP

QB_RDRDY_BC_DP

QB_RDRDY_BC_EP

QB_RDDATAP

BC_QB_RDACKP

Quick Bus Transactions 6-13

Figure 6.8 Multiple Requests (Cont.)

T8 T9 T10 T11 T12 T13 T14

Clock Cycles

addr2[32] addr3[32]

data3[64]

data3[8]

data2+1

data0+3 data2+3data2+0 data2+2

SCLKP

BC_I_QB_BREQP

BC_D_QB_BREQP

BC_E_QB_BREQP

BC_QB_WRITEP

BC_QB_READP

BC_QB_BURSTREQP

BC_QB_ADDRP

BC_QB_WRDATAP

BC_QB_BYTEP

QB_GRANT_BC_IP

QB_GRANT_BC_DP

QB_GRANT_BC_EP

QB_BURSTACKP

QB_CMDRDYP

QB_RDRDY_BC_IP

QB_RDRDY_BC_DP

QB_RDRDY_BC_EP

QB_RDDATAP

BC_QB_RDACKP

6-14 Interface Operation

6.2 Reset Behavior

This section describes the two reset types and the affect each has on

modules in the EZ4021-FC. The two reset types are reset and soft reset.

6.2.1 Reset

The primary purpose of a Reset is to initialize the EZ4021-FC

EasyMACRO core at power up. When asserted, the RESETP signal

initializes the internal states and control registers in the EZ4021-FC.

However, RESETP does not initialize the general-purpose registers, the

I-Cache, or the D-Cache.

The RESETP signal must be asserted and deasserted on the rising edge

of the system clock (SCLKP). It must remain active for at least four

SCLKP clock cycles. The EZ4021-FC considers RESETP a

nonmaskable exception and remains in idle mode while RESETP is

asserted. Figure 6.9 shows the timing for a reset and the start of an

instruction fetch after RESETP is deasserted.

Figure 6.9 Reset Pipeline Behavior

For more information on reset exception handling, refer to sections

7.10.1 and 7.10.2, which begin on page 7-13.

SCLKP

RESETP

EG_CPURSTP

CPU_CD_IVA

Instruction 0

Instruction 1

Instruction 2

Reset Instruction 0

Reset Instruction 1

Reset Instruction 2

FRXMW

KilledF

Killed

FRX

A A+4 BCF0 0000 +4 +8

Reset Behavior 6-15

6.2.2 Soft Reset

The primary purpose of the Soft Reset exception is to reinitialize the

processor after a fatal error. When asserted, Soft Reset initializes the

EZ4021-FC internal states and control registers. However, Soft Reset

does not initialize the general-purpose registers, the I-Cache, the

D-Cache, or the MMU TLB.

The Soft Reset exception occurs when the EZ4021-FC deasserts the

Processor Reset bit (PrRst) in the EJTAG Control Register (ECR). The

Soft Reset exception is nonmaskable, and the EZ4021-FC is in idle mode

during the period ECR[PrRst] is asserted. The start of the instruction

fetch after ECR[PrRst] is deasserted is the same as that of RESETP, as

shown in Figure 6.9.

For more details on the Soft Reset exception handling, refer to Section

7.10.2, “Soft Reset Exception,” on page 7-14.

6.2.3 Modules Affected by Reset

Table 6.1 lists the reset sources and the modules that they affect.

Note: The system must reach a known steady state before either

PrRst, ERst, or DJ_TRSTN is asserted (or the TAP

controller achieves the Test-Logic-Reset state). If the

protocol between modules is in an intermediate state in

which asserting a reset to 1 module and not another

causes a protocol violation (for example, asserting ERst

resets the EJTAG Probe DMA and CPU Probe Access

Logic but not the CPU), undeﬁned operation will occur.

6-16 Interface Operation

Table 6.1 Reset Sensitivity

Module Reset Soft

Reset

Processor

Reset

(PrRst)1

EJTAG

Reset

(ERst)2Test Reset

(DJ_TRSTN)3

TAP

Controller

Test Logic

Reset4

CPU Yes Yes Yes No No No

CP0 Yes Yes Yes No No No

ICC Yes Yes Yes No No No

DCC Yes Yes Yes No No No

BIU Yes Yes Yes No No No

MMU Yes No No No No No

MDU Yes Yes Yes No No No

EJTAG Interface

- EJTAG Probe DMA and

CPU Probe Access

Logic

- EJTAG Protocol Engine,

TAP Controller, and

Serial Registers

- EJTAG Breakpoint

Logic

- EJTAG PC Trace Logic

Yes

Yes5

Yes

Yes5

Yes

1. Processor Reset, bit 16, in the EJTAG Control register. Note that PrRst is identical to the CPU Soft

Reset. Setting PrRst causes a soft reset.

2. EJTAG Reset, bit 7, in the EJTAG Control register.

3. EasyMACRO core input signal.

4. This reset is identical to the assertion of DJ_TRSTN and has the same effect.

5. In this case, the registers and the TAP Controller are not reset.

Interrupt Behavior 6-17

6.3 Interrupt Behavior

The EZ4021-FC supports maskable and nonmaskable interrupts.

6.3.1 Nonmaskable Interrupt

The Nonmaskable Interrupt input signal (NMIP) must be asserted and

deasserted on the rising edge of the system clock and should not be

active for more than 1 SCLKP cycle. When NMIP is sampled and found

to be active on the rising edge of the clock, CP0 provides a nonmaskable

exception vector (0xBFC0.0000). Figure 6.10 shows the timing diagram

for the fastest detected case. Figure 6.11 shows the case in which NMIP

is not serviced immediately because of a pipeline stall. The EZ4021-FC

latches the NMIP signal until it is ready to service the interrupt.

Figure 6.10 NMI Pipeline Behavior (Detected Immediately)

PCLKP

NMIP

Instruction 0 FRXM

FRX

Instruction 1

Instruction 2

Instruction 3

Exception F

Killed

Latched

T1 T2 T3 T4 T5

Clock Cycles T6

Internal NMI

Handler 0

SCLKP

Kill

Stall

6-18 Interface Operation

Figure 6.11 NMI Pipeline Behavior (Detection Delayed due to Stall)

For more details on the Soft Reset exception handling, refer to

Section 7.10.2, “Soft Reset Exception,” on page 7-14.

6.3.2 Maskable Interrupts

The EZ4021-FC has ﬁve external interrupt inputs, INTP[4:0], which must

be asserted and deasserted on the rising edge of the system clock. To

mask all ﬁve external interrupts at once, clear the IE bit of the Status

Status register. For more information about this register, refer to

Section 3.2.2.5, “Status Register (12).” The instruction fetch for the

exception handler starts two clocks after an external interrupt is detected,

provided that the pipeline is not in a stall state and that there is no higher

priority exception. Figure 6.12 shows the timing diagram when an

interrupt is detected immediately.

XXXXXXKilled

RRRRRRKilled

F Killed

T1 T2 T3 T4 T5 T6 T7 T8 T9

Clock Cycles

PCLKP

SCLKP

NMIP

Latched

Internal NMI

Kill

Stall

Instruction 1

Instruction 2

Instruction 3

Exception

Handler 0

MMMMMMKilledInstruction 0

Wait States 6-19

Figure 6.12 Interrupt Pipeline Behavior (Detected Immediately)

An INTP exception is similar to an NMI exception, except that external

interrupts are not latched internally, and must be asserted until they are

serviced. If the pipeline is in a stall cycle, the EZ4021-FC does not

service interrupts until the stall condition is resolved.

For more information on the Interrupt exception handling, refer to

Section 7.10.13, “Interrupt Exception,” on page 7-27.

6.4 Wait States

The EZ4021-FC uses the WAITI instruction, which is one of its extended

instructions, to enter a power-saving wait state. In this state, the

EZ4021-FC stalls the pipeline and reduces power consumption during

the period that the EZ4021-FC is inactive. The EZ4021-FC wakes up

when it detects an external exception input (enabled interrupt, NMIP,

reset, soft reset, or bus error). Figure 6.13 shows the timing diagram for

the WAITI instruction.

PCLKP

INTP

Kill

Stall

T1 T2 T3 T4 T5

Instruction 0 FRXM

FRX

Instruction 1

Instruction 2

Instruction 3

Exception F

Killed

Clock Cycles

Handler 0

6-20 Interface Operation

Figure 6.13 WAITI Pipeline Stall

At T1 the CP0 starts executing a WAITI instruction. At T3 (which occurs

in the WB stage of the pipeline), the CP0 requests a pipeline stall and

the EZ4021-FC asserts P_STALLP. At T6 an external interrupt input is

asserted and the EZ4021-FC wakes up during T7. At T8 the instructions

in the pipeline stages are killed, and the IF stage for the exception

handler starts at T9.

T1 T2 T3 T4 T5 T6 T7 T8 T9

Clock Cycles

PCLKP

WAITI Instruction

Instruction 1

Instruction 2

Exception

FRX

MMMM

XXXX

INTP

CPU_EC_WAITI

Kill

Killed

Handler 0

MiniRISC EZ4021-FC EasyMACRO Microprocessor 7-1
Chapter 7
Error and Exception
Handling
This chapter describes how the EZ4021-FC handles errors and
exceptions. It includes information that explains how the EZ4021-FC
handles standard (nondebug) exceptions as well as debug exceptions
during normal mode operation. The EZ4021-FC has no special
provisions for error detection or processing other than what is described
here.
This chapter includes the following sections:
•Section 7.1, “Overview”
•Section 7.2, “Exception Handling Registers”
•Section 7.3, “Standard Exception Operation”
•Section 7.4, “Standard Exception Processing Actions”
•Section 7.5, “Debug Exception Operation”
•Section 7.6, “Debug Exception Processing”
•Section 7.7, “Precision of Exceptions”
•Section 7.8, “Exception Vector Locations”
•Section 7.9, “Priority of Exceptions”
•Section 7.10, “Exception Descriptions”
•Section 7.11, “Loss of PC Trace Information”
•Section 7.12, “Spurious Debug Mode Indications”
7.1 Overview
When the EZ4021-FC detects a standard exception, it suspends the
normal sequence of instruction execution, exits from the current mode,
and enters Kernel mode, where it can handle exceptions. The EZ4021-

7-2 Error and Exception Handling

FC reverts to Kernel mode, regardless of the mode at the time of the

exception. The processor then disables interrupts and forces a software

handler located at a ﬁxed address in memory to execute. The handler

saves the context of the processor. The original context must be restored

after the exception is handled.

When a standard exception occurs, the System Coprocessor (CP0) loads

the Exception Program Counter (EPC) with a restart location where

execution can resume after the exception is serviced. The restart location

in the EPC is the address of the instruction that caused the exception or,

if the instruction was executing in a Branch Delay slot, the address of the

branch instruction immediately preceding the delay slot. The instruction

causing the exception and all the instructions following it in the pipeline

are aborted. They are refetched after returning from the exception

handler.

When the EZ4021-FC detects a debug exception, it suspends the normal

sequence of instruction execution, exits from User, Supervisor or Kernel

mode, and enters Debug mode, where it handles debug exceptions. The

processor then disables all exceptions, standard or debug, with the

exception of reset, and forces a software handler located at a ﬁxed

address in memory to execute. The handler saves the context of the

processor. The original context must be restored when the exception has

been handled.

When a debug exception occurs, the System Coprocessor (CP0) loads

the Debug Exception Program Counter (DEPC) with a restart location

where execution can resume after the exception is serviced. The restart

location in the DEPC is the address of the instruction that was executing

at the time of the exception or that caused the exception or, if the

instruction was executing in a Branch Delay slot, the address of the

branch instruction immediately preceding the delay slot. The instruction

causing the exception and all the instructions following it in the pipeline

are aborted. They are refetched after returning from the debug exception

handler.

Table 7.1 summarizes the events that can initiate exception processing.

Overview 7-3

Table 7.1 EZ4021-FC Standard Exception Summary

Exception Cause

Address Error Triggered by:

- Load or store doubleword not aligned on a doubleword boundary.

- Load, fetch, or store word that is not aligned on a word boundary.

- Load or store halfword that is not aligned on a halfword boundary.

- Reference Kernel address space from User or Supervisor mode.

- Reference Supervisor address space from User mode.

Bus Error (Data) Assertion of the external data bus error input, BC_DBUS_ERR

Bus Error (Instruction) Assertion of the external bus error input, BC_IBUS_ERR

Coprocessor Unusable,

System Call, Breakpoint,

Reserved Instruction

Coprocessor Unusable – Execution of a coprocessor instruction

where the Coprocessor Usable (Cu) bit is not set for the target

coprocessor

SYSCALL – attempts to execute the System Call instruction

BREAK – attempts to execute the Breakpoint instruction

Reserved Instruction – attempts to execute instruction with an

undeﬁned opcode

Data Address Break (Load) Occurs if all of the following are true:

- BE bit in the Data Break Control n Register is set

- Processor’s virtual data address matches the DBA n register

(including any mask bits in the DBA Mask n register)

- Processor is executing a Load instruction

Data Address Break (Store) Same as Data Address Break (Load), except occurs during Store

instruction.

Debug Single Step Single-step mode is enabled.

EJTAG Break Occurs if any of the following are true:

- Probe sets EJTAG Break bit in the EJTAG Control Register.

- DJ_DBGBRKP is asserted.

- DJ_TDIP_DINTN is asserted during PC Trace.

Reset Deassertion of the reset input, RESETP

Instruction Address Break Occurs if both of the following are true:

- Break Enable bit in Instruction Address Control n register is set, and

- Virtual address matches the value in the Instruction Address

Break n Register.

(Sheet 1 of 2)

7-4 Error and Exception Handling

Interrupt Assertion of one of the EZ4021-FC’s ﬁve hardware interrupt inputs,

timer interrupt, or the setting of one of the 2 software interrupt bits in

the Cause register. Interrupts must be enabled in both the Status

Nonmaskable Interrupt Assertion of the nonmaskable interrupt input (NMIP)

while the MNmi

bit of the Debug Control register is set.

