Status Register (SR)

The MIPS CPU has remarkably few mode bits; those that exist are defined by fields in the CPU status register SR, as shown in Figure 3.2. We’ve shown fields for the “standard” R3000 and R4000 CPUs; other CPUs occasionally use other fields, sometimes alter the interpretation of fields, and commonly don’t implement all of the fields.

We emphasize again that there are no nontranslated or noncached modes in MIPS CPUs; all translation and caching decisions are made on the basis of the program address.

The fields that are shared by the R3000 and R4000 CPUs are provided by most MIPS CPUs.

R3000 (MIPS I) status register

R4000 (MIPS III) status register

31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

CU1 CU0 RP FR RE BEV TS PE CM PZ Swc IsC IM KX SX KUo IEo KUp IEp KUc IEc

31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

CU1 CU0 RE BEV TS PE CM PZ Swc IsC IM KUo IEo KUp IEp KUc IEc

Figure 3.2: Fields in status registerSR

Key Fields Common to R3000 and R4000 CPUs

Here are the critical shared fields; it would be very bad form for a new imple-mentation to recycle any of them for any purpose, and they are probably now nailed down for the foreseeable future.

CU1 Coprocessor 1 usable: 1 to use FPA if you have it, 0 to disable. When 0, all FPA instructions cause an exception. While it’s obviously a bad idea to enable FPA instructions if your CPU lacks FPA hardware, it can be useful to turn off an FPA even when you have one.¹

Bits 31 and 30 control the usability of coprocessors 3 and 2, respec-tively, and might be used by some MIPS CPUs that want to define more instructions. CP2 instructions may appear in some core implementa-tions.

BEV Boot exception vectors: When BEV == 1, the CPU uses the ROM (ksegl) space exception entry point (described in Section 5.3). BEV is usually set to 0 in running systems.

1Why turn off a perfectly good FPA? Some operating systems disable FP instructions for every new task; if the task attempts some floating point it will trap and the FPA will be enabled for that task. But now we can distinguish tasks that never use floating-point instructions, and when such a task is suspended and restored we don’t need to save or restore the FP registers; that may save some time in crucial context-saving code.

IM Interrupt mask: An 8-bit field defining which interrupt sources, when ac-tive, will be allowed to cause an exception. Six of the interrupt sources are generated by signals from outside the CPU core (one may be used by the FPA, which although it lives on the same chip is logically exter-nal); the other two are the software-writable interrupt bits in the Cause register.

The 32-bit CPUs with floating-point hardware use one of the CPU inter-rupts to signal floating-point exceptions; MIPS III and subsequent CPUs usually have an interval timer as part of the coprocessor 0 features, and timer events are signalled on the highest interrupt bit. Otherwise, interrupts are signalled from outside the CPU chip.

No interrupt prioritization is provided for you: The hardware treats all interrupt bits the same. See Section5.8 for details.

Less Obvious Shared Fields

These fields are obscure, generally unused, but scary to change and therefore universal to date.

CU0 Coprocessar 0 usable: Set 1 to be able to use some nominally privileged instructions in user mode. You don’t want to do this. The CPU control instructions encoded as coprocessor 0 type are always usable in kernel mode, regardless of the setting of this bit.

RE Reverse endianness in user mode: The MIPS processors can be config-ured, at reset time, with either endianness (see Section 11.6if you don’t know what that means). Since human beings are perverse, there are now two universes of MIPS implementation: DEC and Windows NT are little-endian; SGI and their UNIX world are big-endian. Embedded ap-plications originally showed a strong big-endian bias but are now thor-oughly mixed.

It could be a useful feature in an operating system to be able to run soft-ware from the opposite universe; the RE bit makes it possible. When RE is active, user-privilege software runs as if the CPU had been configured with the opposite endianness.

However, achieving cross-universe running would require a large soft-ware effort as well, and to date nobody has done it.

