PowerPC 74xx Architecture
32-Bit Addressing Modes
Porting Plan 9 to the PowerPC 74xx Architecture
Adam Wolbach
awolbach@[Link]
15-412 Operating Systems Practicum
Abbreviations
Memory
EA Effective Address (32-bit)
VA Virtual Address (52-bit)
RA Real Address (32-bit)
MSR Machine State Register
SDR1 Storage Description Register 1
Base Mathematics
0xFFFF FFFF in Base 16/Hexadecimal
0b1111 1111 in Base 2/Binary
Arithmetic
X || Y Concatenate X with Y
X&Y X (bitwise AND) Y
X | Y X (bitwise OR) Y
X^Y X (bitwise eXclusive OR) Y
~X bitwise NOT X (complement)
YX Repeat bit X, Y times (e.g., 30 = 000) 2
Register Abbreviations
Size of Field
ABCXX Denotes
4 XX bit 16 12
of register ABC Field Name
0 3 4 19 20 31
Bit Index
3
Addressing Overview
Three primary mechanisms
Real Addressing Mode
Block Address Translation (BAT)
Segmented Address Translation (SAT)
Ordinary Segment Translation
Direct-Store Segment Translation
MSRIR value controls instruction fetches
MSRDR value controls data accesses
4
Machine State Register (32-Bit)
P I F F
SF
/// O
W
/ L EE PR FPME E SE BE E
E 0 1
/ IP IR DR // RI LE
0 1 12 13 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
/ = Reserved
Controls many important system flags
EE[16]: External Enable (Interrupts)
If set, external interruption allowed (e.g. Keyboard, “Timer” )
PR[17]: Problem State (User Mode)
If set, processor can only execute non-privileged instructions
IR[26]/DR[27]: Instruction Relocate/Data Relocate
If set, Instruction/Data address translation mechanisms on
RI[28]: Recoverable Interrupt
If set, a resume to regular execution possible 5
Real Addressing Mode
EA == RA to the processor
Bypasses all storage protection checks/translation
MSRIR = 0 results in real addressing mode for
instruction fetches (only type of access)
MSRDR = 0 results in real addressing mode for
any data accesses, read or write
MSRIR and MSRDR can exist in any
combination of settings
6
Block Address Translation
Method of directly mapping large virtual address
spaces to contiguous real memory addresses
Length must be a power of 2, from 217 to 228
Controlled by a mask field in the upper register
Block Length = 217 + (# of bits in mask set)
Alignment must occur on a multiple of its length
Defined by 8 CPU special-purpose register pairs
4 IBAT (Instruction), 4 DBAT (Data)
Each pair consists of upper and lower register
Enabled if MSRIR and/or MSRDR = 1
Great for memory-mapping
Display buffer, kernel memory, etc. 7
BAT Register Pair
Upper
BEPI /// BL Vs V p
0 14 15 18 19 29 30 31
BRPN /// WIMG / PP
0 14 15 24 25 28 29 30 31
BEPI Block Effective Page Index Lower
BL Block-length Mask
e.g., 0x003 = 217+2=19 (512 KB)
BRPN Block Real Page Number
PP Protection bits for BAT area
00 = No Access, x1 = Read Only, 10 = Read/Write
Vs Supervisor state valid bit -- allows root access
Vp Problem state valid bit -- allows user access
WIMG Storage Access Controls 8
BAT Register Validation
BAT register valid if these conditions hold:
MSRIR | MSRDR = 1
(Vs & ~MSRPR) | (Vp & MSRPR) = 1
Cannot overlap any other register’s EA range
Unless they cannot be valid at the same time, as per the
relation above
Translation effects undefined, and probably horrendous, if
conflicting memory state exists
Page Fault Interrupt on PP R/W permissions fail
9
BAT Translation Method
4 11 17
32-bit EA 0 3 4
Page Index
14 15
Offset
31
~BL
AND
15 17
BEPI match Offset
15
BRPN
0 || (EA4:14 & BL)
3
OR
15 17
32-bit RA 0
Real Page || Offset
3 4 14 15
Offset
31
10
BAT Lookup
Registers not indexed by bits, but rather
searched sequentially by access type
Address match (EA covered by BAT) if:
EA0:3 || (EA4:14 & ~BL) = BEPI
15 bits [0-14] needed at most to determine block
starting address because minimum BAT size is 217
4 highest order bits not needed in masking
because blocks cannot be this large
BRPN then OR’d with [ 30 || (EA4:14 & BL) ]
to get remaining page bits from EA
Offset (EA15:31) added, untouched
11
Example – Data Access
12
Segmented Address Translation
Storage divided into 256 MB (228)
segments, of ordinary or direct-store type
Ordinary segments controlled by setting of
relocate bits MSRIR and MSRDR
Used as storage protection
Direct-store segments used for access to I/O
EA sent to device with key check modification
MSRDR must be set
Segments defined by 16 register “table”
13
Segment Register (Ordinary)
T Ks Kp /// VSID
0 1 2 8 31
T = 0, Direct Store off
Ks Supervisor state storage key
(allows supervisor access)
Kp Problem state storage key
(allows user access)
VSID Virtual Segment ID (24-bit)
14
Segment Register (Direct-Store)
T Ks Kp BUID controller specific