Overﬂow, Trap, Floating-Point Integer Overﬂow – Twos-complement overﬂow during an add or

subtract.

Trap – One of the Trap instructions results in a “true” condition.

Floating-Point – Used by an external ﬂoating-point coprocessor.

Soft Reset Deassertion of the soft reset input, SOFT_RESETP.

Software Debug Breakpoint Execution of the SDBBP instruction.

TLB Invalid A virtual address reference matches a TLB entry that is marked

invalid.

TLB Modiﬁed The virtual address reference of a store operation matches a TLB

entry that is marked valid, but is not dirty/writable.

TLB Reﬁll There is no TLB entry to match a reference to a mapped address

space.

Table 7.1 EZ4021-FC Standard Exception Summary (Cont.)

Exception Cause

(Sheet 2 of 2)

Exception Handling Registers 7-5

7.2 Exception Handling Registers

Table 7.2 lists the CP0 registers used during standard exception

processing. Software examines these registers during exception

processing to determine the cause of an exception and the state of the

CPU at the time the exception occurred. For more information about

Processing Registers,” page 3-23.

The Move to Coprocessor 0 (MTC0) instruction sets these register

values, and Move from Coprocessor 0 (MFC0) reads the register

contents except for the DESAVE register, which can be accessed by both

single-word coprocessor instructions and their doubleword counterparts,

DMFC0 and DMTC0.

Table 7.2 CP0 Exception Processing Registers

CP0

Number

Context 4

BadVAddr 8

Count 9

Compare 11

Status 12

Cause 13

Exception Program Counter (EPC) 14

Debug 23

Debug Exception Program Counter (DEPC) 24

Error Program Counter (ErrorEPC) 30

Debug Save (DESAVE) 31

7-6 Error and Exception Handling

7.3 Standard Exception Operation

To handle a standard exception, the processor saves the current

operating state, enters Kernel mode, disables interrupts, and forces

execution of a handler at a ﬁxed address. To resume normal operation,

the original operating state must be restored and interrupts enabled.

When an exception occurs, the EPC register is loaded with the restart

location at which execution can resume after the exception has been

serviced. The EPC register contains the address of the instruction

associated with the exception, or, if the instruction was executing in a

Branch Delay slot, the EPC register contains the address of the branch

instruction immediately preceding the delay slot.

The EZ4021-FC processor uses the following mechanisms for saving

and restoring the operating mode and interrupt status:

•A single interrupt enable bit (IE) located in the Status register

•A base operating mode (Kernel, Supervisor, User) located in the

KSU ﬁeld of the Status register

•An exception level (normal, exception) located in the EXL ﬁeld of the

Status register

•An error level (normal, error) located in the ERL ﬁeld of the Status

Interrupts are enabled by setting the Status register IE bit to 1 and both

levels (EXL, ERL) to 0 (normal).

Table 7.3 shows how the current processor operating mode is deﬁned.

Standard Exception Processing Actions 7-7

Exceptions set the exception level to exception (EXL = 1). The exception

handler typically resets the exception level to normal (EXL = 0) after

saving the appropriate state. It sets it back to exception while restoring

that state. Returning from an exception (ERET instruction) resets the

exception level to normal.

7.4 Standard Exception Processing Actions

Figures 7.1–7.3 show the basic set of actions taken for each of the

EZ4021-FC standard exception classes: Reset, Soft Reset or

Nonmaskable Interrupt, and Common.

Figure 7.1 Reset Exception

Figure 7.2 Soft Reset and NMI Exceptions

Table 7.3 Current Processor Mode

Current Mode Status

KSU[1:0] Status EXL Status ERL

Kernel 00 0 0

Supervisor 01 0 0

User 10 0 0

Kernel xx 1 0

Kernel xx 0 1

Random ←TLBENTRIES - 1

Wired ←06

ErrorEPC ←RestartPC

SR ←04 || SR27..23 || 1 || 0 || 0 || SR19..3 || 1 || SR1..0

PC ←0xBFC0 0000

ErrorEPC ←RestartPC

SR ←SR31..23 || 1 || 0 || 1 || SR19..3 || 1 || SR1..0

PC ←0xBFC0 0000

7-8 Error and Exception Handling

Figure 7.3 Common Exceptions

7.5 Debug Exception Operation

To handle a debug exception, the processor enters Debug mode,

disables all exceptions except reset, and forces execution of a handler at

a ﬁxed address. To resume normal operation, the original operating state

is restored.

When an exception occurs, the DEPC register is loaded with the restart

location where execution resumes after the exception is serviced. The

DEPC register contains the address of the instruction associated with the

exception, or, if the instruction was executing in a Branch Delay slot, the

DEPC register contains the address of the branch instruction

immediately preceding the delay slot.

Because the Debug mode hardware resources exist on top of the normal

operating hardware, there is no need for the EZ4021-FC to save the

current operating mode when a debug exception is taken. Software must

use the DESAVE register to save the current general-purpose register

(GPR) contents to a buffer and must restore it before leaving the debug

exception handler. No other state restoration is necessary, nor performed

by hardware.

When entering Debug mode, the EZ4021-FC sets the Debug Mode bit

of the Debug register (bit 30 of CP0 register 24). Returning from an

exception (DERET instruction) resets the bit.

Cause ←BD || 0 || CE || 0

|| Cause15..8 || 0 || ExcCode || 0

if ((SR1 = 0) then

EPC ←RestartPC

endif

SR ←SR31..2 || 1 || SR0

if (SR22 = 1) then

PC ←0xBFC0 0200 + vector offset

else

PC ←0x8000 0000 + vector offset

endif

Debug Exception Processing 7-9

7.6 Debug Exception Processing

Figure 7.4 shows the basic set of actions taken for EZ4021-FC debug

exception classes. If a debug exception and a standard exception occur

simultaneously, the standard exception resources are updated as shown

in Section 7.4, “Standard Exception Processing Actions,” while the debug

exception resources are updated as shown in Figure 7.4.

Figure 7.4 Debug Exceptions

Due to pipelined execution, the debug exception vector might be fetched

before some debug exception cause and status bits are set. This is not

an issue for logic within pipelined structures. However, the EJTAG probe

is not a pipelined structure. It views execution as single-cycle in nature.

As a result, the instruction fetch for the debug exception vector and the

setting of the cause and status bits visible to the probe can appear out

of order.

7.7 Precision of Exceptions

Exceptions are logically precise, which means the instruction that causes

an exception and all those that follow it are aborted, generally before

committing to any state. Execution picks up where it left off before the

exception, and the instruction can be re-executed after the exception is

serviced. When the instructions that follow an exception are killed,

exceptions associated with those instructions are also killed, so that

exceptions are not taken in the order detected, but in the instruction fetch

order.

Debug[31] ←DBD

Debug[30:29] ←2b10

Debug[28]← Debug[28]

Debug[27:15]← 013

Debug[14:12]←[NIS,TRS,OES (based on simultaneous standard exc)]

Debug[11:10]←Debug[11:10]

Debug[9]← 0

Debug[8:0]← Debug Exception Cause

DEPC ←RestartPC

if (ECR[15] = 1 and ECR[14] = 0) then

PC ←0xFF20 0200

else

PC ←0xBFC0 0400

endif

7-10 Error and Exception Handling

Interrupts generated by external devices attached to the processor have

a variety of meanings that depend on the system environment where the

EZ4021-FC resides. Variations in memory system design can affect the

meaning of bus error exceptions and the location and means of

accessing relevant parameters to service them. As far as possible, this

architectural description of the exception handling system identiﬁes

which state information is reliable or unreliable.

In some cases, however, the characteristics of the pipeline staging

cannot guarantee that all states in the processor and associated system

will remain completely unchanged. State changes that may occur include

the following:

•Instructions may be read from memory and loaded into the

instruction cache.

•The multiply/divide registers (HI and LO) may be altered by a

multiply/divide or MTHI/MTLO instruction.

Normally, these changes can be ignored because the state of the

machine is sufﬁciently restored to allow execution to resume.

7.8 Exception Vector Locations

The Reset, Soft Reset, and Nonmaskable Interrupt exceptions always

vector to location 0xBFC0.0000. Addresses for all other exceptions are

a combination of a base address and a vector offset. Table 7.4 and

Table 7.5 show the standard and debug exception vector base

addresses, respectively. Table 7.6 shows the vector offset addresses.

Table 7.4 Standard Exception Vector Base Addresses

BEV1

1. Status register bit 22.

Vector Base

0 0x80000000

1 0xBFC00200

Priority of Exceptions 7-11

7.9 Priority of Exceptions

Exceptions are prioritized within a pipeline stage, within an instruction,

and from instruction to instruction. An exception for any given instruction

always has a higher priority than exceptions occurring in a subsequent

instruction. If two exceptions occur in the same instruction, priority is

given to the exception that occurs in the earliest pipeline stage.

Exceptions that occur in the same instruction and in the same pipeline

stage have deﬁned priorities.

Exceptions are prioritized within the stage in which they are taken. They

are listed in descending priority order (highest priority ﬁrst) as follows:

7.9.1 Overriding Priority (Stage Independent)

1. Reset

2. Soft Reset

Table 7.5 Debug Exception Vector Base Addresses

ProbEn1

1. EJTAG Control register bit 15.

SetDEV2

2. EJTAG Control register bit 14.

Vector Base

0 X 0xBFC00200

1 0 0xFF200000

1 1 0xBFC00200

Table 7.6 Exception Vector Offset Addresses

Exception Vector Offset

TLB Reﬁll (EXL = 0) 0x000

All Others Standard 0x180

Debug 0x200

7-12 Error and Exception Handling

7.9.2 W Stage Exceptions

1. Data Address Break

2. Data Bus Error

3. Floating Point

4. TLB Reﬁll/TLB Invalid (Data)

5. TLB Modiﬁed (Data Access)

7.9.3 M Stage Exceptions

1. EJTAG Break

2. Nonmaskable Interrupt

3. Overﬂow, Trap

4. Address Error (Data Access)

5. Interrupt

7.9.4 X Stage Exceptions

1. Software Debug Breakpoint

2. Coprocessor Unusable, SYSCALL, BREAK, Reserved Instruction

7.9.5 R Stage Exceptions

1. Debug Single Step

2. Instruction Address Break

3. Address Error (Instruction)

4. TLB Reﬁll/TLB Invalid (Instruction Fetch)

5. Bus Error (Instruction Fetch)

7.10 Exception Descriptions

This section describes the cause, handling, and servicing of each

EZ4021-FC exception, The exceptions are presented in the same order

as listed in Section 7.9, “Priority of Exceptions.”

Exception Descriptions 7-13

7.10.1 Reset Exception

The primary purpose of Reset is to initialize the EZ4021-FC

EasyMACRO core at power up.

7.10.1.1 Cause

The Reset exception occurs when the RESETP input signal is asserted

and then deasserted. This exception is not maskable.

7.10.1.2 Handling

The CPU provides a special exception vector (0xBFC0.0000) for this

exception. The reset vector resides in unmapped and uncached CPU

address space, so the hardware need not initialize the TLB or the caches

to handle the exception. The processor can fetch and execute

instructions while the caches and virtual memory are in an undeﬁned

state.

The contents of all registers in the CPU are undeﬁned when the Reset

exception occurs, except for the following:

•In the Status register, the SR and TS bits are cleared, and the ERL

and BEV bits are set. All other bits are undeﬁned.

•The Random register is initialized to the value of its upper boundary.

•The Wired register is initialized to 0.

•The Debug register is initialized to 0.

7.10.1.3 Servicing

The Reset exception is serviced by:

•Initializing all processor registers, coprocessor registers, caches and

memory system

•Performing diagnostic tests

•Bootstrapping the operating system

7-14 Error and Exception Handling

7.10.2 Soft Reset Exception

This section describes the Soft Reset/Nonmaskable Interrupt (NMI)

exception cause and response.

7.10.2.1 Cause

The Soft Reset exception occurs in response to either the setting of the

PrRst bit in the EJTAG Control register or a Nonmaskable Interrupt input

(NMIP). This exception is not maskable under normal operation.

7.10.2.2 Handling

Regardless of the cause, when this exception occurs, the SR bit in the

Status register is set, which distinguishes this exception from a Reset

exception.

The EZ4021-FC does not indicate any distinction between an exception

caused by the PrRst bit or the NMIP signal.

•An exception caused by an NMIP is taken only if the processor is

processing instructions; the exception is taken at the instruction

boundary. It does not abort any state machines and preserves the

state of the processor for diagnosis. This exception can be masked

if the MNmi bit in the Debug Control register is cleared.

•An exception caused by setting the PrRst bit performs a subset of

the full reset. After a Reset Exception (caused by RESETP)

completely initializes the processor, PrRst can be asserted to the

processor in any state, even if the processor is no longer processing

instructions. In this situation, the processor does not read or set

processor conﬁguration parameters. However, it does initialize all

other processor state that requires hardware initialization (for

instance, state machines and registers), so the CPU can fetch and

execute the Reset exception handler located in uncached and

unmapped space. Although no other processor state is changed

unnecessarily, a soft reset sequence can alter some state because

the exception may occur arbitrarily on a cycle boundary and abort

any multicycle operation in progress. Because bus, cache, or other

operations can be interrupted, portions of the cache, memory, or

other processor state can be inconsistent.

Exception Descriptions 7-15

For both PrRst and NMIP, the processor jumps to the Reset exception

vector (0xBFC0.0000). The vector resides within unmapped and

uncached CPU address space, so the hardware need not initialize the

TLB or the cache to handle the PrRst or NMI interrupt.

As previously noted, state machines interrupted by PrRst may cause

some register contents to be inconsistent with the other processor state.

