exception.s

RTEMS (Real-Time Executive for Multiprocessor Systems) is a free open source real-time operating sys

/*
 *  exception.S -- Exception handlers for early boot.
 *
 *  Copyright (C) 1998, 1999 Gabriel Paubert, [e-mail]
 *
 *  Modified to compile in RTEMS development environment
 *  by Eric Valette
 *
 *  Copyright (C) 1999 Eric Valette. [e-mail]
 *
 *  The license and distribution terms for this file may be
 *  found in found in the file LICENSE in this distribution or at
 *  http://www.rtems.com/license/LICENSE.
 *
 * $Id: exception.S,v 1.2.4.1 2003/09/04 18:45:20 joel Exp $
 */

/* This is an improved version of the TLB interrupt handling code from
 * the 603e users manual (603eUM.pdf) downloaded from the WWW. All the 
 * visible bugs have been removed. Note that many have survived in the errata 
 * to the 603 user manual (603UMer.pdf). 
 * 
 *  This code also pays particular attention to optimization, takes into
 * account the differences between 603 and 603e, single/multiple processor
 * systems and tries to order instructions for dual dispatch in many places.
 * 
 *  The optimization has been performed along two lines:
 * 1) to minimize the number of instruction cache lines needed for the most
 *    common execution paths (the ones that do not result in an exception).
 * 2) then to order the code to maximize the number of dual issue and 
 *    completion opportunities without increasing the number of cache lines 
 *    used in the same cases.
 *    	
 *  The last goal of this code is to fit inside the address range
 * assigned to the interrupt vectors: 192 instructions with fixed
 * entry points every 64 instructions.
 * 	
 *  Some typos have also been corrected and the Power l (lowercase L)
 * instructions replaced by lwz without comment.
 * 	
 *  I have attempted to describe the reasons of the order and of the choice
 * of the instructions but the comments may be hard to understand without
 * the processor manual.
 * 	
 *  Note that the fact that the TLB are reloaded by software in theory
 * allows tremendous flexibility, for example we could avoid setting the 
 * reference bit of the PTE which will could actually not be accessed because
 * of protection violation by changing a few lines of code. However, 
 * this would significantly slow down most TLB reload operations, and
 * this is the reason for which we try never to make checks which would be
 * redundant with hardware and usually indicate a bug in a program.
 * 
 *  There are some inconsistencies in the documentation concerning the
 * settings of SRR1 bit 15. All recent documentations say now that it is set 
 * for stores and cleared for loads. Anyway this handler never uses this bit.
 * 	
 *  A final remark, the rfi instruction seems to implicitly clear the
 * MSR<14> (tgpr)bit. The documentation claims that this bit is restored
 * from SRR1 by rfi, but the corresponding bit in SRR1 is the LRU way bit.
 * Anyway, the only exception which can occur while TGPR is set is a machine
 * check which would indicate an unrecoverable problem. Recent documentation
 * now says in some place that rfi clears MSR<14>.	 
 * 	
 *  TLB software load for 602/603/603e/603ev:	 
 *    Specific Instructions: 
 *      tlbld - write the dtlb with the pte in rpa reg 
 *      tlbli - write the itlb with the pte in rpa reg 
 *    Specific SPRs:	 
 *      dmiss - address of dstream miss 
 *      imiss - address of istream miss
 *      hash1 - address primary hash PTEG address 
 *      hash2 - returns secondary hash PTEG address 
 *      iCmp - returns the primary istream compare value 
 *      dCmp - returns the primary dstream compare value 
 *      rpa - the second word of pte used by tlblx
 *    Other specific resources:	
 *      cr0 saved in 4 high order bits of SRR1,
 *      SRR1 bit 14 [WAY] selects TLB set to load from LRU algorithm	
 *      gprs r0..r3 shadowed by the setting of MSR bit 14 [TGPR] 
 *      other bits in SRR1 (unused by this handler but see earlier comments)
 * 
 *    There are three basic flows corresponding to three vectors:
 *      0x1000: Instruction TLB miss, 	
 *      0x1100: Data TLB miss on load,
 *      0x1200: Data TLB miss on store or not dirty page	 	
 */
	
/* define the following if code does not have to run on basic 603 */
/* #define USE_KEY_BIT */
	
/* define the following for safe multiprocessing */
/* #define MULTIPROCESSING */	

/* define the following for mixed endian */
/* #define CHECK_MIXED_ENDIAN */

/* define the following if entries always have the reference bit set */
#define ASSUME_REF_SET

/* Some OS kernels may want to keep a single copy of the dirty bit in a per
 * page table. In this case writable pages are always write-protected as long
 * as they are clean, and the dirty bit set actually means that the page
 * is writable. 
 */
#define DIRTY_MEANS_WRITABLE 	
	
#include <asm.h>
#include <rtems/score/cpu.h>
#include "bootldr.h"

