[unix-history] / usr / src / sys / hp300 / DOC / HPMMU.notes

Overview:
--------

	(Some of this is gleaned from an article in the September 1986
	Hewlett-Packard Journal and info in the July 1987 HP Communicator)

	Page and segment table entries mimic the Motorola 68851 PMMU,
	in an effort at upward compatibility.  The HP MMU uses a two
	level translation scheme.  There are seperate (but equal!)
	translation tables for both supervisor and user modes.  At the
	lowest level are page tables.  Each page table consists of one
	or more 4k pages of 1024x4 byte page table entries.  Each PTE
	maps one 4k page of VA space.  At the highest level is the
	segment table.  The segment table is a single 4K page of 1024x4
	byte entries.  Each entry points to a 4k page of PTEs.  Hence
	one STE maps 4Mb of VA space and one page of STEs is sufficient
	to map the entire 4Gb address space (what a coincidence!).  The
	unused valid bit in page and segment table entries must be
	zero.

	There are seperate translation lookaside buffers for the user
	and supervisor modes, each containing 1024 entries.

	To augment the 68020's instruction cache, the HP CPU has an
	external cache.  A direct-mapped, virtual cache implementation
	is used with 16 Kbytes of cache on 320 systems and 32 Kbytes on
	350 systems.  Each cache entry can contain instructions or data,
	from either user or supervisor space.  Seperate valid bits are
	kept for user and supervisor entries, allowing for descriminatory
	flushing of the cache.

	MMU translation and cache-miss detection are done in parallel.


Segment table entries:
------- ----- -------

	bits 31-12:	Physical page frame number of PT page
	bits 11-4:	Reserved at zero
			(can software use them?)
	bit 3:		Reserved at one
	bit 2:		Set to 1 if segment is read-only, ow read-write
	bits 1-0:	Valid bits
			(hardware uses bit 1)


Page table entries:
---- ----- -------

	bits 31-12:	Physical page frame number of page
	bits 11-7:	Available for software use
	bit 6:		If 1, inhibits caching of data in this page.
			(both instruction and external cache)
	bit 5:		Reserved at zero
	bit 4:		Hardware modify bit
	bit 3:		Hardware reference bit
	bit 2:		Set to 1 if page is read-only, ow read-write
	bits 1-0:	Valid bits
			(hardware uses bit 0)


Hardware registers:
-------- ---------

	The hardware has four longword registers controlling the MMU.
	The registers can be accessed as shortwords also (remember to
	add 2 to addresses given below).

	5F4000:	Supervisor mode segment table pointer.  Loaded (as longword)
		with page frame number (i.e. Physaddr >> 12) of the segment
		table mapping supervisor space.
	5F4004: User mode segment table pointer.  Loaded (as longword) with
		page frame number of the segment table mapping user space.
	5F4008: TLB control register.  Used to invalid large sections of the
		TLB.  More info below.
	5F400C:	MMU command/status register.  Defined as follows:

		bit 15:	If 1, indicates a page table fault occured
		bit 14:	If 1, indicates a page fault occured
		bit 13: If 1, indicates a protection fault (write to RO page)
		bit 6:	MC68881 enable.  Tied to chip enable line.
			(set this bit to enable)
		bit 5:	MC68020 instruction cache enable.  Tied to Insruction
			cache disable line.  (set this bit to enable)
		bit 3:	If 1, indicates an MMU related bus error occured.
			Bits 13-15 are now valid.
		bit 2:	External cache enable.  (set this bit to enable)
		bit 1:	Supervisor mapping enable.  Enables translation of
			supervisor space VAs.
		bit 0:	User mapping enable.  Enables translation of user
			space VAs.


	Any bits set by the hardware are cleared only by software.
	(i.e. bits 3,13,14,15)

Invalidating TLB:
------------ ---

	All translations:
		Read the TLB control register (5F4008) as a longword.

	User translations only:
		Write a longword 0 to TLB register or set the user
		segment table pointer.

	Supervisor translations only:
		Write a longword 0x8000 to TLB register or set the
		supervisor segment table pointer.

	A particular VA translation:
		Set destination function code to 3 ("purge" space),
		write a longword 0 to the VA whose translation we are to
		invalidate, and restore function code.  This apparently
		invalidates any translation for that VA in both the user
		and supervisor LB.  Here is what I did:

		#define FC_PURGE 3
		#define FC_USERD 1
		_TBIS:
			movl	sp@(4),a0	| VA to invalidate
			moveq	#FC_PURGE,d0	| change address space
			movc	d0,dfc		|   for destination
			moveq	#0,d0		| zero to invalidate?
			movsl	d0,a0@		| hit it
			moveq	#FC_USERD,d0	| back to old
			movc	d0,dfc		|   address space
			rts			| done


Invalidating the external cache:
------------ --- -------- -----

	Everything:
		Toggle the cache enable bit (bit 2) in the MMU control
		register (5F400C).  Can be done by ANDing and ORing the
		register location.

	User:
		Change the user segment table pointer register (5F4004),
		i.e. read the current value and write it back.