Otherwise, the contents of all registers are preserved when this

exception occurs, except for the following:

•ErrorEPC register – contains the restart PC

•BEV, SR, and ERL bits of the Status register – set to 1

•Status register TS bit – cleared to 0

•Registers that support debug breakpoints (such as DCR, IBS, IBCn,

DBCn and DBS) – initialized to the their reset value

•Debug Register – cleared to 0

7.10.2.3 Servicing

PrRst-initiated exceptions give the debug host the capability to reset the

processor without resetting the entire system. This might become

necessary if the processor is not responding to debug commands or if

the processor is executing at an unknown address. The NMIP signal

might be useful for other than resetting the processor while preserving

cache and memory contents. For example, if the system detects an

impending power failure, it could use NMIP to cause an immediate,

controlled shutdown.

Exceptions that are due to either PrRst or NMIP appear identical to

software; both exceptions jump to the Reset exception vector and set the

Status register SR bit. Unless external hardware provides a way to

distinguish between the two, both are serviced by saving the current

user-visible processor state for diagnostic purposes and reinitializing (the

same as for the Reset exception).

Normally, it is not possible to continue program execution after returning

from this exception, because PrRst can happen at any time and a

nonmaskable interrupt can occur in the midst of another error exception.

7-16 Error and Exception Handling

7.10.3 Data Address Break Exception

This section describes the Data Address Break exception cause and

response.

7.10.3.1 Cause

The Data Address Break exception occurs when all of the following

occur:

•The virtual address generated by the CPU for a load or store

instruction matches the value in any of the DBAn registers, as

masked by the corresponding DBMn register.

•If the ASIDuse bit in the DBCn register is active, and the

MMU-generated ASID in the EntryHi Register matches the ASID ﬁeld

in the DBCn register.

•If this is a Store instruction, and the NoSB bit in the DBCn register

is cleared.

•If this is a Load instruction, and the NoLB bit in the DBCn register is

cleared.

•The BAI bits speciﬁed in the DBCn register allow a break on the

bytes selected by the Load or Store instruction.

•The BE bit of the DBCn register is set to enable the hardware break.

The Data Address Break exception is not maskable under normal

operation.

7.10.3.2 Handling

The debug exception vector is used for this exception. In the Debug

indicate the debug exception occurred during a Load or Store instruction,

respectively.

The DEPC register points to the Load or Store instruction that caused

the exception unless this instruction is in a branch delay slot. If it is in a

branch delay slot, then the DEPC register points to the branch instruction

that precedes the delay slot, and the Debug register DBD bit is set.

Exception Descriptions 7-17

When the Data Address Break exception occurs, the EJTAG Control

processor is in Debug mode. In addition, the debug exception vector can

be fetched from the probe. Either action indicates to the debug host

software that the expected breakpoint occurred, and that the debug

software can begin executing.

7.10.3.3 Servicing

Move one of the GPRs to the DESAVE register. Load this liberated GPR

with a buffer address to which the entire GPR set should be stored in

memory. Then store the value in the DESAVE register as well. Before

returning from the debug exception handler, restore the GPR set just

before executing the DERET instruction.

7.10.4 Bus Error Exception

This section describes the Bus Error exception cause and response.

7.10.4.1 Cause

The Bus Error exception is raised for events such as bus time-out, bus

parity errors, and invalid physical memory accesses. This exception is

not maskable under normal operation.

This exception occurs when a cache miss reﬁll, uncached reference, or

an unbuffered write is terminated with a Quick Bus error response

(QB_BADADDRP or QB_RDERRP)

A write operation that is accepted

by a Quick Bus slave device, but that later cannot complete due to an

error, must generate an interrupt (INTP) to the EZ4021-FC EasyMACRO

core to indicate the failing condition.

7.10.4.2 Handling

The common exception vector is used for this exception. The Cause

instruction fetch or Load/Store instruction caused the exception.

For instruction fetch bus errors (IBE), the EPC register points to the

instruction that caused the exception, unless this instruction is in a

branch delay slot. If it is in a branch delay slot, the EPC register points

to the preceding branch instruction, and the Cause register BD bit is set.

7-18 Error and Exception Handling

Data access bus errors (DBE) in the EZ4021-FC can be asynchronous

events with respect to CPU instruction processing. For that reason, the

EPC register is not guaranteed to point to the instruction that caused the

exception.

7.10.4.3 Servicing

The physical address where the fault occurred can be computed from

information available in the CP0 registers:

•If the Cause register exception code is set to IBE, the virtual address

of the instruction that caused the bus error exception is either in the

EPC register or it is EPC + 4 (if the Cause register BD bit is set).

The physical address is obtained by using the TLBP instruction and

reading the EntryLo register to compute the physical page number.

•If the Cause register exception code is set to DBE, the EPC register

is not guaranteed to contain the virtual address of the instruction that

caused the bus error exception. Therefore, a register outside the

EZ4021-FC must capture the failing physical address.

The process currently executing is handed a bus error indication, which

is usually fatal to the process.

7.10.5 Floating-Point Exception

This section describes the ﬂoating-point exception cause and response.

7.10.5.1 Cause

The Floating-Point Coprocessor (if installed) uses the Floating-Point

exception. The contents of the Floating-Point Control Status register

(inside CP1) indicate the cause of the exception. This exception is not

maskable under normal operation.

Exception Descriptions 7-19

7.10.5.2 Handling

The common exception vector is used for this exception. The Cause

The EPC register points to the ﬁrst instruction for which processing was

not completed unless this instruction is in a Branch Delay slot. If it is in

a Branch Delay slot, the EPC register points at the preceding branch

instruction, and the BD bit of the Cause register is set.

7.10.5.3 Servicing

This exception is cleared by resetting to 0 the appropriate bit in the

Floating-Point Control Status register.

For an unimplemented instruction exception, the Kernel must emulate the

instruction. For other exceptions, the Kernel should pass the exception

to the user process that caused the exception.

7.10.6 TLB Reﬁll Exception

This section describes the TLB Reﬁll exception cause and response.

7.10.6.1 Cause

The TLB Reﬁll exception occurs when there is no TLB entry to match a

reference to a mapped address space. This exception is not maskable

under normal operation.

7.10.6.2 Handling

The EZ4021-FC uses a special TLB Reﬁll exception vector when the

exception level in the Status register (at the time the TLB miss is

detected) is set for normal operation (EXL = 0). If the exception level at

the time of detection is set for exception (EXL = 1), then the common

exception vector is used.

The Cause register exception code is set to TLBL if the exception

occurred during an instruction fetch or data load. It is set to TLBS if the

exception was during a data Store instruction.

7-20 Error and Exception Handling

When the TLB Reﬁll exception occurs, the BadVAddr, Context, and

EntryHi registers hold the virtual address that failed translation. The

EntryHi register also contains the ASID from which the translation fault

occurred. The Random register normally contains a valid location in

which to place the replacement TLB entry. The contents of the EntryLo

registers are undeﬁned.

The EPC register points to the instruction that caused the exception

unless the instruction is in a branch delay slot. If it is in a branch delay

slot, the EPC register points to the preceding branch instruction, and the

Cause register BD bit is set.

7.10.6.3 Servicing

To service this exception, the contents of the Context register are used

as a virtual address to fetch memory locations containing the physical

page frame and access control bits for a pair of TLB entries. This

information is placed in the EntryHi, EntryLo0, and EntryLo1 registers

and is written into the TLB.

It is possible that the virtual address used to obtain the physical address

and access control information is on a page that is not resident in the

TLB. In this case, a TLB Reﬁll exception is allowed inside the TLB Reﬁll

handler. While the ﬁrst exception goes to a special exception vector

offset (0x000), this second exception goes to the common exception

vector offset (0x180).

The second TLB Reﬁll exception obscures the contents of the BadVAddr,

Context, and EntryHi registers within the TLB Reﬁll handler. As a result,

the exact virtual address whose translation caused the ﬁrst fault is not

known unless the TLB Reﬁll handler speciﬁcally saved this address. It is

possible to observe only the failing PTE virtual address. The BadVAddr

the TLB Reﬁll handler, which is the PTE address for the original failing

address.

The operating system can determine the original virtual page number

that caused the fault, but not the complete address. The operating

system uses this information to fetch the PTE that contains the physical

address and to access control information. It also writes the entry into

the TLB and returns to the original user program.

Exception Descriptions 7-21

Returning to the TLB Reﬁll handler should be avoided at this point. When

the EXL bit is set, it prevents the EPC from the ﬁrst TLB Reﬁll exception

from being overwritten by the second TLB Reﬁll exception. Consequently,

the appropriate return address can be determined from the values of the

current EPC and the Status register BD bit.

7.10.7 TLB Invalid Exception

This section describes the TLB Invalid exception cause and response.

7.10.7.1 Cause

The TLB invalid exception occurs when a virtual address reference

matches a TLB entry that is marked invalid. This exception is not

maskable under normal operation.

7.10.7.2 Handling

The common exception vector is used for this exception. If the cause of

the exception was an instruction fetch or data load, the Cause register

exception code is set to TLBL. If the cause is a data store, the exception

code is set to TLBS.

When the TLB invalid exception occurs, the BadVAddr, Context, and

EntryHi registers hold the virtual address that failed translation. The

EntryHi register also contains the ASID from which the translation fault

occurred. The contents of the EntryLo registers are undeﬁned.

The EPC register points to the instruction that caused the exception,

unless this instruction is in a branch delay slot. If it is in a branch delay

slot, the EPC register points to the preceding branch instruction, and the

Cause register BD bit is set.

7.10.7.3 Servicing

A TLB entry is typically marked invalid when one of the following is true:

•A virtual address does not exist

•The virtual address exists, but is not in main memory (a page fault)

•A trap is desired on any reference to the page (for example, to

maintain a reference bit)

7-22 Error and Exception Handling

After servicing the cause of the TLB invalid exception, the TLB entry is

located using the TLBP instruction, and replaced by an entry with the

valid bit set. For a brief description of the TLBP instruction, see

Table 4.17 on page 4-26.

7.10.8 TLB Modiﬁed Exception

This section describes the TLB Modiﬁed exception cause and response.

7.10.8.1 Cause

The TLB modiﬁed exception occurs during a store operation when the

virtual address reference to memory matches a TLB entry that is valid

but is not marked dirty and therefore writable. This exception is not

maskable under normal operation.

7.10.8.2 Handling

The common exception vector is used for this exception. The ExcCode

ﬁeld in the Cause register is set to Mod.

When the TLB modiﬁed exception occurs, the BadVAddr, Context, and

EntryHi registers hold the virtual address that failed translation. The

EntryHi register also contains the ASID from which the translation fault

occurred. The contents of the EntryLo registers are undeﬁned.

The EPC register points to the instruction that caused the exception,

unless this instruction is in a branch delay slot. If it is in a branch delay

slot, the EPC register points to the preceding branch instruction, and the

Cause register BD bit is set.

7.10.8.3 Servicing

The Kernel uses the failed virtual address and virtual page number to

identify the corresponding access control information. The page identiﬁed

may or may not permit write access. If write accesses are not permitted,

a Write Protection Violation occurs.

If write accesses are permitted, the Kernel marks the page frame as

dirty/writable in the Kernel’s own data structure. The TLBP instruction

places the index of the TLB entry that must be altered into the Index

information and writes them to the TLB.

Exception Descriptions 7-23

7.10.9 EJTAG Break Exception

This section describes the EJTAG Break exception cause and response.

7.10.9.1 Cause

The EJTAG Break exception occurs when any of the following occur:

•EJTAG Control register EjtagBrk bit is set.

•EZ4021-FC is actively outputting PC Trace information and the

DJ_TDIP_DINTN input signal is driven LOW. Note that PC Trace is

active when the EIR contains the PC Trace instruction and the TAP

Controller is in the Run-Test-Idle State.

•DJ_DBGBRKP input signal is driven HIGH.

EJTAG Break is incapable of breaking a system stall unless that stall is

caused by a WAITI instruction. If the system is hung, EJTAG Break is not

able to break the stall. Typically, the EZ4021-FC system software does

not create conditions where a system hang can occur.

It is recommended that the exception cause (listed above) remain

asserted until it is veriﬁed that the break occurred. Spurious assertion

and removal of the cause of EJTAG Break before it is veriﬁed can

produce undeﬁned operation. This recommendation is consistent with the

use of standard interrupts.

The EJTAG Break exception is not maskable under normal operation.

7.10.9.2 Handling

The debug exception vector is used for this exception. The Debug

The DEPC register points to the instruction executing when the EJTAG

Break condition occurred unless this instruction is in a Branch Delay slot.

If the instruction is in a Branch Delay slot, the DEPC register points to

the preceding branch instruction and the DBD bit of the Debug register

is set.

7-24 Error and Exception Handling

When the EJTAG break exception occurs, the EJTAG Control register

BrkSt bit is set to 1, which indicates to the probe that the processor is in

Debug mode. In addition, the debug exception vector can be fetched

from the probe. Either action indicates to the debug host software that

the expected breakpoint occurred, and that the debug software can begin

executing.

7.10.9.3 Servicing

Move one of the GPRs to the DESAVE register. Load this liberated GPR

with a buffer address to which the entire GPR set should be stored in

memory. Then store the value in the DESAVE register as well. Before

returning from the debug exception handler, restore the GPR set just

before executing the DERET instruction.

Use EJTAG Break either to take control of the system and enter debug

mode, or to discontinue PC Trace so the EJTAG pins are available for

scanning information in and out of the EZ4021-FC core. Normal

response to an EJTAG Break exception is to probe memory, the GPRs

and the CP0 registers, including the DEPC, to determine where in code

the core is executing. After these steps, if needed, more resources can

be set up for more extensive debugging.

7.10.10 Integer Overﬂow Exception

This section describes the Integer Overﬂow exception cause and

response.

7.10.10.1 Cause

The Integer Overﬂow exception occurs when an ADD, ADDI, SUB,

DADD, DADDI, or DSUB instruction results in a twos-complement

overﬂow. This exception is not maskable under normal operation.

Exception Descriptions 7-25

7.10.10.2 Handling

The common exception vector is used for this exception. The ExcCode

ﬁeld in the Cause register is set to OV.