TS TLB shutdown: See Chapter6for details. TS gets set if a program address simultaneously matches two TLB entries, which is certainly a sign of something horribly wrong in the OS software. Prolonged operation in this state, in some implementations, could cause internal contention and damage to some chips, so the TLB ceases to match anything. TLB shutdown is terminal and can be cleared only by a hardware reset.

54

3.3. Encodings of Standard CPU Control Registers Some MIPS CPUs have foolproof TLB hardware and may not implement this bit.

On IDT R3051 family CPUs you can inspect this bit following hardware reset, and it will be set if and only if the CPU lacks a TLB (the memory management hardware). This test is not reliable across all implementa-tions.

R3000-Specific Fields in the Status Register: Everyday Use

SwC, IsC Swap caches and isolate (data) cache: These are cache mode bits for cache management and diagnostics; see Section 4.5 for details. In simple terms, when SR(IsC) is set, all loads and stores access only the data cache and never memory; in this mode a partial-word store invalidates the cache entry.

When SR(SwC) is set, the roles of the I-cache and the D-cache are re-versed so that you can access and invalidate I-cache entries.

KUc, IEc These are the two basic CPU protection bits.

KUcis set 1 when running with kernel privileges, 0 for user mode. In ker-nel mode you can get at the whole program address space and use priv-ileged (coprocessor 0) instructions. In user mode you are restricted to program addresses between zero and 0x7FFF FFFF and can’t run privi-leged instructions; attempts to break the rules result in an exception.

IEc is set 0 to prevent the CPU taking an interrupt, 1 to enable.

KUp, IEp KU previous, IE previous: On an exception, the hardware takes the values ofKUcandIEcand saves them here at the same time as changing the values of KUc, IEc to [1, 0] (kernel mode, interrupts disabled). The instruction rfe can be used to copyKUp, IEp back intoKUc,IEc.

KUo, IEo KU old, IE old: On an exception the KUp, IEp bits are saved here.

Effectively, the six KU/IE bits are operated as a three-deep, 2-bit-wide stack that is pushed on an exception and popped an rfe. The process is described in Chapter5 and illustrated in Figure 5.1.

This provides a chance to recover cleanly from an exception occuring so early in an exception-handling routine that the first exception has not yet saved SR. The circumstances in which this can be done are limited, and it is probably only really of use in allowing the user ThB refill code to be made a little shorter; see Section 6.7for more information.

Obscure R3000-only Bits

PE Set if a cache parity error has occurred. No exception is generated by this condition, which is really only useful for diagnostics. The MIPS

architecture has cache diagnostic facilities because earlier versions of the CPU used external caches, and signal timing on the cache buses was at the limits of technology For those implementations the cache parity error bit was an essential design debug tool.

For CPUs with on-chip caches, this feature is probably obsolete.

CM This shows the result of the last load operation performed with the D-cache isolated (see bit IsC of this register or Section 4.9.1to know more about what “isolated” means). CM is yet if the cache really contained data for the addressed memory location (i.e., if the load would have hit in the cache even if the cache had not been isolated).

PZ When set, cache parity bits are written as zero and not checked. This is a fossil from CPUs with external caches, where it allowed confident designers to dispense with the external memory that held the cache parity bits, saving a little money. You won’t use this if the CPU has on-chip caches.

Common SR Fields in R4x00 CPUs

Remember, these fields are in principle entirely CPU dependent; however, there’s been a lot of commonality in CPUs from MIPS III upward.

FR A mode switch: Set 1 to expose all 32 double-sized floating-point registers to software; set 0 to make them behave as they do on the R3000.

SR Soft reset occurred: MIPS CPUs offer several different grades of rest-distinguished by hardware signals. The field SR(SR) is clear follow-ing a hard reset (one where all operatfollow-ing parameters are reloaded from scratch) but set following a soft reset or NMI. In particular, the configu-ration register Configretains its values across a soft reset but must be reprogrammed after a hard reset.

