 |
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
| Datasheet File OCR Text: |
| G2CORERM/d 6/2003 rev. 1 g2 powerpc? core reference manual f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . .
how to reach us: usa/europe/locations not listed: motorola literature distribution p.o. box 5405, denver, colorado 80217 1-480-768-2130 (800) 521-6274 japan: motorola japan ltd. sps, technical information center 3-20-1, minami-azabu minato-ku tokyo 106-8573 japan 81-3-3440-3569 asia/pacific: motorola semiconductors h.k. ltd. silicon harbour centre, 2 dai king street tai po industrial estate, tai po, n.t., hong kong 852-26668334 technical information center: (800) 521-6274 home page: www.motorola.com/semiconductors motorola and the stylized m logo are registered in the u.s. patent and trademark office. digital dna is a trademark of motorola, inc. the described product is a powerpc microprocessor. the powerpc name is a trademark of ibm corp. and used under license. ll other product or service names are the property of their respective owners. motorola, inc. is an equal opportunity/affirmative action employer. ? motorola, inc. 2003 information in this document is provided solely to enable system and software implementers to use motorola products. there are no express or implied copyright licenses granted hereunder to design or fabricate any integrated circuits or integrated circuits based on the information in this document. motorola reserves the right to make changes without further notice to any products herein. motorola makes no warranty, representation or guarantee regarding the suitability of its products for any particular purpose, nor does motorola assume any liability arising out of the application or use of any product or circuit, and specifically disclaims any and all liability, including without limitation consequential or incidental damages. ?typical? parameters which may be provided in motorola data sheets and/or specifications can and do vary in different applications and actual performance may vary over time. all operating parameters, including ?typicals? must be validated for each customer application by customer?s technical experts. motorola does not convey any license under its patent rights nor the rights of others. motorola products are not designed, intended, or authorized for use as components in systems intended for surgical implant into the body, or other applications intended to support or sustain life, or for any other application in which the failure of the motorola product could create a situation where personal injury or death may occur. should buyer purchase or use motorola products for any such unintended or unauthorized application, buyer shall indemnify and hold motorola and its officers, employees, subsidiaries, affiliates, and distributors harmless against all claims, costs, damages, and expenses, and reasonable attorney fees arising out of, directly or indirectly, any claim of personal injury or death associated with such unintended or unauthorized use, even if such claim alleges that motorola was negligent regarding the design or manufacture of the part. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . register model instruction set model instruction and data cache operation exceptions memory management signal descriptions power management instruction timing revision history index powerpc instruction set listings glo ind a glossary of terms and abbreviations 1 2 3 5 6 7 8 9 4 10 11 debug features core interface operation b overview f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . overview register model instruction set model instruction and data cache operation exceptions memory management signal descriptions power management instruction timing revision history index powerpc instruction set listings glo ind a glossary of terms and abbreviations 1 2 3 4 5 6 7 8 9 4 10 11 debug features core interface operation b overview f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents section number title page number motorola contents v contents paragraph number title page number contents about this book audience .......................................................................................................... xxxiii organization..................................................................................................... xxxiii suggested reading........................................................................................... xxxiv general information..................................................................................... xxxiv related documentation..................................................................................xxxv conventions .......................................................................................................xxxv acronyms and abbreviations .......................................................................... xxxvi terminology conventions..................................................................................... xli chapter 1 overview 1.1 overview.............................................................................................................. 1-1 1.1.1 features ........................................................................................................... 1-3 1.1.2 g2_le-specific features................................................................................. 1-6 1.1.2.1 true little-endian mode ............................................................................. 1-7 1.1.2.2 critical interrupt .......................................................................................... 1-7 1.1.2.3 other new signals....................................................................................... 1-7 1.1.2.4 additional supervisor-level sprs.............................................................. 1-8 1.1.3 instruction unit ................................................................................................ 1-8 1.1.3.1 instruction queue and dispatch unit .......................................................... 1-8 1.1.3.2 branch processing unit (bpu).................................................................... 1-9 1.1.4 independent execution units........................................................................... 1-9 1.1.4.1 integer unit (iu) .......................................................................................... 1-9 1.1.4.2 floating-point unit (fpu) ........................................................................... 1-9 1.1.4.3 load/store unit (lsu) .............................................................................. 1-10 1.1.4.4 system register unit (sru)...................................................................... 1-10 1.1.5 completion unit ............................................................................................ 1-10 1.1.6 memory subsystem support.......................................................................... 1-11 1.1.6.1 memory management units (mmus)....................................................... 1-11 1.1.6.2 cache units................................................................................................ 1-12 1.1.7 core interface ................................................................................................ 1-13 1.1.8 system support functions ............................................................................. 1-13 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number vi g2 powerpc core reference manual motorola 1.1.8.1 power management ................................................................................... 1-14 1.1.8.2 time base/decrementer ............................................................................ 1-14 1.1.8.3 ieee 1149.1 (jtag)/cop test interface .................................................. 1-15 1.1.8.4 clock multiplier......................................................................................... 1-15 1.2 powerpc architecture implementation ............................................................. 1-15 1.3 implementation-specific information................................................................ 1-16 1.3.1 register model............................................................................................... 1-17 1.3.1.1 general-purpose registers (gprs)............................................................ 1-17 1.3.1.2 floating-point registers (fprs) ................................................................ 1-17 1.3.1.3 condition register (cr) ............................................................................ 1-19 1.3.1.4 floating-point status and control register (fpscr) ............................... 1-19 1.3.1.5 machine state register (msr) .................................................................. 1-19 1.3.1.6 segment registers (srs) ........................................................................... 1-19 1.3.1.7 special-purpose registers (sprs) ............................................................. 1-19 1.3.1.7.1 user-level sprs.................................................................................... 1-20 1.3.1.7.2 supervisor-level sprs.......................................................................... 1-20 1.3.2 instruction set and addressing modes .......................................................... 1-22 1.3.2.1 powerpc instruction set and addressing modes...................................... 1-22 1.3.2.2 implementation-specific instruction set ................................................... 1-24 1.3.3 cache implementation ................................................................................... 1-24 1.3.3.1 powerpc cache characteristics ................................................................ 1-24 1.3.3.2 implementation-specific cache implementation ...................................... 1-25 1.3.3.3 instruction and data cache way-locking................................................. 1-26 1.3.4 exception model............................................................................................ 1-26 1.3.4.1 powerpc exception model........................................................................ 1-26 1.3.4.2 implementation-specific exception model............................................... 1-28 1.3.5 memory management.................................................................................... 1-31 1.3.5.1 powerpc memory management................................................................ 1-31 1.3.5.2 implementation-specific memory management....................................... 1-31 1.3.6 instruction timing ......................................................................................... 1-32 1.3.7 system interface ............................................................................................ 1-34 1.3.7.1 memory accesses ...................................................................................... 1-35 1.3.7.2 signals........................................................................................................ 1-35 1.3.8 debug features (g2_le only)...................................................................... 1-37 1.3.8.1 instruction address breakpoint registers (iabr and iabr2)................. 1-37 1.3.8.2 data address breakpoint registers (dabr and dabr2) ....................... 1-38 1.3.8.3 breakpoint signaling ................................................................................. 1-38 1.3.8.4 other debug resources ............................................................................. 1-38 1.4 differences between the mpc603e and the g2 and g2_le cores .................. 1-39 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number motorola contents vii chapter 2 register model 2.1 register set .......................................................................................................... 2-1 2.1.1 powerpc register set...................................................................................... 2-1 2.1.2 implementation-specific registers.................................................................. 2-9 2.1.2.1 hardware implementation register 0 (hid0) ........................................... 2-10 2.1.2.2 hardware implementation register 1 (hid1) ........................................... 2-14 2.1.2.3 hardware implementation register 2 (hid2) ........................................... 2-14 2.1.2.4 data and instruction tlb miss address registers (dmiss and imiss) .............................................................................. 2-16 2.1.2.5 data and instruction tlb compare registers (dcmp and icmp)................................................................................ 2-16 2.1.2.6 primary and secondary hash address registers (hash1 and hash2) ........................................................................... 2-17 2.1.2.7 required physical address register (rpa)............................................... 2-17 2.1.2.8 bat registers (bat4?bat7)?g2_le only .......................................... 2-18 2.1.2.9 critical interrupt save/restore register 0 (csrr0)?g2_le only ........ 2-19 2.1.2.10 critical interrupt save/restore register 1 (csrr1)?g2_le only ........ 2-19 2.1.2.11 sprg4?sprg7 (g2_le only)................................................................. 2-20 2.1.2.12 system version register (svr)?g2_le only........................................ 2-20 2.1.2.13 system memory base address (mbar)?g2_le only.......................... 2-20 2.1.2.14 instruction address breakpoint registers (iabr and iabr2)................. 2-21 2.1.2.14.1 instruction address breakpoint control registers (ibcr)? g2_le only ...................................................................................... 2-21 2.1.2.15 data address breakpoint register (dabr and dabr2)? g2_le only .......................................................................................... 2-22 2.1.2.15.1 data address breakpoint control registers (dbcr)? g2_le-only ...................................................................................... 2-24 chapter 3 instruction set model 3.1 operand conventions .......................................................................................... 3-1 3.1.1 data organization in memory and memory operands ................................... 3-1 3.1.2 endian modes and byte ordering ................................................................... 3-1 3.1.3 alignment and misaligned accesses............................................................... 3-2 3.1.4 floating-point execution model...................................................................... 3-3 3.1.5 effect of operand placement on performance ................................................ 3-4 3.2 instruction set summary ..................................................................................... 3-5 3.2.1 classes of instructions ..................................................................................... 3-6 3.2.1.1 definition of boundedly undefined ............................................................ 3-6 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number viii g2 powerpc core reference manual motorola 3.2.1.2 defined instruction class ............................................................................ 3-7 3.2.1.3 illegal instruction class ............................................................................... 3-7 3.2.1.4 reserved instruction class .......................................................................... 3-8 3.2.2 addressing modes ........................................................................................... 3-8 3.2.2.1 memory addressing .................................................................................... 3-8 3.2.2.2 memory operands ....................................................................................... 3-9 3.2.2.3 effective address calculation ..................................................................... 3-9 3.2.2.4 synchronization ........................................................................................ 3-10 3.2.2.4.1 context synchronization ....................................................................... 3-10 3.2.2.4.2 execution synchronization.................................................................... 3-10 3.2.2.4.3 instruction-related exceptions ............................................................. 3-10 3.2.3 instruction set overview ............................................................................... 3-11 3.2.4 powerpc uisa instructions .......................................................................... 3-11 3.2.4.1 integer instructions .................................................................................... 3-12 3.2.4.1.1 integer arithmetic instructions.............................................................. 3-12 3.2.4.1.2 integer compare instructions ................................................................ 3-13 3.2.4.1.3 integer logical instructions................................................................... 3-13 3.2.4.1.4 integer rotate and shift instructions ..................................................... 3-14 3.2.4.2 floating-point instructions ........................................................................ 3-15 3.2.4.2.1 floating-point arithmetic instructions.................................................. 3-16 3.2.4.2.2 floating-point multiply-add instructions ............................................. 3-16 3.2.4.2.3 floating-point rounding and conversion instructions ......................... 3-17 3.2.4.2.4 floating-point compare instructions..................................................... 3-17 3.2.4.2.5 floating-point status and control register instructions ....................... 3-18 3.2.4.2.6 floating-point move instructions.......................................................... 3-18 3.2.4.3 load and store instructions ....................................................................... 3-19 3.2.4.3.1 self-modifying code ............................................................................ 3-19 3.2.4.3.2 integer load and store address generation.......................................... 3-19 3.2.4.3.3 register indirect integer load instructions ........................................... 3-20 3.2.4.3.4 integer store instructions....................................................................... 3-20 3.2.4.3.5 integer load and store with byte-reverse instructions........................ 3-21 3.2.4.3.6 integer load and store multiple instructions........................................ 3-22 3.2.4.3.7 integer load and store string instructions ............................................ 3-23 3.2.4.3.8 floating-point load and store address generation.............................. 3-24 3.2.4.3.9 floating-point load instructions ........................................................... 3-24 3.2.4.3.10 floating-point store instructions........................................................... 3-25 3.2.4.4 branch and flow control instructions....................................................... 3-25 3.2.4.4.1 branch instruction address calculation................................................ 3-26 3.2.4.4.2 branch instructions................................................................................ 3-26 3.2.4.4.3 condition register logical instructions................................................ 3-27 3.2.4.5 trap instructions ........................................................................................ 3-27 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number motorola contents ix 3.2.4.6 processor control instructions................................................................... 3-28 3.2.4.6.1 move to/from condition register instructions.................................... 3-28 3.2.4.7 memory synchronization instructions?uisa ......................................... 3-28 3.2.5 powerpc vea instructions ........................................................................... 3-30 3.2.5.1 processor control instructions................................................................... 3-30 3.2.5.2 memory synchronization instructions?vea .......................................... 3-30 3.2.5.3 memory control instructions?vea ........................................................ 3-31 3.2.5.4 external control instructions..................................................................... 3-32 3.2.6 powerpc oea instructions ........................................................................... 3-32 3.2.6.1 system linkage instructions...................................................................... 3-33 3.2.6.2 processor control instructions?oea ...................................................... 3-33 3.2.6.2.1 move to/from machine state register instructions............................. 3-33 3.2.6.2.2 move to/from special-purpose register instructions.......................... 3-33 3.2.6.3 memory control instructions?oea ........................................................ 3-35 3.2.6.3.1 supervisor-level cache management instruction ................................ 3-36 3.2.6.3.2 segment register manipulation instructions ........................................ 3-36 3.2.6.3.3 translation lookaside buffer management instructions ...................... 3-36 3.2.7 recommended simplified mnemonics.......................................................... 3-37 3.2.8 implementation-specific instructions............................................................ 3-37 chapter 4 instruction and data cache operation 4.1 overview.............................................................................................................. 4-1 4.2 instruction cache organization and control ....................................................... 4-3 4.2.1 instruction cache organization ....................................................................... 4-3 4.2.2 instruction cache fill operations .................................................................... 4-4 4.2.3 instruction cache control................................................................................ 4-4 4.2.3.1 instruction cache invalidation..................................................................... 4-4 4.2.3.2 instruction cache disabling ........................................................................ 4-5 4.2.3.3 instruction cache locking........................................................................... 4-5 4.3 data cache organization and control ................................................................. 4-5 4.3.1 data cache organization ................................................................................. 4-5 4.3.2 data cache fill operations.............................................................................. 4-6 4.3.3 data cache control.......................................................................................... 4-6 4.3.3.1 data cache invalidation .............................................................................. 4-6 4.3.3.2 data cache disabling .................................................................................. 4-7 4.3.3.3 data cache locking .................................................................................... 4-7 4.3.3.4 data cache operations and address broadcasts......................................... 4-7 4.3.4 data cache touch load support ..................................................................... 4-8 4.4 basic data cache operations .............................................................................. 4-8 4.4.1 data cache fill ................................................................................................ 4-8 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number x g2 powerpc core reference manual motorola 4.4.2 data cache cast-out operation ...................................................................... 4-9 4.4.3 cache block push operation ........................................................................... 4-9 4.5 data cache transactions on bus ......................................................................... 4-9 4.5.1 single-beat transactions ................................................................................. 4-9 4.5.2 burst transactions ........................................................................................... 4-9 4.5.3 access to direct-store segments................................................................... 4-10 4.6 memory management/cache access mode bits?w, i, m, and g................... 4-10 4.6.1 write-through attribute (w) ........................................................................ 4-11 4.6.2 caching-inhibited attribute (i)...................................................................... 4-12 4.6.3 memory coherency attribute (m)................................................................. 4-12 4.6.4 guarded attribute (g).................................................................................... 4-13 4.6.5 w, i, and m bit combinations ....................................................................... 4-13 4.6.5.1 out-of-order execution and guarded memory ........................................ 4-14 4.6.5.2 effects of out-of-order data accesses ..................................................... 4-14 4.6.5.3 effects of out-of-order instruction fetches.............................................. 4-15 4.7 cache coherency?mei protocol ..................................................................... 4-15 4.7.1 mei state definitions .................................................................................... 4-16 4.7.2 mei state diagram ........................................................................................ 4-16 4.7.3 mei hardware considerations ...................................................................... 4-17 4.7.4 coherency precautions .................................................................................. 4-19 4.7.4.1 coherency in single-processor systems ................................................... 4-19 4.7.5 load and store coherency summary ............................................................ 4-19 4.7.6 atomic memory references.......................................................................... 4-20 4.7.7 cache reaction to specific bus operations .................................................. 4-20 4.7.8 operations causing core_artry assertion ...................................................... 4-21 4.7.9 enveloped high-priority cache block push operation ................................ 4-22 4.8 cache control instructions ................................................................................ 4-22 4.8.1 data cache block invalidate ( dcbi ) instruction ............................................ 4-24 4.8.2 data cache block touch ( dcbt ) instruction.................................................. 4-24 4.8.3 data cache block touch for store ( dcbtst ) instruction................................ 4-24 4.8.4 data cache block clear to zero ( dcbz ) instruction ...................................... 4-24 4.8.5 data cache block store ( dcbst ) instruction.................................................. 4-25 4.8.6 data cache block flush ( dcbf ) instruction................................................... 4-25 4.8.7 enforce in-order execution of i/o ( eieio ) instruction .................................. 4-26 4.8.8 instruction cache block invalidate ( icbi ) instruction ................................... 4-26 4.8.9 instruction synchronize ( isync ) instruction .................................................. 4-26 4.9 system bus interface and cache instructions.................................................... 4-26 4.10 bus interface ...................................................................................................... 4-27 4.11 mei state transactions ...................................................................................... 4-29 4.12 cache locking ................................................................................................... 4-31 4.12.1 cache locking terminology ......................................................................... 4-32 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number motorola contents xi 4.12.2 cache locking register summary ................................................................ 4-32 4.12.3 performing cache locking............................................................................ 4-33 4.12.3.1 data cache locking .................................................................................. 4-34 4.12.3.1.1 enabling the data cache ....................................................................... 4-34 4.12.3.1.2 address translation for data cache locking ....................................... 4-34 4.12.3.1.3 disabling exceptions for data cache locking ..................................... 4-35 4.12.3.1.4 invalidating the data cache .................................................................. 4-36 4.12.3.1.5 loading the data cache ........................................................................ 4-37 4.12.3.1.6 entire data cache locking.................................................................... 4-37 4.12.3.1.7 data cache way-locking...................................................................... 4-37 4.12.3.1.8 invalidating the data cache (even if locked) ...................................... 4-38 4.12.3.2 instruction cache locking......................................................................... 4-38 4.12.3.2.1 enabling the instruction cache.............................................................. 4-38 4.12.3.2.2 address translation for instruction cache locking.............................. 4-39 4.12.3.2.3 disabling exceptions for instruction cache locking............................ 4-40 4.12.3.2.4 preloading instructions into the instruction cache................................ 4-40 4.12.3.2.5 entire instruction cache locking.......................................................... 4-42 4.12.3.2.6 instruction cache way-locking ............................................................ 4-42 4.12.3.2.7 invalidating the instruction cache (even if locked) ............................ 4-43 chapter 5 exceptions 5.1 exception classes ................................................................................................ 5-2 5.1.1 exception priorities.......................................................................................... 5-6 5.1.2 summary of front-end exception handling ................................................... 5-8 5.2 exception processing ........................................................................................... 5-9 5.2.1 exception processing registers ....................................................................... 5-9 5.2.1.1 srr0 and srr1 bit settings....................................................................... 5-9 5.2.1.2 csrr0 and csrr1 bit settings?g2_le only....................................... 5-11 5.2.1.3 sprg4?sprg7 (g2_le only)................................................................. 5-11 5.2.1.4 msr bit settings ....................................................................................... 5-12 5.2.2 enabling and disabling exceptions............................................................... 5-14 5.2.3 steps for exception processing...................................................................... 5-15 5.2.4 setting msr[ri] ............................................................................................ 5-16 5.2.5 returning from an exception handler with rfi ............................................. 5-16 5.2.6 returning from an interrupt with rfci ........................................................... 5-16 5.3 process switching .............................................................................................. 5-17 5.4 exception latencies ........................................................................................... 5-17 5.5 exception definitions ........................................................................................ 5-18 5.5.1 reset exceptions (0x00100) .......................................................................... 5-19 5.5.1.1 hard reset and power-on reset ............................................................... 5-19 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number xii g2 powerpc core reference manual motorola 5.5.1.2 soft reset................................................................................................... 5-21 5.5.1.3 byte ordering considerations for g2_le only........................................ 5-21 5.5.2 machine check exception (0x00200) ........................................................... 5-22 5.5.2.1 machine check exception enabled (msr[me] = 1)................................ 5-23 5.5.2.2 checkstop state (msr[me] = 0) .............................................................. 5-24 5.5.3 dsi exception (0x00300) .............................................................................. 5-24 5.5.4 isi exception (0x00400)................................................................................ 5-27 5.5.5 external interrupt (0x00500) ......................................................................... 5-27 5.5.6 alignment exception (0x00600) ................................................................... 5-28 5.5.6.1 integer alignment exceptions ................................................................... 5-29 5.5.6.2 load/store multiple alignment exceptions .............................................. 5-30 5.5.7 program exception (0x00700)....................................................................... 5-31 5.5.7.1 ieee floating-point exception program exceptions................................ 5-31 5.5.7.2 illegal, reserved, and unimplemented instructions program exceptions............................................................................... 5-32 5.5.8 floating-point unavailable exception (0x00800) ......................................... 5-32 5.5.9 decrementer exception (0x00900)................................................................ 5-32 5.5.10 critical interrupt exception (0x00a00)?g2_le only................................ 5-33 5.5.11 system call exception (0x00c00) ................................................................ 5-34 5.5.12 trace exception (0x00d00)........................................................................... 5-34 5.5.12.1 single-step instruction trace mode .......................................................... 5-35 5.5.12.2 branch trace mode ................................................................................... 5-36 5.5.13 instruction tlb miss exception (0x01000).................................................. 5-36 5.5.14 data tlb miss on load exception (0x01100).............................................. 5-36 5.5.15 data tlb miss on store exception (0x01200) ............................................. 5-37 5.5.16 instruction address breakpoint exception (0x01300) .................................. 5-37 5.5.17 system management interrupt (0x01400) ..................................................... 5-39 chapter 6 memory management 6.1 mmu features ..................................................................................................... 6-2 6.1.1 memory addressing ........................................................................................ 6-3 6.1.2 mmu organization.......................................................................................... 6-3 6.1.3 address translation mechanisms .................................................................... 6-8 6.1.4 memory protection facilities......................................................................... 6-10 6.1.5 page history information............................................................................... 6-11 6.1.6 general flow of mmu address translation ................................................. 6-11 6.1.6.1 real addressing mode and block address translation selection ............ 6-11 6.1.6.2 page address translation selection .......................................................... 6-12 6.1.7 mmu exceptions summary .......................................................................... 6-14 6.1.8 mmu instructions and register summary.................................................... 6-17 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number motorola contents xiii 6.2 real addressing mode....................................................................................... 6-19 6.3 block address translation................................................................................. 6-20 6.4 memory segment model ................................................................................... 6-21 6.4.1 page history recording ................................................................................. 6-21 6.4.1.1 referenced bit ........................................................................................... 6-22 6.4.1.2 changed bit ............................................................................................... 6-22 6.4.1.3 scenarios for referenced and changed bit recording ............................. 6-23 6.4.2 page memory protection ............................................................................... 6-24 6.4.3 tlb description ............................................................................................ 6-25 6.4.3.1 tlb organization ...................................................................................... 6-25 6.4.3.2 tlb entry invalidation.............................................................................. 6-26 6.4.4 page address translation summary.............................................................. 6-27 6.5 page table search operation ............................................................................. 6-27 6.5.1 page table search operation?conceptual flow ......................................... 6-27 6.5.2 implementation-specific table search operation ......................................... 6-31 6.5.2.1 resources for table search operations ..................................................... 6-32 6.5.2.1.1 data and instruction tlb miss address registers (dmiss and imiss).......................................................................... 6-34 6.5.2.1.2 data and instruction tlb compare registers (dcmp and icmp) ...... 6-34 6.5.2.1.3 primary and secondary hash address registers (hash1 and hash2) ....................................................................... 6-35 6.5.2.1.4 required physical address register (rpa) .......................................... 6-35 6.5.2.2 software table search operation .............................................................. 6-36 6.5.2.2.1 flow for example exception handlers ................................................. 6-37 6.5.2.2.2 code for example exception handlers ................................................. 6-42 6.5.3 page table updates........................................................................................ 6-48 6.5.4 segment register updates ............................................................................. 6-48 chapter 7 instruction timing 7.1 terminology and conventions............................................................................. 7-1 7.2 instruction timing overview............................................................................... 7-3 7.3 timing considerations......................................................................................... 7-8 7.3.1 general instruction flow ................................................................................. 7-8 7.3.2 instruction fetch timing.................................................................................. 7-9 7.3.2.1 cache arbitration....................................................................................... 7-10 7.3.2.2 cache hit ................................................................................................... 7-10 7.3.2.3 cache miss................................................................................................. 7-13 7.3.3 instruction dispatch and completion considerations ................................... 7-13 7.3.3.1 rename register operation ....................................................................... 7-15 7.3.3.2 instruction serialization............................................................................. 7-15 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number xiv g2 powerpc core reference manual motorola 7.3.3.3 execution unit considerations .................................................................. 7-16 7.4 execution unit timings ..................................................................................... 7-16 7.4.1 branch processing unit execution timing.................................................... 7-16 7.4.1.1 branch folding .......................................................................................... 7-17 7.4.1.2 static branch prediction ............................................................................ 7-18 7.4.1.2.1 predicted branch timing examples ...................................................... 7-19 7.4.2 integer unit execution timing ...................................................................... 7-20 7.4.3 floating-point unit execution timing .......................................................... 7-21 7.4.4 load/store unit execution timing................................................................ 7-21 7.4.5 system register unit execution timing ....................................................... 7-21 7.5 memory performance considerations ............................................................... 7-22 7.5.1 copy-back mode........................................................................................... 7-22 7.5.2 write-through mode ..................................................................................... 7-23 7.5.3 cache-inhibited accesses .............................................................................. 7-23 7.6 instruction scheduling guidelines..................................................................... 7-23 7.6.1 branch, dispatch, and completion unit resource requirements................. 7-24 7.6.1.1 branch resolution resource requirements .............................................. 7-24 7.6.1.2 dispatch unit resource requirements...................................................... 7-25 7.6.1.3 completion unit resource requirements ................................................. 7-25 7.7 instruction latency summary............................................................................ 7-26 chapter 8 signal descriptions 8.1 signal groupings ................................................................................................. 8-1 8.2 signal configurations .......................................................................................... 8-3 8.2.1 functional groupings ...................................................................................... 8-3 8.2.2 input/output enable and high-impedance control signals ............................ 8-3 8.2.2.1 unidirectional/bidirectional signals ........................................................... 8-5 8.2.2.2 logic gate equivalent and bidirectional signals........................................ 8-5 8.2.3 signal summary............................................................................................... 8-6 8.3 signal descriptions ............................................................................................ 8-10 8.3.1 address bus arbitration signals.................................................................... 8-11 8.3.1.1 bus request (core_br )?output ................................................................ 8-11 8.3.1.2 bus grant (core_bg )?input ...................................................................... 8-11 8.3.1.3 address bus busy ..................................................................................... 8-12 8.3.1.3.1 address bus busy in (core_abb_in )...................................................... 8-12 8.3.1.3.2 address bus busy out (core_abb_out ) ................................................. 8-13 8.3.1.3.3 address bus busy output enable (core_abb_oe)?output .................. 8-13 8.3.1.3.4 address bus busy high-impedance enable (core_abb_tre)?input..... 8-14 8.3.2 address transfer start signals....................................................................... 8-14 8.3.2.1 transfer start ............................................................................................. 8-14 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number motorola contents xv 8.3.2.1.1 transfer start in (core_ts_in )................................................................. 8-14 8.3.2.1.2 transfer start out (core_ts_out ) ............................................................ 8-15 8.3.3 address transfer signals ............................................................................... 8-15 8.3.3.1 address bus .............................................................................................. 8-15 8.3.3.1.1 address bus in (core_a_in[0:31]) ......................................................... 8-15 8.3.3.1.2 address bus out (core_a_out[0:31])..................................................... 8-15 8.3.3.1.3 address bus output enable (core_a_oe)?output ............................... 8-16 8.3.3.1.4 address bus high-impedance enable (core_a_tre)?input .................. 8-16 8.3.3.2 address bus parity .................................................................................... 8-17 8.3.3.2.1 address bus parity in (core_ap_in[0:3])............................................... 8-17 8.3.3.2.2 address bus parity input enable (core_ap_ien)?output .................... 8-17 8.3.3.2.3 address bus parity out (core_ap_out[0:3]) .......................................... 8-17 8.3.3.3 address parity error (core_ape )?output ................................................. 8-18 8.3.3.3.1 address parity error output enable (core_ape_oe)?output ............... 8-18 8.3.3.3.2 address parity error high-impedance enable (core_ape_tre)? input................................................................................................... 8-19 8.3.4 address transfer attribute signals................................................................ 8-19 8.3.4.1 transfer type ............................................................................................. 8-19 8.3.4.1.1 transfer type in (core_tt_in[0:4])......................................................... 8-20 8.3.4.1.2 transfer type out (core_tt_out[0:4]) .................................................... 8-21 8.3.4.2 transfer size (core_tsiz[0:2])?output ..................................................... 8-22 8.3.4.3 transfer burst ............................................................................................ 8-23 8.3.4.3.1 transfer burst in (core_tbst_in ) ............................................................ 8-23 8.3.4.3.2 transfer burst out (core_tbst_out )........................................................ 8-23 8.3.4.4 transfer code (core_tc[0:1])?output ...................................................... 8-24 8.3.4.5 cache inhibit (core_ci )?output ............................................................... 8-24 8.3.4.6 write-through (core_wt )?output............................................................ 8-24 8.3.4.7 global signals............................................................................................ 8-25 8.3.4.7.1 global in (core_gbl_in ) ......................................................................... 8-25 8.3.4.7.2 global out (core_gbl_out )..................................................................... 8-25 8.3.4.8 cache set entry (core_cse[0:1])?output................................................. 8-25 8.3.5 address transfer termination signals........................................................... 8-26 8.3.5.1 address acknowledge (core_aack )?input............................................... 8-26 8.3.5.2 address retry ........................................................................................... 8-26 8.3.5.2.1 address retry in (core_artry_in )........................................................... 8-26 8.3.5.2.2 address retry out (core_artry_out ) ...................................................... 8-27 8.3.5.2.3 address retry output enable (core_artry_oe)?output ....................... 8-28 8.3.5.2.4 address retry high-impedance enable (core_artry_tre)?input ......... 8-28 8.3.6 data bus arbitration signals ......................................................................... 8-29 8.3.6.1 data bus grant (core_dbg )?input ........................................................... 8-29 8.3.6.2 data bus write only (core_dbwo )?input................................................ 8-29 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number xvi g2 powerpc core reference manual motorola 8.3.6.3 data bus busy .......................................................................................... 8-30 8.3.6.3.1 data bus busy in (core_dbb_in ) ........................................................... 8-30 8.3.6.3.2 data bus busy out (core_dbb_out )....................................................... 8-30 8.3.6.3.3 data bus busy output enable (core_dbb_oe)?output........................ 8-31 8.3.6.3.4 data bus busy high-impedance enable (core_dbb_tre)?input .......... 8-31 8.3.7 data transfer signals..................................................................................... 8-31 8.3.7.1 data bus .................................................................................................... 8-32 8.3.7.1.1 data bus in (core_dh_in[0:31], core_dl_in[0:31])................................ 8-32 8.3.7.1.2 data bus input enable (core_dh_ien, core_dl_ien)?output ............... 8-32 8.3.7.1.3 data bus out (core_dh_out[0:31], core_dl_out[0:31])?output .......... 8-33 8.3.7.1.4 data bus output enable (core_d_oe)?output..................................... 8-33 8.3.7.1.5 data bus high-impedance enable (core_d_tre)?input ....................... 8-34 8.3.7.2 data bus parity (dp[0:7]) ......................................................................... 8-34 8.3.7.2.1 data bus parity in (core_dp_in[0:7]) .................................................... 8-34 8.3.7.2.2 data bus parity input enable (core_dp_ien)?output.......................... 8-35 8.3.7.2.3 data bus parity out (core_dp_out[0:7]) ............................................... 8-35 8.3.7.3 data parity error (core_dpe )?output ...................................................... 8-35 8.3.7.3.1 data parity error output enable (core_dpe_oe)?output .................... 8-36 8.3.7.3.2 data parity error high-impedance enable (core_dpe_tre)?input....... 8-36 8.3.7.4 data bus disable (core_dbdis )?input...................................................... 8-36 8.3.8 data transfer termination signals ................................................................ 8-37 8.3.8.1 transfer acknowledge (core_ta )?input................................................... 8-37 8.3.8.2 data retry (core_drtry )?input ................................................................. 8-38 8.3.8.3 transfer error acknowledge (core_tea )?input........................................ 8-38 8.3.9 interrupt and checkstop signals .................................................................... 8-39 8.3.9.1 external interrupt (core_int )?input.......................................................... 8-39 8.3.9.2 critical interrupt (core_cint )?input: g2_le core-only ......................... 8-39 8.3.9.3 system management interrupt (core_smi )?input.................................... 8-40 8.3.9.4 machine check interrupt (core_mcp )?input ........................................... 8-40 8.3.9.5 checkstop signals...................................................................................... 8-41 8.3.9.5.1 checkstop input (core_ckstp_in )........................................................... 8-41 8.3.9.5.2 checkstop output (core_ckstp_out ) ...................................................... 8-41 8.3.9.5.3 checkstop output enable (core_ckstp_oe)?output ............................ 8-42 8.3.9.5.4 checkstop high-impedance enable (core_ckstp_tre)?input............... 8-42 8.3.10 reset signals.................................................................................................. 8-42 8.3.10.1 hard reset (core_hreset )?input ............................................................... 8-42 8.3.10.2 soft reset (core_sreset )?input................................................................. 8-43 8.3.10.3 reset configuration signals ...................................................................... 8-43 8.3.10.3.1 32-bit mode (core_32bitmode )?input................................................. 8-43 8.3.10.3.2 reduced pinout mode (core_redpinmode)?input ............................... 8-44 8.3.10.3.3 msr ip bit set mode (core_msrip)?input.......................................... 8-44 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number motorola contents xvii 8.3.10.3.4 drtry mode (core_drtrymode)?input .............................................. 8-44 8.3.10.3.5 true little-endian mode (core_tle)?input .......................................... 8-45 8.3.10.3.6 system version register (core_svr[0:31] )?input ................................ 8-45 8.3.11 processor status signals ................................................................................ 8-45 8.3.11.1 quiescent acknowledge (core_qack )?input............................................ 8-45 8.3.11.2 quiescent request (core_qreq )?output................................................... 8-46 8.3.11.3 reservation (core_rsrv )?output .............................................................. 8-46 8.3.11.4 time base enable (core_tben)?input ...................................................... 8-46 8.3.11.5 tlbi sync (core_tlbisync )?input............................................................ 8-46 8.3.11.5.1 output enable (core_outputs_oe)?output........................................... 8-47 8.3.12 cop/scan interface........................................................................................ 8-47 8.3.12.1 jtag test clock (core_tck)?input.......................................................... 8-48 8.3.12.2 jtag test data input (core_tdi)?input ................................................... 8-48 8.3.12.3 jtag test data output (core_tdo)?output............................................. 8-49 8.3.12.3.1 jtag test data output enable (core_tdo_oe)?output....................... 8-49 8.3.12.4 jtag test mode select (core_tms)?input .............................................. 8-49 8.3.12.5 jtag test reset (core_trst )?input .......................................................... 8-49 8.3.12.6 tlm tap enable (core_tap_en)?input................................................... 8-50 8.3.12.7 test linking module select (core_tlmsel)?output ................................. 8-50 8.3.13 test interface.................................................................................................. 8-50 8.3.13.1 disable (core_disable)?input................................................................... 8-51 8.3.13.2 lssd test clock (core_l1_tstclk, core_l2_tstclk)?input ........................ 8-51 8.3.13.3 lssd test control (core_lssd_mode )?input........................................... 8-51 8.3.14 debug control signals................................................................................... 8-51 8.3.14.1 instruction address breakpoint register watchpoint (core_iabr )?output .............................................................................. 8-52 8.3.14.2 instruction address breakpoint register watchpoint (core_iabr2 )?output ............................................................................ 8-52 8.3.14.3 data address breakpoint register watchpoint (core_dabr )?output ...... 8-52 8.3.14.4 data address breakpoint register watchpoint (core_dabr2 )?output .... 8-53 8.3.15 clock signals ................................................................................................. 8-53 8.3.15.1 system clock (core_sysclk)?input .......................................................... 8-53 8.3.15.2 test clock output (core_clk_out) ............................................................. 8-54 8.3.15.3 pll configuration (core_pll_cfg[0:4])?input......................................... 8-55 chapter 9 core interface operation 9.1 overview.............................................................................................................. 9-1 9.1.1 operation of the instruction and data caches ................................................. 9-2 9.1.2 operation of the system interface ................................................................... 9-4 9.1.3 optional 32-bit data bus mode ...................................................................... 9-5 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number xviii g2 powerpc core reference manual motorola 9.1.4 direct-store accesses ...................................................................................... 9-5 9.2 memory access protocol..................................................................................... 9-5 9.2.1 arbitration signals........................................................................................... 9-6 9.2.2 address pipelining and split-bus transactions............................................... 9-7 9.2.3 timing diagram conventions.......................................................................... 9-8 9.3 address bus tenure ............................................................................................. 9-9 9.3.1 address bus arbitration .................................................................................. 9-9 9.3.2 address transfer............................................................................................ 9-11 9.3.2.1 address bus parity .................................................................................... 9-12 9.3.2.2 address transfer attribute signals............................................................ 9-12 9.3.2.2.1 transfer type (core_tt_in[0:4], core_tt_out[0:4]) signals .................... 9-13 9.3.2.2.2 transfer size (core_tsiz[0:2]) signals ................................................... 9-13 9.3.2.3 burst ordering during data transfers ...................................................... 9-14 9.3.2.4 effect of alignment in data transfers (64-bit bus) ................................. 9-14 9.3.2.5 effect of alignment in data transfers (32-bit bus) ................................. 9-16 9.3.2.5.1 alignment of external control instructions .......................................... 9-18 9.3.2.6 transfer code (core_tc[0:1]) signals ........................................................ 9-19 9.3.3 address transfer termination ...................................................................... 9-19 9.4 data bus tenure................................................................................................. 9-21 9.4.1 data bus arbitration...................................................................................... 9-21 9.4.1.1 using the core_dbb_out signal.................................................................. 9-22 9.4.2 data bus write only...................................................................................... 9-23 9.4.3 data transfer ................................................................................................. 9-23 9.4.4 data transfer termination ............................................................................. 9-24 9.4.4.1 normal single-beat termination............................................................... 9-25 9.4.4.2 normal burst termination ......................................................................... 9-26 9.4.4.3 data transfer termination due to a bus error.......................................... 9-27 9.4.5 memory coherency?mei protocol ............................................................. 9-29 9.5 timing examples ............................................................................................... 9-31 9.6 optional bus configurations ............................................................................. 9-37 9.6.1 32-bit data bus mode ................................................................................... 9-37 9.6.2 no-core_drtry mode ...................................................................................... 9-39 9.6.3 reduced-pinout mode ................................................................................... 9-40 9.7 interrupt, checkstop, and reset signals ............................................................ 9-40 9.7.1 external interrupts ......................................................................................... 9-41 9.7.2 checkstops ..................................................................................................... 9-41 9.7.3 reset inputs.................................................................................................... 9-41 9.7.4 core quiesce control signals........................................................................ 9-41 9.8 processor state signals ...................................................................................... 9-42 9.8.1 support for the lwarx/stwcx. instruction pair ............................................... 9-42 9.8.2 core_tlbisync input ........................................................................................ 9-42 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number motorola contents xix 9.9 ieee 1149.1-compliant interface...................................................................... 9-42 9.9.1 ieee 1149.1 interface description ................................................................ 9-42 9.10 using core_dbwo (data bus write only).......................................................... 9-43 chapter 10 power management 10.1 overview............................................................................................................ 10-1 10.2 dynamic power management............................................................................ 10-1 10.3 programmable power modes............................................................................. 10-2 10.3.1 power management modes ........................................................................... 10-3 10.3.1.1 full-power mode with dpm disabled ...................................................... 10-3 10.3.1.2 full-power mode with dpm enabled ....................................................... 10-3 10.3.1.3 doze mode................................................................................................. 10-3 10.3.1.4 nap mode .................................................................................................. 10-4 10.3.1.5 sleep mode ................................................................................................ 10-5 10.3.2 power management software considerations............................................... 10-6 10.4 example code sequence for entering processor sleep mode .......................... 10-6 chapter 11 debug features 11.1 breakpoint facilities .......................................................................................... 11-1 11.1.1 instruction address breakpoint registers (iabr, iabr2)........................... 11-1 11.1.2 instructional address control register (ibcr)............................................. 11-2 11.1.3 data address breakpoint registers (dabr, dabr2) ................................. 11-2 11.1.4 data address control register (dbcr)........................................................ 11-3 11.1.5 other debug resources ................................................................................. 11-3 11.1.6 software debug features............................................................................... 11-3 11.2 expanded debugging facilities in breakpoint registers .................................. 11-4 11.2.1 breakpoint enabled........................................................................................ 11-4 11.2.2 single-step enabled....................................................................................... 11-4 11.2.3 branch trace enabled.................................................................................... 11-5 11.2.4 address matching .......................................................................................... 11-5 11.2.5 combinational matching ............................................................................... 11-5 11.3 watchpoint signaling......................................................................................... 11-5 11.4 exception vectors and priority .......................................................................... 11-6 11.5 instruction address breakpoint examples ........................................................ 11-6 11.6 synchronization requirements .......................................................................... 11-8 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . contents paragraph number title page number xx g2 powerpc core reference manual motorola appendix a powerpc instruction set listings a.1 instructions sorted by mnemonic....................................................................... a-1 a.2 instructions sorted by opcode............................................................................ a-8 a.3 instructions grouped by functional categories ............................................... a-15 a.4 instructions sorted by form ............................................................................. a-25 a.5 instruction set legend ...................................................................................... a-36 appendix b revision history b.1 revision changes from revision 0 to revision 1 ..............................................b-1 glossary of terms and abbreviations index f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . figures figure number title page number motorola figures xxi res 1-1 g2 core block diagram ............................................................................................... 1-2 1-2 programming model?registers ................................................................................ 1-18 1-3 data cache organization ............................................................................................ 1-25 1-4 system interface ......................................................................................................... 1-3 4 2-1 programming model?registers .................................................................................. 2-3 2-2 hardware implementation register 0 (hid0) ............................................................ 2-10 2-3 hardware implementation register 1 (hid1) ............................................................ 2-14 2-4 hardware implementation-dependent register 2 (hid2).......................................... 2-15 2-5 dmiss and imiss registers ...................................................................................... 2-16 2-6 dcmp and icmp registers........................................................................................ 2-16 2-7 hash1 and hash2 registers ................................................................................... 2-17 2-8 required physical address register (rpa)................................................................ 2-18 2-9 upper bat register.................................................................................................... 2-18 2-10 lower bat register ................................................................................................... 2-19 2-11 critical interrupt save/restore register 0 (csrr0) .................................................. 2-19 2-12 critical interrupt save/restore register 1 (csrr1) .................................................. 2-19 2-13 sprg0?sprg7 registers........................................................................................... 2-20 2-14 instruction address breakpoint registers (iabr and iabr2).................................. 2-21 2-15 instruction address breakpoint control register (ibcr).......................................... 2-22 2-16 data address breakpoint registers (dabr and dabr2) ........................................ 2-22 2-17 data address breakpoint control register (dbcr) .................................................. 2-24 4-1 instruction cache organization .................................................................................... 4-4 4-2 data cache organization .............................................................................................. 4-6 4-3 double-word address ordering?critical-double-word-first ................................. 4-10 4-4 mei cache coherency protocol?state diagram (wim = 001)................................ 4-17 4-5 bus interface address buffers .................................................................................... 4-28 5-1 machine status save/restore register 0 (ssr0).......................................................... 5-9 5-2 machine status save/restore register 1 (ssr1)........................................................ 5-10 5-3 critical interrupt save/restore register 0 (csrr0) .................................................. 5-11 5-4 critical interrupt save/restore register 1 (csrr1) .................................................. 5-11 5-5 special-purpose registers (sprg0?sprg7) ............................................................. 5-12 5-6 machine state register (msr) ................................................................................... 5-12 6-1 mmu conceptual block diagram?32-bit implementations...................................... 6-5 6-2 g2 core immu block diagram ................................................................................... 6-6 6-3 g2 core dmmu block diagram ................................................................................. 6-7 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . figures figure number title page number xxii g2 powerpc core reference manual motorola 6-4 address translation types............................................................................................ 6-9 6-5 general flow of address translation (real addressing mode and block) ............... 6-12 6-6 general flow of page and direct-store interface address translation...................... 6-13 6-7 segment register and tlb organization ................................................................... 6-26 6-8 page address translation flow for 32-bit implementations?tlb hit.................... 6-28 6-9 primary page table search?conceptual flow.......................................................... 6-30 6-10 secondary page table search flow?conceptual flow ............................................ 6-31 6-11 dmiss and imiss registers ...................................................................................... 6-34 6-12 dcmp and icmp registers........................................................................................ 6-34 6-13 hash1 and hash2 registers ................................................................................... 6-35 6-14 required physical address (rpa) register................................................................ 6-36 6-15 flow for example software table search operation ................................................. 6-38 6-16 check and set r and c bit flow ................................................................................ 6-39 6-17 page fault setup flow ................................................................................................ 6-40 6-18 setup for protection violation exceptions.................................................................. 6-41 7-1 pipelined execution unit .............................................................................................. 7-4 7-2 instruction flow diagram ............................................................................................. 7-5 7-3 g2 core processor pipeline stages............................................................................... 7-7 7-4 instruction timing?cache hit .................................................................................. 7-11 7-5 instruction timing?cache miss................................................................................ 7-14 7-6 branch instruction timing .......................................................................................... 7-20 8-1 functional signal groups ............................................................................................. 8-3 8-2 logic diagram for bidirectional signals...................................................................... 8-5 8-3 detailed signal groups ............................................................................................... 8-10 8-4 ieee 1149.1-compliant boundary scan interface ..................................................... 8-48 9-1 g2 core block diagram ............................................................................................... 9-3 9-2 overlapping tenures on the bus for a single-beat transfer ........................................ 9-5 9-3 address bus arbitration ............................................................................................. 9-10 9-4 address bus arbitration showing bus parking ......................................................... 9-11 9-5 address bus transfer.................................................................................................. 9-12 9-6 snooped address cycle with core_artry_out ............................................................. 9-21 9-7 data bus arbitration ................................................................................................... 9-22 9-8 normal single-beat read termination....................................................................... 9-25 9-9 normal single-beat write termination ...................................................................... 9-26 9-10 normal burst transaction........................................................................................... 9-26 9-11 termination with drtry ........................................................................................... 9-27 9-12 read burst with core_ta wait states and core_drtry .................................................. 9-28 9-13 mei cache coherency protocol?state diagram (wim = 001)................................ 9-30 9-14 fastest single-beat reads........................................................................................... 9-31 9-15 fastest single-beat writes .......................................................................................... 9-32 9-16 single-beat reads showing data-delay controls ..................................................... 9-33 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . figures figure number title page number motorola figures xxiii 9-17 single-beat writes showing data-delay controls..................................................... 9-34 9-18 burst transfers with data-delay controls.................................................................. 9-35 9-19 use of transfer error acknowledge (tea ) ............................................................... 9-36 9-20 32-bit data bus transfer (8-beat burst) .................................................................... 9-38 9-21 32-bit data bus transfer (two-beat burst with drtry )......................................... 9-39 9-22 core_dbwo transaction ............................................................................................... 9-44 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . figures figure number title page number xxiv g2 powerpc core reference manual motorola f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . tables table number title page number motorola tables xxv tables i acronyms and abbreviated terms.......................................................................... xxxvi ii terminology conventions............................................................................................ xli iii instruction field conventions ..................................................................................... xlii 1-1 endian mode indication .............................................................................................. 1-7 1-2 critical interrupt enabling bit..................................................................................... 1-7 1-3 exception classifications .......................................................................................... 1-28 1-4 exceptions and conditions ........................................................................................ 1-29 1-5 other debug and support register bits .................................................................... 1-39 1-6 differences between g2 and g2_le cores.............................................................. 1-39 2-1 pvr field descriptions ............................................................................................... 2-4 2-2 architectural pvr field descriptions......................................................................... 2-5 2-3 assigned pvr values.................................................................................................. 2-5 2-4 msr bit settings ......................................................................................................... 2-6 2-5 hid0 bit functions ................................................................................................... 2-11 2-6 hid0[sbclk] and hid0[eclk] core_clk_out configuration ............................... 2-14 2-7 hid1 bit settings ...................................................................................................... 2-14 2-8 hid2 bit descriptions ............................................................................................... 2-15 2-9 dcmp and icmp bit settings .................................................................................. 2-17 2-10 hash1 and hash2 bit settings.............................................................................. 2-17 2-11 rpa bit settings ........................................................................................................ 2-1 8 2-12 system version register (svr) bit settings............................................................. 2-20 2-13 instruction address breakpoint register (iabr and iabr2) bit settings .............. 2-21 2-14 instruction address breakpoint control registers (ibcr)....................................... 2-22 2-15 data address breakpoint registers (dabr and dabr2) bit settings ................... 2-23 2-16 data address breakpoint control registers (dbcr)?g2_le-only ...................... 2-24 3-1 endian mode indication .............................................................................................. 3-2 3-2 memory operands ....................................................................................................... 3-3 3-3 integer arithmetic instructions.................................................................................. 3-12 3-4 integer compare instructions .................................................................................... 3-13 3-5 integer logical instructions....................................................................................... 3-14 3-6 integer rotate instructions ........................................................................................ 3-15 3-7 integer shift instructions ........................................................................................... 3-15 3-8 floating-point arithmetic instructions...................................................................... 3-16 3-9 floating-point multiply-add instructions ................................................................. 3-16 3-10 floating-point rounding and conversion instructions ............................................. 3-17 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . tables table number title page number xxvi g2 powerpc core reference manual motorola 3-11 floating-point compare instructions ........................................................................ 3-18 3-13 floating-point move instructions.............................................................................. 3-18 3-14 integer load instructions........................................................................................... 3-20 3-15 integer store instructions........................................................................................... 3-21 3-16 integer load and store with byte-reverse instructions............................................ 3-22 3-17 integer load and store multiple instructions............................................................ 3-23 3-18 integer load and store string instructions ................................................................ 3-23 3-19 floating-point load instructions ............................................................................... 3-24 3-20 floating-point store instructions............................................................................... 3-25 3-21 branch instructions.................................................................................................... 3-27 3-22 condition register logical instructions.................................................................... 3-27 3-23 trap instructions........................................................................................................ 3- 27 3-24 move to/from condition register instructions........................................................ 3-28 3-25 memory synchronization instructions?uisa ......................................................... 3-29 3-26 move from time base instruction............................................................................ 3-30 3-27 memory synchronization instructions?vea .......................................................... 3-31 3-28 user-level cache instructions .................................................................................. 3-31 3-29 external control instructions .................................................................................... 3-32 3-30 system linkage instructions ..................................................................................... 3-33 3-31 move to/from machine state register instructions................................................. 3-33 3-32 move to/from special-purpose register instructions.............................................. 3-34 3-33 implementation-specific spr encodings ( mfspr ) ................................................... 3-34 3-34 segment register manipulation instructions ............................................................ 3-36 3-35 translation lookaside buffer management instructions .......................................... 3-37 4-1 combinations of w, i, and m bits............................................................................. 4-13 4-2 mei state definitions ................................................................................................ 4-16 4-3 core_cse[0:1] signal encoding.................................................................................. 4-18 4-4 memory coherency actions on load operations..................................................... 4-19 4-5 memory coherency actions on store operations..................................................... 4-20 4-6 response to bus transactions ................................................................................... 4-20 4-7 bus operations caused by cache control instructions (wim = 001) ...................... 4-27 4-8 mei state transitions ................................................................................................ 4-29 4-9 cache organization ................................................................................................... 4-32 4-10 hid0 bits used to perform cache locking.............................................................. 4-33 4-11 hid2 bits used to perform cache way-locking ..................................................... 4-33 4-12 msr bits used to perform cache locking .............................................................. 4-33 4-13 example bat settings for cache locking ............................................................... 4-35 4-14 msr bits for disabling exceptions .......................................................................... 4-35 4-15 g2 core dwlck[0?2] encodings ........................................................................... 4-38 4-16 example bat settings for cache locking ............................................................... 4-39 4-17 msr bits for disabling exceptions .......................................................................... 4-40 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . tables table number title page number motorola tables xxvii 4-18 g2 core iwlck[0?2] encodings............................................................................. 4-42 5-1 exception classifications ............................................................................................ 5-3 5-2 exceptions and conditions .......................................................................................... 5-4 5-3 exception priorities ..................................................................................................... 5-6 5-4 srr1 bit settings for machine check exceptions ................................................... 5-10 5-5 srr1 bit settings for software table search operations ........................................ 5-10 5-6 conventional uses of sprg4?sprg7 ..................................................................... 5-12 5-7 msr bit settings ....................................................................................................... 5-12 5-8 ieee floating-point exception mode bits ............................................................... 5-14 5-9 msr setting due to exception ................................................................................. 5-18 5-10 hard reset msr value and exception vector .......................................................... 5-20 5-11 settings caused by hard reset.................................................................................. 5-20 5-12 soft reset exception?register settings .................................................................. 5-21 5-13 machine check exception?register settings ......................................................... 5-24 5-14 dsi exception?register settings ............................................................................ 5-25 5-15 external interrupt?register settings ....................................................................... 5-28 5-16 alignment interrupt?register settings.................................................................... 5-29 5-17 access types ............................................................................................................. 5- 30 5-18 critical interrupt?register settings ......................................................................... 5-34 5-19 trace exception?register settings.......................................................................... 5-35 5-20 instruction and data tlb miss exceptions?register settings ............................... 5-37 5-21 instruction address breakpoint exception?register settings ................................ 5-38 5-22 breakpoint action for multiple modes enabled for the same address.................... 5-39 5-23 system management interrupt?register settings ................................................... 5-40 6-1 mmu features summary ............................................................................................ 6-2 6-2 access protection options for pages......................................................................... 6-10 6-3 translation exception conditions ............................................................................. 6-15 6-4 other mmu exception conditions ........................................................................... 6-16 6-5 instruction summary?mmu control ...................................................................... 6-17 6-6 mmu registers ......................................................................................................... 6-18 6-7 table search operations to update history bits?tlb hit case ............................ 6-22 6-8 model for guaranteed r and c bit settings.............................................................. 6-24 6-9 implementation-specific resources for table search operations ............................ 6-32 6-10 implementation-specific srr1 bits ......................................................................... 6-33 6-11 dcmp and icmp bit settings .................................................................................. 6-35 6-12 hash1 and hash2 bit settings.............................................................................. 6-35 6-13 rpa bit settings ........................................................................................................ 6-3 6 7-1 branch instructions.................................................................................................... 7-26 7-2 system register instructions ..................................................................................... 7-26 7-3 condition register logical instructions.................................................................... 7-27 7-4 integer instructions .................................................................................................... 7-27 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . tables table number title page number xxviii g2 powerpc core reference manual motorola 7-5 floating-point instructions ........................................................................................ 7-29 7-6 load and store instructions ....................................................................................... 7-30 8-1 input/output enable and high-impedance signal mappings...................................... 8-4 8-2 conditions for unidirectional/bidirectional signals ................................................... 8-5 8-3 truth table for bidirectional signals .......................................................................... 8-6 8-4 g2 core signal cross reference ................................................................................. 8-6 8-5 g2 core snoop hit response.................................................................................... 8-20 8-6 transfer type encoding for the g2 core as a bus master........................................ 8-21 8-7 implementation-specific transfer type encoding.................................................... 8-22 8-8 data transfer size ..................................................................................................... 8-23 8-9 encodings for core_tc[0:1] signals ........................................................................... 8-24 8-10 data bus lane assignments...................................................................................... 8-32 8-11 data bus parity signal assignments ......................................................................... 8-34 8-12 core_clk_out signal configuration............................................................................ 8-54 8-13 core pll configuration............................................................................................ 8-55 9-1 timing diagram legend.............................................................................................. 9-8 9-2 transfer size signal encodings................................................................................. 9-13 9-3 burst ordering?64-bit bus...................................................................................... 9-14 9-4 burst ordering?32-bit bus...................................................................................... 9-14 9-5 aligned data transfers (64-bit bus)......................................................................... 9-15 9-6 misaligned data transfers (4-byte examples) ......................................................... 9-16 9-7 aligned data transfers (32-bit bus mode) .............................................................. 9-17 9-8 misaligned 32-bit data bus transfer (4-byte examples) ........................................ 9-18 9-9 transfer code encoding ............................................................................................ 9-19 9-10 core_cse[0:1] signals................................................................................................. 9-30 9-11 ieee interface pin descriptions................................................................................ 9-43 10-1 g2 core programmable power modes....................................................................... 10-3 11-1 other debug and support register bits .................................................................... 11-3 11-2 related debug exceptions and conditions ............................................................... 11-6 11-3 single address matching (g2 core emulation) ....................................................... 