The ARM926EJ-S has one TLB for instructions and data, with lockdown entries that whole-TLB invalidation preserves. Two comments said the I and D TLBs were separate; they now say what the software TLB really differs in: capacity and replacement (a direct-mapped cache of 4096 1 KiB granules), and lockdown, which is not modelled (c10 writes are ignored). No code change. Co-Authored-By: Claude Opus 5.5 <[email protected]>