1$NetBSD: HPMMU.notes,v 1.5 2002/02/11 10:44:39 wiz Exp $ 2 3Overview: 4-------- 5 6 (Some of this is gleaned from an article in the September 1986 7 Hewlett-Packard Journal and info in the July 1987 HP Communicator) 8 9 Page and segment table entries mimic the Motorola 68851 PMMU, 10 in an effort at upward compatibility. The HP MMU uses a two 11 level translation scheme. There are separate (but equal!) 12 translation tables for both supervisor and user modes. At the 13 lowest level are page tables. Each page table consists of one 14 or more 4k pages of 1024x4 byte page table entries. Each PTE 15 maps one 4k page of VA space. At the highest level is the 16 segment table. The segment table is a single 4K page of 1024x4 17 byte entries. Each entry points to a 4k page of PTEs. Hence 18 one STE maps 4Mb of VA space and one page of STEs is sufficient 19 to map the entire 4Gb address space (what a coincidence!). The 20 unused valid bit in page and segment table entries must be 21 zero. 22 23 There are separate translation lookaside buffers for the user 24 and supervisor modes, each containing 1024 entries. 25 26 To augment the 68020's instruction cache, the HP CPU has an 27 external cache. A direct-mapped, virtual cache implementation 28 is used with 16 Kbytes of cache on 320 systems and 32 Kbytes on 29 350 systems. Each cache entry can contain instructions or data, 30 from either user or supervisor space. Separate valid bits are 31 kept for user and supervisor entries, allowing for descriminatory 32 flushing of the cache. 33 34 MMU translation and cache-miss detection are done in parallel. 35 36 37Segment table entries: 38------- ----- ------- 39 40 bits 31-12: Physical page frame number of PT page 41 bits 11-4: Reserved at zero 42 (can software use them?) 43 bit 3: Reserved at one 44 bit 2: Set to 1 if segment is read-only, ow read-write 45 bits 1-0: Valid bits 46 (hardware uses bit 1) 47 48 49Page table entries: 50---- ----- ------- 51 52 bits 31-12: Physical page frame number of page 53 bits 11-7: Available for software use 54 bit 6: If 1, inhibits caching of data in this page. 55 (both instruction and external cache) 56 bit 5: Reserved at zero 57 bit 4: Hardware modify bit 58 bit 3: Hardware reference bit 59 bit 2: Set to 1 if page is read-only, ow read-write 60 bits 1-0: Valid bits 61 (hardware uses bit 0) 62 63 64Hardware registers: 65-------- --------- 66 67 The hardware has four longword registers controlling the MMU. 68 The registers can be accessed as shortwords also (remember to 69 add 2 to addresses given below). 70 71 5F4000: Supervisor mode segment table pointer. Loaded (as longword) 72 with page frame number (i.e. Physaddr >> 12) of the segment 73 table mapping supervisor space. 74 5F4004: User mode segment table pointer. Loaded (as longword) with 75 page frame number of the segment table mapping user space. 76 5F4008: TLB control register. Used to invalid large sections of the 77 TLB. More info below. 78 5F400C: MMU command/status register. Defined as follows: 79 80 bit 15: If 1, indicates a page table fault occurred 81 bit 14: If 1, indicates a page fault occurred 82 bit 13: If 1, indicates a protection fault (write to RO page) 83 bit 6: MC68881 enable. Tied to chip enable line. 84 (set this bit to enable) 85 bit 5: MC68020 instruction cache enable. Tied to Insruction 86 cache disable line. (set this bit to enable) 87 bit 3: If 1, indicates an MMU related bus error occurred. 88 Bits 13-15 are now valid. 89 bit 2: External cache enable. (set this bit to enable) 90 bit 1: Supervisor mapping enable. Enables translation of 91 supervisor space VAs. 92 bit 0: User mapping enable. Enables translation of user 93 space VAs. 94 95 96 Any bits set by the hardware are cleared only by software. 97 (i.e. bits 3,13,14,15) 98 99Invalidating TLB: 100------------ --- 101 102 All translations: 103 Read the TLB control register (5F4008) as a longword. 104 105 User translations only: 106 Write a longword 0 to TLB register or set the user 107 segment table pointer. 108 109 Supervisor translations only: 110 Write a longword 0x8000 to TLB register or set the 111 supervisor segment table pointer. 112 113 A particular VA translation: 114 Set destination function code to 3 ("purge" space), 115 write a longword 0 to the VA whose translation we are to 116 invalidate, and restore function code. This apparently 117 invalidates any translation for that VA in both the user 118 and supervisor LB. Here is what I did: 119 120 #define FC_PURGE 3 121 #define FC_USERD 1 122 _TBIS: 123 movl sp@(4),a0 | VA to invalidate 124 moveq #FC_PURGE,d0 | change address space 125 movc d0,dfc | for destination 126 moveq #0,d0 | zero to invalidate? 127 movsl d0,a0@ | hit it 128 moveq #FC_USERD,d0 | back to old 129 movc d0,dfc | address space 130 rts | done 131 132 133Invalidating the external cache: 134------------ --- -------- ----- 135 136 Everything: 137 Toggle the cache enable bit (bit 2) in the MMU control 138 register (5F400C). Can be done by ANDing and ORing the 139 register location. 140 141 User: 142 Change the user segment table pointer register (5F4004), 143 i.e. read the current value and write it back. 144 145 Supervisor: 146 Change the supervisor segment table pointer register 147 (5F4000), i.e. read the current value and write it back. 148