0 1 2 3 12 31
T = 1, Direct Store on
Ks Supervisor state storage key
Kp Problem state storage key
BUID Bus Unit ID
cs Device dependent data for I/O
15
Segment EA to RA Translation
4 16 12
32-bit EA SR Byte
0 4 19 20 31
Identify
Segment
Register
Page Index
52-bit VA 24 16 12
Virtual Segment ID API Page Remainder Byte
Key
Hashed
Page Table
20 12
32-bit RA 0
Real Page Number
19 20
Byte
31
16
Hashed Page Table
Variable-sized data structure that hashes between
virtual page numbers and real page numbers
Must be aligned on its 2n size, where 16 ≤ n ≤ 25
Contains 2n-6 64-byte Page Table Entry Groups
Each PTEG has 8 PTE entries, each 8 bytes long
Important to balance: Size of PT and Page Fault Rate
Exists in main memory
RA and size defined by Storage Description Register 1
n, and thus the number of PTEG’s, controlled by OS
Architecture neutral as to # of PT’s allowed
17
Storage Description Register 1 (32-Bit)
HTABORG /// HTABMASK
0 15 23 31
HTABORG[0-15] Real Address of Page Table
(Aligned on 216 byte boundary,
meaning minimum size is 64KB)
HTABMASK[23-31] Mask for Page Table Address
(e.g., 0x007 strips 3 bits off of
the hash to allow for 210+3 PTEGs)
18
Hashing VA’s to RA’s
Key indexed by (VSID derived from segment
register || EA Page Index)
40-bitkey hashes to 20-bit Real Page Number
High-order 6 bits of EA Page Index referred to as
Abbreviated Page Index, stored in PTE
API resolves issues with hash function using less than all 16
bits of the page index by comparing the PTE’s API with the
EA’s API, which are the bits potentially not used in the hash
If the primary hashing of the key fails, a
secondary hash is attempted using the
complement of the original key as its key
If that fails, a Page Fault Interrupt is taken
19
Page Table Entry
V VSID H API
0 1 24 25 26 31
RPN /// R C WIMG / PP
0 19 23 24 25 28 29 30 31
API Abbreviated Page Index (PTE Collision Disambiguation)
C Change Bit
H Primary / Secondary Hash
PP Page Protection Bits
(00 = No Access, x1 = Read Only, 10 = Read/Write)
R Reference Bit
RPN Real Page Number
V Valid Bit
VSID Virtual Segment ID (PTE Collision Disambiguation)
WIMG Storage Access Control (Cache Control)
20
Hashing VA (Primary)
1) Perform following computation on parameters:
VSID5:23 ^ (30 || EA4:19 )
Denote this as N
Note that EA4:19 = 16-bit Page Index
2) Create following address through concatenations:
SDR10:6 || [ (N0:8 & SDR123:31) | SDR17:15 ] || N9:18 || 60
Note that, at minimum, 10 lower-order bits of N/Page Index
identify a unique PTEG
3) This identifies a PTEG. Test PTE’s inside of it for:
PTEH = 0
PTEv = 1
PTEVSID = VA0:23
PTEAPI = VA24:29
4) If PTE found build Real Address, else proceed to
Secondary Hash 21
Hashing VA (Secondary)
1) Perform following computation on parameters:
~(VSID5:23 ^ (30 || EA4:19 ))
Denote this as N
Note that EA4:19 = 16-bit Page Index
2) Create following address through concatenations:
SDR10:6 || [ (N0:8 & SDR123:31) | SDR17:15 ] || N9:18 || 60
Note that, at minimum, 10 lower-order bits of N/Page Index
identify a unique PTEG
3) This identifies a PTEG. Test PTE’s inside of it for:
PTEH = 1
PTEv = 1
PTEVSID = VA0:23
PTEAPI = VA24:29
4) If PTE found build Real Address, else proceed to
Secondary Hash
5) Else, a Page Fault Interrupt is issued, OS must deal 22
Forming RA
If the Page Table search succeeds, the
RA is formed by concatenating the RPN
from the PTE with bits 20:31 of the
Effective Address (the “Byte”/offset)
Failure results in Page Fault Interrupt of
the access type
Instruction
Storage Interrupt
Data Storage Interrupt
23
Example – Data Access
24
A Note on Storage Control
WIMG bits in BAT registers / PTE’s
W – Write-through
Stores updates to cache to home storage location
I – Caching Inhibited
Ignores on-board caches
M – Memory Coherence
Forces hardware data coherence, allowing improved
performance in systems in which accesses to storage kept
consistent by hardware are slower than accesses to storage not
kept consistent, assuming software can enforce the required
consistency. If set, hardware must enforce data coherence.
Paraphrased from The PowerPC Architecture
G – Guarded Memory
If set, prevents speculative execution (prefetching)
Not applicable to Instruction BAT entries 25
Which does the processor use?
Segment Registers and BAT Registers
accessed in parallel, with BAT taking
precedence if both translations found valid
If neither lookup is found to be valid, a
Page Fault Interrupt is generated and the
OS must deal with the problem
26
Sources
The PowerPC Architecture: A Specification For a New Family of
RISC Processors, Morgan Kaufmann Publishers, San Francisco,
1994
27