11-7 11-4 two addresses or matching.................................................................................... 11-7 11-5 address matching for inside address range ............................................................ 11-7 11-6 address matching for outside address range ......................................................... 11-8 a-1 complete instruction list sorted by mnemonic........................................................ a-1 a-2 complete instruction list sorted by opcode............................................................. a-8 a-3 integer arithmetic instructions ................................................................................ a-15 a-4 integer compare instructions................................................................................... a-16 a-5 integer logical instructions ..................................................................................... a-16 a-6 integer rotate instructions ....................................................................................... a-17 a-7 integer shift instructions.......................................................................................... a-17 a-8 floating-point arithmetic instructions .................................................................... a-18 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . tables table number title page number motorola tables xxix a-9 floating-point multiply-add instructions ............................................................... a-18 a-10 floating-point rounding and conversion instructions............................................ a-18 a-11 floating-point compare instructions ....................................................................... a-19 a-12 floating-point status and control register instructions.......................................... a-19 a-13 integer load instructions ......................................................................................... a-19 a-14 integer store instructions ......................................................................................... a-20 a-15 integer load and store with byte-reverse instructions .......................................... a-20 a-16 integer load and store multiple instructions .......................................................... a-20 a-17 integer load and store string instructions .............................................................. a-21 a-18 memory synchronization instructions..................................................................... a-21 a-19 floating-point load instructions ............................................................................. a-21 a-20 floating-point store instructions ............................................................................. a-21 a-21 floating-point move instructions ............................................................................ a-22 a-22 branch instructions .................................................................................................. a-22 a-23 condition register logical instructions .................................................................. a-22 a-24 system linkage instructions .................................................................................... a-23 a-25 trap instructions ...................................................................................................... a-23 a-26 processor control instructions ................................................................................. a-23 a-27 cache management instructions .............................................................................. a-23 a-28 segment register manipulation instructions ........................................................... a-24 a-29 lookaside buffer management instructions............................................................ a-24 a-30 external control instructions .................................................................................. a-24 a-31 i-form ..................................................................................................................... .a-25 a-32 b-form ..................................................................................................................... a-25 a-33 sc-form................................................................................................................... a -25 a-34 d-form..................................................................................................................... a-25 a-35 ds-form................................................................................................................... a -27 a-36 x-form..................................................................................................................... a-27 a-37 xl-form .................................................................................................................. a- 31 a-38 xfx-form................................................................................................................ a-3 2 a-39 xfl-form ................................................................................................................ a-3 2 a-40 xs-form................................................................................................................... a -32 a-41 xo-form .................................................................................................................. a- 33 a-42 a-form..................................................................................................................... a-33 a-43 m-form .................................................................................................................... a -34 a-44 md-form ................................................................................................................. a-3 5 a-45 mds-form ............................................................................................................... a-35 a-46 powerpc instruction set legend ............................................................................. a-36 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . tables table number title page number xxx g2 powerpc core reference manual motorola f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola about this book xxxi about this book the primary objective of this reference manual is to define the functionality of the g2 core, a derivative of the original mpc603e powerpc? microprocessor design. the g2 core is an implementation of the powerpc microprocessor family. this reference manual also describes the g2_le core, which is a derivative of the g2 core. it is written from the perspective of the g2 core and unless otherwise noted, the information applies to both the g2 and g2_le core. the g2_le core has the similar functionality to the g2 core and any differences regarding registers, signals, exception model, and debug features are summarized in section 1.4, ?differences between the mpc603e and the g2 and g2_le cores.? this book is intended as a companion to the programming environments manual for 32-bit implementations of the powerpc architecture (referred to as the programming environment manual ) which provides a general description of the features that are common to processors and cores that implement the powerpc architecture and indicates those features that are optional or that may be implemented differently in the design of each processor and core. note about the companion programming environments manual the powerpc architecture definition is flexible to support to a broad range of the processors as well as cores. note that the programming environments manual describes only powerpc architecture features for 32-bit implementations. contact your sales representative for a copy of the programming environments manual . this reference manual and the programming environments manual distinguish between the three levels, or programming environments, of the powerpc architecture, which are as follows: user instruction set architecture (uisa)?the uisa defines the architecture level to which user-level software should conform. the uisa defines the base user-level instruction set, user-level registers, data types, memory conventions, and the memory and programming models seen by application programmers. virtual environment architecture (vea)?the vea, which is the smallest component of the powerpc architecture, defines additional user-level functionality f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . xxxii g2 powerpc core reference manual motorola that falls outside typical user-level software requirements. the vea describes the memory model for an environment in which multiple processors or other devices can access external memory, and defines aspects of the cache model and cache control instructions from a user-level perspective. the resources defined by the vea are particularly useful for optimizing memory accesses and for managing resources in an environment in which other processors and devices can access external memory. operating environment architecture (oea)?the oea defines supervisor-level resources typically required by an operating system. the oea defines the memory management model, supervisor-level registers, and exception model. implementations that conform to the oea also conform to the uisa and vea. note that some resources are defined more generally at one level in the architecture and more specifically at another. for example, conditions that cause a floating-point exception are defined by the uisa, while the exception mechanism itself is defined by the oea. for ease in reference, topics in this book are presented in the same order as the programming environments manual. topics build on one another, beginning with a description and complete summary of the g2 core register model (including the g2_le core specifics) and followed by the instruction set model and progressing to more specific, architecture-based topics regarding the cache, exception, and memory management models. as such, chapters may include information from multiple levels of the architecture. (for example, the discussion of the cache model uses information from both the vea and the oea.) the powerpc architecture: a specification for a new family of risc processors defines the architecture from the perspective of the three programming environments and remains the defining document for the powerpc architecture. for information about ordering motorola documentation, see ?suggested reading? on page xxxiv. the information in this book is subject to change without notice, as described in the disclaimers on the title page of this book. as with any technical documentation, it is the readers? responsibility to be sure they are using the most recent version of the documentation. for more information, contact your sales representative. to locate any published errata or updates for this reference manual, refer to the world-wide web at http://www.motorola.com/semiconductors. a list of major differences between the mpc603e microprocessor, the g2 core, and the g2_le core are provided in table 1-6. note that the g2 core has similar functionality as the mpc603e. however, the minor differences between them are documented by footnotes. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola about this book xxxiii audience audience this manual is intended to be used as a reference for many semiconductor products targeting a range of markets including automotive, communication, consumer, networking, and computer peripherals. it is intended for system software and hardware developers and applications programmers who want to develop products using the cores. it is assumed that the reader understands operating systems, core system design, and details of the powerpc architecture. organization following is a summary and a brief description of the major sections of this manual: chapter 1, ?overview,? is useful for readers who want a general understanding of the features and functions of the powerpc architecture and the differences between the g2 and g2_le cores. this chapter describes the flexible nature of the powerpc architecture definition, and provides an overview of how the powerpc architecture defines the register set, instruction set and addressing modes, cache model (including instruction and data cache way-locking for the g2 core), exception model, memory management model, instruction timing, system support interface, and debug features for the g2 and g2_le cores. chapter 2, ?register model,? provides a brief synopsis of the registers implemented in the g2 core and some registers implemented only in the g2_le core. chapter 3, ?instruction set model,? provides a brief description of the operand conventions, an overview of the powerpc addressing modes, and a list of the instructions implemented by the g2 core. note that instructions are organized by functions. chapter 4, ?instruction and data cache operation,? provides a discussion of the cache and memory model as implemented on the g2 core. chapter 5, ?exceptions,? describes the exception model defined in the powerpc oea, and the specific exception model implemented on the g2 and g2_le cores. chapter 6, ?memory management,? describes the g2 core?s implementation of the memory management unit specifications provided by the oea. chapter 7, ?instruction timing,? provides information about latencies, interlocks, special situations, and various conditions to help make programming more efficient. this chapter is of special interest to software engineers and system designers. chapter 8, ?signal descriptions,? provides descriptions of individual signals of the g2 core that are candidates for being driven as external device signals. this chapter also describes signals which are only defined in the g2_le core. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . xxxiv g2 powerpc core reference manual motorola suggested reading chapter 9, ?core interface operation,? describes signal timings for various operations. it also provides a detailed description of the 60x bus interface, the multiple bus master capability, and the memory coherency features of the g2 core. chapter 10, ?power management,? provides information about the power saving modes for the g2 core. chapter 11, ?debug features,? provides information about the debug features of the g2_le core. this chapter also describes trace facility debug features for both the g2 and g2_le cores. appendix a, ?powerpc instruction set listings,? lists all the powerpc instructions while indicating those instructions that are not implemented by the g2 and g2_le cores; it also includes the instructions that are specific to the g2 and g2_le cores. instructions are grouped according to mnemonic, opcode, function, and form. also included is a quick referrence table that contains general information, such as the architecture level, privilege level, and form, and indicates if the instruction is 64-bit and optional. appendix b, ?revision history,? lists the major differences between revision 1 and revision 2 of the g2 core reference manual . this reference manual also includes a glossary and an index. suggested reading this section lists additional reading that provides background for the information in this reference manual, as well as general information about the powerpc architecture. general information the following documentation, available through morgan-kaufmann publishers, 340 pine street, sixth floor, san francisco, ca, provides useful information about the powerpc architecture and computer architecture in general: the powerpc architecture: a specification for a new family of risc processors , second edition, by international business machines, inc. updates to the architecture specification are accessible via the world-wide web at http://www.austin.ibm.com/tech/ppc-chg.html. powerpc microprocessor common hardware reference platform: a system architecture , by apple computer, inc., international business machines, inc., and motorola, inc. computer architecture: a quantitative approach , second edition, john l. hennessy and david a. patterson. computer organization and design: the hardware/software interface , second edition, david a. patterson and john l. hennessy. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola about this book xxxv conventions inside macintosh: powerpc system software , addison-wesley publishing company, one jacob way, reading, ma, 01867; tel. (800) 282-2732 (u.s.a.), (800) 637-0029 (canada), (716) 871-6555 (international). related documentation motorola documentation is available from the sources listed on the back cover of this manual; the document order numbers are included in parentheses for ease in ordering: programming environments manual for 32-bit implementations of the powerpc architecture (mpcfpe32b/ad)?describes resources defined by the powerpc architecture. user?s and reference manuals?these books provide details about individual implementations and are intended for use with the programming environments manual. addenda/errata to user?s or reference manuals?because some processors have follow-on devices, an addendum is provided that describes the additional features and functionality changes. these addenda are intended for use with the corresponding book. implementation variances relative to rev. 1 of the programming environments manual is available at http://www.motorola.com/semiconductors. technical summaries?each device has a technical summary that provides an overview of its features. this document is roughly the equivalent to the overview (chapter 1) of an implementation?s user?s or reference manual. application notes?these short documents contain useful information about specific design issues useful to programmers and engineers working with motorola processors. documentation for support chips?these include the following: ? mpc106 pci bridge/memory controller user?s manual (mpc106um/ad) ? mpc107 pci bridge/memory controller technical summary (mpc107ts/d) ? mpc107 pci bridge/memory controller user?s manual (mpc107um/ad) additional literature is published as new processors become available. for a current list of documentation, refer to: http://www.mot.com/semiconductors. conventions this document uses the following notational conventions: mnemonics instruction mnemonics are shown in lowercase bold italics italics indicate variable command parameters, for example, bcctr x book titles in text are set in italics f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . xxxvi g2 powerpc core reference manual motorola acronyms and abbreviations 0x0 prefix to denote hexadecimal number 0b0 prefix to denote binary number r a, r b instruction syntax used to identify a source gpr r a|0 contents of a specified gpr or the value 0 r d instruction syntax used to identify a destination gpr fr a, fr b, fr c instruction syntax used to identify a source fpr fr d instruction syntax used to identify a destination fpr reg[field] abbreviations or acronyms for registers are shown in uppercase text. specific bits, fields, or ranges appear in brackets. for example, msr[le] refers to the little-endian mode enable bit in the machine state register. x in certain contexts, such as a signal encoding, this indicates a don?t care n used to express an undefined numerical value ? not logical operator & and logical operator | or logical operator indicates reserved bits or bit fields in a register. although these bits may be written to as either ones or zeros, they are always read as zeros. acronyms and abbreviations table i contains acronyms and abbreviations that are used in this reference manual. table i. acronyms and abbreviated terms term meaning abe address bus enable alu arithmetic logic unit bat block address translation batl block address translation lower batu block address translation upper be branch trace enable bist built-in self test biu bus interface unit bl block size mask 0 0 0 0 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola about this book xxxvii acronyms and abbreviations bpu branch processing unit buid bus unit id ce critical interrupt exception enable cia current instruction address cmos complementary metal-oxide semiconductor cmp iabr compare type cmp2 iabr2 compare type cop common on-chip processor cr condition register csrr0 critical interrupt save/restore register 0 csrr1 critical interrupt save/restore register 1 ctr count register cq completion queue dar data address register dabr data address breakpoint register dabr2 data address breakpoint register 2 dbat data bat dbcr data address control register dce data cache enable dcfi data cache flash invalidate dcmp data tlb compare dec decrementer register dlock data cache lock dmiss data tlb miss address dmmu data memory management unit dpm dynamic power management enable dr data address translation enable dsisr register used for determining the source of a dsi exception dtlb data translation lookaside buffer dwlck data cache way-lock ea effective address ear external access register ecc error checking and correction table i. acronyms and abbreviated terms (continued) term meaning f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . xxxviii g2 powerpc core reference manual motorola acronyms and abbreviations ee external interrupt enable fe0 floating-point exception model 0 fe1 floating-point exception model 1 fifo first-in-first-out fp floating-point available fpr floating-point register fpscr floating-point status and control register fpu floating-point unit gpr general-purpose register hbe high bat enable hid0 hardware implementation register 0 hid1 hardware implementation register 1 hid2 hardware implementation register 2 i cache-inhibited iabr instruction address breakpoint register 1 iabr2 instruction address breakpoint register 2 ibat instruction bat ibcr instruction breakpoint control register ice instruction cache enable icfi instruction cache flash invalidate icmp instruction tlb compare ieee institute for electrical and electronics engineers iee external interrupt enable ifem instruction fetch enable m (bit) ile exception little-endian mode ilock instruction cache lock imiss instruction tlb miss address immu instruction memory management unit ip exception prefix iq instruction queue ir instruction address translation enable itlb instruction translation lookaside buffer iu integer unit table i. acronyms and abbreviated terms (continued) term meaning f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola about this book xxxix acronyms and abbreviations iwlck instruction cache way-lock l2 secondary cache le little-endian mode enable let true little-endian mode bit lifo last-in-first-out lr link register lru least recently used lsb least-significant byte lsb least-significant bit lsu load/store unit m memory-coherent mbar system memory base address me machine check enable mei modified/exclusive/invalid mesi modified/exclusive/shared/invalid?cache coherency protocol mfg manufacturing revision tag mjrev major processor design revision indicator mnrev minor processor design revision indicator mmu memory management unit mq mq register msb most-significant byte msb most-significant bit msr machine state register nan not a number ni non-ieee mode bit no-op no operation noopti no-op the data cache touch instructions oea operating environment architecture pid processor identification tag pir processor identification register pll phase-locked loop power performance optimized with enhanced risc architecture pow power management enable table i. acronyms and abbreviated terms (continued) term meaning f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . xl g2 powerpc core reference manual motorola acronyms and abbreviations por power-on reset proc processor revision tag pr privilege level pt processor id type tag pte page table entry pteg page table entry group pvr processor version register raw read-after-write ri recoverable exception rid resource id risc reduced instruction set computing rtl register transfer language rwitm read with intent to modify sdr1 register that specifies the page table base address for virtual-to-physical address translation se single-step trace enable soc system-on-a-chip spr special-purpose register sr segment register srr0 machine status save/restore register 0 srr1 machine status save/restore register 1 sru system register unit smi system management interrupt svr system version register sig_type combinational signal type t translation control bit tap test access port tb time base facility tbl time base lower register tbu time base upper register tgpr temporary gpr remapping tlb translation lookaside buffer ttl transistor-to-transistor logic uimm unsigned immediate value table i. acronyms and abbreviated terms (continued) term meaning f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola about this book xli terminology conventions terminology conventions table ii describes terminology conventions used in this manual. uisa user instruction set architecture utlb unified translation lookaside buffer uut unit under test vea virtual environment architecture vpn virtual page number w write-through war write-after-read waw write-after-write wimg write-through/caching-inhibited/memory-coherency enforced/guarded bits xatc extended address transfer code xer register used for indicating conditions such as carries and overflows for integer operations table ii. terminology conventions the architecture specification this manual data storage interrupt (dsi) dsi exception extended mnemonics simplified mnemonics fixed-point unit (fxu) integer unit (iu) instruction storage interrupt (isi) isi exception interrupt exception privileged mode (or privileged state) supervisor-level privilege problem mode (or problem state) user-level privilege real address physical address relocation translation storage (locations) memory storage (the act of) access store in write back store through write through table i. acronyms and abbreviated terms (continued) term meaning f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . xlii g2 powerpc core reference manual motorola terminology conventions table iii describes instruction field notation used in this manual. table iii. instruction field conventions the architecture specification equivalent to: ba, bb, bt crb a, crb b, crb d (respectively) bf, bfa crf d, crf s (respectively) dd ds ds flm fm fra, frb, frc, frt, frs fr a, fr b, fr c, fr d, fr s (respectively) fxm crm ra, rb, rt, rs r a, r b, r d, r s (respectively) si simm uimm ui uimm /, //, /// 0...0 (shaded) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-1 chapter 1 overview this chapter provides an overview of features for the embedded g2 processor core, a derivative of the original mpc603e powerpc? microprocessor design. the g2 core is an implementation of the powerpc microprocessor family. this reference manual also describes the g2_le core, which is a derivative of the g2 core the g2_le core implements some enhanced features with a true little-endian mode, an additional critical interrupt signal, and four additional instruction bat and four additional data bat registers. this document is written from the perspective of the g2 core and all of the descriptions apply to both the g2 and g2_le cores, except where explicitly noted. note that throughout this document, the terms g2 core, core, and processor are used interchangeably. 1.1 overview this section describes the details of the g2 core, provides a block diagram showing the major functional units (see figure 1-1), and briefly describes how these units interact. all differences between the g2 and g2_le implementations are noted. the g2 core is a low-power implementation of this microprocessor family of reduced instruction set computing (risc) microprocessors. the core implements the 32-bit portion of the powerpc architecture, which defines 32-bit effective addresses, integer data types of 8, 16, and 32 bits, and floating-point data types of 32 and 64 bits. the g2 core is a superscalar processor that can issue and retire as many as three instructions per clock cycle. instructions can execute out of program order for increased performance; however, the core makes completion appear sequential. the g2 core integrates five execution units?an integer unit (iu), a floating-point unit (fpu), a branch processing unit (bpu), a load/store unit (lsu), and a system register unit (sru). the ability to execute five instructions in parallel and the use of simple instructions with rapid execution times yield high efficiency and throughput for g2-core based systems. most integer instructions execute in one clock cycle. on the g2 core, the fpu is pipelined so a single-precision multiply-add instruction can be issued and completed every clock cycle. the g2 core provides hardware support for all single- and double-precision floating-point operations for most value representations and all rounding modes. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-2 g2 powerpc core reference manual motorola overview figure 1-1. g2 core block diagram 64-bi t 64-bit (two instructions) 32-bit branch processing unit 32-/64-bit data bus 32-bit address bus instruction unit integer unit floating- point unit fpr file fp rename registers 16-kbyte d cache tags sequential fetcher ctr cr lr + * / fpscr system register unit + * / core interface d mmu srs dtlb dbat array touch load buffer copy-back buffer 64-bit dispatch unit 64-bit (two instructions) power dissipation control completion unit time base counter/ decrementer clock multiplier jtag/cop interface xer i mmu srs itlb ibat array 16-kbyte i cache tags 64-bit 64-bit 32-bit gpr file load/store unit + 64-bit gp rename registers instruction queue + f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-3 overview the g2 core provides independent on-chip, 16-kbyte, four-way set-associative, physically-addressed caches for instructions and data, and on-chip instruction and data memory management units (mmus). the mmus contain 64-entry, two-way set-associative, data and instruction translation lookaside buffers (dtlb and itlb) that provide support for demand-paged virtual-memory address translation and variable-sized block translation. the tlbs and caches use a least recently used (lru) replacement algorithm. the g2 core also supports block address translation through the use of two independent instruction and data block address translation (ibat and dbat) arrays, each containing four pairs of bats; however the g2_le core supports block address translation arrays of eight pairs of data bats and eight pairs of instruction bats. effective addresses are compared simultaneously with all four (or eight, for g2_le) entries in the bat array during block translation. in accordance with the powerpc architecture, if an effective address hits in both the tlb and bat array, the bat translation takes priority. the g2 core has a selectable 32- or 64-bit 60x data bus and a 32-bit 60x address bus. the core interface protocol allows multiple masters to compete for system resources through a central external arbiter. the g2 core provides a three-state (exclusive, modified, and invalid) coherency protocol which is a compatible subset of a four-state (modified/exclusive/shared/invalid) mesi protocol. this protocol operates coherently in systems that contain four-state caches. the g2 core supports single-beat and burst data transfers for memory accesses and supports memory-mapped i/o operations. the g2_le core has a new mmu with eight additional bats which provides better performance in protecting accesses on a segment, block, or page basis along with memory accesses and i/o accesses. the true little-endian mode is another enhanced capability of the g2_le core which is not managed on a page basis through the mmu. unlike the powerpc little-endian mode (manipulates the only address bits), the true little-endian mode actually operates on true little-endian instructions and data from memory. the critical interrupt is an additional exception in the g2_le core which has higher priority order than the system management interrupt. also debug feature is improved in the g2_le. see section 1.3.8, ?debug features (g2_le only),? for more detail. additional sprg exception handling registers are provided for enhancing the use of the operating system. 1.1.1 features this section describes the major features of the g2 core noting where the g2 and g2_le implementations differ: high-performance, superscalar microprocessor core ? as many as three instructions issued and retired per clock ? as many as five instructions in execution per clock f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-4 g2 powerpc core reference manual motorola overview ? single-cycle execution for most instructions ? pipelined fpu for all single-precision and most double-precision operations five independent execution units and two register files ? bpu featuring static branch prediction ? a 32-bit iu ? fully ieee 754-compliant fpu for both single- and double-precision operations ? lsu for data transfer between data cache and general-purpose registers (gprs) and floating-point registers (fprs) ? sru that executes condition register (cr), special-purpose register (spr), and integer add/compare instructions ? thirty-two 32-bit gprs for integer operands ? thirty-two 64-bit fprs for single- or double-precision operands high instruction and data throughput ? zero-cycle branch capability (branch folding) ? programmable static branch prediction on unresolved conditional branches ? instruction fetch unit capable of fetching two instructions per clock from the instruction cache ? a six-entry instruction queue (iq) that provides lookahead capability ? independent pipelines with feed-forwarding that reduces data dependencies in hardware ? 16-kbyte data cache and 16-kbyte instruction cache?four-way set-associative, physically addressed, lru replacement algorithm ? cache write-back or write-through operation programmable on a per page or per block basis ? bpu that performs cr lookahead operations ? address translation facilities for 4-kbyte page size, variable block size, and 256-mbyte segment size ? a 64-entry, two-way set-associative itlb and dtlb ? four-entry data and instruction bat arrays (for g2 core), and eight-entry data and instruction bat arrays (for g2_le core) providing 128-kbyte to 256-mbyte blocks ? software table search operations and updates supported through fast trap mechanism ? 52-bit virtual address; 32-bit physical address facilities for enhanced system performance ? a 32- or 64-bit split-transaction data bus interface (60x bus) with burst transfers f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-5 overview ? support for one-level address pipelining and out-of-order bus transactions on the 60x interface ? true little-endian mode (for g2_le only) for compatibility with other true little-endian devices. ? critical interrupt exception (for g2_le only) is added ? hardware support for misaligned little-endian accesses integrated power management ? internal processor/bus clock multiplier ratios ? three power-saving modes: doze, nap, and sleep ? automatic dynamic power reduction when internal functional units are idle in-system testability and debugging features through jtag boundary-scan capability features specific to the g2 core not present on the original mpc603e (pid6-603e) processors follow: enhancements to the register set ? the g2 core has two more additional hid0 bits then the original mpc603e: ? the address bus enable (abe) bit, hid0[28], gives the g2 core the ability to broadcast dcbf , dcbi , and dcbst onto the 60x bus. ? the instruction fetch enable m (ifem) bit, hid0[24], allows the g2 core to reflect the value of the m bit during instruction translation onto the 60x bus. ? the g2 core has one more additional hid2 register than the original mpc603e that enables the true little-endian mode, the new additional bat registers, and cache way-locking for the g2 core. enhancements to cache implementation ? the instruction cache is blocked only until the critical load completes (hit under reloads allowed) ? the critical-double-word is simultaneously written to the cache and forwarded to the requesting unit, thus minimizing stalls due to load delays. ? the hid2 register enables instruction and data cache way-locking. ? provides for an optional data cache operation broadcast feature (enabled by hid0[abe]) that allows for correct system management using an external copy-back l2 cache. ? all of the cache control instructions ( icbi , dcbi , dcbf , and dcbst , excluding dcbz ) require that hid0[abe] be enabled in order to execute. exceptions ? the g2 core offers hardware support for misaligned little-endian accesses. little-endian load/store accesses that are not on a word boundary, with the f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-6 g2 powerpc core reference manual motorola overview exception of strings and multiples, generate exceptions under the same circumstances as big-endian accesses. ? the g2_le core supports true little-endian mode to minimize the impact on software porting from true little-endian systems. ? a new input interrupt signal, core_cint , is provided to trigger the critical interrupt exception on the g2_le core. ? the g2 core does not have misalignment support for eciwx and ecowx graphics instructions. these instructions cause an alignment exception if the access is not on a word boundary. bus clock?new bus multipliers are selected by the encodings of core_pll_cfg[0:4]. instruction timing ? the integer divide instructions, divwu [ o ][ . ] and divw [ o ][ . ], execute in 20 clock cycles; execution of these instructions in the original pid6 mpc603e device takes 37 clock cycles. ? support for single-cycle store ? an adder/comparator added to system register unit that allows dispatch and execution of multiple integer add and compare instructions on each cycle. enhanced debug features ? addition of three breakpoint registers?iabr2, dabr, and dabr2 ? two new breakpoint control registers?dbcr and ibcr ? inclusion of four breakpoint signals?core_iabr , core_iabr2 , core_dabr , and core_dabr2 figure 1-1 provides a block diagram of the g2 core that shows how the execution units?iu, fpu, bpu, lsu, and sru?operate independently and in parallel. note that this is a conceptual diagram and does not attempt to show how these features are physically implemented on the chip. the g2 core provides address translation and protection facilities, including an itlb, dtlb, and instruction and data bat arrays. instruction fetching and issuing is handled in the instruction unit. translation of addresses for cache or external memory accesses are handled by the mmus. both units are discussed in more detail in section 1.1.3, ?instruction unit,? and section 1.1.6.1, ?memory management units (mmus).? 1.1.2 g2_le-specific features the following sections describe some of the additional features of the g2_le core. for a table summary of the differences between the g2 core and the g2_le cores, see section 1.4, ?differences between the mpc603e and the g2 and g2_le cores.? f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-7 overview 1.1.2.1 true little-endian mode true little-endian mode is supported in the g2_le core to minimize the impact on software porting from true little-endian systems. the true little-endian mode applies for all instruction fetches and data load and store operations to and from memory. the g2_le powers up in one of two endian modes, big-endian mode or true little-endian mode, selected by the core_tle signal at the negation of core_hreset . like all the mode control signals, the state of core_tle is captured at the negation of core_hreset . the state of msr[ile], msr[le], and hid2[let] are set to the value that is dictated by core_tle. the endian mode should be set at the negation of core_hreset and should remain unchanged by software for the duration of the system operation. bit 4 of hid2, (hid2[let]) is used in conjunction with msr[le] to indicate the endian mode of operation of the g2_le core as shown in table 1-1. 1.1.2.2 critical interrupt a new input interrupt signal, core_cint , is provided to trigger the critical interrupt exception on the g2_le core. this asynchronous exception uses vector offset 0x00a00. msr[ce] is allocated for enabling the critical interrupt, and a new instruction, return from critical interrupt ( rfci ), is implemented to return from these exception handlers. also, two new registers, csrr0 and csrr1, are used to save and restore the processor state for critical interrupts. table 1-2 shows the bit allocation of msr[ce], which enables and disables the critical interrupt. 1.1.2.3 other new signals there are four additional signals that support the breakpoint state outputs (core_iabr , core_iabr2 , core_dabr , and core_dabr2 ) and one additional watchpoint debug feature (core_tdo_oe). table 1-1. endian mode indication msr[le] hid2[let] endian mode 0 x big-endian 1 0 modified (powerpc) little-endian 1 1 true little-endian table 1-2. critical interrupt enabling bit msr[ce] mode 24 0 disables critical interrupt 1 enables critical interrupt f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-8 g2 powerpc core reference manual motorola overview 1.1.2.4 additional supervisor-level sprs the g2_le core has 29 new/additional supervisor-level sprs. see section 1.3.1.7, ?special-purpose registers (sprs),? for more information. 1.1.3 instruction unit as shown in figure 1-1, the g2 core instruction unit, containing a fetch unit, instruction queue, dispatch unit, and bpu, provides centralized control of instruction flow to the execution units. the instruction unit determines the address of the next instruction to be fetched based on information from the sequential fetcher and from the bpu. the instruction unit fetches the instructions from the instruction cache into the instruction queue. the bpu receives branch instructions from the fetcher and uses static branch prediction to allow fetching from a predicted instruction stream while a conditional branch is evaluated. the bpu folds out for unconditional branch instructions and conditional branch instructions unaffected by instructions in the execution pipeline. instructions issued beyond a predicted branch cannot complete execution until the branch is resolved, preserving the programming model of sequential execution. if any of these are branch instructions, they are decoded but not issued. instructions to be executed by the fpu, iu, lsu, and sru are issued and allowed to progress up to the register write-back stage. write-back is allowed when a correctly predicted branch is resolved, and execution continues along the predicted path. if branch prediction is incorrect, the instruction unit flushes all predicted path instructions, and instructions are issued from the correct path. 1.1.3.1 instruction queue and dispatch unit the instruction queue (iq), shown in figure 1-1, holds as many as six instructions and loads up to two instructions from the instruction unit during a single cycle. the instruction fetch unit continuously loads as many instructions as space in the iq allows. instructions are dispatched to their respective execution units from the dispatch unit at a maximum rate of two instructions per cycle. dispatching is facilitated to the iu, fpu, lsu, and sru by the provision of a reservation station at each unit. the dispatch unit performs source and destination register dependency checking, determines dispatch serializations, and inhibits subsequent instruction dispatching as required. for a more detailed overview of instruction dispatch, see section 1.3.6, ?instruction timing.? f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-9 overview 1.1.3.2 branch processing unit (bpu) the bpu receives branch instructions from the fetch unit and performs cr lookahead operations on conditional branches to resolve them early, achieving the effect of a zero-cycle branch in many cases. the bpu uses a bit in the instruction encoding to predict the direction of the conditional branch. therefore, when an unresolved conditional branch instruction is encountered, the core fetches instructions from the predicted target stream until the conditional branch is resolved. the bpu contains an adder to compute branch target addresses and three user-control registers?the link register (lr), the count register (ctr), and the conditional register (cr). the bpu calculates the return pointer for subroutine calls and saves it into the lr for certain types of branch instructions. the lr also contains the branch target address for the branch conditional to link register ( bclr x ) instruction. the ctr contains the branch target address for the branch conditional to count register ( bcctr x ) instruction. the contents of the lr and ctr can be copied to or from any gpr. because the bpu uses dedicated registers rather than gprs or fprs, execution of branch instructions is largely independent from execution of integer and floating-point instructions. 1.1.4 independent execution units the powerpc architecture?s support for independent execution units allows implementation of processors with out-of-order instruction execution. for example, because branch instructions do not depend on gprs or fprs, branches can often be resolved early, eliminating stalls caused by taken branches. the four other execution units and the completion unit are described in the following sections. 1.1.4.1 integer unit (iu) the iu executes all integer instructions. the iu executes one integer instruction at a time, performing computations with its arithmetic logic unit (alu), multiplier, divider, and xer register. most integer instructions are single-cycle instructions. the 32 gprs hold integer operands. stalls due to contention for gprs are minimized by the automatic allocation of rename registers. the g2 core writes the contents of the rename registers to the appropriate gpr when integer instructions are retired by the completion unit. 1.1.4.2 floating-point unit (fpu) the fpu contains a single-precision multiply-add array and the floating-point status and control register (fpscr). the multiply-add array allows the g2 core to efficiently implement multiply and multiply-add operations. the fpu is pipelined so that single- and f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-10 g2 powerpc core reference manual motorola overview double-precision instructions can be issued back-to-back. the 32 fprs are provided to support floating-point operations. stalls due to contention for fprs are minimized by the automatic allocation of rename registers. the g2 core writes the contents of the rename registers to the appropriate fpr when floating-point instructions are retired by the completion unit. the g2 core supports all ieee-754 floating-point data types (normalized, denormalized, nan, zero, and infinity) in hardware, eliminating the latency incurred by software exception routines. 1.1.4.3 load/store unit (lsu) the lsu executes all load and store instructions and provides the data transfer interface between the gprs, fprs, and the cache/memory subsystem. the lsu calculates effective addresses, performs data alignment, and provides sequencing for load/store string and multiple instructions. load and store instructions are issued and executed in program order; however, the memory accesses can occur out of order. synchronizing instructions are provided to enforce strict ordering. cacheable loads, when free of data bus dependencies, can execute out of order with a maximum throughput of one per cycle and a two-cycle total latency. data returned from the cache is held in a rename register until the completion logic commits the value to a gpr or fpr. stores cannot be executed in a predicted manner and are held in the store queue until the completion logic signals that the store operation is to be completed to memory. the core executes store instructions with a maximum throughput of one per cycle and a three-cycle total latency. the time required to perform the actual load or store depends on whether the operation involves the cache, system memory, or an i/o device. 1.1.4.4 system register unit (sru) the sru executes various system-level instructions, including condition register logical operations and move to/from special-purpose register instructions. it also executes integer add/compare instructions. in order to maintain system state, most instructions executed by the sru are completion-serialized; that is, the instruction is held for execution in the sru until all prior instructions issued have completed. results from completion-serialized instructions executed by the sru are not available or forwarded for subsequent instructions until the instruction completes. 1.1.5 completion unit the completion unit tracks instructions in program order from dispatch through execution and then completes. completing an instruction commits the core to any architectural f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-11 overview register changes caused by that instruction. in-order completion ensures the correct architectural state when the core must recover from a mispredicted branch or any exception. instruction state and other information required for completion is kept in a five-entry fifo completion queue. a single completion queue entry is allocated for each instruction once it enters the execution unit from the dispatch unit. an available completion queue entry is a required resource for dispatch; if no completion entry is available, dispatch stalls. a maximum of two instructions per cycle are completed in order from the queue. 1.1.6 memory subsystem support the g2 core provides separate instruction and data caches and mmus. the core also provides an efficient processor bus interface to facilitate access to main memory and other bus subsystems. the memory subsystem support functions are described in the following sections. 1.1.6.1 memory management units (mmus) the g2 core mmus support up to 4 petabytes (2 52 ) of virtual memory and 4 gigabytes (2 32 ) of physical memory (referred to as real memory in the architecture specification) for instruction and data. the mmus also control access privileges for these spaces on block and page granularities. referenced and changed status is maintained by the processor for each page to assist implementation of a demand-paged virtual memory system. note that software assistant is required for the g2 core to maintain reference and changed status. a key bit is implemented to provide information about memory protection violations prior to page table search operations. the lsu calculates effective addresses (eas) for data loads and stores, performs data alignment to and from cache memory, and provides the sequencing for load and store string and multiple word instructions. the instruction unit calculates effective addresses for instruction fetching. after an ea is generated, its higher-order bits are translated by the appropriate mmu into physical address bits. the lower-order ea bits are the same on the physical address which are directed to the on-chip cache and formed the index into a four-way set-associative tag array. after translating the address, the mmu passes the higher-order physical address bits to the cache and the cache lookup completes. for caching-inhibited accesses or accesses that miss in the cache, the untranslated lower-order address bits are concatenated with the translated higher-order address bits; the resulting 32-bit physical address is then used by the memory unit and the system interface to access external memory. the mmu also directs the address translation and enforces the protection hierarchy programmed by the operating system in relation to the supervisor/user privilege level of the access and in relation to whether the access is a load or store. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-12 g2 powerpc core reference manual motorola overview for instruction fetches, the immu looks for the address in the itlb and in the ibat array. if an address hits both, the ibat array translation is used. data accesses cause a lookup in the dtlb and dbat array. in most cases, the translation is in a tlb and the physical address bits are available to the on-chip cache. the g2_le core implements four additional ibat and four additional dbat entries. when the ea misses in the tlbs, the core provides hardware assistance for software to perform a search of the translation tables in memory. the hardware assist consists of the following features: automatic storage of the missed effective address in imiss and dmiss automatic generation of the primary and secondary hashed real address of the page table entry group (pteg), which are readable from the hash1 and hash2 register locations. the hash data is generated from the contents of the imiss or dmiss register. the register that is selected depends on the miss (instruction or data) that was last acknowledged. automatic generation of the first word of the page table entry (pte) of the tables being searched a real page address (rpa) register that matches the format of the lower word of the pte tlb access instructions ( tlbli and tlbld ) that are used to load an address translation into the instruction or data tlbs shadow registers for gpr0?gpr3 that allow miss code to execute without corrupting the state of any of the existing gprs. shadow registers are used only for servicing a tlb miss. see section 1.3.5.2, ?implementation-specific memory management,? for more information about memory management for the core. 1.1.6.2 cache units the g2 core provides independent 16-kbyte, four-way set-associative instruction and data caches. the cache block is 32 bytes long. the caches adhere to a write-back policy, but the g2 core allows control of cacheability, write policy, and memory coherency at the page and block levels. the caches use an lru replacement policy. as shown in figure 1-1, the caches provide a 64-bit interface to the instruction fetch unit and lsu. the surrounding logic selects, organizes, and forwards the requested information to the requesting unit. write operations to the cache can be performed on a byte basis, and a complete read-modify-write operation to the cache can occur in each cycle. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-13 overview the load/store and instruction fetch units provide the caches with the address of the data or instruction to be fetched. in the case of a cache hit, the cache returns two words to the requesting unit. because the data cache tags are single-ported, simultaneous load or store and snoop accesses cause resource contention. snoop accesses have the highest priority and are given first access to the tags, unless the snoop access coincides with a tag write; in this case the snoop is retried and must rearbitrate for cache access. loads or stores deferred due to snoop accesses are performed on the clock cycle following the snoop. 1.1.7 core interface because the caches are on-chip, write-back caches, the most common transactions are burst-read memory operations, burst-write memory operations, and single-beat (noncacheable or write-through) memory read and write operations. there can also be address-only operations, variants of the burst and single-beat operations, (for example, global memory operations that are snooped and atomic memory operations), and address retry activity (for example, when a snooped read access hits a modified cache block). memory accesses can occur in single-beat (1?8 bytes) and four-beat burst (32 bytes) data transfers when the 60x bus is configured as 64 bits, and in single-beat (1?4 bytes), two-beat (8 bytes), and eight-beat (32 bytes) data transfers when the bus is configured as 32 bits. the 60x address and data buses operate independently to support pipelining and split transactions during memory accesses. the core can pipeline its own transactions to a depth of one level. access to the system interface is granted through an external arbitration mechanism that allows devices to compete for bus mastership. this arbitration is flexible, allowing the core to be integrated into systems that implement various fairness and bus parking procedures to avoid arbitration overhead. typically, memory accesses are weakly ordered?sequences of operations, including load/store string and multiple instructions, do not necessarily complete in the order they begin?maximizing the efficiency of the bus without sacrificing coherency of the data. the core allows read operations to precede store operations (except when a dependency exists, or in cases where a noncacheable access is performed), and provides support for a write operation to proceed a previously queued read data tenure (for example, allowing a snoop push to be enveloped by the address and data tenures of a read operation). because the processor can dynamically optimize run-time ordering of load/store traffic, overall performance is improved. 1.1.8 system support functions the g2 core implements several support functions that include power management, time base/decrementer registers for system timing tasks, an ieee 1149.1 (jtag)/common f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-14 g2 powerpc core reference manual motorola overview on-chip processor (cop) test interface, and a phase-locked loop (pll) clock multiplier. these system support functions are described in the following sections. 1.1.8.1 power management the g2 core provides four power modes, selectable by setting the appropriate control bits in the machine state register (msr) and hardware implementation register 0 (hid0). the four power modes are as follows: full-power?this is the default power state of the g2 core. the g2 core is fully powered and the internal functional units are operating at the full processor clock speed. if the dynamic power management mode is enabled, functional units that are idle will automatically enter a low-power state without affecting performance, software execution, or external hardware. doze?all the functional units of the g2 core are disabled except for the time base/decrementer registers and the bus snooping logic. when the processor is in doze mode, an external asynchronous interrupt, system management interrupt, decrementer exception, hard or soft reset, or machine check brings the g2 core into the full-power state. the core in doze mode maintains the pll in a fully-powered state and locked to the system external clock input (core_sysclk) so a transition to the full-power state takes only a few processor clock cycles. nap?the nap mode further reduces power consumption by disabling bus snooping, leaving only the time base register and the pll in a powered state. the core returns to the full-power state upon receipt of an external asynchronous interrupt, system management interrupt, decrementer exception, hard or soft reset, or machine check input (core_ mcp ) signal. a return to full-power state from a nap state takes only a few processor clock cycles. sleep?sleep mode reduces power consumption to a minimum by disabling all internal functional units; then external system logic may disable the pll and core_sysclk. returning the core to the full-power state requires the enabling of the pll and core_sysclk, followed by the assertion of an external asynchronous interrupt, system management interrupt, hard or soft reset, or core_ mcp signal after the time required to relock the pll. 1.1.8.2 time base/decrementer the time base is a 64-bit register (accessed as two 32-bit registers) that is incremented once every four bus clock cycles; external control of the time base is provided through the time base enable (core_tben) signal. the decrementer is a 32-bit register that generates a decrementer interrupt exception after a programmable delay. the contents of the decrementer register are decremented once every four bus clock cycles, and the decrementer exception is generated as the count passes through zero. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-15 powerpc architecture implementation 1.1.8.3 ieee 1149.1 (jtag)/cop test interface the core provides ieee 1149.1 and cop functions for facilitating board testing and chip debugging. the ieee 1149.1 test interface provides a means for boundary-scan testing the core and the attached system logic. the cop function shares the ieee 1149.1 test port, providing a means for executing test routines, and facilitating chip and software debugging. the g2_le core has four additional debug interface signals and three additional breakpoint registers (one instruction and two data breakpoint registers) for debugging purposes. these features expand the functionality of breakpoints and watchpoints. the new breakpoint registers are accessible as sprs. see section 1.3.8, ?debug features (g2_le only),? for more information. there are two additional signals, core_tap_en and core_tlmsel, which allow multiple jtag blocks. see section 8.3.12.6, ?tlm tap enable (core_tap_en)?input,? and section 8.3.12.7, ?test linking module select (core_tlmsel)?output,? for more information. 1.1.8.4 clock multiplier the internal clocking of the g2 core is generated from and synchronized to the external clock signal, core_sysclk, by means of a voltage-controlled oscillator-based pll. the pll provides programmable internal processor clock multiplier ratios which multiply the externally supplied clock frequency. the bus clock is the same frequency and is synchronous with core_sysclk. the configuration of the pll can be read by software from the hardware implementation register 1 (hid1). 1.2 powerpc architecture implementation the powerpc architecture consists of the following layers, and adherence to the powerpc architecture can be measured in terms of which of the following levels of the architecture is implemented: user instruction set architecture (uisa)?defines the base user-level instruction set, user-level registers, data types, floating-point exception model, memory models for a uniprocessor environment, and programming model for a uniprocessor environment. virtual environment architecture (vea)?describes the memory model for a multiprocessor environment, defines cache control instructions, and describes other aspects of virtual environments. implementations that conform to the vea also adhere to the uisa, but may not necessarily adhere to the oea. operating environment architecture (oea)?defines the memory management model, supervisor-level registers, synchronization requirements, and exception model. implementations that conform to the oea also adhere to the uisa and vea. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-16 g2 powerpc core reference manual motorola implementation-specific information the powerpc architecture allows a wide range of designs for such features as cache and system interface implementations. 1.3 implementation-specific information the powerpc architecture is derived from the ibm power architecture (performance optimized with enhanced risc architecture). the powerpc architecture shares the benefits of the power architecture optimized for single-chip implementations. the powerpc architecture design facilitates parallel instruction execution and is scaleable to take advantage of future technological gains. this section describes the powerpc architecture in general and specific details about the implementation of the g2 core as a low-power, 32-bit member of this g2 core family. the main topics addressed are as follows: section 1.3.1, ?register model,? describes the registers for the operating environment architecture common among g2 cores that implement the powerpc architecture and describes the programming model. it also describes the additional registers that are unique to the core. section 1.3.2, ?instruction set and addressing modes,? describes the powerpc instruction set and addressing modes for the oea, and defines and describes the instructions implemented in the core. section 1.3.3, ?cache implementation,? describes the cache model that is defined generally for cores that implement the powerpc architecture by the vea. it also provides specific details about the g2 core cache implementation. section 1.3.4, ?exception model,? describes the exception model of the oea and the differences in the core exception model. section 1.3.5, ?memory management,? describes generally the conventions for memory management among these cores. this section also describes the core implementation of the 32-bit powerpc memory management specification. section 1.3.6, ?instruction timing,? provides a general description of the instruction timing provided by the superscalar, parallel execution supported by the powerpc architecture and the g2 core. section 1.3.7, ?system interface,? describes the signals implemented on the core. the g2 core is a high-performance, superscalar processor core. the powerpc architecture allows optimizing compilers to schedule instructions to maximize performance through efficient use of the powerpc instruction set and register model. the multiple, independent execution units allow compilers to optimize instruction throughput. compilers that take advantage of the flexibility of the powerpc architecture can additionally optimize system performance. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-17 implementation-specific information the following sections summarize the features of the core, including both those that are defined by the architecture and those that are unique to the various core implementations. specific features of the core are listed in section 1.1.1, ?features.? 1.3.1 register model the powerpc architecture defines register-to-register operations for most computational instructions. source operands for these instructions are accessed from the registers or are provided as immediate values embedded in the instruction opcode. the three-register instruction format allows specification of a target register distinct from the two-source operands. load and store instructions transfer data between registers and memory. the g2 core has two levels of privilege?supervisor mode of operation (typically used by the operating system) and user mode of operation (used by the application software). the programming models incorporate 32 gprs, 32 fprs, special-purpose registers (sprs), and several miscellaneous registers. each core also has its own unique set of hardware implementation (hid) registers. having access to privileged instructions, registers, and other resources allows the operating system to control the application environment (providing virtual memory and protecting operating system and critical machine resources). instructions that control the state of the g2 core, the address translation mechanism, and supervisor registers can be executed only when the core is operating in supervisor mode. figure 1-2 shows all the core registers available at the user and supervisor level. the numbers to the right of the sprs indicate the number that is used in the syntax of the instruction operands for the move to/from spr instructions. the following sections describe the g2 core implementation-specific features as they apply to registers. 1.3.1.1 general-purpose registers (gprs) the powerpc architecture defines 32 user-level gprs, which are 32 bits wide in 32-bit cores. the gprs serve as the data source or destination for all integer instructions. 1.3.1.2 floating-point registers (fprs) the powerpc architecture also defines 32 user-level, 64-bit fprs. the fprs serve as the data source or destination for floating-point instructions. these registers can contain data objects of either single- or double-precision floating-point formats. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-18 g2 powerpc core reference manual motorola implementation-specific information figure 1-2. programming model?registers instruction/data address breakpoint register 1 user model spr 1008 hid0 1 spr 1009 hid1 1 instruction/data address breakpoint control 2 ibcr dbcr instruction bat registers spr 528 ibat0u spr 529 ibat0l spr 530 ibat1u spr 531 ibat1l spr 532 ibat2u spr 533 ibat2l spr 534 ibat3u spr 535 ibat3l memory management registers software table search registers 1 spr 976 dmiss spr 977 dcmp spr 978 hash1 spr 979 hash2 spr 980 imiss spr 981 icmp spr 982 rpa configuration registers hardware implementation registers spr268 tbl spr269 tbu spr 1 fpscr condition register general-purpose registers (32-bit) floating-point registers (64-bit) xer xer spr 8 link register lr time base facility (for reading) supervisor model sdr1 spr 25 sdr1 spr 9 count register ctr cr 1 these registers are g2 core implementation-specific (not defined by the powerpc architecture). 2 these registers are g2_le core implementation-specific (not defined by the powerpc architecture). gpr0 gpr1 gpr31 segment registers sr0 sr1 sr15 ibat4u 2 ibat4l 2 ibat5u 2 ibat7l 2 spr 560 spr 561 spr 562 spr 563 spr 564 spr 565 spr 566 spr 567 spr 536 dbat0u spr 537 dbat0l spr 538 dbat1u spr 539 dbat1l spr 540 dbat2u spr 541 dbat2l spr 542 dbat3u spr 543 dbat3l spr 568 dbat4u 2 spr 569 dbat4l 2 spr 570 dbat5u 2 spr 571 dbat5l 2 spr 572 dbat6u 2 spr 573 dbat6l 2 spr 574 dbat7u 2 spr 575 dbat7l 2 machine state register msr system/processor version register spr 286 svr 2 miscellaneous registers spr 1010 spr 1018 spr 1013 1 spr 317 iabr 1 spr 22 decrementer dec spr 282 external address register (optional) ear time base facility (for writing) spr 284 tbl spr 285 tbu spr 309 spr 310 breakpoint registers exception handling registers data address register spr 19 dar sprgs spr 272 sprg0 spr 273 sprg1 spr 274 sprg2 spr 275 sprg3 spr 276 sprg4 2 spr 277 sprg5 2 spr 278 sprg6 2 spr 279 sprg7 2 spr 58 csrr0 spr 59 csrr1 critical interrupt registers 2 dsisr spr 18 dsisr spr 26 srr0 spr 27 srr1 save and restore registers dabr2 2 spr 1011 hid2 1 spr 287 pvr memory base address register mbar 2 spr 311 fpr0 fpr1 fpr31 floating-point status and control register data address register spr 19 dar iabr2 2 dabr 2 ibat5l 2 ibat6u 2 ibat7u 2 ibat6l 2 data bat registers f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-19 implementation-specific information 1.3.1.3 condition register (cr) the cr is a 32-bit user-level register that provides a mechanism for testing and branching. it consists of eight 4-bit fields that reflect the results of certain operations, such as move, integer and floating-point comparisons, arithmetic, and logical operations. 1.3.1.4 floating-point status and control register (fpscr) the user-level fpscr contains all floating-point exception signal bits, exception summary bits, exception enable bits, and rounding control bits needed for compliance with the ieee 754 standard. 1.3.1.5 machine state register (msr) the msr is a supervisor-level register that defines the state of the core. the contents of this register are saved when an exception is taken and restored when the exception handling completes. a critical interrupt exception is taken only in the g2_le core when the core_cint signal is asserted and msr[ce] is set. the g2 core implements the msr as a 32-bit register. 1.3.1.6 segment registers (srs) for memory management, 32-bit processors implement sixteen 32-bit srs. to speed access, the core implements the srs as two arrays; a main array (for data memory accesses) and a shadow array (for instruction memory accesses). loading a segment entry with the move to segment register ( mtsr ) instruction loads both arrays. 1.3.1.7 special-purpose registers (sprs) the oea defines numerous sprs that serve a variety of functions, such as providing controls, indicating status, configuring the core, and performing special operations. during normal execution, a program can access the registers, as shown in figure 1-2, depending on the program?s access privilege (supervisor or user, determined by the privilege-level bit, msr[pr]). note that gprs and fprs are accessed through operands that are part of the instructions. access to registers can be explicit (that is, through the use of specific instructions for that purpose such as move to special-purpose register ( mtspr ) and move from special-purpose register ( mfspr ) instructions) or implicit, as the part of the execution of an instruction. some registers are accessed both explicitly and implicitly. the g2_le core has 29 new/additional supervisor-level sprs, which are shown in figure 1-2. two critical interrupt sprs (csrr0 and csrr1), four additional sprgs (sprg4?sprg7), four pairs of instruction bats (ibat4?ibat7) and four pairs of data bats (dbat4?dbat7), one system version register (svr), one system memory base address (mbar), one instruction address breakpoint control (ibcr) and one data address f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-20 g2 powerpc core reference manual motorola implementation-specific information breakpoint control (dbcr), a new instruction breakpoint register (iabr2), and two data address breakpoint registers (dabr and dabr2) are added to the g2_le core. in the g2 core, all sprs are 32 bits wide. 1.3.1.7.1 user-level sprs the following sprs are accessible by user-level software: link register (lr)?the lr can be used to provide the branch target address and to hold the return address after branch and link instructions. the lr is 32 bits wide in 32-bit implementations. count register (ctr)?the ctr is decremented and tested automatically as a result of branch-and-count instructions. the ctr is 32 bits wide in 32-bit implementations. xer register?the 32-bit xer contains the summary overflow bit, integer carry bit, overflow bit, and a field specifying the number of bytes to be transferred by a load string word indexed ( lswx ) or store string word indexed ( stswx ) instruction. 1.3.1.7.2 supervisor-level sprs the core also contains sprs that can be accessed only by supervisor-level software. these registers consist of the following: the dsisr defines the cause of data access and alignment exceptions. the cause of a dsi exception for a data breakpoint (match with dabr and dabr2) can be determined by the value of the dsisr[dabr] bit (bit 9). the data address register (dar) holds the address of an access after an alignment or dsi exception. for example, it contains the address of the breakpoint match condition. the decrementer register (dec) is a 32-bit decrementing counter that provides a mechanism for causing a decrementer exception after a programmable delay. sdr1 specifies the page table format used in virtual-to-physical address translation for pages. (note that physical address is referred to as real address in the architecture specification.) the machine status save/restore register 0 (srr0) is used for saving the address of the instruction that caused the exception, and the address to return to when a return from interrupt ( rfi ) instruction is executed. the machine status save/restore register 1 (srr1) is used to save machine status on exceptions and to restore machine status when an rfi instruction is executed. the sprg0?sprg3 registers are provided for operating system use, which reduce the latency that may be incurred because of saving registers to memory while in a handler. note that g2_le implements four additional sprgs. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-21 implementation-specific information the external access register (ear) controls access to the external control facility through the external control in word indexed ( eciwx ) and external control out word indexed ( ecowx ) instructions. the time base register (tb) is a 64-bit register that maintains the time of day and operates interval timers. it consists of two 32-bit fields?time base upper (tbu) and time base lower (tbl). the processor version register (pvr) is a read-only register that identifies the version (model) and revision level of the processor. see table 1-6 for the version and revision level of the pvr for the g2 and g2_le processor cores. block address translation (bat) arrays?the powerpc architecture defines 16 bat registers. the g2 core has four pairs of dbat and ibat registers. note that g2_le supports additional bats. see figure 1-2 for a list of the spr numbers for the bat arrays. the following supervisor-level sprs are implementation-specific (not defined in the powerpc architecture): dmiss and imiss are read-only registers that are loaded automatically on an instruction or data tlb miss. hash1 and hash2 contain the physical addresses of the primary and secondary page table entry groups (ptegs). icmp and dcmp contain a duplicate of the first word in the page table entry (pte) for which the table search is looking. the required physical address (rpa) register is loaded by the core with the second word of the correct pte during a page table search. the hardware implementation (hid0 and hid1) registers provide the means for enabling core checkstops and features, and allows software to read the configuration of the pll configuration signals. the hid2 register enables the true little-endian mode, cache way-locking, and the additional bat registers. a new system version register (svr) is added to the g2_le core, that identifies the specific version (model) and revision level of the system-on-a-chip (soc) integration. system memory base address (mbar) is a new implementation-specific register for the g2_le core. it supports a system-level memory map. the instruction address breakpoint register (iabr) is loaded with an instruction address that is compared to instruction addresses in the dispatch queue. when an address match occurs, an instruction address breakpoint exception is generated. to support critical interrupts, two new registers (csrr0 and csrr1) are added to the g2_le core only. four additional sprg registers (sprg4?sprg7) are in the g2_le core f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-22 g2 powerpc core reference manual motorola implementation-specific information block address translation (bat) arrays?the g2_le core has 16 additional bat registers (four pairs of dbat and ibat registers). one additional instruction address breakpoint register (iabr2) and two new data address breakpoint registers (dabr, dabr2) are added to the g2_le (not in g2 core). one instruction breakpoint control (ibcr) and one data breakpoint control (dbcr) are implemented in the g2_le core (not in g2 core). 1.3.2 instruction set and addressing modes the following sections describe the powerpc instruction set and addressing modes in general. 1.3.2.1 powerpc instruction set and addressing modes all powerpc instructions are encoded as single-word (32-bit) opcodes. instruction formats are consistent among all instruction types, permitting efficient decoding to occur in parallel with operand accesses. this fixed instruction length and consistent format simplifies instruction pipelining. the powerpc instructions are divided into the following categories: integer instructions?these include computational and logical instructions. ? integer arithmetic instructions ? integer compare instructions ? integer logical instructions ? integer rotate and shift instructions floating-point instructions?these include floating-point computational instructions, as well as instructions that affect the fpscr. ? floating-point arithmetic instructions ? floating-point multiply/add instructions ? floating-point rounding and conversion instructions ? floating-point compare instructions ? floating-point status and control instructions load/store instructions?these include integer and floating-point load and store instructions. ? integer load and store instructions ? integer load and store multiple instructions ? floating-point load and store f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-23 implementation-specific information ? primitives used to construct atomic memory operations ( lwarx and stwcx. instructions) flow control instructions?these include branching instructions, condition register logical instructions, trap instructions, and other instructions that affect the instruction flow. ? branch and trap instructions ? condition register logical instructions processor control instructions?these instructions are used for synchronizing memory accesses and management of caches, tlbs, and the segment registers. ? move to/from spr instructions ? move to/from msr ? synchronize ? instruction synchronize memory control instructions?these instructions provide control of caches, tlbs, and segment registers. ? supervisor-level cache management instructions ? translation lookaside buffer management instructions. note that there are additional implementation-specific instructions. ? user-level cache instructions ? segment register manipulation instructions the g2 core implements the following instructions which are defined as optional by the powerpc architecture: ? external control in word indexed ( eciwx ) ? external control out word indexed ( ecowx ) ? floating select ( fsel ) ? floating reciprocal estimate single-precision ( fres ) ? floating reciprocal square root estimate ( frsqrte ) ? store floating-point as integer word ( stfiwx ) note that this grouping of instructions does not indicate the execution unit that executes a particular instruction or group of instructions. integer instructions operate on byte, half-word, and word operands. floating-point instructions operate on single-precision (one word) and double-precision (one double word) floating-point operands. the powerpc architecture uses instructions that are 4 bytes long and word-aligned. it provides for byte, half-word, and word operand loads and stores between memory and a set of 32 gprs. it also provides for word and double-word operand loads and stores between memory and a set of 32 fprs. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-24 g2 powerpc core reference manual motorola implementation-specific information computational instructions do not modify memory. to use a memory operand in a computation and then modify the same or another memory location, the memory contents must be loaded into a register, modified, and then written back to the target location with distinct instructions. the g2 core follows the program flow when it is in the normal execution state. however, the flow of instructions can be interrupted directly by the execution of an instruction or by an asynchronous event. either kind of exception may cause one of several components of the system software to be invoked. 1.3.2.2 implementation-specific instruction set the g2 core instruction set is defined as follows: the core provides hardware support for all 32-bit powerpc instructions. the core provides two implementation-specific instructions used for software table search operations following tlb misses: ? load data tlb entry ( tlbld ) ? load instruction tlb entry ( tlbli ) the g2_le implements the following instruction which is added to support critical interrupts. this is a supervisor-level, context synchronizing instruction. ? return from critical interrupt ( rfci ) 1.3.3 cache implementation the following sections describe the general cache characteristics as implemented in the powerpc architecture and the core implementation, specifically. g2_le-specific information is noted where applicable. 1.3.3.1 powerpc cache characteristics the powerpc architecture does not define hardware aspects of cache implementations. the g2 core controls the following memory access modes on a page or block basis: write-back/write-through mode caching-inhibited mode memory coherency note that in the core, a cache block is defined as eight words. the vea defines cache management instructions that provide a means by which the application programmer can affect the cache contents. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-25 implementation-specific information 1.3.3.2 implementation-specific cache implementation the g2 core has two 16-kbyte, four-way set-associative (instruction and data) caches. the caches are physically addressed, and the data cache can operate in either write-back or write-through mode as specified by the powerpc architecture. the data cache is configured as 128 sets of 4 blocks each. each block consists of 32 bytes, 2 state bits, and an address tag. the two state bits implement the three-state mei (modified/exclusive/invalid) protocol. each block contains eight 32-bit words. note that the powerpc architecture defines the term ?block? as the cacheable unit. for the core, the block size is equivalent to a cache line. a block diagram of the data cache organization is shown in figure 1-3. figure 1-3. data cache organization the instruction cache also consists of 128 sets of 4 blocks, and each block consists of 32 bytes, an address tag, and a valid bit. the instruction cache may not be written to, except through a block fill operation. in the g2 core, the instruction cache is blocked only until the critical load completes. the g2 core supports instruction fetching from other instruction cache lines following the forwarding of the critical-first-double-word of a cache line load operation. successive instruction fetches from the cache line being loaded are forwarded, and accesses to other instruction cache lines can proceed during the cache line load operation. the instruction cache is not snooped, and cache coherency must be maintained by software. a fast hardware invalidation capability is provided to support cache maintenance. the organization of the instruction cache is very similar to the data cache shown in figure 1-3. each cache block contains eight contiguous words from memory that are loaded from an 8-word boundary (that is, bits a[27?31] of the effective addresses are zero); thus, a cache block never crosses a page boundary. misaligned accesses across a page boundary can incur a performance penalty. address tag 1 address tag 2 address tag 3 block 1 block 2 block 3 128 sets address tag 0 block 0 8 words/block state state state words 0?7 words 0?7 words 0?7 words 0?7 state f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-26 g2 powerpc core reference manual motorola implementation-specific information the g2 core cache blocks are loaded in four beats of 64 bits each when the core is configured with a 64-bit 60x data bus. when the core is configured with a 32-bit bus, cache block loads are performed with eight beats of 32 bits each. the burst load is performed as critical-double-word-first. the data cache is blocked to internal accesses until the load completes; the instruction cache allows sequential fetching during a cache block load. in the core, the critical-double-word is simultaneously written to the cache and forwarded to the requesting unit, thus minimizing stalls due to load delays. to ensure coherency among caches in a multiprocessor (or multiple caching-device) implementation, the core implements the mei protocol. the following three states indicate the state of the cache block: modified?the cache block is modified with respect to system memory; that is, data for this address is valid only in the cache and not in system memory. exclusive?this cache block holds valid data that is identical to the data at this address in system memory. no other cache has this data. invalid?this cache block does not hold valid data. cache coherency is enforced by on-chip bus snooping logic. because the g2 core data cache tags are single-ported, a simultaneous load or store and snoop access represents a resource contention. the snoop access is given first access to the tags. the load or store then occurs on the clock following the snoop. 1.3.3.3 instruction and data cache way-locking the g2 core implements instruction and data cache way-locking, which guarantees that certain memory accesses will hit in the cache. this provides deterministic access times for those accesses. see chapter 4, ?instruction and data cache operation,? for more information. 1.3.4 exception model this section describes the powerpc exception model and the g2 core implementation, specifically. g2_le core-specific information is noted where applicable. 1.3.4.1 powerpc exception model the powerpc exception mechanism allows the core to change to supervisor state as a result of external signals, errors, or unusual conditions arising in the execution of instructions, and differs from the arithmetic exceptions defined by the ieee for floating-point operations. when exceptions occur, information about the state of the core is saved to certain registers and the core begins execution at an address (exception vector) predetermined for each exception type. processing of exceptions occurs in supervisor mode. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-27 implementation-specific information although multiple exception conditions can map to a single exception vector, a more specific condition may be determined by examining a register associated with the exception?for example, the dsisr and the fpscr. additionally, some exception conditions can be explicitly enabled or disabled by software. the powerpc architecture requires that exceptions be handled in program order; therefore, although a particular implementation may recognize exception conditions out of order, they are presented strictly in order. when an instruction-caused exception is recognized, any unexecuted instructions that appear earlier in the instruction stream, including any that have not yet entered the execute stage, are required to complete before the exception is taken. any exceptions caused by those instructions are handled first. likewise, exceptions that are asynchronous and precise are recognized when they occur, but are not handled until the instruction currently in the completion stage successfully completes execution or generates an exception, and the completed store queue is emptied. unless a catastrophic condition causes a system reset or machine check exception, only one exception is handled at a time. if, for example, a single instruction encounters multiple exception conditions, those conditions are handled sequentially. after the exception handler handles an exception, the instruction execution continues until the next exception condition is encountered. however, in many cases there is no attempt to re-execute the instruction. this method of recognizing and handling exception conditions sequentially guarantees that exceptions are recoverable. exception handlers should save the information stored in srr0 and srr1 early to prevent the program state from being lost due to a system reset or machine check exception or to an instruction-caused exception in the exception handler, and before enabling external interrupts. the powerpc architecture supports four types of exceptions: synchronous, precise?these are caused by instructions. all instruction-caused exceptions are handled precisely; that is, the machine state at the time the exception occurs is known and can be completely restored. this means that (excluding the trap and system call exceptions) the address of the faulting instruction is provided to the exception handler and neither the faulting instruction nor subsequent instructions in the code stream will complete execution before the exception is taken. once the exception is processed, execution resumes at the address of the faulting instruction (or at an alternate address provided by the exception handler). when an exception is taken due to a trap or system call instruction, execution resumes at an address provided by the handler. synchronous, imprecise?the powerpc architecture defines two imprecise floating-point exception modes, recoverable and nonrecoverable. even though the g2 core provides a means to enable the imprecise modes, it implements these modes identically to the precise mode (that is, all enabled floating-point enabled exceptions are always precise on the core). f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-28 g2 powerpc core reference manual motorola implementation-specific information asynchronous, maskable?the external, system management interrupt (smi), and decrementer interrupts are maskable asynchronous exceptions. when these exceptions occur, their handling is postponed until the next instruction, and any exceptions associated with that instruction, completes execution. if there are no instructions in the execution units, the exception is taken immediately on determination of the correct restart address (for loading srr0). asynchronous, nonmaskable?there are two nonmaskable asynchronous exceptions: system reset and the machine check exception. these exceptions may not be recoverable, or may provide a limited degree of recoverability. all exceptions report recoverability through msr[ri]. 1.3.4.2 implementation-specific exception model as specified by the powerpc architecture, all exceptions can be described as either precise or imprecise and either synchronous or asynchronous. asynchronous exceptions (some of which are maskable) are caused by events external to the processor?s execution; synchronous exceptions, which are all handled precisely by the g2 core, are caused by instructions. a system management interrupt is an implementation-specific exception. the exception classes are shown in table 1-3. the exceptions are listed in table 5-3 in order of highest to lowest priority. although exceptions have other characteristics as well, such as whether they are maskable or nonmaskable, the distinctions shown in table 1-3 define categories of exceptions that the core handles uniquely. note that table 1-3 includes no synchronous imprecise instructions. while the powerpc architecture supports imprecise handling of floating-point exceptions, the core implements floating-point exception modes as precise exceptions. the g2 core exceptions, and conditions that cause them, are listed in table 1-4. table 1-3. exception classifications synchronous/asynchronous precise/imprecise exception type asynchronous, nonmaskable imprecise machine check system reset asynchronous, maskable precise external interrupt decrementer system management interrupt critical interrupt synchronous precise instruction-caused exceptions f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-29 implementation-specific information table 1-4. exceptions and conditions exception type vector offset (hex) causing conditions reserved 00000 ? system reset 00100 a system reset is caused by the assertion of either core_sreset or core_hreset . machine check 00200 a machine check is caused by the assertion of the core_tea signal during a data bus transaction, assertion of core_mcp , or an address or data parity error. dsi 00300 the cause of a dsi exception can be determined by the bit settings in the dsisr, listed as follows: 1 set if the translation of an attempted access is not found in the primary hash table entry group (hteg), or in the rehashed secondary hteg, or in the range of a dbat register; otherwise cleared. 