	Supervisor:
		Change the supervisor segment table pointer register
		(5F4000), i.e. read the current value and write it back.
Commit	Line	Data
435db02d MH	1	Overview:
	2	--------
	3
	4	(Some of this is gleaned from an article in the September 1986
	5	Hewlett-Packard Journal and info in the July 1987 HP Communicator)
	6
	7	Page and segment table entries mimic the Motorola 68851 PMMU,
	8	in an effort at upward compatibility. The HP MMU uses a two
	9	level translation scheme. There are seperate (but equal!)
	10	translation tables for both supervisor and user modes. At the
	11	lowest level are page tables. Each page table consists of one
	12	or more 4k pages of 1024x4 byte page table entries. Each PTE
	13	maps one 4k page of VA space. At the highest level is the
	14	segment table. The segment table is a single 4K page of 1024x4
	15	byte entries. Each entry points to a 4k page of PTEs. Hence
	16	one STE maps 4Mb of VA space and one page of STEs is sufficient
	17	to map the entire 4Gb address space (what a coincidence!). The
	18	unused valid bit in page and segment table entries must be
	19	zero.
	20
	21	There are seperate translation lookaside buffers for the user
	22	and supervisor modes, each containing 1024 entries.
	23
	24	To augment the 68020's instruction cache, the HP CPU has an
f6710dcd MH	25	external cache. A direct-mapped, virtual cache implementation
	26	is used with 16 Kbytes of cache on 320 systems and 32 Kbytes on
	27	350 systems. Each cache entry can contain instructions or data,
	28	from either user or supervisor space. Seperate valid bits are
	29	kept for user and supervisor entries, allowing for descriminatory
435db02d MH	30	flushing of the cache.
	31
	32	MMU translation and cache-miss detection are done in parallel.
	33
	34
	35	Segment table entries:
	36	------- ----- -------
	37
	38	bits 31-12: Physical page frame number of PT page
	39	bits 11-4: Reserved at zero
	40	(can software use them?)
	41	bit 3: Reserved at one
	42	bit 2: Set to 1 if segment is read-only, ow read-write
	43	bits 1-0: Valid bits
	44	(hardware uses bit 1)
	45
	46
	47	Page table entries:
	48	---- ----- -------
	49
	50	bits 31-12: Physical page frame number of page
	51	bits 11-7: Available for software use
	52	bit 6: If 1, inhibits caching of data in this page.
	53	(both instruction and external cache)
	54	bit 5: Reserved at zero
	55	bit 4: Hardware modify bit
	56	bit 3: Hardware reference bit
	57	bit 2: Set to 1 if page is read-only, ow read-write
	58	bits 1-0: Valid bits
	59	(hardware uses bit 0)
	60
	61
	62	Hardware registers:
	63	-------- ---------
	64
	65	The hardware has four longword registers controlling the MMU.
	66	The registers can be accessed as shortwords also (remember to
	67	add 2 to addresses given below).
	68
	69	5F4000: Supervisor mode segment table pointer. Loaded (as longword)
	70	with page frame number (i.e. Physaddr >> 12) of the segment
	71	table mapping supervisor space.
	72	5F4004: User mode segment table pointer. Loaded (as longword) with
	73	page frame number of the segment table mapping user space.
	74	5F4008: TLB control register. Used to invalid large sections of the
	75	TLB. More info below.
	76	5F400C: MMU command/status register. Defined as follows:
	77
	78	bit 15: If 1, indicates a page table fault occured
	79	bit 14: If 1, indicates a page fault occured
	80	bit 13: If 1, indicates a protection fault (write to RO page)
	81	bit 6: MC68881 enable. Tied to chip enable line.
	82	(set this bit to enable)
	83	bit 5: MC68020 instruction cache enable. Tied to Insruction
	84	cache disable line. (set this bit to enable)
	85	bit 3: If 1, indicates an MMU related bus error occured.
	86	Bits 13-15 are now valid.
	87	bit 2: External cache enable. (set this bit to enable)
	88	bit 1: Supervisor mapping enable. Enables translation of
	89	supervisor space VAs.
	90	bit 0: User mapping enable. Enables translation of user
	91	space VAs.
	92
	93
94	Any bits set by the hardware are cleared only by software.
95	(i.e. bits 3,13,14,15)
96
97	Invalidating TLB:
98	------------ ---
99
100	All translations:
101	Read the TLB control register (5F4008) as a longword.
102
103	User translations only:
104	Write a longword 0 to TLB register or set the user
105	segment table pointer.
106
107	Supervisor translations only:
108	Write a longword 0x8000 to TLB register or set the
109	supervisor segment table pointer.
110
111	A particular VA translation:
112	Set destination function code to 3 ("purge" space),
113	write a longword 0 to the VA whose translation we are to
114	invalidate, and restore function code. This apparently
115	invalidates any translation for that VA in both the user
116	and supervisor LB. Here is what I did:
117
118	#define FC_PURGE 3
119	#define FC_USERD 1
120	_TBIS:
121	movl sp@(4),a0 \| VA to invalidate
122	moveq #FC_PURGE,d0 \| change address space
123	movc d0,dfc \| for destination
124	moveq #0,d0 \| zero to invalidate?
125	movsl d0,a0@ \| hit it
126	moveq #FC_USERD,d0 \| back to old
127	movc d0,dfc \| address space
128	rts \| done
129
130
131	Invalidating the external cache:
132	------------ --- -------- -----
133
134	Everything:
135	Toggle the cache enable bit (bit 2) in the MMU control
136	register (5F400C). Can be done by ANDing and ORing the
137	register location.
138
139	User:
140	Change the user segment table pointer register (5F4004),
141	i.e. read the current value and write it back.
142
143	Supervisor:
144	Change the supervisor segment table pointer register
145	(5F4000), i.e. read the current value and write it back.