The EPC register points to the instruction that caused the exception

unless the instruction is in a branch delay slot. If it is in a branch delay

slot, the EPC register points to the preceding branch instruction, and the

Cause register BD bit is set.

7.10.10.3 Servicing

The process executing at the time of the exception is handed an integer

overﬂow indication. This error is usually fatal to the process that caused

the exception.

7.10.11 Trap Exception

This section describes the Trap exception cause and response.

7.10.11.1 Cause

The Trap exception occurs when a TGE, TGEU, TLT, TLTU, TEQ, TNE,

TGEI, TGEUI, TLTI, TLTUI, TEQI, or TNEI instruction results in a TRUE

condition. This exception is not maskable under normal operation.

7.10.11.2 Handling

The common exception vector is used for this exception. The ExcCode

ﬁeld in the Cause register is set to TR.

The EPC register points to the instruction that caused the exception

unless the instruction is in a branch delay slot. If it is in a branch delay

slot, the EPC register points to the preceding branch instruction, and the

Cause register BD bit is set.

7.10.11.3 Servicing

The process executing at the time of the exception is handed a trap

indication. This error is usually fatal to the process that caused the

exception.

7-26 Error and Exception Handling

7.10.12 Address Error Exception

This section describes the Address Error exception cause and response.

7.10.12.1 Cause

The Address Error exception occurs if the processor attempts to:

•Load or store a doubleword that is not aligned on a doubleword

boundary

•Fetch, load, or store a word that is not aligned on a word boundary

•Load or store a halfword that is not aligned on a halfword boundary

•Reference Kernel address space while in either User or Supervisor

mode

•Reference Supervisor address space while in User mode

The Address Error exception is not maskable under normal operation.

7.10.12.2 Handling

The common exception vector is used for this exception. The Cause

occurred during an instruction fetch/data load or data store, respectively.

When the Address Error exception occurs, the BadVAddr register holds

the virtual address that was improperly aligned or that referenced

protected address space.

The EPC register points to the instruction that caused the exception

unless the instruction is in a branch delay slot. If it is in a branch delay

slot, the EPC register points to the preceding branch instruction, and the

Cause register BD bit is set.

7.10.12.3 Servicing

The process executing at the time of the exception is handed a

segmentation violation indication. This error is usually fatal to the process

that caused the exception.

Exception Descriptions 7-27

7.10.13 Interrupt Exception

This section describes the Interrupt exception cause and response.

7.10.13.1 Cause

The Interrupt exception occurs when one of the eight interrupt conditions

is asserted. The signiﬁcance of these interrupts depends on the speciﬁc

system implementation.

There are six hardware interrupts and two software interrupts. Each of

the eight interrupts can be masked by clearing the corresponding bit in

the Int and SW mask ﬁelds of the Status register. All eight interrupts can

be masked at once by clearing the Status register IE bit.

7.10.13.2 Handling

The common exception vector is used for this exception. The ExcCode

ﬁeld in the Cause register is set to INT.

The Cause register IP ﬁeld indicates the current interrupt requests. It is

possible that more than one bit may be set at the same time. It is also

possible that none of the Cause register bits are set if an interrupt is

asserted and then deasserted before the Cause register is read.

The EPC register points to the ﬁrst instruction for which processing was

not completed unless the instruction is in a branch delay slot. If it is in a

branch delay slot, the EPC register points to the preceding branch

instruction, and the Cause register BD bit is set as an indicator.

7.10.13.3 Servicing

If the interrupt is caused by one of the two software interrupt conditions,

the interrupt condition is cleared by setting the corresponding Cause

If the interrupt is hardware generated, the interrupt condition is cleared

by correcting the condition causing the interrupt. How this is

accomplished is implementation dependent.

7-28 Error and Exception Handling

7.10.14 Software Debug Breakpoint Exception

This section describes the Software Debug Breakpoint exception cause

and response.

7.10.14.1 Cause

The Software Debug Breakpoint exception occurs when an attempt is

made to execute the SDBBP instruction. This exception is not maskable

under normal operation.

7.10.14.2 Handling

The debug exception vector is used for this exception. The Debug

The DEPC register points to the SDBBP instruction, unless this

instruction is in a branch delay slot. If it is in a branch delay slot, the

DEPC register points to the preceding branch instruction, and the Debug

When the SDBBP break exception occurs, the EJTAG Control register

BrkSt bit is set to 1, which indicates to the probe that the processor is in

Debug mode. In addition, the debug exception vector can be fetched

from the probe. Either action indicates to the debug host software that

the expected breakpoint occurred, and that the debug software can begin

executing.

7.10.14.3 Servicing

Move one of the general-purpose registers to the DESAVE register. Load

this liberated GPR with a buffer address to which the entire GPR set

should be stored in memory. Then store the DESAVE register value as

well. Before returning from the debug exception handler, restore the GPR

set just before executing the DERET instruction.

When the Software Debug Breakpoint exception occurs, control transfers

to the debug exception handler. The code ﬁeld (bits [25:6]) in the SDBBP

instruction can hold additional information for the exception handler. To

obtain this information, load the contents of the instruction to which the

DEPC register points. If the instruction resides in a branch delay slot,

then add 4 to the DEPC register value.

Exception Descriptions 7-29

The SDBBP instruction may reside in its current location because the

compiler put it there or because it was swapped with another instruction.

For example, a swap might occur if the debug host wanted to initiate a

breakpoint.

If an instruction in memory was swapped, then invalidate the cache line

and restore the original instruction in memory. In this case, no

adjustment of the DEPC value is necessary.

If the SDBBP instruction was placed in its current location during compile

time, then address calculations must be made when returning from the

exception handler. It is important that the SDBBP not be executed again

upon returning from the handler. The restart address can be computed

by using the DEPC register and the Cause register BD bit along with

knowing whether the Branch was taken or not.

•If BD = 0, then Restart_PC = DEPC + 4

•If BD = 1 and branch was not taken, then Restart_PC = DEPC + 8

•If BD = 1 and branch was taken, then Restart_PC = Branch Target

Address

When the SDBBP instruction resides in a Branch Delay slot, it is up to

the exception handler to obtain the Branch Target Address from the prior

branch and determine whether the branch was taken.

7.10.15 Coprocessor Unusable Exception

This section describes the Coprocessor Unusable exception cause and

response.

7.10.15.1 Cause

The Coprocessor Unusable exception occurs when an attempt is made

to execute a coprocessor instruction for either of the following:

•A coprocessor that is not marked usable

•CP0 when it is not marked usable and the process is executing in

Supervisor or User mode

This exception is not maskable under normal operation.

7-30 Error and Exception Handling

7.10.15.2 Handling

The common exception vector is used for this exception. The ExcCode

ﬁeld in the Cause register is set to CPU. The contents of the Cause

reference was made.

The EPC register points to the instruction that caused the exception

unless this instruction is in a branch delay slot. If it is in a branch delay

slot, the EPC register points to the preceding branch instruction, and the

Cause register BD bit is set as an indicator.

7.10.15.3 Servicing

The coprocessor to which an attempted reference was made is identiﬁed

in the Cause register CE ﬁeld. The result is one of the following:

•If the process is entitled to access, the coprocessor is marked usable

and the corresponding user state is restored.

•If the process is entitled to access the coprocessor, but the

coprocessor does not exist or has failed, then interpret the

coprocessor instruction.

•If the process is not entitled to access the coprocessor, give an

Illegal/Privileged Instruction indication to the process executing at the

time. This error is usually fatal.

7.10.16 System Call Exception

This section describes the System Call exception cause and response.

7.10.16.1 Cause

The System Call exception occurs when there is an attempt to execute

the SYSCALL instruction. This exception is not maskable under normal

operation.

7.10.16.2 Handling

The common exception vector is used for this exception. The ExcCode

ﬁeld in the Cause register is set to Sys.

Exception Descriptions 7-31

The EPC register points to the SYSCALL instruction that caused the

exception unless this instruction is in a branch delay slot. If it is in a

branch delay slot, the EPC register points to the preceding branch

instruction, and the Cause register BD bit is set as an indicator.

7.10.16.3 Servicing

When this exception occurs, control is transferred to the applicable

system routine. To resume execution, the routine must restart instruction

execution after the SYSCALL instruction. This restart address can be

computed by using the EPC register and the Cause register BD bit along

with knowing whether the Branch was taken.

•If BD = 0, then Restart_PC = EPC + 4

•If BD = 1 and branch was not taken, then Restart_PC = EPC + 8

•If BD = 1 and branch was taken, then Restart_PC = Branch Target

Address

When the SYSCALL instruction resides in a Branch Delay slot, it is up

to the exception handler to obtain the Branch Target Address from the

prior branch and determine whether the branch was taken.

7.10.17 Breakpoint Exception

This section describes the Breakpoint exception cause and response.

7.10.17.1 Cause

The Breakpoint exception occurs when there is an attempt to execute the

BREAK instruction. This exception is not maskable under normal

operation.

7.10.17.2 Handling

The common exception vector is used for this exception. The ExcCode

ﬁeld in the Cause register is set to BP.

The EPC register points to the BREAK instruction that caused the

exception unless this instruction is in a branch delay slot. If it is in a

branch delay slot, the EPC register points to the preceding branch

instruction, and the Cause register BD bit is set as an indicator.

7-32 Error and Exception Handling

7.10.17.3 Servicing

When the Breakpoint exception occurs, control transfers to the exception

handler. The code ﬁeld (bits [25:6]) in the BREAK instruction can hold

additional information for the exception handler. To obtain this

information, load the contents of the instruction to which the EPC register

points. If the instruction resides in a branch delay slot, then add 4 to the

EPC register value.

To resume execution, the routine must restart instruction execution after

the BREAK instruction. This restart address can be computed by using

the EPC register and the Cause register BD bit along with knowing

whether the Branch was taken.

•If BD = 0, then Restart_PC = EPC + 4

•If BD = 1 and branch was not taken, then Restart_PC = EPC + 8

•If BD = 1 and branch was taken, then Restart_PC = Branch Target

Address

When the BREAK instruction resides in a Branch Delay slot, it is up to

the exception handler to obtain the Branch Target Address from the prior

branch and determine whether the branch was taken.

7.10.18 Reserved Instruction Exception

This section describes the Reserved Instruction exception cause and

response.

7.10.18.1 Cause

The Reserved Instruction exception occurs when an attempt is made to

execute one of the following instructions with the conditions indicated:

•An instruction whose major opcode (bits [31:26]) is undeﬁned

•A SPECIAL instruction whose minor opcode (bits [5:0]) is undeﬁned

•A REGIMM instruction whose minor opcode (bits [20:16]) is

undeﬁned

For the EZ4021-FC, 64-bit operations are

always

valid in all processor

modes.

This exception is not maskable under normal operation.

Exception Descriptions 7-33

7.10.18.2 Handling

The common exception vector is used for this exception. The ExcCode

ﬁeld in the Cause register is set to RI.

The EPC register contains the address of the Reserved instruction that

caused the exception unless this instruction is in a branch delay slot. If

it is in a Branch Delay slot, the EPC register points at the preceding

branch instruction, and the Cause register BD bit is set as an indicator.

7.10.18.3 Servicing

Use the Reserved Instruction exception to trap to emulation routines for

instructions not supported in the EZ4021-FC instruction set. After

emulation is completed, resume execution as described below.

If there is no emulation routine, give the process executing at the time of

the exception an Illegal Instruction indication. This error is usually fatal.

To resume execution after emulation is completed, the routine must

restart instruction execution after the Reserved instruction. This restart

address can be computed by using the EPC register and the Cause

•If BD = 0, then Restart_PC = EPC + 4

•If BD = 1 and branch was not taken, then Restart_PC = EPC + 8

•If BD = 1 and branch was taken, then Restart_PC = Branch Target

Address

When the Reserved instruction resides in a Branch Delay slot, it is up to

the exception handler to obtain the Branch Target Address from the prior

branch and determine whether the branch was taken.

7.10.19 Debug Single Step Exception

This section describes the Debug Single Step exception cause and

response.

7.10.19.1 Cause

The Debug Single Step exception occurs when the SSt bit of the Debug

7-34 Error and Exception Handling

(not Debug mode) before the next instruction is killed. This allows code

to be executed one instruction at a time with a call to the debug

exception handler between each instruction. The following exceptions

exist:

•An instruction in a branch delay slot is not killed by a single step

exception. It is executed in tandem with the jump or branch.

•An instruction that is the target of a DERET is not killed by a single

step exception.

This exception is not maskable under normal operation.

7.10.19.2 Handling

The debug exception vector is used for this exception. The Debug

The DEPC register points to the instruction killed by the single step.

Because no instruction in the branch delay slot can be killed by a single

step exception, the DBD and the DSS bits can never be set

simultaneously.

When the Debug Single Step exception occurs, the EJTAG Control

processor is in Debug mode. In addition, the debug exception vector can

be fetched from the probe. Either action indicates to the debug host

software that the expected break occurred, and that the debug software

can begin executing.

7.10.19.3 Servicing

Move one of the general-purpose registers to the DESAVE register. Load

this liberated GPR with a buffer address to which the entire GPR set

should be stored in memory. Then store the DESAVE register value as

well. Before returning from the debug exception handler, restore the GPR

set just before executing the DERET instruction.

The debug single step exception is used to do detailed debugging of

faulty code. After each instruction is executed, speciﬁc hardware

resources are polled and inspected for change. When single step mode

is enabled, load scheduling is disabled in order to ensure that the system

state is current when the debug exception handler examines the

hardware resources.

Exception Descriptions 7-35

7.10.20 Instruction Address Break Exception

This section describes the Instruction Address Break exception cause

and response.

7.10.20.1 Cause

The Instruction Address Break exception occurs when all of the following

occur:

•The virtual address generated by the CPU for an instruction fetch

matches the value in any of the IBAn registers, as masked by the

corresponding IBMn register.

•If the ASIDuse bit in the IBCn register is active, and the

MMU-generated ASID in the EntryHi register matches the ASID ﬁeld

in the IBCn register.

•The BE bit of the IBCn register is set to enable the hardware break.