4 set if a memory access is not permitted by the page or dbat protection mechanism; otherwise cleared. 5 set by an eciwx or ecowx instruction if the access is to an address that is marked as write-through, or execution of a load/store instruction that accesses a direct-store segment. 6 set for a store operation and cleared for a load operation 9 g 2_le core only. set a data address breakpoint exception when the data (bit 0?28) in the dabr1 or dabr2 matches the next data access (load or store instruction) to complete in the completion unit. the different breakpoints are enabled as follows: write breakpoints enabled when dabr[30] is set read breakpoints enabled when dabr[31] is set 11 set if eciwx or ecowx is used and ear[e] is cleared isi 00400 an isi exception is caused when an instruction fetch cannot be performed for any of the following reasons: the effective (logical) address cannot be translated. that is, there is a page fault for this portion of the translation, so an isi exception must be taken to load the pte (and possibly the page) into memory. the fetch access is to a direct-store segment (indicated by srr1[3] set). the fetch access violates memory protection (indicated by srr1[4] set). if the key bits (ks and kp) in the segment register and the pp bits in the pte are set to prohibit read access, instructions cannot be fetched from this location. external interrupt 00500 an external interrupt is caused when msr[ee] = 1 and the core_int signal is asserted. alignment 00600 an alignment exception is caused when the core cannot perform a memory access for any of the reasons described below: the operand of a floating-point load or store instruction is not word-aligned. the operand of lmw , stmw , lwarx , and stwcx. instructions are not aligned. the execution of a floating-point load or store instruction to a direct-store segment. the operand of a load, store, load multiple, store multiple, load string, or store string instruction crosses a segment boundary into a direct-store segment, or crosses a protection boundary. execution of a misaligned eciwx or ecowx instruction. the instruction is lmw , stmw , lswi , lswx , stswi , stswx , and the g2 core is in little-endian mode. it applies to both powerpc little-endian and le mode for g2_le core. the operand of dcbz is in memory that is write-through-required or caching-inhibited. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-30 g2 powerpc core reference manual motorola implementation-specific information program 00700 a program exception is caused by one of the following exception conditions, which correspond to bit settings in srr1 and arise during execution of an instruction: floating-point enabled exception?a floating-point enabled exception condition is generated when the following condition is met: (msr[fe0] | msr[fe1]) & fpscr[fex] is 1. fpscr[fex] is set by the execution of a floating-point instruction that causes an enabled exception or by the execution of one of the ?move to fpscr? instructions that results in both an exception condition bit and its corresponding enable bit being set in the fpscr. illegal instruction?an illegal instruction program exception is generated when execution of an instruction is attempted with an illegal opcode or illegal combination of opcode and extended opcode fields (including powerpc instructions not implemented in the core), or when execution of an optional instruction not provided in the core is attempted (these do not include those optional instructions that are treated as no-ops). privileged instruction?a privileged instruction type program exception is generated when the execution of a privileged instruction is attempted and the msr register user privilege bit, msr[pr], is set. in the g2 core, this exception is generated for mtspr or mfspr with an invalid spr field if spr[0] = 1 and msr[pr] = 1. this may not be true for all cores that implement the powerpc architecture. trap?a trap type program exception is generated when any of the conditions specified in a trap instruction is met. floating-point unavailable 00800 a floating-point unavailable exception is caused by an attempt to execute a floating-point instruction (including floating-point load, store, and move instructions) when the floating-point available bit is cleared (msr[fp] = 0). decrementer 00900 the decrementer exception occurs when dec[31] changes from 0 to 1. this exception is also enabled with msr[ee]. critical interrupt 00a00 a critical interrupt exception is taken when the core_cint signal is asserted and msr[ce] = 1 (g2_le only). reserved 00b00?00bff ? system call 00c00 a system call exception occurs when a system call ( sc ) instruction is executed. trace 00d00 a trace exception is taken when msr[se] = 1 or when the currently completing instruction is a branch and msr[be] = 1. reserved 00e00 the g2 core does not generate an exception to this vector. other devices may use this vector for floating-point assist exceptions. reserved 00e10?00fff ? instruction translation miss 01000 an instruction translation miss exception is caused when the effective address for an instruction fetch cannot be translated by the itlb. data load translation miss 01100 a data load translation miss exception is caused when the effective address for a data load operation cannot be translated by the dtlb. data store translation miss 01200 a data store translation miss exception is caused when the effective address for a data store operation cannot be translated by the dtlb, or where a dtlb hit occurs, and the change bit in the pte must be set due to a data store operation. table 1-4. exceptions and conditions (continued) exception type vector offset (hex) causing conditions f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-31 implementation-specific information 1.3.5 memory management the following sections describe the memory management features of the powerpc architecture and the g2 core implementation, respectively. 1.3.5.1 powerpc memory management the primary functions of the mmu are to translate logical (effective) addresses to physical addresses for memory accesses and to provide access protection on blocks and pages of memory. the core generates two types of accesses that require address translation?instruction accesses and data accesses to memory generated by load and store instructions. the powerpc mmu and exception model support demand-paged virtual memory. virtual memory management permits execution of programs larger than the size of physical memory; demand-paged implies that individual pages are loaded into physical memory from system memory only when they are first accessed by an executing program. the hashed page table is a variable-sized data structure that defines the mapping between virtual page numbers and physical page numbers. the page table size is a power of two, and its starting address is a multiple of its size. the page table contains a number of page table entry groups (ptegs). a pteg contains eight page table entries (ptes) of 8 bytes each; therefore, each pteg is 64 bytes long. pteg addresses are entry points for table search operations. address translations are enabled by setting bits in the msr?msr[ir] enables instruction address translations and msr[dr] enables data address translations. 1.3.5.2 implementation-specific memory management the instruction and data memory management units in the g2 core provide 4 gbytes of logical address space accessible to supervisor and user programs with a 4-kbyte page size and 256-mbyte segment size. block sizes range from 128 kbytes to 256 mbytes and are instruction address breakpoint 01300 an instruction address breakpoint exception occurs when the address (bits 0?29) in the iabr matches the next instruction to complete in the completion unit, and iabr[bit 30] is set. system management interrupt 01400 a system management interrupt is caused when msr[ee] = 1 and the core_smi input signal is asserted. reserved 01500?02fff ? table 1-4. exceptions and conditions (continued) exception type vector offset (hex) causing conditions f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-32 g2 powerpc core reference manual motorola implementation-specific information software selectable. in addition, the core uses an interim 52-bit virtual address and hashed page tables for generating 32-bit physical addresses. the mmus in the g2 core rely on the exception processing mechanism for the implementation of the paged virtual memory environment and for enforcing protection of designated memory areas. instruction and data tlbs provide address translation in parallel with the on-chip cache access, incurring no additional time penalty in the event of a tlb hit. a tlb is a cache of the most recently used page table entries. software is responsible for maintaining the consistency of the tlb with memory. the core tlbs are 64-entry, two-way set-associative caches that contain instruction and data address translations. the core provides hardware assist for software table search operations through the hashed page table on tlb misses. supervisor software can invalidate tlb entries selectively. for instructions and data that maintain address translations for blocks of memory, the g2 core and the g2_le core provide independent four- and eight-entry bat arrays, respectively. these entries define blocks that can vary from 128 kbytes to 256 mbytes. the bat arrays are maintained by system software. hid2[hbe] is added to the g2_le for enabling or disabling the four additional pairs of bat registers. however, regardless of the setting of hid2[hbe], these bats are accessible by mfspr and mtspr . as specified by the powerpc architecture, the hashed page table is a variable-sized data structure that defines the mapping between virtual page numbers and physical page numbers. the page table size is a power of two, and its starting address is a multiple of its size. also as specified by the powerpc architecture, the page table contains a number of ptegs. a pteg contains 8 ptes of 8 bytes each; therefore, each pteg is 64 bytes long. pteg addresses are entry points for table search operations. 1.3.6 instruction timing the g2 core is a pipelined superscalar processor core. because instruction processing is reduced into a series of stages, an instruction does not require all of the resources of an execution unit at the same time. for example, after an instruction completes the decode stage, it can pass on to the next stage, while the subsequent instruction can advance into the decode stage. this improves the throughput of the instruction flow. for example, it may take three cycles for a single floating-point instruction to execute, but if there are no stalls in the floating-point pipeline, a series of floating-point instructions can have a throughput of one instruction per cycle. the core instruction pipeline has four major pipeline stages, described as follows: the fetch pipeline stage primarily involves retrieving instructions from the memory system and determining the location of the next instruction fetch. additionally, if possible, the bpu decodes branches during the fetch stage and folds out branch instructions before the dispatch stage. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-33 implementation-specific information the dispatch pipeline stage is responsible for decoding the instructions supplied by the instruction fetch stage, and determining which of the instructions are eligible to be dispatched in the current cycle. in addition, the source operands of the instructions are read from the appropriate register file and dispatched with the instruction to the execute pipeline stage. at the end of the dispatch pipeline stage, the dispatched instructions and their operands are latched by the appropriate execution unit. in the execute pipeline stage, each execution unit with an executable instruction executes the selected instruction (perhaps over multiple cycles), writes the instruction's result into the appropriate rename register, and notifies the completion stage when the execution has finished. in the case of an internal exception, the execution unit reports the exception to the completion/write-back pipeline stage and discontinues instruction execution until the exception is handled. the exception is not signaled until that instruction is the next to be completed. execution of most floating-point instructions is pipelined within the fpu allowing up to three instructions to be executing in the fpu concurrently. the fpu pipeline stages are multiply, add, and round-convert. the lsu has two pipeline stages. the first stage is for effective address calculation and mmu translation, and the second is for accessing data in the cache. the complete/write-back pipeline stage maintains the correct architectural machine state and transfers the contents of the rename registers to the gprs and fprs as instructions are retired. if the completion logic detects an instruction causing an exception, all following instructions are canceled, their execution results in rename registers are discarded, and instructions are fetched from the correct instruction stream. a superscalar processor core issues multiple independent instructions into multiple pipelines allowing instructions to execute in parallel. the g2 core has five independent execution units, one each for integer instructions, floating-point instructions, branch instructions, load/store instructions, and system register instructions. the iu and the fpu each have dedicated register files for maintaining operands (gprs and fprs, respectively), allowing integer and floating-point calculations to occur simultaneously without interference. integer division performance of the g2 core has been improved, with the divwu x and divw x instructions executing in 20 clock cycles instead of the 37 cycles required in the mpc603e. the core provides support for single-cycle store and it provides an adder/comparator in the system register unit that allows the dispatch and execution of multiple integer add and compare instructions on each cycle. refer to chapter 7, ?instruction timing,? for more information. because the powerpc architecture can be applied to such a wide variety of implementations, instruction timing among processor cores varies accordingly. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-34 g2 powerpc core reference manual motorola implementation-specific information 1.3.7 system interface the system interface is specific for each processor core implementation. the g2 core provides a versatile system interface that allows for a wide range of implementations. the interface includes a 32-bit 60x address bus, a 32- or 64-bit 60x data bus, and 56 control and information signals (see figure 1-4). the system interface allows for address-only transactions, as well as address and data transactions. the core control and information signals include the address arbitration, address start, address transfer, transfer attribute, address termination, data arbitration, data transfer, data termination, and core state signals. test and control signals provide diagnostics for selected internal circuits. figure 1-4. system interface the system interface supports bus pipelining, allowing the address tenure of one transaction to overlap the data tenure of another. the extent of the pipelining depends on external arbitration and control circuitry. similarly, the core supports split-bus transactions for systems with multiple potential bus masters?one device can have mastership of the address bus while another has mastership of the data bus. allowing multiple bus transactions to occur simultaneously increases the available bus bandwidth for other activity, and as a result, improves performance. the g2 core supports multiple masters through a bus arbitration scheme that allows various devices to compete for the shared bus resource. arbitration logic can implement priority protocols, such as fairness, and can park masters to avoid arbitration overhead. the mei protocol ensures coherency among multiple devices and system memory. also, the core on-chip caches, tlbs, and optional second-level caches can be controlled externally. the core clocking structure allows the bus to operate at integer multiples of the core cycle time. g2 core 1.5 v address arbitration transfer attribute address transfer address start clocks data arbitration data termination interrupt, checkstops debug control jtag/cop interface processor status output enable input enable high-impedance control data transfer address termination test interface reset f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-35 implementation-specific information the following sections describe the core bus support for memory operations. note that some signals perform different functions depending on the addressing protocol used. 1.3.7.1 memory accesses the g2 core 60x bus is configured at power-up to either a 32- or 64-bit width. when the core is configured with a 32-bit 60x bus, memory accesses allow transfer sizes of 8, 16, 24, or 32 bits in one bus clock cycle. data transfers occur in either single-beat transactions, two-beat or eight-beat burst transactions, with a single-beat transaction transferring as many as 32 bits. single- or double-beat transactions are caused by noncached accesses that access memory directly (that is, reads and writes when caching is disabled, caching-inhibited accesses, and stores in write-through mode). eight-beat burst transactions, which always transfer an entire cache block (32 bytes), are initiated when a line is read from or written to memory. when the core is configured with a 64-bit 60x bus, memory accesses allow transfer sizes of 8, 16, 24, 32, 40, 48, 56, or 64 bits in one bus clock cycle. data transfers occur in either single-beat transactions or four-beat burst transactions. single-beat transactions are caused by noncached accesses that access memory directly (that is, reads and writes when caching is disabled, caching-inhibited accesses, and stores in write-through mode). four-beat burst transactions, which always transfer an entire cache block (32 bytes), are initiated when a line is read from or written to memory. 1.3.7.2 signals the g2 core signals are grouped as follows: address arbitration signals?the g2 core uses these signals to arbitrate for 60x address bus mastership. address transfer start signals?these signals indicate that a bus master has begun a transaction on the address bus of the 60x bus. address transfer signals?these signals, consisting of the address bus, address parity, and address parity error signals, are used to transfer the address and to ensure the integrity of the transfer. transfer attribute signals?these signals provide information about the type of transfer, such as the transfer size and whether the transaction is bursted, write-through, or caching-inhibited. address transfer termination signals?these signals are used to acknowledge the end of the address phase of the transaction. they also indicate whether a condition exists that requires the address phase to be repeated. data arbitration signals?the g2 core uses these signals to arbitrate for 60x data bus mastership. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-36 g2 powerpc core reference manual motorola implementation-specific information data transfer signals?these signals, consisting of the data bus, data parity, and data parity error signals, are used to transfer the data and to ensure the integrity of the transfer. data transfer termination signals?data termination signals are required after each data beat in a data transfer. in a single-beat transaction, the data termination signals also indicate the end of the tenure. in burst accesses, the data termination signals apply to individual beats and indicate the end of the tenure only after the final data beat. they also indicate whether a condition exists that requires the data phase to be repeated. output enable signals?these output signals indicate that the corresponding outputs of the g2 core are driving, provided the corresponding high-impedance control signal is also asserted. high-impedance control signals?these input signals (static) enable the operation of the output enable signals. input enable signals?these output signals indicate that the corresponding input signals are being received by the core, provided the corresponding high-impedance control signal is also asserted. system status signals?these signals include the external interrupt signals, checkstop signals, and both soft- and hard-reset signals. these signals are used to interrupt and, under various conditions, to reset the core. reset configuration signals?these signals are sampled while core_hreset is asserted and they control certain modes of operation. jtag/cop interface signals?the jtag (ieee 1149.1) interface and common on-chip processor (cop) unit provides a serial interface to the system for performing monitoring and boundary tests. processor status?these signals include the memory reservation signal, machine quiesce control signals, time base enable signal, and core_tlbisync signal. clock signals?these signals provide for system clock input and frequency control. test interface signals?signals like address matching, combinational matching and watchpoint are used in the g2_le for production testing. seven additional signals are added to the g2_le core to support true little-endian mode (core_tle), the critical interrupt function (core_cint ), the breakpoint state outputs (core_iabr , core_iabr2 , core_dabr , and core_dabr2 ), and the debug features (core_tdo_oe). f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-37 implementation-specific information note a bar over a signal name indicates that the signal is active low?for example, core_artry_in (address retry) and core_ts_in (transfer start). active-low signals are referred to as asserted (active) when they are low and negated when they are high. signals that are not active low, such as core_ap_in[0:3] (address bus parity signals) and core_tt_in[0:4] (transfer type signals) are referred to as asserted when they are high and negated when they are low. 1.3.8 debug features (g2_le only) some new debug features are specific to the g2_le core. accesses to the debug facilities are available only in supervisor mode by using the mtspr and mfspr instructions. the g2_le provides the following additional features in the jtag/cop interface: addition of three breakpoint registers?iabr2, dabr, and dabr2 two new breakpoint control registers?dbcr and ibcr inclusion of four breakpoint signals?core_iabr , core_iabr2 , core_dabr , and core_dabr2 if instruction or data breakpoints are set to match with any exception vector, an unrecoverable state occurs. also, instruction or data breakpoints must not be set to match any address used in the breakpoint exception handlers. a breakpoint that matches within an exception handler can cause an indeterminate or unrecoverable processor state. 1.3.8.1 instruction address breakpoint registers (iabr and iabr2) iabr and iabr2 can be used to cause a breakpoint exception if a specified instruction address is encountered. iabr and iabr2 control the instruction address breakpoint exception. iabr[cea] holds an effective address to which each instruction?s address is compared. the exception is enabled by setting iabr[30]. the exception is taken when there is an instruction address breakpoint match on the next instruction to complete. the instruction address match does not complete before the breakpoint exception is taken but the address of that instruction is stored in srr0. upon execution of an rfi instruction, the instruction addressed in srr0 is retired, meaning that the results are committed to the destination registers or memory address. note that iabr is implemented in both the g2 core and the g2_le core; iabr2 is an implementation-specific register for the g2_le core only. also, note that ibcr gives further control of instruction breakpoints for the g2_le core. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-38 g2 powerpc core reference manual motorola implementation-specific information 1.3.8.2 data address breakpoint registers (dabr and dabr2) dabr and dabr2 cause a breakpoint exception (subset of the dsi exception) if there is a match between the cea field and the address of any data access and the data breakpoint is enabled. dabr[cea] and dabr2[cea] hold an effective address to which each data access address is compared. in addition, data breakpoints are enabled for write and read accesses individually by setting bit 30 and bit 31 of the dabr, respectively. finally, the data address breakpoint translation bit (dabr[bt]) must match msr[dr] for a match to occur. the data access that causes a match is not performed before the data breakpoint exception is taken. when the exception occurs, the dar is set to the address of the data access that caused the breakpoint, and dsisr[9] is set. the address of the instruction associated with the matching data access is saved in srr0. upon execution of an rfi instruction, the instruction addressed in srr0 is retired, and all results are committed to the destination address in memory. 1.3.8.3 breakpoint signaling the breakpoint signaling provided on the g2_le core allows observability of breakpoint matches external to the core. the core_iabr , core_iabr2 , core_dabr , and core_dabr2 breakpoint signals are asserted for at least one bus clock cycle when the respective breakpoint occurs. when dbcr and ibcr are configured for an or combinational signal type, the breakpoint signals core_iabr , core_iabr2 and core_dabr , core_dabr2 reflect their respective breakpoints. when the dbcr and ibcr are configured for and combinational signal type, only the core_iabr2 and core_dabr2 breakpoint signals are asserted after the and condition is met (both instruction breakpoints occurred or both data breakpoints occurred). the breakpoint signaling conditions are described in chapter 11, ?debug features.? 1.3.8.4 other debug resources in addition to the four breakpoint registers and two breakpoint control registers, other internal register values control and observe the effects of breakpoint conditions. table 1-5 shows these registers and their bits. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-39 differences between the mpc603e and the g2 and g2_le cores 1.4 differences between the mpc603e and the g2 and g2_le cores table 1-6 describes the differences between the mpc603e and the g2 and g2_le cores. note that the g2 core has similar functionality to the mpc603e processor. however, the minor differences between them are documented by footnotes. table 1-5. other debug and support register bits register bits name description msr 17 pr privilege level. breakpoint registers can only be accessed when this bit is cleared (supervisor mode). 21 se single-step trace enable 0 the processor executes instructions normally 1 the processor generates a trace exception on the successful completion of the next instruction 22 be branch trace enable 0 the processor executes branch instructions normally 1 the processor generates a trace exception on the successful completion of a branch instruction hid0 0?31 ? see table 2-5 for details dar 0?31 ? data address register. dar is loaded with the effective address of a data breakpoint condition that matches. dsisr 9 dabr set if dabr exception occurs table 1-6. differences between g2 and g2_le cores g2 core g2_le core impact new pvr register value 1 new pvr register value the g2 core version number is 0x8081 and the revision level starts at 0x1010 and changes for each revision of the core. the g2_le core version number is 0x8082 and the revision level starts at 0x1010 and changes for each revision of the core. big-endian or modified little-endian modes core_tle is a new signal for enabling true little-endian mode at reset true little-endian mode (for g2_le only) for compatibility with other true little-endian devices. true little-endian mode is supported in the g2_le core to minimize the impact on software porting from true little-endian systems. unlike other devices that implement the powerpc architecture, g2_le supports true big-endian, true little-endian, and modified little-endian mode of operations. only one external interrupt signal (core_int ) an additional input interrupt signal, core_cint , implements a critical interrupt function. msr[ce] is allocated for enabling the critical interrupt ? a new instruction is implemented for critical interrupt return from critical interrupt ( rfci ) is implemented to return from these exception handlers f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-40 g2 powerpc core reference manual motorola differences between the mpc603e and the g2 and g2_le cores ? vector offset for critical interrupt an exception vector offset of 0x00a00 is defined for critical interrupt ? two new registers are implemented for saving processor state for critical interrupts csrr0 and csrr1 have the same bit assignments as srr0 and srr1, respectively. supports instruction cache way-locking in addition to entire instruction cache locking supports instruction cache way-locking in addition to entire instruction cache locking hid2 register controls instruction cache way-locking. the instruction cache way-locking is useful for locking blocks of instructions into the instruction cache for time-critical applications that require deterministic behavior. supports data cache way-locking in addition to entire data cache locking supports data cache way-locking in addition to entire data cache locking hid2 register controls data cache way-locking. it is useful for locking blocks of data into the data cache for time-critical applications where deterministic behavior is required. sprg0?sprg3 are the four sprg registers in the mpc603e and the g2 core four additional sprg registers are implemented in g2_le core only the additional sprgs reduce latencies that may be incurred from saving registers to memory while in an exception handler g2 core has five jtag/cop interface signals one additional jtag/cop interface signal is implemented in the g2_le the core_tdo_oe output signal is used for debugging. note that core_tdo is always driven, regardless of the state of core_tdo_oe. instruction address breakpoint exception is controlled by iabr instruction address breakpoint exception is controlled by iabr and iabr2 instruction address breakpoint exceptions in both the g2 and the g2_le cores use the 0x01300 vector offset ? two new data address breakpoint registers are implemented in the g2_le the two new data address breakpoint registers (dabr and dabr2) expand the debug functionality of the breakpoints. the new breakpoint registers are accessible as sprs with mtspr and mfspr . ? one instruction register and one data breakpoint control register are implemented ibcr and dbcr are implemented to support the additional debug features. these registers are accessible as sprs with mtspr and mfspr . ? breakpoint signals are implemented for debug breakpoint signals?core_iabr , core_iabr2 , core_dabr , core_dabr2 ?are asserted to indicate a breakpoint condition as programmed in dbcr and ibcr. these signals may be or?d or and?d to reflect the respective breakpoints. ? vector offset for data address breakpoint exception is 0x00300 data address breakpoint exception is a dsi exception. the cause of a dsi exception can be determined by the bit settings of dsisr[9]. dar contains the address of the breakpoint match condition. ? one new register is implemented for supporting system level memory map system memory base address register (mbar) can be accessed with mtspr or mfspr using spr311 in supervisor mode. it can store the present memory base address for the system memory map. table 1-6. differences between g2 and g2_le cores (continued) g2 core g2_le core impact f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 1. overview 1-41 differences between the mpc603e and the g2 and g2_le cores ? one new register is implemented for identifying specific version and revision level of the system-on-a-chip (soc) the system version register (svr) can be accessed with mfspr using spr286. this register is programmed externally by the chip-integrator. the g2 core has four pairs of data and four pairs of instruction bat registers the g2_le has eight pairs of data and eight pairs of instruction bat registers ibat4?ibat7 are the four additional pairs of instruction bats and dbat4?dbat7 are the four additional data bats in g2_le only. hid2[hbe] is added to the g2_le for enabling or disabling the four additional pairs of bat registers. these bats are accessible by the mfspr and mtspr instructions regardless of the setting of hid2[hbe]. hid0?hid2 are the three unique hardware implementation registers for the g2 core 2 new bits are defined in hid2 for enabling the high bats and true little-endian mode hid0 and hid1 provide the means for enabling core checkstops and features and allows software to read the configuration of pll configuration signals. hid2 enables cache way-locking; it also enables the true little-endian mode and the new additional bat registers, for the g2_le core. ? the lssd test control and the scan chain connections are rearranged in the g2_le new test integration requirements ? g2_le has seven additional signals for address matching, combinational matching, and breakpoints. the g2_le core implements the following additional features: to support true little-endian mode core_tle is implemented to support critical interrupt function core_cint is implemented to support breakpoint state output, core_iabr , core_iabr2 , core_dabr , and core_dabr2 are implemented to support additional debug features core_tdo_oe is added 1 the mpc603e processor version number is 6 for pid6-603e and 7 for the pid7t-603e. the revision level starts at 0x0100 and changes for each revision of the mpc603e. 2 hid0?hid1 are the two unique hardware implementation registers for the mpc603e. table 1-6. differences between g2 and g2_le cores (continued) g2 core g2_le core impact f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 1-42 g2 powerpc core reference manual motorola differences between the mpc603e and the g2 and g2_le cores f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 2. register model 2-1 chapter 2 register model this chapter describes the powerpc register model and specific implementation on the g2 and g2_le core. 2.1 register set this section describes the register organization in the g2 core as defined by the three levels of the powerpc architecture?user instruction set architecture (uisa), virtual environment architecture (vea), and operating environment architecture (oea), as well as the core implementation-specific registers. full descriptions of the basic register set defined by the powerpc architecture are provided in chapter 2, ?register set,? in the programming environments manual . the powerpc architecture defines register-to-register operations for all computational instructions. source data for these instructions is accessed from the on-chip registers or is provided as an immediate value embedded in the opcode. the three-register instruction format allows specification of a target register distinct from the two source registers, thus preserving the original data for use by other instructions and reducing the number of instructions required for certain operations. data is transferred between memory and registers with explicit load and store instructions only. note that there may be registers common to other processors of this family that are not implemented in the g2 core. when the core detects special-purpose register (spr) encodings other than those defined in this document, it either takes an exception or it treats the instruction as a no-op. (note that exceptions are referred to as interrupts in the architecture specification.) conversely, some sprs in the g2 core may not be implemented in other processors or may not be implemented in the same way. 2.1.1 powerpc register set the uisa registers, shown in figure 2-1, can be accessed by either user- or supervisor-level instructions (the architecture specification refers to user- and supervisor-level as problem state and privileged state, respectively). the general-purpose registers (gprs) and floating-point registers (fprs) are accessed through instruction operands. access to registers can be explicit (that is, through the use of specific instructions f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 2-2 g2 powerpc core reference manual motorola register set for that purpose, such as the mtspr and mfspr instructions) or implicit as part of the execution (or side effect) of an instruction. some registers are accessed both explicitly and implicitly. figure 2-1 describes both the registers in the g2 core and the additional registers of the g2_le core. all g2 core registers are present in the g2_le core. also note that the implementation-specific registers for the g2 and g2_le cores are shown in figure 2-1. the number to the right of the register name indicates the number that is used in the syntax of the instruction operands to access the register (for example, the number used to access the xer is spr1). for more information on the powerpc register set, refer to chapter 2, ?register set,? in the programming environments manual . the g2 core user-level registers are described as follows: user-level registers (uisa)?the user-level registers can be accessed by all software with either user or supervisor privileges. the user-level register set includes the following: ? general-purpose registers (gprs). the gpr file consists of thirty-two 32-bit gprs designated as gpr0?gpr31. this register file serves as the data source or destination for all integer instructions and provides data for generating addresses. ? floating-point registers (fprs). the fpr file consists of thirty-two 64-bit fprs designated as fpr0?fpr31, which serves as the data source or destination for all floating-point instructions. these registers can contain data objects of either single- or double-precision floating-point format. before the stfd instruction is used to store the contents of an fpr to memory, the fpr must have been initialized after reset (explicitly loaded with any value) by using a floating-point load instruction. ? condition register (cr). the cr consists of eight 4-bit fields, cr0?cr7, that reflect the results of certain arithmetic operations and provides a mechanism for testing and branching. ? floating-point status and control register (fpscr). the fpscr contains all floating-point exception signal bits, exception summary bits, exception enable bits, and rounding control bits needed for compliance with the ieee 754 standard. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 2. register model 2-3 register set figure 2-1. programming model?registers instruction/data address breakpoint register 1 user model spr 1008 hid0 1 spr 1009 hid1 1 instruction/data address breakpoint control 2 ibcr dbcr instruction bat registers spr 528 ibat0u spr 529 ibat0l spr 530 ibat1u spr 531 ibat1l spr 532 ibat2u spr 533 ibat2l spr 534 ibat3u spr 535 ibat3l memory management registers software table search registers 1 spr 976 dmiss spr 977 dcmp spr 978 hash1 spr 979 hash2 spr 980 imiss spr 981 icmp spr 982 rpa configuration registers hardware implementation registers spr268 tbl spr269 tbu spr 1 fpscr condition register general-purpose registers (32-bit) floating-point registers (64-bit) xer xer spr 8 link register lr time base facility (for reading) supervisor model sdr1 spr 25 sdr1 spr 9 count register ctr cr 1 these registers are g2 core implementation-specific (not defined by the powerpc architecture). 2 these registers are g2_le core implementation-specific (not defined by the powerpc architecture). gpr0 gpr1 gpr31 segment registers sr0 sr1 sr15 ibat4u 2 ibat4l 2 ibat5u 2 ibat7l 2 spr 560 spr 561 spr 562 spr 563 spr 564 spr 565 spr 566 spr 567 spr 536 dbat0u spr 537 dbat0l spr 538 dbat1u spr 539 dbat1l spr 540 dbat2u spr 541 dbat2l spr 542 dbat3u spr 543 dbat3l spr 568 dbat4u 2 spr 569 dbat4l 2 spr 570 dbat5u 2 spr 571 dbat5l 2 spr 572 dbat6u 2 spr 573 dbat6l 2 spr 574 dbat7u 2 spr 575 dbat7l 2 machine state register msr system/processor version register spr 286 svr 2 miscellaneous registers spr 1010 spr 1018 spr 1013 1 spr 317 iabr 1 spr 22 decrementer dec spr 282 external address register (optional) ear time base facility (for writing) spr 284 tbl spr 285 tbu spr 309 spr 310 breakpoint registers exception handling registers data address register spr 19 dar sprgs spr 272 sprg0 spr 273 sprg1 spr 274 sprg2 spr 275 sprg3 spr 276 sprg4 2 spr 277 sprg5 2 spr 278 sprg6 2 spr 279 sprg7 2 spr 58 csrr0 spr 59 csrr1 critical interrupt registers 2 dsisr spr 18 dsisr spr 26 srr0 spr 27 srr1 save and restore registers dabr2 2 spr 1011 hid2 1 spr 287 pvr memory base address register mbar 2 spr 311 fpr0 fpr1 fpr31 floating-point status and control register data address register spr 19 dar iabr2 2 dabr 2 ibat5l 2 ibat6u 2 ibat7u 2 ibat6l 2 data bat registers f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 2-4 g2 powerpc core reference manual motorola register set the remaining user-level registers are sprs. note that the powerpc architecture provides a separate mechanism for accessing sprs (the mtspr and mfspr instructions). these instructions are commonly used to explicitly access certain registers, while other sprs may be accessed as the side effect of executing other instructions. ? xer register (xer). the 32-bit xer indicates overflow and carries for integer operations. it is set implicitly by many instructions. ? link register (lr). the 32-bit lr provides the branch target address for the branch conditional to link register ( bclr x ) instruction and can optionally be used to hold the logical address (referred to as the effective address in the architecture specification) of the instruction that follows a branch and link instruction, typically used for linking to subroutines. ? count register (ctr). the 32-bit ctr can be used to hold a loop count that can be decremented during execution of appropriately coded branch instructions. it can also provide the branch target address for the branch conditional to count register ( bcctr x ) instruction. user-level registers (vea)?the vea introduces the time base facility (tb) for reading. the tb is a 64-bit register pair whose contents are incremented once every four bus clock cycles. the tb consists of two 32-bit registers?time base upper (tbu) and time base lower (tbl). note that the time base registers are read-only in user state. the core supervisor-level registers are described as follows: supervisor-level registers (oea)?the oea defines the registers an operating system uses for memory management, configuration, and exception handling. the powerpc architecture defines the following supervisor-level registers: ? configuration registers ? processor version register (pvr). this read-only register identifies the version (model) and revision level of this processor core. the contents of the pvr can be copied to a gpr by the mfspr instruction. read access to the pvr is supervisor-level only; write access is not provided. the pvr consists of the fields as described in table 2-1. table 2-1. pvr field descriptions bits name description 0?3 cid company or manufacturer id number. for motorola and motorola licensees, bit 0 is set to one. motorola?s code is 0b1000. 4?5 ? reserved 6?9 pt processor id type. optional field to identify different versions of the same processor [pid]; must read as zero if unused. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 2. register model 2-5 register set note that the powerpc architecture defines this register in more general terms than defined in table 2-1. architecturally, the pvr consists of two 16-bit fields as described in table 2-2. implementation note ?the g2 core version number is 0x8081 and the revision level starts at 0x1010 and changes for each revision of the core. the g2_le core version number is 0x8082 and the revision level starts at 0x2010 and changes for each revision of the core. table 2-3 describes some of the pvr values for g2-related devices. 10?15 pid 1 processor identification. this field is used to indicate different implementations of the powerpc architecture. 16?19 proc process revision. this field identifies the relative process changes and revisions. 20?23 mfg manufacturing revision. this optional field identifies relative manufacturing revisions and changes. this was formerly the major processor design revision indicator (in the mpc603e). 24?27 mjrev major processor design revision indicator 28?31 mnrev minor processor design revision indicator 1 the pid values are assigned by the powerpc architecture group. table 2-2. architectural pvr field descriptions bits name description 0?15 version a 16-bit number that uniquely identifies a particular processor version. this number can be used to determine the version of a processor; it may not distinguish between different end product models if more than one model uses the same processor. 16?31 revision a 16-bit number that distinguishes between various releases of a particular version (that is, an engineering change level). the value of the revision portion of the pvr is implementation-specific. the processor revision level is changed for each revision of the device. table 2-3. assigned pvr values device name version no. revision no. mpc603r (pid7) 0x0007 0x1201 g2 core?original 0x0081 0x0011 g2 core (g2h4) 0x8081 0x1010 g2 core (general-purpose) 0x8082 0x1010 g2 core (licensee-specific) 0x9081 0x0010 g2_le core (licensee-specific) 0x8082 0x0010 g2_le core (general-purpose) 0x8082 0x2010 g2_le core (licensee-specific) 0xa082 0x2010 mpc603e (pid6) 0x0006 0x0101 table 2-1. pvr field descriptions (continued) bits name description f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 2-6 g2 powerpc core reference manual motorola register set ? machine state register (msr). the msr defines the state of the processor. the msr can be modified by the move to machine state register ( mtmsr ), system call ( sc ), and return from exception ( rfi ) and return from critical exception ( rfci ) instructions. it can be read by the move from machine state register ( mfmsr ) instruction. implementation note ?the g2 core defines msr[13] as the power management enable (pow) bit and msr[14] as the temporary gpr remapping (tgpr) bit. the g2_le allocates msr[24] for enabling the critical interrupt and rfci, the return from critical interrupt instruction. msr[31] is used in conjunction with hid2[let] to indicate the endian mode of operation of the g2_le core. these bits are described in table 2-4. mpc603e (pid7v) 0x0007 0x0100, 0x0201 space for future versions table 2-4. msr bit settings bits name description 0 ? reserved. full function. 1?4 ? reserved. partial function. 5?9 ? reserved. full function. 10?12 ? reserved. partial function. 13 pow power management enable (implementation-specific) 0 disables programmable power modes (normal operation mode) 1 enables programmable power modes (nap, doze, or sleep mode). this bit controls the programmable power modes only; it has no effect on dynamic power management (dpm). msr[pow] may be altered with an mtmsr instruction only. also, when altering the pow bit, software may alter only this bit in the msr and no others. the mtmsr instruction must be followed by a context-synchronizing instruction. see chapter 10, ?power management,? for more information. 14 tgpr temporary gpr remapping (implementation-specific) 0 normal operation 1 tgpr mode. gpr0?gpr3 are remapped to tgpr0?tgpr3 for use by tlb miss routines. the contents of gpr0?gpr3 remain unchanged while msr[tgpr] = 1. attempts to use gpr4?gpr31 with msr[tgpr] = 1 yield undefined results. temporarily replaces tgpr0?tgpr3 with gpr0?gpr3 for use by tlb miss routines. the tgpr bit is set when either an instruction tlb miss, data read miss, or data write miss exception is taken. the tgpr bit is cleared by an rfi instruction. table 2-3. assigned pvr values (continued) device name version no. revision no. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 2. register model 2-7 register set 15 ile exception little-endian mode. when an exception occurs, this bit is copied into msr[le] to select the endian mode for the context established by the exception. 16 ee external interrupt enable 0 the processor ignores external interrupts, system management interrupts, and decrementer interrupts. 1 the processor is enabled to take an external interrupt, system management interrupt, or decrementer interrupt. 17 pr privilege level 0 the processor can execute both user- and supervisor-level instructions 1 the processor can only execute user-level instructions 18 fp floating-point available 0 the processor prevents dispatch of floating-point instructions, including floating-point loads, stores, and moves. 1 the processor can execute floating-point instructions, and can take floating-point enabled exception type program exceptions. 19 me machine check enable 0 machine check exceptions are disabled 1 machine check exceptions are enabled 20 fe0 floating-point exception mode 0 (see table 5-8) 21 se single-step trace enable 0 the processor executes instructions normally 1 the processor generates a trace exception upon the successful completion of the next instruction 22 be branch trace enable 0 the processor executes branch instructions normally 1 the processor generates a trace exception upon the successful completion of a branch instruction 23 fe1 floating-point exception mode 1 (see table 5-8) 24 ce critical interrupt exception enable (g2_le core-only) 0 critical interrupts disabled 1 critical interrupts enabled; critical interrupt exception and rfci instruction enabled the critical interrupt is an asynchronous implementation-specific exception. the critical interrupt exception vector offset is 0x00a00. the rfci instruction is implemented to return from these exception handlers. also, csrr0 and csrr1 are used to save and restore the processor state for critical interrupts. 25 ip exception prefix. the setting of this bit specifies whether an exception vector offset is prepended with fs or 0s. in the following description, nnnnn is the offset of the exception. see table 5-2. 0 exceptions are vectored to the physical address 0x000 n_nnnn 1 exceptions are vectored to the physical address 0xfff n_nnnn 26 ir instruction address translation 0 instruction address translation is disabled 1 instruction address translation is enabled see chapter 6, ?memory management? table 2-4. msr bit settings (continued) bits name description f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 2-8 g2 powerpc core reference manual motorola register set ? memory management registers ? block-address translation (bat) registers. the g2 core also supports eight block-address translation registers (bats) through the use of two independent instruction and data block address translation (ibat and dbat) arrays, each containing four pairs of bats. however, the g2_le core supports block address translation arrays of eight pairs of data bats and eight pairs of instruction bats, which are implementation-specific. effective addresses are compared simultaneously with all four (or eight, for g2_le) entries in the bat array during block translation. figure 2-1 lists spr numbers for the bat registers. ? sdr1. the sdr1 register specifies the page table base address used in virtual-to-physical address translation. (note that physical address is referred to as real address in the architecture specification.) ? segment registers (srs). the oea defines sixteen 32-bit segment registers (sr0?sr15). the fields in the segment register are interpreted differently depending on the value of bit 0. ? exception handling registers ? data address register (dar). after a data access or an alignment exception, the dar is set to the effective address generated by the faulting instruction. ? the sprg0?sprg3 registers are provided for operating system use, which reduce the latency that may be incurred because of saving registers to memory while in a handler and also assist in searching the page tables in software. if software table searching is not enabled, then these registers may be used for any supervisor purpose. note that the g2_le core implements four additional sprgs (sprg4?sprg7), which are not defined by the powerpc architecture. the format of these registers is the same as that of 27 dr data address translation 0 data address translation is disabled 1 data address translation is enabled see chapter 6, ?memory management? 28?29 ? reserved. full function. 30 ri recoverable exception (for system reset and machine check exceptions) 0 exception is not recoverable 1 exception is recoverable 31 le little-endian mode enable 0 the processor runs in big-endian mode 1 the processor runs in little-endian mode. for the g2_le core, see section 1.1.2.1, ?true little-endian mode,? for a definition of whether the core is operating in true little-endian mode or modified little-endian mode. table 2-4. msr bit settings (continued) bits name description f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 2. register model 2-9 register set sprg0?sprg3 defined in section 2.1.2.11, ?sprg4?sprg7 (g2_le only).? ? dsisr. the dsisr defines the cause of data access and alignment exceptions. ? machine status save/restore register [0?1] (srr0, srr1). the srr0 and srr1 are used to save machine status on exceptions and to restore machine status when an rfi instruction is executed. implementation note ?the g2 core implements the key bit (bit 12) in the srr1 register to simplify the table search software. for more information refer to chapter 6, ?memory management.? note that to support critical interrupts, two new registers, csrr0 and csrr1, are implemented on the g2_le core, which are not defined by the powerpc architecture. these registers have same bit assignments as srr0 and srr1, and are described in section 2.1.2, ?implementation-specific registers.? ? miscellaneous registers ? the time base facility (tb) for writing. the tb is a 64-bit register pair that can be used to provide time-of-day or interval timing. it consists of two 32-bit registers?time base upper (tbu) and time base lower (tbl). the tb is incremented once every four clock cycles on the core. ? decrementer (dec). the dec register is a 32-bit decrementing counter that provides a mechanism for causing a decrementer exception after a programmable delay. the dec is decremented once every four bus clock cycles. ? external access register (ear). the ear is a 32-bit register used in conjunction with the eciwx and ecowx instructions. although the powerpc architecture specifies that ear26?ear31 are used to select a device, the g2 core implements only bits 28?31. note that ear and the eciwx and ecowx instructions are optional in the powerpc architecture and may not be supported in all processors that implement the oea. 2.1.2 implementation-specific registers the g2 core defines the dmiss, imiss, dcmp, icmp, hash1, hash2, and rpa registers for software table search operations. these registers should be accessed only when address translation is disabled (msr[ir] and msr[dr] are both zero). for a complete discussion, refer to section 6.5.2, ?implementation-specific table search operation.? also, hid0, hid1, and iabr sprs are defined and described in this section. these registers can be accessed by supervisor-level instructions only using the spr numbers shown in figure 2-1. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 2-10 g2 powerpc core reference manual motorola register set note that the g2_le core defines the following: two new critical interrupt registers (csrr0, csrr1), which are implementation-specific. the csrr0 and csrr1 registers support the critical interrupt function, which have the same bit assignments as srr0 and srr1, respectively. the effective address for resuming program execution is saved into csrr0 and the content of the msr is saved into csrr1. an additional rfci instruction is implemented for supporting the return from a critical interrupt, selecting the csrr0 and csrr1 registers. four additional exception handling sprg registers, which are provided for operating system use. a new system version register (svr). see section 2.1.2.12, ?system version register (svr)?g2_le only,? for bit definitions. system memory base address (mbar) is a new implementation-specific register for the g2_le core. it supports a system-level memory map. see section 2.1.2.13, ?system memory base address (mbar)?g2_le only,? for more information. eight additional bats (ibat4?ibat7 and dbat4?dbat7), providing better performance in protecting accesses on a segment, block, or page basis along with memory accesses and i/o accesses. see figure 2-1 for a list of the spr numbers for the bat arrays. one additional address breakpoint register (iabr2), one new instruction address breakpoint control register (ibcr), two new data breakpoint registers (dabr, dabr2), and one new data address breakpoint control register (dbcr) are implemented in the g2_le processor core. all these registers are implementation-specific and they are described in the section 2.1.2.14, ?instruction address breakpoint registers (iabr and iabr2),? and section 2.1.2.15, ?data address breakpoint register (dabr and dabr2)?g2_le only.? 2.1.2.1 hardware implementation register 0 (hid0) the hid0 register, shown in figure 2-2, defines enable bits for various g2 core-specific features. figure 2-2. hardware implementation register 0 (hid0) 0 1 2 3 4 5 6 7 8 9 101112 1516171819202122 232425 262728 29 3031 reserved ebd eba par nap dpm nhr ice dce dcfi emcp sbclk eclk doze sleep ilock dlock icfi fbiob noopti 0 0 0 0000000 ifem 00 abe 00 0 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 2. register model 2-11 register set table 2-5 shows the bit definitions for hid0. table 2-5. hid0 bit functions bits name function 0 emcp enable core_mcp . the primary purpose of this bit is to mask out further machine check exceptions caused by assertion of core_mcp , similar to how msr[ee] can mask external interrupts. 0 masks core_mcp . asserting core_mcp does not generate a machine check exception or a checkstop. 1 asserting core_mcp causes checkstop if msr[me] = 0 or a machine check exception if me = 1 1? reserved 2 eba enable core_ap_in[0:3] and core_ape for address parity checking. eba and ebd allow the processor to operate with memory subsystems that do not generate parity. 0 disables address parity checking during a snoop operation 1 allows an address parity error during snoop operations to cause a checkstop if msr[me] = 0 or a machine check exception if msr[me] = 1 3 ebd enable core_dpe for data parity checking. eba and ebd allow the processor to operate with memory subsystems that do not generate parity. 0 disables data parity checking 1 allows a data parity error during reads to cause a checkstop if msr[me] = 0 or a machine check exception if msr[me] = 1 4 sbclk core_clk_out output enable. used in conjunction with hid0[eclk] and core_hreset to configure core_clk_out. see table 2-6. 5? reserved 6 eclk core_clk_out output enable. used in conjunction with hid0[sbclk] and the core_hreset signal to configure core_clk_out. see table 2-6. 7 par disable precharge of core_artry_out 0 precharge of core_artry_out enabled 1 alters bus protocol slightly by preventing the processor from driving core_artry_out to high (negated) state. if this is done, the integrated device must restore the signals to the high state. 8doze 1 doze mode enable. operates in conjunction with msr[pow]. 0 doze mode disabled 1 doze mode enabled. doze mode is invoked by setting msr[pow] while this bit is set. in doze mode, the pll, time base, and snooping remain active. 9 nap 1 nap mode enable. operates in conjunction with msr[pow]. 0 nap mode disabled 1 nap mode enabled. doze mode is invoked by setting msr[pow] while this bit is set. in nap mode, the pll and time base remain active. 10 sleep 1 sleep mode enable. operates in conjunction with msr[pow]. 0 sleep mode disabled 1 sleep mode enabled. sleep mode is invoked by setting msr[pow] while this bit is set. core_qreq is asserted to indicate that the processor is ready to enter sleep mode. if the system logic determines that the processor may enter sleep mode, the quiesce acknowledge signal, core_qack , is asserted back to the processor. once core_qack assertion is detected, the processor enters sleep mode after several processor clocks. at this point, the system logic may turn off the pll by first configuring core_pll_cfg[0:4] to pll bypass mode, then disabling core_sysclk. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 2-12 g2 powerpc core reference manual motorola register set 11 dpm 1 dynamic power management enable 0 dynamic power management is disabled 1 functional units enter a low-power mode automatically if the unit is idle. this does not affect operational performance and is transparent to software or any external hardware. 12?15 ? reserved, should be cleared. 16 ice 2 instruction cache enable 0 the instruction cache is neither accessed nor updated. all pages are accessed as if they were marked cache-inhibited (wim = x1x). potential cache accesses from the bus (snoop and cache operations) are ignored. in the disabled state for the l1 caches, the cache tag state bits are ignored and all accesses are propagated to the 60x bus as single-beat transactions. for those transactions, however, core_ci reflects the state of the i bit in the mmu for that page regardless of cache disabled status. ice is zero at power-up. 1 the instruction cache is enabled 17 dce data cache enable 0 the data cache is neither accessed nor updated. all pages are accessed as if they were marked cache-inhibited (wim = x1x). potential cache accesses from the 60x bus (snoop and cache operations) are ignored. in the disabled state for the l1 caches, the cache tag state bits are ignored and all accesses are propagated to the 60x bus as single-beat transactions. for those transactions, however, core_ci reflects the state of the i bit in the mmu for that page regardless of cache disabled status. dce is zero at power-up. 1 the data cache is enabled 18 ilock instruction cache lock 0 normal operation 1 instruction cache is locked. a locked cache supplies data normally on a hit, but the access is treated as a cache-inhibited transaction on a miss. on a miss, the transaction to the 60x bus is single-beat; however, core_ci still reflects the state of the i bit in the mmu for that page independent of cache locked or disabled status. to prevent locking during a cache access, an isync instruction must precede the setting of ilock. 19 dlock data cache lock 0 normal operation 1 data cache is locked. a locked cache supplies data normally on a hit, but is treated as a cache-inhibited transaction on a miss. on a miss, the transaction to the 60x bus is single-beat; however, core_ci still reflects the state of the i bit in the mmu for that page independent of cache locked or disabled status. a snoop hit to a locked l1 data cache performs as if the cache were not locked. a cache block invalidated by a snoop remains invalid until the cache is unlocked. to prevent locking during a cache access, a sync instruction must precede the setting of dlock. 20 icfi instruction cache flash invalidate 0 the instruction cache is not invalidated. the bit is cleared when the invalidation operation begins (usually the next cycle after the write operation to the register). the instruction cache must be enabled for the invalidation to occur. 1 an invalidate operation is issued that marks the state of each instruction cache block as invalid without writing back modified cache blocks to memory. cache access is blocked during this time. bus accesses to the cache are signaled as a miss during invalidate-all operations. setting icfi clears all the valid bits of the blocks and the plru bits to point to way l0 of each set. for the g2 core, the proper use of the icfi and dcfi bits is to set and clear them with two consecutive mtspr operations. table 2-5. hid0 bit functions (continued) bits name function f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 2. register model 2-13 register set table 2-6 shows how hid0[bclk], hid0[eclk], and core_hreset are used to configure core_clk_out. see section 8.3.15.2, ?test clock output (core_clk_out),? for more information. 21 dcfi data cache flash invalidate 0 the data cache is not invalidated. the bit is cleared when the invalidation operation begins (usually the next cycle after the write operation to the register). the data cache must be enabled for the invalidation to occur. 1 an invalidate operation is issued that marks the state of each data cache block as invalid without writing back modified cache blocks to memory. cache access is blocked during this time. bus accesses to the cache are signaled as a miss during invalidate-all operations. setting dcfi clears all the valid bits of the blocks and the plru bits to point to way l0 of each set. for the g2 core, the proper use of the icfi and dcfi bits is to set and clear them with two consecutive mtspr operations. 22?23 ? reserved, should be cleared. 24 ifem enable m bit on 60x bus for instruction fetches 0 m bit not reflected on bus for instruction fetches. instruction fetches are treated as nonglobal on the bus. 1 instruction fetches reflect the m bit from the wim settings 25?26 ? reserved, should be cleared. 27 fbiob force branch indirect on bus 0 register indirect branch targets are fetched normally 1 forces register indirect branch targets to be fetched externally 28 abe address broadcast enable. controls whether certain address-only operations (such as cache operations) are broadcast on the 60x bus. 0 address-only operations affect only local caches and are not broadcast 1 address-only operations are broadcast on the 60x bus affected instructions are dcbi , dcbf , and dcbst . note that these cache control instruction broadcasts are not snooped by the g2 core. refer to section 4.3.3, ?data cache control,? for more information. 29?30 ? reserved, should be cleared. 31 noopti no-op the data cache touch instructions 0the dcbt and dcbtst instructions are enabled 1the dcbt and dcbtst instructions are no-oped globally 1 see chapter 10, ?power management.? 2 see chapter 4, ?instruction and data cache operation.? table 2-5. hid0 bit functions (continued) bits name function f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 2-14 g2 powerpc core reference manual motorola register set hid0 can be accessed with mtspr and mfspr using spr1008. 2.1.2.2 hardware implementation register 1 (hid1) the hid1 register, shown in figure 2-3, defines enable bits for various g2 core-specific features. figure 2-3. hardware implementation register 1 (hid1) table 2-7 shows the bit definitions for hid1. hid1 can be accessed with mfspr using spr1009. 2.1.2.3 hardware implementation register 2 (hid2) the g2 core implements an additional hardware implementation-dependent hid2 register, shown in figure 2-4, which enables cache way-locking; the g2_le core also enables true little-endian mode and the new additional bat registers. it is a supervisor-only, read/write, table 2-6. hid0[sbclk] and hid0[eclk] core_clk_out configuration core_hreset hid0[eclk] hid0[sbclk] core_clk_out asserted x x core negated 0 0 core negated 0 1 core clock frequency/2 negated 1 0 core negated 1 1 bus table 2-7. hid1 bit settings bits name description 0 pc0 pll configuration bit 0 (read-only) 1 pc1 pll configuration bit 1 (read-only) 2 pc2 pll configuration bit 2 (read-only) 3 pc3 pll configuration bit 3 (read-only) 4 pc4 pll configuration bit 4 (read-only) 5?30 ? reserved, should be cleared 31 0 tied to zero note: the clock configuration bits reflect the state of the core_pll_cfg[0:4] signals. 01234 31 pc3 pc0 pc1 pc2 pc4 0 0 0000000000000 00 0000000000 reserved f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 2. register model 2-15 register set implementation-specific special purpose register (spr) which is accessed as spr1011 (decimal). the hid2 bits are shown in table 2-8. figure 2-4. hardware implementation-dependent register 2 (hid2) table 2-8 describes the hid2 fields. table 2-8. hid2 bit descriptions bits name description 0?3 ? reserved 4 let true little-endian. this bit enables true little-endian mode operation for instruction and data accesses. this bit is set to reflect the state of the core_tle signal at the negation of core_hreset . this bit is used in conjunction with msr[le] to determine the endian mode of operation as described in table 1-1. 0 modified (powerpc) little-endian mode 1 true little-endian mode changing the value of this bit during normal operation is discouraged 5?12 ? reserved 13 hbe high bat enable. regardless of the setting of hid2[hbe], these bats are accessible by mfspr and mtspr . 0 ibat[4?7] and dbat[4?7] are disabled 1 ibat[4?7] and dbat[4?7] are enabled 14 ? reserved 15 ? reserved 16?18 iwlck[0?2] instruction cache way-lock. useful for locking blocks of instructions into the instruction cache for time-critical applications that require deterministic behavior. see chapter 4, ?instruction and data cache operation.? 000 = no ways locked 001 = way 0 locked 010 = way 0 through way 1 locked 011 = way 0 through way 2 locked 100 = way 0 through way 3 locked 101 = way 0 through way 4 locked 110 = way 0 through way 5 locked 111 = reserved 19?23 ? reserved 31 27 26 24 23 19 18 14 13 12 4 0 iwlck[0?2] 0 0 00000 000 hbe dwlck[0?2] 000 0000 0 3 5 00 let 15 0 0 0 16 reserved 00 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 2-16 g2 powerpc core reference manual motorola register set 2.1.2.4 data and instruction tlb miss address registers (dmiss and imiss) dmiss and imiss, shown in figure 2-5, are loaded automatically on a data or instruction tlb miss. dmiss and imiss contain the effective address of the access that caused the tlb miss exception. the contents are used by the core when calculating the values of hash1 and hash2 and by the tlbld and tlbli instructions when loading a new tlb entry. note that the g2 core always loads dmiss with a big-endian address, even when msr[le] is set. these registers are both read- and write-accessible. however, caution should be used when writing to these registers. figure 2-5. dmiss and imiss registers 2.1.2.5 data and instruction tlb compare registers (dcmp and icmp) dcmp and icmp, shown in figure 2-6, contain the first word in the required pte. the contents are constructed automatically from the contents of the segment registers and the effective address (dmiss or imiss) when a tlb miss exception occurs. each pte read from the tables during the table search process should be compared with this value to determine if the pte is a match. upon execution of a tlbld or tlbli instruction, the upper 25 bits of the dcmp or icmp register and 11 bits of the effective address are loaded into the first word of the selected tlb entry. these registers are read and write to the software. figure 2-6. dcmp and icmp registers 24?26 dwlck[0?2] data cache way-lock. useful for locking blocks of data into the data cache for time-critical applications where deterministic behavior is required. see chapter 4, ?instruction and data cache operation.? 000 = no ways locked 001 = way 0 locked 010 = way 0 through way 1 locked 011 = way 0 through way 2 locked 100 = way 0 through way 3 locked 101 = way 0 through way 4 locked 110 = way 0 through way 5 locked 111 = reserved 27?31 ? reserved table 2-8. hid2 bit descriptions (continued) bits name description 0 31 effective address 01 24 25 26 31 v vsid api 0 reserved f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 2. register model 2-17 register set table 2-9 describes the bit settings for the dcmp and icmp registers. 2.1.2.6 primary and secondary hash address registers (hash1 and hash2) hash1 and hash2, shown in figure 2-7, contain the physical addresses of the primary and secondary ptegs for the access that caused the tlb miss exception. for convenience, the g2 core automatically constructs the full physical address by routing sdr1 bits 0?6 into hash1 and hash2 and clearing the lower 6 bits. these read-only registers are constructed from the dmiss or imiss contents (the register choice is determined by which miss most recently occurred). figure 2-7. hash1 and hash2 registers table 2-10 describes the bit settings of the hash1 and hash2 registers. 2.1.2.7 required physical address register (rpa) during a page table search operation, the software must load the rpa, shown in figure 2-8, with the second word of the correct pte. when the tlbld or tlbli instruction is executed, the rpa and dmiss or imiss register are merged and loaded into the selected tlb entry. the referenced (r) bit is ignored when the write occurs (no location exists in the tlb entry for this bit). the rpa register is read and write accessible to the software. table 2-9. dcmp and icmp bit settings bits name description 0 v valid bit. set by the processor on a tlb miss exception. 1?24 vsid virtual segment id. copied from vsid field of corresponding segment register. 25 ? reserved, should be cleared. 26?31 api abbreviated page index. copied from api of effective address. table 2-10. hash1 and hash2 bit settings bits name description 0?6 htaborg copy of the upper 7 bits of the htaborg field from sdr1 7?25 hashed page address address bits 7?25 of the pteg to be searched 26?31 ? reserved 067 25 26 31 htaborg hashed page address 0 0 0 0 0 0 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 2-18 g2 powerpc core reference manual motorola register set figure 2-8. required physical address register (rpa) table 2-11 describes the bit settings of the rpa register. 2.1.2.8 bat registers (bat4?bat7)?g2_le only the g2_le mmu has four additional ibat and four additional dbat array entries that provide a mechanism for translating additional blocks as large as 256 mbytes from the 32-bit effective address space into the physical memory space. this can be used for translating large address ranges whose mappings do not change frequently. bats are software-controlled arrays that store the available block address translations on-chip. the g2_le core supports block address translation through the use of two independent instruction and data block address translation (ibat and dbat) arrays; each array is comprised of four additional entries used for instruction accesses and four additional entries used for data accesses. ibat4?ibat7 and dbat4?dbat7 are implementation-specific registers on the g2_le core, which are optionally enabled in hid2. the format of these registers is the same as that of ibat0?ibat3 and dbat0?dbat3. each bat array entry consists of a pair of bat registers?an upper and a lower bat register for each entry. figure 2-9 and figure 2-10 show the format and bit definitions of the upper and lower bats for 32-bit processor cores, respectively. figure 2-9. upper bat register table 2-11. rpa bit settings bits name description 0?19 rpn physical page number from pte 20?22 ? reserved 23 r referenced bit from pte 24 c changed bit from pte 25?28 wimg memory/cache access attribute bits 29 ? reserved 30?31 pp page protection bits from pte 0 19 20 22 23 24 25 28 29 30 31 rpn r cwimg pp 0 0 0 0 reserved bepi 0 0 0 0 bl vs vp 014151819293031 reserved f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 2. register model 2-19 register set figure 2-10. lower bat register the bat registers contain the effective-to-physical address mappings for blocks of memory. this mapping includes the effective address bits that are compared with the effective address of the access, the memory/cache access mode bits (wimg), and the protection bits for the block. the size of the block and the starting address of the block are defined by the physical block number (brpn) and block size mask (bl) fields. the sixteen new bat registers are enabled by hid2[hbe]. however, regardless of the setting of this bit, the bat registers are accessible by the mfspr and mtspr instructions and are only accessible to supervisor-level programs. see section 2.1.2.3, ?hardware implementation register 2 (hid2),? for more information on the hbe bit. 2.1.2.9 critical interrupt save/restore register 0 (csrr0)?g2_le only csrr0 is used to save machine status on critical interrupt exceptions and restore machine status when an rfci instruction is executed. the format of csrr0 is shown in figure 2-11. figure 2-11. critical interrupt save/restore register 0 (csrr0) for information on how specific exceptions affect csrr0, refer to the descriptions of individual exceptions in chapter 5, ?exceptions.? 2.1.2.10 critical interrupt save/restore register 1 (csrr1)?g2_le only csrr1 is used to save machine status on exceptions and to restore machine status when an rfci instruction is executed. figure 2-12 shows the csrr1 format. figure 2-12. critical interrupt save/restore register 1 (csrr1) for information on how specific exceptions affect csrr1, refer to the individual exceptions in chapter 5, ?exceptions.? 01415242528293031 brpn 0 0000 0000 0 wimg* 0 pp *w and g bits are not defined for ibat registers. attempting to write to these bits causes boundedly-undefined results. reserved csrr0 0 29 30 31 00 reserved 0 29 30 31 csrr1 0 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 2-20 g2 powerpc core reference manual motorola register set 2.1.2.11 sprg4?sprg7 (g2_le only) the g2_le core provides four additional sprg (sprg4?sprg7) registers for general operating system use, such as performing a fast state save or for supporting multiprocessor implementations. the formats of sprg4?sprg7 are shown in figure 2-13. figure 2-13. sprg0?sprg7 registers for information on conventional uses for sprg4?sprg7, refer to section 5.2.1.3, ?sprg4?sprg7 (g2_le only).? 2.1.2.12 system version register (svr)?g2_le only the system version register (svr) is 32-bit (g2_le specific), read-only register that identifies the specific version (model) and revision level of the system on a chip (soc), including the processor core identification by the pvr. supervisor mode write access is reserved for future use. the svr can be accessed with mfspr using spr286. the bits in svr are defined in table 2-12. note that all bits within this register must be programmed by the soc and unused bits must be set to zero. also, svr4?svr15 are control fields for this register. 2.1.2.13 system memory base address (mbar)?g2_le only the g2_le core implements a new memory base address register (mbar) to support the system level memory map. the mbar can be accessed with mtspr or mfspr using table 2-12. system version register (svr) bit settings bits name description 0?3 cid company or manufacturer id. these bits are required. bit 0 must set to 1. 4?9 socop 1 1 the sid values are assigned by the powerpc architecture. soc integration options. this optional field identifies the soc device specific options that are integrated within the soc. the field reads 0 when it is not used. 10?15 sid 2 2 the soc value is an optional field assigned by the soc design integrator. soc id. this required field is used to identify the soc device. 16?19 proc process revision field. this optional field is used to indicate different process revisions of the soc. 20?23 mfg manufacturing revision. this optional field identifies uniquely different manufacturing revisions of the soc. 24?27 mjrev major soc design revision indicator. this is a required field. 28-31 mnrev minor soc design revision indicator. this is a required field. sprg n 0 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 2. register model 2-21 register set spr311 in supervisor mode. the present memory base address for the system memory map is stored in this register. it is important to ensure that the present value of the base offset is current in the system memory. 2.1.2.14 instruction address breakpoint registers (iabr and iabr2) the iabr, shown in figure 2-14, controls the instruction address breakpoint exception. in the g2_le core, an additional address breakpoint register (iabr2) is implemented. iabr[cea] holds an effective address to which each instruction?s address is compared. the exception is enabled by setting iabr[be]. the exception is taken when there is an instruction address breakpoint match on the next instruction to complete. the instruction tagged with the match cannot complete before the breakpoint exception is taken. the address of the instruction which matches the breakpoint condition is stored in srr0. the tagged instruction is completed and retired on return from the exception ( rfi or rfci ). the results are then committed to the destination registers and address. note that if the iabr/iabr2 register values are set to any exception vector, an unrecoverable processor state will occur. figure 2-14. instruction address breakpoint registers (iabr and iabr2) the bits in the iabr and iabr2 are defined in table 2-13. for more information about the instruction breakpoint exception, see section 5.5.16, ?instruction address breakpoint exception (0x01300).? 2.1.2.14.1 instruction address breakpoint control registers (ibcr)?g2_le only the ibcr, shown in figure 2-15, is a supervisor-level register with spr309 on the g2_le core, which is accessible only by using an mtspr or mfspr instruction. the ibcr controls the compare and match type conditions for iabr and iabr2. note that iabr and iabr2 must be enabled before the effects of ibcr are realized. table 2-13. instruction address breakpoint register (iabr and iabr2) bit settings bits name description 0?29 cea compare effective address. word address to be compared. 30 be breakpoint enable. iabr (or iabr2) enabled. setting this bit enables the iabr exception. 31 ? reserved 0 29 30 31 cea be 0 reserved f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 2-22 g2 powerpc core reference manual motorola register set figure 2-15. instruction address breakpoint control register (ibcr) table 2-14 describes the ibcr fields. 2.1.2.15 data address breakpoint register (dabr and dabr2)?g2_le only the optional data address breakpoint facility on the g2_le core is controlled by optional sprs, dabr and dabr2. the data address breakpoint facility provides a means to detect data accesses to a designated double-word address. the breakpoint address is compared to the effective address of all data accesses; it does not apply to instruction fetches. dabr and dabr2, the two data address breakpoint registers shown in figure 2-16, can both cause the data address breakpoint exception. figure 2-16. data address breakpoint registers (dabr and dabr2) table 2-14. instruction address breakpoint control registers (ibcr) bits name description 0?7 ? reserved 8?9 cmp iabr breakpoint compare type 00 match if instruction?s ea equals iabr[cea] 01 reserved 10 match if instruction?s ea is less than iabr[cea] 11 match if instruction?s ea is greater than or equal to iabr[cea] 10?11 cmp2 iabr2 breakpoint compare type 00 match if instruction?s ea equals iabr2[cea] 01 reserved 10 match if instruction?s ea less than iabr2[cea] 11 match if instruction?s ea greater than or equal to iabr2[cea] 12 ? reserved 13 ? reserved 14 sig_type combinational signal type 0 instruction?s ea matches iabr[cea] or instruction?s ea matches iabr2[cea] 1 instruction?s ea matches iabr[cea] and instruction?s ea matches iabr2[cea] 15 dns do not signal. disable core_iabr and core_iabr2 output signals 0 allow signal to toggle on a match 1 do not toggle signal on match 0 7 8 9 10 1112 13 14 15 16 29 30 31 cmp 0000_0000_0000 cmp2 0000_0000 00 sig_type dns reserved cea wbe bt rbe 0 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 2. register model 2-23 register set when an enabled data breakpoint condition matches with the address of a data access, a dsi exception occurs. when a dsi exception is taken to indicate a data breakpoint condition, dar is set to the data address that causes the breakpoint and dsisr[9] is set. the address of the instruction associated with the breakpoint condition is stored in srr0. note that if the dabr/dabr2 register values are set to match on any exception vector, an indeterminate or unrecoverable processor state may occur. table 2-15 describes the fields in dabr and dabr2. a data address breakpoint match is detected for a load or store instruction if the following conditions are met for any byte accessed: ea0?ea28 = dabr[cea] msr[dr] = dabr[bt] the instruction is a store and dabr[wbe] = 1 or the instruction is a load and dabr[rbe] = 1 even if the above conditions are satisfied, it is undefined whether a match occurs in the following cases: a store conditional indexed instruction ( stwcx. ) in which the store is not performed a load or store string instruction ( lswx or stswx ) with a zero length a dcbz , dcba , eciwx , or ecowx instruction. for the purpose of determining whether a match occurs, eciwx is treated as a load and dcbz , dcba , and ecowx are treated as stores. the cache management instructions other than dcbz and dcba never cause a match. if dcbz or dcba causes a match, some or all of the target memory locations may have been updated. when a match occurs, a dsi exception is generated. refer to section 5.5.3, ?dsi exception (0x00300),? more information on the data address breakpoint facility. table 2-15. data address breakpoint registers (dabr and dabr2) bit settings bits name description 0?28 cea data address breakpoint 29 bt breakpoint translation enable. match if msr[dr] = dabr[bt]. 30 wbe data write enable. matching on data writes enabled. 31 rbe data read enable. matching on data reads enabled. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 2-24 g2 powerpc core reference manual motorola register set 2.1.2.15.1 data address breakpoint control registers (dbcr)?g2_le-only the dbcr is a supervisor-level register with spr310 on the g2_le core, which is accessible only by using mtspr and mfspr . the dbcr controls the compare and match type conditions for dabr1 and dabr2. figure 2-17 shows the format of the dbcr. figure 2-17. data address breakpoint control register (dbcr) table 2-16 provides the description of dbcr bit settings. table 2-16. data address breakpoint control registers (dbcr)?g2_le-only bits name description 0?7 ? reserved 8?9 cmp dabr1 breakpoint compare type 00 match if data?s ea equals dabr[cea] 01 reserved 10 match if data?s ea less than dabr[cea] 11 match if data?s ea greater than or equal to dabr[cea] 10?11 cmp2 dabr2 breakpoint compare type 00 match if data?s ea equals dabr2[cea] 01 reserved 10 match if data?s ea less than dabr2[cea] 11 match if data?s ea greater than or equal to dabr2[cea] 12?13 ? reserved 14 sig_type combinational signal type 0 data access ea matches dabr[cea] or ea matches dabr2[cea] 1 data access ea matches dabr[cea] and ea matches dabr2[cea] 15 dns do not signal. disable core_dabr and core_dabr2 output signals. 0 allow signal to toggle on a match 1 do not toggle signal on match 16?31 ? reserved 0 7 8 9 10 1112 1314 15 16 29 30 31 cmp 0000_0000_0000 cmp2 0000_0000 00 sig_type dns reserved f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-1 chapter 3 instruction set model this chapter describes the operand conventions as they are represented in two levels of the powerpc architecture. it also provides detailed descriptions of conventions used for storing values in registers and memory, accessing the core registers, and the representation of data in these registers. operand conventions g2 core instruction set 3.1 operand conventions this section describes the integer and floating-point operand conventions. it also describes the big- and little-endian byte ordering for the g2 and g2_le cores. 3.1.1 data organization in memory and memory operands bytes in memory are numbered consecutively starting with 0. each number is the address of the corresponding byte. memory operands may be bytes, half words, words, or double words, or, for the load/store multiple and move assist instructions, a sequence of bytes or words. the address of a memory operand is the address of its first byte (that is, of its lowest-numbered byte). operand length is implicit for each instruction. 3.1.2 endian modes and byte ordering the powerpc architecture supports both big- and little-endian byte ordering. the default byte and bit ordering is big-endian. see section 3.1.2, ?byte ordering,? in the programming environments manual , for more information about big- and little-endian byte ordering. true little-endian mode is supported in the g2_le core to minimize the impact on software porting from true little-endian systems. the true little-endian mode applies for all instruction fetches and data load and store operations to and from memory. the g2_le powers up in one of two endian modes, big-endian mode or true little-endian mode, selected by the core_tle signal at the negation of core_hreset . the endian mode should be set at the f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-2 g2 powerpc core reference manual motorola operand conventions negation of core_hreset , and should remain unchanged by software for the duration of the system operation. bit 4 of hid2, (hid2[let]) is used in conjunction with msr[le] to indicate the endian mode of operation of the g2_le core as shown in table 3-1. when the g2_le core is in true little-endian mode, memory and i/o subsystems are treated as true little-endian. the following occurs when operating in true little-endian mode: the byte reversing for instruction occurs before the instruction is decoded. the byte reversing for data occurs when the data item is being moved to or from the gpr. therefore, the byte reversal in little-endian mode for load or store accesses occurs between memory or the data cache, and the register files for the g2_le core. 3.1.3 alignment and misaligned accesses the operand of a single-register memory access instruction has a natural alignment boundary equal to the operand length. in other words, the natural address of an operand is an integral multiple of the operand length. a memory operand is said to be aligned if it is aligned at its natural boundary; otherwise it is misaligned. for a detailed discussion about memory operands, see chapter 3, ?operand conventions,? in the programming environments manual . operands for single-register memory access instructions have the characteristics shown in table 3-2. (although not permitted as memory operands, quad words are shown because quad-word alignment is desirable for certain memory operands.) table 3-1. endian mode indication msr[le] hid2[let] endian mode 0 x big-endian 1 0 modified (powerpc) little-endian 1 1 true little-endian f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-3 operand conventions the concept of alignment is also applied more generally to data in memory. for example, a 12-byte data item is said to be word-aligned if its address is a multiple of four. implementation notes ?the following describes how the g2 core handles alignment and misaligned accesses: the g2 core provides hardware support for some misaligned memory accesses. however, misaligned accesses suffer a performance degradation compared to aligned accesses of the same type. the g2 core does not provide hardware support for floating-point load/store operations that are not word-aligned. in such a case, the core invokes an alignment exception and the exception handler must break up the misaligned access. for this reason, floating-point single- and double-word accesses should always be word-aligned. note that a floating-point double-word access on a word-aligned boundary requires an extra cycle to complete. any half-word, word, double-word, and string reference access that crosses an alignment boundary must be broken into multiple discrete accesses. for string accesses, the hardware makes no attempt to get aligned to reduce the number of accesses. (multiple word accesses are architecturally required to be aligned.) the resulting performance degradation depends on how well each individual access behaves with respect to the memory hierarchy. at a minimum, additional cache access cycles are required. more dramatically, each discrete access to a noncacheable page involves an individual bus operation that reduces the effective bus bandwidth. the frequent use of misaligned accesses is discouraged because they can compromise the overall performance. 3.1.4 floating-point execution model the g2 core provides hardware support for all single- and double-precision floating-point operations for most value representations and all rounding modes. the powerpc table 3-2. memory operands operand length addr[28?31] if aligned byte 8 bits xxxx half word 2 bytes xxx0 word 4 bytes xx00 double word 8 bytes x000 quad word 16 bytes 0000 note: an x in an address bit position indicates that the bit can be 0 or 1 independent of the state of other address bits. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-4 g2 powerpc core reference manual motorola operand conventions architecture provides for hardware to implement a floating-point system as defined in ansi/ieee standard 754-1985, ieee standard for binary floating point arithmetic . for detailed information about the floating-point execution model, refer to chapter 3, ?operand conventions,? in the programming environments manual . the ieee 754 standard includes 64- and 32-bit arithmetic. the standard requires that single-precision arithmetic be provided for single-precision operands. the standard permits double-precision arithmetic instructions to have either (or both) single-precision or double-precision operands, but states that single-precision arithmetic instructions should not accept double-precision operands. the uisa follows these guidelines: double-precision arithmetic instructions may have single-precision operands but always produce double-precision results. single-precision arithmetic instructions require all operands to be single-precision and always produce single-precision results. for arithmetic instructions, conversions from double- to single-precision must be done explicitly by software, while conversions from single- to double-precision are done implicitly. all powerpc implementations provide the equivalent of the following execution models to ensure that identical results are obtained. the definition of the arithmetic instructions for infinities, denormalized numbers, and nans follow conventions described in the following sections. although the double-precision format specifies an 11-bit exponent, exponent arithmetic uses two additional bit positions to avoid potential transient overflow conditions. an extra bit is required when denormalized double-precision numbers are prenormalized. a second bit is required to permit computation of the adjusted exponent value in the following examples when the corresponding exception enable bit is one: underflow during multiplication using a denormalized factor overflow during division using a denormalized divisor 3.1.5 effect of operand placement on performance the vea states that the placement (location and alignment) of operands in memory affect the relative performance of memory accesses. the best performance is guaranteed if memory operands are aligned on natural boundaries. to obtain the best performance from the core, the programmer should assume the performance model described in chapter 3, ?operand conventions,? in the programming environments manual . f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-5 instruction set summary 3.2 instruction set summary this section describes instructions and addressing modes defined for the g2 core. these instructions are divided into the following functional categories: integer instructions?these include arithmetic and logical instructions. for more information, see section 3.2.4.1, ?integer instructions.? floating-point instructions?these include floating-point arithmetic instructions, as well as instructions that affect the floating-point status and control register (fpscr). for more information, see section 3.2.4.2, ?floating-point instructions.? load and store instructions?these include integer and floating-point load and store instructions. for more information, see section 3.2.4.3, ?load and store instructions.? flow control instructions?these include branching instructions, condition register logical instructions, and other instructions that affect the instruction flow. for more information, see section 3.2.4.4, ?branch and flow control instructions.? trap instructions?these are used to test for a specified set of conditions; see section 3.2.4.5, ?trap instructions.? processor control instructions?these are used for synchronizing memory accesses and managing caches, tlbs, and segment registers. for more information, see section 3.2.4.6, ?processor control instructions,? section 3.2.5.1, ?processor control instructions,? and section 3.2.6.2, ?processor control instructions?oea.? memory synchronization instructions?these are used for synchronizing memory accesses. see section 3.2.4.7, ?memory synchronization instructions?uisa? and section 3.2.5.2, ?memory synchronization instructions?vea.? memory control instructions?these provide control of caches, tlbs, and segment registers. for more information, see section 3.2.5.3, ?memory control instructions?vea? and section 3.2.6.3, ?memory control instructions?oea.? system linkage instructions?these include the system call ( sc ) and return from interrupt ( rfi ) instructions. see section 3.2.6.1, ?system linkage instructions.? external control instructions?these include instructions for use with special input/output devices. see section 3.2.5.4, ?external control instructions.? note that this grouping of instructions does not necessarily indicate the execution unit that processes a particular instruction or group of instructions. this information, which is useful in taking full advantage of the g2 core superscalar parallel instruction execution, is provided in chapter 8, ?instruction set,? of the programming environments manual . integer instructions operate on word operands. floating-point instructions operate on single- and double-precision floating-point operands. powerpc instructions are 4-byte words. the uisa provides for byte, half-word, and word operand loads and stores between f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-6 g2 powerpc core reference manual motorola instruction set summary memory and a set of 32 gprs. it also provides for word and double-word operand loads and stores between memory and a set of 32 fprs. arithmetic and logical instructions do not read or modify memory. to use the contents of a memory location in a computation and then modify the same or another memory location, the memory contents must be loaded into a register, modified, and then written to the target location using load and store instructions. the description of each instruction includes the mnemonic and a formatted list of operands. to simplify assembly language programming, a set of simplified mnemonics (extended mnemonics in the architecture specification) and symbols is provided for some of the frequently-used instructions; see appendix f, ?simplified mnemonics,? in the programming environments manual , for a complete list of simplified mnemonic examples. 3.2.1 classes of instructions the g2 core instructions belong to one of the following three classes: defined illegal reserved note that although the definitions of these terms are consistent among the processors of this family, the assignment of these classifications is not. for example, an instruction that is specific to 64-bit implementations is considered defined for 64-bit implementations but illegal for 32-bit implementations such as the g2 core. the class is determined by examining the primary opcode and the extended opcode, if any. if either is not that of a defined instruction or of a reserved instruction, the instruction is illegal. in future versions of the powerpc architecture, instruction codings that are now illegal may become assigned to instructions in the architecture or may be reserved by being assigned to processor-specific instructions. 3.2.1.1 definition of boundedly undefined if instructions are encoded with incorrectly set bits in reserved fields, the results on execution can be said to be boundedly undefined. if a user-level program executes the incorrectly coded instruction, the resulting undefined results are bounded in that a spurious change from user to supervisor state is not allowed, and the level of privilege exercised by the program in relation to memory access and other system resources cannot be exceeded. boundedly undefined results for a given instruction may vary between implementations, and between execution attempts in the same implementation. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-7 instruction set summary 3.2.1.2 defined instruction class defined instructions are guaranteed to be supported in all powerpc implementations, except as stated in the instruction descriptions in chapter 8, ?instruction set,? in the programming environments manual . the g2 core provides hardware support for all instructions defined for 32-bit implementations. a processor of this family invokes the illegal instruction error handler (part of the program exception) when the unimplemented powerpc instructions are encountered so they can be emulated in software, as required. a defined instruction can have invalid forms, as described in the following section. 3.2.1.3 illegal instruction class illegal instructions are grouped into the following categories: instructions not defined in the powerpc architecture. these opcodes are available for future extensions of the powerpc architecture; that is, future versions of the powerpc architecture may define any of these instructions to perform new functions. the following primary opcodes are defined as illegal but may be used in future extensions to the architecture: 1, 4, 5, 6, 9, 22, 56, 57, 60, 61 instructions defined in the powerpc architecture but not implemented in a specific powerpc implementation. for example, instructions that can be executed on 64-bit processors are considered illegal by 32-bit processor cores. the following primary opcodes are defined for 64-bit implementations only and are illegal on the core: 2, 30, 58, 62 all unused extended opcodes are illegal. the unused extended opcodes can be determined from information in appendix a.2, ?instructions sorted by opcode,? and section 3.2.1.4, ?reserved instruction class.? notice that extended opcodes for instructions that are defined only for 64-bit implementations are illegal in 32-bit implementations, and vice versa. the following primary opcodes have unused extended opcodes: 17, 19, 31, 59, 63 (primary opcodes 30 and 62 are illegal for all 32-bit implementations, but as 64-bit opcodes they have some unused extended opcodes) an instruction consisting entirely of zeros is guaranteed to be an illegal instruction. this increases the probability that an attempt to execute data or uninitialized memory invokes the system illegal instruction error handler (a program exception). note that if only the primary opcode consists of all zeros, the instruction is f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-8 g2 powerpc core reference manual motorola instruction set summary considered a reserved instruction. this is further described in section 3.2.1.4, ?reserved instruction class.? an attempt to execute an illegal instruction invokes the illegal instruction error handler (a program exception) but has no other effect. section 5.5.7, ?program exception (0x00700),? describes illegal and invalid instruction exceptions. except for an instruction consisting entirely of binary zeros, illegal instructions are available for further additions to the powerpc architecture. 3.2.1.4 reserved instruction class reserved instructions are allocated to specific implementation-dependent purposes not defined by the powerpc architecture. an attempt to execute an unimplemented reserved instruction invokes the illegal instruction error handler (a program exception). see section 5.5.7, ?program exception (0x00700),? for additional information about illegal and invalid instruction exceptions. the following types of instructions are included in this class: implementation-specific instructions (for example, load data tlb entry ( tlbld ) and load instruction tlb entry ( tlbli ) instructions). optional instructions defined by the powerpc architecture but not implemented by the core (for example, floating square root ( fsqrt ) and floating square root single ( fsqrts ) instructions). 3.2.2 addressing modes this section provides an overview of conventions for addressing memory and calculating effective addresses as defined by the powerpc architecture for 32-bit implementations. for more detailed information, see ?conventions? in chapter 4, ?addressing modes and instruction set summary,? of the programming environments manual . 3.2.2.1 memory addressing a program references memory using the effective (logical) address computed by the processor when it executes a memory access or branch instruction or when it fetches the next sequential instruction. as described in section 3.1.1, ?data organization in memory and memory operands,? bytes in memory are numbered consecutively starting with zero. each number is the address of the corresponding byte. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-9 instruction set summary 3.2.2.2 memory operands memory operands may be bytes, half words, words, or double words, or, for the load/store multiple and load/store string instructions, a sequence of bytes or words. the address of a memory operand is the address of its first byte (that is, of its lowest-numbered byte). operand length is implicit for each instruction. the powerpc architecture supports both big- and little-endian byte ordering. the default byte and bit ordering is big-endian. see section 3.1.2, ?byte ordering,? in the programming environments manual , for more information about big- and little-endian byte ordering. the operand of a single-register memory access instruction has a natural alignment boundary equal to the operand length. in other words, the ?natural? address of an operand is an integral multiple of the operand length. a memory operand is said to be aligned if it is aligned at its natural boundary; otherwise it is misaligned. for a detailed discussion about memory operands, see chapter 3, ?operand conventions,? in the programming environments manual . 3.2.2.3 effective address calculation an effective address (ea) is the 32-bit sum computed by the processor core when executing a memory access or branch instruction or when fetching the next sequential instruction. for a memory access instruction, if the sum of the effective address and the operand length exceeds the maximum effective address, the memory operand is considered to wrap around from the maximum effective address through effective address 0, as described in the following paragraphs. effective address computations for both data and instruction accesses use 32-bit unsigned binary arithmetic. a carry from bit 0 is ignored. load and store operations have three categories of effective address generation: register indirect with immediate index mode register indirect with index mode register indirect mode section 3.2.4.3.2, ?integer load and store address generation,? describes effective address generation for load and store operations. branch instructions have three categories of effective address generation: immediate link register indirect count register indirect section 3.2.4.4.1, ?branch instruction address calculation,? describes branch instruction effective address generation. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-10 g2 powerpc core reference manual motorola instruction set summary 3.2.2.4 synchronization the synchronization described in this section refers to the state of the core performing the synchronization. 3.2.2.4.1 context synchronization the system call ( sc ) and return from interrupt ( rfi ) instructions perform context synchronization by allowing previously issued instructions to complete before performing a change in context. execution of one of these instructions ensures the following: no higher priority exception exists ( sc ). all previous instructions have completed to a point where they can no longer cause an exception. if a prior memory access instruction causes direct-store error exceptions, the results are guaranteed to be determined before this instruction is executed. previous instructions complete execution in the context (privilege, protection, and address translation) under which they were issued. the instructions following the sc or rfi instruction execute in the context established by these instructions. 3.2.2.4.2 execution synchronization an instruction is execution synchronizing if all previously initiated instructions appear to have completed before the instruction is initiated or, in the case of the synchronize ( sync ) and instruction synchronize ( isync ) instructions, before the instruction completes. for example, the move to machine state register ( mtmsr ) instruction is execution synchronizing. it ensures that all preceding instructions have completed execution and will not cause an exception before the instruction executes but does not ensure subsequent instructions execute in the newly established environment. for example, if the mtmsr sets msr[pr], unless an isync immediately follows the mtmsr instruction, a privileged instruction could be executed or privileged access could be performed without causing an exception even though msr[pr] indicates user mode. 3.2.2.4.3 instruction-related exceptions there are two kinds of exceptions in the g2 core?those caused directly by the execution of an instruction and those caused by an asynchronous event. either may cause components of the system software to be invoked. exceptions can be caused directly by the execution of an instruction as follows: an attempt to execute an illegal instruction causes the illegal instruction (program exception) handler to be invoked. an attempt by a user-level program to execute the supervisor-level instructions listed below causes the privileged instruction (program f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-11 instruction set summary exception) handler to be invoked. the core provides the following supervisor-level instructions: dcbi (this instruction should never be used on the g2 core), mfmsr , mfspr , mfsr , mfsrin , mtmsr , mtspr , mtsr , mtsrin , rfi , tlbie , tlbsync , tlbld , and tlbli . note that the privilege level of the mfspr and mtspr instructions depends on the spr encoding. an attempt to access memory that is not available (page fault) causes the isi exception handler to be invoked. an attempt to access memory with an effective address alignment that is invalid for the instruction causes the alignment exception handler to be invoked. the execution of an sc instruction invokes the system call exception handler that permits a program to request the system to perform a service. the execution of a trap instruction invokes the program exception trap handler. the execution of a floating-point instruction when floating-point instructions are disabled or unavailable invokes the floating-point unavailable exception handler. the execution of an instruction that causes a floating-point exception while exceptions are enabled in the msr invokes the program exception handler. exceptions caused by asynchronous events are described in chapter 5, ?exceptions.? 3.2.3 instruction set overview this section provides a brief overview of the powerpc instructions implemented in the core and highlights any special information with respect to how the g2 core implements a particular instruction. note that the categories used in this section correspond to those used in chapter 4, ?addressing modes and instruction set summary,? in the programming environments manual . these categorizations are somewhat arbitrary and are provided for the convenience of the programmer and do not necessarily reflect the powerpc architecture specification. note that some of the instructions have the following optional features: cr update?the dot ( . ) suffix on the mnemonic enables the update of the cr. overflow option?the o suffix indicates that the overflow bit in the xer is enabled. 3.2.4 powerpc uisa instructions the uisa includes the base user-level instruction set (excluding a few user-level cache control, synchronization, and time base instructions), user-level registers, programming model, data types, and addressing modes. this section discusses the instructions defined in the uisa. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-12 g2 powerpc core reference manual motorola instruction set summary 3.2.4.1 integer instructions this section describes the integer instructions. these consist of the following: integer arithmetic instructions integer compare instructions integer logical instructions integer rotate and shift instructions integer instructions use the content of the gprs as source operands and place results into gprs, into the xer, and into condition register (cr) fields. 3.2.4.1.1 integer arithmetic instructions table 3-3 lists the integer arithmetic instructions for the core. table 3-3. integer arithmetic instructions name mnemonic operand syntax add add ( add. addo addo. ) r d ,r a ,r b add carrying addc ( addc. addco addco. ) r d ,r a ,r b add extended adde ( adde. addeo addeo. ) r d ,r a ,r b add immediate addi r d ,r a , simm add immediate carrying addic r d ,r a , simm add immediate carrying and record addic. r d ,r a , simm add immediate shifted addis r d ,r a , simm add to minus one extended addme ( addme. addmeo addmeo. ) r d ,r a add to zero extended addze ( addze. addzeo addzeo. ) r d ,r a divide word divw ( divw. divwo divwo. ) r d ,r a ,r b divide word unsigned divwu ( divwu. divwuo divwuo. ) r d ,r a ,r b multiply high word mulhw ( mulhw. ) r d ,r a ,r b multiply high word unsigned mulhwu ( mulhwu. ) r d ,r a ,r b multiply low mullw ( mullw. mullwo mullwo. ) r d ,r a ,r b multiply low immediate mulli r d ,r a , simm negate neg ( neg. nego nego. ) r d ,r a subtract from subf ( subf. subfo subfo. ) r d ,r a ,r b subtract from carrying subfc ( subfc. subfco subfco. ) r d ,r a ,r b subtract from extended subfe ( subfe. subfeo subfeo. ) r d ,r a ,r b subtract from immediate carrying subfic r d ,r a , simm subtract from minus one extended subfme ( subfme. subfmeo subfmeo. ) r d ,r a subtract from zero extended subfze ( subfze. subfzeo subfzeo. ) r d ,r a f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-13 instruction set summary although there is no subtract immediate instruction, its effect can be achieved by using an addi instruction with the immediate operand negated. simplified mnemonics are provided that include this negation. the subf instructions subtract the second operand ( r a) from the third operand ( r b). simplified mnemonics are provided in which the third operand is subtracted from the second operand. see appendix f, ?simplified mnemonics,? in the programming environments manual , for examples. 3.2.4.1.2 integer compare instructions the integer compare instructions algebraically or logically compare the contents of r a with either the uimm operand, the simm operand, or the contents of r b. the comparison is signed for the cmpi and cmp instructions, and unsigned for the cmpli and cmpl instructions. table 3-4 lists the integer compare instructions. the crf d operand can be omitted if the result of the comparison is to be placed in cr0. otherwise, the target cr field must be specified in the instruction crf d field. for more information refer to appendix f, ?simplified mnemonics,? in the programming environments manual . 3.2.4.1.3 integer logical instructions the logical instructions shown in table 3-5 perform bit-parallel operations. logical instructions with the cr update enabled and instructions andi. and andis. set cr field cr0 to characterize the result of the logical operation. these fields are set as if the sign-extended low-order 32 bits of the result were algebraically compared to zero. logical instructions without cr update and the remaining logical instructions do not modify the cr. logical instructions do not affect the xer[so], xer[ov], and xer[ca] bits. for simplified mnemonics examples for the integer logical operations see appendix f, ?simplified mnemonics,? in the programming environments manual . table 3-4. integer compare instructions name mnemonic operand syntax compare cmp crf d , l ,r a ,r b compare immediate cmpi crf d,l, r a,simm compare logical cmpl crf d , l ,r a ,r b compare logical immediate cmpli crf d , l ,r a , uimm f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-14 g2 powerpc core reference manual motorola instruction set summary 3.2.4.1.4 integer rotate and shift instructions rotation operations are performed on data from a gpr, and the result, or a portion of the result, is returned to a gpr. see appendix f, ?simplified mnemonics,? in the programming environments manual , for a complete list of simplified mnemonics that allows simpler coding of often-used functions such as clearing the leftmost or rightmost bits of a register, left justifying or right justifying an arbitrary field, and simple rotates and shifts. integer rotate instructions rotate the contents of a register. the result of the rotation is either inserted into the target register under control of a mask (if a mask bit is 1, the associated bit of the rotated data is placed into the target register; and if the mask bit is 0, the associated bit in the target register is unchanged), or anded with a mask before being placed into the target register. the integer rotate instructions are listed in table 3-6. table 3-5. integer logical instructions name mnemonic operand syntax and and ( and. ) r a ,r s ,r b and immediate andi. r a ,r s , uimm and immediate shifted andis. r a ,r s , uimm and with complement andc ( andc. ) r a ,r s ,r b count leading zeros word cntlzw ( cntlzw. ) r a ,r s equivalent eqv ( eqv. ) r a ,r s ,r b extend sign byte extsb ( extsb. ) r a ,r s extend sign half word extsh ( extsh. ) r a ,r s nand nand ( nand. ) r a ,r s ,r b nor nor ( nor. ) r a ,r s ,r b or or ( or. ) r a ,r s ,r b or immediate ori r a ,r s , uimm or immediate shifted oris r a ,r s , uimm or with complement orc ( orc. ) r a ,r s ,r b xor xor ( xor. ) r a ,r s ,r b xor immediate xori r a ,r s , uimm xor immediate shifted xoris r a ,r s , uimm f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-15 instruction set summary the integer shift instructions perform left and right shifts. immediate-form logical (unsigned) shift operations are obtained by specifying masks and shift values for certain rotate instructions. simplified mnemonics are provided, making coding of such shifts simpler and easier to understand. multiple-precision shifts can be programmed as shown in appendix c, ?multiple-precision shifts,? in the programming environments manual . the integer shift instructions are listed in table 3-7. 3.2.4.2 floating-point instructions this section describes the floating-point instructions, which include the following: floating-point arithmetic instructions floating-point multiply-add instructions floating-point rounding and conversion instructions floating-point compare instructions floating-point status and control register instructions floating-point move instructions see section 3.2.4.3, ?load and store instructions,? for information about floating-point loads and stores. the powerpc architecture supports a floating-point system as defined in the ieee 754 standard, but requires software support to conform with that standard. all floating-point operations conform to the ieee 754 standard, except if software sets the non-ieee mode bit (ni) in the fpscr. the g2 core is in the nondenormalized mode when the ni bit is set in the fpscr. if a denormalized result is produced, a default result of zero is generated. table 3-6. integer rotate instructions name mnemonic operand syntax rotate left word immediate then and with mask rlwinm ( rlwinm. ) r a ,r s , sh , mb , me rotate left word immediate then mask insert rlwimi ( rlwimi. ) r a ,r s , sh , mb , me rotate left word then and with mask rlwnm ( rlwnm. ) r a ,r s ,r b , mb , me table 3-7. integer shift instructions name mnemonic operand syntax shift left word slw ( slw. ) r a ,r s ,r b shift right algebraic word sraw ( sraw. ) r a ,r s ,r b shift right algebraic word immediate srawi ( srawi. ) r a ,r s , sh shift right word srw ( srw. ) r a ,r s ,r b f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-16 g2 powerpc core reference manual motorola instruction set summary the generated zero has the same sign as the denormalized number. the core performs single- and double-precision floating-point operations compliant with the ieee 754 floating-point standard. implementation note ?single-precision denormalized results require two additional processor clock cycles to round. when loading or storing a single-precision denormalized number, the load/store unit may take up to 24 processor clock cycles to convert between the internal double-precision format and the external single-precision format. 3.2.4.2.1 floating-point arithmetic instructions the floating-point arithmetic instructions are listed in table 3-8. 3.2.4.2.2 floating-point multiply-add instructions these instructions combine multiply and add operations without an intermediate rounding operation. the fractional part of the intermediate product is 106 bits wide, and all 106 bits take part in the add/subtract portion of the instruction. the floating-point multiply-add instructions are listed in table 3-9. table 3-8. floating-point arithmetic instructions name mnemonic operand syntax floating add (double-precision) fadd ( fadd. ) fr d ,fr a ,fr b floating add single fadds ( fadds. ) fr d ,fr a ,fr b floating divide (double-precision) fdiv ( fdiv. ) fr d ,fr a ,fr b floating divide single fdivs ( fdivs. ) fr d ,fr a ,fr b floating multiply (double-precision) fmul ( fmul. ) fr d ,fr a ,fr c floating multiply single fmuls ( fmuls. ) fr d ,fr a ,fr c floating reciprocal estimate single fres ( fres. ) fr d ,fr b floating reciprocal square root estimate frsqrte ( frsqrte. ) fr d ,fr b floating select fsel ( fsel. ) fr d ,fr a ,fr c ,fr b floating subtract (double-precision) fsub ( fsub. ) fr d ,fr a ,fr b floating subtract single fsubs ( fsubs. ) fr d ,fr a ,fr b table 3-9. floating-point multiply-add instructions name mnemonic operand syntax floating multiply-add (double-precision) fmadd ( fmadd. ) fr d ,fr a ,fr c ,fr b floating multiply-add single fmadds ( fmadds. ) fr d ,fr a ,fr c ,fr b floating multiply-subtract (double-precision) fmsub ( fmsub. ) fr d ,fr a ,fr c ,fr b floating multiply-subtract single fmsubs ( fmsubs. ) fr d ,fr a ,fr c ,fr b f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-17 instruction set summary implementation note ?single-precision multiply-type instructions operate faster than their double-precision equivalents. see chapter 7, ?instruction timing,? for more information. 3.2.4.2.3 floating-point rounding and conversion instructions the floating round to single-precision ( frsp ) instruction is used to truncate a 64-bit double-precision number to a 32-bit single-precision floating-point number. the floating-point conversion instructions convert a 64-bit double-precision floating-point number to a 32-bit signed integer number. the powerpc architecture defines bits 0?31 of floating-point register fr d as undefined when executing the floating convert to integer word ( fctiw ) and floating convert to integer word with round toward zero ( fctiwz ) instructions. examples of uses of these instructions to perform various conversions can be found in appendix d, ?floating-point models,? in the programming environments manual . the floating-point rounding instructions are shown in table 3-10. 3.2.4.2.4 floating-point compare instructions floating-point compare instructions compare the contents of two floating-point registers. the comparison ignores the sign of zero (that is +0 = ?0). the floating-point compare instructions are listed in table 3-11. floating negative multiply-add (double-precision) fnmadd ( fnmadd. ) fr d ,fr a ,fr c ,fr b floating negative multiply-add single fnmadds ( fnmadds. ) fr d ,fr a ,fr c ,fr b floating negative multiply-subtract (double-precision) fnmsub ( fnmsub. ) fr d ,fr a ,fr c ,fr b floating negative multiply-subtract single fnmsubs ( fnmsubs. ) fr d ,fr a ,fr c ,fr b table 3-10. floating-point rounding and conversion instructions name mnemonic operand syntax floating convert to integer word fctiw ( fctiw. ) fr d ,fr b floating convert to integer word with round toward zero fctiwz ( fctiwz. ) fr d ,fr b floating round to single-precision frsp ( frsp. ) fr d ,fr b table 3-9. floating-point multiply-add instructions (continued) name mnemonic operand syntax f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-18 g2 powerpc core reference manual motorola instruction set summary 3.2.4.2.5 floating-point status and control register instructions every fpscr instruction appears to synchronize the effects of all floating-point instructions executed by a given processor. executing an fpscr instruction ensures that all floating-point instructions previously initiated by the given processor appear to have completed before the fpscr instruction is initiated and that no subsequent floating-point instructions appear to be initiated by the given processor until the fpscr instruction has completed. the fpscr instructions are listed in table 3-12. implementation note ?the architecture notes that, in some implementations, the move to fpscr fields ( mtfsf x ) instruction may perform more slowly when only a portion of the fields are updated as opposed to all of the fields. this is not the case in the g2 core. 3.2.4.2.6 floating-point move instructions floating-point move instructions copy data from one floating-point register to another. the floating-point move instructions do not modify the fpscr. the cr update option in these instructions controls the placing of result status into cr1. floating-point move instructions are listed in table 3-13. table 3-11. floating-point compare instructions name mnemonic operand syntax floating compare ordered fcmpo crf d ,fr a ,fr b floating compare unordered fcmpu crf d ,fr a ,fr b table 3-12. floating-point status and control register instructions name mnemonic operand syntax move from fpscr mffs ( mffs. ) fr d move to condition register from fpscr mcrfs crf d ,crf s move to fpscr bit 0 mtfsb0 ( mtfsb0. ) crb d move to fpscr bit 1 mtfsb1 ( mtfsb1. ) crb d move to fpscr field immediate mtfsfi ( mtfsfi. ) crf d , imm move to fpscr fields mtfsf ( mtfsf. )fm ,fr b table 3-13. floating-point move instructions name mnemonic operand syntax floating absolute value fabs ( fabs. ) fr d ,fr b floating move register fmr ( fmr. ) fr d ,fr b floating negate fneg ( fneg. ) fr d ,fr b floating negative absolute value fnabs ( fnabs. ) fr d ,fr b f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-19 instruction set summary 3.2.4.3 load and store instructions load and store instructions are issued and translated in program order; however, the accesses can occur out of order. synchronizing instructions are provided to enforce strict ordering. this section describes the load and store instructions of the g2 core, which consist of the following: integer load instructions integer store instructions integer load and store with byte-reverse instructions integer load and store multiple instructions integer load and store string instructions floating-point load instructions floating-point store instructions 3.2.4.3.1 self-modifying code when a processor modifies a memory location that may be contained in the instruction cache, software must ensure that memory updates are visible to the instruction fetching mechanism. this can be achieved by the following instruction sequence: dcbst |update memory sync |wait for update icbi |remove (invalidate) copy in instruction cache isync |remove copy in own instruction buffer these operations are required because the data cache is a write-back cache. since instruction fetching bypasses the data cache, changes to items in the data cache may not be reflected in memory until the fetch operations complete. special care must be taken to avoid coherency paradoxes in systems that implement unified secondary caches, and designers should carefully follow the guidelines for maintaining cache coherency that are provided in the vea, and discussed in chapter 5, ?cache model and memory coherency,? in the programming environments manual . because the core does not broadcast the m bit for instruction fetches, external caches are subject to coherency paradoxes. 3.2.4.3.2 integer load and store address generation integer load and store operations generate effective addresses using register indirect with immediate index mode, register indirect with index mode, or register indirect mode. see section 3.2.2.3, ?effective address calculation.? note that the core is optimized for load and store operations that are aligned on natural boundaries, and operations that are not naturally aligned may suffer performance degradation. refer to section 5.5.6.1, ?integer alignment exceptions.? f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-20 g2 powerpc core reference manual motorola instruction set summary 3.2.4.3.3 register indirect integer load instructions for integer load instructions, the byte, half word, word, or double word addressed by the ea is loaded into r d. many integer load instructions have an update form, in which r a is updated with the generated effective address. for these forms, the ea is placed into r a and the memory element (byte, half word, word, or double word) addressed by ea is loaded into r d. implementation note ?in some implementations, the load half word algebraic instructions ( lha and lhax ) and the load with update ( lbzu , lbzux , lhzu , lhzux , lhau , lhaux , lwu , and lwux ) instructions may execute with greater latency than other types of load instructions. in the g2 core, these instructions operate with the same latency as other load instructions. table 3-14 lists the integer load instructions. 3.2.4.3.4 integer store instructions for integer store instructions, the contents of r s are stored into the byte, half word, word, or double word in memory addressed by the effective address. many store instructions have table 3-14. integer load instructions name mnemonic operand syntax load byte and zero lbz r d , d( r a) load byte and zero indexed lbzx r d ,r a ,r b load byte and zero with update lbzu r d , d( r a) load byte and zero with update indexed lbzux r d ,r a ,r b load half word algebraic lha r d , d( r a) load half word algebraic indexed lhax r d ,r a ,r b load half word algebraic with update lhau r d , d( r a) load half word algebraic with update indexed lhaux r d ,r a ,r b load half word and zero lhz r d , d( r a) load half word and zero indexed lhzx r d ,r a ,r b load half word and zero with update lhzu r d , d( r a) load half word and zero with update indexed lhzux r d ,r a ,r b load word and zero lwz r d , d( r a) load word and zero indexed lwzx r d ,r a ,r b load word and zero with update lwzu r d , d( r a) load word and zero with update indexed lwzux r d ,r a ,r b f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-21 instruction set summary an update form, in which r a is updated with the ea. for these forms, the following rules apply: if r a 0, the ea is placed into r a. if r s = r a, the contents of r s are copied to the target memory element, then the generated ea is placed into r a ( r s). the g2 core defines store with update instructions with r a = 0 and integer store instructions with the cr update option enabled (rc field, bit 31, in the instruction encoding = 1) to be invalid forms. table 3-15 provides a list of the integer store instructions for the core. 3.2.4.3.5 integer load and store with byte-reverse instructions table 3-16 describes integer load and store with byte-reverse instructions. when used in a system operating with the default big-endian byte order, these instructions have the effect of loading and storing data in little-endian order. likewise, when used in a system operating with little-endian byte order, these instructions have the effect of loading and storing data in big-endian order. when used in a g2_le core-based system operating with true little-endian byte order, these instructions have the effect of loading and storing data in true little-endian order. for more information about big- and little-endian byte ordering, see section 3.1.2, ?byte ordering,? in the programming environments manual . for more information about true little-endian operation, see section 3.1.2, ?endian modes and byte ordering.? table 3-15. integer store instructions name mnemonic operand syntax store byte stb r s , d( r a) store byte indexed stbx r s ,r a ,r b store byte with update stbu r s , d( r a) store byte with update indexed stbux r s ,r a ,r b store half word sth r s , d( r a) store half word indexed sthx r s ,r a ,r b store half word with update sthu r s , d( r a) store half word with update indexed sthux r s ,r a ,r b store word stw r s , d( r a) store word indexed stwx r s ,r a ,r b store word with update stwu r s , d( r a) store word with update indexed stwux r s ,r a ,r b f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-22 g2 powerpc core reference manual motorola instruction set summary the g2_le core supports the true little-endian mode. in true little-endian mode, the core treats the memory and i/o subsystems as little-endian memory. in this case, instruction and data bytes are reserved as follows: the byte reversing for instruction accesses occurs before the instruction is decoded. the byte reversing occurs for data accesses when the data item is being moved to or from the gpr. therefore, byte reversal during the load or store accesses is performed between memory or the data cache, and the register files. implementation note ?in some implementations, load byte-reverse instructions ( lhbrx and lwbrx ) may have greater latency than other load instructions; however, these instructions operate with the same latency as other load instructions in the core. 3.2.4.3.6 integer load and store multiple instructions the integer load/store multiple instructions are used to move blocks of data to and from the gprs. in some implementations, these instructions are likely to have greater latency and take longer to execute, perhaps much longer, than a sequence of individual load or store instructions that produce the same results. implementation notes ?the following describes the g2 core implementation of the load/store multiple instruction: the load multiple and store multiple instructions may have operands that require memory accesses crossing a 4-kbyte page boundary. as a result, these instructions may be interrupted by a dsi exception associated with the address translation of the second page. in this case, the core performs some or all of the memory references from the first page, and none of the memory references from the second page before taking the exception. on return from the dsi exception, the load or store multiple instruction will re-execute from the beginning. for additional information, refer to ?dsi exception (0x00300)? in chapter 6, ?exceptions,? in the programming environments manual . the powerpc architecture defines the load multiple word ( lmw ) instruction with r a in the range of registers to be loaded as an invalid form. it defines the load multiple and store multiple instructions with misaligned operands (that is, the ea is not a multiple of four) to cause an alignment exception. the core defines the load multiple table 3-16. integer load and store with byte-reverse instructions name mnemonic operand syntax load half word byte-reverse indexed lhbrx r d ,r a ,r b load word byte-reverse indexed lwbrx r d ,r a ,r b store half word byte-reverse indexed sthbrx r s ,r a ,r b store word byte-reverse indexed stwbrx r s ,r a ,r b f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-23 instruction set summary word ( lmw ) instruction with r a in the range of registers to be loaded as an invalid form. the powerpc architecture describes some preferred instruction forms for the integer load and store multiple instructions that may perform better than other forms in some implementations. none of these preferred forms affect instruction performance in the g2 core. when the core is operating with little-endian byte order, execution of a load or store multiple instruction causes the system alignment error handler to be invoked; see section 3.1.2, ?byte ordering,? in the programming environments manual , for more information. table 3-17 lists the integer load and store multiple instructions for the g2 core. 3.2.4.3.7 integer load and store string instructions the integer load and store string instructions allow movement of data from memory to registers or from registers to memory without concern for alignment. these instructions can be used for a short move between arbitrary memory locations or to initiate a long move between misaligned memory fields. when the core is operating with little-endian byte order, execution of a load or store string instruction causes the system alignment error handler to be invoked; see section 3.1.2, ?byte ordering,? in the programming environments manual , for more information. table 3-18 lists the integer load and store string instructions. load string and store string instructions may involve operands that are not word-aligned. as described in ?alignment exception (0x00600)? in chapter 6, ?exceptions,? in the programming environments manual , a misaligned string operation suffers a performance penalty compared to a word-aligned operation of the same type. table 3-17. integer load and store multiple instructions name mnemonic operand syntax load multiple word lmw r d , d( r a) store multiple word stmw r s , d( r a) table 3-18. integer load and store string instructions name mnemonic operand syntax load string word immediate lswi r d ,r a , nb load string word indexed lswx r d ,r a ,r b store string word immediate stswi r s ,r a , nb store string word indexed stswx r s ,r a ,r b f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-24 g2 powerpc core reference manual motorola instruction set summary when a string operation crosses a 4-kbyte boundary, the instruction may be interrupted by a dsi exception associated with the address translation of the second page. in this case, the core performs some or all memory references from the first page and none from the second before taking the exception. on return from the dsi exception, the load or store string instruction will re-execute from the beginning. for more information, refer to ?dsi exception (0x00300)? in chapter 6, ?exceptions,? in the programming environments manual . implementation note ?if r a is in the range of registers to be loaded for a load string word immediate ( lswi ) instruction or if either r a or r b is in the range of registers to be loaded for a load string word indexed ( lswx ) instruction, the powerpc architecture defines the instruction to be of an invalid form. in addition, the lswx and stswx instructions that specify a string length of zero are defined to be invalid by the powerpc architecture. however, none of these cases hold true for the g2 core?the core treats these cases as valid forms. 3.2.4.3.8 floating-point load and store address generation floating-point load and store operations generate effective addresses using the register indirect with immediate index addressing mode and register indirect with index addressing mode (details are described below). floating-point loads and stores are not supported for direct-store accesses. the use of the floating-point load and store operations for direct-store accesses results in a dsi exception. 3.2.4.3.9 floating-point load instructions separate floating-point load instructions are used for single-precision and double-precision operands. because fprs support only double-precision format, the fpu converts single-precision data to double-precision format before loading the operands into the target fpr. this conversion is described fully in ?floating-point load instructions? in appendix d, ?floating-point models,? in the programming environments manual . implementation note ?the powerpc architecture defines load with update instructions with r a = 0 as an invalid form; however, the core treats this case as a valid form. table 3-19 provides a list of the floating-point load instructions. table 3-19. floating-point load instructions name mnemonic operand syntax load floating-point double lfd fr d , d( r a) load floating-point double indexed lfdx fr d ,r a ,r b load floating-point double with update lfdu fr d , d( r a) load floating-point double with update indexed lfdux fr d ,r a ,r b f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-25 instruction set summary 3.2.4.3.10 floating-point store instructions there are three basic forms of the store instruction?single-precision, double-precision, and integer. the integer form is supported by the optional stfiwx instruction. because the fprs support only double-precision format for floating-point data, the fpu converts double-precision data to single-precision format before storing the operands. the conversion steps are described in ?floating-point store instructions? in appendix d, ?floating-point models,? in the programming environments manual . implementation note ?the powerpc architecture defines store with update instructions with r a = 0 as an invalid form; however, the core treats this case as valid. table 3-20 lists the floating-point store instructions. 3.2.4.4 branch and flow control instructions branch instructions are executed by the branch processing unit (bpu). the bpu receives branch instructions from the fetch unit and performs cr lookahead operations on conditional branches to resolve them early, achieving the effect of a zero-cycle branch in many cases. load floating-point single lfs fr d , d( r a) load floating-point single indexed lfsx fr d ,r a ,r b load floating-point single with update lfsu fr d , d( r a) load floating-point single with update indexed lfsux fr d ,r a ,r b table 3-20. floating-point store instructions name mnemonic operand syntax store floating-point as integer word indexed stfiwx fr s ,r a ,r b store floating-point double stfd fr s , d( r a) store floating-point double indexed stfdx fr s ,r a ,r b store floating-point double with update stfdu fr s , d( r a) store floating-point double with update indexed stfdux fr s ,r a ,r b store floating-point single stfs fr s , d( r a) store floating-point single indexed stfsx fr s ,r a ,r b store floating-point single with update stfsu fr s , d( r a) store floating-point single with update indexed stfsux fr s ,r a ,r b table 3-19. floating-point load instructions (continued) name mnemonic operand syntax f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-26 g2 powerpc core reference manual motorola instruction set summary some branch instructions can redirect instruction execution conditionally based on the value of bits in the cr. when the branch processor encounters one of these instructions, it scans the execution pipelines to determine whether an instruction in progress may affect the particular cr bit. if no interlock is found, the branch can be resolved immediately by checking the bit in the cr and taking the action defined for the branch instruction. if an interlock is detected, the branch is considered unresolved and the direction of the branch is predicted using static branch prediction as described in ?conditional branch control? in chapter 4, ?addressing modes and instruction set summary,? in the programming environments manual . the interlock is monitored while instructions are fetched for the predicted branch. when the interlock is cleared, the branch processor determines whether the prediction was correct, based on the value of the cr bit. if the prediction is correct, the branch is considered completed and instruction fetching continues. if the prediction is incorrect, the fetched instructions are purged, and instruction fetching continues along the alternate path. see chapter 8, ?instruction timing,? in the programming environments manual , for more information about how branches are executed. 3.2.4.4.1 branch instruction address calculation branch instructions can change the instruction sequence. instruction addresses are always assumed to be word aligned; the processor ignores the two low-order bits of the generated branch target address. branch instructions compute the effective address (ea) of the next instruction address using the following addressing modes: branch relative branch conditional to relative address branch to absolute address branch conditional to absolute address branch conditional to link register branch conditional to count register 3.2.4.4.2 branch instructions table 3-21 lists the branch instructions provided by the processors that implement the powerpc architecture. to simplify assembly language programming, a set of simplified mnemonics and symbols is provided for the most frequently used forms of branch conditional, compare, trap, rotate and shift, and certain other instructions. see appendix f, ?simplified mnemonics,? in the programming environments manual , for a list of simplified mnemonic examples. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-27 instruction set summary 3.2.4.4.3 condition register logical instructions condition register logical instructions, shown in table 3-22, and the move condition register field ( mcrf ) instruction are also defined as flow control instructions, although they are executed by the system register unit (sru). most instructions executed by the sru are completion-serialized to maintain system state; that is, the instruction is held for execution in the sru until all prior instructions issued have completed. note that if the lr update option is enabled for any of these instructions, these forms of the instructions are invalid in the g2 core. 3.2.4.5 trap instructions the trap instructions shown in table 3-23 are provided to test for a specified set of conditions. if any of the conditions tested by a trap instruction are met, the system trap handler is invoked. if the tested conditions are not met, instruction execution continues normally. table 3-21. branch instructions name mnemonic operand syntax branch b ( ba bl bla ) target_addr branch conditional bc ( bca bcl bcla )bo , bi , target_addr branch conditional to count register bcctr ( bcctrl )bo , bi branch conditional to link register bclr ( bclrl )bo , bi table 3-22. condition register logical instructions name mnemonic operand syntax condition register and crand crb d ,crb a ,crb b condition register and with complement crandc crb d ,crb a ,crb b condition register equivalent creqv crb d ,crb a ,crb b condition register nand crnand crb d ,crb a ,crb b condition register nor crnor crb d ,crb a ,crb b condition register or cror crb d ,crb a ,crb b condition register or with complement crorc crb d ,crb a ,crb b condition register xor crxor crb d ,crb a ,crb b move condition register field mcrf crf d ,crf s table 3-23. trap instructions name mnemonic operand syntax trap word tw to ,r a ,r b trap word immediate twi to ,r a , simm f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-28 g2 powerpc core reference manual motorola instruction set summary see appendix f, ?simplified mnemonics,? in the programming environments manual , for a complete set of simplified mnemonics. 3.2.4.6 processor control instructions uisa-level processor control instructions are used to read from and write to the condition register (cr). 3.2.4.6.1 move to/from condition register instructions table 3-24 lists the instructions provided by the g2 core for reading from or writing to the cr. 3.2.4.7 memory synchronization instructions?uisa memory synchronization instructions control the order in which memory operations are completed with respect to asynchronous events and the order in which memory operations are seen by other processors or memory access mechanisms. see chapter 4, ?instruction and data cache operation,? for additional information about these instructions and about related aspects of memory synchronization. the sync instruction delays execution of subsequent instructions until previous instructions have completed to the point that they can no longer cause an exception and until all previous memory accesses are performed globally; the sync operation is not broadcast onto the g2 core 60x bus interface. additionally, all load and store cache/bus activities initiated by prior instructions are completed. touch load operations ( dcbt and dcbtst ) are required to complete at least through address translation but are not required to complete on the bus. the functions performed by the sync instruction normally take a significant amount of time to complete; as a result, frequent use of this instruction may adversely affect performance. in addition, the number of cycles required to complete a sync instruction depends on system parameters and on the processor's state when the instruction is issued. the proper paired use of the lwarx and stwcx. instructions allows programmers to emulate common semaphore operations such as test and set, compare and swap, exchange memory, and fetch and add. examples of these operations can be found in appendix e, ?synchronization programming examples,? in the programming environments manual . typically, the lwarx instruction should be paired with an stwcx. instruction with the same table 3-24. move to/from condition register instructions name mnemonic operand syntax move from condition register mfcr r d move to condition register fields mtcrf crm ,r s move to condition register from xer mcrxr crf d f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-29 instruction set summary effective address used for both instructions of the pair. note that the reservation granularity is 32 bytes. the concept behind the use of the lwarx and stwcx. instructions is that a processor may load a semaphore from memory, compute a result based on the value of the semaphore, and conditionally store it back to the same location (only if that location has not been modified since it was first read), and determine if the store was successful. the conditional store is performed, based on the existence of a reservation established by the preceding lwarx instruction. if the reservation exists when the store is executed, the store is performed which sets a bit in the cr. if the reservation does not exist when the store is executed, the target memory location is not modified and a bit is cleared in the cr. if the store was successful, the sequence of instructions from the read of the semaphore to the store that updated the semaphore appear to have been executed atomically (that is, no other processor or mechanism modified the semaphore location between the read and the update), thus providing the equivalent of a real atomic operation. however, in reality, other cores may have read from the location during this operation. in the g2 core, the reservations are made on behalf of aligned 32-byte sections of the memory address space. the lwarx and stwcx. instructions require the ea to be aligned. exception handling software should not attempt to emulate a misaligned lwarx or stwcx. instruction, because there is no correct way to define the address associated with the reservation. in general, the lwarx and stwcx. instructions should be used only in system programs, which can be invoked by application programs as needed. at most, one reservation exists simultaneously on any processor. the address associated with the reservation can be changed by a subsequent lwarx instruction. the conditional store is performed, based on the existence of a reservation established by the preceding lwarx regardless of whether the address generated by the lwarx matches that generated by the stwcx. instruction. a reservation held by the processor is cleared by one of the following: executing an stwcx. instruction to any address attempt by some other device to modify a location in the reservation granularity (32 bytes) the lwarx and stwcx. instructions to write-through memory do not cause a dsi exception. table 3-25 lists the uisa memory synchronization instructions for the g2 core. table 3-25. memory synchronization instructions?uisa name mnemonic operand syntax load word and reserve indexed lwarx r d ,r a ,r b store word conditional indexed stwcx. r s ,r a ,r b synchronize sync ? f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-30 g2 powerpc core reference manual motorola instruction set summary 3.2.5 powerpc vea instructions the vea describes the semantics of the memory model that can be assumed by software processes, and includes descriptions of the cache model, cache-control instructions, address aliasing, and other related issues. 3.2.5.1 processor control instructions the vea defines the move from time base ( mftb ) instruction for reading the contents of the time base register. the mftb is a user-level instruction, as shown in table 3-26. simplified mnemonics are provided for the mftb instruction so it can be coded with the tbr name as part of the mnemonic rather than requiring it to be coded as an operand. the mftb instruction serves as both a basic and simplified mnemonic. assemblers recognize an mftb mnemonic with two operands as the basic form, and an mftb mnemonic with one operand as the simplified form. simplified mnemonics are also provided for move from time base upper ( mftbu ), a variant of the mftb instruction rather than of mfspr . the core ignores the extended opcode differences between mftb and mfspr by ignoring bit 25 of both instructions and treating them identically. refer to appendix f, ?simplified mnemonics,? in the programming environments manual . 3.2.5.2 memory synchronization instructions?vea memory synchronization instructions control the order in which memory operations are performed with respect to asynchronous events, and the order in which memory operations are seen by other processors or memory access mechanisms. see chapter 4, ?instruction and data cache operation,? for additional information about these instructions and about related aspects of memory synchronization. implementation notes ?the following describes how the core handles memory synchronization in the vea. the instruction synchronize ( isync ) instruction causes the core to discard all prefetched instructions, wait for any preceding instructions to complete, and then branch to the next sequential instruction (having the effect of clearing the pipeline behind the isync instruction). the enforce in-order execution of i/o ( eieio ) instruction is used to ensure memory reordering of noncacheable memory access. because the core does not reorder noncacheable memory accesses, the eieio instruction is treated as a no-op. table 3-27 lists the vea memory synchronization instructions for the g2 core. table 3-26. move from time base instruction name mnemonic operand syntax move from time base mftb r d , tbr f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-31 instruction set summary 3.2.5.3 memory control instructions?vea memory control instructions include the following types: cache management instructions segment register manipulation instructions translation lookaside buffer management instructions this section describes the user-level cache management instructions defined by the vea. see section 3.2.6.3, ?memory control instructions?oea,? for information about supervisor-level cache, segment register manipulation, and translation lookaside buffer management instructions. the instructions listed in table 3-28 provide user-level programs the ability to manage on-chip caches when they exist. as with other memory-related instructions, the effect of the cache management instructions on memory are weakly ordered. if the programmer needs to ensure that cache or other instructions have been performed with respect to all other processors and system mechanisms, a sync instruction must be placed in the program following those instructions. note that when data address translation is disabled (msr[dr] = 0), the data cache block set to zero ( dcbz ) instruction allocates a cache block in the cache and may not verify that the physical address is valid. if a cache block is created for an invalid physical address, a machine check condition may result when an attempt is made to write that cache block back to memory. the cache block could be written back as a result of the execution of an instruction that causes a cache miss and the invalid addressed cache block is the target for replacement or a data cache block store ( dcbst ) instruction. table 3-27. memory synchronization instructions?vea name mnemonic operand syntax enforce in-order execution of i/o eieio ? instruction synchronize isync ? table 3-28. user-level cache instructions name mnemonic operand syntax data cache block flush dcbf ra,rb data cache block set to zero dcbz ra,rb data cache block store dcbst ra,rb data cache block touch dcbt ra,rb data cache block touch for store dcbtst ra,rb instruction cache block invalidate icbi ra,rb f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-32 g2 powerpc core reference manual motorola instruction set summary note that any cache control instruction that generates an effective address that corresponds to a direct-store segment (sr[t] = 1) is treated as a no-op. table 3-28 lists the cache instructions that are accessible to user-level programs. note that incoherency may occur if a write-through store is followed by a dcbz instruction that is, in turn, followed by a snoop, all to the same cache block. this occurs when the logical address for the dcbz and the write-through store are different, but aliased to the same physical page. to avoid potential adverse effects, dcbz should not address write-through memory that can be accessed through multiple logical addresses. explicit store instructions that write all zeros should be used instead. note that broadcasting a sequence of dcbz instructions may cause snoop accesses to be retried indefinitely, which may cause the snoop originator to time out or the snooped transaction to not complete. this can be avoided by disabling the broadcasting of dcbz by marking the memory space being addressed by the dcbz instruction as not global in the bat or pte. note that incoherency may occur if the following sequence of accesses hits the same cache block: a write-through, a dcbz instruction, a snoop. this occurs when the logical address for the dcbz and the write-through store are different, but aliased to the same physical page. 3.2.5.4 external control instructions the eciwx instruction provides an alternative way to map special devices. the mmu translation of the ea is not used to select the special device, as it is used in loads and stores. rather, it is used as an address operand that is passed to the device over the address bus. four other signals (the burst and size signals on the 60x bus) are used to select the device; these four signals output the 4-bit resource id (rid) field in the ear register. the eciwx instruction also loads a word from the data bus that is output by the special device. executing these instructions when msr[dr] = 0 causes a programming error, and the physical address on the bus is undefined. executing these instructions to a direct-store segment causes a dsi exception. the external control instructions are listed in table 3-29. 3.2.6 powerpc oea instructions the oea includes the structure of the memory management model, supervisor-level registers, and exception model. table 3-29. external control instructions name mnemonic operand syntax external control in word indexed eciwx rd,ra,rb external control out word indexed ecowx r s ,r a ,r b f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-33 instruction set summary 3.2.6.1 system linkage instructions this section describes the system linkage instructions (see table 3-30). the sc instruction is a user-level instruction that permits a user program to call on the system to perform a service and causes the processor to take an exception. the return from interrupt ( rfi ) instruction is a supervisor-level instruction that is useful for returning from an exception handler. the return from critical interrupt ( rfci ) instruction is a supervisor-level instruction that is only implemented in the g2_le processor core. the rfci instruction is useful for returning from a critical interrupt exception handler. this new instruction is described in section 3.2.8, ?implementation-specific instructions.? 3.2.6.2 processor control instructions?oea processor control instructions are used to read from and write to the condition register (cr), machine state register (msr), and special-purpose registers (sprs), and to read from the time base register (tbu or tbl). 3.2.6.2.1 move to/from machine state register instructions table 3-31 lists the instructions provided by the core for reading from or writing to the msr. 3.2.6.2.2 move to/from special-purpose register instructions simplified mnemonics are provided for the mtspr and mfspr instructions so they can be coded with the spr name as part of the mnemonic rather than as a numeric operand. see appendix f, ?simplified mnemonics,? in the programming environments manual , for simplified mnemonic examples. the mtspr and mfspr instructions are shown in table 3-32. table 3-30. system linkage instructions name mnemonic operand syntax return from interrupt rfi ? system call sc ? table 3-31. move to/from machine state register instructions name mnemonic operand syntax move from machine state register mfmsr r d move to machine state register mtmsr r s f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-34 g2 powerpc core reference manual motorola instruction set summary for mtspr and mfspr instructions, the spr number coded in assembly language does not appear directly as a 10-bit binary number in the instruction. the number coded is split into two 5-bit halves that are reversed in the instruction encoding, with the high-order 5 bits appearing in bits 16?20 of the instruction encoding and the low-order 5 bits in bits 11?15. if the spr field contains any value other than one of the values shown in table 3-33, either the program exception handler is invoked or the results are boundedly undefined. table 3-32. move to/from special-purpose register instructions name mnemonic operand syntax move from special-purpose register mfspr r d , spr move to special-purpose register mtspr spr ,r s table 3-33. implementation-specific spr encodings (mfspr) spr 1 register name access decimal spr[5?9] spr[0?4] 58 00001 11010 csrr0 2 supervisor 59 00001 11011 csrr1 2 supervisor 276 01000 10100 sprg4 2 supervisor 277 01000 10101 sprg5 2 supervisor 278 01000 10110 sprg6 2 supervisor 279 01000 10111 sprg7 2 supervisor 286 01000 11110 svr 2 supervisor 309 01001 10101 ibcr 2 supervisor 310 01001 10110 dbcr 2 supervisor 311 01001 10111 mbar 2 supervisor 317 01001 11101 dabr2 2 supervisor 560 10001 10000 ibat4u 2 supervisor 561 10001 10001 ibat4l 2 supervisor 562 10001 10010 ibat5u 2 supervisor 563 10001 10011 ibat5l 2 supervisor 564 10001 10100 ibat6u 2 supervisor 565 10001 10101 ibat6l 2 supervisor 566 10001 10110 ibat7u 2 supervisor 567 10001 10111 ibat7l 2 supervisor 568 10001 11000 dbat4u 2 supervisor 569 10001 11001 dbat4l 2 supervisor 570 10001 11010 dbat5u 2 supervisor 571 10001 11011 dbat5l 2 supervisor f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-35 instruction set summary implementation note ?the core ignores the extended opcode differences between mftb and mfspr by ignoring tb[25] and treating both instructions identically. 3.2.6.3 memory control instructions?oea this section describes memory control instructions, which include the following types: cache management instructions segment register manipulation instructions translation lookaside buffer management instructions 572 10001 11100 dbat6u 2 supervisor 573 10001 11101 dbat6l supervisor 574 10001 11110 dbat7u 2 supervisor 575 10001 11111 dbat7l 2 supervisor 976 11110 10000 dmiss supervisor 977 11110 10001 dcmp supervisor 978 11110 10010 hash1 supervisor 979 11110 10011 hash2 supervisor 980 11110 10100 imiss supervisor 981 11110 10101 icmp supervisor 982 11110 10110 rpa supervisor 1008 11111 10000 hid0 supervisor 1009 11111 10001 hid1 supervisor 1010 11111 10010 iabr supervisor 1011 11111 10011 hid2 supervisor 1013 11111 10101 dabr 2 supervisor 1018 11111 11010 iabr2 2 supervisor 1 note that the order of the two 5-bit halves of the spr number is reversed compared with actual instruction coding. for mtspr and mfspr instructions, the spr number coded in assembly language does not appear directly as a 10-bit binary number in the instruction. the number coded is split into two 5-bit halves that are reversed in the instruction, with the high-order 5 bits appearing in bits 16?20 of the instruction and the low-order 5 bits in bits 11?15. 2 these registers are implementation-specific for g2_le core only. table 3-33. implementation-specific spr encodings (mfspr) (continued) spr 1 register name access decimal spr[5?9] spr[0?4] f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-36 g2 powerpc core reference manual motorola instruction set summary 3.2.6.3.1 supervisor-level cache management instruction the supervisor-level cache management instruction in the powerpc architecture, dcbi , should not be used on the g2 core. if it is used it can cause a data storage interrupt. the user-level dcbf instruction, described in section 3.2.5.3, ?memory control instructions?vea? and section 4.8, ?cache control instructions,? should be used when the program needs to invalidate cache blocks. note that the dcbf instruction causes modified blocks to be flushed to system memory if they are the target of a dcbf instruction, whereas, by definition in the powerpc architecture, the dcbi instruction only invalidates modified blocks. 3.2.6.3.2 segment register manipulation instructions the instructions listed in table 3-34 provide access to the segment registers for the g2 core. these instructions operate completely independent of the msr[ir] and msr[dr] bit settings. refer to ?synchronization requirements for special registers and tlbs? in chapter 2, ?register set,? in the programming environments manual , for serialization requirements and other recommended precautions to observe when manipulating the segment registers. 3.2.6.3.3 translation lookaside buffer management instructions the address translation mechanism is defined in terms of segment descriptors and page table entries (ptes) used by the processors to locate the effective-to-physical address mapping for a particular access. the ptes reside in page tables in memory. as defined for 32-bit implementations by the powerpc architecture, segment descriptors reside in 16 on-chip segment registers. implementation note ?the g2 core provides the ability to invalidate a tlb entry. the tlb invalidate entry ( tlbie ) instruction invalidates the tlb entry indexed by the ea, and operates on both the instruction and data tlbs simultaneously invalidating four tlb entries (both sets in each tlb). the index corresponds to bits 15?19 of the ea. to invalidate all entries within both tlbs, 32 tlbie instructions should be issued, incrementing this field by one each time. the core provides two implementation-specific instructions ( tlbld and tlbli ) that are used by software table search operations following tlb misses to load tlb entries on-chip. table 3-34. segment register manipulation instructions name mnemonic operand syntax move from segment register mfsr r d , sr move from segment register indirect mfsrin r d ,r b move to segment register mtsr sr ,r s move to segment register indirect mtsrin r s ,r b f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-37 instruction set summary for more information on tlbld and tlbli refer to section 3.2.8, ?implementation-specific instructions.? note that the tlbia instruction is not implemented on the core. refer to chapter 6, ?memory management,? for more information about the tlb operations for the g2 core. table 3-35 lists the tlb instructions. because the presence and exact semantics of the translation lookaside buffer management instructions is implementation-dependent, system software should incorporate uses of the instructions into subroutines to maximize compatibility with programs written for other processors. for more information on the powerpc instruction set, refer to chapter 4, ?addressing modes and instruction set summary,? and chapter 8, ?instruction set,? in the programming environments manual . 3.2.7 recommended simplified mnemonics to simplify assembly language programs, a set of simplified mnemonics is provided for some of the most frequently used operations (such as no-op, load immediate, load address, move register, and complement register). powerpc compliant assemblers provide the simplified mnemonics listed in ?recommended simplified mnemonics? in appendix f, ?simplified mnemonics,? in the programming environments manual , and listed with some of the instruction descriptions in this chapter. programs written to be portable across the various assemblers for the powerpc architecture should not assume the existence of mnemonics not described in this document. for a complete list of simplified mnemonics, see appendix f, ?simplified mnemonics,? in the programming environments manual . 3.2.8 implementation-specific instructions this section provides a detailed look at the two g2 and one g2_le core implementation-specific instructions? tlbld , tlbli , and rfci , respectively. table 3-35. translation lookaside buffer management instructions name mnemonic operand syntax load data tlb entry tlbld r b load instruction tlb entry tlbli r b tlb invalidate entry tlbie r b tlb synchronize tlbsync ? f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-38 g2 powerpc core reference manual motorola instruction set summary tlbld tlbld load data tlb entry integer unit tlbld r b ea ( r b) tlb entry created from dcmp and rpa dtlb entry selected by ea[15-19] and srr1[way] created tlb entry the ea is the contents of r b. the tlbld instruction loads the contents of the data pte compare (dcmp) and required physical address (rpa) registers into the first word of the selected data tlb entry. the specific dtlb entry to be loaded is selected by the ea and srr1[way] bit. the tlbld instruction should only be executed when address translation is disabled (msr[ir] = 0 and msr[dr] = 0). note that it is possible to execute the tlbld instruction when address translation is enabled; however, extreme caution should be used in doing so. if data address translation is set (msr[dr] = 1) tlbld must be preceded by a sync instruction and succeeded by a context synchronizing instruction. also, note that care should be taken to avoid modification of the instruction tlb entries that translate current instruction prefetch addresses. this is a supervisor-level instruction; it is also a g2 core-specific instruction, and not part of the powerpc instruction set. other registers altered: none 05610111516 2021 3031 reserved 31 0 0 0 0 0 0 0 0 0 0 b 978 0 b 978 0 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 3. instruction set model 3-39 instruction set summary tlbli tlbli load instruction tlb entry integer unit tlbld r b ea ( r b) tlb entry created from icmp and rpa itlb entry selected by ea[15-19] and srr1[way] created tlb entry the ea is the contents of r b. the tlbli instruction loads the contents of the instruction pte compare (icmp) and required physical address (rpa) registers into the first word of the selected instruction tlb entry. the specific itlb entry to be loaded is selected by the ea and srr1[way] bit. the tlbli instruction should only be executed when address translation is disabled (msr[ir] = 0 and msr[dr] = 0). note that it is possible to execute the tlbld instruction when address translation is enabled; however, extreme caution should be used in doing so. if instruction address translation is set (msr[ir] = 1), tlbli must be followed by a context synchronizing instruction such as isync or rfi . also, note that care should be taken to avoid modification of the instruction tlb entries that translate current instruction prefetch addresses. this is a supervisor-level instruction; it is also a g2 core-specific instruction, and not part of the powerpc instruction set. other registers altered: none 05610111516 2021 3031 reserved 31 0 0 0 0 0 0 0 0 0 0 b 1010 0 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 3-40 g2 powerpc core reference manual motorola instruction set summary rfci rfci return from critical interrupt msr[16?27, 30?31] csrr1[16?27, 30?31] nia iea csrr0[0?29] || 0b00 bits csrr1[16-27, 30?31] are placed into the corresponding bits of the msr. if the new msr value does not enable any pending exceptions, then the next instruction is fetched, under control of the new msr value, from the address csrr0[0?29] || 0b00. if the new msr value enables one or more pending exceptions, the exception associated with the highest priority pending exception is generated; in this case the value placed into csrr0 by the exception processing mechanism is the address of the instruction that would have been executed next had the exception not occurred. note that an implementation may define additional msr bits, and in this case, may also cause them to be saved to csrr1 from msr on an exception and restored to msr from csrr1 on an rfci . this is a supervisor-level, context synchronizing instruction. this instruction is defined only for 32-bit implementations. other registers altered: msr reserved 056101115162021 3031 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 51 0 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-1 chapter 4 instruction and data cache operation the g2 core provides two 16-kbyte, four-way set-associative caches to allow the registers and execution units rapid access to instructions and data. both the instruction and data caches are tightly coupled to the g2 core bus interface unit (biu) to allow efficient access to the system memory controller and other bus masters. the g2 core load/store unit (lsu) is also directly coupled to the data cache to allow the efficient movement of data to and from the general-purpose and floating-point registers. this chapter describes the organization of the cache, cache coherency protocols, cache control instructions, and various cache operations. it describes the interaction between the caches, the load/store unit, the instruction unit, and the memory subsystem. it also describes the cache way-locking features provided in the g2 core. note that in this chapter, the term multiprocessor is used in the context of maintaining cache coherency. these multiprocessor devices could be actual processors or other devices that can access system memory, maintain their own caches, and function as bus masters requiring cache coherency. 4.1 overview both the instruction and data caches have 32-byte blocks, and data cache blocks can be snooped or cast out when the cache block is reloaded. the data cache is designed to adhere to a write-back policy, but the g2 core allows control of cacheability, write-back policy, and memory coherency at the page and block level. both caches use a least recently used (lru) replacement policy. burst fill operations to the caches result from cache misses, or in the case of the data cache, cache block write-back operations to memory. note that in the powerpc architecture, the term ?cache block,? or simply ?block? when used in the context of cache implementations, refers to the unit of memory at which coherency is maintained. for the g2 core, the block size is equivalent to the eight-word cache line. this value may be different for other implementations that support the powerpc architecture. the data cache is configured as 128 sets of 4 blocks. each block consists of 32 bytes, 2 state bits, and an address tag. the two state bits implement the three-state mei (modified/ exclusive/invalid) protocol, a coherent subset of the standard four-state mesi protocol. cache coherency is enforced by on-chip bus snooping logic. since the g2 core data cache f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-2 g2 powerpc core reference manual motorola overview tags are single-ported, a simultaneous load or store and snoop access represent a resource contention. the snoop access is given first access to the tags. load or store operations can be performed to the cache on the clock cycle immediately following a snoop access if the snoop misses. snoop hits may block the data cache for two or more cycles, depending on whether a copy back to main memory is required. the instruction cache also consists of 128 sets of 4 blocks, and each block consists of 32 bytes, an address tag, and a valid bit. the instruction cache is only written as a result of a block fill operation on a cache miss. in the g2 core, the instruction cache is blocked only until the critical load completes. the g2 core supports instruction fetching from other instruction cache lines following the forwarding of the critical-first-double-word of a cache line load operation. successive instruction fetches from the cache line being loaded are forwarded, and accesses to other instruction cache lines can proceed during the cache line load operation. the instruction cache is not snooped, and cache coherency must be maintained by software. a fast hardware invalidation capability is provided to support cache maintenance. the load/store unit provides the data transfer interface between the data cache and the gprs and fprs. the lsu provides all logic required to calculate effective addresses, handle data alignment to and from the data cache, and provides sequencing for load and store string and multiple operations. as shown in figure 1-1, the caches provide a 64-bit interface to the instruction fetcher and lsu. write operations to the data cache can be performed on a byte, half-word, word, or double-word basis. the g2 core bus interface unit receives requests for bus operations from the instruction and data caches, and executes the operations according to the g2 core bus protocol. the biu provides address queues, prioritization, and bus control logic. the biu also captures snoop addresses for data cache, address queue, and memory reservation ( lwarx and stwcx . instruction) operations. the biu also contains a touch load address buffer used for address compares during load or store operations. all the data for the corresponding address queues (load and store data queues) is located in the data cache. the data queues are considered temporary storage for the cache and not part of the biu. on a cache miss, the g2 core cache blocks are loaded in four beats of 64 bits each when the g2 core is configured with a 64-bit data bus; when the g2 core is configured with a 32-bit bus, cache block loads are performed with eight beats of 32 bits each. the burst load is performed as critical-double-word-first. the data cache is blocked to internal accesses until the load completes; the instruction cache allows sequential fetching during a cache block load. in the g2 core, the critical-double-word is simultaneously written to the cache and forwarded to the requesting unit, thus minimizing stalls due to load delays. note that the cache being filled cannot be accessed internally until the fill completes. when address translation is enabled, the memory access is performed under the control of the page table entry used to translate the effective address. each page table entry and bat contains four mode control bits, w, i, m, and g, that specify the storage mode for all f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-3 instruction cache organization and control accesses translated using that particular page table entry. the w (write-through) and i (caching-inhibited) bits control how the processor executing the access uses its own cache. the m (memory coherence) bit specifies whether the processor executing the access must use the mei (modified, exclusive, or invalid) cache coherence protocol to ensure all copies of the addressed memory location are kept consistent. the g (guarded memory) bit controls whether out-of-order data and instruction fetching is permitted. the g2 core maintains data cache coherency in hardware by coordinating activity between the data cache, memory system, and bus interface logic. as bus operations are performed on the bus by other bus masters, the g2 core bus snooping logic monitors the addresses that are referenced. these addresses are compared with the addresses resident in the data cache. if there is a snoop hit, the g2 core bus snooping logic responds to the bus interface with the appropriate snoop status (for example, a core_artry_out ). additional snoop action may be forwarded to the cache as a result of a snoop hit in some cases (a cache push of modified data or cache block invalidation). the g2 core supports a fully-coherent 4-gbyte physical memory address space. bus snooping is used to drive the mei three-state cache-coherency protocol that ensures the coherency of global memory with respect to the processor?s cache. see section 4.7.1, ?mei state definitions.? this chapter describes the organization of the g2 core on-chip instruction and data caches, the mei cache coherency protocol, cache control instructions, various cache operations, and the interaction between the cache, lsu, and biu. g2 core specific information is noted where applicable. 4.2 instruction cache organization and control the instruction fetcher accesses the instruction cache frequently in order to sustain the high throughput provided by the six-entry instruction queue. 4.2.1 instruction cache organization the instruction cache organization is shown in figure 4-1. each cache block contains eight contiguous words from memory that are loaded from an eight-word boundary (that is, bits a27?a31 of the effective addresses are zero); thus, a cache block never crosses a page boundary. misaligned accesses across a page boundary can incur a performance penalty. note that address bits a20?a26 provide an index to select a set. bits a27?a31 select a byte within a block. the tags consists of bits pa0?pa19. address translation occurs in parallel, such that higher-order bits (the tag bits in the cache) are physical. note that the replacement algorithm is strictly an lru algorithm; that is, the least-recently used block is filled with new instructions on a cache miss. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-4 g2 powerpc core reference manual motorola instruction cache organization and control figure 4-1. instruction cache organization 4.2.2 instruction cache fill operations the g2 core instruction cache blocks are loaded in four 64-bit beats, with the critical-double-word loaded first. the instruction cache allows sequential fetching during a cache block load. on a cache miss, the critical and following double words read from memory are simultaneously written to the instruction cache and forwarded to the dispatch queue, thus minimizing stalls due to cache fill latency. there is no snooping of the instruction cache. in the g2 core, the critical-double-word is simultaneously written to the cache and forwarded to the requesting unit, thus minimizing stalls due to load delays. 4.2.3 instruction cache control in addition to instruction cache control instructions, the g2 core provides several hid0 bits to control invalidating, disabling, and locking the instruction cache. the wimg bits in the page tables and the ibats also affect the cacheability of pages and whether the pages are considered guarded. 4.2.3.1 instruction cache invalidation although the g2 core instruction cache is automatically invalidated during a power-on or hard reset, asserting core_sreset does not invalidate the instruction cache. software can invalidate the contents of the instruction cache using the instruction cache flash invalidate control bit, hid0[icfi]. flash invalidation of the instruction cache is accomplished by setting icfi bit (invalidates the cache) and subsequently clearing the icfi bit (enables normal operation) in two consecutive mtspr [hid0] instructions. address tag 1 address tag 2 address tag 3 block 1 block 2 block 3 128 sets address tag 0 block 0 8 words/block state state state words 0?7 words 0?7 words 0?7 words 0?7 state f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-5 data cache organization and control 4.2.3.2 instruction cache disabling the instruction cache may be disabled through the use of the instruction cache enable control bit, hid0[ice]. when the instruction cache is in the disabled state, the cache tag state bits are ignored and all accesses are propagated to the bus as single-beat transactions. the ice bit is cleared during a power-on reset, causing the instruction cache to be disabled. to prevent the cache from being enabled or disabled in the middle of a data access, an isync instruction should be issued before changing the value of ice. 4.2.3.3 instruction cache locking the contents of instruction cache may be locked through the use of hid0[ilock]. a locked instruction cache supplies instructions normally on a cache hit, but cache misses are treated as cache-inhibited accesses. the cache-inhibited (core_ci ) signal is asserted if a cache access misses into a locked cache. the setting of the ilock bit must be preceded by an isync instruction to prevent the instruction cache from being locked during an instruction access. note that the g2 core also provides instruction cache way-locking in addition to entire instruction cache locking as described in section 4.12, ?cache locking.? 4.3 data cache organization and control the lsu transfers data between the data cache and the gprs and fprs and provides buffers for load and store bus operations. the data cache also provides storage for the cache tags required for memory coherency and performs the cache block replacement lru function. 4.3.1 data cache organization the organization of the data cache is shown in figure 4-2. each cache block contains eight contiguous words from memory that are loaded from an eight-word boundary (that is, bits a27?a31 of the effective addresses are zero); thus, a cache block never crosses a page boundary. misaligned accesses across a page boundary can incur a performance penalty. note that bits a20?a26 provide an index to select a set. bits a27?a31 select a byte within a block. the tags consists of bits pa0?pa19. address translation occurs in parallel, such that higher-order bits (the tag bits in the cache) are physical. note that the replacement algorithm is strictly an lru algorithm; that is, the least-recently used block is filled with new data on a cache miss. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-6 g2 powerpc core reference manual motorola data cache organization and control figure 4-2. data cache organization 4.3.2 data cache fill operations when the g2 core is configured with a 64-bit data bus, cache blocks are loaded in four beats of 64 bits each. when the g2 core is configured with a 32-bit bus, cache block loads are performed with eight beats of 32 bits each. the burst load is performed as critical-double-word-first. the data cache is blocked to internal accesses until the load completes. in the g2 core, the critical-double-word is simultaneously written to the cache and forwarded to the requesting unit, thus minimizing stalls due to load delays. 4.3.3 data cache control the g2 core provides several means of data cache control through the use of the wimg bits in the page tables, control bits in the hid0 register, and user- and supervisor-level cache control instructions. while memory page level cache control is provided by the wimg bits, the on-chip data cache can be invalidated, disabled, locked, or broadcast by the control bits in the hid0 register described in this section. (note that user- and supervisor-level are referred to as problem and privileged state, respectively, in the architecture specification.) 