1$NetBSD: HPMMU.notes,v 1.7 2024/05/14 19:00:43 andvar Exp $
2
3Overview:
4--------
5
6          (Some of this is gleaned from an article in the September 1986
7          Hewlett-Packard Journal and info in the July 1987 HP Communicator)
8
9          Page and segment table entries mimic the Motorola 68851 PMMU,
10          in an effort at upward compatibility.  The HP MMU uses a two
11          level translation scheme.  There are separate (but equal!)
12          translation tables for both supervisor and user modes.  At the
13          lowest level are page tables.  Each page table consists of one
14          or more 4k pages of 1024x4 byte page table entries.  Each PTE
15          maps one 4k page of VA space.  At the highest level is the
16          segment table.  The segment table is a single 4K page of 1024x4
17          byte entries.  Each entry points to a 4k page of PTEs.  Hence
18          one STE maps 4Mb of VA space and one page of STEs is sufficient
19          to map the entire 4Gb address space (what a coincidence!).  The
20          unused valid bit in page and segment table entries must be
21          zero.
22
23          There are separate translation lookaside buffers for the user
24          and supervisor modes, each containing 1024 entries.
25
26          To augment the 68020's instruction cache, the HP CPU has an
27          external cache.  A direct-mapped, virtual cache implementation
28          is used with 16 Kbytes of cache on 320 systems and 32 Kbytes on
29          350 systems.  Each cache entry can contain instructions or data,
30          from either user or supervisor space.  Separate valid bits are
31          kept for user and supervisor entries, allowing for discriminatory
32          flushing of the cache.
33
34          MMU translation and cache-miss detection are done in parallel.
35
36
37Segment table entries:
38------- ----- -------
39
40          bits 31-12:         Physical page frame number of PT page
41          bits 11-4:          Reserved at zero
42                              (can software use them?)
43          bit 3:              Reserved at one
44          bit 2:              Set to 1 if segment is read-only, ow read-write
45          bits 1-0: Valid bits
46                              (hardware uses bit 1)
47
48
49Page table entries:
50---- ----- -------
51
52          bits 31-12:         Physical page frame number of page
53          bits 11-7:          Available for software use
54          bit 6:              If 1, inhibits caching of data in this page.
55                              (both instruction and external cache)
56          bit 5:              Reserved at zero
57          bit 4:              Hardware modify bit
58          bit 3:              Hardware reference bit
59          bit 2:              Set to 1 if page is read-only, ow read-write
60          bits 1-0: Valid bits
61                              (hardware uses bit 0)
62
63
64Hardware registers:
65-------- ---------
66
67          The hardware has four longword registers controlling the MMU.
68          The registers can be accessed as shortwords also (remember to
69          add 2 to addresses given below).
70
71          5F4000:   Supervisor mode segment table pointer.  Loaded (as longword)
72                    with page frame number (i.e. Physaddr >> 12) of the segment
73                    table mapping supervisor space.
74          5F4004: User mode segment table pointer.  Loaded (as longword) with
75                    page frame number of the segment table mapping user space.
76          5F4008: TLB control register.  Used to invalid large sections of the
77                    TLB.  More info below.
78          5F400C:   MMU command/status register.  Defined as follows:
79
80                    bit 15:   If 1, indicates a page table fault occurred
81                    bit 14:   If 1, indicates a page fault occurred
82                    bit 13: If 1, indicates a protection fault (write to RO page)
83                    bit 6:    MC68881 enable.  Tied to chip enable line.
84                              (set this bit to enable)
85                    bit 5:    MC68020 instruction cache enable.  Tied to Instruction
86                              cache disable line.  (set this bit to enable)
87                    bit 3:    If 1, indicates an MMU related bus error occurred.
88                              Bits 13-15 are now valid.
89                    bit 2:    External cache enable.  (set this bit to enable)
90                    bit 1:    Supervisor mapping enable.  Enables translation of
91                              supervisor space VAs.
92                    bit 0:    User mapping enable.  Enables translation of user
93                              space VAs.
94
95
96          Any bits set by the hardware are cleared only by software.
97          (i.e. bits 3,13,14,15)
98
99Invalidating TLB:
100------------ ---
101
102          All translations:
103                    Read the TLB control register (5F4008) as a longword.
104
105          User translations only:
106                    Write a longword 0 to TLB register or set the user
107                    segment table pointer.
108
109          Supervisor translations only:
110                    Write a longword 0x8000 to TLB register or set the
111                    supervisor segment table pointer.
112
113          A particular VA translation:
114                    Set destination function code to 3 ("purge" space),
115                    write a longword 0 to the VA whose translation we are to
116                    invalidate, and restore function code.  This apparently
117                    invalidates any translation for that VA in both the user
118                    and supervisor LB.  Here is what I did:
119
120                    #define FC_PURGE 3
121                    #define FC_USERD 1
122                    _TBIS:
123                              movl      sp@(4),a0 | VA to invalidate
124                              moveq     #FC_PURGE,d0        | change address space
125                              movc      d0,dfc              |   for destination
126                              moveq     #0,d0               | zero to invalidate?
127                              movsl     d0,a0@              | hit it
128                              moveq     #FC_USERD,d0        | back to old
129                              movc      d0,dfc              |   address space
130                              rts                           | done
131
132
133Invalidating the external cache:
134------------ --- -------- -----
135
136          Everything:
137                    Toggle the cache enable bit (bit 2) in the MMU control
138                    register (5F400C).  Can be done by ANDing and ORing the
139                    register location.
140
141          User:
142                    Change the user segment table pointer register (5F4004),
143                    i.e. read the current value and write it back.
144
145          Supervisor:
146                    Change the supervisor segment table pointer register
147                    (5F4000), i.e. read the current value and write it back.
148