The Instruction Address Break exception is not maskable under normal

operation.

7.10.20.2 Handling

The debug exception vector is used for this exception. The Debug

The DEPC register points to the instruction that caused the exception

unless this instruction is in a branch delay slot. If it is in a branch delay

slot, the DEPC register points to the preceding branch instruction, and

the Debug register DBD bit is set.

When the Instruction Address Break exception occurs, the EJTAG

Control register BrkSt bit is set to 1, which indicates to the probe that the

processor is in Debug mode. In addition, the debug exception vector can

be fetched from the probe. Either action indicates to the debug host

software that the expected break occurred, and that the debug software

can begin executing.

7.10.20.3 Servicing

Move one of the general-purpose registers to the DESAVE register. Load

this liberated GPR with a buffer address to which the entire GPR set

7-36 Error and Exception Handling

should be stored in memory. Then store the DESAVE register value as

well. Before returning from the debug exception handler, restore the GPR

set just before executing the DERET instruction.

7.11 Loss of PC Trace Information

In certain cases, encountering a debug exception while PC Trace is

active can cause the loss of some trace information.

These cases and their solutions are explained as follows:

•Entering debug mode using the SDBBP instruction can cause loss

of the last valid trace code prior to the SDBBP instruction.

To avoid this problem, put breakpoints at the end of sequential blocks

of instructions. Because SDBBP is typically used to enter debug

mode, only the trace data prior to the last

prior

instruction is lost. To

reconstruct this lost value, use the last probe trace entry, the DEPC

value, and the DBD bit located in the CP0 Debug register.

•Entering debug mode using an Instruction Address Break can cause

the loss of the last two valid trace codes prior to the instruction that

matched the break.

This situation only occurs when using hardware instruction address

breaks. Whenever possible, use software breakpoints instead. You

can use software breakpoints in almost all cases except uncached

ROM space. If you must use hardware instruction address breaks,

you can reconstruct lost data using one of the following methods:

– If the lost trace data is for sequential instructions, you can easily

identify the data by looking at the last recorded trace entry from

the probe, the contents of the DEPC register, and a source code

listing.

Spurious Debug Mode Indications 7-37

– If the lost trace data is a branch/jump and its delay slot

instruction, you can identify this information by looking at the last

probe trace entry, the DEPC value, and a source code listing.

Very little information is actually lost, which makes it much easier to

reconstruct the lost data.

7.12 Spurious Debug Mode Indications

Under certain conditions, a spurious debug mode (DBM) indication is

sent to the probe. DBM is part of the PC Trace Status signal described

on page 5-8. This spurious indication only occurs when both of the

following conditions are true:

1. The CPU attempts to enter debug mode due to an Instruction

Address Break.

2. A Floating Point or Data Bus Error is encountered by the instruction

prior to the instruction that matches the Instruction Address Break.

Sending spurious debug break indications to the probe only occurs in

very obscure situations. For example, the EZ4021-FC does not have a

Floating-Point Unit, so generation of a Floating-Point exception is not a

problem. Also, because generation of a Data Bus Error is almost always

fatal to all systems, the spurious generation of a debug mode indication

at that time is typically going to be a

don’t care

The generation of a spurious debug mode indication can be avoided by

not using hardware instruction address breakpoints. Whenever possible,

use software breakpoints instead.

The probe software can work around the problem of spurious debug

indications if it uses hardware polling. Hardware polling helps the probe

detect spurious debug indications, which the probe can then safely

ignore.

7-38 Error and Exception Handling

MiniRISC EZ4021-FC EasyMACRO Microprocessor 8-1

Chapter 8

Memory Test

This chapter contains information on testing the instruction cache, data

cache, register ﬁle, and TLB RAMs. This chapter includes the following

sections:

•Section 8.1, “I-Cache BIST”

•Section 8.2, “D-Cache Test”

•Section 8.3, “Register File Test”

•Section 8.4, “Translation Lookaside Buffer (TLB) Test”

8.1 I-Cache BIST

The I-Cache consists of Tag, LRU, and Data RAMs. The I-Cache RAMs

have a built-in self-test (BIST) capability that uses a checkerboard test

pattern and indicates a go/no go test result to an external I/O signal pin

on the EZ4021-FC.

See Section 5.5, “BIST Signals,” page 5-14, for BIST signal information.

Figure 8.1 provides a functional block diagram of the I-Cache and the

associated BIST logic.

8-2 Memory Test

Figure 8.1 I-Cache with BIST Block Diagram

The MemBIST controller generates the test vectors, cycles the tests

through the RAMs, checks the results, and generates a go/no go

indication to the external TAP controller.

Each I-Cache RAM includes interface logic, called a collar, through which

the MemBIST controller interfaces with the RAM.

The user must supply the external TAP controller. You can generate a

TAP controller to interface with MemBIST controllers using the

Logic Vision tool,

chiptesta

. For information on using this tool, contact

your LSI Logic Applications engineer.

I-Cache

Data

Set 0

I-Cache

Data

Set 1

I-Cache

Tag

Set 0

I-Cache

Tag

Set 1 I-Cache

LRU

MemBIST Controller

CollarCollarCollarCollarCollar

EZ4021-FC

User-Provided

External TAP Controller

D-Cache Test 8-3

8.2 D-Cache Test

The D-Cache consists of Tag, LRU, and Data RAMs.

8.2.1 D-Cache Tag/LRU RAMs

The D-Cache Tag and LRU RAMs are tested using the CACHE Index

Load Tag and Index Store Tag instructions in a special cache test mode.

Asserting the CACHE_TESTP core input signal enables this special test

mode. While operating in cache test mode, you can read the Line Locked

(LL) and LRU bits in the CP0 TagLo register. Refer to Section 3.1.3.9,

“TagLo (28) and TagHi (29) Registers,” page 3-19 for a description of the

TagLo register and its operation.

Use this register along with the CACHE Index Tag operations to

write/read patterns to/from the Tag and LRU RAMs to verify their

operation.

8.2.2 D-Cache Data RAMs

After the D-Cache Tag and LRU RAMs have been veriﬁed, the Data

RAMs can be tested using standard load and store operations.

First, set up the D-Cache Tag RAMs with valid entries using a simple

physical Tag ID progression. Do this using the CACHE Index Store Tag

or Create Exclusive Dirty commands. Once the Tags are setup, the test

program simply steps through the physical Tag ID progression using

store data and load data operations to write and read data patterns

to/from the Data RAMs. To avoid TLB translations, use virtual addresses

in the kseg0 address range.

8-4 Memory Test

8.3 Register File Test

The register ﬁle test uses CPU instructions (such as LUI and XORI) to

write and read data patterns to/from the register ﬁle. Neither the register

ﬁle nor the EZ4021-FC core requires a special test mode during the

all 32 registers are written, the data is read out to external memory using

Store instructions. The test uses six data patterns to test the register ﬁle:

walking 1s, walking 0s, checkerboard, inverse checkerboard, solid 1s,

and solid 0s.

8.4 Translation Lookaside Buffer (TLB) Test

The TLB test uses the TLB Write (TLBW), TLB Read (TLBR), and TLB

probe (TLBP) instructions along with the following CP0 registers: Index

(0), EntryLo0 (2), EntryLo1 (3), PageMask (5), and EntryHi (10). For

information about these registers, refer to Section 3.1.3, “Memory and

TLB-Support Registers.”

The test sequence involves writing and verifying data patterns to/from the

TLB. First, the test writes a pattern of entries to the TLB using the TLBW

instruction, and then uses the TLBR instruction to read the results in the

associated CP0 register. Finally, the test probes the entries using the

TLBP instruction and veriﬁes the results in the Index register. Note that

the TLB instructions function even when the MMU is disabled.

MiniRISC EZ4021-FC EasyMACRO Microprocessor 9-1

Chapter 9

Speciﬁcations

This chapter speciﬁes the EZ4021-FC’s AC timing and electrical

characteristics. This chapter has the following sections:

•Section 9.1, “Physical Speciﬁcations”

•Section 9.2, “AC Timing and Loading”

9.1 Physical Speciﬁcations

The EZ4021-FC EasyMACRO Microprocessor core has a single 1x clock

input. Clock duty cycles may vary from 30% to 70% at maximum

frequency. Variance is greater at lower frequencies.

The EZ4021-FC operates at 250 MHz tested under worst-case

conditions, 1.71 V, 125 °C.

Table 9.1 shows the size of the EZ4021-FC in G12-p, four-layer metal

technology.

Table 9.1 EZ4021-FC Physical Layout Size

Parameter Value

Technology LCBG12P (4LM)

Width 3.32 mm

Height 3.56 mm

Total Area 12 mm2

9-2 Speciﬁcations

9.2 AC Timing and Loading

The AC timing values given in this section are based on the conditions

given in Table 9.2.

Input setup time is measured from the time the signal is valid to the rising

edge of the clock. Input hold time is measured from the rising edge of

the clock to the time the signal goes invalid. For input setup times, the

driver must drive the signal valid before any receivers need it. For input

hold times, the driver must hold the signal valid longer than needed by

any receiver. The maximum and minimum delay times for outputs are

measured from the rising edge of the clock to the time the signal is valid.

Figure 9.1 shows how AC timing is measured. Table 9.3 shows the

EZ4021-FC timing conditions, and Table 9.4 shows the AC timing for

maximum clock frequency. Tables 9.5 and 9.6 show the AC timing values

and loading for the EZ4021-FC. Note that all timing in Tables 9.5 and 9.6

is measured in nanoseconds.

Figure 9.1 AC Speciﬁcations

Table 9.2 EZ4021-FC AC Timing Conditions

Reference Clock Operating Conditions Insertion Delay

PCLKP WCABS 2.2 ns

BCCOM 1.0 ns

DJ_TCKP WCABS 0.7 ns

BCCOM 0.3 ns

PCLKP

Input Signal

Max Delay

Min Delay

Clock Period

Output Signal

Setup Hold

AC Timing and Loading 9-3

Load is the total load on the net measured in standard loads visible to

the output driver or to the input gate. The I/O loading values shown in

Tables 9.5 and 9.6 are derived from internal loading only, that is, with the

EZ4021-FC as part of a system-on-a-chip design.

Table 9.3 EZ4021-FC Core Timing Conditions for G12

AC Timing Process VDD (V) Junction Temperature (C)

NOM 1.00 1.8 25

BCCOM 0.80 1.89 -40

WCABS 1.17 1.71 125

Table 9.4 EZ4021-FC Core Maximum Clock Frequency for AC

Timing

AC Timing Clock Period (ns) Frequency (MHz)

NOM 4.00 250.0

BCCOM 4.00 250.0

WCABS 4.00 250.0

9-4 Speciﬁcations

Table 9.5 gives the AC timing for the EZ4021-FC input pins. Table 9.6

gives the AC timing for the EZ4021-FC output pins. In the tables, a tilde

(~) preceding a clock name means the signal is referenced from the

falling clock edge.

Table 9.5 EZ4021-FC Core Input AC Timing (ns) and Loading

Signal Name WCABS

Setup BCCOM

Hold Standard Loads,

Internal Reference Clock

BIG_ENDIANP static static 6 PCLKP/DJ_TCKP

BIST_ALGO_MODE[1:0] 2.7 −0.3 4 PCLKP

BIST_DIAG_EN 1.1 −0.1 4 PCLKP

BIST_HOLD 2.7 −0.1 4 PCLKP

BIST_SETUP[1:0] 3.1 −0.2 4 PCLKP

BIST_SHIFT 3.1 −0.3 4 PCLKP

BIST_SI 1.4 −0.2 4 PCLKP

CACHE_TESTP 0.9 0.0 8 PCLKP

CG_RESETP 1.3 −0.2 4 PCLKP

COP_CP0COND 1.0 −0.1 6 PCLKP

DCACHE_ENABLEP 1.0 0.0 6 PCLKP

DJ_DBGBRKP 0.7 0.0 8 DJ_TCKP

DJ_DBRKDEMUXP 0.8 0.0 10 DJ_TCKP

DJ_EJTAGIRBITS[1:0] 2.1 0.0 8 DJ_TCKP

DJ_JTAGALSOP 0.8 0.1 6 ~DJ_TCKP

DJ_JTAGTDOP pass-

through

path

pass-

through

path

4 DJ_TCKP

DJ_PON[19:0] 1.7 −0.2 6 DJ_TCKP

DJ_TDIP_DINTN 2.0 0.0 8 DJ_TCKP

DJ_TMSP 2.0 0.0 6 DJ_TCKP

(Sheet 1 of 3)

AC Timing and Loading 9-5

DJ_TRSTN 0.5 0.2 4 DJ_TCKP

DJ_PCTEN static static 6 PCLKP/DJ_TCKP

ICACHE_ENABLEP 0.8 0.0 10 PCLKP

INTP[4:0] 2.4 −0.1 8 PCLKP

LOADSCHED_ENABLEP 0.9 0.0 10 PCLKP

MBIST_EN 3.8 −0.3 4 PCLKP

MMU_CNTALWYSP 0.8 0.0 4 PCLKP

MMU_ENABLEP 1.3 −0.1 4 PCLKP

NMI 1.4 −0.2 4 PCLKP

PREFETCH_ENABLEP 0.6 0.1 6 PCLKP

PRID_REV[3:0] 2.2 0.0 6 PCLKP

QB_ADDRP[31:3] 1.5 0.0 4 PCLKP

QB_BADADDRP 2.2 −0.1 4 PCLKP

QB_BOFFP 2.3 0.0 4 PCLKP

QB_BURSTACKP 1.1 0.0 4 PCLKP

QB_CMDRDYP 2.3 −0.1 4 PCLKP

QB_GRANT_BC_DP 2.5 0.0 4 PCLKP

QB_GRANT_BC_EP 2.5 0.0 4 PCLKP

QB_GRANT_BC_IP 1.5 0.0 4 PCLKP

QB_RDDATAP[63:0] 0.6 0.1 4 PCLKP

QB_RDERRP 0.7 0.0 4 PCLKP

QB_RDRDY_BC_DP 1.9 −0.1 4 PCLKP

QB_RDRDY_BC_EP 1.9 0.0 4 PCLKP

QB_RDRDY_BC_IP 1.9 −0.1 4 PCLKP

Table 9.5 EZ4021-FC Core Input AC Timing (ns) and Loading (Cont.)

