How is cache addressing assigned on the R5?

I understand that the TCM (Tightly Coupled Memory) address can be assigned by the user as shown below, so I know the method for TCM base address assignment:

Example 8-1: Setting TCM location
DSB ; Data synchronization barrier
MOV r0, #0x800000001 ; Set base address, with enable bit set
MCR p15, 0, r0, c9, c1, 0 ; Write TCM region register
ISB ; Instruction synchronization barrier

However, for the cache system (both I-Cache and D-Cache), the base addresses are not user-configurable in the same way. I want to know whether it is possible to insert specific data into the cache to corrupt it for cache testing purposes. To perform such a test, I think I need to know how the cache address is assigned.

I came across a cache enable example using CP15 registers to enable the I-Cache and D-Cache. Here's how it is done by writing to the System Control Register (SCTLR):

MRC p15, 0, r0, c1, c0, 0 ; Read SCTLR
ORR r0, r0, #(1 << 12) ; Set bit 12 to enable I-Cache
ORR r0, r0, #(1 << 2) ; Set bit 2 to enable D-Cache
MCR p15, 0, r0, c1, c0, 0 ; Write SCTLR

But It seems there isn't explicit information available about cache addresses. How, then, is the cache address assigned on the R5?