DE Disable cache and system interface data checking: You may need to set this for some hardware systems that don’t provide parity on cache refills (though the hardware designer has the option of flagging data returning to the CPU as having no parity, which is probably a better approach).

You should also set it for CPUs that don’t implement cache parity.

UX, SX, KX These support a mix of R3000-compatible and expanded ad-dress spaces: There are separate bits for the three different privilege levels; when the appropriate one is set, the most common memory trans-lation exceptions (TLB misses) are redirected to a different entry point where the software will expect to deal with 64-bit addresses.

Also, when SR(vx) is zero the CPU won’t run 64-bit instructions from the MIPS III ISA in user mode.

56

3.3. Encodings of Standard CPU Control Registers KSU CPU privilege level: 0 for kernel, 1 for supervisor, 2 for user. Regardless of this setting, the CPU is in kernel mode whenever the EXL or ERL bits are set following an exception. The supervisor privilege level was introduced with the R4x00 but has never been used; see the sidebar for an explanation (or speculation) why.

ERL Error level: This gets set when the CPU takes a parity/ECC mis-check exception. This uses a separate bit because a correctable ECC error can happen anywhere — even in the most sensitive part of an ordinary exception routine — and if the system is aiming to patch up ECC errors and keep running, it must be able to fix them regardless of when they occur. That’s challenging, since the exception routine has no registers it can safely use; and with no registers to use as pointers, it can’t start saving register values.

To get us out of this hole, SR(ERL) has drastic effects; all access to normal user-space-translated addresses disappears, and program ad-dresses from 0 through 0x7FFF FFFF become uncached windows onto the same physical addresses. The intention is that the cache error ex-ception handler can use base+offset addressing off the zero register to get itself some memory space to save registers.

EXL Exception level: Set by any exception, this forces kernel mode and dis-ables interrupts; the intention is to keep EXL on for long enough for software to decide what the new CPU privilege level and interrupt mask is to be.

IE Global interrupt enable: Note that either ERL or EXL inhibit all interrupts, regardless.

Why Is There an Supervisor Mode?

The R3000 CPU offered only two privilege Lev-els, which are all that is required by most UNIX implementations and all that has ever been used in any MIPS OS. So why did the R4000’s designers go to considerable trouble to add a feature that has never been used?

In 1989-90 one of the biggest successes for MIPS was the use of the R3000 CPU in DEC’s DECstation product line and MIPS wanted the R4000 to be selected as DEC’s future work-station CPU. The competition was an in-house development that evolved into DEC’s Alpha architecture, but they were coming from hind; R4000 was usable about 18 months be-fore Alpha. Whichever CPU was chosen had to run not only UNIX but DEC’s minicomputer operating system VMS; apparently VMS archi-tects claimed that it wasn’t possible to imple-ment VMS on a system with only two privilege levels.

Alpha’s basic instruction set is almost identi-cal to MIPS’s; its biggest difference the at-tempt to do without any partial-wrord loads or stores, and newer Alpha instruction sets have regained those.

In the end, it appears that the VMS software team was decisive in choosing Alpha over the R4000 because of its insistence that certain differences in the instruction set and CPU con-trol architectures would make a VMS port to R4000 crucially slower. I am very skefr tical about this and put the choice down to NIH (not invented here). DEC was arobably right to believe that control over its microprocessor development was essential, but it’s interesting to speculate how things might have turned out differently if DEC had stayed on board with the R4000.

I also suspect that sales of VMS on Alpha have been negligible, but that’s another story.

CPU-Dependent Fields in R4x00 CPUs

RP Reduced power: Lowers the CPU’s operating frequency, usually by divid-ing it by 16. In many R4x00 CPUs this doesn’t work; even where it does, it requires that the CPU system interface be built to cope with it. Read the CPU manual, and talk to the system designer.

CH Cache hit indicator: Used for diagnostics only.

CE Cache error: This is only useful for diagnostics and recovery routines, and those should rely on information in the ECC register instead.