Signal Name WCABS

Setup BCCOM

Hold Standard Loads,

Internal Reference Clock

(Sheet 2 of 3)

9-6 Speciﬁcations

QB_SLRDY_BC_DP 0.8 0.0 4 PCLKP

QB_SLRDY_BC_EP 0.7 0.1 4 PCLKP

QB_SLRDY_BC_IP 0.7 0.0 4 PCLKP

QB_WRITEP 1.1 0.0 4 PCLKP

READPRI_ENABLEP 0.7 0.1 4 PCLKP

RESETP 0.6 0.1 4 PCLKP

SCLKP_DIVP[1:0] 2.6 0.0 6 PCLKP

SNOOP_ENABLEP 0.7 0.1 4 PCLKP

VCED_ENABLEP static static 4 PCLKP/DJ_TCKP

WRITEBUF_ENABLEP 0.7 0.1 10 PCLKP

Table 9.6 EZ4021-FC Core Output AC Timing (ns) and Loading

Signal Name BCCOM

Min WCABS

Max Standard Loads

(n1a) Reference Clock

BC_D_QB_BREQP 0.4 1.9 50 PCLKP

BC_DMP 0.4 1.0 50 PCLKP

BC_E_QB_BREQP 0.4 1.8 50 PCLKP

BC_I_QB_BREQP 0.4 1.6 50 PCLKP

BC_QB_ADDRP[31:3] 0.3 2.3 50 PCLKP

BC_QB_BURSTREQP 0.3 2.2 50 PCLKP

BC_QB_BYTEP[7:0] 0.3 2.2 50 PCLKP

BC_QB_CMDLOCKP 0.3 0.9 50 PCLKP

(Sheet 1 of 3)

Table 9.5 EZ4021-FC Core Input AC Timing (ns) and Loading (Cont.)

Signal Name WCABS

Setup BCCOM

Hold Standard Loads,

Internal Reference Clock

(Sheet 3 of 3)

AC Timing and Loading 9-7

BC_QB_RDACKP 0.4 1.1 50 PCLKP

BC_QB_READP 0.5 1.8 50 PCLKP

BC_QB_WRDATAP[63:0] 0.2 0.7 50 PCLKP

BC_QB_WRITEP 0.4 1.4 50 PCLKP

BIST_SO 0.4 1.0 50 PCLKP

CPU_EC_WAITI 0.6 1.6 50 PCLKP

DCLKP1, 2 0.2 0.7 50 PCLKP

DHQ_SCR1[31:0] 0.3 1.0 50 PCLKP

DJ_PERRSTN20.2 0.7 50 PCLKP

DJ_PURETDO_DRN20.3 0.8 50 DJ_TCKP

DJ_PURETDOP20.3 0.9 50 ~DJ_TCKP

DJ_PURETDOP from

DJ_JTAGTDOP20.3 1.0 50 N/A

DJ_TDO_DRIVEN20.5 1.0 50 DJ_TCKP

DJ_TDOP_TPCP20.5 1.1 50 ~DJ_TCKP

DJ_TDOP_TPCP from

DJ_JTAGTDOP20.3 1.0 50 N/A

DT_PCST1[2:0]20.3 0.9 50 PCLKP

DT_PCST2[2:0]20.3 0.9 50 PCLKP

Table 9.6 EZ4021-FC Core Output AC Timing (ns) and Loading (Cont.)

Signal Name BCCOM

Min WCABS

Max Standard Loads

(n1a) Reference Clock

(Sheet 2 of 3)

9-8 Speciﬁcations

DT_TPC1P20.4 1.1 50 PCLKP

DT_TPCPLP[6:0]20.3 1.0 50 PCLKP

MBIST_CMP_STAT 0.6 3.0 50 PCLKP

MBIST_DONE 0.4 1.1 50 PCLKP

MBIST_GO 0.5 2.7 50 PCLKP

PSTALLP 0.4 0.9 50 PCLKP

1. DCLKP timing is with respect to the rising edge of PCLKP at PCLKP input.

2. The maximum allowable loads on EJTAG output is 64 standard loads.

Table 9.6 EZ4021-FC Core Output AC Timing (ns) and Loading (Cont.)

Signal Name BCCOM

Min WCABS

Max Standard Loads

(n1a) Reference Clock

(Sheet 3 of 3)

Customer Feedback

We would appreciate your feedback on this document. Please copy the

following page, add your comments, and fax it to us at the number

shown.

If appropriate, please also fax copies of any marked-up pages from this

document.

Important: Please include your name, phone number, fax number, and

company address so that we may contact you directly for

clariﬁcation or additional information.

Thank you for your help in improving the quality of our documents.

Customer Feedback

Reader’s Comments

Fax your comments to: LSI Logic Corporation

Technical Publications

M/S E-198

Fax: 408.433.4333

Please tell us how you rate this document:

MiniRISC® EZ4021-FC

EasyMACRO™ Microprocessor.

Place a check mark in the appropriate

blank for each category.

What could we do to improve this document?

If you found errors in this document, please specify the error and page

number. If appropriate, please fax a marked-up copy of the page(s).

Please complete the information below so that we may contact you

directly for clariﬁcation or additional information.

Excellent Good Average Fair Poor

Completeness of information ____ ____ ____ ____ ____

Clarity of information ____ ____ ____ ____ ____

Ease of ﬁnding information ____ ____ ____ ____ ____

Technical content ____ ____ ____ ____ ____

Usefulness of examples and

illustrations ____ ____ ____ ____ ____

Overall manual ____ ____ ____ ____ ____

Name Date

Telephone

Title

Company Name

Street

City, State, Zip

Department Mail Stop

Fax

U.S. Distributors

by State

A. E. Avnet Electronics

http://www.hh.avnet.com

B. M. Bell Microproducts,

Inc. (for HAB’s)

http://www.bellmicro.com

I. E. Insight Electronics

http://www.insight-electronics.com

W. E. Wyle Electronics

http://www.wyle.com

Alabama

Daphne

I. E. Tel: 334.626.6190

Huntsville

A. E. Tel: 256.837.8700

B. M. Tel: 256.705.3559

I. E. Tel: 256.830.1222

W. E. Tel: 800.964.9953

Alaska

A. E. Tel: 800.332.8638

Arizona

Phoenix

A. E. Tel: 480.736.7000

B. M. Tel: 602.267.9551

W. E. Tel: 800.528.4040

Tempe

I. E. Tel: 480.829.1800

Tucson

A. E. Tel: 520.742.0515

Arkansas

W. E. Tel: 972.235.9953

California

Agoura Hills

B. M. Tel: 818.865.0266

Granite Bay

B. M. Tel: 916.523.7047

Irvine

A. E. Tel: 949.789.4100

B. M. Tel: 949.470.2900

I. E. Tel: 949.727.3291

W. E. Tel: 800.626.9953

Los Angeles

A. E. Tel: 818.594.0404

W. E. Tel: 800.288.9953

Sacramento

A. E. Tel: 916.632.4500

W. E. Tel: 800.627.9953

San Diego

A. E. Tel: 858.385.7500

B. M. Tel: 858.597.3010

I. E. Tel: 800.677.6011

W. E. Tel: 800.829.9953

San Jose

A. E. Tel: 408.435.3500

B. M. Tel: 408.436.0881

I. E. Tel: 408.952.7000

Santa Clara

W. E. Tel: 800.866.9953

Woodland Hills

A. E. Tel: 818.594.0404

Westlake Village

I. E. Tel: 818.707.2101

Colorado

Denver

A. E. Tel: 303.790.1662

B. M. Tel: 303.846.3065

W. E. Tel: 800.933.9953

Englewood

I. E. Tel: 303.649.1800

Idaho Springs

B. M. Tel: 303.567.0703

Connecticut

Cheshire

A. E. Tel: 203.271.5700

I. E. Tel: 203.272.5843

Wallingford

W. E. Tel: 800.605.9953

Delaware

North/South

A. E. Tel: 800.526.4812

Tel: 800.638.5988

B. M. Tel: 302.328.8968

W. E. Tel: 856.439.9110

Florida

Altamonte Springs

B. M. Tel: 407.682.1199

I. E. Tel: 407.834.6310

Boca Raton

I. E. Tel: 561.997.2540

Bonita Springs

B. M. Tel: 941.498.6011

Clearwater

I. E. Tel: 727.524.8850

Fort Lauderdale

A. E. Tel: 954.484.5482

W. E. Tel: 800.568.9953

Miami

B. M. Tel: 305.477.6406

Orlando

A. E. Tel: 407.657.3300

W. E. Tel: 407.740.7450

Tampa

W. E. Tel: 800.395.9953

St. Petersburg

A. E. Tel: 727.507.5000

Georgia

Atlanta

A. E. Tel: 770.623.4400

B. M. Tel: 770.980.4922

W. E. Tel: 800.876.9953

Duluth

I. E. Tel: 678.584.0812

Hawaii

A. E. Tel: 800.851.2282

Idaho

A. E. Tel: 801.365.3800

W. E. Tel: 801.974.9953

Illinois

North/South

A. E. Tel: 847.797.7300

Tel: 314.291.5350

Chicago

B. M. Tel: 847.413.8530

W. E. Tel: 800.853.9953

Schaumburg

I. E. Tel: 847.885.9700

Indiana

Fort Wayne

I. E. Tel: 219.436.4250

W. E. Tel: 888.358.9953

Indianapolis

A. E. Tel: 317.575.3500

Iowa

W. E. Tel: 612.853.2280

Cedar Rapids

A. E. Tel: 319.393.0033

Kansas

W. E. Tel: 303.457.9953

Kansas City

A. E. Tel: 913.663.7900

Lenexa

I. E. Tel: 913.492.0408

Kentucky

W. E. Tel: 937.436.9953

Central/Northern/ Western

A. E. Tel: 800.984.9503

Tel: 800.767.0329

Tel: 800.829.0146

Louisiana

W. E. Tel: 713.854.9953

North/South

A. E. Tel: 800.231.0253

Tel: 800.231.5775

Maine

A. E. Tel: 800.272.9255

W. E. Tel: 781.271.9953

Maryland

Baltimore

A. E. Tel: 410.720.3400

W. E. Tel: 800.863.9953

Columbia

B. M. Tel: 800.673.7461

I. E. Tel: 410.381.3131

Massachusetts

Boston

A. E. Tel: 978.532.9808

W. E. Tel: 800.444.9953

Burlington

I. E. Tel: 781.270.9400

Marlborough

B. M. Tel: 800.673.7459

Woburn

B. M. Tel: 800.552.4305

Michigan

Brighton

I. E. Tel: 810.229.7710

Detroit

A. E. Tel: 734.416.5800

W. E. Tel: 888.318.9953

Clarkston

B. M. Tel: 877.922.9363

Minnesota

Champlin

B. M. Tel: 800.557.2566

Eden Prairie

B. M. Tel: 800.255.1469

Minneapolis

A. E. Tel: 612.346.3000

W. E. Tel: 800.860.9953

St. Louis Park

I. E. Tel: 612.525.9999

Mississippi

A. E. Tel: 800.633.2918

W. E. Tel: 256.830.1119

Missouri

W. E. Tel: 630.620.0969

St. Louis

A. E. Tel: 314.291.5350

I. E. Tel: 314.872.2182

Montana

A. E. Tel: 800.526.1741

W. E. Tel: 801.974.9953

Nebraska

A. E. Tel: 800.332.4375

W. E. Tel: 303.457.9953

Nevada

Las Vegas

A. E. Tel: 800.528.8471

W. E. Tel: 702.765.7117

New Hampshire

A. E. Tel: 800.272.9255

W. E. Tel: 781.271.9953

New Jersey

North/South

A. E. Tel: 201.515.1641

Tel: 609.222.6400

Mt. Laurel

I. E. Tel: 856.222.9566

Pine Brook

B. M. Tel: 973.244.9668

W. E. Tel: 800.862.9953

Parsippany

I. E. Tel: 973.299.4425

Wayne

W. E. Tel: 973.237.9010

New Mexico

W. E. Tel: 480.804.7000

Albuquerque

A. E. Tel: 505.293.5119

U.S. Distributors

by State

(Continued)