/* 
 * Instruction TLB miss flow 
 *   Entry at 0x1000 with the following:	 
 *     srr0 -> address of instruction that missed 
 *     srr1 -> 0:3=cr0, 13=1 (instruction), 14=lru way, 16:31=saved MSR 
 *     msr<tgpr> -> 1 
 *     iMiss -> ea that missed 
 *     iCmp -> the compare value for the va that missed 
 *     hash1 -> pointer to first hash pteg
 *     hash2 -> pointer to second hash pteg 
 *
 *   Register usage: 
 *     r0 is limit address during search / scratch after 
 *     r1 is pte data / error code for ISI exception when search fails
 *     r2 is pointer to pte 
 *     r3 is compare value during search / scratch after
 */
/* Binutils or assembler bug ? Declaring the section executable and writable
 * generates an error message on the @fixup entries.
 */
	.section .exception,"aw"	
#	.org    0x1000        # instruction TLB miss entry point
	.globl	tlb_handlers
tlb_handlers:
	.type	tlb_handlers,@function
#define ISIVec tlb_handlers-0x1000+0x400
#define DSIVec tlb_handlers-0x1000+0x300
	mfspr   r2,HASH1      
	lwz     r1,0(r2)      # Start memory access as soon as possible
	mfspr   r3,ICMP       # to load the cache.  
0:	la      r0,48(r2)     # Use explicit loop to avoid using ctr
1:	cmpw    r1,r3         # In theory the loop is somewhat slower
	beq-    2f            # than documentation example
	cmpw    r0,r2         # but we gain from starting cache load 
	lwzu    r1,8(r2)      # earlier and using slots between load 
	bne+    1b            # and comparison for other purposes.  
	cmpw    r1,r3
	bne-    4f            # Secondary hash check
2:	lwz     r1,4(r2)      # Found:	load second word of PTE 
	mfspr   r0,IMISS      # get miss address during load delay
#ifdef ASSUME_REF_SET
	andi.	r3,r1,8       # check for guarded memory
	bne-	5f
	mtspr	RPA,r1
	mfsrr1	r3
	tlbli	r0
#else
/* This is basically the original code from the manual. */
#	andi.   r3,r1,8       # check for guarded memory
#	bne-    5f
#	andi.   r3,r1,0x100   # check R bit ahead to help folding
/* However there is a better solution: these last three instructions can be 
replaced by the following which should cause less pipeline stalls because 
both tests are combined and there is a single CR rename buffer */
	extlwi  r3,r1,6,23    # Keep only RCWIMG in 6 most significant bits.
	rlwinm. r3,r3,5,0,27  # Keep only G (in sign) and R and test.  
	blt-    5f            # Negative means guarded, zero R not set.   
	mfsrr1  r3            # get saved cr0 bits now to dual issue
	ori     r1,r1,0x100
	mtspr   RPA,r1
	tlbli   r0
/* Do not update PTE if R bit already set, this will save one cache line
writeback at a later time, and avoid even more bus traffic in
multiprocessing systems, when several processors access the same PTEGs.
We also hope that the reference bit will be already set. */
	bne+    3f
#ifdef MULTIPROCESSING	
	srwi    r1,r1,8       # get byte 7 of pte
	stb     r1,+6(r2)     # update page table
#else
	sth     r1,+6(r2)     # update page table
#endif
#endif
3:	mtcrf   0x80,r3       # restore CR0
	rfi                   # return to executing program
	      
/* The preceding code is 20 to 25 instructions long, which occupies
3 or 4 cache lines. */
4:	andi.   r0,r3,0x0040  # see if we have done second hash
	lis     r1,0x4000     # set up error code in case next branch taken
	bne-    6f            # speculatively issue the following
	mfspr   r2,HASH2      # get the second pointer
	ori     r3,r3,0x0040  # change the compare value
	lwz     r1,0(r2)      # load first entry
	b       0b            # and go back to main loop
/* We are now at 27 to 32 instructions, using 3 or 4 cache lines for all
cases in which the TLB is successfully loaded. */ 

/* Guarded memory protection violation: synthesize an ISI exception. */ 
5:	lis     r1,0x1000     # set srr1<3>=1 to flag guard violation
/* Entry Not Found branches here with r1 correctly set. */
6:	mfsrr1  r3
	mfmsr   r0
	insrwi  r1,r3,16,16   # build srr1 for ISI exception
	mtsrr1  r1            # set srr1
/* It seems few people have realized rlwinm can be used to clear a bit or
a field of contiguous bits in a register by setting mask_begin>mask_end. */
	rlwinm  r0,r0,0,15,13 # clear the msr<tgpr> bit
	mtcrf   0x80, r3      # restore CR0
	mtmsr   r0            # flip back to the native gprs
	isync                 # Required from 602 doc!
	b       ISIVec        # go to instruction access exception 
/* Up to now there are 37 to 42 instructions so at least 20 could be 
inserted for complex cases or for statistics recording. */ 


/* 
  Data TLB miss on load flow 
    Entry at 0x1100 with the following:	 
      srr0 -> address of instruction that caused the miss 
      srr1 -> 0:3=cr0, 13=0 (data), 14=lru way, 15=0, 16:31=saved MSR 
      msr<tgpr> -> 1 
      dMiss -> ea that missed 
      dCmp -> the compare value for the va that missed 
      hash1 -> pointer to first hash pteg
      hash2 -> pointer to second hash pteg 
 
    Register usage: 
      r0 is limit address during search / scratch after 
      r1 is pte data / error code for DSI exception when search fails
      r2 is pointer to pte 
      r3 is compare value during search / scratch after
*/
	.org	tlb_handlers+0x100  
	mfspr   r2,HASH1      
	lwz     r1,0(r2)      # Start memory access as soon as possible
	mfspr   r3,DCMP       # to load the cache.