New York

Hauppauge

I. E. Tel: 516.761.0960

Long Island

A. E. Tel: 516.434.7400

W. E. Tel: 800.861.9953

Rochester

A. E. Tel: 716.475.9130

I. E. Tel: 716.242.7790

W. E. Tel: 800.319.9953

Smithtown

B. M. Tel: 800.543.2008

Syracuse

A. E. Tel: 315.449.4927

North Carolina

Raleigh

A. E. Tel: 919.859.9159

I. E. Tel: 919.873.9922

W. E. Tel: 800.560.9953

North Dakota

A. E. Tel: 800.829.0116

W. E. Tel: 612.853.2280

Ohio

Cleveland

A. E. Tel: 216.498.1100

W. E. Tel: 800.763.9953

Dayton

A. E. Tel: 614.888.3313

I. E. Tel: 937.253.7501

W. E. Tel: 800.575.9953

Strongsville

B. M. Tel: 440.238.0404

Valley View

I. E. Tel: 216.520.4333

Oklahoma

W. E. Tel: 972.235.9953

Tulsa

A. E. Tel: 918.459.6000

I. E. Tel: 918.665.4664

Oregon

Beaverton

B. M. Tel: 503.524.1075

I. E. Tel: 503.644.3300

Portland

A. E. Tel: 503.526.6200

W. E. Tel: 800.879.9953

Pennsylvania

Mercer

I. E. Tel: 412.662.2707

Philadelphia

A. E. Tel: 800.526.4812

B. M. Tel: 877.351.2355

W. E. Tel: 800.871.9953

Pittsburgh

A. E. Tel: 412.281.4150

W. E. Tel: 440.248.9996

Rhode Island

A. E. 800.272.9255

W. E. Tel: 781.271.9953

South Carolina

A. E. Tel: 919.872.0712

W. E. Tel: 919.469.1502

South Dakota

A. E. Tel: 800.829.0116

W. E. Tel: 612.853.2280

Tennessee

W. E. Tel: 256.830.1119

East/West

A. E. Tel: 800.241.8182

Tel: 800.633.2918

Texas

Arlington

B. M. Tel: 817.417.5993

Austin

A. E. Tel: 512.219.3700

B. M. Tel: 512.258.0725

I. E. Tel: 512.719.3090

W. E. Tel: 800.365.9953

Dallas

A. E. Tel: 214.553.4300

B. M. Tel: 972.783.4191

W. E. Tel: 800.955.9953

El Paso

A. E. Tel: 800.526.9238

Houston

A. E. Tel: 713.781.6100

B. M. Tel: 713.917.0663

W. E. Tel: 800.888.9953

Richardson

I. E. Tel: 972.783.0800

Rio Grande Valley

A. E. Tel: 210.412.2047

Stafford

I. E. Tel: 281.277.8200

Utah

Centerville

B. M. Tel: 801.295.3900

Murray

I. E. Tel: 801.288.9001

Salt Lake City

A. E. Tel: 801.365.3800

W. E. Tel: 800.477.9953

Vermont

A. E. Tel: 800.272.9255

W. E. Tel: 716.334.5970

Virginia

A. E. Tel: 800.638.5988

W. E. Tel: 301.604.8488

Haymarket

B. M. Tel: 703.754.3399

Springﬁeld

B. M. Tel: 703.644.9045

Washington

Kirkland

I. E. Tel: 425.820.8100

Maple Valley

B. M. Tel: 206.223.0080

Seattle

A. E. Tel: 425.882.7000

W. E. Tel: 800.248.9953

West Virginia

A. E. Tel: 800.638.5988

Wisconsin

Milwaukee

A. E. Tel: 414.513.1500

W. E. Tel: 800.867.9953

Wauwatosa

I. E. Tel: 414.258.5338

Wyoming

A. E. Tel: 800.332.9326

W. E. Tel: 801.974.9953

Sales Ofﬁces and Design

Resource Centers

LSI Logic Corporation

Corporate Headquarters

1551 McCarthy Blvd

Milpitas CA 95035

Tel: 408.433.8000

Fax: 408.433.8989

NORTH AMERICA

California

Irvine

18301 Von Karman Ave

Suite 900

Irvine, CA 92612

♦Tel: 949.809.4600

Fax: 949.809.4444

Pleasanton Design Center

5050 Hopyard Road, 3rd Floor

Suite 300

Pleasanton, CA 94588

Tel: 925.730.8800

Fax: 925.730.8700

San Diego

7585 Ronson Road

Suite 100

San Diego, CA 92111

Tel: 858.467.6981

Fax: 858.496.0548

Silicon Valley

1551 McCarthy Blvd

Sales Ofﬁce

M/S C-500

Milpitas, CA 95035

♦Tel: 408.433.8000

Fax: 408.954.3353

Design Center

M/S C-410

Tel: 408.433.8000

Fax: 408.433.7695

Wireless Design Center

11452 El Camino Real

Suite 210

San Diego, CA 92130

Tel: 858.350.5560

Fax: 858.350.0171

Colorado

Boulder

4940 Pearl East Circle

Suite 201

Boulder, CO 80301

♦Tel: 303.447.3800

Fax: 303.541.0641

Colorado Springs

4420 Arrowswest Drive

Colorado Springs, CO 80907

Tel: 719.533.7000

Fax: 719.533.7020

Fort Collins

2001 Danﬁeld Court

Fort Collins, CO 80525

Tel: 970.223.5100

Fax: 970.206.5549

Florida

Boca Raton

2255 Glades Road

Suite 324A

Boca Raton, FL 33431

Tel: 561.989.3236

Fax: 561.989.3237

Georgia

Alpharetta

2475 North Winds Parkway

Suite 200

Alpharetta, GA 30004

Tel: 770.753.6146

Fax: 770.753.6147

Illinois

Oakbrook Terrace

Two Mid American Plaza

Suite 800

Oakbrook Terrace, IL 60181

Tel: 630.954.2234

Fax: 630.954.2235

Kentucky

Bowling Green

1262 Chestnut Street

Bowling Green, KY 42101

Tel: 270.793.0010

Fax: 270.793.0040

Maryland

Bethesda

6903 Rockledge Drive

Suite 230

Bethesda, MD 20817

Tel: 301.897.5800

Fax: 301.897.8389

Massachusetts

Waltham

200 West Street

Waltham, MA 02451

♦Tel: 781.890.0180

Fax: 781.890.6158

Burlington - Mint Technology

77 South Bedford Street

Burlington, MA 01803

Tel: 781.685.3800

Fax: 781.685.3801

Minnesota

Minneapolis

8300 Norman Center Drive

Suite 730

Minneapolis, MN 55437

♦Tel: 612.921.8300

Fax: 612.921.8399

New Jersey

Red Bank

125 Half Mile Road

Suite 200

Red Bank, NJ 07701

Tel: 732.933.2656

Fax: 732.933.2643

Cherry Hill - Mint Technology

215 Longstone Drive

Cherry Hill, NJ 08003

Tel: 856.489.5530

Fax: 856.489.5531

New York

Fairport

550 Willowbrook Ofﬁce Park

Fairport, NY 14450

Tel: 716.218.0020

Fax: 716.218.9010

North Carolina

Raleigh

Phase II

4601 Six Forks Road

Suite 528

Raleigh, NC 27609

Tel: 919.785.4520

Fax: 919.783.8909

Oregon

Beaverton

15455 NW Greenbrier Parkway

Suite 235

Beaverton, OR 97006

Tel: 503.645.0589

Fax: 503.645.6612

Texas

Austin

9020 Capital of TX Highway North

Building 1

Suite 150

Austin, TX 78759

Tel: 512.388.7294

Fax: 512.388.4171

Plano

500 North Central Expressway

Suite 440

Plano, TX 75074

♦Tel: 972.244.5000

Fax: 972.244.5001

Houston

20405 State Highway 249

Suite 450

Houston, TX 77070

Tel: 281.379.7800

Fax: 281.379.7818

Canada

Ontario

Ottawa

260 Hearst Way

Suite 400

Kanata, ON K2L 3H1

♦Tel: 613.592.1263

Fax: 613.592.3253

INTERNATIONAL

France

Paris

LSI Logic S.A.

Immeuble Europa

53 bis Avenue de l'Europe

B.P. 139

78148 Velizy-Villacoublay

Cedex, Paris

♦Tel: 33.1.34.63.13.13

Fax: 33.1.34.63.13.19

Germany

Munich

LSI Logic GmbH

Orleansstrasse 4

81669 Munich

♦Tel: 49.89.4.58.33.0

Fax: 49.89.4.58.33.108

Stuttgart

Mittlerer Pfad 4

D-70499 Stuttgart

♦Tel: 49.711.13.96.90

Fax: 49.711.86.61.428

Italy

Milan

LSI Logic S.P.A.

CentroDirezionaleColleoniPalazzo

Orione Ingresso 1

20041 Agrate Brianza, Milano

♦Tel: 39.039.687371

Fax: 39.039.6057867

Japan

Tokyo

LSI Logic K.K.

Rivage-Shinagawa Bldg. 14F

4-1-8 Kounan

Minato-ku, Tokyo 108-0075

♦Tel: 81.3.5463.7821

Fax: 81.3.5463.7820

Osaka

Crystal Tower 14F

1-2-27 Shiromi

Chuo-ku, Osaka 540-6014

♦Tel: 81.6.947.5281

Fax: 81.6.947.5287

Sales Ofﬁces and Design

Resource Centers

(Continued)

Korea

Seoul

LSI Logic Corporation of

Korea Ltd

10th Fl., Haesung 1 Bldg.

942, Daechi-dong,

Kangnam-ku, Seoul, 135-283

Tel: 82.2.528.3400

Fax: 82.2.528.2250

The Netherlands

Eindhoven

LSI Logic Europe Ltd

World Trade Center Eindhoven

Building ‘Rijder’

Bogert 26

5612 LZ Eindhoven

Tel: 31.40.265.3580

Fax: 31.40.296.2109

Singapore

LSI Logic Pte Ltd

7 Temasek Boulevard

#28-02 Suntec Tower One

Singapore 038987

Tel: 65.334.9061

Fax: 65.334.4749

Sweden

Stockholm

LSI Logic AB

Finlandsgatan 14

164 74 Kista

♦Tel: 46.8.444.15.00

Fax: 46.8.750.66.47

Taiwan

Taipei

LSI Logic Asia, Inc.

Taiwan Branch

10/F 156 Min Sheng E. Road

Section 3

Taipei, Taiwan R.O.C.

Tel: 886.2.2718.7828

Fax: 886.2.2718.8869

United Kingdom

Bracknell

LSI Logic Europe Ltd

Greenwood House

London Road

Bracknell, Berkshire RG12 2UB

♦Tel: 44.1344.426544

Fax: 44.1344.481039

♦Sales Ofﬁces with

Design Resource Centers

International Distributors

Australia

New South Wales

Reptechnic Pty Ltd

3/36 Bydown Street

Neutral Bay, NSW 2089

♦Tel: 612.9953.9844

Fax: 612.9953.9683

Belgium

Acal nv/sa

Lozenberg 4

1932 Zaventem

Tel: 32.2.7205983

Fax: 32.2.7251014

China

Beijing

LSI Logic International

Services Inc.

Beijing Representative

Ofﬁce

Room 708

Canway Building

66 Nan Li Shi Lu

Xicheng District

Beijing 100045, China

Tel: 86.10.6804.2534 to 38

Fax: 86.10.6804.2521

France

Rungis Cedex

Azzurri Technology France

22 Rue Saarinen

Sillic 274

94578 Rungis Cedex

Tel: 33.1.41806310

Fax: 33.1.41730340

Germany

Haar

EBV Elektronik

Hans-Pinsel Str. 4

D-85540 Haar

Tel: 49.89.4600980

Fax: 49.89.46009840

Munich

Avnet Emg GmbH

Stahlgruberring 12

81829 Munich

Tel: 49.89.45110102

Fax: 49.89.42.27.75

Wuennenberg-Haaren

Peacock AG

Graf-Zepplin-Str 14

D-33181 Wuennenberg-Haaren

Tel: 49.2957.79.1692

Fax: 49.2957.79.9341

Hong Kong

AVT Industrial Ltd

Unit 608 Tower 1

Cheung Sha Wan Plaza

833 Cheung Sha Wan Road

Kowloon, Hong Kong

Tel: 852.2428.0008

Fax: 852.2401.2105

Serial System (HK) Ltd

2301 Nanyang Plaza

57 Hung To Road, Kwun Tong

Kowloon, Hong Kong

Tel: 852.2995.7538

Fax: 852.2950.0386

India

Bangalore

Spike Technologies India

Private Ltd

951, Vijayalakshmi Complex,

2nd Floor, 24th Main,

J P Nagar II Phase,

Bangalore, India 560078

♦Tel: 91.80.664.5530

Fax: 91.80.664.9748

Israel

Tel Aviv

Eastronics Ltd

11 Rozanis Street

P.O. Box 39300

Tel Aviv 61392

Tel: 972.3.6458777

Fax: 972.3.6458666

Japan

Tokyo

Daito Electron

Sogo Kojimachi No.3 Bldg

1-6 Kojimachi

Chiyoda-ku, Tokyo 102-8730

Tel: 81.3.3264.0326

Fax: 81.3.3261.3984

Global Electronics

Corporation

Nichibei Time24 Bldg. 35 Tansu-cho

Shinjuku-ku, Tokyo 162-0833

Tel: 81.3.3260.1411

Fax: 81.3.3260.7100

Technical Center

Tel: 81.471.43.8200

Marubeni Solutions

1-26-20 Higashi

Shibuya-ku, Tokyo 150-0001

Tel: 81.3.5778.8662

Fax: 81.3.5778.8669

Shinki Electronics

Myuru Daikanyama 3F

3-7-3 Ebisu Minami

Shibuya-ku, Tokyo 150-0022

Tel: 81.3.3760.3110

Fax: 81.3.3760.3101

Yokohama-City

Innotech

2-15-10 Shin Yokohama

Kohoku-ku

Yokohama-City, 222-8580

Tel: 81.45.474.9037

Fax: 81.45.474.9065

Macnica Corporation

Hakusan High-Tech Park

1-22-2 Hadusan, Midori-Ku,

Yokohama-City, 226-8505

Tel: 81.45.939.6140

Fax: 81.45.939.6141

The Netherlands

Eindhoven

Acal Nederland b.v.

Beatrix de Rijkweg 8

5657 EG Eindhoven

Tel: 31.40.2.502602

Fax: 31.40.2.510255

Switzerland

Brugg

LSI Logic Sulzer AG

Mattenstrasse 6a

CH 2555 Brugg

Tel: 41.32.3743232

Fax: 41.32.3743233

Taiwan

Taipei

Avnet-Mercuries

Corporation, Ltd

14F, No. 145,

Sec. 2, Chien Kuo N. Road

Taipei, Taiwan, R.O.C.

Tel: 886.2.2516.7303

Fax: 886.2.2505.7391

Lumax International

Corporation, Ltd

7th Fl., 52, Sec. 3

Nan-Kang Road

Taipei, Taiwan, R.O.C.

Tel: 886.2.2788.3656

Fax: 886.2.2788.3568

Prospect Technology

Corporation, Ltd

4Fl., No. 34, Chu Luen Street

Taipei, Taiwan, R.O.C.

Tel: 886.2.2721.9533

Fax: 886.2.2773.3756

Wintech Microeletronics

Co., Ltd

7F., No. 34, Sec. 3, Pateh Road

Taipei, Taiwan, R.O.C.

Tel: 886.2.2579.5858

Fax: 886.2.2570.3123

United Kingdom

Maidenhead

Azzurri Technology Ltd

16 Grove Park Business Estate

Waltham Road

White Waltham

Maidenhead, Berkshire SL6 3LW

Tel: 44.1628.826826

Fax: 44.1628.829730

Milton Keynes

Ingram Micro (UK) Ltd

Garamonde Drive

Wymbush

Milton Keynes

Buckinghamshire MK8 8DF

Tel: 44.1908.260422

Swindon

EBV Elektronik

12 Interface Business Park

Bincknoll Lane

Wootton Bassett,

Swindon, Wiltshire SN4 8SY

Tel: 44.1793.849933

Fax: 44.1793.859555

♦Sales Ofﬁces with

Design Resource Centers

Chapter 1
Introduction
1 Overview 1-1
2 Features 1-3
3 Application Examples 1-5
4 CoreWare Program 1-5
Chapter 2
Functional Description
1 EZ4021-FC CPU 2-2
1.1 CPU Data Path Control (CDC) Module 2-3
1.2 Integer Data Path (IDP) Module 2-3
1.3 System Coprocessor 0 (CP0) 2-3
1.4 Pipeline Architecture 2-3
2 Memory Management Unit 2-4
3 Cache Memory 2-5
3.1 Instruction Cache 2-5
3.2 Data Cache 2-7
3.3 Cache Maintenance Operations 2-11
4 Multiply/Divide Unit (MDU) 2-12
4.1 Standard Instructions 2-12
4.2 Extended Instructions 2-12
4.3 Performance 2-12
4.4 Pipeline Interlocks 2-13
5 Quick Bus Interface 2-13
6 Bus Interface Unit (BIU) 2-14
6.1 BIU Features 2-15
6.2 Instruction Cache Reﬁll Summary 2-17
6.3 Data Cache Reﬁll Summary 2-17
6.4 Quick Bus Access Priority 2-17
6.5 Programmable BIU Features 2-18
7 EJTAG Interface 2-18
8 Clocks 2-23
8.1 System Clock 2-23
8.2 EJTAG and Scan Clocks 2-24
8.3 Require External Synchronization to System Clock 2-24

Chapter 3
Programmer’s Model
1 Memory Management 3-1
1.1 Operating Modes 3-1
1.2 Virtual Memory and the TLB 3-7
1.3 Memory and TLB-Support Registers 3-9
1.4 Virtual Address Translation 3-20
2 Exception Processing 3-22
2.1 Exception Vector Locations 3-23
2.2 CP0 Exception Processing Registers 3-23
3 EJTAG Debugging 3-34
3.1 EJTAG Debug Registers 3-35
3.2 EJTAG Serial-Access Registers 3-35
3.3 EJTAG CP0 Registers 3-49
3.4 EJTAG Memory Mapped Registers 3-57
4 System Conﬁguration Register 1 3-74
Chapter 4
Instruction Set Architecture
1 Instruction Set Formats 4-1
2 Load and Store Instructions 4-2
2.1 Scheduling a Load Delay Slot 4-2
2.2 Deﬁning Access Types 4-3
2.3 CPU Loads and Stores 4-5
2.4 Atomic Update Loads and Stores 4-9
2.5 Coprocessor Loads and Stores 4-9
3 Computational Instructions 4-10
3.1 ALU 4-11
3.2 Three-Operand, Register Type 4-13
3.3 Shift 4-14
3.4 Multiply and Divide 4-16
4 Jump and Branch Instructions 4-19
5 Exception Instructions 4-22
6 Serialization Instruction 4-24
7 Coprocessor Instructions 4-24
7.1 Coprocessor Data Movement and Conditional Branch Instructions4-24
7.2 System Control Coprocessor (CP0) Instructions 4-26

8 Cache Maintenance Instruction 4-27
9 EZ4021-FC Instruction Extensions 4-32
9.1 General 32-Bit Instruction Extensions 4-32
9.2 CP0 Instruction Extensions 4-33
10 CPU 32-Bit Instruction Opcode Encoding 4-42
Chapter 5
Signal Descriptions
1 Quick Bus Interface 5-1
2 Interrupt, Clock, and Reset Signals 5-5
3 EJTAG and PC Trace Signals 5-7
3.1 EJTAG Standard Signals 5-7
3.2 EJTAG Standard Support Signals 5-10
3.3 Nonmultiplexed EJTAG Signals 5-10
3.4 EJTAG External Module Signals 5-11
3.5 EJTAG Conﬁguration Signals 5-11
4 Global Test Mode Signals 5-13
5 BIST Signals 5-14
6 Miscellaneous Signals 5-15
Chapter 6
Interface Operation
1 Quick Bus Transactions 6-1
1.1 Basic Transactions 6-1
1.2 Advanced Transactions 6-7
2 Reset Behavior 6-14
2.1 Reset 6-14
2.2 Soft Reset 6-15
2.3 Modules Affected by Reset 6-15
3 Interrupt Behavior 6-17
3.1 Nonmaskable Interrupt 6-17
3.2 Maskable Interrupts 6-18
4 Wait States 6-19
Chapter 7
Error and Exception Handling
1 Overview 7-1

2 Exception Handling Registers 7-5
3 Standard Exception Operation 7-6
4 Standard Exception Processing Actions 7-7
5 Debug Exception Operation 7-8
6 Debug Exception Processing 7-9
7 Precision of Exceptions 7-9
8 Exception Vector Locations 7-10
9 Priority of Exceptions 7-11
9.1 Overriding Priority (Stage Independent) 7-11
9.2 W Stage Exceptions 7-12
9.3 M Stage Exceptions 7-12
9.4 X Stage Exceptions 7-12
9.5 R Stage Exceptions 7-12
10 Exception Descriptions 7-12
10.1 Reset Exception 7-13
10.2 Soft Reset Exception 7-14
10.3 Data Address Break Exception 7-16
10.4 Bus Error Exception 7-17
10.5 Floating-Point Exception 7-18
10.6 TLB Reﬁll Exception 7-19
10.7 TLB Invalid Exception 7-21
10.8 TLB Modiﬁed Exception 7-22
10.9 EJTAG Break Exception 7-23
10.10 Integer Overﬂow Exception 7-24
10.11 Trap Exception 7-25
10.12 Address Error Exception 7-26
10.13 Interrupt Exception 7-27
10.14 Software Debug Breakpoint Exception 7-28
10.15 Coprocessor Unusable Exception 7-29
10.16 System Call Exception 7-30
10.17 Breakpoint Exception 7-31
10.18 Reserved Instruction Exception 7-32
10.19 Debug Single Step Exception 7-33
10.20 Instruction Address Break Exception 7-35
11 Loss of PC Trace Information 7-36
12 Spurious Debug Mode Indications 7-37

Chapter 8
Memory Test
8.1 I-Cache BIST 8-1
8.2 D-Cache Test 8-3
8.2.1 D-Cache Tag/LRU RAMs 8-3
8.2.2 D-Cache Data RAMs 8-3
8.3 Register File Test 8-4
8.4 Translation Lookaside Buffer (TLB) Test 8-4
Chapter 9
Speciﬁcations
9.1 Physical Speciﬁcations 9-1
9.2 AC Timing and Loading 9-2
Customer Feedback

1 EZ4021-FC EasyMACRO Microprocessor Block Diagram 1-2
1 EZ4021-FC EasyMACRO Microprocessor
Block Diagram 2-2
2 EZ4021-FC Instruction Pipeline 2-3
3 I-Cache Line State Diagram 2-6
4 Address to I-Cache Tag and Line Number 2-7
5 Write Back Line State Transition Diagram 2-8
6 Write Through Line State Transition Diagram 2-9
7 Address to D-Cache Tag and Line Number 2-10
8 BIU I/O Block Diagram 2-15
9 TAP Controller 2-20
10 On-Chip SCLKP Generation 2-23
11 EZ4021-FC Clock Distribution 2-25
1 User Mode Memory Map 3-3
2 Supervisor Mode Memory Map 3-4
3 Kernel Mode Memory Map 3-5
4 EZ4021-FC Virtual Address Format 3-7
5 EZ4021-FC TLB Entry Format 3-8
6 Index Register (0) 3-10
7 Random Register (1) 3-11
8 EntryLo0/1 Register 3-12
9 PageMask Register (5) 3-13
10 Wired Register Location 3-14
11 Wired Register 3-14
12 EntryHi Register (10) 3-15
13 PRId Register (15) 3-16
14 Conﬁg Register (16) 3-17
15 TagLo Register 3-20
16 EZ4021-FC TLB Address Translation Process 3-21
17 Context Register (4) 3-25
18 BadVAddr Register (8) 3-26
19 Count Register (9) 3-26
20 Compare Register (11) 3-27
21 Status Register (12) 3-27
22 Cause Register (13) 3-30
23 EPC Register (14) 3-33
24 ErrorEPC Register (30) 3-34
25 EJTAG Instruction Register (EIR) 3-36

26 EJTAG Bypass Register (EBR) 3-38
27 EJTAG Device Identiﬁcation Register (EDIR) 3-38
28 EJTAG Implementation Register (EIMR) 3-39
29 EJTAG Address Register (EAR) 3-41
30 EJTAG Data Register (EDR) 3-42
31 EJTAG Control Register (ECR) 3-43
32 Byte Lane Signiﬁcance and Dsz Deﬁnition 3-47
33 Debug Register (23) (Debug) 3-50
34 Debug Exception Program Counter (DEPC) Register (24) 3-55
35 Debug Exception Save (DESAVE) Register (31) 3-56
36 Debug Control Register (DCR) 3-60
37 Instruction Address Break Status (IBS) Register 3-62
38 Instruction Address Break n Register (IBAn) 3-64
39 Instruction Address Break Control n Register (IBCn) 3-65
40 Instruction Address Break Mask n Registers (IBMn) 3-66
41 Data Address Break Status Register (DBS) 3-68
42 Data Break Address n Registers (DBAn) 3-69
43 Data Break Control n Registers (DBCn) 3-70
44 Data Address Break Mask n Registers (DBMn) 3-73
45 Data Value Break n Registers (DVBn) 3-74
46 System Conﬁguration Register 1 3-74
1 Instruction Format 4-2
2 Byte Speciﬁcations for Loads/Store 4-4
3 Index Effective Address Format 4-28
1 Four-Doubleword Instruction Request 6-2
2 Instruction Burst Data Return 6-3
3 Single Doubleword Instruction Request and Return 6-4
4 Store Data Write 6-6
5 Store Burst 6-7
6 Quick Bus Slave Ready Operation 6-9
7 Burst Request of a Nonburstable Device 6-10
8 Multiple Requests 6-12
9 Reset Pipeline Behavior 6-14
10 NMI Pipeline Behavior (Detected Immediately) 6-17
11 NMI Pipeline Behavior (Detection Delayed due to Stall) 6-18
12 Interrupt Pipeline Behavior (Detected Immediately) 6-19
13 WAITI Pipeline Stall 6-20
1 Reset Exception 7-7

7.2 Soft Reset and NMI Exceptions 7-7

7.3 Common Exceptions 7-8

7.4 Debug Exceptions 7-9

8.1 I-Cache with BIST Block Diagram 8-2

9.1 AC Speciﬁcations 9-2

1 Write Back D-Cache Data Coherency 2-9
2 Write Through D-Cache Data Coherency 2-10
3 Cache Maintenance Operations 2-11
4 Execution Time of Multiply and Divide Instructions 2-13
5 Programmable Features 2-18
1 Exception Addresses 3-23
2 EJTAG Interface Instructions 3-37
3 Memory-Mapped Registers 3-58
1 Normal CPU Load/Store Instructions 4-6
2 Unaligned CPU Load/Store Instructions 4-8
3 Atomic Update CPU Load/Store Instructions 4-9
4 Coprocessor Load/Store Instructions 4-10
5 ALU Instructions with an Immediate Operand 4-12
6 Three-Operand, Register Type Instructions 4-13
7 Shift Instructions 4-15
8 Multiply and Divide Instructions 4-17
9 Execution Time of Multiply and Divide Instructions 4-18
10 Jump Instructions 4-20
11 PC-Relative Conditional Branch Instructions 4-20
12 PC-Relative Conditional Branch Likely Instructions 4-21
13 Breakpoint and System Call Instructions 4-22
14 Trap-on-Condition Instructions 4-23
15 Serialization Instruction 4-24
16 Coprocessor Data Movement and Conditional Branch Instructions4-25
17 CP0 Instructions 4-26
18 Cache Maintenance Instruction 4-27
19 Cache Operation Code Deﬁnitions 4-29
20 General Instruction Extensions 4-32
21 CP0 Instruction Extensions 4-33
22 MIPS III Major Opcode Bit Encoding 4-42
23 COPz rs Opcode Bit Encoding 4-43
24 COPz rt Opcode Bit Encoding 4-43
25 REGIMM Opcode rt Bit Encoding 4-43
26 SPECIAL Opcode Bit Encoding 4-44
27 SPECIAL 2 Opcode Bit Encoding 4-44
28 CP0 Opcode Bit Encoding 4-45
1 Reset Sensitivity 6-16
1 EZ4021-FC Standard Exception Summary 7-3

2 CP0 Exception Processing Registers 7-5
3 Current Processor Mode 7-7
4 Standard Exception Vector Base Addresses 7-10
5 Debug Exception Vector Base Addresses 7-11
6 Exception Vector Offset Addresses 7-11
1 EZ4021-FC Physical Layout Size 9-1
2 EZ4021-FC AC Timing Conditions 9-2
3 EZ4021-FC Core Timing Conditions for G12 9-3
4 EZ4021-FC Core Maximum Clock Frequency for AC Timing 9-3
5 EZ4021-FC Core Input AC Timing (ns) and Loading 9-4
6 EZ4021-FC Core Output AC Timing (ns) and Loading 9-6