4.3.3.1 data cache invalidation while the data cache is automatically invalidated when the g2 core is powered up and during a hard reset, assertion of the soft reset signal does not cause data cache invalidation. software may invalidate the contents of the data cache using the data cache flash invalidate (dcfi) control bit in the hid0 register. flash invalidation of the data cache is accomplished by setting the dcfi bit (invalidates the cache) and subsequently clearing the dcfi bit (enables normal operation) in two consecutive store operations. if dcfi is not cleared the cache state will remain invalid. address tag 1 address tag 2 address tag 3 block 1 block 2 block 3 128 sets address tag 0 block 0 8 words/block state state state words 0?7 words 0?7 words 0?7 words 0?7 state f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-7 data cache organization and control 4.3.3.2 data cache disabling the data cache may be disabled through the use of the data cache enable (dce) control bit in the hid0 register. when the data cache is in the disabled state, the cache tag state bits are ignored, and all accesses are propagated to the bus as single-beat transactions. the dce bit is cleared on power-up, causing the data cache to be disabled. to prevent the cache from being enabled or disabled in the middle of a data access, a sync instruction should be issued before changing the value of dce. note that while snooping is not performed when the data cache is disabled, cache operations (caused by the dcbz , dcbf , dcbst , and dcbi instructions) are not affected by disabling the cache, causing potential coherency errors. an example of this would be a dcbf instruction that hits a modified cache block in the disabled cache, causing a copy back to memory of potentially stale data. note the dcbi instruction should never be used on the g2 core. regardless of the state of hid0[dce], load and store operations are assumed to be weakly ordered. thus, the lsu can perform load operations that occur later in the program ahead of store operations, even when the data cache is disabled. however, strongly ordered load and store operations can be enforced through the setting of the i bit (of the page wimg bits) when address translation is enabled. note that when address translation is disabled, the default wimg bits cause the i bit to be cleared (accesses are assumed to be cacheable), and thus, the accesses are weakly ordered. refer to section 4.6.2, ?caching-inhibited attribute (i),? for a description of the operation of the i bit and section 6.2, ?real addressing mode,? for a description of the wimg bits when address translation is disabled. 4.3.3.3 data cache locking the contents of the data cache may be locked through the hid0[dlock]. a locked data cache supplies data normally on a cache hit, but cache misses are treated as cache-inhibited accesses. the cache-inhibited (core_ci ) signal is asserted if a cache access misses into a locked cache. the setting of dlock must be preceded by a sync instruction to prevent the cache from being locked during an access. note that the g2 core also provides instruction cache way-locking in addition to entire data cache locking as described in section 4.12, ?cache locking.? 4.3.3.4 data cache operations and address broadcasts executing a dcbz instruction generates an address-only broadcast on the bus. additionally, if hid0[abe] is set on a g2 core processor, the execution of the dcbf , dcbi , and dcbst instructions also causes an address-only broadcast. the ability of the g2 core to optionally perform address-only broadcasts when executing the dcbi , dcbf , and dcbst instructions f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-8 g2 powerpc core reference manual motorola basic data cache operations allows the coherency management of an external copy-back l2 cache. note that these cache control instruction broadcasts are not snooped by the g2 core. 4.3.4 data cache touch load support touch load operations allow an instruction stream to prefetch data from memory prior to a cache miss. the g2 core supports touch load operations through a temporary cache block buffer located between the biu and the data cache. the cache block buffer is essentially a floating cache block that is loaded by the biu on a touch load operation, and is then read by a load instruction that requests that data. after a touch load completes on the bus, the biu continues to compare the touch load address with subsequent load requests from the data cache. if the load address matches the touch load address in the biu, the data is forwarded to the data cache from the touch load buffer, the read from memory is canceled, and the touch load address buffer is invalidated. to avoid the storage of stale data in the touch load buffer, touch load requests that are mapped as write-through or caching-inhibited by the mmu are treated as no-ops by the biu. also, subsequent load instructions after a touch load that are mapped as write-through or caching-inhibited do not hit in the touch load buffer, and cause the touch load buffer to be invalidated on a matching address. while the g2 core provides only a single cache block buffer, other microprocessor implementations may provide buffering for more than one cache block. programs written for other implementations may issue several dcbt or dcbtst instructions sequentially, reducing the performance if executed on the g2 core. to improve performance in these situations, hid0[noopti] (bit 31) can be set. this causes the dcbt and dcbtst instructions to be treated as no-ops, cause no bus activity, and incur only one processor clock cycle of execution latency. noopti is cleared at a power-on reset, enabling the use of the dcbt and dcbtst instructions. 4.4 basic data cache operations this section describes the three types of operations that can occur to the data cache, and how these operations are implemented in the g2 core. 4.4.1 data cache fill a cache block is filled after a read miss or write miss (read-with-intent-to-modify) occurs in the cache. the cache block that corresponds to the missed address is updated by a burst transfer of the data from system memory. note that if a read miss occurs in a system with multiple bus masters, and the data is modified in another cache, the modified data is first written to external memory before the cache fill occurs. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-9 data cache transactions on bus 4.4.2 data cache cast-out operation the g2 core uses an lru replacement algorithm to determine which of the four possible cache locations should be used for a cache update on a cache miss. adding a new block to the cache causes any modified data associated with the least-recently used element to be written back, or cast out, to system memory to maintain memory coherence. 4.4.3 cache block push operation when a cache block in the g2 core is snooped and hit by another bus master and the data is modified, the cache block must be written to memory and made available to the snooping device. the cache block that is hit, is pushed out onto the bus. the g2 core supports two kinds of push operations?normal push operations and enveloped high-priority push operations, described in section 4.7.9, ?enveloped high-priority cache block push operation.? 4.5 data cache transactions on bus the g2 core transfers data to and from the data cache in single-beat transactions of two words, or in four-beat transactions of eight words which fill a cache block. 4.5.1 single-beat transactions single-beat bus transactions can transfer from 1 to 8 bytes to or from the g2 core. single-beat transactions can be caused by cache write-through accesses, caching-inhibited accesses (i bit of the wimg bits for the page is set), or accesses when the cache is disabled (hid0[dce] bit is cleared), and can be misaligned. 4.5.2 burst transactions burst transactions on the g2 core always transfer eight words of data at a time, and are aligned to a double-word boundary. the g2 core transfer burst (core_tbst ) output signal indicates to the system whether the current transaction is a single-beat transaction or four-beat burst transfer. burst transactions have an assumed address order. for cacheable read operations or cacheable, non-write-through write operations that miss the cache, the g2 core presents the double-word aligned address associated with the load or store instruction that initiated the transaction. as shown in figure 4-3, this quad word contains the address of the load or store that missed the cache. this minimizes latency by allowing the critical code or data to be forwarded to the processor before the rest of the block is filled. for all other burst operations, however, the entire block is transferred in order (oct-word aligned). critical-double-word-first fetching on a cache miss applies to both the data and instruction cache. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-10 g2 powerpc core reference manual motorola memory management/cache access mode bits?w, i, m, and g figure 4-3. double-word address ordering?critical-double-word-first 4.5.3 access to direct-store segments the g2 core does not provide support for access to direct-store segments. operations attempting to access a direct-store segment will invoke a dsi exception. see section 5.5.3, ?dsi exception (0x00300).? 4.6 memory management/cache access mode bits?w, i, m, and g some memory characteristics can be set on either a block or page basis by using the wimg bits in the bat registers or page table entry (pte), respectively. the wimg attributes control the following functionality: write-through (w bit) caching-inhibited (i bit) memory coherency (m bit) guarded memory (g bit) these bits allow both uniprocessor and multiprocessor system designs to exploit numerous system-level performance optimizations. careless specification and use of these bits may create situations where coherency paradoxes are observed by the processor. in particular, this can happen when the state of these bits is changed without appropriate precautions being taken (for example, when g2 core cache address bits 27:28 beat beat abcd 0 0 0 1 1 0 1 1 abcd 0123 if the address requested is in double-word a, the address placed on the bus is that of double-word a, and the four data beats are ordered in the following manner: if the address requested is in double-word c, the address placed on the bus will be that of double-word c, and the four data beats are ordered in the following manner: cd ab 0123 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-11 memory management/cache access mode bits?w, i, m, and g flushing the pages that correspond to the changed bits from the caches of all processors in the system is required, or when the address translations of aliased physical addresses (referred to as real addresses in the architecture specification) specify different values for any of the wim bits). the g2 core considers any of these cases to be a programming error that may compromise the coherency of memory. these paradoxes can occur within a single processor or across several devices, as described in section 4.7.4.1, ?coherency in single-processor systems.? the wimg attributes are programmed by the operating system for each page and block. the w and i attributes control how the processor performing an access uses its own cache. the m attribute ensures that coherency is maintained for all copies of the addressed memory location. the g attribute prevents out-of-order loading and prefetching from the addressed memory location. when an access requires coherency, the processor performing the access must inform the coherency mechanisms throughout the system that the access requires memory coherency. the m attribute determines the kind of access performed on the bus (global or local). the wimg attributes occupy 4 bits in the bat registers for block address translation and in the ptes for page address translation. the wimg bits are programmed as follows: the operating system uses the mtspr instruction to program the wimg bits in the bat registers for block address translation. the ibat register pairs do not have a g bit and all accesses that use the ibat register pairs are considered not guarded. the operating system writes the wimg bits for each page into the ptes in system memory as it sets up the page tables. note that for accesses performed with direct address translation (msr[ir] = 0 or msr[dr] = 0 for instruction or data access, respectively), the wimg bits are automatically generated as 0b0011 (the data is write-back, caching is enabled, memory coherency is enforced, and memory is guarded). 4.6.1 write-through attribute (w) when an access is designated as write-through (w = 1), if the data is in the cache, a store operation updates the cached copy of the data. in addition, the update is written to the external memory location (as described below). while the powerpc architecture permits multiple store instructions to be combined for write-through accesses except when the store instructions are separated by a sync or eieio instruction, the g2 core does not implement this ?combined store? capability. note that a store operation that uses the write-through attribute may cause any part of valid data in the cache to be written back to main memory. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-12 g2 powerpc core reference manual motorola memory management/cache access mode bits?w, i, m, and g the definition of the external memory location to be written to, in addition to the on-chip cache, depends on the implementation of the memory system and can be illustrated by the following examples: ram?the store is sent to the ram controller to be written into the target ram. i/o device?the store is sent to the memory-mapped i/o control hardware to be written to the target register or memory location. in systems with multilevel caching, the store must be written to at least a depth in the memory hierarchy that is seen by all processors and devices. accesses that correspond to w = 0 are considered write-back. for this case, although the store operation is performed to the cache, it is only made to external memory when a copy-back operation is required. use of the write-back mode (w = 0) can improve overall performance for areas of the memory space that are seldom referenced by other masters in the system. 4.6.2 caching-inhibited attribute (i) if i = 1, the memory access is completed by referencing the location in main memory, bypassing the on-chip cache. during the access, the addressed location is not loaded into the cache nor is the location allocated in the cache. it is considered a programming error if a copy of the target location of an access to caching-inhibited memory is resident in the cache. software must ensure that the location has not been previously loaded into the cache, or, if it has, that it has been flushed from the cache. the powerpc architecture permits data accesses from more than one instruction to be combined for cache-inhibited operations, except when the accesses are separated by a sync instruction, or by an eieio instruction when the page or block is also designated as guarded. this ?combined access? capability is not implemented on the g2 core. note that the eieio is treated as a no-op by the g2 core. the caching-inhibited (i) bit in the g2 core controls whether load and store operations are strongly or weakly ordered. if an i/o device requires load and store accesses to occur in program order, then the i bit for the page must be set. 4.6.3 memory coherency attribute (m) this attribute is provided to allow improved performance in systems where hardware-enforced coherency is relatively slow, and software is able to enforce the required coherency. when m = 0, the processor does not enforce data coherency. when m = 1, the processor enforces data coherency and the corresponding access is considered to be a global access. when the m attribute is set, and the access is performed, the global signal is asserted to indicate that the access is global. snooping devices affected by the access must then f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-13 memory management/cache access mode bits?w, i, m, and g respond to this global access if their data is modified by asserting core_artry_in , and updating the memory location. because instruction memory does not have to be consistent with data memory, the g2 core ignores the m attribute for instruction accesses. 4.6.4 guarded attribute (g) when the guarded bit is set, the memory area (block or page) is designated as guarded, meaning that the processor will perform out-of-order accesses to this area of memory, only as follows: out-of-order load operations from guarded memory areas are performed only if the corresponding data is resident in the cache. the processor prefetches from guarded areas, but only when required, and only within the memory boundary dictated by the cache block. that is, if an instruction is certain to be required for execution by the program, it is fetched and the remaining instructions in the block may be prefetched, even if the area is guarded. this setting can be used to protect certain memory areas from read accesses made by the processor that are not dictated directly by the program. if there are areas of memory that are not fully populated (in other words, there are holes in the memory map within this area), this setting can protect the system from undesired accesses caused by out-of-order load operations or instruction prefetches that could lead to the generation of the machine check exception. also, the guarded bit can be used to prevent out-of-order load operations or prefetches from occurring to certain peripheral devices that produce undesired results when accessed in this way. 4.6.5 w, i, and m bit combinations table 4-1 summarizes the six combinations of the wim bits. note that either a zero or one setting for the g bit is allowed for each of these wim bit combinations. table 4-1. combinations of w, i, and m bits wim setting meaning 000 data may be cached. loads or stores whose target hits in the cache use that entry in the cache. memory coherency is not enforced by hardware. 001 data may be cached. loads or stores whose target hits in the cache use that entry in the cache. memory coherency is enforced by hardware. 010 caching is inhibited. the access is performed to external memory, completely bypassing the cache. memory coherency is not enforced by hardware. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-14 g2 powerpc core reference manual motorola memory management/cache access mode bits?w, i, m, and g 4.6.5.1 out-of-order execution and guarded memory out-of-order execution occurs when the g2 core performs operations in advance in case the result is needed. typically, these operations are performed by otherwise idle resources; thus if a result is not required, it is ignored and the out-of-order operation incurs no time penalty (typically). supervisor-level programs designate memory as guarded on a block or page level. memory is designated as guarded if it is not be well-behaved with respect to out-of-order operations. for example, the memory area that contains a memory-mapped i/o device may be designated as guarded if an out-of-order load or instruction fetch performed to such a device might cause the device to perform unexpected or incorrect operations. another example of memory that should be designated as guarded is the area that corresponds to the device that resides at the highest implemented physical address (as it has no successor and out-of-order sequential operations such as instruction prefetching may result in a machine check exception). in addition, areas that contain holes in the physical memory space may be designated as guarded. 4.6.5.2 effects of out-of-order data accesses most data operations may be performed out-of-order, as long as the machine appears to follow a simple sequential model. however, the following out-of-order operations do not occur: out-of-order loading from guarded memory (g = 1) does not occur. however, when a load or store operation is required by the program, the entire cache block(s) containing the referenced data may be loaded into the cache. out-of-order store operations that alter the state of the target location do not occur. 011 caching is inhibited. the access is performed to external memory, completely bypassing the cache. memory coherency must be enforced by external hardware (processor provides hardware indication that access is global). 100 data may be cached. load operations whose target hits in the cache use that entry in the cache. stores are written to external memory. the target location of the store may be cached and is updated on a hit. memory coherency is not enforced by hardware. 101 data may be cached. load operations whose target hits in the cache use that entry in the cache. stores are written to external memory. the target location of the store may be cached and is updated on a hit. memory coherency is enforced by hardware. table 4-1. combinations of w, i, and m bits (continued) wim setting meaning f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-15 cache coherency?mei protocol no errors except machine check exceptions are reported due to the out-of-order execution of an instruction until it is known that execution of the instruction is required. machine check exceptions resulting solely from out-of-order execution (from nonguarded memory) may be reported. when an out-of-order instruction result is abandoned, only one side effect (other than a possible machine check) may occur?the referenced bit (r) in the corresponding page table entry (and tlb entry) can be set due to an out-of-order load operation. see chapter 5, ?exceptions,? for more information on the machine check exception. thus, an out-of-order load or store instruction will not access guarded memory unless one of the following conditions exist: the target memory item is resident in an on-chip cache. in this case, the location may be accessed from the cache or main memory. the target memory item is cacheable (i = 0) and it is guaranteed that the load or store is in the execution path (assuming there are no intervening exceptions). in this case, the entire cache block containing the target may be loaded into the cache. 4.6.5.3 effects of out-of-order instruction fetches to avoid instruction fetch delay, the processor typically fetches instructions ahead of those currently being executed. such instruction prefetching is said to be out-of-order in that prefetched instructions may not be executed due to intervening branches or exceptions. during instruction prefetching, no errors except machine check exceptions are reported due to the out-of-order fetching of an instruction until it is known that execution of the instruction is required. machine check exceptions resulting solely from out-of-order execution (from nonguarded memory) may be reported. when an out-of-order instruction result is abandoned, only one side effect (other than a possible machine check) may occur?the referenced bit (r) in the corresponding page table entry (and tlb entry) can be set due to an out-of-order load operation. see chapter 5, ?exceptions,? for more information on the machine check exception. instruction fetching from guarded memory is not permitted. 4.7 cache coherency?mei protocol the primary objective of a coherent memory system is to provide the same image of memory to all devices using the system. coherency allows synchronization and cooperative use of shared resources. otherwise, multiple copies of a memory location, some containing stale values, could exist in a system resulting in errors when the stale values are used. each potential bus master must follow rules for managing the state of its cache. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-16 g2 powerpc core reference manual motorola cache coherency?mei protocol the g2 core cache coherency protocol is a coherent subset of the standard mesi four-state cache protocol that omits the shared state. since data cannot be shared, the g2 core signals all cache block fills as if they were write misses (read-with-intent-to-modify), flushing the corresponding copies of the data in all caches external to the g2 core prior to the g2 core cache block fill operation. following the cache block load, the g2 core is the exclusive owner of the data and may write to it without a bus broadcast transaction. to maintain this coherency, all global reads observed on the bus by the g2 core are snooped as if they are writes, causing the g2 core to write a modified cache block back to memory and invalidate the cache block, or simply invalidate the cache block if it is unmodified. the exception to this rule occurs when a snooped transaction is a caching-inhibited read (either burst or single-beat, where core_tt[0:4] = 0x1010; see table 8-6 for clarification), in which case the g2 core does not invalidate the snooped cache block. if the cache block is modified, the block is written back to memory, and the cache block is marked exclusive unmodified. if the cache block is marked exclusive unmodified when snooped, no bus action is taken, and the cache block remains in the exclusive unmodified state. this treatment of caching-inhibited reads decreases the possibility of data thrashing by allowing noncaching devices to read data without invalidating the entry from the g2 core data cache. 4.7.1 mei state definitions the g2 core data cache characterizes each 32-byte block it contains as being in one of three mei states. addresses presented to the cache are indexed into the cache directory with bits a20:a26, and the upper-order 20 bits from the physical address translation (pa0?pa19) are compared against the indexed cache directory tags. if neither of the indexed tags matches, the result is a cache miss. if a tag matches, a cache hit occurred and the directory indicates the state of the cache block through two state bits kept with the tag. the three possible states for a cache block in the cache are the modified state (m), the exclusive state (e), and the invalid state (i). the three mei states are defined in table 4-2. 4.7.2 mei state diagram the g2 core provides dedicated hardware to provide memory coherency by snooping bus transactions. the address retry capability of the g2 core enforces the mei protocol, as shown in figure 4-4. figure 4-4 assumes that the wim bits for the page or block are set to 001; that is, write-back, caching-not-inhibited, and memory coherency enforced. table 4-2. mei state definitions mei state definition modified (m) the addressed cache block is valid only in the cache. the cache block is modified with respect to system memory?that is, the modified data in the cache block has not been written back to memory. exclusive (e) the addressed block is in this cache only. the data in this cache block is consistent with system memory. invalid (i) this state indicates that the addressed cache block is not resident in the cache. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-17 cache coherency?mei protocol figure 4-4. mei cache coherency protocol?state diagram (wim = 001) section 4.11, ?mei state transactions,? provides a detailed list of mei transitions for various operations and wim bit settings. 4.7.3 mei hardware considerations while the g2 core provides the hardware required to monitor bus traffic for coherency, the g2 core data cache tags are single ported, and a simultaneous load or store and snoop access represent a resource conflict. in general, the snoop access has highest priority and is given first access to the tags. the load or store access will then occur on the clock following the snoop. the snoop is not given priority into the tags when the snoop coincides with a tag write (for example, validation after a cache block load). in these situations, the snoop is retried and must re-arbitrate before the lookup is possible. occasionally, cache snoops cannot be serviced and must be retried. these retries occur if the cache is busy with a burst read or write when the snoop operation takes place. note that it is possible for a snoop to hit a modified cache block that is already in the process of being written to the copy-back buffer for replacement purposes. if this happens, the g2 rh wh rh wh sh sh/cir wm sh/crw rm sh/crw bus transactions sh = snoop hit rh = read hit rm = read miss wh = write hit wm = write miss sh/crw = snoop hit, cacheable read/write sh/cir = snoop hit, cache inhibited read = cache line fill = snoop push wh exclusive modified invalid f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-18 g2 powerpc core reference manual motorola cache coherency?mei protocol core retries the snoop, and raises the priority of the cast-out operation to allow it to go to the bus before the cache block fill. the global (core_gbl ) signal, asserted as part of the address attribute field during a bus transaction, enables the snooping hardware of the g2 core. address bus masters assert core_gbl to indicate that the current transaction is a global access (that is, an access to memory shared by more than one device). if core_gbl is not asserted for the transaction, that transaction is not snooped by the g2 core. note that the core_gbl signal is not asserted for instruction fetches, and that core_gbl is asserted for all data read or write operations when using direct address translation. (note that direct address translation is referred to as the real addressing mode, not the direct-store segment, in the architecture specification.) normally, core_gbl reflects the m-bit value specified for the memory reference in the corresponding translation descriptor(s). care must be taken to minimize the number of pages marked as global, because the retry protocol enforces coherency and can use considerable bus bandwidth if a lot of data is shared. therefore, available bus bandwidth can decrease as more traffic is marked global. the g2 core snoops a transaction if the transfer start (core_ts ) and core_gbl signals are asserted together in the same bus clock (this is a qualified snooping condition). no snoop update to the g2 core cache occurs if the snooped transaction is not marked global. also, because cache block cast-outs and snoop pushes do not require snooping, the core_gbl signal is not asserted for these operations. when the g2 core detects a qualified snoop condition, the address associated with the core_ts signal is compared with the cache tags. snooping finishes if no hit is detected. if, however, the address hits in the cache, the g2 core reacts according to the mei protocol shown in figure 4-4. to facilitate external monitoring of the internal cache tags, the cache set entry signals (core_cse[0:1]) represent in binary the cache set being replaced on read operations (including read-with-intent-to-modify operations). the core_cse[0:1] signals do not apply for write operations to memory, or during noncacheable or touch load operations. note that these signals are valid only for g2 core burst operations. table 4-3 shows the core_cse[0:1] (cache set entry) encodings. table 4-3. core_cse[0:1] signal encoding core_cse[0:1] cache set element 00 set 0 01 set 1 10 set 2 11 set 3 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-19 cache coherency?mei protocol 4.7.4 coherency precautions the g2 core supports a three-state coherency protocol that supports the modified, exclusive, and invalid (mei) cache states. this protocol is a compatible subset of the mesi four-state protocol and operates coherently in systems that contain four-state caches. in addition, the g2 core does not broadcast cache operations caused by cache instructions. they are intended for the management of the local cache but not for other caches in the system. 4.7.4.1 coherency in single-processor systems the following situations concerning coherency can be encountered within a single-processor system: load or store to a caching-inhibited page (wim = 0bx1x) and a cache hit occurs. caching is inhibited for this page (i = 1)?load or store operations to a caching-inhibited page that hit in the cache cause boundedly undefined results. store to a page marked write-through (wim = 0b10x) and a cache read hit to a modified cache block. this page is marked as write-through (w = 1)?the g2 core pushes the modified cache block to memory and the block remains marked modified (m). note that when wim bits are changed, it is critical that the cache contents reflect the new wim bit settings. for example, if a block or page that had allowed caching becomes caching-inhibited, software should ensure that the appropriate cache blocks are flushed to memory and invalidated. 4.7.5 load and store coherency summary table 4-4 provides a summary of memory coherency actions performed by the g2 core on load operations. noncacheable cases are not part of this table. table 4-5 provides an overview of memory coherency actions on store operations. this table does not include noncacheable or write-through cases. the read-with-intent-to- modify (rwitm) examples involve selecting a replacement class and casting-out modified data that may have resided in that replacement class. table 4-4. memory coherency actions on load operations cache state bus operation core_artry action m none don?t care read from cache e none don?t care read from cache i read negated load data and mark e i read asserted retry read operation f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-20 g2 powerpc core reference manual motorola cache coherency?mei protocol 4.7.6 atomic memory references the load word and reserve indexed ( lwarx ) and store word conditional indexed ( stwcx. ) instructions provide an atomic update function for a single, aligned word of memory. while an lwarx instruction will normally be paired with an stwcx. instruction with the same effective address, an stwcx. instruction to any address will cancel the reservation. for detailed information on these instructions, refer to chapter 3, ?instruction set model,? in this book and chapter 8, ?instruction set,? in the programming environments manual . 4.7.7 cache reaction to specific bus operations there are several bus transaction types defined for the g2 core bus. the g2 core must snoop these transactions and perform the appropriate action to maintain memory coherency as shown in table 4-6. a processor may assert core_artry_out for any bus transaction due to internal conflicts that prevent the appropriate snooping. the transactions in table 4-6 correspond to the transfer type signals core_tt[0:4], described in section 8.3.4.1, ?transfer type.? table 4-5. memory coherency actions on store operations cache state bus operation core_artry action m none don't care modify cache e none don't care modify cache, mark m i rwitm negated load data, modify it, mark m i rwitm asserted retry the rwitm table 4-6. response to bus transactions snooped transaction g2 core response clean block no action is taken flush block no action is taken write-with-flush write-with-flush-atomic write-with-flush and write-with-flush-atomic operations occur after the processor issues a store or stwcx. instruction, respectively. if the addressed block is in the exclusive state, the address snoop forces the state of the addressed block to invalid. if the addressed block is in the modified state, the address snoop causes core_artry_out to be asserted and initiates a push of the modified block out of the cache and changes the state of the block to invalid. the execution of an stwcx. instruction cancels the reservation associated with any address. kill block the kill block operation is an address-only bus transaction initiated when a dcbz instruction is executed; when snooped by the g2 core, the addressed cache block is invalidated if in the e state, or flushed to memory and invalidated if in the m state, and any associated reservation is canceled. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-21 cache coherency?mei protocol 4.7.8 operations causing core_artry assertion the following scenarios cause the g2 core to assert the core_artry_out signal: snoop hits to a block in the m state (flush or clean) this case is a normal snoop hit and will result in core_artry_out being asserted if the snooped transaction was a flush or clean request. if the snooped transaction was a kill request, core_artry_out will not be asserted. snoop attempt during the last core_ta of a cache line fill in no-core_drtry mode, during the cycle that the last core_ta is asserted to the g2 core on a cache line fill, the tag is being written to its new state by the g2 core and is not accessible. this will result in a collision being signaled by asserting core_artry_out . with core_drtry enabled, the cache tags are inaccessible to a snoop operation one cycle after the last core_ta . write-with-kill in a write-with-kill operation, the processor snoops the cache for a copy of the addressed block. if one is found, an additional snoop action is initiated internally and the cache block is forced to the i state, killing modified data that may have been in the block. any reservation associated with the block is also canceled. read read-atomic the read operation is used by most single-beat and burst read operations on the bus. all burst reads observed on the bus are snooped as if they were writes, causing the addressed cache block to be flushed. a read on the bus with the core_gbl signal asserted causes the following responses: if the addressed block in the cache is invalid, the g2 core takes no action. if the addressed block in the cache is in the exclusive state, the block is invalidated. if the addressed block in the cache is in the modified state, the block is flushed to memory and the block is invalidated. if the snooped transaction is a caching-inhibited read and the block in the cache is in the exclusive state, the snoop causes no bus activity and the block remains in the exclusive state. if the block is in the cache in the modified state, the g2 core initiates a push of the modified block out to memory and marks the cache block as exclusive. read-atomic operations appear on the bus in response to lwarx instructions and generate the same snooping responses as read operations. read-with-intent-to- modify (rwitm) rwitm-atomic a rwitm operation is issued to acquire exclusive use of a memory location for the purpose of modifying it. if the addressed block is invalid, the g2 core takes no action. if the addressed block in the cache is in the exclusive state, the g2 core initiates an additional snoop action to change the state of the cache block to invalid. if the addressed block in the cache is in the modified state, the block is flushed to memory and the block is invalidated. the rwitm-atomic operations appear on the bus in response to stwcx. instructions and are snooped like rwitm instructions. sync no action is taken tlb invalidate no action is taken table 4-6. response to bus transactions (continued) snooped transaction g2 core response f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-22 g2 powerpc core reference manual motorola cache control instructions snoop hit after the first core_ta of a burst load operation after the first core_ta of a burst load operation, the data tags are committed to being written; snoop operations cannot be serviced until the load completes, thereby causing the assertion of core_artry_out . snoop hits to line in the cast-out buffer the g2 core cast-out buffer is kept coherent with main memory, and snoop operations that hit in the cast-out buffer will cause the assertion of core_artry_out . snoop attempt during cycles that dcbz instruction or load or store operation is updating the tag during the execution of a dcbz instruction or during a load or store operation that requires a cache line cast out, the cache tags will be inaccessible during the first and last cycle of the operation. snoop attempt during the cycle that a dcbf or dcbst instruction is updating the tag if the ea of a dcbf or dcbst instruction hits in the cache, the tag will be changed to its new state. during that clock, the tag is not accessible and snoop transactions during that cycle will cause the assertion of core_artry_out . 4.7.9 enveloped high-priority cache block push operation in cases where the g2 core has completed the address tenure of a read operation, and then detects a snoop hit to a modified cache block by another bus master, the g2 core provides a high-priority push operation. if the address snooped is the same as the address of the data to be returned by the read operation, core_artry_out is asserted one or more times until the data tenure of the read operation is completed. the cache block push transaction can be enveloped within the address and data tenures of a read operation. this feature prevents deadlocks in system organizations that support multiple memory-mapped buses. more specifically, the g2 core internally detects the scenario where a load request is outstanding and the processor has pipelined a write operation on top of the load. normally, when the data bus is granted to the g2 core, the resulting data bus tenure is used for the load operation. the enveloped high-priority cache block push feature defines a bus signal, the data bus write only qualifier (core_dbwo ), which, when asserted with a qualified data bus grant, indicates that the resulting data tenure should be used for the store operation instead. this signal is described in section 9.10, ? using core-dbwo (data bus write only).? note that the enveloped copy-back operation is an internally pipelined bus operation. 4.8 cache control instructions software must use the appropriate cache management instructions to ensure that caches are kept consistent when data is modified by the processor. when a processor alters a memory location that may be contained in an instruction cache, software must ensure that updates f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-23 cache control instructions to memory are visible to the instruction fetching mechanism. although the instructions to enforce coherency vary among implementations and, hence, operating systems should provide a system service for this function, the following sequence is typical: 1. dcbst (update memory) 2. sync (wait for update) 3. icbi (invalidate copy in cache) 4. isync (invalidate copy in own instruction buffer) these operations are necessary because the processor does not maintain instruction memory coherent with data memory. software is responsible for enforcing coherency of instruction caches and data memory. since instruction fetching may bypass the data cache, changes made to items in the data cache may not be reflected in memory until after the instruction fetch completes. the powerpc architecture defines instructions for controlling both the instruction and data caches when they exist. the g2 core interprets the cache control instructions ( icbi , dcbi , dcbt , dcbz , and dcbst ) as if they pertain only to the g2 core caches. they are not intended for use in managing other caches in the system. the dcbz instruction causes an address-only broadcast on the bus if the contents of the block are from a page marked global through the wimg bits. this broadcast is performed for coherency reasons; the dcbz instruction is the only cache control instruction that can allocate and take new ownership of a line. note that if the hid0[abe] bit is set on a g2 core processor, the execution of the dcbf , dcbi , and dcbst instructions will also cause an address-only broadcast. the dcbz instruction is also the only cache operation that is snooped by the g2 core. the cache instructions are intended primarily for the management of the on-chip cache, and do not perform address-only broadcasts for the maintenance of other caches in the system. the ability of the g2 core to optionally perform address-only broadcasts when executing the dcbi , dcbf , and the dcbst instructions allows the coherency management of an external copy-back l2 cache. note that the dcbi instruction should never be used on the g2 core. the other instructions do not broadcast either for the purpose of invalidating or flushing other caches in the system or for managing system resources. any bus activity caused by these instructions is the direct result of performing the operation in the g2 core cache. note that a data access exception is generated if the effective address of a dcbi , dcbst , dcbf , or dcbz instruction cannot be translated due to the lack of a tlb entry. (note that exceptions are referred to as interrupts in the architecture specification.) note that in the powerpc architecture, the term ?cache block? or ?block,? when used in the context of cache implementations, refers to the unit of memory at which coherency is maintained. for the g2 core, this is the eight-word cache line. this value may be different for other implementations that support the powerpc architecture. in-depth descriptions of f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-24 g2 powerpc core reference manual motorola cache control instructions coding these instructions is provided in chapter 3, ?addressing modes and instruction set summary,? and chapter 10, ?instruction set,? in the programming environments manual . 4.8.1 data cache block invalidate (dcbi) instruction if the block containing the byte addressed by the ea is in the data cache, the cache block is invalidated regardless of whether the block is in the exclusive or modified state. if hid0[abe] is set on a g2 core when a dcbi instruction is executed, the g2 core will perform an address-only bus transaction. the dcbi instruction can only be executed when the g2 core is in the supervisor state. 4.8.2 data cache block touch (dcbt) instruction this instruction provides a method for improving performance through the use of software-initiated prefetch hints. the g2 core performs the fetch when the address hits in the tlb or bat registers, and when it is a permitted load access from the addressed page. the operation is treated similarly to a byte load operation with respect to coherency. if the address translation does not hit in the tlb or bat mechanism, or if it does not have load access permission, the instruction is treated as a no-op. if the cache is locked or disabled, or if the access is to a page that is marked as guarded, the dcbt instruction is treated as a no-op. if the access is directed to a write-through or caching-inhibited page, the instruction is treated as a no-op. the dcbt instruction never affects the referenced or changed bits in the hashed page table. a successful dcbt instruction affects the state of the tlb and cache lru bits as defined by the lru algorithm. the touch load buffer will be marked invalid if the contents of the touch buffer have been moved to the cache, if any data cache management instruction has been executed, if a dcbz instruction is executed that matches the address of the cache block in the touch buffer, or if another dcbt instruction is executed. 4.8.3 data cache block touch for store (dcbtst) instruction the dcbtst instruction, like the data cache block touch instruction ( dcbt ), allows software to prefetch a cache block in anticipation of a store operation (read-with-intent-to-modify). 4.8.4 data cache block clear to zero (dcbz) instruction if the block containing the byte addressed by the ea is in the data cache, all bytes are cleared. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-25 cache control instructions if the block containing the byte addressed by the ea is not in the data cache and the corresponding page is caching-allowed, the block is established in the data cache without fetching the block from main memory, and all bytes of the block are cleared. if the contents of the cache block are from a page marked global through the wim bits, an address-only bus transaction is run. if the page containing the byte addressed by the ea is caching-inhibited or write-through, then the system alignment exception handler is invoked. the dcbz instruction is treated as a store to the addressed byte with respect to address translation and protection. 4.8.5 data cache block store (dcbst) instruction if the block containing the byte addressed by the ea is in coherency-required mode, and a block containing the byte addressed by the ea is in the data cache of any processor and has been modified, the writing of it to main memory is initiated. on a g2 core, if the cache block is unmodified, hid0[abe] is set, and if the contents of the cache block are from a page marked global through the wim bits, an address-only bus transaction is run. the function of this instruction is independent of the write-through and caching- inhibited/caching-allowed modes of the block containing the byte addressed by the ea. this instruction is treated as a load to the addressed byte with respect to address translation and protection. 4.8.6 data cache block flush (dcbf) instruction the action taken depends on the memory mode associated with the target, and on the state of the cache block. the following list describes the action taken for the various cases. these actions are executed regardless of whether the page containing the addressed byte is in caching-inhibited or caching-allowed mode. the following actions occur in both coherency-required (wim = 0bxx1) and coherency-not-required mode (wim = 0bxx0). the dcbf instruction causes the following cache activity: unmodified block?invalidates the block in the processor?s cache modified block?copies the block to memory and invalidates data cache block absent block?does nothing the g2 core treats this instruction as a load to the addressed byte with respect to address translation and protection. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-26 g2 powerpc core reference manual motorola system bus interface and cache instructions 4.8.7 enforce in-order execution of i/o (eieio) instruction as defined by the powerpc architecture, the eieio instruction provides an ordering function for the effects of load and store instructions executed by a given processor. executing eieio ensures that all memory accesses previously initiated by the given processor are completed with respect to main memory before any memory accesses subsequently initiated by the processor access main memory. the eieio instruction orders loads and stores to caching- inhibited memory only. the eieio instruction is intended for use only in performing memory-mapped i/o operations. it enforces strong ordering of cache-inhibited memory accesses during i/o operations between the processor and i/o devices. when executed by the g2 core, the eieio instruction is treated as a no-op; caching-inhibited load and store operations (inhibited by the wimg bits for the page) are performed in strict program order. 4.8.8 instruction cache block invalidate (icbi) instruction the execution of an icbi instruction causes all four cache sets indexed by the ea to be marked invalid. no cache hit is required, and no mmu translation is performed. 4.8.9 instruction synchronize (isync) instruction the isync instruction waits for all previous instructions to complete and then discards any previously fetched instructions, causing subsequent instructions to be fetched (or refetched) from memory and to execute in the context established by the previous instructions. this instruction has no effect on other processors or on their caches. 4.9 system bus interface and cache instructions table 4-7 provides an overview of the bus operations initiated by cache control instructions. the cache control, tlb management, and synchronization instructions supported by the g2 core may affect or be affected by the operation of the bus. none of the instructions will actively broadcast through address-only transactions on the bus (except for dcbz ), and no broadcasts by other masters are snooped by the g2 core (except for kills). the operation of the instructions, however, may indirectly cause bus transactions to be performed, or their completion may be linked to the bus. table 4-7 summarizes how these instructions may operate with respect to the bus. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-27 bus interface note that table 4-7 assumes that the wim bits are set to 001; that is, since the cache is operating in write-back mode, caching is permitted and coherency is enforced. table 4-7 does not include noncacheable or write-through cases, nor does it completely describe the mechanisms for the operations described. for more information, see section 4.11, ?mei state transactions.? for detailed information on the cache control instructions, refer to chapter 3, ?instruction set model,? in this book and chapter 8, ?instruction set,? in the programming environments manual . the g2 core contains snooping logic to monitor the bus for these commands and the control logic required to keep the cache and the memory queues coherent. for additional details about the specific bus operations performed by the g2 core, see chapter 9, ?core interface operation.? 4.10 bus interface the bus interface buffers bus requests from the instruction and data caches, and executes the requests per the g2 core bus protocol. it includes address register queues, prioritization logic, and bus control logic. the bus interface also captures snoop addresses for snooping in the cache and in the address register queues, snoops for reservations, and holds the touch load address for the cache. all data storage for the address register buffers (load and store table 4-7. bus operations caused by cache control instructions (wim = 001) operation cache state next cache state bus operations comment sync don?t care no change none waits for memory queues to complete bus activity icbi don?t care i none ? dcbi 1 1 the dcbi instruction should never be used on the g2 core. don?t care i none ? dcbf i, e i none ? dcbf m i write-with-kill block is pushed dcbst i, e no change none ? dcbst m e write block is pushed dcbz im write-with-kill? dcbz e, m m kill block writes over modified data dcbt i no change read fetched cache block is stored in touch load queue dcbt e, m no change none ? dcbtst i no change read-with-intent- to-modify fetched cache block is stored in touch load queue dcbtst e, m no change none ? f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-28 g2 powerpc core reference manual motorola bus interface data buffers) are located in the cache section. the data buffers are considered temporary storage for the cache and not part of the bus interface. the general functions and features of the bus interface are as follows: address register buffers that include: ? instruction cache load address buffer ? data cache load address buffer ? data cache touch load address buffer (associated data block buffer located in cache) ? data cache cast-out/store address buffer (associated data line buffer located in cache) ? data cache snoop copy-back address buffer (associated data line buffer located in cache) ? reservation address buffer for snoop monitoring pipeline collision detection for data cache buffers reservation address snooping for lwarx / stwcx. instructions one-level address pipelining loadahead of store capability figure 4-5 is a conceptual block diagram of the bus interface. the address register queues hold transaction requests that the bus interface may issue on the bus independently of the other requests. the bus interface may have up to two transactions operating on the bus at any given time through the use of address pipelining. figure 4-5. bus interface address buffers snoop biu control address address data system bus control instruction data d-cache cst/st addr d-cache snp addr d-cache tld addr i-cache ld addr d-cache ld addr cache cache f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-29 mei state transactions for additional information about the g2 core bus interface and the bus protocols, refer to chapter 9, ?core interface operation.? 4.11 mei state transactions table 4-8 shows mei state transitions for various operations. bus operations are described in table 4-6. table 4-8. mei state transitions operation cache operation bus sync wim current state next state cache actions bus operation load (t = 0) read no x0x i same 1 cast out of modified block (as required) write-with-kill 2 pass four-beat read to memory queue read load (t = 0) read no x0x e,m same read data from cache ? load (t = 0) read no x1x i same pass single-beat read to memory queue read load (t = 0) read no x1x e i crtry read ? load (t = 0) read no x1x m i crtry read (push sector to write queue) write-with-kill lwarx read acts like other reads but bus operation uses special encoding store (t = 0) write no 00x i same 1 cast out of modified block (if necessary) write-with-kill 2pass rwitm to memory queue rwitm store (t = 0) write no 00x e,m m write data to cache ? store stwcx. (t = 0) write no 10x i same pass single-beat write to memory queue write-with-flush store stwcx. (t = 0) write no 10x e same 1 write data to cache ? 2 pass single-beat write to memory queue write-with-flush store stwcx. (t = 0) write no 10x m same 1 crtry write ? 2 push block to write queue write-with-kill store (t = 0) or stwcx. (wim = 10x) write no x1x i same pass single-beat write to memory queue write-with-flush store (t = 0) or stwcx. (wim = 10x) write no x1x e i crtry write ? f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-30 g2 powerpc core reference manual motorola mei state transactions store (t = 0) or stwcx. (wim = 10x) write no x1x m i 1 crtry write ? 2 push block to write queue write-with-kill stwcx. conditional write if the reserved bit is set, this operation is like other writes except the bus operation uses a special encoding. dcbf data cache block flush no xxx i,e same 1 crtry dcbf ? 2 pass flush flush same i 3 state change only ? dcbf data cache block flush no xxx m i push block to write queue write-with-kill dcbst data cache block store no xxx i,e same 1 crtry dcbst ? 2 pass clean clean same same 3 no action ? dcbst data cache block store no xxx m e push block to write queue write-with-kill dcbz data cache block set to zero no x1x x x alignment trap ? dcbz data cache block set to zero no 10x x x alignment trap ? dcbz data cache block set to zero yes 00x i same 1 crtry dcbz ? 2 cast out of modified block write-with-kill 3 pass kill kill same m 4 clear block ? dcbz data cache block set to zero no 00x e,m m clear block ? dcbt data cache block touch no x1x i same pass single-beat read to memory queue read dcbt data cache block touch no x1x e i crtry read ? dcbt data cache block touch no x1x m i 1 crtry read ? 2 push block to write queue write-with-kill table 4-8. mei state transitions (continued) operation cache operation bus sync wim current state next state cache actions bus operation f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-31 cache locking 4.12 cache locking this section describes the entire cache locking and cache way-locking features of the g2 core. dcbt data cache block touch no x0x i same 1 cast out of modified block (as required) write-with-kill 2 pass four-beat read to memory queue read dcbt data cache block touch no x0x e,m same no action ? single-beat read reload dump 1 no xxx i same forward data_in ? four-beat read (double-word- aligned) reload dump no xxx i e write data_in to cache ? four-beat write (double-word- aligned) reload dump no xxx i m write data_in to cache ? e i snoop write or kill no xxx e i state change only (committed) ? m i snoop kill no xxx m i state change only (committed) ? push m i snoop flush no xxx m i conditionally push write-with-kill push m e snoop clean no xxx m e conditionally push write-with-kill tlbie tlb invalidate no xxx x x 1 crtry tlbi ? 2pass tlbi ? 3 no action ? sync synchroni- zation no xxx x x 1 crtry sync ? 2pass sync ? 3 no action ? note: single-beat writes are not snooped in the write queue. table 4-8. mei state transitions (continued) operation cache operation bus sync wim current state next state cache actions bus operation f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-32 g2 powerpc core reference manual motorola cache locking 4.12.1 cache locking terminology cache locking refers to the ability to prevent some or all of a processor?s instruction or data cache from being overwritten. cache locking can be set for either an entire cache or for individual ways within the cache as follows: entire cache locking?when an entire cache is locked, data for read hits within the cache are supplied to the requesting unit in the same manner as hits from an unlocked cache. similarly, writes that hit in the data cache are written to the cache in the same way as write hits to an unlocked cache. however, any access that misses in the cache is treated as a cache-inhibited access. cache entries that are invalid at the time of locking remain invalid and inaccessible until the cache is unlocked. when the cache has been unlocked, all entries (including invalid entries) are available. entire cache locking is inefficient if the number of instructions or the size of data to be locked is small compared to the cache size. way-locking?locking only a portion of the cache is accomplished by locking ways within the cache. locking always begins with the first way (way 0) and is sequential, that is, locking ways 0, 1, and 2 is possible, but it is not possible to lock only way 0 and way 2. when using way-locking, at least two ways must be left unlocked. the maximum number of lockable ways is six on the g2 core (way 0?way 5). unlike entire cache locking, invalid entries in a locked way are accessible and available for data replacement. as hits to the cache fill invalid entries within a locked way, the entries become valid and locked. this behavior differs from entire cache locking in which invalid entries cannot be allocated. unlocked ways of the cache behave normally. table 4-9 summaries the g2 core cache organization. 4.12.2 cache locking register summary table 4-10 through table 4-12 outline the registers and bits used to perform cache locking on the g2 core. refer to section 2.1.2.1, ?hardware implementation register 0 (hid0) ,? for a complete description of the hid0 and msr registers. refer to section 2.1.2.3, ?hardware implementation register 2 (hid2),? for a complete description of the hid2 register. table 4-9. cache organization instruction cache size data cache size associativity block size way size 16 kbytes 16 kbytes 4-way 8 words 4 kbytes f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-33 cache locking 4.12.3 performing cache locking this section outlines the basic procedures for locking the data and instruction caches and provides some example code for locking the caches. the procedures for the data cache are described first, followed by the corresponding sections for locking the instruction cache. the basic procedures for cache locking are: enabling the cache enabling address translation for example code table 4-10. hid0 bits used to perform cache locking bits name description 16 ice instruction cache enable. this bit must be set for instruction cache locking. see section 4.12.3.1.1, ?enabling the data cache.? 17 dce data cache enable. this bit must be set for data cache locking. see section 4.12.3.1.1, ?enabling the data cache.? 18 ilock instruction cache lock. set to lock the entire instruction cache. see section 4.12.3.2.5, ?entire instruction cache locking.? 19 dlock data cache lock. set to lock the entire data cache. see section 4.12.3.1.6, ?entire data cache locking.? 20 icfi instruction cache flash invalidate. setting and then clearing this bit invalidates the entire instruction cache. see section 4.12.3.2.7, ?invalidating the instruction cache (even if locked).? 21 dcfi data cache flash invalidate. setting and then clearing this bit invalidates the entire data cache. see section 4.12.3.1.4, ?invalidating the data cache.? table 4-11. hid2 bits used to perform cache way-locking bits name description 16?18 iwlck instruction cache way-lock. these bits are used to lock individual ways in the instruction cache. see section 4.12.3.2.6, ?instruction cache way-locking.? 24?26 dwlck data cache way-lock. these bits are used to lock individual ways in the data cache. see section 4.12.3.1.7, ?data cache way-locking.? table 4-12. msr bits used to perform cache locking bits name description 16 ee external interrupt enable. this bit must be cleared during instruction and data cache loading. see section 4.12.3.1.3, ?disabling exceptions for data cache locking.? 19 me machine check enable. this bit must be cleared during instruction and data cache loading. see section 4.12.3.1.3, ?disabling exceptions for data cache locking.? 26 ir instruction address translation. this bit must be set to enable instruction address translation by the mmu. see section 4.12.3.1.2, ?address translation for data cache locking.? 27 dr data address translation. this bit must be set to enable data address translation by the mmu. see section 4.12.3.1.2, ?address translation for data cache locking.? f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-34 g2 powerpc core reference manual motorola cache locking disabling exceptions loading the cache locking the cache (entire cache locking or cache way-locking) in addition, this section describes how to invalidate the data and instruction caches, even when they are locked. 4.12.3.1 data cache locking this section describes the procedures for performing data cache locking on the g2 core. 4.12.3.1.1 enabling the data cache to lock the data cache, the data cache enable bit hid0[dce], bit 17, must be set. the following assembly code enables the data cache: # enable the data cache. this corresponds # to setting dce bit in hid0 (bit 17) mfspr r1, hid0 ori r1, r1, 0x4000 sync mtspr hid0, r1 4.12.3.1.2 address translation for data cache locking two distinct memory areas must be set up to enable cache locking: the first area is where the code that performs the locking resides and is executed from the second area is where the data to be locked resides both areas of memory must be in locations that are translated by the memory management unit (mmu). this translation can be performed either with the page table or the block address translation (bat) registers. for the purposes of the cache locking example in this document, the two areas of memory are defined using the bat registers. the first area is a 1-mbyte area in the upper region of memory that contains the code performing the cache locking. the second area is a 256-mbyte block of memory (not all of the 256 mbytes of memory is locked in the cache; this area is set up as an example) that contains the data to lock. both memory areas use identity translation (the logical memory address equals the physical memory address). table 4-13 summarizes the bat settings used in this example. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-35 cache locking the block address translation upper (batu) and block address translation lower (batl) settings in table 4-13 can be used for both instruction block address translation (ibat) and data block address translation (dbat) registers. after the bat registers have been set up, the mmu must be enabled. the following assembly code enables both instruction and data memory address translation: # enable instruction and data memory address translation. this # corresponds to setting ir and dr in the msr (bits 26 & 27) mfmsr r1 ori r1, r1, 0x0030 mtmsr r1 sync 4.12.3.1.3 disabling exceptions for data cache locking to ensure that exception handler routines do not execute while the cache is being loaded (which could possibly pollute the cache with undesired contents) all exceptions must be disabled. this is accomplished by clearing the appropriate bits in the machine state register (msr). see table 4-14 for the bits within the msr that must be cleared to ensure that exceptions are disabled. the following assembly code disables all asynchronous exceptions: # clear the following bits from the msr: # ee (16) me (19) # fe0 (20) fe1 (23) # me (24) table 4-13. example bat settings for cache locking area base address memory size wimg bits batu setting batl setting first 0xfff0_0000 1 mbyte 0b0100 1 0xfff0_001f 0xfff0_0002 1 1 cache-inhibited memory is not a requirement for data cache locking. a setting of 0xfff0_0002 with a corresponding wimg of 0b0000 marks the memory area as cacheable. second 0x0000_0000 256 mbyte 0b0000 0x0000_1fff 0x0000_0002 table 4-14. msr bits for disabling exceptions bits name description 16 ee external interrupt enable 19 me machine check enable 20 fe0 1 1 the floating-point exception may not need to be disabled because the example code shown in this document that performs cache locking does not execute any floating-point operations. floating-point exception mode 0 23 fe1 1 floating-point exception mode 1 24 ce critical interrupt enable f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-36 g2 powerpc core reference manual motorola cache locking mfmsr r1 lis r2, 0xffff ori r2, r2, 0x667f and r1, r1, r2 mtmsr r1 sync 4.12.3.1.4 invalidating the data cache if a non-empty data cache has modified data, and the data cannot be discarded, the data cache must be flushed before it can be invalidated. data cache flushing is accomplished by filling the data cache with known data and performing a flash invalidate or a series of dcbf instructions that force a flush and invalidation of the data cache block. the following code sequence shows how to flush the data cache: # r6 contains a block-aligned address in memory with which to fill # the data cache. for this example, address 0x0 is used li r6, 0x0 # ctr = number of data blocks to load # number of blocks = (16k) / (32 bytes/block) # = 2^14 / 2^5 = 2^9 = 0x200 li r1, 0x200 mtctr r1 # save the total number of blocks in cache to r8 mr r8, r1 # load the entire cache with known data loop: lwz r2, 0(r6) addi r6, r6, 32 # find the next block bdnz loop # decrement the counter, and # branch if ctr != 0 # now, flush the cache with dcbf instructions li r6, 0x0 # address of first block mtctr r8 # number of blocks loop2: dcbf r0, r6 addi r6, r6, 32 # find the next block bdnz loop2 # decrement the counter, and # branch if ctr != 0 if the content of the data cache does not need to be flushed to memory, the cache can be directly invalidated. the entire data cache is invalidated through the data cache flash invalidate bit hid0[dcfi], bit 21. setting hid0[dcfi] and then immediately clearing it f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-37 cache locking causes the entire data cache to be invalidated. the following assembly code invalidates the entire data cache (does not flush modified entries): # set and then clear the hid0[dcfi] bit, bit 21 mfspr r1, hid0 mr r2, r1 ori r1, r1, 0x0400 mtspr hid0, r1 mtspr hid0, r2 sync 4.12.3.1.5 loading the data cache this section explains loading data into the data cache. the data cache can be loaded in several ways. the example in this document loads the data from memory. the following assembly code loads the data cache: # assuming interrupts are turned off, cache has been flushed, # mmu on, and loading from contiguous cacheable memory. # r6 = starting address of code to lock # r20 = temporary register for loading into # ctr = number of cache blocks to lock loop: lwz r20, 0(r6) # load data into d-cache addi r6, r6, 32 # find next block to load bdnz loop # ctr = ctr-1, branch if ctr != 0 4.12.3.1.6 entire data cache locking locking of the entire data cache is controlled by the data cache lock bit (hid0[dlock], bit 19). setting hid0[dlock] to 1 locks the entire data cache. to unlock the data, the hid0[dlock] must be cleared to 0. setting the dlock bit must be preceded by a sync instruction to prevent the data cache from being locked during a data access. the following assembly code locks the entire data cache: # set the dlock bit in hid0 (bit 19) mfspr r1, hid0 ori r1, r1, 0x1000 sync mtspr hid0, r1 4.12.3.1.7 data cache way-locking data cache way-locking is controlled by hid2[dwlck], bits 24?26. table 4-15 shows the hid2[dwlck[0?2]] settings for the g2 core embedded processor. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-38 g2 powerpc core reference manual motorola cache locking the following assembly code locks way 0 of the g2 core data cache: # lock way 0 of the data cache # this corresponds to setting dwlck(0-2) 0b001 (bits 24-26) mfspr r1, hid2 lis r2, 0xffff ori r2, r2, 0xff1f and r1, r1, r2 ori r1, r1, 0x0020 sync mtspr hid2, r1 4.12.3.1.8 invalidating the data cache (even if locked) there are two methods to invalidate the instruction or data cache: invalidate the entire cache by setting and then immediately clearing the data cache flash invalidate bit hid0[dcfi], bit 21. even when a cache is locked, toggling dcfi bit invalidates all of the data cache. the data cache block invalidate ( dcbi ) instruction can be used to invalidate individual cache blocks on other devices. however, the dcbi instruction should never be used on the g2 core. 4.12.3.2 instruction cache locking this section describes the procedures for performing instruction cache locking on the g2 core. 4.12.3.2.1 enabling the instruction cache to lock the instruction cache, the instruction cache enable bit hid0[ice], bit 16 must be set. table 4-15. g2 core dwlck[0?2] encodings dwlck[0:2] ways locked 0b000 no ways locked 0b001 way 0 locked 0b010 ways 0 and 1 locked 0b011 ways 0, 1, and 2 locked 0b100 ways 0, 1, 2, and 3 locked 0b101 ways 0, 1, 2, 3, and 4 locked 0b110 ways 0, 1, 2, 3, 4, and 5 locked 0b111 reserved f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-39 cache locking # enable the data cache. this corresponds # to setting dce bit in hid0 (bit 17) mfspr r1, hid0 ori r1, r1, 0x8000 sync mtspr hid0, r1 4.12.3.2.2 address translation for instruction cache locking two distinct memory areas must be set up to enable cache locking: the first area is where the code that performs the locking resides and is executed from the second area is where the instructions to be locked reside both areas of memory must be in locations that are translated by the memory management unit (mmu). this translation can be performed either with the page table or the block address translation (bat) registers. for the purposes of the cache locking example in this document, two areas of memory are defined using the bat registers. the first area is a 1-mbyte area in the upper region of memory that contains the code performing the cache locking. this area of memory must be cache-inhibited for instruction cache locking. the second area is a 256-mbyte block of memory (not all of the 256 mbytes of memory is locked in the cache; this area is set up as an example) that contains the instructions to lock. both memory areas use identity translation (the logical memory address equals the physical memory address). table 4-16 summarizes the bat settings used in this example. the block address translation upper (batu) and block address translation lower (batl) settings in table 4-16 can be used for both instruction block address translation (ibat) and data block address translation (dbat) registers. after the bat registers have been set up, the mmu must be enabled. the following assembly code enables both instruction and data memory address translation: # enable instruction and data memory address translation. this # corresponds to setting ir and dr in the msr (bits 26 & 27) table 4-16. example bat settings for cache locking area base address memory size wimg bits batu setting batl setting first 0xfff0_0000 1 mbyte 0b0100 1 0xfff0_001f 0xfff0_0022 1 1 0xfff0_0022 defines a cache-inhibited memory area used for instruction cache locking, and corresponds to a wimg of 0b0100. cache-inhibited memory is not a requirement for data cache locking. a setting of 0xfff0_0002 with a corresponding wimg of 0b0000 marks the memory area as cacheable. second 0x0000_0000 256 mbytes 0b0000 0x0000_1fff 0x0000_0002 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-40 g2 powerpc core reference manual motorola cache locking mfmsr r1 ori r1, r1, 0x0030 mtmsr r1 sync 4.12.3.2.3 disabling exceptions for instruction cache locking to ensure that exception handler routines do not execute while the cache is being loaded (which could possibly pollute the cache with undesired contents) all exceptions must be disabled. this is accomplished by clearing the appropriate bits in the machine state register (msr). see table 4-17 for the bits within the msr that must be cleared to ensure that exceptions are disabled. the following assembly code disables all asynchronous exceptions: # clear the following bits from the msr: # ee (16) me (19) # fe0 (20) fe1 (23) # me (24) mfmsr r1 lis r2, 0xffff ori r2, r2, 0x667f and r1, r1, r2 mtmsr r1 sync 4.12.3.2.4 preloading instructions into the instruction cache to optimize performance, processors that implement the powerpc architecture automatically prefetch instructions into the instruction cache. this feature can be used to preload explicit instructions into the cache even when it is known that their execution will be canceled. although the execution of the instructions is canceled, the instructions remain valid in the instruction cache. table 4-17. msr bits for disabling exceptions bit name description 16 ee external interrupt enable 19 me machine check enable 20 fe0 1 1 the floating-point exception may not need to be disabled because the example code shown in this document that performs cache locking does not execute any floating-point operations. floating-point exception mode 0 23 fe1 1 floating-point exception mode 1 24 ce critical interrupt enable f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-41 cache locking because instructions are intentionally executed speculatively, care must be taken to ensure that all i/o memory is marked guarded. otherwise, speculative loads and stores to i/o space could potentially cause data loss. see the programming environments manual for a full discussion of guarded memory. the code that prefetches must be in cache-inhibited memory as in the following example: # assuming exceptions are disabled, cache has been flushed, # the mmu is on, and we are executing in a cache-inhibited # location in memory # lr and r6 = starting address of code to lock # ctr = number of cache blocks to lock # r2 = non-zero numerator and denominator # ?loop? must begin on an 8-byte boundary to ensure that # the divw and beqlr+ are fetched on the same cycle. .orig 0xfff04000 loop: divw. r2, r2, r2 # long divide w/ non-zero result beqlr+ # cause the prefetch to happen addi r6, r6, 32 # find next block to prefetch mtlr r6 # set the next block bdnz- loop # decrement the counter and # branch if ctr != 0 in the above example, both the divw and beqlr+ instructions are fetched at the same time (this assumes a 64-bit 60x data bus; the preloading code does not work for a 32-bit data bus) due to their placement on a double-word boundary. the divide instruction was chosen because it takes many cycles to execute. during execution of the divide, the processor starts fetching instructions speculatively at the target destination of the branch instruction. the speculation occurs because the branch is statically predicted as taken. this speculative fetching causes the cache block that is pointed to by the link register (lr) to be loaded into the cache. because the divw. instruction always produces a non-zero result, the beqlr+ is not taken and execution of all speculatively fetched instructions is canceled. however, the instructions remain valid in the cache. if the destination instruction stream contains an unconditional branch to another memory location, it is possible to also prefetch the destination of the unconditional branch instruction. this does not cause a problem if the destination of the unconditional branch is also inside the area of memory that needs to be preloaded. but if the destination of the unconditional branch is not in the area of memory to be loaded, then care must be taken to ensure that the branch destination is to an area of memory that is cache inhibited. otherwise, unintentional instructions may be locked in the cache and the desired instructions may not be in their expected way within the cache. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-42 g2 powerpc core reference manual motorola cache locking 4.12.3.2.5 entire instruction cache locking locking the entire instruction cache is controlled by the instruction cache lock bit (hid0[ilock], bit 18). setting hid0[ilock] locks the entire instruction cache, and clearing hid0[ilock] allows the instruction cache to operate normally. the setting of the hid0[ilock] should be preceded by an isync instruction to prevent the instruction cache from being locked during an instruction access. the following assembly code locks the contents of the entire instruction cache. # set the ilock bit in hid0 (bit 18) mfspr r1, hid0 ori r1, r1, 0x2000 isync mtspr hid0, r1 4.12.3.2.6 instruction cache way-locking instruction cache way-locking is controlled by the hid2[iwlck], bits 16?18. table 4-18 shows the hid2[iwlck[0?2]] settings for the g2 core embedded processor. the following assembly code locks way 0 of the g2 core instruction cache: # lock way 0 of the instruction cache # this corresponds to setting iwlck(0?2) to 0b001 (bits 16?18) mfspr r1, hid2 lis r2, 0xffff ori r2, r2, 0x1fff and r1, r1, r2 ori r1, r1, 0x2000 isync mtspr hid2, r1 table 4-18. g2 core iwlck[0?2] encodings iwlck[0:2] ways locked 0b000 no ways locked 0b001 way 0 locked 0b010 ways 0 and 1 locked 0b011 ways 0, 1, and 2 locked 0b100 ways 0, 1, 2, and 3 locked 0b101 ways 0, 1, 2, 3, and 4 locked 0b110 ways 0, 1, 2, 3, 4, and 5 locked 0b111 reserved f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 4. instruction and data cache operation 4-43 cache locking 4.12.3.2.7 invalidating the instruction cache (even if locked) there are two methods to invalidate the instruction cache. in the first way, invalidate the entire cache by setting and then immediately clearing the instruction cache flash invalidate bit (hid0[icfi], bit 20). even when a cache is locked, toggling the icfi bit invalidates all of the instruction cache. the following assembly code invalidates the entire instruction cache: # set and then clear the hido[icfi] bit, bit 20 mfspr r1, hid0 mr r2, r1 ori r1, r1, 0x0800 mtspr hid0, r1 mtspr hid0, r2 sync in the second method, the instruction cache block invalidate ( icbi) instruction can be used to invalidate individual cache blocks. the icbi instruction invalidates blocks in an entirely locked instruction cache. the icbi instruction also may invalidate way-locked blocks within the instruction cache. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 4-44 g2 powerpc core reference manual motorola cache locking f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-1 chapter 5 exceptions the powerpc exception mechanism allows the processor to change to supervisor state as a result of external signals, errors, or unusual conditions arising in the execution of instructions, and differ from the arithmetic exceptions defined by the ieee for floating-point operations. when exceptions (referred to as interrupts in the architecture specification) occur, information about the state of the processor is saved to certain registers and the processor begins execution at an address (exception vector) predetermined for each exception. processing of exceptions occurs in supervisor mode. although multiple exception conditions can map to a single exception vector, a more specific condition may be determined by examining a register associated with the exception?for example, the dsisr or fpscr. additionally, certain exception conditions can be explicitly enabled or disabled by software. the powerpc architecture requires that exceptions be handled in program order; therefore, although a particular implementation may recognize exception conditions out of order, they are handled strictly in order with respect to the instruction stream. when an instruction-caused exception is recognized, any unexecuted instructions that appear earlier in the instruction stream, including any that have not yet entered the execute state, are required to complete before the exception is taken. any exceptions caused by those instructions are handled first. likewise, exceptions that are asynchronous and precise are recognized when they occur, but are not handled until the instruction currently in the completion stage successfully completes execution or generates an exception, and the completed store queue is emptied (see section 7.1, ?terminology and conventions,? for the definition). an instruction is said to have completed when the results of that instruction?s execution have been committed to the registers defined by the architecture (for example, the gprs or fprs, rather than rename buffers). if a single instruction encounters multiple exception conditions, those exceptions are taken and handled sequentially. likewise, exceptions that are asynchronous are recognized when they occur, but are not handled until the next instruction to complete in program order successfully completes. throughout this chapter, the phrase ?next instruction? implies the next instruction to complete in program order. note that exceptions can occur while an exception handler routine is executing, and multiple exceptions can become nested. it is up to the exception handler to save the states to allow control to ultimately return to the original excepting program. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-2 g2 powerpc core reference manual motorola exception classes unless a catastrophic condition causes a system reset or machine check exception, only one exception is handled at a time. if, for example, a single instruction encounters multiple exception conditions, those conditions are handled sequentially. after the exception handler handles an exception, the instruction execution continues until the next exception condition is encountered. however, in many cases there is no attempt to re-execute the instruction. this method of recognizing and handling exception conditions sequentially guarantees that exceptions are recoverable. to prevent loss of state information, exception handlers should save the information stored in srr0 and srr1 soon after the exception is taken. this prevents loss of information due to a system reset or machine check exception or to an instruction-caused exception in the exception handler before disabling external interrupts. in this chapter, the following terminology is used to describe the various stages of exception processing: recognition exception recognition occurs when the condition that can cause an exception is identified by the processor. taken an exception is said to be taken when control of instruction execution is passed to the exception handler; that is, the context is saved and the instruction at the appropriate vector offset is fetched and the exception handler routing is executed in supervisor mode. handling exception handling is performed by the software linked to the appropriate vector offset. exception handling is performed at the supervisor-level. 5.1 exception classes the powerpc architecture supports four types of exceptions: synchronous, precise?these are caused by instructions. all instruction-caused exceptions are handled precisely; that is, the machine state at the time the exception occurs is known and can be completely restored. this means that (excluding the trap and system call exceptions) the address of the faulting instruction is provided to the exception handler and that neither the faulting instruction nor subsequent instructions in the code stream will complete execution before the exception is taken. once the exception is processed, execution resumes at the address of the faulting instruction (or at an alternate address provided by the exception handler). when an exception is taken due to a trap or system call instruction, execution resumes at an address provided by the handler. synchronous, imprecise?the powerpc architecture defines two imprecise floating-point exception modes: recoverable and nonrecoverable. even though the g2 core provides a means to enable the imprecise modes, it implements these modes f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-3 exception classes identically to the precise mode (that is, all enabled floating-point exceptions are always precise on the g2 core). asynchronous, maskable?the external (core_int ), system management interrupt (core_smi ), and decrementer exceptions are maskable asynchronous exceptions. the critical interrupt (core_cint ) exception of the g2_le core is also a maskable asynchronous exception. when these exceptions occur, their handling is postponed until the next instruction completes execution and until any exceptions associated with that instruction complete execution. if there are no instructions in the execution units, the exception is taken immediately upon determination of the correct restart address (for loading srr0). asynchronous, nonmaskable?there are two nonmaskable asynchronous exceptions: system reset and the machine check exception. these exceptions may not be recoverable, or may provide a limited degree of recoverability. all exceptions report recoverability through the msr[ri] bit. the g2 core exception classes are shown in table 5-1. table 5-1 defines exception categories that are handled uniquely by the g2 core. note that table 5-1 includes no synchronous imprecise exceptions. while the powerpc architecture supports imprecise handling of floating-point exceptions, the g2 core implements floating-point exception modes as precise exceptions. although the powerpc architecture specifies that the recognition of the machine check exception is nonmaskable, on the g2 core the stimuli that cause this exception are maskable. for example, the machine check exception is caused by the assertion of core_tea , core_ape , core_dpe , or core_mcp . however, core_mcp , core_ape , and core_dpe can be disabled by bits 0, 2, and 3, respectively, in hid0. therefore, the machine check caused by asserting core_tea is the only truly nonmaskable machine check exception. the g2 core exceptions, and conditions that cause them, are listed in table 5-2. table 5-1. exception classifications synchronous/asynchronous precise/imprecise exception type asynchronous, nonmaskable imprecise machine check system reset asynchronous, maskable precise external interrupt decrementer system management interrupt critical interrupt (g2_le core only) synchronous precise instruction-caused exceptions f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-4 g2 powerpc core reference manual motorola exception classes table 5-2. exceptions and conditions exception type vector offset (hex) causing conditions reserved 00000 ? system reset 00100 a system reset is caused by the assertion of either core_sreset or core_hreset . machine check 00200 a machine check is caused by the assertion of the core_tea signal during a data bus transaction, assertion of core_mcp , or an address or data parity error. dsi 00300 the cause of a dsi exception can be determined by the bit settings in the dsisr, listed as follows: 1 set if the translation of an attempted access is not found in the primary hash table entry group (hteg), or in the rehashed secondary hteg, or in the range of a dbat register; otherwise cleared. 4 set if a memory access is not permitted by the page or dbat protection mechanism; otherwise cleared. 5 set by an eciwx or ecowx instruction if the access is to an address that is marked as write-through, or execution of a load/store instruction that accesses a direct-store segment. 6 set for a store operation and cleared for a load operation 9 g2_le core only. set a data address breakpoint exception occurs when the data [0?28] in the dabr or dabr2 matches the next data access (load or store instruction) to complete in the completion unit. the different breakpoints are enabled as follows: write breakpoints enabled when dabr[30] is set read breakpoints enabled when dabr[31] is set 11 set if eciwx or ecowx is used and ear[e] is cleared isi 00400 an isi exception is caused when an instruction fetch cannot be performed for any of the following reasons: the effective (logical) address cannot be translated. that is, there is a page fault for this portion of the translation, so an isi exception must be taken to load the pte (and possibly the page) into memory. the fetch access is to a direct-store segment (indicated by srr1[3] set) the fetch access violates memory protection (indicated by srr1[4] set). if the key bits (ks and kp) in the segment register and the pp bits in the pte are set to prohibit read access, instructions cannot be fetched from this location. external interrupt 00500 an external interrupt is caused when msr[ee] = 1 and the core_int signal is asserted. alignment 00600 an alignment exception is caused when the core cannot perform a memory access for any of the reasons described below: the operand of a floating-point load or store instruction is not word-aligned. the operand of lmw , stmw , lwarx , and stwcx. instructions are not aligned. the execution of a floating-point load or store instruction to a direct-store segment. the operand of a load, store, load multiple, store multiple, load string, or store string instruction crosses a segment boundary into a direct-store segment, or crosses a protection boundary. execution of a misaligned eciwx or ecowx instruction. the instruction is lmw , stmw , lswi , lswx , stswi , stswx , and the g2 core is in little-endian mode. this applies to both modified little-endian and true little-endian mode for g2_le core. the operand of dcbz is in memory that is write-through-required or caching-inhibited. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-5 exception classes program 00700 a program exception is caused by one of the following exception conditions, which correspond to bit settings in srr1 and arise during execution of an instruction. floating-point enabled exception?a floating-point enabled exception condition is generated when the following condition is met: (msr[fe0] | msr[fe1]) & fpscr[fex] is 1. fpscr[fex] is set by the execution of a floating-point instruction that causes an enabled exception or by the execution of one of the ?move to fpscr? instructions that results in both an exception condition bit and its corresponding enable bit being set in the fpscr. illegal instruction?an illegal instruction program exception is generated when execution of an instruction is attempted with an illegal opcode or illegal combination of opcode and extended opcode fields (including powerpc instructions not implemented in the core), or when execution of an optional instruction not provided in the core is attempted (these do not include those optional instructions that are treated as no-ops). privileged instruction?a privileged instruction type program exception is generated when the execution of a privileged instruction is attempted and the msr register user privilege bit, msr[pr], is set. in the g2 core, this exception is generated for mtspr or mfspr with an invalid spr field if spr[0] = 1 and msr[pr] = 1. this may not be true for all cores that implement the powerpc architecture. trap?a trap type program exception is generated when any of the conditions specified in a trap instruction is met. floating-point unavailable 00800 a floating-point unavailable exception is caused by an attempt to execute a floating-point instruction (including floating-point load, store, and move instructions) when the floating-point available bit is cleared (msr[fp] = 0). decrementer 00900 the decrementer exception occurs when dec[31] changes from 0 to 1. this exception is enabled with msr[ee]. critical interrupt 00a00 a critical interrupt exception is taken when the core_cint signal is asserted and msr[ce] = 1 (g2_le only). reserved 00b00?00bff ? system call 00c00 a system call exception occurs when a system call ( sc ) instruction is executed. trace 00d00 a trace exception is taken when msr[se] =1 or when the currently completing instruction is a branch and msr[be] =1. reserved 00e00 the g2 core does not generate an exception to this vector. other devices may use this vector for floating-point assist exceptions. reserved 00e10?00fff ? instruction translation miss 01000 an instruction translation miss exception is caused when the effective address for an instruction fetch cannot be translated by the itlb. data load translation miss 01100 a data load translation miss exception is caused when the effective address for a data load operation cannot be translated by the dtlb. data store translation miss 01200 a data store translation miss exception is caused when the effective address for a data store operation cannot be translated by the dtlb, or where a dtlb hit occurs, and the change bit in the pte must be set due to a data store operation. table 5-2. exceptions and conditions (continued) exception type vector offset (hex) causing conditions f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-6 g2 powerpc core reference manual motorola exception classes exceptions are roughly prioritized by exception class, as follows: 1. nonmaskable, asynchronous exceptions have priority over all other exceptions? system reset and machine check exceptions (although the machine check exception condition can be disabled so the condition causes the processor to go directly into the checkstop state). these exceptions cannot be delayed, and do not wait for the completion of any precise exception handling. 2. synchronous, precise exceptions are caused by instructions and are taken in strict program order. 3. maskable asynchronous exceptions (for example, external interrupt and decrementer exceptions) are delayed until higher priority exceptions are taken. system reset and machine check exceptions may occur at any time and are not delayed even if an exception is being handled. as a result, state information for the interrupted exception may be lost; therefore, these exceptions are typically nonrecoverable. all other exceptions have lower priority than system reset and machine check exceptions, and the exception may not be taken immediately when it is recognized. 5.1.1 exception priorities the exceptions are listed in table 5-3 in order of highest to lowest priority. instruction address breakpoint 01300 an instruction address breakpoint exception occurs when the address (bits 0?29) in the iabr matches the next instruction to complete in the completion unit, and iabr[30] is set. note that the g2_le core also implements iabr2, which functions identically to iabr. system management interrupt 01400 a system management interrupt is caused when msr[ee] = 1 and the core_smi input signal is asserted. reserved 01500?02fff ? table 5-3. exception priorities exception category priority exception cause asynchronous 0 system reset core_hreset or power-on reset 1 machine check core_tea , core_mcp , core_ape , or core_dpe 2 system reset core_sreset 3 critical interrupt core_cint (g2_le-only) 4 system management interrupt core_smi table 5-2. exceptions and conditions (continued) exception type vector offset (hex) causing conditions f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-7 exception classes exception priorities are described in detail in ?exception priorities,? in chapter 6, ?exceptions,? in the programming environments manual . asynchronous (continued) 5 external interrupt core_int 6 decrementer exception decrementer passed through 0x00000000 instruction fetch 0 itlb miss instruction tlb miss 1 instruction access instruction access exception instruction dispatch/ execution 0 iabr instruction address breakpoint exception 1 program program exception due to the following: illegal instruction privileged instruction trap 2 system call system call exception 3 floating-point unavailable floating-point unavailable exception 4 program program exception due to a floating-point enabled exception 5 alignment alignment exception due to the following: floating-point not word-aligned lmw , stmw , lwarx , or stwcx. not word-aligned ecwix or ecowx operands not aligned multiple or string access with little-endian bit set 6 data access data access exception due to a bat page protection violation 7 data access data access exception due to the following: eciwx , ecowx , lwarx , or stwcx. to direct-store segment (bit 5 of dsisr) crossing from memory segment to direct-store segment (bit 0 of dsisr) crossing from direct-store segment to memory segment any access to direct-store, sr[t] = 1 eciwx or ecowx with ear[e] = 0 (bit 11 of dsisr) 8 dtlb miss data tlb miss exception due to: store miss load miss 9 alignment alignment exception due to a dcbz to a write-through or caching-inhibited page 10 data access data access exception due to tlb page protection violation 11 dtlb miss data tlb miss exception due to a change bit not set on a store operation post-instruction execution 0 trace trace exception due to the following: msr[se] = 1 msr[be] = 1 for branches table 5-3. exception priorities (continued) exception category priority exception cause f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-8 g2 powerpc core reference manual motorola exception classes 5.1.2 summary of front-end exception handling the following list of interrupt categories describes how the g2 core handles exceptions up to the point of signaling the appropriate exception to occur. note that a recoverable state is reached if the completed store queue is empty (drained, not canceled) and any instruction that is next in program order and has been signaled to complete has completed. if msr[ri] is clear, the core is in a nonrecoverable state by default. also, completion of an instruction is defined as performing all architectural register writes associated with that instruction, and then removing that instruction from the completion buffer queue. asynchronous nonmaskable nonrecoverable?(system reset caused by the assertion of either core_hreset or internally during power-on reset (por)). these exceptions have highest priority and are taken immediately regardless of other pending exceptions or recoverability. a nonpredicted address is guaranteed. asynchronous maskable nonrecoverable?(machine check). a machine check exception takes priority over any other pending exception except a nonrecoverable system reset caused by the assertion of either core_hreset or internally during por. a machine check exception is taken immediately regardless of recoverability. a machine check exception can occur only if the machine check enable bit, msr[me], is set. if msr[me] is cleared, the processor goes directly into checkstop state when a machine check exception condition occurs. a nonpredicted address is guaranteed. asynchronous nonmaskable recoverable?(system reset caused by the assertion of core_sreset ). this interrupt takes priority over any other pending exceptions except nonrecoverable exceptions listed above. this exception is taken immediately when a recoverable state is reached. asynchronous maskable recoverable?(system management interrupt, critical interrupt (g2_le only), external interrupt, decrementer exception). before handling this type of exception, the next instruction in program order must complete or except. if this action causes another type of exception, that exception is taken and the asynchronous maskable recoverable exception remains pending. once an instruction can complete without causing an exception, further instruction completion is halted while the exception not taken remains pending. the exception is taken when a recoverable state is reached. instruction fetch?(itlb, isi). when this type of exception is detected, dispatch is halted and the current instruction stream is allowed to drain. if completing any instructions in this stream causes an exception, that exception is taken and the instruction fetch exception is forgotten. otherwise, as soon as the machine is empty and a recoverable state is reached, the instruction fetch exception is taken. instruction dispatch/execution?(program, dsi, alignment, emulation trap, system call, dtlb miss on load or store, iabr). this type of exception is determined at dispatch or execution of an instruction. the exception remains pending until all instructions in program order before the exception-causing instruction are f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-9 exception processing completed. the exception is then taken without completing the exception-causing instruction. if any other exception condition is created in completing these previous instructions in the machine, that exception takes priority over the pending instruction dispatch/execution exception, which will then be forgotten. post-instruction execution?(trace). this type of exception is generated following execution and completion of an instruction while a trace mode is enabled. if executing the instruction produces conditions for another type of interrupt, that exception is taken and the post-instruction execution exception is forgotten for that instruction. 5.2 exception processing when an exception is taken, the processor uses the save/restore registers, srr0 and srr1, to save the contents of the machine state register for user-level mode and to identify where instruction execution should resume after the exception is handled. 5.2.1 exception processing registers the g2 core implements the srr0 and srr1 registers that are used for saving processor state on an exception. the g2_le core also uses these registers; additionally, the g2_le core implements csrr0 and csrr1 to specifically save state for critical interrupt exceptions. 5.2.1.1 srr0 and srr1 bit settings when an exception occurs, srr0 is set to point to the instruction at which instruction processing should resume when the exception handler returns control to the interrupted process. all instructions in the program flow preceding this one will have completed and no subsequent instruction will have completed. this may be the address of the instruction that caused the exception or the next one (as in the case of a system call exception). the instruction addressed can be determined from the exception type and status bits. this address is used to resume instruction processing in the interrupted process, typically when an rfi instruction is executed. the srr0 register is shown in figure 5-1 . figure 5-1. machine status save/restore register 0 (ssr0) the save/restore register 1 (srr1) is used to save machine status (the contents of the msr) on exceptions and to restore those values when rfi is executed. srr1 is shown in figure 5-2. srr0 (holds ea for resuming program execution) 0 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-10 g2 powerpc core reference manual motorola exception processing figure 5-2. machine status save/restore register 1 (ssr1) typically, when an exception occurs, bits 0?15 of srr1 are loaded with exception-specific information and bits 16?31 of msr are placed into the corresponding bit positions of srr1. the g2 core loads srr1 with specific bits for handling machine check exceptions, as shown in table 5-4. the g2 core loads srr1 with specific bits for handling the three tlb miss exceptions, as shown in table 5-5. table 5-4. srr1 bit settings for machine check exceptions bits name description 0 msr[0] copy of msr bit 0 1?4 ? reserved 5?9 msr[5?9] copy of msr bits 5?9 10?11 ? reserved 12 mcp machine check 13 tea tea error 14 dpe data parity error 15 ape address parity error 16?31 msr[16?31] copy of msr bits16?31 table 5-5. srr1 bit settings for software table search operations bits name description 0?3 crf0 copy of condition register field 0 (cr0) 4? reserved 5?9 msr[5?9] copy of msr bits 5?9 10?11 ? reserved 12 key tlb miss protection key 13 i/d instruction/data tlb miss 0dtlb miss 1itlb miss 14 way bit 14 indicates which tlb associativity set should be replaced 0set 0 1set 1 15 s/l store/load protection instruction 0 load miss 1 store miss 16?31 msr[16?31] copy of msr bits 16?31 0 31 exception-specific information and msr bit values f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-11 exception processing note that in some implementations, every instruction fetch when msr[ir] = 1 and every instruction execution requiring address translation when msr[dr] = 1 may modify srr1. 5.2.1.2 csrr0 and csrr1 bit settings?g2_le only the g2_le core also implements the csrr0 and csrr1 to save state for critical interrupt exceptions only. note that the values saved in csrr0 are the same as those saved in srr0 for all other exceptions, and the values saved in csrr1 are the same as those saved in srr1 for all other exceptions. however, csrr0 and csrr1 have unique spr numbers, as described in chapter 2, ?register model.? figure 5-3 shows the format of csrr0. figure 5-3. critical interrupt save/restore register 0 (csrr0) when a critical interrupt exception occurs, csrr0 is set to point to an instruction such that all prior instructions have completed execution and no subsequent instruction has begun execution. when an rfci instruction is executed, the contents of csrr0 are copied to the next instruction address (nia)?the 32-bit address of the next instruction to be executed. figure 5-4 shows the format of csrr1. figure 5-4. critical interrupt save/restore register 1 (csrr1) when an exception occurs, csrr1[0?15] are loaded with all zeros and the values of msr[16?31] are placed in corresponding csrr1 bit positions. when rfci executes, msr[16?31] are loaded from csrr1[16?31]. csrr1[0?15] are defined as reserved. an implementation may define one or more of these bits, and may also cause them to be saved from msr when an exception is taken, and restored to msr from csrr1 when an rfci is executed. 5.2.1.3 sprg4?sprg7 (g2_le only) the g2_le core provides four additional sprg (sprg4?sprg7) registers for general operating system use, such as performing a fast state save or for supporting multiprocessor implementations. however, sprg4?sprg7 have unique spr numbers, as described in chapter 2, ?register model.? the formats of sprg4?sprg7 are shown in figure 5-5. csrr0 0 29 30 31 reserved 00 csrr1 0 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-12 g2 powerpc core reference manual motorola exception processing figure 5-5. special-purpose registers (sprg0?sprg7) table 5-6 describes conventional uses of sprg4 ?sprg7 for the g2_le core. 5.2.1.4 msr bit settings the msr is shown in figure 5-6. when an exception occurs, msr bits, as described in table 5-7, are altered as determined by the exception. figure 5-6. machine state register (msr) table 5-7 shows the bit definitions for the msr. full function reserved bits are saved in srr1 when an exception occurs; partial function reserved bits are not saved. table 5-6. conventional uses of sprg4?sprg7 register description sprg4 software may load a unique physical address in this register to identify an area of memory reserved for use by the first-level exception handler. this area must be unique for each processor in the system. sprg5 sprg5 may be used as a scratch register by the first-level exception handler to save the content of a gpr. that gpr then can be loaded from sprg4 and used as a base register to save other gprs to memory. sprg6 sprg6 may be used by the operating system as needed. sprg7 sprg7 may be used by the operating system as needed. table 5-7. msr bit settings bits name description 0 ? reserved. full function. 1?4 ? reserved. partial function. 5?9 ? reserved. full function. 10?12 ? reserved. partial function. 13 pow power management enable (implementation-specific) 0 disables programmable power modes (normal operation mode) 1 enables programmable power modes (nap, doze, or sleep mode) this bit controls the programmable power modes only; it has no effect on dynamic power management (dpm). msr[pow] may be altered with an mtmsr instruction only. also, when altering the pow bit, software may alter only this bit in the msr and no others. the mtmsr instruction must be followed by a context-synchronizing instruction. see chapter 10, ?power management,? for more information. sprg n 0 31 0 1213141516171819 2021222324252627 28293031 reserved 0 0 0 0 0 0 0 0 0 0 0 0 0 pow tgpr ile ee pr fp me fe0 se be fe1 0 ip ir dr 0 0 ri le f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-13 exception processing 14 tgpr temporary gpr remapping (implementation-specific) 0 normal operation 1 tgpr mode. gpr0?gpr3 are remapped to tgpr0?tgpr3 for use by tlb miss routines the contents of gpr0?gpr3 remain unchanged while msr[tgpr] = 1. attempts to use gpr4?gpr31 with msr[tgpr] = 1 yield undefined results. temporarily replaces tgpr0?tgpr3 with gpr0?gpr3 for use by tlb miss routines. the tgpr bit is set when either an instruction tlb miss, data read miss, or data write miss exception is taken. the tgpr bit is cleared by an rfi instruction. 15 ile exception little-endian mode. when an exception occurs, this bit is copied into msr[le] to select the endian mode for the context established by the exception. 16 ee external interrupt enable 0 the processor ignores external interrupts, system management interrupts, and decrementer interrupts. 1 the processor is enabled to take an external interrupt, system management interrupt, or decrementer interrupt. 17 pr privilege level 0 the processor can execute both user- and supervisor-level instructions. 1 the processor can only execute user-level instructions. 18 fp floating-point available 0 the processor prevents dispatch of floating-point instructions, including floating-point loads, stores, and moves. 1 the processor can execute floating-point instructions, and can take floating-point enabled exception type program exceptions. 19 me machine check enable 0 machine check exceptions are disabled 1 machine check exceptions are enabled 20 fe0 floating-point exception mode 0 (see table 5-8) 21 se single-step trace enable 0 the processor executes instructions normally 1 the processor generates a trace exception on the successful completion of the next instruction 22 be branch trace enable 0 the processor executes branch instructions normally 1 the processor generates a trace exception upon the successful completion of a branch instruction 23 fe1 floating-point exception mode 1 (see table 5-8) 24 ce critical interrupt exception enable (g2_le core-only) 0 critical interrupts disabled 1 critical interrupts enabled; critical interrupt exception and rfci instruction enabled. the critical interrupt is an asynchronous implementation-specific exception. the critical interrupt exception vector offset is 0x00a00. the return from critical interrupt ( rfci ) instruction is implemented to return from these exception handlers. also, csrr0 and csrr1, are used to save and restore the processor state for critical interrupts. 25 ip exception prefix. the setting of this bit specifies whether an exception vector offset is prepended with fs or 0s. in the following description, nnnnn is the offset of the exception. see table 5-2. 0 exceptions are vectored to the physical address 0x000 n_nnnn 1 exceptions are vectored to the physical address 0xfff n_nnnn table 5-7. msr bit settings (continued) bits name description f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-14 g2 powerpc core reference manual motorola exception processing the ieee floating-point exception mode bits (fe0 and fe1) together define whether floating-point exceptions are handled precisely, imprecisely, or if they are taken at all. the possible settings and default conditions for the g2 core are shown in table 5-8. for further details, see chapter 6, ?exceptions,? in the programming environments manual . msr bits are guaranteed to be written to srr1 when the first instruction of the exception handler is encountered. 5.2.2 enabling and disabling exceptions when a condition exists that may cause an exception to be generated, it must be determined whether the exception is enabled for that condition as follows: ieee floating-point enabled exceptions (a type of program exception) are ignored when both msr[fe0] and msr[fe1] are cleared. if either of these bits are set, all ieee enabled floating-point exceptions are taken and cause a program exception. 26 ir instruction address translation 0 instruction address translation is disabled 1 instruction address translation is enabled see chapter 6, ?memory management.? 27 dr data address translation 0 data address translation is disabled 1 data address translation is enabled see chapter 6, ?memory management.? 28?29 ? reserved. full function. 30 ri recoverable exception (for system reset and machine check exceptions) 0 exception is not recoverable 1 exception is recoverable 31 le little-endian mode enable 0 the processor runs in big-endian mode 1 the processor runs in little-endian mode. for the g2_le core, see section 1.1.2.1, ?true little-endian mode,? for a definition of whether the core is operating in true little-endian mode or modified little-endian mode. table 5-8. ieee floating-point exception mode bits fe0 fe1 mode 0 0 floating-point exceptions disabled 0 1 floating-point imprecise nonrecoverable 1 1 not implemented in the g2 core. 1 0 floating-point imprecise recoverable 1 1 1 floating-point precise mode table 5-7. msr bit settings (continued) bits name description f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-15 exception processing asynchronous, maskable exceptions (that is, the external, system management, and decrementer interrupts) are enabled by setting the msr[ee] bit. when msr[ee] = 0, recognition of these exception conditions is delayed. msr[ee] is cleared automatically when an exception is taken, to delay recognition of conditions causing those exceptions. a machine check exception can occur only if the machine check enable bit, msr[me], is set. if msr[me] is cleared, the processor goes directly into checkstop state when a machine check exception condition occurs. individual machine check exceptions can be enabled and disabled through bits in the hid0 register, as described in table 2-5. the g2_le core enables the critical interrupt with the msr[ce] bit. system reset exceptions cannot be masked. 5.2.3 steps for exception processing after it is determined that the exception can be taken (by confirming that any instruction-caused exceptions occurring earlier in the instruction stream have been handled, and by confirming that the exception is enabled for the exception condition), the processor does the following: 1. the machine status save/restore register 0 (srr0) is loaded with an instruction address that depends on the type of exception. see the individual exception description for details about how this register is used for specific exceptions. 2. srr1[1?4, 10?15] are loaded with information specific to the exception type. 3. srr1[5?9, 16?31] are loaded with a copy of the corresponding bits of the msr. 4. the msr is set as described in table 5-7. the new values take effect beginning with the fetching of the first instruction of the exception-handler routine located at the exception vector address. note that msr[ir] and msr[dr] are cleared for all exception types; therefore, address translation is disabled for both instruction fetches and data accesses beginning with the first instruction of the exception-handler routine. 5. instruction fetch and execution resumes, using the new msr value, at a location specific to the exception type. the location is determined by adding the exception's vector (see table 5-2) to the base address determined by msr[ip]. if ip is cleared, exceptions are vectored to the physical address 0x000 n_nnnn . if ip is set, exceptions are vectored to the physical address 0xfff n_nnnn . for a machine check exception that occurs when msr[me] = 0 (machine check exceptions are disabled), the processor enters the checkstop state (the machine stops executing instructions). see section 5.5.2, ?machine check exception (0x00200).? note that the same steps occur when a critical interrupt occurs (and is enabled) for the g2_le core, except that csrr0 is set instead of srr0 and csrr1 is set instead of srr1. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-16 g2 powerpc core reference manual motorola exception processing 5.2.4 setting msr[ri] the operating system should handle msr[ri] as follows: in the machine check and system reset exceptions?if srr1[ri] is cleared, the exception is not recoverable. if it is set, the exception is recoverable with respect to the processor. in each exception handler?when enough state information has been saved that a machine check or system reset exception can reconstruct the previous state, set msr[ri]. in each exception handler?clear msr[ri], set the srr0 and srr1 (or csrr0 and csrr1) registers appropriately, and then execute rfi (or rfci ). note that the ri bit being set indicates that, with respect to the processor, enough processor state data is valid for the processor to continue, but it does not guarantee that the interrupted process can resume. 5.2.5 returning from an exception handler with rfi the return from interrupt ( rfi ) instruction performs context synchronization by allowing previously issued instructions to complete before returning to the interrupted process. in general, execution of the rfi instruction ensures the following: all previous instructions have completed to a point where they can no longer cause an exception. if a previous instruction causes a direct-store interface error exception, the results must be determined before this instruction is executed. previous instructions complete execution in the context (privilege, protection, and address translation) under which they were issued. the rfi instruction copies srr1 bits back into the msr. the instructions following this instruction execute in the context established by this instruction. for a complete description of context synchronization, refer to chapter 6, ?exceptions,? in the programming environments manual. 5.2.6 returning from an interrupt with rfci the return from critical interrupt ( rfci ) is a g2_le core-only supervisor level instruction that performs context synchronization by allowing previously issued instructions to complete before returning to the interrupted process. the rfci instruction performs the same f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-17 process switching functions as rfi , except that it uses csrr0 and csrr1 to restore the processor state. thus, execution of the rfci instruction ensures the following: csrr1[0, 5?9, 16?31] are placed into the corresponding bits of the msr. if the new msr value does not enable any pending exceptions, the next instruction is fetched from the address defined by csrr0[0?29] || 0b00. if the new msr value enables one or more pending exceptions, the exception associated with the highest priority pending exception is generated. in this case, the exception processing mechanism places in srr0 the address of the instruction which would have executed next had the exception not occurred. 5.3 process switching the operating system should execute one of the following when processes are switched: the sync instruction, which orders the effects of instruction execution. all instructions previously initiated appear to have completed before the sync instruction completes, and no subsequent instructions appear to be initiated until the sync instruction completes. for an example showing the use of a sync instruction, see chapter 2, ?register set,? of the programming environments manual. the isync instruction, which waits for all previous instructions to complete and then discards any fetched instructions, causing subsequent instructions to be fetched (or refetched) from memory and to execute in the context (privilege, translation, protection, etc.) established by the previous instructions. the stwcx. instruction, to clear any outstanding reservations, which ensures that an lwarx instruction in the old process is not paired with an stwcx. instruction in the new process. the operating system should set the msr[ri] bit as described in section 5.2.4, ?setting msr[ri].? 5.4 exception latencies latencies for taking various exceptions depend on the state of the machine when the exception conditions occur. this latency may be as short as one cycle, in which case an exception is signaled in the cycle following the appearance of the exception condition. the latencies are as follows: hard reset and machine check?in most cases, a hard reset or machine check exception will have a single-cycle latency. a two- to three-cycle delay may occur only when a predicted instruction is next to complete, and the branch guess that forced this instruction to be predicted was resolved to be incorrect. soft reset?the latency of a soft reset exception is affected by recoverability. the time to reach a recoverable state may depend on the time needed to complete or f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-18 g2 powerpc core reference manual motorola exception definitions except an instruction at the point of completion, the time needed to drain the completed store queue (see section 7.1, ?terminology and conventions,? for the definition), and the time waiting for a correct empty state so that a valid msr[ip] may be saved. for lower-priority externally-generated interrupts, a delay may be incurred waiting for another interrupt generated while reaching a recoverable state to be serviced. further delays are possible for other types of exceptions depending on the number and type of instructions that must be completed before those exceptions may be serviced. see section 5.1.2, ?summary of front-end exception handling,? to determine possible maximum latencies for different exceptions. 5.5 exception definitions table 5-9 shows all the types of exceptions that can occur with the g2 core and the msr bit settings when the processor transitions to supervisor mode. the state of these bits prior to the exception is typically stored in srr1 (or csrr1 for critical interrupts on the g2_le core). note that msr[ce] is cleared for the following exceptions in system reset, machine check, and critical interrupt. table 5-9. msr setting due to exception exception type msr bit pow tgpr ile ee pr fp me fe0 se be fe1 ce 1 ip ir dr ri le system reset 0 0 ? 0 0 0? 0 0 0 0 0 1000ile machine check 0 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 ile dsi 0 0 ? 0 0 0? 0 0 0 0 ??000ile isi 0 0 ? 0 0 0 ? 0 0 0 0 ? ? 0 0 0 ile external 0 0 ? 0 0 0 ? 0 0 0 0 ? ? 0 0 0 ile alignment 0 0 ? 0 0 0 ? 0 0 0 0 ? ? 0 0 0 ile program 0 0 ? 0 0 0? 0 0 0 0 ??000ile floating-point unavailable 00?000?0000??0 00ile decrementer 0 0 ? 0 0 0 ? 0 0 0 0 ? ? 0 0 0 ile critical interrupt 0 0 ? 0 0 0 ? 0 0 0 0 0 ? 0 0 0 ile system call 0 0 ? 0 0 0 ? 0 0 0 0 ? ? 0 0 0 ile trace exception 0 0 ? 0 0 0 ? 0 0 0 0 ? ? 0 0 0 ile itlb miss 0 1 ? 0 0 0 ? 0 0 0 0 ? ? 0 0 0 ile dtlb miss on load 0 1 ? 0 0 0? 0 0 0 0 ??000ile dtlb miss on store 0 1 ? 0 0 0? 0 0 0 0 ??000ile f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-19 exception definitions 5.5.1 reset exceptions (0x00100) the system reset exception is a nonmaskable, asynchronous exception signaled to the g2 core either through the assertion of the reset signals (core_sreset or core_hreset ) or internally during the power-on reset (por) process. the assertion of the soft reset signal, core_sreset , as described in section 8.3.10.2, ?soft reset (core_sreset )?input,? causes the system reset exception to be taken and the physical base address of the handler is determined by the msr[ip] bit. the assertion of the hard reset signal, core_hreset , as described in section 8.3.10.1, ?hard reset (core_hreset )?input,? causes the system reset exception to be taken. note that there are some byte ordering precautions necessary when coming out of reset in big-endian mode and switching to little-endian mode. the following sections describe the differences between a hard and soft reset and the byte ordering implications for reset exception handling. 5.5.1.1 hard reset and power-on reset as described in section 5.1.2, ?summary of front-end exception handling,? the hard reset exception is a nonrecoverable, nonmaskable asynchronous exception. when core_hreset is asserted or at power-on reset (por), the g2 core immediately branches to the address determined by the state of the core_msrip signal, as described in table 5-10, without attempting to reach a recoverable state. instruction address breakpoint 0 0 ? 0 0 0? 0 0 0 0 ??000ile system management interrupt 0 0 ? 0 0 0? 0 0 0 0 ??000ile note: 0 bit is cleared. 1 bit is set. ile bit is copied from the ile bit in the msr. ? bit is not altered. reserved bits are read as if written as 0. 1 g2_le core only. table 5-9. msr setting due to exception (continued) exception type msr bit pow tgpr ile ee pr fp me fe0 se be fe1 ce 1 ip ir dr ri le f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-20 g2 powerpc core reference manual motorola exception definitions a hard reset has the highest priority of any exception, and is always nonrecoverable. table 5-11 shows the state of the machine just before it fetches the first instruction of the system reset handler after a hard reset. the core_hreset signal can be asserted for the following reasons: system power-on reset system reset from a panel switch for information on the core_hreset signal, see section 8.3.10.1, ?hard reset (core_hreset )?input.? the following is also true after a hard reset operation: external checkstops are enabled table 5-10. hard reset msr value and exception vector core_msrip msr[0?31] fetch instructions from handler at system reset vector asserted 0x0000_0040 (msr[ip] = 1) 0xfff0_0100 negated 0x0000_0000 (msr[ip] = 0) 0x0000_0100 table 5-11. settings caused by hard reset register setting register setting gprs unknown pvr see table 2-3 fprs unknown hid0 0000_0000 fpscr 00000000 hid1 0000_0000 cr all 0s hid2 0000_0000 or 0800_0000 srs unknown dmiss and imiss all 0s msr 0000_0040 or 0000_0000 or 0001_0041 or 0001_0001 dcmp and icmp all 0s xer 0000_0000 rpa all 0s tbu 0000_0000 iabr all 0s tbl 0000_0000 dsisr 0000_0000 lr 0000_0000 dar 0000_0000 ctr 0000_0000 dec ffff_ffff sdr1 0000_0000 hash1 0000_0000 srr0 (and csrr0) 0000_0000 hash2 0000_0000 srr1 (and csrr1) 0000_0000 tlbs unknown sprgs 0000_0000 cache all cache blocks invalidated tag directory all 0s. (however, lru bits are initialized so each side of the cache has a unique lru value.) bats unknown f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-21 exception definitions the on-chip test interface has given control of the i/os to the rest of the chip for functional use since the reset exception has data and instruction translation disabled (msr[dr] and msr[ir] both cleared), the chip operates in real addressing mode as described in section 6.2, ?real addressing mode.? 5.5.1.2 soft reset as described in section 5.1.2, ?summary of front-end exception handling,? the soft reset exception is a type of system reset exception that is recoverable, nonmaskable, and asynchronous. when core_sreset is asserted, the processor attempts to reach a recoverable state by allowing the next instruction to either complete or cause an exception, blocking the completion of subsequent instructions, and allowing the completed store queue to drain (see section 7.1, ?terminology and conventions,? for the definition). unlike a hard reset, no registers or latches are initialized; however, the instruction cache is disabled (hid0[ice] = 0). after core_sreset is recognized as asserted, the processor begins fetching instructions from the system reset routine at offset 0x0100. when a soft reset occurs, registers are set as shown in table 5-12. a soft reset is recoverable provided that attaining the recoverable state does not cause a machine check exception. this interrupt case is third in priority, following hard reset and machine check. when a soft reset occurs, registers are set as shown in table 5-12 in addition to the clearing of hid0[ice]. 5.5.1.3 byte ordering considerations for g2_le only all exception handler routines are executed in the endian mode determined by the setting of the msr[ile], msr[le], and hid2[let] bits (see table 1-1 for endian mode indication) when the exception is taken. a special case for exception handlers is the system reset exception handler for both hard and soft reset for the g2_le core. when the core_tle signal is negated at the time core_hreset is negated, the system exception handler of the table 5-12. soft reset exception?register settings register setting description srr0 set to the effective address of the instruction that the processor would have attempted to complete next if no exception conditions were present. srr1 0?15 cleared 16?31 loaded from msr[16?31]. note that if the processor state is corrupted to the extent that execution cannot be reliably restarted, srr1[30] is cleared. msr pow 0 tgpr 0 ile ? ee 0 pr 0 fp 0 me ? fe0 0 se 0 be 0 fe1 0 ce 0 ip ? ir 0 dr 0 ri 0 le set to value of ile f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-22 g2 powerpc core reference manual motorola exception definitions device enters into the big-endian mode. if msr[ile], msr[le], and hid2[let] are subsequently set (during or after the reset routine has completed), a subsequent soft reset causes the system reset exception handler to be entered in true little-endian mode, potentially resulting in illegal instruction execution (if the beginning of the handler is written assuming big-endian code). note that the reverse occurs for true little-endian mode. the following assembly language code highlights register settings necessary when in big-endian mode coming out of hard reset and subsequently changing the processor state to true little-endian mode and setting the msr[ile], msr[le], and hid2[let] bits. the first eight instructions of the system reset exception handler is written in big-endian format, in order to facilitate the mode switch. the rest of the reset handler is written in true little-endian format for the remaining supervisor or os code. this reset code assumes that caching is not enabled out of reset. due to the complexities involved with keeping the memory system coherent, it is strongly recommended not to change endinaness at any other time once it is determined at hard reset. .orig 0xfff0 0100 # default ip vector # begin hreset_ handler with big-endian mode xor r2,r2,r2 initialize register xor r1,r1,r1 # initialize register oris r2,r2,0x0800 # set bit in r2 for hid2[4]let mtspr hid2,r2 # load hid2 setting let bit oris r1,r1,0x0001 # set bit in r1 for msr[15]ile ori r1,r1,0x0001 # set bit in r1 for msr[31]le mtmsr r1 # load msr setting ile and le bits isync # wait for all instructions to complete # end big-endian mode, true little-endian enabled # modify the 8 big-endian instructions into valid true little-endian instructions # true little-endian mode mtspr srr1,r1 # load the machine state with le enabled xor r0,r0,r0 # initialize register oris r0,r0,0x0001 # set starting address at b?0001 0000 mtspr srr0,r0 # load the next instruction address # whatever instructions the supervisor/os wants. rfi # return from hreset_ interrupt routine # end hreset_ handler in true little-endian mode see section 3.1.2, ?endian modes and byte ordering,? for more information on the endian modes of the g2 and g2_le cores. 5.5.2 machine check exception (0x00200) the g2 core conditionally initiates a machine check exception after detecting the assertion of the core_tea or core_mcp signals on the 60x bus (assuming the machine check is enabled with msr[me] = 1). the assertion of one of these signals indicates that a bus error f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-23 exception definitions occurred and the system terminates the current transaction. one clock cycle after the signal is asserted, the data bus signals go to the high-impedance state; however, data entering the gpr or the cache is not invalidated. note that if hid0[emcp] is cleared, the core ignores the assertion of the core_mcp signal. a machine check exception also occurs when an address or data parity error is detected on the bus and the address or data parity error is enabled in hid0. see section 2.1.2.1, ?hardware implementation register 0 (hid0),? for more information. note that the g2 core makes no attempt to force recoverability on a machine check; however, it does guarantee that the machine check exception is always taken immediately upon request, with a nonpredicted address saved in srr0, regardless of the current machine state. because pending stores in the store queue (see figure 7-4) are not canceled when a machine check exception occurs, two consecutive stores that result in the assertion of core_tea can cause the processor to checkstop. to prevent a checkstop in this case, a sync instruction must be placed between two stores that can result in assertion of core_tea . software can use the machine check exception in a recoverable mode to probe memory. for this case, a sync , load, sync instruction sequence is used. if the load access results in a system error (for example, the assertion of core_tea ), the processor can handle this in a recoverable state. if the sync instruction is not used, a second access to the same address as the first load could cause the processor to enter the checkstop state. if the msr[me] bit is set, the exception is recognized and handled; otherwise, the g2 core attempts to enter an internal checkstop. note that the resulting machine check exception has priority over any exceptions caused by the instruction that generated the bus operation. machine check exceptions are only enabled when msr[me] = 1; this is described in section 5.5.2.1, ?machine check exception enabled (msr[me] = 1).? if msr[me] = 0 and a machine check occurs, the processor enters the checkstop state; this is described in section 5.5.2.2, ?checkstop state (msr[me] = 0).? 5.5.2.1 machine check exception enabled (msr[me] = 1) when a machine check exception is taken, registers are updated as shown in table 5-13. when a machine check exception is taken, instruction execution for the handler begins at offset 0x00200 from the physical base address indicated by msr[ip]. in order to return to the main program, the exception handler should do the following: 1. srr0 and srr1 should be given the values to be used by the rfi instruction 2. execute rfi f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-24 g2 powerpc core reference manual motorola exception definitions 5.5.2.2 checkstop state (msr[me] = 0) when the g2 core enters the checkstop state, it asserts the checkstop output signal, core_ckstp_out . the following events cause the g2 core to enter the checkstop state: machine check exception occurs with msr[me] cleared external checkstop input, core_ckstp_in , is asserted. when a processor is in the checkstop state, instruction processing is suspended and generally cannot be restarted without resetting the processor. the contents of all latches are frozen within two cycles upon entering the checkstop state so that the state of the processor can be analyzed as an aid in problem determination. note that not all processors that implement the powerpc architecture provide the same level of error checking. the reasons a processor can enter checkstop state are implementation-dependent. 5.5.3 dsi exception (0x00300) a dsi exception occurs when no higher priority exception exists and a data memory access cannot be performed. the condition that caused the dsi exception can be determined by reading the dsisr register, a supervisor-level spr (spr18) that can be read by using the mfspr instruction. bit settings are provided in table 5-14. table 5-14 also indicates the memory element that is saved to the dar. table 5-13. machine check exception?register settings register setting description srr0 set to the address of the next instruction that would have been completed in the interrupted instruction stream. neither this instruction nor any others beyond it will have been completed. all preceding instructions will have been completed. srr1 0?11 cleared 12 core_mcp ?machine check signal caused exception 13 core_tea ?transfer error acknowledge signal caused exception 14 core_dpe ?data parity error condition (and signal assertion) caused exception 15 core_ape ?address parity error condition (and signal assertion) caused exception 16?31 loaded from msr[16?31] msr pow 0 tgpr 0 ile ? ee 0 pr 0 fp 0 me ? fe0 0 se 0 be 0 fe1 0 ce 0 ip ? ir 0 dr 0 ri 0 le set to value of ile note: when a machine check exception is taken, the exception handler should set msr[me] as soon as it is practical to handle another core_tea assertion. otherwise, subsequent core_tea assertions cause the processor to automatically enter the checkstop state. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-25 exception definitions dsi exceptions can occur for any of the following reasons: the instruction is not supported for the type of memory addressed any access to a direct-store segment (sr[t] = 1) the attempted access violates the memory protection defined by sr[ks,kp], pte[pp], or dbatn[pp]. note that the oea specifies an additional case that may cause a dsi exception?when an effective address for a load, store, or cache operation cannot be translated by the tlbs. on the g2 core, this condition causes a tlb miss exception instead. these scenarios are common among all processors that implement the powerpc architecture. the following additional scenarios can cause a dsi exception in the g2 core: a bus error indicates crossing from a direct-store segment to a memory segment table 5-14. dsi exception?register settings register setting description srr0 set to the effective address of the instruction that caused the exception. srr1 0?15 cleared 16?31 loaded with msr[16?31] msr pow 0 tgpr 0 ile ? ee 0 pr 0 fp 0 me ? fe0 0 se 0 be 0 fe1 0 ce ? ip ? ir 0 dr 0 ri 0 le set to value of ile dsisr 0 set if a load or store instruction results in a direct-store error exception due to a load or store instruction accesses a direct-store segment by setting a t bit. 1 set by the data tlb miss exception handler if the translation of an attempted access is not found in the primary hash table entry group (hteg), or in the rehashed secondary hteg, or in the range of a dbat register; otherwise cleared. 2?3 cleared 4 set if a memory access is not permitted by the page or bat protection mechanism; otherwise cleared. 5 set if the lwarx or stwcx. instruction is attempted to direct-store space 6 set for a store operation and cleared for a load operation 9 g2_le core only. set when a data address breakpoint exception when the data (bit 29) in the dabr1 or dabr2 matches the next data access (load or store instruction) to complete in the completion unit. the different breakpoints are enabled as follows: write breakpoints enabled when dabr[30] is set read breakpoints enabled when dabr[31] is set 7?31 cleared dar set to the effective address of a memory element as described in the following list: a byte in the first word accessed in the page that caused the dsi exception, for a byte, half word, or word memory access. a byte in the first word accessed in the bat area that caused the dsi exception for a byte, half word, or word access to a bat area. a byte in the block that caused the exception for icbi , dcbz , dcbst , dcbf , or dcbi 1 instructions. the ea that causes a data breakpoint for the g2_le core. any ea in the memory range addressed (for direct-store exceptions). 1 the dcbi instruction should never be used on the g2 core. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-26 g2 powerpc core reference manual motorola exception definitions the execution of any load/store instruction to a direct-store segment (sr[t] = 1) a data access crosses from a memory segment (sr[t] = 0) into a direct-store segment (sr[t] = 1) finally, the g2_le core causes a dsi exception when either the dabr or dabr2 is enabled and the address of an access matches with the value in the cea field and the breakpoint is enabled for the type of access (read or write) in dabr/dabr2. see chapter 11, ?debug features,? and section 2.1.2.15, ?data address breakpoint register (dabr and dabr2)?g2_le only,? for more information. dsi exceptions can be generated by load/store instructions and cache control instructions ( dcbi , dcbz , dcbst , and dcbf ). note that the dcbi instruction should never be used on the g2 core. the g2 core supports the crossing of page boundaries. however, if the second page has a translation error or protection violation associated with it, the g2 core takes the dsi exception in the middle of the instruction. in this case, the data address register (dar) always points to a byte address in the first word of the offending page. if an stwcx. instruction has an effective address for which a normal store operation would cause a dsi exception, the g2 core takes the dsi exception without checking for the reservation. if the xer indicates that the byte count for an lswi or stswi instruction is zero, a dsi exception does not occur, regardless of the effective address. the condition that caused the exception is defined in the dsisr. these conditions also use the data address register (dar) as shown in table 5-14. when a dsi exception is taken, instruction execution for the handler begins at offset 0x00300 from the physical base address indicated by msr[ip]. the architecture permits certain instructions to be partially executed when they cause a dsi exception. these are as follows: load multiple or load string instructions?some registers in the range of registers to be loaded may have been loaded. store multiple or store string instructions?some bytes of memory in the range addressed may have been updated. in these cases, the number of registers and amount of memory altered are instruction- and boundary-dependent. however, memory protection is not violated. furthermore, if some of the data accessed is in direct-store space (sr[t] = 1) and the instruction is not supported for direct-store accesses, the locations in direct-store space are not accessed. for update forms, the update register ( r a) is not altered. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-27 exception definitions 5.5.4 isi exception (0x00400) the isi exception is implemented as it is defined by the powerpc architecture. an isi exception occurs when no higher priority exception exists and an attempt to fetch the next instruction fails for any of the following reasons: if an instruction tlb miss fails to find the desired pte, then a page fault is synthesized. the itlb miss handler branches to the isi exception handler to retrieve the translation from a storage device. an attempt is made to fetch an instruction from a direct-store segment while instruction translation is enabled (msr[ir] = 1) an attempt is made to fetch an instruction from no-execute memory an attempt is made to fetch an instruction from guarded memory when msr[ir] = 1 the fetch access violates memory protection register settings for this exception are described in chapter 6, ?exceptions,? in the programming environments manual. when an isi exception is taken, instruction execution for the handler begins at offset 0x00400 from the physical base address indicated by msr[ip]. 5.5.5 external interrupt (0x00500) an external interrupt is signaled to the g2 core by the assertion of the core_int signal as described in section 8.3.9.1, ?external interrupt (core_int )?input.? the interrupt may not be recognized if a higher priority exception occurs simultaneously or if the msr[ee] bit is cleared when core_int is asserted. after the core_int is recognized, the g2 core generates a recoverable halt to instruction completion. the g2 core allows the next instruction in program order to complete, including handling any exceptions that instruction may generate. however, the g2 core blocks subsequent instructions from completing and allows any outstanding stores to occur to system memory. if any other exceptions are encountered in this process, they are taken first and the external interrupt is delayed until a recoverable halt is achieved. at this time, the g2 core saves the state information and takes the external interrupt as defined by the powerpc architecture. the register settings for the external interrupt are shown in table 5-15. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-28 g2 powerpc core reference manual motorola exception definitions when an external interrupt is taken, instruction execution for the handler begins at offset 0x00500 from the physical base address indicated by msr[ip]. the g2 core only recognizes the interrupt condition (core_int asserted) if the msr[ee] bit is set; it ignores the interrupt condition if the msr[ee] bit is cleared. to guarantee that the external interrupt is taken, the core_int signal must be held asserted until the g2 core takes the interrupt. if the core_int signal is negated before the interrupt is taken, the g2 core is not guaranteed to take an external interrupt. the interrupt handler must send a command to the device that asserted core_int , acknowledging the interrupt and instructing the device to negate core_int before the handler re-enables recognition of external interrupts. 5.5.6 alignment exception (0x00600) this section describes conditions that can cause alignment exceptions in the g2 core. the g2 core implements the alignment exception as it is defined in the powerpc architecture. for information on bit settings and how exception conditions are detected, refer to the programming environments manual . note that the powerpc architecture allows individual processors to determine whether an exception is required to handle various alignment conditions. similar to dsi exceptions, alignment exceptions use the srr0 and srr1 to save the machine state and the dsisr to determine the source of the exception. the g2 core initiates an alignment exception when it detects any of the following conditions: the operand of a floating-point load or store operation is not word-aligned the operand of an lmw , stmw , lwarx , or stwcx. instruction is not word-aligned. a multiple or string access is attempted with the msr[le] bit set the operand of a floating-point load or store operation is to a direct-store segment the operand of an elementary, multiple or string load or store crosses a segment boundary with a change to the direct-store attribute (t bit different). table 5-15. external interrupt?register settings register setting srr0 set to the effective address of the instruction that the processor would have attempted to execute next if no interrupt conditions were present. srr1 0?15 cleared 16?31 loaded from msr[16?31] msr pow 0 tgpr 0 ile ? ee 0 pr 0 fp 0 me ? fe0 0 se 0 be 0 fe1 0 ce ? ip ? ir 0 dr 0 ri 0 le set to value of ile f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-29 exception definitions the operand of a eciwx or ecowx instruction is not aligned the operand of a dcbz instruction is in a page that is write-through or caching-inhibited note that although the mpc603e processor generates an aligment exception for a misaligned little-endian access (msr[le] = 1), the g2 core does not. the register settings for alignment exceptions are shown in table 5-15. the architecture does not support the use of a misaligned ea by lwarx or stwcx. instructions. if one of these instructions specifies a misaligned ea, the exception handler should not emulate the instruction, but should treat the occurrence as a programming error. 5.5.6.1 integer alignment exceptions the g2 core is optimized for load and store operations that are aligned on natural boundaries. operations that are not naturally aligned may suffer performance degradation, table 5-16. alignment interrupt?register settings register setting srr0 set to the effective address of the instruction that caused the exception srr1 0?15 cleared 16?31 loaded from msr[16?31] msr pow 0 tgpr 0 ile ? ee 0 pr 0 fp 0 me ? fe0 0 se 0 be 0 fe1 0 ce ? ip ? ir 0 dr 0 ri 0 le set to value of ile dsisr 0?11 cleared 12?13 cleared. (note that these bits can be set by several 64-bit powerpc instructions that are not supported in the g2 core.) 14 cleared 15?16 for instructions that use register indirect with index addressing?set to bits 29?30 of the instruction for instructions that use register indirect with immediate index addressing?cleared 17 for instructions that use register indirect with index addressing?set to bit 25 of the instruction for instructions that use register indirect with immediate index addressing?set to bit 5 of the instruction 18?21 for instructions that use register indirect with index addressing?set to bits 21?24 of the instruction for instructions that use register indirect with immediate index addressing?set to bits 1?4 of the instruction 22?26 set to bits 6?10 (identifying either the source or destination) of the instruction. undefined for dcbz . 27?31 set to bits 11?15 of the instruction ( r a). set to either bits 11?15 of the instruction or to any register number not in the range of registers loaded by a valid form instruction, for lmw , lswi , and lswx instructions. otherwise undefined. dar set to the ea of the data access as computed by the instruction causing the alignment exception. when the operand of an lmw , stmw , lwarx , or stwcx. instruction is not word-aligned, that address value + 4 is stored into the dar. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-30 g2 powerpc core reference manual motorola exception definitions depending on the type of operation, the boundaries crossed, and the mode that the processor is in during execution. more specifically, these operations may either cause an alignment exception or they may cause the processor to break the memory access into multiple, smaller accesses with respect to the cache and the memory subsystem. the g2 core can initiate an alignment exception for the access shown in table 5-17. in this case, the appropriate range check is performed before the instruction begins execution. as a result, if an alignment exception is taken, it is guaranteed that no portion of the instruction has been executed. a page-address translation access occurs when msr[dr] is set, sr[t] is cleared, and there is not a match in the bat. note the following points: the following is true for all loads and stores except strings/multiples: ? byte operands never cause an alignment exception ? half-word operands can cause an alignment exception if the ea ends in 0xfff ? word operands can cause an alignment exception if the ea ends in 0xffd?fff ? double-word operands cause an alignment exception if the ea ends in 0xff9?fff the dcbz instruction causes an alignment exception if the access is to a page or block with the w (write-through) or i (cache-inhibit) bit set in the tlb or bat, respectively. a misaligned memory access that does not cause an alignment exception will not perform as well as an aligned access of the same type. the resulting performance degradation due to misaligned accesses depends on how well each individual access behaves with respect to the memory hierarchy. at a minimum, additional cache access cycles are required that can delay other processor resources from using the cache. more dramatically, for an access to a noncacheable page, each discrete access involves individual processor bus operations that reduce the effective bandwidth of that bus. finally, note that when the g2 core is in page address translation mode, there is no special handling for accesses that fall into bat regions. 5.5.6.2 load/store multiple alignment exceptions most alignment exceptions store the address as computed by the instruction in the dar. however, when the operand of an lmw , stmw , lwarx , or stwcx. instruction is not word-aligned that address value + 4 is stored into the dar. table 5-17. access types msr[dr] sr[t] access type 1 0 page-address translation access f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-31 exception definitions 5.5.7 program exception (0x00700) the g2 core implements the program exception as it is defined by the powerpc architecture (oea). a program exception occurs when no higher priority exception exists and one or more of the exception conditions defined in the oea occur. when a program exception is taken, instruction execution for the handler begins at offset 0x00700 from the physical base address indicated by msr[ip]. the exception conditions are as follows: floating-point enabled exception?these exceptions correspond to ieee-defined exception conditions, such as overflows, and divide by zeros that may occur during the execution of a floating-point arithmetic instruction. as a group, these exceptions are enabled by the fe0 and fe1 bits in the msr. individual conditions are enabled by specific bits in the fpscr. for general information about this exception, see the programming environments manual . for more information about how these exceptions are implemented in the g2 core, see section 5.5.7.1, ?ieee floating-point exception program exceptions.? illegal instruction?an illegal instruction program exception is generated when execution of an instruction is attempted with an illegal opcode or illegal combination of opcode and extended opcode fields (including powerpc instructions not implemented in the g2 core). these do not include those optional instructions treated as no-ops. privileged instruction?a privileged instruction type program exception is generated when the execution of a privileged instruction is attempted and the msr register user privilege bit, msr[pr], is set. in the g2 core, this exception is generated for mtspr or mfspr with an invalid spr field if spr[0] = 1 and msr[pr] = 1. this may not be true for all processors that implement the powerpc architecture. trap?a trap type program exception is generated when any of the conditions specified in a trap instruction is met. 5.5.7.1 ieee floating-point exception program exceptions floating-point exceptions are signaled by condition bits set in the floating-point status and control register (fpscr). they can cause the system floating-point enabled exception handler to be invoked. the g2 core handles all floating-point exceptions precisely. the g2 core implements the fpscr as it is defined by the powerpc architecture; for more information about the fpscr, see the programming environments manual . floating-point operations that change exception sticky bits in the fpscr may suffer a performance penalty. when an exception is disabled in the fpscr and msr[fe] = 0, updates to the fpscr exception sticky bits are serialized at the completion stage. this serialization may result in a one- or two-cycle execution delay. the penalty is incurred only f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-32 g2 powerpc core reference manual motorola exception definitions when the exception bit is changed and not on subsequent operations with the same exception. see chapter 7, ?instruction timing,? for a full description of completion serialization. when an exception is enabled in the fpscr, the instruction traps to the emulation trap exception vector without updating the fpscr or the target fpr. the emulation trap exception handler is required to complete the instruction. the emulation trap exception handler is invoked regardless of the fe setting in the msr. the two ieee floating-point imprecise modes, defined by the powerpc architecture when msr[fe0] msr[fe1], are treated as precise exceptions (that is, msr[fe0] = msr[fe1] = 1). this is regardless of the setting of msr[ni]. for the highest and most predictable floating-point performance, all exceptions should be disabled in the fpscr and msr. for more information about the program exception, see the programming environments manual . 5.5.7.2 illegal, reserved, and unimplemented instructions program exceptions in accordance with the powerpc architecture, the g2 core considers all instructions defined for 64-bit implementations and unimplemented optional instructions, such as fsqrt , eciwx , and ecowx as illegal and takes a program exception when one of these instructions is encountered. likewise, if a supervisor-level instruction is encountered when the processor is in user-level mode, a privileged instruction-type program exception is taken. 5.5.8 floating-point unavailable exception (0x00800) a floating-point unavailable exception occurs when no higher priority exception exists, an attempt is made to execute a floating-point instruction (including floating-point load, store, and move instructions), and the floating-point available bit in the msr is disabled (msr[fp] = 0). register settings for this exception are described in chapter 6, ?exceptions,? in the programming environments manual when a floating-point unavailable exception is taken, instruction execution for the handler begins at offset 0x00800 from the physical base address indicated by msr[ip]. 5.5.9 decrementer exception (0x00900) the g2 core implements the decrementer interrupt exception as it is defined in the powerpc architecture. a decrementer exception request is made when the decrementer counts down through zero. the request is held until there are no higher priority exceptions and msr[ee] = 1. at this point the decrementer exception is taken. if multiple decrementer exception requests are received before the first can be reported, only one exception is reported. the occurrence of a decrementer exception cancels the request. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-33 exception definitions register settings for this exception are described in chapter 6, ?exceptions,? in the programming environments manual. when a decrementer exception is taken, instruction execution for the handler begins at offset 0x00900 from the physical base address indicated by msr[ip]. 5.5.10 critical interrupt exception (0x00a00)?g2_le only a critical interrupt is signaled to the g2_le core by the assertion of the core_int signal as described in section 8.3.9.2, ?critical interrupt (core_cint )?input: g2_le core-only.? the interrupt may not be recognized if a higher priority exception occurs simultaneously or if the msr[ce] bit is cleared when core_cint is asserted. the following events occur when the g2_le recognizes the assertion of core_cint : multi-cycle instructions not in the completion stage are terminated outstanding load or store instructions that have not been completed are terminated any outstanding page table search activity is terminated the effective address for resuming program execution is saved into csrr0 the contents of msr are saved into csrr1 the msr register is loaded with all zeros except the ip, ile, and me bits which remain unchanged exception processing starts at offset value 0x00a00 from the physical base address indicated by msr[ip] some types of instructions (for example load multiple/string and floating-point instructions) cause additional interrupt recognition latency. timing critical applications must consider these instruction execution latencies in calculating worst-case interrupt recognition latency. upon returning from a critical interrupt handler routine the core restarts any terminated or uncompleted instructions, including terminated load multiple or load string instructions. note that these restarted load instructions may cause side-effects on peripheral devices that have auto-decrementer or status bit changes caused by the subsequent load accesses. the register settings for the critical interrupt are shown in table 5-15. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-34 g2 powerpc core reference manual motorola exception definitions the g2_le core only recognizes the interrupt condition (core_cint asserted) if the msr[ce] bit is set; it ignores the interrupt condition if the msr[ce] bit is cleared. to guarantee that the critical interrupt is taken, the core_cint signal must be held asserted until the g2_le core takes the interrupt. if the core_cint signal is negated before the interrupt is taken, the g2_le core is not guaranteed to take a critical interrupt. the interrupt handler must send a command to the device that asserted core_cint , acknowledging the interrupt and instructing the device to negate core_cint before the handler re-enables recognition of critical interrupts. the additional sprg4?7 registers on the g2_le core can reduce overall latency for critical interrupts, as fewer gprs need to be saved upon entering a critical interrupt handler routine. the g2_le core also implements the rfci instruction for specifically returning from critical interrupt routines and restoring the processor state from csrr0 and csrr1. 5.5.11 system call exception (0x00c00) the g2 core implements the system call exception as it is defined by the powerpc architecture. a system call exception request is made when a system call ( sc ) instruction is completed. if no higher priority exception exists, the system call exception is taken, with srr0 being set to the ea of the instruction following the sc instruction. register settings for this exception are described in chapter 6, ?exceptions,? in the programming environments manual. when a system call exception is taken, instruction execution for the handler begins at offset 0x00c00 from the physical base address indicated by msr[ip]. 5.5.12 trace exception (0x00d00) the trace exception is taken under one of the following conditions: when msr[se] is set, a single-step instruction trace exception is taken when no higher priority exception exists and any instruction (other than rfi , rfci , mtmsr , or isync ) is successfully completed. note that other processors will take the trace table 5-18. critical interrupt?register settings register setting csrr0 set to the effective address of the instruction that the processor would have attempted to execute next if no interrupt conditions were present. csrr1 0?15 cleared 16?31 loaded from msr[16?31] msr pow 0 tgpr 0 ile ? ee 0 pr 0 fp 0 me ? fe0 0 se 0 be 0 fe1 0 ce 0 ip ? ir 0 dr 0 ri 0 le set to value of ile f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-35 exception definitions exception on isync instructions (when msr[se] is set); the g2 core does not take the trace exception on isync instructions. single-step instruction trace mode is described in section 5.5.12.1, ?single-step instruction trace mode.? when msr[be] is set, the branch trace exception is taken after each branch instruction is completed. the g2 core deviates from the architecture by not taking trace exceptions on isync instructions. single-step instruction trace mode is described in section 5.5.12.2, ?branch trace mode.? successful completion implies that the instruction caused no other exceptions. a trace exception is never taken for an sc or trap instruction that takes a trap exception. msr[se] and msr[be] are cleared when the trace exception is taken. in the normal use of this function, msr[se] and msr[be] are restored when the exception handler returns to the interrupted program using an rfi instruction. register settings for the trace mode are described in table 5-19. note that a trace or instruction address breakpoint exception condition generates a soft stop instead of an exception if soft stop has been enabled by the jtag/cop logic. if trace and breakpoint conditions occur simultaneously, the breakpoint conditions receive higher priority. when a trace exception is taken, instruction execution for the handler begins at offset 0x00d00 from the base address indicated by msr[ip]. 5.5.12.1 single-step instruction trace mode the single-step instruction trace mode is enabled by setting msr[se]. encountering the single-step breakpoint causes the following action?trap to address vector 0x00d00. the single-step trace action traps after an instruction execution and completion. table 5-19. trace exception?register settings register setting description srr0 set to the address of the instruction following the one for which the trace exception was generated. srr1 0?15 cleared 16?31 loaded from msr[16?31] msr pow 0 tgpr 0 ile ? ee 0 pr 0 fp 0 me ? fe0 0 se 0 be 0 fe1 0 ce ? ip ? ir 0 dr 0 ri 0 le set to value of ile f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-36 g2 powerpc core reference manual motorola exception definitions 5.5.12.2 branch trace mode the branch trace mode is enabled by setting msr[be]. encountering the branch trace breakpoint causes the following action?trap to interrupt vector 0x00d00. the branch trace action is to trap after the completion of any branch instruction whenever msr[be] is set. 5.5.13 instruction tlb miss exception (0x01000) when the effective address for an instruction load, store, or cache operation cannot be translated by the itlb, an instruction tlb miss exception is generated. register settings for the instruction and data tlb miss exceptions are described in table 5-20. if the instruction tlb miss exception handler fails to find the desired pte, then a page fault must be synthesized. the handler must restore the machine state and clear msr[tgpr] before invoking the isi exception (0x00400). software table search operations are discussed in chapter 6, ?memory management.? when an instruction tlb miss exception is taken, instruction execution for the handler begins at offset 0x01000 from the physical base address indicated by msr[ip]. 5.5.14 data tlb miss on load exception (0x01100) when the effective address for a data load or cache operation cannot be translated by the dtlb, a data tlb miss on load exception is generated. register settings for the instruction and data tlb miss exceptions are described in table 5-20. if a data tlb miss exception handler fails to find the desired pte, then a page fault must be synthesized. the handler must restore the machine state and clear msr[tgpr] before invoking the dsi exception (0x00300). software table search operations are discussed in chapter 6, ?memory management.? when a data tlb miss on load exception is taken, instruction execution for the handler begins at offset 0x01100 from the physical base address indicated by msr[ip]. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-37 exception definitions 5.5.15 data tlb miss on store exception (0x01200) when the effective address for a data store or cache operation cannot be translated by the dtlb, a data tlb miss on store exception is generated. the data tlb miss on store exception is also taken when the changed bit (c = 0) for a dtlb entry needs to be updated for a store operation. register settings for the instruction and data tlb miss exceptions are described in table 5-20. if a data tlb miss exception handler fails to find the desired pte, then a page fault must be synthesized. the handler must restore the machine state and clear msr[tgpr] before invoking the dsi exception (0x00300). software table search operations are discussed in chapter 6, ?memory management.? when a data tlb miss on store exception is taken, instruction execution for the handler begins at offset 0x01200 from the physical base address indicated by msr[ip]. 5.5.16 instruction address breakpoint exception (0x01300) the instruction address breakpoint is controlled by the iabr and iabr2 special purpose register. bits [0?29] of iabr and iabr holds an effective address to which each instruction?s address is compared. the exception is enabled by setting bit 30 in the iabr and iabr2. the exception is taken when an instruction breakpoint address matches on the table 5-20. instruction and data tlb miss exceptions?register settings register setting description srr0 set to the address of the next instruction to be executed in the program for which the tlb miss exception was generated. srr1 0?3 loaded from condition register cr0 field 4?11 cleared 12 key. key for tlb miss (sr[ks] or sr[kp], depending on whether the access is a user or supervisor access). 13 d/i. data or instruction access. 0 = data tlb miss 1 = instruction tlb miss 14 way. next tlb set to be replaced (set per lru). 0 = replace tlb associativity set 0 1 = replace tlb associativity set 1 15 s/l. store or load data access. 0 = data tlb miss on load 1 = data tlb miss on store (or c = 0) 16?31 loaded from msr[16?31] msr pow 0 tgpr 1 ile ? ee 0 pr 0 fp 0 me ? fe0 0 se 0 be 0 fe1 0 ce ? ip ? ir 0 dr 0 ri 0 le set to value of ile f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-38 g2 powerpc core reference manual motorola exception definitions next instruction to complete. the instruction tagged with the match is not completed before the instruction address breakpoint exception is taken. the breakpoint action can be trapped to interrupt vector 0x01300 (default). note that the g2_le core also has a second instruction address breakpoint register, iabr2, that functions identically to iabr, and allows for two instruction breakpoints to be enabled. the bit settings for when an instruction address breakpoint exception is taken are shown in table 5-21. the default breakpoint action is to trap before the execution of the matching instruction. table 5-22 shows the priority of actions taken when more than one mode is enabled for the same instruction. note that a trace or instruction address breakpoint exception condition generates a soft stop instead of an exception if soft stop has been enabled by the jtag/cop logic. if trace and breakpoint conditions occur simultaneously, the breakpoint conditions receive higher priority. the g2 core requires that an mtspr instruction that updates the iabr be followed by a context-synchronizing instruction. if the mtspr instruction enables the instruction address breakpoint exception, the context-synchronizing instruction cannot generate a breakpoint response. the g2 core also cannot block a breakpoint response on the context-synchronizing instruction if the breakpoint was disabled by the mtspr instruction. see ?synchronization requirements for special registers and tlbs? in chapter 2, ?register set,? in the programming environments manual , for more information on this requirement. table 5-21. instruction address breakpoint exception?register settings register setting description srr0 set to the address of the next instruction to be executed in the program for which the tlb miss exception was generated. srr1 0?15 cleared 16?31 loaded from msr[16?31] msr pow 0 tgpr 0 ile ? ee 0 pr 0 fp 0 me ? fe0 0 se 0 be 0 fe1 0 ce ? ip ? ir 0 dr 0 ri 0 le set to value of ile f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 5. exceptions 5-39 exception definitions section 2.1.2.14, ?instruction address breakpoint registers (iabr and iabr2),? and chapter 11, ?debug features,? provide more information about the instruction breakpoint facility. 5.5.17 system management interrupt (0x01400) the system management interrupt behaves like an external interrupt except for the signal asserted and the vector taken. a system management interrupt is signaled to the g2 core by the assertion of the core_smi signal. the interrupt may not be recognized if a higher priority exception occurs simultaneously or if msr[ee] is cleared when core_smi is asserted. note that core_smi takes priority over core_int if they are recognized simultaneously. after the core_smi is detected (and provided that msr[ee] is set), the g2 core generates a recoverable halt to instruction completion. the g2 core requires the next instruction in program order to complete or except, block completion of any following instructions, and allow the completed store queue to drain (see section 7.1, ?terminology and conventions,? for the definition). if any higher priority exceptions are encountered in this process, they are taken first and the system management interrupt is delayed until a recoverable halt is achieved. at this time the g2 core saves state information and takes the system management interrupt. the register settings for the external interrupt exception are shown in table 5-23. table 5-22. breakpoint action for multiple modes enabled for the same address iabr[ie] msr[be] msr[se] first action next action comments 1 1 0 instruction address breakpoint trace (branch) enabling both modes is useful only if both trace and address breakpoint interrupts are needed. 1 0 1 instruction address breakpoint trace (single-step) enabling both modes is useful only if different breakpoint actions are required. 0 1 1 trace (branch) none the action for branch trace and single-step trace is the same. enabling both trace modes is redundant except for hard stop on branches. 1 1 1 instruction address breakpoint trace enabling all modes is redundant. this entry is for clarification only. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 5-40 g2 powerpc core reference manual motorola exception definitions when a system management interrupt is taken, instruction execution for the handler begins at offset 0x01400 from the physical base address indicated by msr[ip]. the g2 core recognizes the interrupt condition (core_smi asserted) only if the msr[ee] bit is set; otherwise, the interrupt condition is ignored. to guarantee that the external interrupt is taken, the core_smi signal must be held active until the g2 core takes the interrupt. if the core_smi signal is negated before the interrupt is taken, the g2 core is not guaranteed to take a system management interrupt. the interrupt handler must send a command to the device that asserted core_smi , acknowledging the interrupt and instructing the device to negate core_smi . table 5-23. system management interrupt?register settings register setting description srr0 set to the effective address of the instruction that the processor would have attempted to complete next if no interrupt conditions were present. srr1 0?15 cleared 16?31 loaded from msr[16?31] msr pow 0 tgpr 0 ile ? ee 0 pr 0 fp 0 me ? fe0 0 se 0 be 0 fe1 0 ce ? ip ? ir 0 dr 0 ri 0 le set to value of ile f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-1 chapter 6 memory management this chapter describes the g2 core implementation of the memory management unit (mmu) specifications provided by the powerpc operating environment architecture (oea). the mmu implementation of the g2 core is the same as that of the mpc603e microprocessor. however, the g2_le core implements four additional ibat entries and four additional dbat entries. the primary function of the mmu in a processor of this family is the translation of logical (effective) addresses to physical addresses (referred to as real addresses in the architecture specification) for memory accesses, and i/o accesses (i/o accesses are assumed to be memory-mapped). in addition, the mmu provides access protection on a segment, block, or page basis. this chapter describes the specific hardware used to implement the mmu model of the oea in the core. refer to chapter 7, ?memory management,? in the programming environments manual for a complete description of the conceptual model. two general types of accesses generated by processors that implement the powerpc architecture require address translation?instruction accesses, and data accesses to memory generated by load and store instructions. generally, the address translation mechanism is defined in terms of segment descriptors and page tables defined by the powerpc architecture for locating the effective-to-physical address mapping for instruction and data accesses. the segment information translates the effective address to an interim virtual address and the page table information translates the virtual address to a physical address. the segment descriptors, used to generate the interim virtual addresses, are stored as on-chip segment registers on 32-bit implementations (such as the g2 core). in addition, two translation lookaside buffers (tlbs) are implemented on the core to keep recently-used page address translations on-chip. although the oea describes one mmu (conceptually), the g2 core hardware maintains separate tlbs and table search resources for instruction and data accesses that can be accessed independently (and simultaneously). therefore, the core is described as having two mmus, one for instruction accesses (immu) and one for data accesses (dmmu). the block address translation (bat) mechanism is a software-controlled array that stores the available block address translations on-chip. bat array entries are implemented as pairs of bat registers that are accessible as supervisor-level special-purpose registers f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-2 g2 powerpc core reference manual motorola mmu features (sprs). there are separate instruction and data bat mechanisms, and in the g2 core, they reside in the instruction and data mmus, respectively. the mmus, together with the exception processing mechanism, provide the necessary support for the operating system to implement a paged virtual memory environment and for enforcing protection of designated memory areas. exception processing is described in chapter 5, ?exceptions.? section 5.2, ?exception processing,? describes the msr which controls some of the critical functionality of the mmus. 6.1 mmu features the g2 core completely implements all features required by the memory management specification of the oea for 32-bit implementations. thus, it provides 4 gbytes of effective address space accessible to supervisor and user programs with a 4-kbyte page size and 256-mbyte segment size. in addition, the mmus of 32-bit processors use an interim virtual address (52 bits) and hashed page tables in the generation of 32-bit physical addresses. these processors also have a bat mechanism for mapping large blocks of memory. block sizes range from 128 kbytes to 256 mbytes and are software-programmable. table 6-1 summarizes all g2 core mmu features including the architectural features of powerpc mmus (defined by the oea) for 32-bit processors and the implementation-specific features provided by the core. table 6-1. mmu features summary feature category architecturally defined/ g2 core-specific feature address ranges architecturally defined 2 32 bytes of effective address 2 52 bytes of virtual address 2 32 bytes of physical address page size architecturally defined 4 kbytes segment size architecturally defined 256 mbytes block address translation architecturally defined range of 128 kbytes?256 mbytes sizes implemented with ibat and dbat registers in bat array memory protection architecturally defined segments selectable as no-execute pages selectable as user/supervisor and read-only blocks selectable as user/supervisor and read-only page history architecturally defined referenced and changed bits defined and maintained page address translation architecturally defined translations stored as ptes in hashed page tables in memory page table size determined by mask in sdr1 register f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-3 mmu features 6.1.1 memory addressing a program references memory using the effective (logical) address computed by the processor when it executes a load, store, or cache instruction, and when it fetches the next instruction. the effective address is translated to a physical address according to the procedures described in chapter 7, ?memory management,? in the programming environments manual , augmented with information in this chapter. the memory subsystem uses the physical address for the access. for a complete discussion of effective address calculation, see section 3.2.2.3, ?effective address calculation.? 6.1.2 mmu organization figure 6-1 shows the conceptual organization of a powerpc mmu in a 32-bit implementation; note that it does not describe the specific hardware used to implement the memory management function for a particular processor. processors may optionally implement on-chip tlbs and may optionally support the automatic search of the page tables for ptes. in addition, other hardware features (invisible to the system software) not depicted in the figure may be implemented. figure 6-2 and figure 6-3 show the conceptual organization of the g2 core instruction and data mmus, respectively. the instruction addresses shown in figure 6-2 are generated by the processor for sequential instruction fetches and addresses that correspond to a change tlbs architecturally defined instructions for maintaining optional tlbs ( tlbie instruction in g2 core) g2 core-specific 64-entry (32-entry byway), two-way set-associative itlb 64-entry(32-entry byway), two-way set-associative dtlb segment descriptors architecturally defined stored as segment registers on-chip page table search support g2 core-specific three mmu exceptions defined: itlb miss exception, dtlb miss on load exception, and dtlb miss on store (or c = 0) exception; mmu-related bits set in srr1 for these exceptions. imiss and dmiss registers (missed effective address) hash1 and hash2 registers (pteg addr) icmp and dcmp registers (for comparing ptes) rpa register (for loading tlbs) tlbli r b instruction for loading itlb entries tlbld r b instruction for loading dtlb entries shadow registers for gpr0?gpr3 (can use r0 ? r3 in table search handler without corruption of r0 ? r3 in context that was previously executing), called tgpr0?tgpr3. table 6-1. mmu features summary (continued) feature category architecturally defined/ g2 core-specific feature f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-4 g2 powerpc core reference manual motorola mmu features of program flow. data addresses shown in figure 6-3 are generated by load and store instructions and by cache instructions. as shown in the figures, after an address is generated, the higher-order bits of the effective address, ea0?ea19 (or a smaller set of address bits, ea0?ea n , in the cases of blocks), are translated into physical address bits pa0?pa19. the lower-order address bits, a20?a31, are untranslated and, therefore, identical for both effective and physical addresses. after translating the address, the mmus pass the resulting 32-bit physical address to the memory subsystem. in addition to the higher-order address bits, the mmus automatically keep an indicator of whether each access was generated as an instruction or data access and a supervisor/user indicator that reflects the state of the pr bit of the msr when the effective address was generated. in addition, for data accesses, there is an indicator of whether the access is for a load or a store operation. this information is then used by the mmus to appropriately direct the address translation and to enforce the protection hierarchy programmed by the operating system. section 5.2, ?exception processing,? describes the msr, which controls some of the critical functionality of the mmus. the figures show how the a20?a26 address bits index into the on-chip instruction and data caches to select a cache set. the remaining physical address bits are then compared with the tag fields (comprised of bits pa0?pa19) of the four selected cache blocks to determine if a cache hit has occurred. in the case of a cache miss, the instruction or data access is then forwarded to the bus interface unit which then initiates a 60x bus access to the memory subsystem. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-5 mmu features figure 6-1. mmu conceptual block diagram?32-bit implementations mmu (32-bit) a20?a31 x ea0?ea19 ea0?ea19 ea0?ea3 0 15 pa0?pa31 ea0?ea14 ea4?ea19 on-chip tlbs (optional) page table search logic (optional) instruction accesses a20?a31 spr25 sdr1 + x pa15?pa19 + x x ea15-ea19 upper 24 bits of virtual address ea15?ea19 pa0?pa19 bat hit optional pa0?pa14 ibat0u ibat3l ibat0l ibat3u dbat0u dbat3l dbat0l dbat3u ea0-ea14 segment registers data accesses f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-6 g2 powerpc core reference manual motorola mmu features figure 6-2. g2 core immu block diagram compare immu a20?a26 pa0?pa31 instruction unit spr978 hash1 bpu itlb 0 15 select ea0?ea19 rpa hash2 spr979 spr982 ibat array spr980 imiss icmp spr981 x + 0 31 0 127 tags pa0?pa19 compare i cache hit/miss select ea0?ea14 ea0?ea19 a20?a31 pa0?pa19 sdr1 spr25 i cache ea4?ea19 segment registers ea0?ea3 ibat0u ibat3l ibat0l ibat3u ibat4u ibat7l ibat4l ibat7u g2_le only see figure 6-7 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-7 mmu features figure 6-3. g2 core dmmu block diagram dmmu pa0?pa31 spr978 hash1 dtlb 0 15 ea0?ea3 select ea0?ea19 rpa hash2 spr979 spr982 dbat array spr976 dmiss dcmp spr977 x + 0 31 ea0?ea19 a20?a26 0 127 d cache hit/miss select pa0?pa19 d cache spr25 sdr1 ea0?ea14 ea4?ea19 a20?a31 ta g s pa0?pa19 compare compare dbat0u dbat3l dbat0l dbat3u segment registers load/store unit g2_le_only dbat4u dbat7l dbat4l dbat7u see figure 6-7 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-8 g2 powerpc core reference manual motorola mmu features 6.1.3 address translation mechanisms processors that implement the powerpc architecture support the following four types of address translation: page address translation?translates the page frame address for a 4-kbyte page size. block address translation?translates the block number for blocks that range in size from 128 kbytes to 256 mbytes. direct-store interface address translation?used to generate direct-store interface accesses on the external bus; not implemented in the g2 core. real addressing mode translation?when address translation is disabled, the physical address is identical to the effective address. figure 6-4 shows the three implemented address translation mechanisms provided by the mmus. the segment descriptors shown in the figure, control the page address translation mechanism. when an access uses page address translation, the appropriate segment descriptor is required. in 32-bit implementations, one of the 16 on-chip segment registers (which contain segment descriptors) is selected by the 4 highest-order effective address bits. a control bit in the corresponding segment descriptor then determines if the access is to memory (memory-mapped) or to the direct-store interface space (selected when the direct-store translation control bit (t bit) in the corresponding segment descriptor is set). note that the direct-store interface existed in previous processors only for compatibility with i/o devices that use this interface. when an access is determined to be to the direct-store interface space, the g2 core takes a dsi exception as described in section 5.5.3, ?dsi exception (0x00300),? if it is a data access. the g2 core takes an isi exception as described in section 5.5.4, ?isi exception (0x00400),? if it is an instruction access. for memory accesses translated by a segment descriptor, the interim virtual address is generated using the information in the segment descriptor. page address translation corresponds to the conversion of this virtual address into the 32-bit physical address used by the memory subsystem. in most cases, the physical address for the page resides in an on-chip tlb and is available for quick access. however, if the page address translation misses in an on-chip tlb, the mmu causes a search of the page tables in memory (using the virtual address information and a hashing function) to locate the required physical address. when this occurs, the g2 core vectors to the exception handlers that search the page tables with software. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-9 mmu features figure 6-4. address translation types block address translation occurs in parallel with page address translation and is similar to page address translation; however, fewer higher-order effective address bits are translated into physical address bits (more lower-order address bits (at least 17) are untranslated to form the offset into a block). also, instead of segment descriptors and a tlb, block address translations use the on-chip bat registers as a bat array. if an effective address matches the corresponding field of a bat register, the information in the bat register is used to generate the physical address; in this case, the results of the page translation (occurring in parallel) are ignored (even if the segment corresponds to the direct-store interface space). real addressing mode translation occurs when address translation is disabled; in this case, the physical address generated is identical to the effective address. instruction and data address translation is enabled with the msr[ir] and msr[dr] bits, respectively. thus, when the processor generates an access, and the corresponding address translation enable (t = 1) (t = 0) 031 effective address 051 virtual address segment descriptor located match with bat registers 031 physical address 031 physical address 031 physical address look up in page table address translation disabled page address translation direct-store interface translation (msr[ir] = 0 or msr[dr] = 0) real addressing mode effective address = physical address (see section 6.2, ?real addressing mode?) block address translation (see section 6.3, ?block address translation?) dsi/isi exception f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-10 g2 powerpc core reference manual motorola mmu features bit in msr is cleared (msr[ir] for instruction accesses and msr[dr] for data accesses), the resulting physical address is identical to the effective address and all other translation mechanisms are ignored. 6.1.4 memory protection facilities in addition to the translation of effective addresses to physical addresses, the mmus provide access protection of supervisor areas from user access and can designate areas of memory as read-only, as well as, no-execute or guarded. table 6-2 shows the eight protection options supported by the mmus for pages. the operating system programs whether instructions can be fetched from an area of memory by appropriately using the no-execute option provided in the segment descriptor. each of the remaining options is enforced, based on a combination of information in the segment descriptor and the page table entry. thus, the supervisor-only option allows only read and write operations generated while the processor is operating in supervisor mode (corresponding to msr[pr] = 0) to access the page. user accesses that map into a supervisor-only page cause an exception to be taken. finally, there is a facility in the vea and oea that allows pages or blocks to be designated as guarded, preventing out-of order accesses that may cause undesired side effects. for example, areas of the memory map that are used to control i/o devices can be marked as guarded so that accesses (for example, instruction prefetches) do not occur unless they are explicitly required by the program. for more information on memory protection, see ?memory protection facilities? in chapter 7, ?memory management,? in the the programming environments manual . table 6-2. access protection options for pages option user read user write supervisor read supervisor write i-fetch data i-fetch data supervisor-only ? ? ? ? supervisor-only-no-execute ???? ? supervisor-write-only ? ? ? supervisor-write-only-no-execute ? ?? ? both user/supervisor ???? both user/supervisor-no-execute ? ? ? ? both read-only ? ? ? ? both read-only-no-execute ? ?? ? note: access permitted. ? protection violation. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-11 mmu features 6.1.5 page history information the mmus of these processors also define referenced (r) and changed (c) bits in the page address translation mechanism that can be used as history information relevant to the page. this information can then be used by the operating system to determine the areas of memory to write back to disk when new pages must be allocated in main memory. while these bits are initially programmed by the operating system into the page table, the architecture specifies that the r and c bits may be maintained either by the processor hardware (automatically) or by some software-assist mechanism that updates these bits when required as needed by the g2 core. the software table search routines used by the g2 core set the r bit when a pte is accessed; the core causes an exception (to vector to the software table search routines) when the c bit in the corresponding tlb entry requires updating. see section 6.4.1.3, ?scenarios for referenced and changed bit recording,? for more details. 6.1.6 general flow of mmu address translation the following sections describe the general flow used by processors that implement the powerpc architecture to translate effective addresses to virtual and then physical addresses. 6.1.6.1 real addressing mode and block address translation selection when an instruction or data access is generated and the corresponding instruction or data translation is disabled (msr[ir] = 0 or msr[dr] = 0), real addressing mode translation is used (physical address equals effective address) and the access continues to the memory subsystem as described in section 6.2, ?real addressing mode.? figure 6-5 shows the flow used by the mmus in determining whether to select real addressing mode, block address translation, or to use the segment descriptor to select page address translation. note that if the bat array search results in a hit, the access is qualified with the appropriate protection bits. if the access violates the protection mechanism, an exception (isi or dsi exception) is generated. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-12 g2 powerpc core reference manual motorola mmu features figure 6-5. general flow of address translation (real addressing mode and block) 6.1.6.2 page address translation selection if address translation is enabled (real addressing mode not selected) and the effective address information does not match with a bat array entry, then the segment descriptor must be located. once the segment descriptor is located, the t bit in the segment descriptor selects whether the translation is to a page or to a direct-store interface segment, as shown in figure 6-6. note that the g2 core does not implement the direct-store interface, and accesses to these segments cause a dsi exception. in addition, figure 6-6 also shows the way the no-execute protection is enforced; if the n bit in the segment descriptor is set and the access is an instruction fetch, the access is faulted as described in chapter 7, ?memory management,? in the programming environments manual . note that the figure shows the flow for these cases as described by the oea and, therefore, the tlb references are shown as optional. since the core implements tlbs, these branches are valid, and described in more detail throughout this chapter. perform address translation with segment descriptor access faulted compare address with instruction or data bat array (as appropriate) translate address perform real addressing mode translation effective address generated continue access to memory subsystem instruction translation enabled (msr[ir] =1) data translation enabled (msr[dr] = 1) (see figure 6-6) instruction translation disabled (msr[ir] = 0) data translation disabled (msr[dr] = 0) bat array hit i-access access protected access permitted perform real addressing mode translation (see the programming environments manual ) bat array miss d-access f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-13 mmu features figure 6-6. general flow of page and direct-store interface address translation access faulted access faulted continue access to memory subsystem translate address *in the case of instruction accesses, causes isi exception. load tlb entry tlb miss address translation with segment descriptor (see figure 6-8) (see figure 6-9) otherwise check t bit in segment descriptor use ea0?ea3 to select 1 of 16 on-chip segment registers pte not found pte found access protected access permitted optional to the powerpc architecture. implemented in the mpc603e. compare virtual address with tlb entries generate 52-bit virtual address from segment descriptor dsi/isi exception perform page table search operation tlb hit i-fetch with n-bit set in segment descriptor (no-execute) direct-store segment address (t = 1)* page address translation (t = 0) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-14 g2 powerpc core reference manual motorola mmu features if the t bit in the corresponding segment descriptor is zero, page address translation is selected. the information in the segment descriptor is then used to generate the 52-bit virtual address. the virtual address is then used to identify the page address translation information (stored as page table entries (ptes) in a page table in memory). for increased performance, the core has two tlbs to store recently-used ptes on-chip. if an access hits in the appropriate tlb, the page translation occurs and the physical address bits are forwarded to the memory subsystem. if the required pte is not resident, the mmu requires a search of the page table. in this case, the core traps to one of three exception handlers for the system software to perform the page table search. if the pte is successfully matched, a new tlb entry is created and the page translation is once again attempted. this time, the tlb is guaranteed to hit. once the pte is located, the access is qualified with the appropriate protection bits. if the access is a protection violation (not allowed), an exception (instruction access or data access) is generated. if the pte is not found by the table search operation, a page fault condition exists, and the tlb miss exception handlers synthesize either an isi or dsi exception to handle the page fault. 6.1.7 mmu exceptions summary in order to complete any memory access, the effective address must be translated to a physical address. in the g2 core, an mmu exception condition occurs if this translation fails for one of the following reasons: page fault?there is no valid page table entry to identify the page specified by the effective address (and segment descriptor) and there is no valid bat translation. an address translation is found but the access is not allowed by the memory protection mechanism. additionally, because the core relies on software to perform table search operations, the processor also takes an exception when: there is a miss in the corresponding (instruction or data) tlb. the page table requires an update to the changed (c) bit. the state saved by the processor for each of these exceptions contains information that identifies the address of the failing instruction. refer to chapter 5, ?exceptions,? for a more detailed description of exception processing. because a page fault condition (pte not found in the page tables in memory) is detected by the software that performs the table search operation (and not the core hardware), it does not cause a g2 core exception, in the strictest sense, in that exception processing as described in chapter 5, ?exceptions,? does not occur. however, in order to maintain architectural compatibility with software written for other devices that implement the powerpc architecture, the software that detects this condition should synthesize an f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-15 mmu features exception by setting the appropriate bits in the dsisr or srr1 and branching to the isi or dsi exception handler. refer to section 6.5.2, ?implementation-specific table search operation,? for more information and examples of this exception software. the remainder of this chapter assumes that the table search software emulates this exception and refers to this condition as an exception. the translation exception conditions defined by the oea for 32-bit implementations cause either the isi or the dsi exception to be taken as shown in table 6-3. in addition to the translation exceptions, there are other mmu-related conditions (some of them defined as implementation-specific and, therefore, not required by the architecture) that can cause an exception to occur in the g2 core. these exception conditions map to the processor exception as shown in table 6-4. for example, the g2 core also defines three exception conditions to support software table searching. the only exception conditions that occur when msr[dr] = 0, are the conditions that cause the alignment exception for table 6-3. translation exception conditions condition description exception page fault (no pte found) no matching pte found in page tables (and no matching bat array entry) i access: isi exception 1 srr1[1] = 1 1 the g2 core hardware does not vector to these exceptions automatically. it is assumed that the software that performs the table search operation vectors to these exceptions and sets the appropriate bits when a page fault condition occurs. d access: dsi exception 1 dsisr[1] =1 block protection violation conditions described for block in ?block memory protection? in chapter 7, ?memory management,? in the programming environments manual. ? i access: isi exception srr1[4] = 1 d access: dsi exception dsisr[4] =1 page protection violation conditions described for page in ?page memory protection? in chapter 7, ?memory management,? in the programming environments manual. i access: isi exception 2 srr1[4] = 1 2 the table search software can also vector to these exception conditions. d access: dsi exception 2 dsisr[4] =1 no-execute protection violation attempt to fetch instruction when sr[n] = 1 isi exception srr1[3] = 1 instruction fetch from direct-store segment attempt to fetch instruction when sr[t] = 1 isi exception srr1[3] =1 data access to direct-store segment (including floating-point accesses) note : this is a g2 core-specific condition attempt to perform load or store (including floating-point load or store) when sr[t] = 1 dsi exception dsisr[5] =1 instruction fetch from guarded memory with msr[ir] = 1 attempt to fetch instruction when msr[ir] = 1 and either matching xbat[g] = 1, or no matching bat entry and pte[g] = 1. isi exception srr1[3] =1 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-16 g2 powerpc core reference manual motorola mmu features data accesses. for more detailed information about the conditions that cause the alignment exception (in particular for string/multiple instructions), see section 5.5.6, ?alignment exception (0x00600).? n note that some exception conditions depend on whether the memory area is set up as write-though (w = 1) or cache-inhibited (i = 1). these bits are described fully in ?memory/ cache access attributes? in chapter 5, ?cache model and memory coherency,? in the programming environments manual. refer to chapter 5, ?exceptions,? and to chapter 6, ?exceptions,? in the programming environments manual for a complete description of the srr1 and dsisr bit settings for these exceptions. table 6-4. other mmu exception conditions condition description exception tlb miss for an instruction fetch no matching entry found in itlb instruction tlb miss exception srr1[13] = 1 msr[14] = 1 tlb miss for a data load access no matching entry found in dtlb for data load access data tlb miss on load exception srr1[13] = 0 srr1[15] = 1 msr[14] = 1 tlb miss for a data store, or store and c = 0 no matching entry found in dtlb for data store access or matching dltb entry has c = 0 and the access is a store data tlb miss on store exception, or store and c = 0 srr1[13] = 0 srr1[15] =0 msr[14] = 1 dcbz with w = 1 or i = 1 dcbz instruction to write-through or cache-inhibited segment or block alignment exception (not required by architecture for this condition) dcbz when the data cache is locked the dcbz instruction takes an alignment exception if the data cache is locked (hid0 bits 18 and 19) when it is executed alignment exception lwarx , stwcx. , eciwx , or ecowx instruction to direct-store segment reservation instruction or external control instruction when sr[t] =1 dsi exception dsisr[5] = 1 floating-point load or store to direct-store segment fp memory access when sr[t] = 1 see data access to direct-store segment in table 6-3 load or store that results in a direct-store error does not occur in g2 core does not apply eciwx or ecowx attempted when external control facility disabled eciwx or ecowx attempted with ear[e] = 0 dsi exception dsisr[11] = 1 lmw , stmw , lswi , lswx , stswi , or stswx instruction attempted in little-endian mode lmw , stmw , lswi , lswx , stswi , or stswx instruction attempted while msr[le] = 1. alignment exception operand misalignment translation enabled and operand is misaligned as described in chapter 5, ?exceptions.? alignment exception (some of these cases are implementation-specific) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-17 mmu features 6.1.8 mmu instructions and register summary the mmu instructions and registers provide the operating system with the ability to set up the block address translation areas and the page tables in memory. note that because the implementation of tlbs is optional, the instructions that refer to these structures are also optional. however, because these structures serve as caches of the page table, the architecture specifies a software protocol for maintaining coherency between these caches and the tables in memory whenever changes are made to the tables in memory. when the tables in memory are changed, the operating system purges these caches of the corresponding entries, allowing the translation caching mechanism to refetch from the tables when the corresponding entries are required. note that the g2 core implements all tlb-related instructions except tlbia , which is treated as an illegal instruction. the g2 core also uses some implementation-specific instructions to load two on-chip tlbs. because the mmu specification for these processors is so flexible, it is recommended that the software that uses these instructions and registers be encapsulated into subroutines to minimize the impact of migrating across the family of implementations. table 6-5 summarizes g2 core instructions that specifically control the mmu. for more detailed information about the instructions, refer to chapter 3, ?instruction set model,? in this book and chapter 8, ?instruction set,? in the programming environments manual. table 6-5. instruction summary?mmu control instruction description mtsr sr ,r s move to segment register sr[sr#] r s mtsrin r s ,r b move to segment register indirect sr[ r b[0?3]] r s mfsr r d , sr move from segment register r d sr[sr#] mfsrin r d ,r b move from segment register indirect r d sr[ r b[0?3]] tlbie r b 1 tlb invalidate entry for effective address specified by r b, tlb[v] 0 the tlbie instruction invalidates both tlb entries indexed by the ea, and operates on both the instruction and data tlbs simultaneously invalidating four tlb entries. the index corresponds to bits 15?19 of the ea. software must ensure that instruction fetches or memory references to the virtual pages specified by the tlbie instruction have been completed prior to executing the tlbie instruction. tlbsync 1 tlb synchronize synchronizes the execution of all other tlbie instructions in the system. in the g2 core, when the core_tlbisync signal is negated, instruction execution may continue or resume after the completion of a tlbsync instruction. when the core_tlbisync signal is asserted, instruction execution stops after the completion of a tlbsync instruction. for a complete description of the core_tlbisync signal, refer to section 8.3.11.5, ?tlbi sync (core_tlbisync )?input.? f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-18 g2 powerpc core reference manual motorola mmu features table 6-6 summarizes the registers that the operating system uses to program the g2 core mmus. these registers are accessible to supervisor-level software only. these registers are described in chapter 2, ?register set,? in the programming environments manual. for g2 core-specific registers, see chapter 2, ?register model,? of this book. tlbli (implementation -specific) load instruction tlb entry loads the contents of the icmp and rpa registers into the itlb. tlbld (implementation -specific) load data tlb entry loads the contents of the dcmp and rpa registers into the dtlb. 1 these instructions are defined by the powerpc architecture, but are optional. table 6-6. mmu registers register description segment registers (sr0?sr15) the sixteen 32-bit segment registers are present only in 32-bit implementations of the powerpc architecture. the fields in the segment register are interpreted differently depending on the value of bit 0. the segment registers are accessed by the mtsr , mtsrin , mfsr , and mfsrin instructions. bat registers g2 core: (ibat0u?ibat3u, ibat0l?ibat3l, dbat0u?dbat3u, and dbat0l?dbat3l) g2_le core: (ibat0u?ibat7u, ibat0l?ibat7l, dbat0u?dbat7u, and dbat0l?dbat7l) the g2 core has 16 bat registers, organized as 4 pairs of instruction bat registers (ibat0u?ibat3u paired with ibat0l?ibat3l) and 4 pairs of data bat registers (dbat0u?dbat3u paired with dbat0l?dbat3l). the g2_le core has 32 bat registers, organized as 8 pairs of instruction bat registers (ibat0u?ibat7u paired with ibat0l?ibat7l) and 8 pairs of data bat registers (dbat0u?dbat7u paired with dbat0l?dbat7l). the bat registers are defined as 32-bit registers in 32-bit implementations. these are special-purpose registers that are accessed by the mtspr and mfspr instructions, regardless of the setting of hid2[13]. sdr1 the sdr1 register specifies the variable used in accessing the page tables in memory. sdr1 is defined as a 32-bit register for 32-bit implementations. this is a special-purpose register that is accessed by the mtspr and mfspr instructions. instruction tlb miss address and data tlb miss address registers (imiss and dmiss) when a tlb miss exception occurs, the imiss or dmiss register contains the 32-bit effective address of the instruction or data access, respectively, that caused the miss. note that the g2 core always loads a big-endian address into the dmiss register. these registers are implementation-specific. primary and secondary hash address registers (hash1 and hash2) the hash1 and hash2 registers contain the primary and secondary pteg addresses that correspond to the address causing a tlb miss. these pteg addresses are automatically derived by the core by performing the primary and secondary hashing function on the contents of imiss or dmiss, for an itlb or dtlb miss exception, respectively. these registers are implementation-specific. table 6-5. instruction summary?mmu control (continued) instruction description f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-19 real addressing mode note that the g2 core contains other features that do not specifically control the mmu, but are implemented to increase performance and flexibility. these are: complete set of shadow segment registers for the instruction mmu. these registers are invisible to the programming model, as described in section 6.4.3, ?tlb description.? temporary gpr0?gpr3. these registers are available as r0 ? r3 when msr[tgpr] is set. the core automatically sets msr[tgpr] whenever one of the three tlb miss exceptions occurs, allowing these exception handlers to have four registers that are used as scratchpad space, without having to save or restore this part of the machine state that existed when the exception occurred. note that msr[tgpr] is restored to the value in srr1 when the rfi instruction is executed. refer to section 6.5.2, ?implementation-specific table search operation,? for code examples that take advantage of these registers. in addition, the g2 core also automatically saves the values of cr[cr0] of the executing context to srr1[0?3] whenever one of the three tlb miss exceptions occurs. thus, the exception handler can set cr[cr0] bits and branch accordingly in the exception handler routine, without having to save the existing cr[cr0] bits. however, the exception handler must restore these bits to cr[cr0] before executing the rfi instruction. there are also four other bits saved in srr1 whenever a tlb miss exception occurs that give information about whether the access was an instruction or data access; and if it was a data access, whether it was for a load or a store instruction. also, these bits give some information related to the protection attributes for the access, and which set in the tlb will be replaced when the next tlb entry is loaded. refer to section 6.5.2.1, ?resources for table search operations,? for more information on these bits and their use. 6.2 real addressing mode if address translation is disabled (msr[ir] = 0 or msr[dr] = 0) for a particular access, the effective address is treated as the physical address and is passed directly to the memory instruction and data pte compare registers (icmp and dcmp) the icmp and dcmp registers contain the word to be compared with the first word of a pte in the table search software routine to determine if a pte contains the address translation for the instruction or data access. the contents of icmp and dcmp are automatically derived by the core when a tlb miss exception occurs. these registers are implementation-specific. required physical address register (rpa) the system software loads a tlb entry by loading the second word of the matching pte entry into the rpa register and then executing the tlbli or tlbld instruction (for loading the itlb or dtlb, respectively). this register is implementation-specific. table 6-6. mmu registers (continued) register description f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-20 g2 powerpc core reference manual motorola block address translation subsystem as described in chapter 7, ?memory management,? in the programming environments manual . note that the default wimg bits (0b0011) cause data accesses to be considered cacheable (i = 0) and, thus, load and store accesses are weakly ordered. this is the case, even if the data cache is disabled in the hid0 register (as it is out of hard reset). if i/o devices require load and store accesses to occur in strict program order (strongly ordered), translation must be enabled so that the corresponding i bit can be set. also, for instruction accesses, the default memory access mode bits (wimg) are 0b0001. that is, instruction accesses are considered cacheable (i = 0), and the memory is guarded. again, instruction cache accesses are considered cacheable even if the instruction cache is disabled in the hid0 register (as it is out of hard reset). the w and m bits have no effect on the instruction cache. for information on the synchronization requirements for changes to msr[ir] and msr[dr], refer to ?synchronization requirements for special registers and for lookaside buffers? in chapter 2, ?register set,? in the programming environments manual. 6.3 block address translation the block address translation (bat) mechanism in the oea provides a way to map ranges of effective addresses larger than a single page into contiguous areas of physical memory. such areas can be used for data that is not subject to normal virtual memory handling (paging), such as a memory-mapped display buffer or an extremely large array of numerical data. the software model for block address translation in the g2 core is described in chapter 7, ?memory management,? in the programming environments manual for 32-bit implementations. however, note that for improved performance, the g2_le core contains twice as many bat registers as the g2 core, as shown in figure 6-2 and figure 6-3. implementation note? the bat registers are not initialized by the hardware after the power-up or reset sequence. consequently, all valid bits in both instruction and data bat areas must be explicitly cleared before setting any bat area for the first time and before enabling translation. also, note that software must avoid overlapping blocks while updating a bat area or areas. even if translation is disabled, multiple bat area hits (with the valid bits set) can corrupt the remaining portion (any bits except the valid bits) of the bat registers. thus, multiple bat hits (with valid bits set) are considered a programming error whether translation is enabled or disabled, and can lead to unpredictable results if translation is enabled, (or if translation is disabled, when translation is eventually enabled). for the case of unused bats (if translation is to be enabled), it is sufficient precaution to simply clear the valid bits of the unused bat entries. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-21 memory segment model 6.4 memory segment model the g2 core adheres to the memory segment model as defined in chapter 7, ?memory management,? in the programming environments manual for 32-bit implementations. memory in the oea is divided into 256-mbyte segments. this segmented memory model provides a way to map 4-kbyte pages of effective addresses to 4-kbyte pages in physical memory (page address translation), while providing the programming flexibility afforded by a large virtual address space (52 bits). the segment/page address translation mechanism may be superseded by the bat mechanism described in section 6.3, ?block address translation.? if not, the translation proceeds in the following two steps: 1. from effective address to the virtual address (which never exists as a specific entity, but can be considered to be the concatenation of the virtual page number and the byte offset within a page). 2. from virtual address to physical address. the following section highlights those areas of the memory segment model defined by the oea that are specific to the g2 core. 6.4.1 page history recording referenced (r) and changed (c) bits reside in each pte to keep history information about the page. they are maintained by a combination of the core hardware and the table search software. the operating system uses this information to determine which areas of memory to write back to disk when new pages must be allocated in main memory. referenced and changed recording is performed only for accesses made with page address translation and not for translations made with the bat mechanism or for accesses that correspond to direct-store interface (t = 1) segments. furthermore, r and c bits are maintained only for accesses made while address translation is enabled (msr[ir] = 1 or msr[dr] = 1). in the g2 core, the referenced and changed bits are updated as follows: for tlb hits, the c bit is updated according to table 6-7. for tlb misses, when a table search operation is in progress to locate a pte, the r and c bits are updated (set, if required) to reflect the status of the page based on this access. table 6-7 shows that the status of the c bit in the tlb entry (in the case of a tlb hit) is what causes the processor to update the c bit in the pte (the r bit is assumed to be set in the page tables if there is a tlb hit). therefore, when software clears the r and c bits in the page tables in memory, it must invalidate the tlb entries associated with the pages whose referenced and changed bits were cleared. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-22 g2 powerpc core reference manual motorola memory segment model the g2 core causes the r bit to be set for the execution of the dcbt or dcbtst instruction to that page (by causing a tlb miss exception to load the tlb entry in the case of a tlb miss). however, neither of these instructions causes the c bit to be set. as defined by the powerpc architecture, the referenced and changed bits are updated as if address translation were disabled (real addressing mode translation). additionally, these updates should be performed with single-beat read and byte write transactions on the bus. 6.4.1.1 referenced bit the referenced (r) bit of a page is located in the pte in the page table. every time a page is referenced (with a read or write access) and the r bit is zero, the r bit is then set in the page table. the oea specifies that the referenced bit may be set immediately, or the setting may be delayed until the memory access is determined to be successful. because the reference to a page is what causes a pte to be loaded into the tlb, the referenced bit in all g2 core tlb entries is effectively always set. the processor never automatically clears the referenced bit. the referenced bit is only a hint to the operating system about the activity of a page. at times, the referenced bit may be set by software although the access was not logically required by the program, or even if the access was prevented by memory protection. examples of this in these systems include the following: fetching of instructions not subsequently executed accesses generated by an lswx or stswx instruction with a zero length accesses generated by a stwcx. instruction when no store is performed because a reservation does not exist accesses that cause exceptions and are not completed 6.4.1.2 changed bit the changed bit of a page is located both in the pte in the page table and in the copy of the pte loaded into the tlb (if a tlb is implemented, as in the g2 core). whenever a data store instruction is executed successfully, if the tlb search (for page address translation) table 6-7. table search operations to update history bits?tlb hit case r and c bits in tlb entry processor action 00 combination does not occur 01 combination does not occur 10 read: write: no special action table search operation required to update c. causes a data tlb miss on store exception. 11 no special action for read or write f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-23 memory segment model results in a hit, the changed bit in the matching tlb entry is checked. if it is already set, the processor does not change the c bit. if the tlb changed bit is 0, it is set and a table search operation is performed to also set the c bit in the corresponding pte in the page table. the g2 core causes a data tlb miss on store exception for this case so that the software can perform the table search operation for setting the c bit. refer to section 6.5.2, ?implementation-specific table search operation,? for an example code sequence that handles these conditions. the changed bit (in both the tlb and pte in the page tables) is set only when a store operation is allowed by the page memory protection mechanism and all conditional branches occurring earlier in the program have been resolved (such that the store is guaranteed to be in the execution path). furthermore, the following conditions may cause the c bit to be set: the execution of an stwcx. instruction is allowed by the memory protection mechanism, but a store operation is not performed because no reservation exists. the execution of an stswx instruction is allowed by the memory protection mechanism, but a store operation is not performed because the specified length is zero. the store operation is not performed because an exception occurs before the store is performed. again, note that although the execution of the dcbt and dcbtst instructions may cause the r bit to be set, they never cause the c bit to be set. 6.4.1.3 scenarios for referenced and changed bit recording this section provides a summary of the model (defined by the oea) that is used by the processors for maintaining the referenced and changed bits. in some scenarios, the bits are guaranteed to be set by the processor, in some scenarios, the architecture allows that the bits may be set (not absolutely required), and in some scenarios, the bits are guaranteed to not be set. in implementations that do not maintain the r and c bits in hardware (such as the g2 core), software assistance is required. for these processors, the information in this section still applies, except that the software performing the updates is constrained to the rules described (that is, must set bits shown as guaranteed to be set and must not set bits shown as guaranteed to not be set). table 6-8 defines a prioritized list of the r and c bit settings for all scenarios. the entries in the table are prioritized from top to bottom, such that a matching scenario occurring closer to the top of the table takes precedence over a matching scenario closer to the bottom of the table. for example, if an stwcx. instruction causes a protection violation and there is no reservation, the c bit is not altered, as shown for the protection violation case. note that in the table, load operations include those generated by load instructions, by the eciwx f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-24 g2 powerpc core reference manual motorola memory segment model instruction, and by the cache management instructions that are treated as a load with respect to address translation. similarly, store operations include those operations generated by store instructions, by the ecowx instruction, and by the cache management instructions that are treated as a store with respect to address translation. in the columns for the g2 core, the combination of the core itself and the software used to search the page tables (described in section 6.5.2, ?implementation-specific table search operation?) is assumed. for more information, see ?page history recording? in chapter 7, ?memory management,? of the programming environments manual . 6.4.2 page memory protection the g2 core implements page memory protection as it is defined in chapter 7, ?memory management,? in the programming environments manual . table 6-8. model for guaranteed r and c bit settings priority scenario r bit set c bit set oea g2 core oea g2 core 1 no-execute protection violation no no no no 2 page protection violation maybe yes no no 3 out-of-order instruction fetch or load operation maybe no no no 4 out-of-order store operation for instructions that will cause no other kind of precise exception (in the absence of system-caused, imprecise, or floating-point assist exceptions maybe 1 1 if c is set, r is guaranteed to also be set. no no no 5 all other out-of-order store operations maybe 1 no maybe 1 no 6 zero-length load ( lswx ) maybe yes no no 7 zero-length store ( stswx ) maybe 1 yes maybe 1 yes 8 store conditional ( stwcx. ) that does not store maybe 1 yes maybe 1 yes 9 in-order instruction fetch yes 2 2 this includes the case when the instruction was fetched out-of-order and r was not set (does not apply for the g2 core). yes no no 10 load instruction or eciwx yes yes no no 11 store instruction, ecowx or dcbz instruction yes yes yes yes 12 dcbt , dcbtst , dcbst , or dcbf instruction maybe yes no no 13 icbi instruction maybe 1 no no 1 no 14 dcbi 3 instruction 3 the dcbi instruction should never be used on the g2 core. maybe 1 yes maybe 1 yes f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-25 memory segment model 6.4.3 tlb description this section describes the hardware resources provided in the g2 core to facilitate the page address translation process. note that the hardware implementation of the mmu is not specified by the architecture, and while this description applies to the g2 core, it does not necessarily apply to other processors of this family. 6.4.3.1 tlb organization because the g2 core has two mmus (immu and dmmu) that operate in parallel, some of the mmu resources are shared, and some are actually duplicated (shadowed) in each mmu to maximize performance. figure 6-7 shows the relationships between these resources within both the immu and dmmu and how the various portions of the effective address are used in the address translation process. while both mmus can be accessed simultaneously (both sets of segment registers and tlbs can be accessed in the same clock), when there is an exception condition, only one exception is reported at a time. itlb miss exceptions are reported when there are no more instructions to be dispatched or retired (the pipeline is empty). refer to chapter 7, ?instruction timing,? for more detailed information about the internal pipelines and the reporting of exceptions. as tlb entries are on-chip copies of ptes in the page tables in memory, they are similar in structure. tlb entries consist of two words; the high-order word contains the vsid and api fields of the high-order word of the pte and the low-order word contains the rpn, c bit, wimg bits, and pp bits (as in the low-order word of the pte). in order to uniquely identify a tlb entry as the required pte, the tlb entry also contains five more bits of the page index, ea[10?14] (in addition to the api bits of the pte). when an instruction or data access occurs, the effective address is routed to the appropriate mmu. ea[0?3] select 1 of the 16 segment registers and the remaining effective address bits and the virtual address from the segment register is passed to the tlb. ea[15?19] then select two entries in the tlb; the valid bit is checked and ea[10?14], vsid, and api fields (ea[4?9]) for the access are then compared with the corresponding values in the tlb entries. if one of the entries hits, the pp bits are checked for a protection violation, and the c bit is checked. if these bits do not cause an exception, the rpn value is passed to the memory subsystem and the wimg bits are then used as attributes for the access. also, note that the segment registers do not have a valid bit, and so they should also be initialized before translation is enabled. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-26 g2 powerpc core reference manual motorola memory segment model figure 6-7. segment register and tlb organization 6.4.3.2 tlb entry invalidation for processors, such as the g2 core, that implement tlb structures to maintain on-chip copies of the ptes that are resident in physical memory, the optional tlbie instruction provides a way to invalidate the tlb entries. note that the execution of the tlbie instruction in the g2 core invalidates four entries?both the itlb entries indexed by ea[15?19] and both the indexed entries of the dtlb. the architecture allows tlbie to optionally enable a tlb invalidate signaling mechanism in hardware so that other processors also invalidate their resident copies of the matching pte. the g2 core does not signal the tlb invalidation to other processors and does not perform any action when a tlb invalidation is performed by another processor. 078 31 0 15 segment registers tlb ea0?ea31 ea0?ea3 ea15?ea19 vsid compare compare ea4?ea14 line 1 line 0 mux rpn line1/line 0 hit pa0?pa19 t t vsid v 0 31 v select f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-27 page table search operation the tlbsync instruction causes instruction execution to stop if the core_tlbisync input signal is also asserted. if core_tlbisync is negated, instruction execution may continue or resume after the completion of a tlbsync instruction. section 8.3.11.5, ?tlbi sync (core_tlbisync )?input,? describes the tlb synchronization mechanism in further detail. the tlbia instruction is not implemented on the g2 core and when its opcode is encountered, an illegal instruction program exception is generated. to invalidate all entries of both tlbs, 32 tlbie instructions must be executed, incrementing the value in ea[15?19] by 1 each time. see chapter 8, ?instruction set,? in the programming environments manual for detailed information about the tlbie instruction. 6.4.4 page address translation summary figure 6-8 provides the detailed flow for the page address translation mechanism. the figure includes the checking of the n bit in the segment descriptor and then expands on the tlb hit branch of figure 6-6. the detailed flow for the tlb miss branch is described in section 6.5.1, ?page table search operation?conceptual flow.? note that as in the case of block address translation, if the dcbz instruction is attempted to be executed either in write-through mode or as cache-inhibited (w = 1 or i = 1), the alignment exception is generated. the checking of memory protection violation conditions for page address translation is described in chapter 7, ?memory management,? in the programming environments manual for 32-bit implementations. 6.5 page table search operation as stated earlier, the operating system must synthesize the table search algorithm for setting up the tables. the g2 core tlb miss exception handlers also use this algorithm (with the assistance of some hardware-generated values) to load tlb entries when tlb misses occur, as described in section 6.5.2, ?implementation-specific table search operation.? 6.5.1 page table search operation?conceptual flow the table search process for a processor of this family varies slightly for 64- and 32-bit implementations. the main differences are the address ranges and pte formats specified. see the programming environments manual for the pte format. an outline of the page table search process performed by a 32-bit implementation is as follows: 1. the 32-bit physical address of the primary pteg is generated as described in chapter 7, ?memory management,? in the programming environments manual for 32-bit implementations. 2. the first pte (pte0) in the primary pteg is read from memory. pte reads should occur with an implied wim memory/cache mode control bit setting of 0b001. therefore, they are considered cacheable and burst in from memory and placed in the cache. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-28 g2 powerpc core reference manual motorola page table search operation figure 6-8. page address translation flow for 32-bit implementations?tlb hit (see figure 6-9) (see the programming environments manual ) tlb hit case alignment exception effective address generated continue access to memory subsystem with wimg bits from pte page table search operation pa[0?31] rpn || a[20?31] page address translation check page memory protection violation conditions page memory protection violation access permitted otherwise store access with pte [c] = 0 otherwise dcbz instruction with w or i = 1 otherwise (see figure 6-6) generate 52-bit virtual address from segment descriptor compare virtual address with tlb entries access prohibited (see the programming environments manual ) instruction fetch with n bit set in segment descriptor (no-execute) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-29 page table search operation 3. the pte in the selected pteg is tested for a match with the virtual page number (vpn) of the access. the vpn is the vsid concatenated with the page index field of the virtual address. for a match to occur, the following must be true: ? pte[h] = 0 ? pte[v] = 1 ? pte[vsid] = va[0?23] ? pte[api] = va[24?29] 4. if a match is not found, step 3 is repeated for each of the other seven ptes in the primary pteg. if a match is found, the table search process continues as described in step 8. if a match is not found within the eight ptes of the primary pteg, the address of the secondary pteg is generated. 5. the first pte (pte0) in the secondary pteg is read from memory. again, because pte reads typically have a wim bit combination of 0b001, an entire cache line is burst into the on-chip cache. 6. the pte in the selected secondary pteg is tested for a match with the virtual page number (vpn) of the access. for a match to occur, the following must be true: ? pte[h] = 1 ? pte[v] = 1 ? pte[vsid] = va[0?23] ? pte[api] = va[24?29] 7. if a match is not found, step 6 is repeated for each of the other seven ptes in the secondary pteg. 8. if a match is found, the pte is written into the on-chip tlb and the r bit is updated in the pte in memory (if necessary). if there is no memory protection violation, the c bit is also updated in memory and the table search is complete. 9. if no match is found in the eight ptes of the secondary pteg, the search fails and a page fault exception condition occurs (either an isi exception or a dsi exception). note that the software routines that implement this algorithm must synthesize this condition by appropriately setting the srr1 or dsisr and branching to the isi or dsi handler routine. reads from memory for table search operations should be performed as global (but not exclusive), cacheable operations, and can be loaded into the on-chip cache. figure 6-9 and figure 6-10 provide conceptual flow diagrams of primary and secondary page table search operations as described in the oea for 32-bit processors. recall that the architecture allows implementations to perform the page table search operations automatically (in hardware) or with software assistance (may be required), as is the case with the g2 core. also, the elements in the figure that apply to tlbs are shown as optional because tlbs are not required by the architecture. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-30 g2 powerpc core reference manual motorola page table search operation figure 6-9. primary page table search?conceptual flow (from figure 6-10) fetch pte from pteg otherwise perform secondary page table search secondary page table search hit pte[r] 1 r_flag 1 write pte into tlb otherwise dcbz instruction with w or i = 1 otherwise perform operation to memory or take alignment exception page table search complete tlb[pte[c]] 1 page table search complete r_flag = 1 byte write to update pte[r] in memory pte[r] 1 (update pte[r] in memory) generate pa using primary hash function pa base pa of pteg primary page table search pa pa + 8 (fetch next pte in pteg) fetch pte (64 bits) from pa pte [vsid, api, h, v] = segment descriptor [vsid], ea[api], 0, 1 pte[c] 1 (update pte[c] in memory) pte[r] 1 (update pte[r] in memory) otherwise access permitted access prohibited check memory protection violation conditions optional otherwise last pte in pteg pte[r] = 1 pte[r] = 0 otherwise r_flag = 1 store operation with pte[c] = 0 otherwise r_flag = 1 memory protection violation f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-31 page table search operation figure 6-10. secondary page table search flow?conceptual flow figure 6-9 shows the case of a dcbz instruction that is executed with w = 1 or i = 1, and that the r bit may be updated in memory (if required) before the operation is performed or the alignment exception occurs. the r bit may also be updated by a memory protection violation. 6.5.2 implementation-specific table search operation the g2 core has a set of implementation-specific registers, exceptions, and instructions that facilitate very efficient software searching of the page tables in memory. this section describes those resources and provides three example code sequences that can be used in a g2 core system for an efficient search of the translation tables in software. these three code sequences can be used as handlers for the three exceptions requiring access to the ptes in the page tables in memory?instruction tlb miss, data tlb miss on load, and data tlb miss on store exceptions. generate pa using secondary hash function pa base pa of pteg fetch pte from pteg fetch pte (64 bits) from pa pa pa + 8 (fetch next pte in pteg) pte [vsid, api, h, v] = segment descriptor [vsid], ea[api], 1, 1 secondary page table search hit page fault dsi exception isi exception set srr1[1] = 1 set dsisr[1 = 1] (see figure 6-9) secondary page table search otherwise otherwise last pte in pteg data access instruction access f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-32 g2 powerpc core reference manual motorola page table search operation 6.5.2.1 resources for table search operations in addition to setting up the translation page tables in memory, the system software must assist the processor in loading ptes into the on-chip tlbs. when a required tlb entry is not found in the appropriate tlb, the processor vectors to one of the three tlb miss exception handlers so that the software can perform a table search operation and load the tlb. when this occurs, the processor automatically saves information about the access and the executing context. table 6-9 provides a summary of the implementation-specific exceptions, registers, and instructions that can be used by the tlb miss exception handler software in g2 core systems. refer to chapter 5, ?exceptions,? for more information about exception processing. table 6-9. implementation-specific resources for table search operations resource name description exceptions instruction tlb miss exception (vector offset 0x1000) no matching entry found in itlb data tlb miss on load exception (vector offset 0x1100) no matching entry found in dtlb for a load data access data tlb miss on store exception?also caused when changed bit must be updated (vector offset 0x1200) no matching entry found in dtlb for a store data access or matching dltb entry has c = 0 and access is a store registers imiss and dmiss when a tlb miss exception occurs, the imiss or dmiss register contains the 32-bit effective address of the instruction or data access that caused the miss exception. icmp and dcmp the icmp and dcmp registers contain the word to be compared with the first word of a pte in the table search software routine to determine if a pte contains the address translation for the instruction or data access. the contents of icmp and dcmp are automatically derived by the core when a tlb miss exception occurs. hash1 and hash2 the hash1 and hash2 registers contain the primary and secondary pteg addresses that correspond to the address causing a tlb miss. these pteg addresses are automatically derived by the core by performing the primary and secondary hashing function on the contents of imiss or dmiss, for an itlb or dtlb miss exception, respectively. rpa the system software loads a tlb entry by loading the second word of the matching pte entry into the rpa register and then executing the tlbli or tlbld instruction (for loading the itlb or dtlb, respectively). instructions tlbli r b loads the contents of the icmp and rpa registers into the itlb entry selected by motorola chapter 6. memory management 6-33 page table search operation in addition, the g2 core contains the following features that do not specifically control the mmu, but that are implemented to increase performance and flexibility in the software table search routines whenever one of the three tlb miss exceptions occurs: temporary gpr0?gpr3. these registers are available as r0 ? r3 when msr[tgpr] is set. the g2 core automatically sets msr[tgpr] for these cases, allowing these exception handlers to have four registers that are used as scratchpad space, without having to save or restore this part of the machine state that existed when the exception occurred. note that msr[tgpr] is cleared when the rfi instruction is executed because the old msr value (with msr[tgpr] = 0) saved in srr1 is restored. refer to section 6.5.2.2, ?software table search operation,? for code examples that take advantage of these registers. also, the core automatically saves the values of cr[cr0] of the executing context to srr1[0?3]. thus, the exception handler can set cr[cr0] bits and branch accordingly in the exception handler routine, without having to save the existing cr[cr0] bits. however, the exception handler must restore these bits to cr[cr0] before executing the rfi instruction or branching to the dsi or isi exception handler. in addition, srr1[crf0] must be cleared before branching to the dsi exception handler on a data access page fault. for an instruction access page fault, srr1[0, 2?3] must be cleared before branching to the isi handler. see figure 6-17 for synthesizing a page fault exception when no pte is found. srr1[d/i] identifies an instruction or data miss, and srr1[l/s] identifies a load or store miss. srr1[way] identifies the associativity class of the tlb entry selected for replacement by the lru algorithm. the software can change this value, effectively overriding the replacement algorithm. the srr1[key] bit is used by the table search software to determine if there is a protection violation associated with the access (useful on data write misses for determining if the c bit should be updated in the table). table 6-10 summarizes the srr1 bits updated whenever one of the three tlb miss exceptions occurs. table 6-10. implementation-specific srr1 bits bits name function 0?3 crf0 condition register field 0 bits 12 key key for tlb miss (either ks or kp from segment register, depending on whether the access is a user or supervisor access). 13 d/i set if instruction tlb miss 14 way next tlb set to be replaced (set per lru) 15 s/l set if data tlb miss was for a load instruction f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-34 g2 powerpc core reference manual motorola page table search operation the key bit saved in srr1 is derived as follows: select key from segment register: if msr[pr] = 0, key = ks if msr[pr] = 1, key = kp the rest of this section describes the format of the implementation-specific sprs used by the tlb miss exception handlers. these registers can be accessed by supervisor-level instructions only. because dmiss, imiss, dcmp, icmp, hash1, hash2, and rpa are used to access the translation tables for software table search operations, they should only be accessed when address translation is disabled (msr[ir] = 0 and msr[dr] = 0). note that msr[ir] and msr[dr] are cleared whenever an exception occurs. 6.5.2.1.1 data and instruction tlb miss address registers (dmiss and imiss) the dmiss and imiss registers have the same format as shown in figure 6-11. they are loaded automatically on a data or instruction tlb miss. the dmiss and imiss contain the effective page address of the access which caused the tlb miss exception. the contents are used by the processor when calculating the values of hash1 and hash2, and by the tlbld and tlbli instructions when loading a new tlb entry. note that the core always loads a big-endian address into the dmiss register. these registers are both read- and write- accessible. however, great caution should be used when writing to these registers. figure 6-11. dmiss and imiss registers 6.5.2.1.2 data and instruction tlb compare registers (dcmp and icmp) the dcmp and icmp registers are shown in figure 6-12. these registers contain the first word in the required pte. the contents are constructed automatically from the contents of the segment registers and the effective address (dmiss or imiss) when a tlb miss exception occurs. each pte read from the tables in memory during the table search process should be compared with this value to determine whether or not the pte is a match. upon execution of a tlbld or tlbli instruction, the contents of the dcmp or icmp register is loaded into the first word of the selected tlb entry. figure 6-12. dcmp and icmp registers effective address 0 31 v h vsid api 01 24 25 26 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-35 page table search operation table 6-11 describes the bit settings for the dcmp and icmp registers. 6.5.2.1.3 primary and secondary hash address registers (hash1 and hash2) hash1 and hash2 contain the physical addresses of the primary and secondary ptegs for the access that caused the tlb miss exception. only bits 7?25 differ between them. for convenience, the processor automatically constructs the full physical address by routing bits 0?6 of sdr1 into hash1 and hash2 and clearing the lower six bits. these registers are read-only and are constructed from the contents of the dmiss or imiss register. the format for hash1 and hash2 is shown in figure 6-13. figure 6-13. hash1 and hash2 registers table 6-12 describes the bit settings of the hash1 and hash2 registers. 6.5.2.1.4 required physical address register (rpa) the rpa is shown in figure 6-14. during a page table search operation, the software must load the rpa with the second word of the correct pte. when the tlbld or tlbli instruction is executed, data from imiss and icmp (or dmiss and dcmp) and the rpa registers is merged and loaded into the selected tlb entry. the tlb entry is selected by the effective address of the access (loaded by the table search software from the dmiss or imiss register) and srr1[way]. table 6-11. dcmp and icmp bit settings bits name description 0 v valid bit. set by the processor on a tlb miss exception. 1?24 vsid virtual segment id. copied from vsid field of corresponding segment register. 25 h hash function identifier. cleared by the processor on a tlb miss exception. 26?31 api abbreviated page index. copied from api of effective address. table 6-12. hash1 and hash2 bit settings bits name description 0?6 htaborg[0?6] copy of the upper 7 bits of the htaborg field from sdr1 7?25 hashed page address address bits 7?25 of the pteg to be searched 26?31 ? reserved reserved htaborg hashed page address 0 0 0 0 0 0 067 25 26 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-36 g2 powerpc core reference manual motorola page table search operation figure 6-14. required physical address (rpa) register table 6-13 describes the bit settings of the rpa register. 6.5.2.2 software table search operation when a tlb miss occurs, the instruction or data mmu loads imiss or dmiss, with the effective address of the access. the processor completes all instructions ahead of the instruction that caused the exception, status information is saved in srr1, and one of the three tlb miss exceptions is taken. in addition, the processor loads icmp or dcmp with the value to be compared with the first word of ptes in the tables in memory. the software should then access the first pte at the address pointed to by hash1. the first word of the pte should be loaded and compared to the contents of dcmp or icmp. if there is a match, the required pte has been found and the second word of the pte is loaded from memory into rpa. then the tlbli or tlbld instruction is executed, which loads the contents of icmp or dcmp and rpa into the selected tlb entry. the tlb entry is selected by the effective address of the access and srr1[way]. if the comparison does not match, the pteg address is incremented to point to the next pte in the table, and the above sequence is repeated. if none of the eight ptes in the primary pteg matches, the sequence is then repeated using the secondary pteg (at the address contained in hash2). if the pte is also not found in the eight entries of the secondary page table, a page fault condition exists and a page fault exception must be synthesized. thus, the appropriate bits must be set in srr1 (or dsisr) and the tlb miss handler must branch to either the isi or dsi exception handler, which handles the page fault condition. table 6-13. rpa bit settings bits name description 0?19 rpn physical page number from pte 20?22 ? reserved 23 r referenced bit from pte 24 c changed bit from pte 25?28 wimg memory/cache access attribute bits 29 ? reserved 30?31 pp page protection bits from pte reserved rpn r cwimg pp 0 19 20 22 23 24 25 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-37 page table search operation the following section provides a flow diagram outlining some example software that can be used to handle the three tlb miss exceptions and sample assembly language that implements that flow. 6.5.2.2.1 flow for example exception handlers figure 6-15 shows the flow for the example tlb miss exception handlers. the flow shown is common for the three exception handlers, except that the imiss and icmp registers are used for the instruction tlb miss exception while the dmiss and dcmp registers are used for the two data tlb miss exceptions. also, for the cases of store instructions that cause either a tlb miss or require a table search operation to update the c bit, the flow shows that the c bit is set in both the tlb entry and pte in memory. finally, in the case of a page fault (no pte found in the table search operation), the setup for the isi or dsi exception is slightly different for these two cases. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-38 g2 powerpc core reference manual motorola page table search operation figure 6-15. flow for example software table search operation (see figure 6-16) set counter: cnt 8 load primary pteg pointer: ptr hash1 ? 8 compare_value icmp/dcmp read lower word of next pte from memory: ptr ptr + 8 temp (ptr) read upper word of pte: temp (ptr ? 4) otherwise rpa temp motorola chapter 6. memory management 6-39 page table search operation the flow for checking the r and c bits and setting them appropriately is shown in figure 6-16. figure 6-16. check and set r and c bit flow store byte 7 of pte to memory: (ptr ? 2) temp [byte 7] set r bit: temp temp or 0x100 handler for data store op check r, c bits and set as needed otherwise pp = 00 01 check protection pp = 10 11 setup for protection violation pp = 11 pp = 10 return to tlb miss exception flow (see figure 6-15) (see figure 6-18) (see figure 6-18) temp[c] = 0 otherwise srr1[key] = 1 store bytes 6, 7 of pte to memory: (ptr ? 2) temp [bytes 6, 7] return to tlb miss exception flow (see figure 6-15) set r, c bits: temp temp or 0x180 otherwise setup for protection violation f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-40 g2 powerpc core reference manual motorola page table search operation figure 6-17 shows the flow for synthesizing a page fault exception when no pte is found. figure 6-17. page fault setup flow setup for page fault exception data tlb miss handlers instruction tlb miss handlers dsisr[6] srr1[15] dsisr[1] 1 dar dtemp restore cr0 bits msr[tgpr] 0 branch to dsi exception handler restore cr0 bits msr[tgpr] 0 branch to isi exception handler clear upper bits of srr1 srr1 srr1 and 0xffff srr1[1] 1 clear upper bits of srr1 srr1 srr1 and 0xffff srr1[31] = 1 (little-endian mode) dtemp dmiss dtemp dtemp xor 0x07 otherwise f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-41 page table search operation figure 6-18 shows the flow for managing the cases of a tlb miss on an instruction access to guarded memory, and a tlb miss when c = 0 and a protection violation exists. the setup for these protection violation exceptions is very similar to that of page fault conditions (as shown in figure 6-17) except that different bits in srr1 (and dsisr) are set. figure 6-18. setup for protection violation exceptions dsisr[6] srr1[15] dsisr[4] 1 restore cr0 bits msr[tgpr] 0 branch to dsi exception handler restore cr0 bits msr[tgpr] 0 branch to isi exception handler clear upper bits of srr1 srr1 srr1 and 0xffff srr1[4] 1 clear upper bits of srr1 srr1 srr1 and 0xffff data tlb miss handlers (instruction access to guarded memory) (data access to protected memory; c = 0) setup for protection violation exceptions dar dtemp srr1[31] = 1 (little-endian mode) dtemp dmiss dtemp dtemp xor 0x07 otherwise instruction tlb miss handler f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 6-42 g2 powerpc core reference manual motorola page table search operation 6.5.2.2.2 code for example exception handlers this section provides assembly language examples that implement the flow diagrams described above. note that although these routines fit into a few cache lines, they are supplied only as functional examples; they could be further optimized for faster performance. # tlb software load for g2 core # # new instructions: # tlbld - write the dtlb with the pte in rpa reg # tlbli - write the itlb with the pte in rpa reg # new sprs # dmiss - address of dstream miss # imiss - address of istream miss # hash1 - address primary hash pteg address # hash2 - returns secondary hash pteg address # icmp - returns the primary istream compare value # dcmp - returns the primary dstream compare value # rpa - the second word of pte used by tlblx # # gpr r0..r3 are shadowed # # there are three flows. # tlbdatamiss - tlb miss on data load # tlbceq0 - tlb miss on data store or store with tlb change bit == 0 # tlbinstrmiss - tlb miss on instruction fetch #+ # place labels for rel branches #- #.machine ppc_603e .set r0, 0 .set r1, 1 .set r2, 2 .set r3, 3 .set dmiss, 976 .set dcmp, 977 .set hash1, 978 .set hash2, 979 .set imiss, 980 .set icmp, 981 .set rpa, 982 .set c0, 0 .set dar, 19 .set dsisr, 18 .set srr0, 26 .set srr1, 27 . .csect tlbmiss[pr] vec0: .globl vec0 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-43 page table search operation .org vec0+0x300 vec300: .org vec0+0x400 vec400: #+ # instruction tb miss flow # entry: # vec = 1000 # srr0 -> address of instruction that missed # srr1 -> 0:3=cr0 4=lru way bit 16:31 = saved msr # msr 6-44 g2 powerpc core reference manual motorola page table search operation # r2 is pointer to pteg # r3 is current compare value #- instrsechash: andi. r1, r3, 0x0040 # see if we have done second hash bne doisi # if so, go to isi exception mfspr r2, hash2 # get the second pointer ori r3, r3, 0x0040 # change the compare value addi r1, 0, 8 # load 8 for counter addi r2, r2, -8 # pre dec for update on load b im0 # try second hash #+ # entry not found: synthesize an isi exception # guarded memory protection violation: synthesize an isi exception # entry: # r0 is saved counter # r1 is junk # r2 is pointer to pteg # r3 is current compare value # doisip: mfspr r3, srr1 # get srr1 andi. r2,r3,0xffff # clean upper srr1 addis r2, r2, 0x0800 # or in srr<4> = 1 to flag prot violation b isi1: doisi: mfspr r3, srr1 # get srr1 andi. r2, r3, 0xffff # clean srr1 addis r2, r2, 0x4000 # or in srr1<1> = 1 to flag pte not found isi1 mtctr r0 # restore counter mtspr srr1, r2 # set srr1 mfmsr r0 # get msr xoris r0, r0, 0x8000 # flip the msr motorola chapter 6. memory management 6-45 page table search operation # r2 is pointer to pteg # r3 is current compare value #- .csect tlbmiss[pr] .org vec0+0x1100 tlbdatamiss: mfspr r2, hash1 # get first pointer addi r1, 0, 8 # load 8 for counter mfctr r0 # save counter mfspr r3, dcmp # get first compare value addi r2, r2, -8 # pre dec the pointer dm0: mtctr r1 # load counter dm1: lwzu r1, 8(r2) # get next pte cmp c0, r1, r3 # see if found pte bdnzf 0, dm1 # dec count br if cmp ne and if count not zero bne datasechash # if not found set up second hash or exit l r1, +4(r2) # load tlb entry lower-word mtctr r0 # restore counter mfspr r0, dmiss # get the miss address for the tlbld mfspr r3, srr1 # get the saved cr0 bits mtcrf 0x80, r3 # restore cr0 mtspr rpa, r1 # set the pte ori r1, r1, 0x100 # set reference bit srw r1, r1, 8 # get byte 7 of pte tlbld r0 # load the dtlb stb r1, +6(r2) # update page table rfi # return to executing program #+ # register usage: # r0 is saved counter # r1 is junk # r2 is pointer to pteg # r3 is current compare value #- datasechash: andi. r1, r3, 0x0040 # see if we have done second hash bne dodsi # if so, go to dsi exception mfspr r2, hash2 # get the second pointer ori r3, r3, 0x0040 # change the compare value addi r1, 0, 8 # load 8 for counter addi r2, r2, -8 # pre dec for update on load b dm0 # try second hash # #+ # c=0 in dtlb and dtlb miss on store flow # entry: # vec = 1200 # srr0 -> address of store that caused the exception # srr1 -> 0:3=cr0 4=lru way bit 5=1 16:31 = saved msr # msr 6-46 g2 powerpc core reference manual motorola page table search operation # dmiss -> ea that missed # dcmp -> the compare value for the va that missed # hash1 -> pointer to first hash pteg # hash2 -> pointer to second hash pteg # # register usage: # r0 is saved counter # r1 is junk # r2 is pointer to pteg # r3 is current compare value #- .csect tlbmiss[pr] .org vec0+0x1200 tlbceq0: mfspr r2, hash1 # get first pointer addi r1, 0, 8 # load 8 for counter mfctr r0 # save counter mfspr r3, dcmp # get first compare value addi r2, r2, -8 # pre dec the pointer ceq0: mtctr r1 # load counter ceq1: lwzu r1, 8(r2) # get next pte cmp c0, r1, r3 # see if found pte bdnzf 0, ceq1 # dec count br if cmp ne and if count not zero bne ceq0sechash # if not found set up second hash or exit l r1, +4(r2) # load tlb entry lower-word andi. r3,r1,0x80 # check the c-bit beq ceq0chkprot # if (c==0) go check protection modes ceq2: mtctr r0 # restore counter mfspr r0, dmiss # get the miss address for the tlbld mfspr r3, srr1 # get the saved cr0 bits mtcrf 0x80, r3 # restore cr0 mtspr rpa, r1 # set the pte tlbld r0 # load the dtlb rfi # return to executing program #+ # register usage: # r0 is saved counter # r1 is junk # r2 is pointer to pteg # r3 is current compare value #- ceq0sechash: andi. r1, r3, 0x0040 # see if we have done second hash bne dodsi # if so, go to dsi exception mfspr r2, hash2 # get the second pointer ori r3, r3, 0x0040 # change the compare value addi r1, 0, 8 # load 8 for counter addi r2, r2, -8 # pre dec for update on load b ceq0 # try second hash f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 6. memory management 6-47 page table search operation #+ # entry found and pte(c-bit==0): # (check protection before setting pte(c-bit) # register usage: # r0 is saved counter # r1 is pte entry # r2 is pointer to pteg # r3 is trashed #- ceq0chkprot: rlwinm. r3,r1,30,0,1 # test pp bge- chk0 # if (pp==00 or pp==01) goto chk0: andi. r3,r1,1 # test pp[0] beq+ chk2 # return if pp[0]==0 b dodsip # else dsip chk0: mfspr r3,srr1 # get old msr andis. r3,r3,0x0008 # test the key bit (srr1-bit 12) beq chk2 # if (key==0) goto chk2: b dodsip # else dsip chk2: ori r1, r1, 0x180 # set reference and change bit sth r1, 6(r2) # update page table b ceq2 # and back we go # #+ # entry not found: synthesize a dsi exception # entry: # r0 is saved counter # r1 is junk # r2 is pointer to pteg # r3 is current compare value # dodsi: mfspr r3, srr1 # get srr1 rlwinm r1, r3, 9,6,6 # get srr1 6-48 g2 powerpc core reference manual motorola page table search operation beq dsi2: # if little endian then: xor r1,r1,0x07 # de-mung the data address dsi2: mtspr dar, r1 # put in dar mfmsr r0 # get msr xoris r0, r0, 0x2 # flip the msr motorola chapter 7. instruction timing 7-1 chapter 7 instruction timing this chapter describes how the g2 core processor fetches, dispatches, and executes instructions and how it reports the results of instruction execution. it gives detailed descriptions of how the g2 core execution units work, and how those units interact with other parts of the processor, such as the instruction fetching mechanism, register files, and caches. it gives examples of instruction sequences, showing potential bottlenecks and how to minimize their effects. finally, it includes tables that identify the unit that executes each instruction implemented on the core, the latency for each instruction, and other information that is useful for the assembly language programmer. 7.1 terminology and conventions this section provides an alphabetical glossary of terms used in this chapter. these definitions are provided as a review of commonly used terms and as a way to point out specific ways these terms are used in this chapter. branch prediction?the process of guessing whether a branch will be taken. such predictions can be correct or incorrect; the term predicted as it is used here does not imply that the prediction is correct (successful). the powerpc architecture defines a means for static branch prediction as part of the instruction encoding. branch resolution?the determination of whether a branch is taken or not taken. a branch is said to be resolved when the processor can determine which instruction path to take. if the branch is resolved as predicted, the instructions following the predicted branch that may have been speculatively executed can complete (see completion). if the branch is not resolved as predicted, instructions on the mispredicted path, and any results of speculative execution, are purged from the pipeline and fetching continues from the nonpredicted path. completion?completion occurs when an instruction has finished executing, written back any results, and is removed from the completion queue (cq). when an instruction completes, it is guaranteed that this instruction and all previous instructions can cause no exceptions. fall-through (branch fall-through)?a not-taken branch. on the g2 core, fall-through branch instructions are removed from the instruction stream at dispatch. that is, these instructions are allowed to fall through the instruction queue through f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-2 g2 powerpc core reference manual motorola terminology and conventions the dispatch mechanism, without either being passed to an execution unit and or given a position in the cq. fetch?the process of bringing instructions from memory (such as a cache or system memory) into the instruction queue. finish?finishing occurs in the last cycle of execution. in this cycle, the cq entry is updated to indicate that the instruction has finished executing. folding (branch folding)?the replacement of a branch instruction with target instructions and any instructions along the not-taken path, when a branch is either taken or predicted as taken. latency?the number of clock cycles necessary to execute an instruction and make ready the results of that execution for a subsequent instruction. pipeline?in the context of instruction timing, the term pipeline refers to the interconnection of the stages. the events necessary to process an instruction are broken into several cycle-length tasks to allow work to be performed on several instructions simultaneously?analogous to an assembly line. as an instruction is processed, it passes from one stage to the next. when it does, the stage becomes available for the next instruction. although an individual instruction may take many cycles to complete (the number of cycles is called instruction latency), pipelining makes it possible to overlap the processing so that the throughput (number of instructions completed per cycle) is greater than if pipelining were not implemented. program order?the order of instructions in an executing program. more specifically, this term is used to refer to the original order in which program instructions are fetched into the instruction queue from the cache. rename register?temporary buffers used by instructions that have finished execution but have not completed. reservation station?a buffer between the dispatch and execute stages that allows instructions to be dispatched even though the results of instructions on which the dispatched instruction may depend are not available. retirement?removal of the completed instruction from the cq. stage?the term stage is used in two different senses, depending on whether the pipeline is being discussed as a physical entity or a sequence of events. in the latter case, a stage is an element in the pipeline during which certain actions are performed, such as decoding the instruction, performing an arithmetic operation, or writing back the results. a stage is typically described as taking a processor clock cycle to perform its operation; however, some events (such as dispatch and write-back) happen instantaneously, and may be thought to occur at the end of the stage. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-3 instruction timing overview an instruction can spend multiple cycles in one stage. an integer multiply, for example, takes multiple cycles in the execute stage. when this occurs, subsequent instructions may stall. in some cases, an instruction may also occupy more than one stage simultaneously, especially in the sense that a stage can be seen as a physical resource?for example, when instructions are dispatched they are assigned a place in the cq at the same time they are passed to the execute stage. they can be said to occupy both the complete and execute stages in the same clock cycle. stall?an occurrence when an instruction cannot proceed to the next stage. store queue?holds store operations that have not been committed to memory, resulting from completed or retired instructions. superscalar?a superscalar processor is one that can dispatch multiple instructions concurrently from a conventional linear instruction stream. in a superscalar implementation, multiple instructions can be in the same stage at the same time. throughput?a measure of the number of instructions that are processed per cycle. for example, a series of double-precision floating-point multiply instructions has a throughput of one instruction per clock cycle. write-back?write-back (in the context of instruction handling) occurs when a result is written from the rename registers into the architectural registers (typically the gprs and fprs or the store queue). 7.2 instruction timing overview the g2 core design minimizes average instruction execution latency, the number of clock cycles it takes to fetch, decode, dispatch, and execute instructions and make the results available for a subsequent instruction. some instructions, such as loads and stores, access memory and require additional clock cycles between the execute phase and the write-back phase. these latencies vary depending on whether the access is to cacheable or noncacheable memory, whether it hits in the l1 cache, whether the cache access generates a write-back to memory, whether the access causes a snoop hit from another device that generates additional activity, and other conditions that affect memory accesses. the g2 core implements many features to improve throughput, such as pipelining, superscalar instruction dispatch, branch folding, removal of fall-through branches, two-level speculative branch handling, and multiple execution units that operate independently and in parallel. as an instruction of load/store and floating-point units passes from stage to stage in a pipelined system, the following instruction can follow through the stages as the former instruction vacates them, allowing several instructions to be processed simultaneously. while it may take several cycles for an instruction to pass through all the stages, when the pipeline has been filled, one instruction can complete its work on every clock cycle. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-4 g2 powerpc core reference manual motorola instruction timing overview figure 7-1 represents a generic pipelined execution unit. figure 7-1. pipelined execution unit the entire path that instructions take through the fetch, decode/dispatch, execute, complete, and write-back stages is considered the g2 core master pipeline, and two of the core execution units (the fpu and lsu) are also multiple-stage pipelines. the g2 core contains the following execution units that operate independently and in parallel: branch processing unit (bpu) 32-bit integer unit (iu)?executes all integer instructions 64-bit floating-point unit (fpu) load/store unit (lsu) system register unit (sru) the g2 core can retire two instructions on every clock cycle. in general, the core processes instructions in four stages?fetch, decode/dispatch, execute, and complete as shown in figure 7-2. note that the example of a pipelined execution unit in figure 7-1 is similar to the three-stage fpu pipeline in figure 7-2. the instruction pipeline stages are described as follows: the instruction fetch stage includes the clock cycles necessary to request instructions from the memory system and the time the memory system takes to respond to the request. instruction fetch timing depends on many variables, such as whether the instruction is in the branch target instruction cache, or in the on-chip instruction cache. instruction fetch timing increases when it is necessary to fetch instructions from system memory. the variables that affect fetch timing include the processor-to-bus clock ratio, the amount of bus traffic, and whether any cache coherency operations are required. clock 0 clock 1 clock 2 clock 3 instruction a ? ? instruction b instruction c instruction d instruction a instruction b instruction c ? instruction a instruction b stage 1 stage 2 stage 3 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-5 instruction timing overview figure 7-2. instruction flow diagram because there are so many variables, unless otherwise specified, the instruction timing examples below assume optimal performance and that the instructions are available in the instruction queue in the same clock cycle that they are requested. the fetch stage ends when the instruction is dispatched. completion buffer assignment maximum two-instruction completion per clock cycle fpu complete (retire) fetch lsu sru instruction queue (in program order) completion queue (in program order) finish iu 2-entry 5 0 0 4 iq5 iq4 iq3 iq2 iq1 iq0 branch processing unit reservation stations dispatch maximum two-instruction fetch per clock cycle maximum two-instruction dispatch per clock cycle store queue maximum two-instruction dispatch per clock cycle f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-6 g2 powerpc core reference manual motorola instruction timing overview the decode/dispatch stage consists of the time it takes to fully decode the instruction and dispatch it from the instruction queue to the appropriate execution unit. instruction dispatch requires the following: ? instructions can be dispatched only from the two lowest instruction queue entries, iq0 and iq1. ? a maximum of two instructions can be dispatched per clock cycle. ? only one instruction can be dispatched to each execution unit per clock cycle. ? there must be a vacancy in the specified execution unit. ? a rename register must be available for each destination operand specified by the instruction. ? for an instruction to dispatch, the appropriate execution unit must be available and there must be an open position in the cq. if no entry is available, the instruction remains in the iq. the execute stage consists of the time between dispatch to the execution unit (or reservation station) and the point at which the instruction vacates the execution unit. most integer instructions have a one-cycle latency; results of these instructions can be used in the clock cycle after an instruction enters the execution unit. however, integer multiply and divide instructions take multiple clock cycles to complete. the iu can process all integer instructions. the lsu and fpu are pipelined, as shown in figure 7-2. the complete (complete/write-back) pipeline stage maintains the correct architectural machine state and commits it to the architectural registers at the proper time. if the completion logic detects an instruction containing an exception status, all following instructions are canceled, their execution results in rename registers are discarded, and the correct instruction stream is fetched. the complete stage ends when the instruction is retired. two instructions can be retired per cycle. instructions are retired only from the two lowest cq entries, cq0 and cq1. the notation conventions used in the instruction timing examples are as follows: fetch?the fetch stage includes the time between when an instruction is requested and when it is brought into the instruction queue. this latency can vary greatly, depending on whether the instruction is in the on-chip cache or system memory (in which case latency can be affected by bus speed and traffic on the system bus, and address translation dispatches). therefore, in the examples in this chapter, the fetch stage is usually idealized; that is, an instruction is usually shown to be in the fetch stage when it is a valid instruction in the instruction queue. the instruction queue has six entries, iq0?iq5. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-7 instruction timing overview in dispatch entry (iq0/iq1)?instructions can be dispatched from iq0 and iq1. because dispatch is instantaneous, it is perhaps more useful to describe it as an event that marks the point in time between the last cycle in the fetch stage and the first cycle in the execute stage. execute?the operations specified by an instruction are being performed by the appropriate execution unit. the black stripe is a reminder that the instruction occupies an entry in the cq, described in figure 7-3. complete?the instruction is in the cq. in the final stage, the results of the executed instruction are written back and the instruction is retired. the cq has five entries, cq0?cq4. in retirement entry?completed instructions can be retired from cq0 and cq1. like dispatch, retirement is an event that in this case occurs at the end of the final cycle of the complete stage. figure 7-3 shows the stages of g2 core execution units. figure 7-3. g2 core processor pipeline stages fetch in dispatch execute 1 complete/retire fetch in dispatch complete/retire ea fetch complete/retire iu/sru instructions lsu instructions fpu instructions normalize multiply add round/ execute execute calculation cache align entry entry bpu instructions fetch fetch predict complete/retire 2 in dispatch entry in completion queue 2 1 several integer instructions, such as multiply and divide instructions, require multiple cycles in the execute stage. 2 only those branch instructions that update the lr or ctr take an entry in the completion queue. in dispatch entry f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-8 g2 powerpc core reference manual motorola timing considerations 7.3 timing considerations the g2 core is a superscalar processor; as many as three instructions can be dispatched to the execution units (one branch instruction to the branch processing unit, and two instructions dispatched from the dispatch queue to the other execution units) during each clock cycle. only one instruction can be dispatched to each execution unit. although instructions appear to the programmer to execute in program order, the g2 core improves performance by executing multiple instructions at a time, using hardware to manage dependencies. when an instruction is dispatched, the register file provides the source data to the execution unit. the register files and rename register have sufficient bandwidth to allow dispatch of two instructions per clock under most conditions. the bpu decodes and executes branches immediately after they are fetched. when a conditional branch cannot be resolved due to a cr data dependency, the branch direction is predicted and execution continues from the predicted path. if the prediction is incorrect, the following steps are taken: 1. the instruction queue is purged and fetching continues from the correct path. 2. any instructions ahead of the predicted branch in the cq are allowed to complete. 3. instructions after the mispredicted branch are purged. 4. dispatching resumes from the correct path. after an execution unit executes an instruction, it places resulting data into the appropriate gpr or fpr rename register. the results are then stored into the correct gpr or fpr during the write-back stage. if a subsequent instruction needs the result as a source operand, it is made available simultaneously to the appropriate execution unit, which allows a data-dependent instruction to be decoded and dispatched without waiting to read the data from the register file. branch instructions that update either the lr or ctr write back their results in a similar fashion. the following section describes this process in greater detail. 7.3.1 general instruction flow as many as two instructions can be fetched into the instruction queue (iq) in a single clock cycle. instructions enter the iq and are dispatched to the various execution units from the dispatch queue. the iq is a six-entry queue, which together with the cq is the backbone of the master pipeline for the microprocessor. the g2 core tries to keep the iq full at all times. the number of instructions requested in a clock cycle is determined by the number of vacant spaces in the iq during the previous clock cycle. this is shown in the examples in this chapter. although the iq can accept as many as two new instructions in a single clock cycle and even if there are more than two spaces available on the current clock cycle, if only one iq entry was vacant on the previous cycle, only one instruction is fetched. typically, f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-9 timing considerations instructions are fetched from the on-chip instruction cache. if the instruction request hits in the on-chip instruction cache, it can usually present the first two instructions of the new instruction stream in the next clock cycle, giving enough time for the next pair of instructions to be fetched from the cache with no idle cycles. instructions not in the instruction cache are fetched from system memory. branch instructions that do not update the lr or ctr are removed from the instruction stream either by branch folding or removal of fall-through branch instructions, as described in section 7.4.1.1, ?branch folding.? branch instructions that update the lr or ctr are treated as if they require dispatch (even through they are not dispatched to an execution unit in the process). they are assigned a position in the cq to ensure that the ctr and lr are updated sequentially. all other instructions are dispatched from iq0 and iq1. the dispatch rate depends on the availability of resources such as the execution units, rename registers, and cq entries, and on the serializing behavior of some instructions. instructions are dispatched in program order; an instruction in iq1 can be dispatched at the same time as one in iq0, but cannot be dispatched ahead of one in iq0. instruction state and all information required for completion is kept in the five-entry, fifo completion queue. a completion queue entry is allocated for each instruction when it is dispatched to an execute unit; if no entry is available, the dispatch unit stalls. a maximum of two instructions per cycle may be completed and retired from the completion queue, and the flow of instructions can stall when a longer-latency instruction reaches the last position in the completion queue. store instructions and instructions executed by the fpu and sru (with the exception of integer add and compare instructions) can only be retired from the last position in the completion queue. subsequent instructions cannot be completed and retired until that longer-latency instruction completes and retires. examples of this are shown in section 7.3.2.2, ?cache hit,? and section 7.3.2.3, ?cache miss.? the rate of instruction completion is also affected by the ability to write instruction results from the rename registers to the architected registers. the g2 core can perform two write-back operations from the rename registers to the gprs each clock cycle, but can perform only one write-back per cycle to the cr, fpr, lr, and ctr. 7.3.2 instruction fetch timing instruction fetch latency depends on the fetch hits of the on-chip instruction cache. if no hit occurs, a memory transaction is required, in which case fetch latency is affected by bus traffic, bus clock speed, and memory translation. these conditions are discussed in the following sections. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-10 g2 powerpc core reference manual motorola timing considerations 7.3.2.1 cache arbitration when the fetcher requests instructions from the cache, two things may happen. if the instruction cache is idle and the requested instructions are present, they are provided on the next clock cycle. however, if the instruction cache is busy due to a cache-line-reload operation, instructions cannot be fetched until that operation completes. 7.3.2.2 cache hit an instruction fetch that hits the instruction cache takes only one clock cycle after the request for as many as two instructions to enter the iq. note that the cache is not blocked to internal accesses until a cache reload completes (hits under misses). the critical-double-word is written simultaneously to the cache and forwarded to the requesting unit, minimizing stalls due to load delays. figure 7-4 shows a simple example of instruction fetching that hits in the on-chip cache. this example uses a series of integer add , and , and double-precision floating-point add instructions to show how the number of instructions to be fetched is determined, how program order is maintained by the iq and cq, how instructions are dispatched and retired in pairs (maximum), and how the fpu pipeline functions. the following instruction sequence is examined: 0 add 1 fadd 2 add 3 fadd 4 br 6 5 fsub 6 fadd 7 fadd 8 add 9 add 10 and 11 and 12 fadd 13 add 14 fadd 15 . 16 . 17 . f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-11 timing considerations figure 7-4. instruction timing?cache hit the instruction timing for this example is described cycle-by-cycle as follows: 0. in cycle 0, instructions 0 and 1 are fetched from the instruction cache and are placed in the two entries in the instruction queue (iq0 and iq1), where they can be dispatched on the next clock cycle. 0 add 1 fadd 2 add 4 br 5 fsub 6 fadd 8 add 9 add 7 fadd 10 and 11 and 13 add 14 fadd 1 0 5 4 7 6 9 8 7 11 10 9 8 7 12 11 10 9 14 13 12 11 10 14 13 12 11 14 13 12 14 3 2 3 2 1 0 3 2 1 6 3 2 1 6 3 8 7 6 9 8 7 6 10 9 8 7 11 10 9 8 7 13 12 11 10 9 14 13 12 11 1 0 instruction queue completion queue 14 13 12 14 13 12 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 14 12 fadd 3 fadd fetch (in iq) in dispatch entry (iq0/iq1) execute complete (in cq) in retirement entry (cq0/cq1) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-12 g2 powerpc core reference manual motorola timing considerations 1. in cycle 1, instructions 0 and 1 are dispatched to the iu and fpu, respectively. notice that for instructions to be dispatched, they must be assigned positions in the cq. in this case, because the cq is empty, instructions 0 and 1 take the two lowest cq entries (cq0 and cq1). instructions 2 and 3 are fetched from the instruction cache. 2. at least two iq positions were available in the iq in cycle 1, so in cycle 2, instructions 4 and 5 are fetched. instruction 4 is a branch unconditional instruction that resolves immediately as taken. because the branch is taken and does not update ctr or lr, it can be folded from the iq. instruction 0 completes, writes back its results, and vacates the cq by the end of the clock cycle. instruction 1 enters the second fpu execute stage, instruction 2 enters the single-stage iu, and instruction 3 is dispatched into the first fpu stage. 3. in cycle 3, target instructions 6 and 7 are fetched, replacing the folded br instruction 4 and instruction 5. instruction 1 enters the last fpu execute stage, instruction 2 has executed but must remain in the cq until instruction 1 completes. note that it can make its results available to subsequent instructions, but cannot be removed from the cq. instruction 3 passes into the last fpu execute stage. note that all three fpu stages are full. to allow for the potential need for denormalization, the dispatch logic prevents instruction 7 ( fadd ) from being dispatched in the next clock cycle. 4. in cycle 4, target instructions (8 and 9) are fetched. instruction 1 completes in cycle 4, allowing instruction 2, which had finished executing in the previous clock cycle, to be removed from the cq. instruction 6 replaces instruction 3 in the first stage of the fpu. also, as will be shown in cycle 5, a single-cycle stall occurs when the fpu pipeline is full. 5. in cycle 5, instruction 3 completes, instruction 6 continues through the fpu pipeline, and although the first stage of the fpu pipeline is free, instruction 7 cannot be dispatched because of the potential need for one of the previous floating-point instructions to require denormalization. because instruction 7 cannot be dispatched neither can instruction 8. this dispatch stall causes the instruction queue to become full when instructions 10 and 11 are fetched. 6. in cycle 6, instruction 12 is fetched. instruction 7 is dispatched to the first fpu stage, so instruction 8 can also be dispatched to the iu. instructions 9 and 10 move to iq0 and iq1, but because instructions 9, 10, and 11 are integer instructions, only one instruction is dispatched in each of the next two clock cycles. note that moving instruction 12 ( fadd ) up further in the program flow would improve dispatch throughput. 7. in cycle 7, instruction 6 completes, instruction 7 is in the second fpu execute stage, and although instruction 8 has executed, it must wait for instruction 7 to complete. instruction 9 dispatches to the iu. instructions 10 and 11 move down in the iq. fetching resumes with instructions 13 and 14. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-13 timing considerations 8. in cycle 8, instruction 7 is in the third fpu execute stage. instructions 8 and 9 have executed and they remain in the cq until instruction 7 completes. instruction 10 is dispatched to the iu. 9. in cycle 9, instruction 7 completes, allowing instruction 8 to complete. because the cq is full, instructions 12 and 13 cannot be dispatched. 10. in cycle 10, instructions 9 and 10 complete. instruction 11 has executed but cannot exit the cq from cq2. instructions 12 and 13 are dispatched to the fpu and iu, respectively. instruction 14 drops into iq0. 11. in cycle 11, instruction 11 completes and instruction 12 is in the second fpu execute stage. instruction 13 has executed but must remain in the cq until instruction 12 completes. instruction 14 enters the first fpu execute stage. 7.3.2.3 cache miss figure 7-5 shows an instruction fetch that misses the on-chip cache and shows how that fetch affects the instruction dispatch. note that a processor/bus clock ratio of 1:2 is used. the same instruction sequence is used as in section 7.3.2.2, ?cache hit.? a cache miss extends the latency of the fetch stage, so in this example, the fetch stage represents not only the time the instruction spends in the iq but also the time required for the instruction to be loaded from system memory, beginning in clock cycle 3. during clock cycle 2, the target instruction for the br instruction is not in the instruction cache; therefore, a memory access must occur. during clock cycle 5, the address of the block of instructions is sent to the system bus. during clock cycle 9, two instructions (64 bits) are returned from memory on the first beat and are forwarded both to the cache and instruction fetcher. 7.3.3 instruction dispatch and completion considerations several factors affect the ability of the g2 core to dispatch instructions at a peak rate of two per cycle?the availability of the execution unit, destination rename registers, and completion queue, as well as the handling of completion-serialized instructions. several of these limiting factors are illustrated in the previous instruction timing examples. to reduce dispatch unit stalls due to instruction data dependencies, the g2 core provides a single-entry reservation station for the fpu, sru, and each iu, and a two-entry reservation station for the lsu. if a data dependency keeps an instruction from starting execution, that instruction is dispatched to the reservation station associated with its execution unit (and the rename registers are assigned), thereby freeing the positions in the instruction queue so instructions can be dispatched to other execution units. execution begins during the same clock cycle that the rename buffer is updated with the data the instruction is dependent on. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-14 g2 powerpc core reference manual motorola timing considerations figure 7-5. instruction timing?cache miss if both instructions in iq0 and iq1 require the same execution unit, the instruction in iq1 cannot be dispatched until the first instruction proceeds through the pipeline and provides the subsequent instruction with a vacancy in the requested execution unit. the completion unit maintains program order after instructions are dispatched, guaranteeing in-order completion and a precise exception model. completing an instruction implies committing execution results to the architected destination registers. in-order completion ensures the correct architectural state when the core must recover from a mispredicted branch or an exception. 0 add 1 fadd 2 add 3 fadd address data 012 8 3 4 56 910 11 12 13 14 15 16 17 18 7 19 instruction queue 5 4 7 6 7 9 11 10 11 13 12 9 8 1 0 3 2 3 2 1 0 3 2 1 3 2 1 3 6 8 7 6 9 8 7 6 13 12 13 12 10 9 8 7 11 10 9 7 6 1 0 completion queue 13 12 6 fadd 7 fadd 5 fsub 4 br fetch (in iq) in dispatch entry (iq0/iq1) execute complete (in cq) in retirement entry (cq0/cq1) 10 and 11 and 12 fadd 13 add 9 add 13 12 11 8 add f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-15 timing considerations the g2 core can execute instructions out-of-order, but in-order completion by the completion unit ensures a precise exception mechanism. program-related exceptions are signaled when the instruction causing the exception reaches the last position in the completion queue. prior instructions are allowed to complete before the exception is taken. 7.3.3.1 rename register operation to avoid contention for a given register file location, the g2 core provides rename registers for holding instruction results before the completion commits them to the architected register. there are five gpr rename registers, four fpr rename registers, and one each for the cr, lr, and ctr. when an instruction dispatches to its execution unit, any required rename registers are allocated for the results of that instruction. if an instruction is dispatched to the reservation station associated with an execution unit due to a data dependency, the dispatcher also provides a tag to the execution unit identifying the rename register that forwards the required data at completion. when the source data reaches the rename register, execution can begin. instruction results are transferred from rename registers to architected registers when an instruction is retired from the cq after any associated exceptions are handled and any predicted branch conditions preceding it in the cq are resolved. if a branch prediction is incorrect, the instructions following the branch are flushed from the cq and any results of those instructions are flushed from the rename registers. 7.3.3.2 instruction serialization although the g2 core can dispatch and complete two instructions per cycle, serializing instructions can be used to limit dispatch and completion to one instruction per cycle. serialization falls into three categories?completion, dispatch, and refetch serialization, which are described as follows: completion serialized instructions are held in the execution unit until all prior instructions in the completion unit have been retired. completion serialization is used for instructions that access or modify a resource for which no rename register exists. results from these instructions are not available or forwarded for subsequent instructions until the serializing instruction is retired. instructions that are completion serialized are as follows: ? instructions (with the exception of integer add and compare instructions) executed by the system register unit (sru) ? floating-point instructions that access or modify the fpscr or cr ( mtfsb1 , mcrfs , mtfsfi , mffs , and mtfsf ). ? instructions that manage caches and tlbs f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-16 g2 powerpc core reference manual motorola execution unit timings ? instructions that directly access the gprs (load and store multiple word and load and store string instructions) ? instructions defined by the architecture to have synchronizing behavior dispatch serialized inhibit the dispatching of subsequent instructions until the serializing instruction is retired. dispatch serialization is used for instructions that access renamed resources used by the dispatcher, and for instructions requiring refetch serialization, including the following: ? the load multiple instructions, lmw , lswi , and lswx . ? the mtspr (xer) and mcrxr instructions ? the synchronizing instructions, sync , isync , mtmsr , rfi , rfci (for the g2_le core) and sc . refetch serialized instructions inhibit dispatching of subsequent instructions and force the refetching of subsequent instructions after the serializing instructions are retired. the context synchronizing instruction, isync , is refetch serializing. 7.3.3.3 execution unit considerations as previously noted, the g2 core can dispatch and retire two instructions per clock cycle. the peak dispatch rate is affected by the availability of execution units on each clock cycle. for an instruction to be dispatched, the required execution unit must be available. the dispatcher monitors the availability of all execution units and suspends instruction dispatch if the required execution unit is unavailable. an execution unit may not be available if it can accept and execute only one instruction per cycle or if an execution unit?s pipeline becomes full, which may occur if instruction execution takes more clock cycles than the number of pipeline stages in the unit and additional instructions are dispatched to that unit to fill the remaining pipeline stages. 7.4 execution unit timings the following sections describe instruction timing considerations for each execution unit. 7.4.1 branch processing unit execution timing flow control operations (conditional branches, unconditional branches, and traps) are typically expensive to execute in most machines because they disrupt normal flow in the instruction stream. when a change in program flow occurs, the iq must be reloaded with the target instruction stream. during this time the execution units will be idle. however, previously dispatched instructions will continue to execute while the new instruction stream makes its way into the iq. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-17 execution unit timings performance features such as branch folding and static branch prediction help minimize penalties associated with flow control operations. the timing for branch instruction execution is determined by many factors including the following: whether the branch requires prediction whether the branch is predicted as taken or not taken whether the branch is taken whether the target instruction stream is in the on-chip cache whether the prediction is correct 7.4.1.1 branch folding when a branch instruction is encountered by the fetcher, the bpu immediately tries to pull that instruction out of the instruction stream and resolve it. when the bpu removes the branch instruction from the stream, the subsequent instruction is shifted down to take the place of the removed branch instruction. this technique is called branch folding. often, it eliminates the penalties of flow control instructions because instruction execution proceeds as though the branch were never there. if the folded branch instruction changes program flow (the branch is said to be taken), the bpu immediately requests the instructions at the new target from the on-chip cache. in most cases, the new instructions arrive in the iq before any bubbles are introduced into the execution units. if the folded branch does not change program flow (the branch is not taken), the branch instruction is already removed and execution continues as if there were never a branch in the original sequence. when a conditional branch cannot be resolved due to a cr data dependency, the branch is executed by means of static branch prediction and instruction fetching proceeds down the predicted path. if the prediction is incorrect when the branch is resolved, the iq and all subsequently executed instructions are purged, instructions executed before the predicted branch are allowed to complete, and instruction fetching resumes down the correct path. there are several situations where instruction sequences create dependencies that prevent a branch instruction from being resolved immediately, thereby causing execution of the subsequent instruction stream based on the predicted outcome of the branch instruction. the instruction sequences, and the resulting action of the branch instruction is described as follows: an mtspr (lr) followed by a bclr ?fetching is stopped and the branch waits for the mtspr to execute. an mtspr (ctr) followed by a bcctr ?fetching is stopped and the branch waits for the mtspr to execute. an mtspr (ctr) followed by a bc (ctr)?fetching is stopped and the branch waits for the mtspr to execute. (note: branch conditions can be a function of the ctr and f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-18 g2 powerpc core reference manual motorola execution unit timings cr; if the ctr condition is sufficient to resolve the branch, then a cr-dependency is ignored.) a bc (ctr) followed by another bc (ctr)?fetching is stopped, and the second branch waits for the first to be completed. a bc (ctr) followed by a bcctr ?fetching is stopped, and the bcctr waits for the first branch to be completed. a branch(lk = 1) followed by a branch(lk = 1)?fetching is stopped, and the second branch waits for the first branch to be completed. (note: a bl instruction does not have to wait for a branch(lk = 1) to complete.) a bc (based-on-cr) waiting for resolution due to a cr-dependency followed by a bc (based-on-cr)?fetching is stopped and the second branch waits for the first cr-dependency to be resolved. 7.4.1.2 static branch prediction static branch prediction allows software (for example, compilers) to give a hint to the machine hardware about the direction the branch is likely to take. when a branch instruction encounters a data dependency, the bpu waits for the required condition code to become available. rather than stalling instruction dispatch until the source operand is ready, the g2 core predicts the likely path and instructions are fetched and executed along that path. when the branch operand becomes available, the branch is evaluated. if the prediction is correct, program flow continues along that path uninterrupted; otherwise, the processor backs up and program flow resumes along the correct path. if the target address of the branch (link or count register) is modified by an instruction that appears before the branch instruction, the bpu waits until the target address is available. the g2 core executes through one level of prediction. the processor may not predict a branch if a prior branch instruction is still unresolved. the number of instructions that can be executed after branch prediction is limited by the fact that instructions in the predicted stream cannot update the register files or memory until the branch is resolved. that is, instructions may be dispatched and executed, but cannot reach the write-back stage in the completion unit, instead, it stalls in the completion queue. when cq is full, no more instructions can be dispatched. in the case of a misprediction, the g2 core is able to redirect the machine state rather effortlessly because the programing model has not been updated. when a branch is found to be mispredicted, all instructions that were dispatched subsequent to the predicted branch instruction are simply flushed from the completion queue, and their results flushed from the rename registers. no architected register state needs to be restored because no architected register state was modified by the instructions following the unresolved predicted branch. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-19 execution unit timings 7.4.1.2.1 predicted branch timing examples figure 7-6 shows how both taken and non-taken branches are handled and how the g2 core handles both correct and incorrect predictions. the example shows the timing for the following instruction sequence (note that the first bc instruction is correctly taken, whereas the second bc is incorrectly predicted): 0 add 1 add 2bc 3 mulhw 4 bc t0 5 fadd 6 and t0 add t1 add t2 add t3 add t4 and t5 or 0. during clock cycle 0, instructions 0 and 1 are dispatched in the beginning of clock cycle 1. 1. in clock cycle 1, instructions 2 and 3 are fetched in the iq. instruction 2 is a branch instruction that updates the ctr and instruction 3 is a mulhw instruction on which instruction 4 depends. instruction 0 enters the iu. instruction 1 has a single-cycle stall. 2. in clock cycle 2, instructions 4 (a second bc instruction) and 5 are fetched. the second bc instruction is predicted as taken. it can be folded, but it cannot be resolved until instruction 3 writes back. instruction 0 completes at the end of this cycle. instruction 1 is dispatched to the iu. instruction 2 takes entry in the cq. 3. in clock cycle 3, target instruction t0 and t1 are fetched. instructions 1 and 2 complete, instruction 4 has been folded, and instruction 5 has been flushed from the iq. instruction 3 is assigned to cq2. 4. in clock cycle 4, target instructions t2 and t3 are fetched. iu instructions t0 and t1 have multiple stalls as one execution possible in a clock cycle. instruction 3 is assigned to cq0. 5. in clock cycle 5, instruction 3, on which the second branch instruction depended, writes back and the branch prediction is proven incorrect. even though t0 is in cq0, where it could be written back, it is not because the prediction was incorrect. all target instructions are flushed from their positions in the pipeline at the end of this clock cycle, as there are many results in the rename registers. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-20 g2 powerpc core reference manual motorola execution unit timings figure 7-6. branch instruction timing after one clock cycle required to refetch the original instruction stream, instruction 5, the same instruction that was fetched in clock cycle 2, is brought back into the iq from the instruction cache, along with one other. 7.4.2 integer unit execution timing the integer unit executes all integer and bit-field computational instructions. many of these instructions execute in a single clock cycle. the integer unit has one execute stage so when 0 add 1 add 2 bc 3 mulhw 4 bc 5 fadd t1 add t2 add t3 add 6 and 01 2 8 3 4 56 10 11 7 9 5 fadd 1 0 5 4 3 t1 t0 5 t3 t2 t1 t0 t5 t4 t3 t2 t1 6 5 3 2 1 instruction queue 2 1 0 3 2 1 3 t0 3 6 5 0 completion queue t4 add t5 or t0 add fetch (in iq) in dispatch entry (iq0/iq1) execute complete (in cq) in retirement entry (cq0/cq1) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-21 execution unit timings a multiple-cycle integer instruction is executed, no other integer instructions can also begin to execute. see table 7-4 for integer instruction execution timing. 7.4.3 floating-point unit execution timing the fpu on the g2 core executes all floating-point computational instructions. the lsu performs integer floating-point loads and stores. execution of most floating-point instructions is pipelined within the fpu, allowing up to three instructions to be executing in the fpu concurrently. while most floating-point instructions execute with three- or four-cycle latency, and one- or two-cycle throughput, three instructions ( fdivs , fdiv , and fres ) execute with latencies of 18 to 33 cycles. the fdivs , fdiv , fres , mtfsb0 , mtfsb1 , mtfsfi , mffs , and mtfsf instructions block the floating-point unit pipeline until they complete execution, and thereby inhibit the dispatch of additional floating-point instructions. with the exception of the mcrfs instruction, all floating-point instructions will immediately forward their cr results to the bpu for fast branch resolution without waiting for the instruction to be retired by the completion unit, and the cr updated. see table 7-5 for floating-point instruction execution timing. 7.4.4 load/store unit execution timing the lsu executes all floating-point and integer loads and stores. it also executes other instructions that address memory. the execution of most load and store instructions is pipelined. the lsu has two pipeline stages; the first is for effective address calculation and mmu translation, and the second is for accessing the physically addressed memory. load and store instructions have a two-cycle latency and one-cycle throughput. if operands are misaligned, additional latency may be required either for an alignment exception to be taken or for additional bus accesses. load instructions that miss in the cache prevent subsequent cache accesses during the cache line refill. see table 7-6 for load and store instruction execution timing. 7.4.5 system register unit execution timing most sru instructions access or modify nonrenamed registers, or directly access renamed registers. they generally execute in a serial manner. results from these instructions are not available or forwarded for use by subsequent instructions until the instruction completes and is retired. the sru can also execute the integer instructions addi , addis , add , addo , cmpi , cmp , cmpli , and cmpl without serialization and in parallel with another integer instruction. refer to section 7.3.3.2, ?instruction serialization,? for additional information on serializing instructions and table 7-2, table 7-3, and table 7-4 for sru instruction execution timing. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-22 g2 powerpc core reference manual motorola memory performance considerations 7.5 memory performance considerations due to the g2 core instruction throughput of three instructions per clock cycle, lack of data bandwidth can become a performance bottleneck. for the g2 core to approach its potential performance levels, it must be able to read and write data quickly and efficiently. if there are many processors in a system environment, one processor may experience long memory latencies while another bus master (for example, a direct-memory access controller) is using the external bus. to alleviate this possible contention, the g2 core provides three memory update modes?copy-back, write-through, and cache-inhibit. each page of memory is specified to be in one of these modes. if a page is in copy-back mode, data being stored to that page is written only to the on-chip cache. if a page is in write-through mode, writes to that page update the on-chip cache on hits and always update main memory. if a page is cache-inhibited, data in that page will never be stored in the on-chip cache. all three of these modes of operation have advantages and disadvantages. a decision as to which mode to use depends on the system environment as well as the application. the following sections describe how performance is impacted by each memory update mode. for details about the operation of the on-chip cache and the memory update modes, see chapter 4, ?instruction and data cache operation.? 7.5.1 copy-back mode when data is stored in a location marked as copy back, store operations for cacheable data do not necessarily cause an external bus cycle to update memory. instead, memory updates only occur on modified line replacements, cache flushes, or when another processor attempts to access a specific address for which there is a corresponding modified cache entry. for this reason, copy-back mode may be preferred when external bus bandwidth is a potential bottleneck?for example, in a multiprocessor environment. copy-back mode is also well suited for data that is closely coupled to a processor, such as local variables. if more than one device uses data stored in a page marked as copy back, snooping must be enabled to allow copy-back operations and cache invalidations of modified data. the g2 core implements snooping hardware to prevent other devices from accessing invalid data. when bus snooping is enabled, depending on the device integration, the processor can monitor the transactions of the other devices. for example, if another device accesses a memory location and its memory-coherent (m) bit is set and the g2 core on-chip cache has a modified value for that address, the processor preempts the bus transaction and updates memory with the cache data. if the cache contents associated with the snooped address are unmodified, the g2 core invalidates the cache block. the other device can then attempt an access to the updated address. see chapter 4, ?instruction and data cache operation.? copy-back mode provides complete cache/memory coherency as well as maximizing available external bus bandwidth. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-23 instruction scheduling guidelines 7.5.2 write-through mode store operations to memory in write-through mode always update memory as well as the on-chip cache (on cache hits). write-through mode is used when the data in the cache must always agree with external memory (for example, video memory), when shared (global) data may be used frequently, or when allocation of a cache line on a cache miss is undesirable. automatic copy back of cached data is not performed if that data is from a memory page marked as write-through mode because valid cache data always agrees with memory. stores to memory that are in write-through mode may cause a decrease in performance. each time a store is performed to memory in write-through mode, the bus is potentially busy for the extra clock cycles required to update memory; therefore, load operations that miss the on-chip cache must wait while the external store operation completes. 7.5.3 cache-inhibited accesses data for a page marked cache-inhibited cannot be stored in the on-chip cache. areas of the memory map can be cache-inhibited by the operating system. if a cache-inhibited access hits in the on-chip cache, the corresponding cache line is invalidated. if the line is marked modified, it is copied back to memory before being invalidated. in summary, the copy-back mode allows both load and store operations to use the on-chip cache. the write-through mode allows load operations to use the on-chip cache, but store operations cause a memory access and a cache update if the data is already in the cache. lastly, the cache-inhibited mode causes memory access for both loads and stores. 7.6 instruction scheduling guidelines the performance of the g2 core can be improved by avoiding resource conflicts and promoting parallel utilization of execution units through efficient instruction scheduling. instruction scheduling on the g2 core can be improved by observing the following guidelines: implement good static branch prediction (setting of y bit in bo field). when branch prediction is uncertain, or an even probability, predict fall through. to reduce mispredictions, separate the instruction that sets cr bits from the branch instruction that evaluates them; separation by more than nine instructions ensures that the cr bits will be immediately available for evaluation. when branching conditionally to a location specified by count registers (ctrs) or link registers (lrs), or when branching conditionally based on the value in the count register, separate the mtspr instruction that initializes the ctr or lr from the f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-24 g2 powerpc core reference manual motorola instruction scheduling guidelines branch instruction performing the evaluation. separation of the branch and mtspr instruction by more than nine instructions ensures the register values will be immediately available for use by the branch instruction. schedule instructions such that they can dual dispatch. schedule instructions to minimize stalls when an execution unit is busy. avoid using serializing instructions. schedule instructions to avoid dispatch stalls due to renamed resource limitations. ? only five instructions can be in execute-complete stage at any one time. ? only five gpr destinations can be in execute-complete-deallocate stage at any one time. note that load with update address instructions use two destination registers. ? only four fpr destinations can be in execute-complete-deallocate stage at any one time. 7.6.1 branch, dispatch, and completion unit resource requirements this section describes the specific resources required to avoid stalls during branch resolution, instruction dispatching, and instruction completion. 7.6.1.1 branch resolution resource requirements the following is a list of branch instructions and the resources required to avoid stalling the fetch unit in the course of branch resolution: the bclr instruction requires lr availability. the bcctr instruction requires ctr availability. branch and link instructions require shadow lr availability. the branch conditional on counter decrement and cr condition requires ctr availability or the cr condition must be false, and the g2 core cannot be executing instructions following an unresolved predicted branch when the branch is encountered by the bpu. the branch conditional on cr condition cannot be executed following an unresolved predicted branch instruction. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-25 instruction scheduling guidelines 7.6.1.2 dispatch unit resource requirements the following is a list of resources required to avoid stalls in the dispatch unit. note that the two dispatch buffers, iq0 and iq1, are at the bottom of the instruction queue: requirements for dispatching from iq0 are as follows: ? needed execution unit available ? needed gpr rename registers available ? needed fpr rename registers available ? completion queue is not full ? instruction is dispatch serialized and completion buffer is empty ? a dispatch serialized instruction is not currently being executed requirements for dispatching from iq1 are as follows: ? instruction in iq0 must dispatch ? instruction dispatched by iq0 is not dispatch serialized ? needed execution unit is available (after dispatch from iq0) ? needed gpr rename registers are available (after dispatch from iq0) ? needed fpr rename register is available (after dispatch from iq0) ? completion queue is not full (after dispatch from iq0) ? instruction dispatched from iq1 is not dispatch serialized 7.6.1.3 completion unit resource requirements the following is a list of resources required to avoid stalls in the completion unit; note that the two completion buffers are described as cq0 and cq1, where cq0 is the entry at the end of the completion queue: requirements for completing an instruction from cq0 are as follows: ? instruction in cq0 must be finished ? instruction in cq0 must not follow an unresolved predicted branch ? instruction in cq0 must not cause an exception requirements for completing an instruction from cq1 are as follows: ? instruction in cq0 must complete in same cycle ? instruction in cq1 must be finished ? instruction in cq1 must not follow an unresolved predicted branch ? instruction in cq1 must not cause an exception ? instruction in cq1 must be an integer or load instruction ? number of cr updates from both cq0 and cq1 must not exceed one f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-26 g2 powerpc core reference manual motorola instruction latency summary ? number of gpr updates from both cq0 and cq1 must not exceed two ? number of fpr updates from both cq0 and cq1 must not exceed one 7.7 instruction latency summary table 7-1 through table 7-6 list the latencies associated with each instruction executed by the g2 core. note that the instruction latency tables contain no 64-bit architected instructions. these instructions will trap to an illegal instruction exception handler when encountered. recall that the term latency is defined as the total time it takes to execute an instruction and make ready the results of that instruction. table 7-1 provides the latencies for the branch instructions. table 7-2 provides the latencies for the system register instructions. table 7-1. branch instructions mnemonic primary extended unit latency (in cycles) 1 1 these operations may be folded for an effective cycle time of 0. bc [ l ][ a ] 16 ? bpu 1 b [ l ][ a ] 18 ? bpu 1 bclr [ l ] 19 016 bpu 1 bcctr [ l ] 19 528 bpu 1 table 7-2. system register instructions mnemonic primary extended unit latency (in cycles) sc 17 - -1 sru 3 rfi , rfci (g2_le only) 19 050 sru 3 isync 19 150 sru 1& mfmsr 31 083 sru 1 mtmsr 31 146 sru 2 mtsr 31 210 sru 2 mtsrin 31 242 sru 2 mfspr (not i/dbats) 31 339 sru 1 mfspr (dbats) 31 339 sru 3& mfspr (ibats) 31 339 sru 3& mtspr (not ibats) 31 467 sru 2 (xer-&) mtspr (ibats) 31 467 sru 2& mfsr 31 595 sru 3& sync 31 598 sru 1& f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-27 instruction latency summary table 7-3 provides the latencies for the condition register logical instructions. table 7-4 provides the latencies for the integer instructions. mfsrin 31 659 sru 3& eieio 31 854 sru 1 mftb 31 371 sru 1 mttb 31 467 sru 1 note: cycle times marked with & require a variable number of cycles due to serialization. table 7-3. condition register logical instructions mnemonic primary extended unit latency (in cycles) mcrf 19 000 sru 1 crnor 19 033 sru 1 crandc 19 129 sru 1 crxor 19 193 sru 1 crnand 19 225 sru 1 crand 19 257 sru 1 creqv 19 289 sru 1 crorc 19 417 sru 1 cror 19 449 sru 1 mfcr 31 019 sru 1 mtcrf 31 144 sru 1 mcrxr 31 512 sru 1& note: cycle times marked with & require a variable number of cycles due to serialization. table 7-4. integer instructions mnemonic primary extended unit latency (in cycles) twi 03 ? integer 2 mulli 07 ? integer 2,3 subfic 08 ? integer 1 cmpli 10 ? integer & sru 1^ cmpi 11 ? integer & sru 1^ addic 12 ? integer 1 table 7-2. system register instructions (continued) mnemonic primary extended unit latency (in cycles) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-28 g2 powerpc core reference manual motorola instruction latency summary addic. 13 ? integer 1 addi 14 ? integer & sru 1 addis 15 ? integer & sru 1 rlwimi [ . ] 20 ? integer 1 rlwinm [ . ] 21 ? integer 1 rlwnm [ . ] 23 ? integer 1 ori 24 ? integer 1 oris 25 ? integer 1 xori 26 ? integer 1 xoris 27 ? integer 1 andi. 28 ? integer 1 andis. 29 ? integer 1 cmp 31 000 integer & sru 1^ tw 31 004 integer 2 subfc [ o ][ . ] 31 008 integer 1 addc [ o ][ . ] 31 010 integer 1 mulhwu [ . ] 31 011 integer 2,3,4,5,6 slw [ . ] 31 024 integer 1 cntlzw [ . ] 31 026 integer 1 and [ . ] 31 028 integer 1 cmpl 31 032 integer & sru 1^ subf [ . ] 31 040 integer 1 andc [ . ] 31 060 integer 1 mulhw [ . ] 31 075 integer 2,3,4,5 neg [ o ][ . ] 31 104 integer 1 nor [ . ] 31 124 integer 1 subfe [ o ][ . ] 31 136 integer 1 adde [ o ][ . ] 31 138 integer 1 subfze [ o ][ . ] 31 200 integer 1 addze [ o ][ . ] 31 202 integer 1 subfme [ o ][ . ] 31 232 integer 1 addme [ o ][ . ] 31 234 integer 1 mull [ o ][ . ] 31 235 integer 2,3,4,5 add [ o ][ . ] 31 266 integer & sru 1 1 eqv [ . ] 31 284 integer 1 table 7-4. integer instructions (continued) mnemonic primary extended unit latency (in cycles) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-29 instruction latency summary table 7-5 provides the latencies for the floating-point instructions. xor [ . ] 31 316 integer 1 orc [ . ] 31 412 integer 1 or [ . ] 31 444 integer 1 divwu [ o ][ . ] 31 459 integer 20 nand [ . ] 31 476 integer 1 divw [ o ][ . ] 31 491 integer 20 srw [ . ] 31 536 integer 1 sraw [ . ] 31 792 integer 1 srawi [ . ] 31 824 integer 1 extsh [ . ] 31 922 integer 1 extsb [ . ] 31 954 integer 1 note: ^ indicates that the cycle time immediately forwards their cr results to the bpu for fast branch resolution. 1 the sru can only execute the add and add [ o ] instructions. table 7-5. floating-point instructions mnemonic primary extended unit latency (in cycles) fdivs [ . ] 59 018 fpu 18^ fsubs [ . ] 59 020 fpu 1-1-1^ fadds [ . ] 59 021 fpu 1-1-1^ fres [ . ] 59 024 fpu 18^ fmuls [ . ] 59 025 fpu 1-1-1^ fmsubs [ . ] 59 028 fpu 1-1-1^ fmadds [ . ] 59 029 fpu 1-1-1^ fnmsubs [ . ] 59 030 fpu 1-1-1^ fnmadds [ . ] 59 031 fpu 1-1-1^ fcmpu 63 000 fpu 1-1-1^ frsp [ . ] 63 012 fpu 1-1-1^ fctiw [ . ] 63 014 fpu 1-1-1^ fctiwz [ . ] 63 015 fpu 1-1-1^ fdiv [ . ] 63 018 fpu 33^ fsub [ . ] 63 020 fpu 1-1-1^ fadd [ . ] 63 021 fpu 1-1-1^ table 7-4. integer instructions (continued) mnemonic primary extended unit latency (in cycles) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-30 g2 powerpc core reference manual motorola instruction latency summary table 7-6 provides latencies for the load and store instructions. fsel [ . ] 63 023 fpu 1-1-1^ fmul [ . ] 63 025 fpu 2-1-1^ frsqrte [ . ] 63 026 fpu 1-1-1^ fmsub [ . ] 63 028 fpu 2-1-1^ fmadd [ . ] 63 029 fpu 2-1-1^ fnmsub [ . ] 63 030 fpu 2-1-1^ fnmadd [ . ] 63 031 fpu 2-1-1^ fcmpo 63 032 fpu 1-1-1^ mtfsb1 [ . ] 63 038 fpu 1-1-1&^ fneg [ . ] 63 040 fpu 1-1-1^ mcrfs 63 064 fpu 1-1-1& mtfsb0 [ . ] 63 070 fpu 1-1-1&^ fmr [ . ] 63 072 fpu 1-1-1^ mtfsfi [ . ] 63 134 fpu 1-1-1&^ fnabs [ . ] 63 136 fpu 1-1-1^ fabs [ . ] 63 264 fpu 1-1-1^ mffs [ . ] 63 583 fpu 1-1-1&^ mtfsf [ . ] 63 711 fpu 1-1-1&^ notes: cycle times marked with & require a variable number of cycles due to completion serialization. cycle times marked with ^ immediately forward their cr results to the bpu for fast branch resolution. cycle times marked with a - specify the number of clock cycles in each pipeline stage. instructions with a single entry in the cycles column are not pipelined. table 7-6. load and store instructions mnemonic primary extended unit latency (in cycles) lwarx 31 020 lsu 2:1 lwzx 31 023 lsu 2:1 dcbst 31 054 lsu 2/5& lwzux 31 055 lsu 2:1 dcbf 31 086 lsu 2/5& lbzx 31 087 lsu 2:1 lbzux 31 119 lsu 2:1 stwcx. 31 150 lsu 8 table 7-5. floating-point instructions (continued) mnemonic primary extended unit latency (in cycles) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 7. instruction timing 7-31 instruction latency summary stwx 31 151 lsu 2:1 stwux 31 183 lsu 2:1 stbx 31 215 lsu 2:1 dcbtst 31 246 lsu 2 stbux 31 247 lsu 2:1 dcbt 31 278 lsu 2 lhzx 31 279 lsu 2:1 tlbie 31 306 lsu 3& eciwx 31 310 lsu 2:1 lhzux 31 311 lsu 2:1 lhax 31 343 lsu 2:1 lhaux 31 375 lsu 2:1 sthx 31 407 lsu 2:1 ecowx 31 438 lsu 2:1 sthux 31 439 lsu 2:1 dcbi 1 31 470 lsu 2& lswx 31 533 lsu 2 + n & lwbrx 31 534 lsu 2:1 lfsx 31 535 lsu 2:1 tlbsync 31 566 lsu 2& lfsux 31 567 lsu 2:1 lswi 31 597 lsu 2 + n & lfdx 31 599 lsu 2:1 lfdux 31 631 lsu 2:1 stswx 31 661 lsu 1 + n & stwbrx 31 662 lsu 2:1 stfsx 31 663 lsu 2:1 stfsux 31 695 lsu 2:1 stswi 31 725 lsu 1 + n & stfdx 31 727 lsu 2:1 stfdux 31 759 lsu 2:1 lhbrx 31 790 lsu 2:1 sthbrx 31 918 lsu 2:1 tlbld 31 978 lsu 2& icbi 31 982 lsu 3& table 7-6. load and store instructions (continued) mnemonic primary extended unit latency (in cycles) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 7-32 g2 powerpc core reference manual motorola instruction latency summary stfiwx 31 983 lsu 2:1 tlbli 31 1010 lsu 3& dcbz 31 1014 lsu 10& lwz 32 ? lsu 2:1 lwzu 33 ? lsu 2:1 lbz 34 ? lsu 2:1 lbzu 35 ? lsu 2:1 stw 36 ? lsu 2:1 stwu 37 ? lsu 2:1 stb 38 ? lsu 2:1 stbu 39 ? lsu 2:1 lhz 40 ? lsu 2:1 lhzu 41 ? lsu 2:1 lha 42 ? lsu 2:1 lhau 43 ? lsu 2:1 sth 44 ? lsu 2:1 sthu 45 ? lsu 2:1 lmw 46 ? lsu 2 + n & stmw 47 ? lsu 1 + n & lfs 48 ? lsu 2:1 lfsu 49 ? lsu 2:1 lfd 50 ? lsu 2:1 lfdu 51 ? lsu 2:1 stfs 52 ? lsu 2:1 stfsu 53 ? lsu 2:1 stfd 54 ? lsu 2:1 stfdu 55 ? lsu 2:1 notes: cycle times marked with & require a variable number of cycles due to serialization. cycle times marked with a / specify hit and miss times for cache management instructions that require conditional bus activity. cycle times marked with a : specify cycles of total latency and throughput. load and store multiple and string instruction cycles are shown as a fixed number of cycles plus a variable number of cycles where n is the number of words accessed by the instruction. 1 the dcbi instruction should never be used on the g2 core. table 7-6. load and store instructions (continued) mnemonic primary extended unit latency (in cycles) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-1 chapter 8 signal descriptions this chapter describes the signals of the g2 core that are candidates for being driven as external device signals. it contains a concise description of the individual signals, showing behavior when the signal is asserted and negated, which signals are input/output pairs with output enable signals, and which signals also have high-impedance control signals. note a bar over a signal name indicates that the signal is active-low?for example, core_artry (address retry) and core_ ts (transfer start). active-low signals are referred to as asserted (active) when they are low and negated when they are high. signals that are not active-low, such as core_ap[0:3] (address bus parity signals) and core_tt[0:4] (transfer type signals) are referred to as asserted when they are high and negated when they are low. 8.1 signal groupings the g2 core 60x bus interface protocol signals are grouped as follows: address arbitration signals?the g2 core uses these signals to arbitrate for 60x address bus mastership. address transfer start signals?these signals indicate that a bus master has begun a transaction on the address bus of the 60x bus. address transfer signals?these signals, consisting of the address bus, address parity, and address parity error signals, are used to transfer the address and to ensure the integrity of the transfer. transfer attribute signals?these signals provide information about the type of transfer, such as the transfer size and whether the transaction is bursted, write-through, or cache-inhibited. address transfer termination signals?these signals are used to acknowledge the end of the address phase of the transaction. they also indicate whether a condition exists that requires the address phase to be repeated. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-2 g2 powerpc core reference manual motorola signal groupings data arbitration signals?the g2 core uses these signals to arbitrate for data bus mastership of the 60x data bus. data transfer signals?these signals, consisting of the data bus, data parity, and data parity error signals, are used to transfer the data and to ensure the integrity of the transfer. data transfer termination signals?data termination signals are required after each data beat in a data transfer. in a single-beat transaction, the data termination signals also indicate the end of the tenure. in burst accesses, the data termination signals apply to individual beats and indicate the end of the tenure only after the final data beat. they also indicate whether a condition exists that requires the data phase to be repeated. output enable signals?these output signals indicate that the corresponding outputs of the g2 core are driving, provided the corresponding high-impedance control signal is also asserted. high-impedance control signals?these input signals (static) enable the operation of the output-enable signals. input enable signals?when these input signals are asserted, it indicates that they expect to receive valid data into the core. in addition, there are many other signals on the g2 core that control and affect other aspects of the device, aside from the bus protocol. they are as follows: system status signals?these signals include the external interrupt signal, the critical interrupt signal (g2_le only), checkstop signals, and both soft- and hard-reset signals. these signals are used to interrupt and, under various conditions, to reset the core. reset configuration signals?these signals are sampled while core_hreset is asserted and they control certain modes of operation. jtag/cop interface signals?the jtag (ieee 1149.1) interface and common on-chip processor (cop) unit provides a serial interface to the system for performing monitoring and boundary tests. processor status?these signals include the memory reservation signal, machine quiesce control signals, time base enable signal, and core_tlbisync signal. debug control?these signals are implemented to control debug features of the powerpc architecture with respect to the g2 and g2_le cores. clock signals?these signals provide for system clock input and frequency control. test interface signals?signals like address matching, combinational matching, and watchpoint are used in the g2_le for production testing. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-3 signal configurations 8.2 signal configurations this section provides various mappings of the g2 core signals. 8.2.1 functional groupings figure 8-1 shows how the g2 core signals are grouped by function. figure 8-1. functional signal groups 8.2.2 input/output enable and high-impedance control signals the g2 core splits the bidirectional signals of the 60x bus into separate input and output signal pairs. in addition, high-impedance signals are included, allowing these input and output signals to be reconnected into a bidirectional signal elsewhere on the device. table 8-1 maps the high-impedance control signals and the output-enable and input-enable indicators to their corresponding 60x bus signals. each signal in the left column applies to all of the signals in the right column in the same row. g2 core 1.5 v address arbitration transfer attribute address transfer address start clocks data arbitration data termination interrupt, checkstops debug control jtag/cop interface processor status output enable input enable high-impedance control data transfer address termination test interface reset f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-4 g2 powerpc core reference manual motorola signal configurations . table 8-1. input/output enable and high-impedance signal mappings input/output enable and high-impedance control signals affected signals core_a_oe core_a_tre core_ap_ien core_a_out[0:31] core_ap_out[0:3] core_ci core_cse[0:1] core_gbl_out core_tbst_out core_tc[0:1] core_tsiz[0:2] core_ts_out core_tt_out[0:4] core_wt core_d_oe core_d_tre core_dh_out[0:31] core_dl_out[0:31] core_dp_out[0:7] core_dh_ien core_dh_out[0:31] core_dl_ien core_dl_out[0:31] core_dp_ien core_dp_out[0:7] core_abb_oe core_abb_tre core_abb_out core_dbb_oe core_dbb_tre core_dbb_out core_ape_oe core_ape_tre core_ape core_dpe_oe core_dpe_tre core_dpe core_artry_oe core_artry_tre core_artry_out core_ckstp_oe core_ckstp_tre core_ckstp_out core_outputs_oe g2 core: core_qreq, core_br, core_rsrv, core_iabr additional g2_le core signals: core_iabr2, core_dabr, core_dabr2. if desired, the core_outputs_oe can be used to qualify the signals for jtag, checkstop, and hreset states. core_tdo_oe core_tdo core_tdo is always driven regardless of the state of core_tdo_oe. core_tdo_oe is asserted when lssd_mode is asserted, lssd scanning, or jtag scanning (valid core_tdo). f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-5 signal configurations 8.2.2.1 unidirectional/bidirectional signals table 8-2 illustrates the conditions for setting up uni- or bidirectional signals external to the core, showing how the high-impedance control signal should be tied. 8.2.2.2 logic gate equivalent and bidirectional signals all bidirectional signals from the 60x bus interface are implemented as separate input, output, output enable, and high-impedance enable signals, and in some cases, there is an input enable signal. figure 8-2 shows an example of how these signals can be used to create a bidirectional signal outside of the core. figure 8-2. logic diagram for bidirectional signals table 8-3 represents the following conditions for a bidirectional signal created by wire-oring the input and output signals from the core: if core_xxx_tre = 1, the core_xxx_oe signal controls the output on the address or data bus. if core_xxx_tre = 0, the data is driven on the bidirectional signal. table 8-2. conditions for unidirectional/bidirectional signals signal type core_xxx_tre (input signal) core_xxx_oe (output signal) core_xxx_ien (output signal) core_xxx_in, core_xxx_out unidirectional negated (tie low) output enable signal is used when valid data is presented to the system level logic. input enable signal is used when valid data is required to be presented to the internal core logic. used as unidirectional signals to or from the system level logic interface. bidirectional asserted (tie high) typically not used or if it is used, it has similar conditions as for a unidirectional signal. typically not used or if it is used, it has similar conditions as for a unidirectional signal. input and output signals are wire-ored together to generate bidirectional signal with value of high, low, or high-impedance appropriately. core_xxx_tre address/data bus/control (bidirectional) n core_xxx_oe data out data in f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-6 g2 powerpc core reference manual motorola signal configurations 8.2.3 signal summary table 8-4 provides alphabetically-ordered g2 core signals with related cross-reference that are relevant to the user. it details the signal name, signal grouping, number of signals, and whether the signal is an input or an output. it also lists which output enable, input enable and high-impedance control signal corresponds to the signal. finally, the table provides a pointer to the section in this chapter where the signal function is described. table 8-3. truth table for bidirectional signals core_xxx_tre core_xxx_oe output on node n address/data bus/control 0 0 1 drive output 0 1 1 drive output 1 0 0 high impedance 1 1 1 drive output table 8-4. g2 core signal cross reference signal (or signal pair) signal name functional grouping corresponding ien, oe, and tre no. of signals i/o section no. core_32bitmode 32-bit mode reset config. ? 1 i 8.3.10.3.1 core_a_in[0:31] address bus address transfer ? 32 i 8.3.3.1 core_a_out[0:31] core_a_oe 32 o core_a_oe address bus output enable output enable ? 1 o core_a_tre address bus high-impedance enable high-impedance control ?1i core_aack address acknowledge address termination ? 1 i 8.3.5.1 core_abb_in address bus busy address arbitration ? 1 i 8.3.1.3 core_abb_out core_abb_oe 1 o core_abb_oe abb output enable output enable ? 1 o core_abb_tre abb high-impedance enable high-impedance control ?1i core_ap_in[0:3] address bus parity address transfer core_ap_ien 4 i 8.3.3.2 core_ap_out[0:3] core_a_oe 4 o core_ap_ien address bus parity input enable input enable ? 1 o core_ape address parity error address transfer core_ape_oe 1 o 8.3.3.3 core_ape_oe ape output enable output enable ? 1 o core_ape_tre ape high-impedance enable high-impedance control ?1i f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-7 signal configurations core_artry_in address retry address termination ? 1 i 8.3.5.2 core_artry_out core_artry_oe 1 o core_artry_oe address retry output enable output enable ? 1 o core_artry_tre address retry high-impedance enable high-impedance control ?1i core_bg bus grant address arbitration ? 1 i 8.3.1.2 core_br bus request address arbitration core_outputs_oe 1 o 8.3.1.1 core_ci cache inhibit transfer attribute core_a_oe 1 o 8.3.4.5 core_cint 1 critical interrupt interrupt, checkstop ? 1 i 8.3.9.2 core_clk_out test clock clocks core_outputs_oe 1 o 8.3.15.2 core_ckstp_in checkstop interrupt, checkstop ? 1 i 8.3.9.5 core_ckstp_out core_ckstp_oe 1 o core_ckstp_oe checkstop output enable output enable ? 1 o core_ckstp_tre checkstop high-impedance enable high-impedance control ?1i core_cse[0:1] cache set entry transfer attribute core_a_oe 2 o 8.3.4.8 core_d_oe data bus output enable output enable core_d_tre 1 o 8.3.7.1.4 core_d_tre data bus high-impedance enable high-impedance control core_d_oe 1 i core_dabr 1 dabr1 watchpoint debug control core_outputs_oe 1 o 8.3.14.3 core_dabr2 1 dabr2 watchpoint core_outputs_oe 1 o 8.3.14.4 core_dbb_in data bus busy data arbitration ? 1 i 8.3.6.3 core_dbb_out core_dbb_oe 1 o core_dbb_oe data bus busy output enable output enable ? 1 o core_dbb_tre data bus busy high-impedance enable high-impedance control ?1i core_dbg data bus grant data arbitration ? 1 i 8.3.6.1 core_dbdis data bus disable data transfer ? 1 i 8.3.7.4 core_dbwo data bus write only data arbitration ? 1 i 8.3.6.2 core_dh_in[0:31] data bus high data transfer core_dh_ien 32 i 8.3.7.1 core_dh_out[0:31] core_d_oe 32 o core_dh_ien dh input enable input enable ? 1 o table 8-4. g2 core signal cross reference (continued) signal (or signal pair) signal name functional grouping corresponding ien, oe, and tre no. of signals i/o section no. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-8 g2 powerpc core reference manual motorola signal configurations core_disable disable test interface ? 1 i 8.3.13.1 core_dl_in[0:31] data bus low data transfer core_dl_ien 1 o 8.3.7.1 core_dl_out[0:31] ? 32 o core_dl_ien dl input enable input enable ? 1 o core_dp_in[0:7] data bus parity data transfer core_dp_ien 8 i 8.3.7.2 core_dp_out[0:7] core_d_oe 8 o core_dp_ien dp input enable input enable ? 1 o core_dpe data parity error data transfer core_dpe_oe 1 o 8.3.7.3 core_dpe_oe dpe output enable output enable ? 1 o core_dpe_tre dpe high-impedance enable high-impedance control ?1i core_drtry data retry data termination ? 1 i 8.3.8.2 core_drtrymode data retry mode reset config. ? 1 i 8.3.10.3.4 core_gbl_in global transfer attribute ? 1 i 8.3.4.7 core_gbl_out core_a_oe 1 o core_hreset hard reset reset ? 1 i 8.3.10.1 core_int interrupt interrupt, checkstop ? 1 i 8.3.9.1 core_iabr iabr1 watchpoint debug control core_outputs_oe 1 i 8.3.14.1 core_iabr2 1 iabr2 watchpoint core_outputs_oe 1 i 8.3.14.2 core_l1_tstclk lssd test clocks test interface ? 1 i 8.3.13.2 core_l2_tstclk ? 1 i core_lssd_mode lssd test control signals ? 1 i 8.3.13.3 core_mcp machine check interrupt, checkstop ? 1 i 8.3.9.4 core_msrip msr ip reset config. ? 1 i 8.3.10.3.3 core_outputs_oe core outputs enable output enable ? 1 o 8.3.11.5.1 core_pll_cfg[0:4] pll configuration clocks ? 5 i 8.3.15.3 core_qack quiescent acknowledge processor status ? 1 i 8.3.11.1 core_qreq quiescent request core_outputs_oe 1 o 8.3.11.2 core_redpinmode reduced pinout mode reset config. ? 1 i 8.3.10.3.2 core_rsrv reservation processor status core_outputs_oe 1 o 8.3.11.3 core_smi system management interrupt interrupt, checkstop ? 1 i 8.3.9.3 table 8-4. g2 core signal cross reference (continued) signal (or signal pair) signal name functional grouping corresponding ien, oe, and tre no. of signals i/o section no. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-9 signal configurations core_sreset soft reset reset ? 1 i 8.3.10.2 core_svr[0:31] 1 system version register reset config. ? 32 i 8.3.10.3.6 core_sysclk system clock clocks ? 1 i 8.3.15.1 core_ta transfer acknowledge data termination ? 1 i 8.3.8.1 core_tap_en test access point enable test interface ? 1 i 8.3.12.6 core_tben time base enable processor status ? 1 i 8.3.11.4 core_tbst_in transfer burst transfer attribute ? 1 i 8.3.4.3 core_tbst_out core_a_oe 1 o core_tc[0:1] transfer code transfer attribute core_a_oe 2 o 8.3.4.4 core_tck jtag test clock jtag/cop interface ? 1 i 8.3.12.1 core_tdi jtag test data jtag/cop interface ? 1 i 8.3.12.2 core_tdo core_tdo_oe 1 o 8.3.12.3 core_tdo_oe tdo output enable output enable ? 1 o 8.3.12.3.1 core_tea transfer error acknowledge data termination ? 1 i 8.3.8.3 core_tlbisync tlbi sync processor status ? 1 i 8.3.11.5 core_tle 1 true little-endian mode interrupts, checkstops, reset ? 1 i 8.3.10.3.5 core_tlmsel test linking module select test interface ? 1 o 8.3.12.7 core_tms jtag test mode select jtag/cop interface ? 1 i 8.3.12.4 core_trst jtag test reset jtag/cop interface ? 1 i 8.3.12.5 core_ts_in transfer start address start ? 1 i 8.3.2.1 core_ts_out core_a_oe 1 o core_tsiz [0:2] transfer size transfer attribute core_a_oe, core_abb_oe 3 o 8.3.4.2 core_tt_in [0:4] transfer type transfer attribute ? 5 i 8.3.4.1 core_tt_out [0:4] core_a_oe 5 o core_wt write-through transfer attribute core_a_oe 1 o 8.3.4.6 1 g2_le only. table 8-4. g2 core signal cross reference (continued) signal (or signal pair) signal name functional grouping corresponding ien, oe, and tre no. of signals i/o section no. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-10 g2 powerpc core reference manual motorola signal descriptions 8.3 signal descriptions this section describes individual g2 core signals, grouped according to figure 8-1. note that the following sections are intended to provide a quick summary of signal functions. chapter 9, ?core interface operation,? describes many of these signals in greater detail, both with respect to how individual signals function and how groups of signals interact. figure 8-3 shows the g2 core signals groups in greater detail. however, it does not show both the input and output versions of the signals, their directions (input/output), and the associated input/output enable signals. figure 8-3. detailed signal groups core_tck core_smi core_dp[0:7] core_a[0:31] core_cse[0:1] core_aack g2 core +1.5 v core_abb core_artry core_bg core_br core_ci core_clk core_ckstp core_d core_dabr 1 /dabr 2 1 core_dbb core_dbg core_dbdis core_dbwo core_disable core_dl,core_dh core_dpe core_drtry core_drtrymode core_gbl core_hreset core_iabr/iabr2 1 core_l1/l2_tstclk core_tc[0:1] core_tap_en core_lssd_mode core_mcp core_msrip core_pll_cfg[0:4] core_redpinmode core_rsrv core_sreset core_sysclk core_ta core_tben core_tbst core_tdo core_tms core_tea core_tlbisync core_tle 1 core_tlmsel core_trst core_tsiz[0:2] core_qack core_qreq core_wt core_32bitmode core_ape core_ap[0:3] core_tt core_ts address arbitration address start address bus transfer attribute address termination clocks data arbitration data transfer data termination core_drtrymode processor status jtag/cop interface core_outputs 1 g2_le specific signal. test interface debug control core_int core_cint 1 interrupt, checkstop reset/reset config. core_svr 1 core_tdi f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-11 signal descriptions 8.3.1 address bus arbitration signals the address arbitration signals are a collection of input and output signals that the g2 core uses to request the 60x address bus, recognize when the request is granted, and indicate when mastership is granted. for a detailed description of how these signals interact, see section 9.3.1, ?address bus arbitration.? 8.3.1.1 bus request (core_br )?output the core_br signal is an output on the g2 core. following are the state meaning and timing comments for core_br . state meaning asserted?indicates that the core is requesting mastership of the 60x address bus. note that core_br may be asserted for one or more cycles, and then negated due to an internal cancellation of the bus request such as a load hit in the touch load buffer. see section 9.3.1, ?address bus arbitration.? negated?indicates that the core is not requesting the 60x address bus. the core may have no bus operation pending, it may be parked, or core_artry_in was asserted on the previous bus clock cycle. timing comments assertion?occurs when the core is not parked and a bus transaction is needed. this may occur even if the two possible pipeline accesses have occurred. core_br is also asserted for one cycle during the execution of a dcbz instruction and during the execution of a load instruction that hits in the touch load buffer. negation?occurs for at least one bus clock cycle after an accepted, qualified bus grant (see section 8.3.1.3.1, ?address bus busy in (core_abb_in ,?), even if another transaction is pending. it is also negated for at least one bus clock cycle when the assertion of core_artry_in is detected on the bus. 8.3.1.2 bus grant (core_bg )?input the core_bg signal is an input on the g2 core. a qualified bus grant occurs when either: core_bg is asserted, and core_abb_out and core_artry_out (after core_aack ) are negated, or core_bg is asserted, and core_abb_in and core_artry_in (after core_aack ) are negated. core_abb and core_artry are both inputs and outputs on the g2 core and are driven by the core or other bus masters. if the core is parked, core_br need not be asserted for the qualified bus grant. following are the state meaning and timing comments for core_bg . f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-12 g2 powerpc core reference manual motorola signal descriptions state meaning asserted?indicates that the g2 core may, with the proper qualification, assume mastership of the 60x address bus. see section 9.3.1, ?address bus arbitration.? negated?indicates that the core is not the next potential address bus master. timing comments assertion?may occur at any time to indicate the core is free to use the address bus. after the core assumes bus mastership, it does not check for a qualified bus grant again until the cycle during which the address bus tenure is completed (assuming it has another transaction to run). the core does not accept a core_bg in the cycles between the assertion of either core_ts_in or core_ts_out and core_aack . negation?may occur anytime to indicate the core cannot use the bus. the core may still assume bus mastership on the bus clock cycle of the negation of core_bg because during the previous cycle core_bg indicated to the core that it was free to take mastership (if qualified). 8.3.1.3 address bus busy there is both an address bus busy input and address bus busy output signal on the g2 core. the core also implements address bus busy output enable and address bus busy high-impedance enable signals. 8.3.1.3.1 address bus busy in (core_abb_in ) following are the state meaning and timing comments for core_abb_in . state meaning asserted?indicates that the address bus is in use. this condition effectively blocks the core from assuming address bus ownership, regardless of the core_bg input; see section 9.3.1, ?address bus arbitration.? negated?indicates that the address bus is not owned by another bus master and that it is available to the core when accompanied by a qualified bus grant. timing comments assertion?may occur when the core must be prevented from using the address bus (and the processor is not currently asserting core_abb_out ). negation?may occur whenever the core can use the address bus. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-13 signal descriptions 8.3.1.3.2 address bus busy out (core_abb_out ) the core also implements address bus busy output enable and address bus busy high-impedance enable signals. core_abb_out acts as follows: if core_abb_tre is asserted, the output is in one of the following three states?high impedance, driven high, or driven low. if core_abb_tre is negated, the output is either driven to the high or low state. in this case, a valid value on core_abb_out exists when core_abb_oe is asserted. following are the state meaning and timing comments for core_abb_out . state meaning asserted?indicates that the core is the 60x address bus master. see section 9.3.1, ?address bus arbitration.? negated?indicates that the core is not using the address bus. if core_abb_out is negated during the bus clock cycle following a qualified bus grant, the core does not accept mastership, even if core_br is asserted. this can occur if a potential transaction is aborted internally before the transaction is started. timing comments assertion?occurs on the bus clock cycle following a qualified core_bg that is accepted by the processor. negation?occurs for a minimum of one-half bus clock cycle following the assertion of core_aack . if core_abb_out is negated during the bus clock cycle following a qualified bus grant, the core does not accept mastership, even if core_br is asserted. high impedance?occurs one-half clock cycle after core_abb_out is negated, after the negation of core_abb_oe, if core_abb_tre is asserted. if core_abb_tre is negated, core-abb_out is always driven. 8.3.1.3.3 address bus busy output enable (core_abb_oe)?output core_abb_oe is an output-enable indicator to its corresponding bus signals. following are the state meaning and timing comments for core_abb_oe. state meaning asserted?indicates that the core is driving a valid core_abb_out . negation?indicates one of the following two conditions: if core_abb_tre is negated, negated core_abb_oe indicates that the core is not driving a valid core_abb_out value. if core_abb_tre is asserted, negated core_abb_oe indicates that core_abb_out is in the high-impedance state. timing comments assertion?occurs one clock cycle after an accepted qualified bus grant and remains asserted for the duration of the address tenure. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-14 g2 powerpc core reference manual motorola signal descriptions negation? remains asserted for a minimum of one-half processor cycle (dependent on the clock mode) and cycle starts after the assertion of core_aack , and then negates. note that negation of core_abb_oe may force core_abb_out to the high-impedance state, if core_abb_tre is asserted. 8.3.1.3.4 address bus busy high-impedance enable (core_abb_tre)?input following are the state meaning and timing comments for core_abb_tre. core_abb_tre is a high-impedance enable signal on the g2 core and can be used to create an external bidirectional core_abb signal. when the related input/output signals (core_abb_in and core_abb_out ) are wire-ored together, the resulting signal functions to a bidirectional 60x bus signal when core_abb_tre is asserted. see section 8.2.2.2, ?logic gate equivalent and bidirectional signals,? for more information. state meaning asserted?core_abb_oe controls whether core_abb_out is driven or forced to a high-impedance state. negated?indicates that core_abb_out is always driven. timing comments assertion/negation?must be set up prior to the negation of core_hreset signal and remain stable during core operation. this is a static configuration. 8.3.2 address transfer start signals address transfer start signals are input and output signals that indicate that an address bus transfer has begun. for detailed information about how the transfer start signals interact with other signals, refer to section 9.3.2, ?address transfer.? 8.3.2.1 transfer start there is both a transfer start input and transfer start output signal on the g2 core. 8.3.2.1.1 transfer start in (core_ts_in ) following are the state meaning and timing comments for core_ts_in . state meaning asserted?indicates that another master has begun a bus transaction and that the address bus and transfer attribute signals are valid for snooping (see core_gbl_in ). negated?indicates that no bus transaction is occurring. timing comments assertion?may occur during the assertion of core_abb_in . negation?must occur one bus clock cycle after core_ts_in is asserted. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-15 signal descriptions 8.3.2.1.2 transfer start out (core_ts_out ) following are the state meaning and timing comments for core_ts_out . state meaning asserted?indicates that the core has begun a memory bus transaction and that the address bus and transfer attribute signals are valid. when asserted with the appropriate core_tt[0:4] signals, it is also an implied data bus request for a memory transaction (unless it is an address-only operation). negated?indicates that no bus transaction is occurring during normal operation. timing comments assertion?coincides with the assertion of core_abb_out . negation?occurs one bus clock cycle after core_ts_out is asserted. high impedance?coincides with the negation of core_abb_out . 8.3.3 address transfer signals the address transfer signals are used to transmit the address and to generate and monitor parity for the 60x address bus transfer. for a detailed description of how these signals interact, refer to section 9.3.2, ?address transfer.? 8.3.3.1 address bus the g2 core address bus consists of 32 input and 32 output signals along with output enable and high-impedance enable signals. 8.3.3.1.1 address bus in (core_a_in[0:31]) following are the state meaning and timing comments for core_a_in[0:31]. state meaning asserted/negated?represents the physical address of a snoop operation. timing comments assertion/negation?must occur on the same bus clock cycle as the assertion of core_ts_in ; is sampled by the core only on this cycle. 8.3.3.1.2 address bus out (core_a_out[0:31]) the core also implements address bus output enable and address bus high-impedance enable signals. core_a_out[0:31] act as follows: if core_a_tre is asserted, the outputs are in one of the following three states?high impedance, driven high, or driven low. if core_a_tre is negated, the outputs are either driven to the high or low state. in this case, valid values on core_a_out[0:31] exist when core_a_oe is asserted. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-16 g2 powerpc core reference manual motorola signal descriptions following are the state meaning and timing comments for core_a_out[0:31]. state meaning asserted/negated?represents the physical address (real address) of the data to be transferred. on burst transfers, the address bus out signal presents the double-word-aligned address containing the critical code or data that missed the cache on a read operation, or the first double word of the cache line on a write operation. note that the address output during burst operations is not incremented. see section 9.3.2, ?address transfer.? timing comments assertion/negation?occurs on the bus clock cycle after a qualified bus grant (coincides with assertion of core_abb_out and core_ts_out ). high impedance?occurs one bus clock cycle after core_aack is asserted, after the negation of core_a_oe, if core_a_tre is asserted. if core_a_tre is negated, core_a_out[0:31] are always driven. 8.3.3.1.3 address bus output enable (core_a_oe)?output core_a_oe is an output-enable indicator to its corresponding bus signals. following are the state meaning and timing comments for core_a_oe. state meaning asserted?indicates that the core is driving a valid core_a_out[0:31]. negated?indicates one of the following two conditions: if core_a_tre is negated, negated core_a_oe indicates that the core is not driving valid core_a_out[0:31] values. if core_a_tre is asserted, negated core_a_oe indicates that core_a_out[0:31] are in the high-impedance state. timing comments assertion/negation?occurs on the bus clock cycle after a qualified bus grant (coincides with assertion of core_abb_out and core_ts_out ). note that negation of core_a_oe may force core_a_out[0:31] to the high-impedance state, if core_a_tre is asserted. 8.3.3.1.4 address bus high-impedance enable (core_a_tre)?input following are the state meaning and timing comments for core_a_tre. core_a_tre is a high-impedance enable signal on the g2 core and can be used to create an external bidirectional core_a_out[0:31] bus. when the related input/output signals (core_a_in[0:31] and core_a_out[0:31]) are wire-ored together, the resulting bus functions similar to a bidirectional 60x address bus when core_a_tre is asserted. see section 8.2.2.2, ?logic gate equivalent and bidirectional signals,? for more information. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-17 signal descriptions state meaning asserted?core_a_oe controls whether core_a_out[0:31] are driven or forced to a high-impedance state. negated?indicates that core_a_out[0:31] are always driven. timing comments assertion/negation?must be set up prior to negation of the core_hreset signal and remain stable during core operation. this is a static configuration. 8.3.3.2 address bus parity there are both address bus parity input and output signals reflecting 1 bit of odd-byte parity for each of the 4 bytes of address when a valid address is on the bus. the g2 core also implements an address bus parity input enable signal. 8.3.3.2.1 address bus parity in (core_ap_in[0:3]) following are the state meaning and timing comments for core_ap_in[0:3]. state meaning asserted/negated?represents odd parity for each of 4 bytes of the physical address for snooping operations. detected even parity causes the processor to take a machine check exception or enter the checkstop state if address parity checking is enabled in the hid0 register; see section 2.1.2.1, ?hardware implementation register 0 (hid0).? (see also the core_ape signal description.) timing comments assertion/negation?the same as core_a_in[0:31]. 8.3.3.2.2 address bus parity input enable (core_ap_ien)?output core_ap_ien is an input-enable indicator for its corresponding bus signals. following are the state meaning and timing comments for core_ap_ien when core_a_tre is negated. state meaning asserted?indicates that the g2 core is receiving valid address parity. negated?indicates that the address parity input data is ignored. timing comments assertion/negation?valid values must be presented on core_ap_in[0:3] when core_ap_ien is asserted to the system logic. 8.3.3.2.3 address bus parity out (core_ap_out[0:3]) following are the state meaning and timing comments for core_ap_out[0:3]. state meaning asserted/negated?represents odd parity for each of 4 bytes of the physical address for a transaction. odd parity means that an odd f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-18 g2 powerpc core reference manual motorola signal descriptions number of bits, including the parity bit, are driven high. the signal assignments correspond to the following: core_ap_out0 core_a_out[0:7] core_ap_out1 core_a_out[8:15] core_ap_out2 core_a_out[16:23] core_ap_out3 core_a_out[24:31] for more information, see section 9.3.2.1, ?address bus parity.? timing comments assertion/negation?the same as core_a_out[0:31]. high impedance?the same as core_a_out[0:31]. 8.3.3.3 address parity error (core_ape )?output core_ape is an output signal on the g2 core. the core also implements address parity error output enable and address parity error high-impedance enable signals. core_ape acts as follows: if core_ape_tre is asserted, the output is in one of the following three states?high impedance, driven high, or driven low. if core_ape_tre is negated, the output is either driven to the high or low state. in this case, a valid value on core_ape exists when core_ape_oe is asserted. when the corresponding high-impedance enable signal is negated, core_ape always drives to a valid logic state. the core_ape signal is not asserted if address parity checking is disabled (hid0[eba] is cleared). for more information, see section 9.3.2.1, ?address bus parity.? following are the state meaning and timing comments for the core_ape signal on the g2 core. state meaning asserted?indicates that incorrect address bus parity has been detected by the core on a snoop (core_gbl_in is asserted). negated?indicates that the core has not detected a parity error (even parity) on the address bus. timing comments assertion?occurs on the second bus clock cycle after core_ts_in is asserted. negation/high impedance?occurs on the third bus clock cycle after core_ts_in is asserted, after the negation of core_ape_oe, if core_ape_tre is asserted. if core_ape_tre is negated, core_ape is always driven. 8.3.3.3.1 address parity error output enable (core_ape_oe)?output core_ape_oe is an output-enable indicator to its corresponding bus signals. following are the state meaning and timing comments for core_ape_oe. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-19 signal descriptions state meaning asserted?indicates that the g2 core is driving a valid core_ape . negated?indicates one of the following two conditions: if core_ape_tre is negated, negated core_ape_oe indicates that the core is not driving a valid core_ape value. if core_ape_tre is asserted, negated core_ape_oe indicates that core_ape is in the high-impedance state. timing comments assertion?core_ape_oe is asserted on the second bus clock after the assertion of core_ts_in . negation?occurs on the third bus clock cycle after core_ts_in is asserted. note that negation of core_ape_oe may force core_ape to the high-impedance state, if core_ape_tre is asserted. 8.3.3.3.2 address parity error high-impedance enable (core_ape_tre)? input following are the state meaning and timing comments for core_ape_tre. core_ape_tre is a high-impedance enable signal on the g2 core and can be used to create a three-statable version of core_ape externally. the resulting core_ape output signal functions similar to a bidirectional 60x bus signal when core_ape_tre is asserted. state meaning asserted?core_ape_oe controls whether core_ape is driven or forced to a high-impedance state. negated?indicates that core_ape is always driven. timing comments assertion/negation?must be set up prior to negation of the core_hreset signal and remain stable during core operation. this is a static configuration. 8.3.4 address transfer attribute signals the transfer attribute signals are a set of signals that further characterize the transfer?such as the size of the transfer, whether it is a read or write operation, and whether it is a burst or single-beat transfer. for a detailed description of how these signals interact, see section 9.3.2, ?address transfer.? 8.3.4.1 transfer type the transfer type signals consist of five inputs and five outputs on the g2 core. for a complete description of the transfer type signals and for transfer type encodings, see table 8-6. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-20 g2 powerpc core reference manual motorola signal descriptions 8.3.4.1.1 transfer type in (core_tt_in[0:4]) following are the state meaning and timing comments for core_tt_in[0:4]. state meaning asserted/negated?indicates the type of transfer in progress (see table 8-5). timing comments assertion/negation?the same as core_a_in[0:31]. table 8-5 describes the 60x bus specification transfer encodings and the g2 core bus snoop response on an address hit. table 8-5. g2 core snoop hit response 60x bus specification command transaction type core_tt_in x g2 core as snooper; action on hit tt0 tt1 tt2 tt3 tt4 clean block address only 00000n/a flush block address only 00100n/a sync address only 01000n/a kill block address only 01100kill, cancel reservation eieio address only 10000n/a external control word write single-beat write 10100n/a tlb invalidate address only 11000n/a external control word read single-beat read 11100n/a lwarx reservation set address only 00001n/a reserved ? 00101n/a tlbsync address only 01001n/a icbi address only 01101n/a reserved ? 1 x x 0 1 n/a write-with-flush single-beat write or burst00010flush, cancel reservation write-with-kill single-beat write or burst00110kill, cancel reservation read single-beat read or burst 01010clean or flush read-with-intent-to-modify burst 01110flush write-with-flush-atomic single-beat write 10010flush, cancel reservation reserved n/a 10110n/a read-atomic single-beat read or burst 11010clean or flush read-with-intent-to modify- atomic burst 11110flush reserved ? 00011n/a reserved ? 00111n/a f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-21 signal descriptions 8.3.4.1.2 transfer type out (core_tt_out[0:4]) following are the state meaning and timing comments for core_tt_out[0:4]. state meaning asserted/negated?indicates the type of transfer in progress. timing comments assertion/negation/high impedance?the same as core_a_out[0:31]. table 8-6 describes the transfer type encodings for the g2 core as a bus master. read-with-no-intent-to-cachesingle-beat read or burst 01011clean reserved ? 01111n/a reserved ? 1 x x 1 1 n/a table 8-6. transfer type encoding for the g2 core as a bus master g2 core bus master transaction transaction source core_tt_out x 60x bus specification command transaction type tt0 tt1 tt2 tt3 tt4 n/a n/a 00000clean block address only n/a n/a 00100flush block address only n/a n/a 01000sync address only address only dcbz 01100kill block address only n/a n/a 10000eieio address only single-beat write (nongbl ) ecowx 10100external control word write single-beat write n/a n/a 11000tlb invalidate address only single-beat read (nongbl ) eciwx 11100external control word read single-beat read n/a n/a 00001lwarx reservation set address only n/a n/a 00101reserved ? n/a n/a 01001tlbsync address only n/a n/a 01101icbi address only n/a n/a 1 x x 0 1 reserved ? single-beat write caching-inhibited or write-through store 00010write-with-flush single-beat write or burst burst (nongbl ) cast-out, or snoop copy back 00110write-with-kill single-beat write or burst table 8-5. g2 core snoop hit response (continued) 60x bus specification command transaction type core_tt_in x g2 core as snooper; action on hit tt0 tt1 tt2 tt3 tt4 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-22 g2 powerpc core reference manual motorola signal descriptions when hid0[abe] is set, the g2 core performs address-only bus transactions with the encodings shown in table 8-7. 8.3.4.2 transfer size (core_tsiz[0:2])?output the core_tsiz[0:2] signals consist of three output signals on the g2 core. following are the state meaning and timing comments for the core_tsiz[0:2] outputs. state meaning asserted/negated?for memory accesses, these signals along with core_tbst_out , indicate the data transfer size for the current bus operation, as shown in table 8-8. table 9-5 shows how the transfer single-beat read caching-inhibited load or instruction fetch 01010read single-beat read or burst burst load miss, store miss, or instruction fetch 01110read-with-intent-to- modify burst single-beat write stwcx. 10010write-with-flush- atomic single-beat write n/a n/a 10110reserved n/a single-beat read lwarx (caching-inhibited load) 11010read-atomic single-beat read or burst burst lwarx (load miss) 11110read-with-intent-to- modify-atomic burst n/a n/a 00011reserved ? n/a n/a 00111reserved ? n/a n/a 01011read-with-no-intent- to-cache single-beat read or burst n/a n/a 01111reserved ? n/a n/a 1 x x 1 1 reserved ? table 8-7. implementation-specific transfer type encoding transaction source core_tt_out[0:4] x bus command transaction type tt0 tt1 tt2 tt3 tt4 dcbst 00000 clean block address only dcbf 00100 flush block address only dcbz , dcbi 1 1 the dcbi instruction should never be used on the g2 core. 01100 kill block address only table 8-6. transfer type encoding for the g2 core as a bus master (continued) g2 core bus master transaction transaction source core_tt_out x 60x bus specification command transaction type tt0 tt1 tt2 tt3 tt4 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-23 signal descriptions size signals are used with the address signals for aligned transfers. table 9-6 shows how the transfer size signals are used with the address signals for misaligned transfers. for external control instructions ( eciwx and ecowx ), core_tsiz[0:2] are used to output bits 29?31 of the external access register (ear), which are used to form the resource id (core_tbst_out ||core_tsiz[0:2]). timing comments assertion/negation?the same as core_a_out[0:31]. high impedance?the same as core_a_out[0:31]. 8.3.4.3 transfer burst there is both a transfer burst input and transfer burst output signal on the g2 core. 8.3.4.3.1 transfer burst in (core_tbst_in ) following are the state meaning and timing comments for core_tbst_in . state meaning asserted/negated?used when snooping single-beat reads (read with no intent to cache) to indicate that a burst transfer is in progress. timing comments assertion/negation?the same as core_a_in[0:31]. 8.3.4.3.2 transfer burst out (core_tbst_out ) following are the state meaning and timing comments for core_tbst_out . state meaning asserted?indicates that a burst transfer is in progress. negated?indicates that a burst transfer is not in progress. table 8-8. data transfer size core_tbst_out core_tsiz[0:2] transfer size asserted 010 burst (32 bytes) negated 000 8 bytes negated 001 1 byte negated 010 2 bytes negated 011 3 bytes negated 100 4 bytes negated 101 5 bytes negated 110 6 bytes negated 111 7 bytes f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-24 g2 powerpc core reference manual motorola signal descriptions for external control instructions ( eciwx and ecowx ), core_tbst_out is used to output ear[28], which is used to form the resource id (core_tbst_out ||core_tsiz[0:2]). timing comments assertion/negation?the same as core_a_out[0:31]. high impedance?the same as core_a_out[0:31]. 8.3.4.4 transfer code (core_tc[0:1])?output the core_tc[0:1] consists of two output signals on the g2 core. following are the state meaning and timing comments for the core_tc[0:1] outputs. state meaning asserted/negated?represents a special encoding for the transfer in progress (see table 8-9). timing comments assertion/negation?the same as core_a_out[0:31]. high impedance?the same as core_a_out[0:31]. 8.3.4.5 cache inhibit (core_ci )?output following are the state meaning and timing comments for the core_ci output. state meaning asserted?indicates that a single-beat transfer is not cached, reflecting the setting of the i bit for the block or page that contains the address of the current transaction. negated?indicates that a burst transfer in progress will allocate a line in the g2 core data cache. timing comments assertion/negation?the same as core_a_out[0:31]. high impedance?the same as core_a_out[0:31]. 8.3.4.6 write-through (core_wt )?output following are the state meaning and timing comments for the core_wt output. state meaning asserted?indicates that a single-beat transaction is write-through, reflecting the value of the w bit for the block or page that contains the address of the current transaction. table 8-9. encodings for core_tc[0:1] signals core_tc(0:1) read write 0 0 data transaction any write 0 1 touch load ? 1 0 instruction fetch ? 1 1 reserved ? f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-25 signal descriptions negated?indicates that a transaction is not for memory area designated as write-through. timing comments assertion/negation?the same as core_a_out[0:31]. high impedance?the same as core_a_out[0:31]. 8.3.4.7 global signals there is both a global input and global output signal on the g2 core. 8.3.4.7.1 global in (core_gbl_in ) following are the state meaning and timing comments for core_gbl_in . state meaning asserted?indicates that a transaction must be snooped by the g2 core. negated?indicates that a transaction is not to be snooped by the g2 core. timing comments assertion/negation?the same as core_a_in[0:31]. 8.3.4.7.2 global out (core_gbl_out ) following are the state meaning and timing comments for core_gbl_out . state meaning asserted?indicates that a transaction is global, reflecting the setting of the m bit for the block or page that contains the address of the current transaction (except in the case of copy-back operations and instruction fetches, which are nonglobal). negated?indicates that a transaction is not global. timing comments assertion/negation?the same as core_a_out[0:31]. high impedance?the same as core_a_out[0:31]. 8.3.4.8 cache set entry (core_cse[0:1])?output following are the state meaning and timing comments for the core_cse[0:1] outputs. state meaning asserted/negated?represents the cache replacement set element for the current transaction reloading into or writing out of the cache. can be used with the address bus and the transfer attribute signals to externally track the state of each cache line in the g2 core cache. note that core_cse[0:1] are not meaningful during data cache touch load operations. timing comments assertion/negation?the same as core_a_out[0:31]. high impedance?the same as core_a_out[0:31]. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-26 g2 powerpc core reference manual motorola signal descriptions 8.3.5 address transfer termination signals the address transfer termination signals are used to indicate either that the address phase of the transaction has completed successfully or must be repeated, and when it should be terminated. for detailed information about how these signals interact, see section 9.3.3, ?address transfer termination.? 8.3.5.1 address acknowledge (core_aack )?input following are the state meaning and timing comments for the core_aack input. state meaning asserted?indicates that the address phase of a transaction is complete. causes core_a_oe to negate on the next bus clock cycle. the g2 core also samples core_artry_in on the bus clock cycle simultaneous with core_aack and on the bus cycle following the assertion of core_aack . the assertion of core_artry_in on the bus clock cycle simultaneous with the assertion of core_aack is known as an early address retry. negated?indicates that the address bus and transfer attributes must remain driven when core_abb_out is asserted. timing comments assertion?may occur as early as the bus clock cycle after core_ts_out is asserted (unless the g2 core is configured for 1:1 or 1.5:1 clock modes, when core_aack can be asserted no sooner than the second cycle following the assertion of core_ts_out ?one address wait state); assertion can be delayed to allow adequate address access time for slow devices. for example, if an implementation supports slow snooping devices, an external arbiter can postpone the assertion of core_aack . negation?must occur one bus clock cycle after the assertion of core_aack . 8.3.5.2 address retry there is both an address retry input and address retry output signal on the g2 core. the core also implements address retry output enable and address retry high-impedance enable signals. 8.3.5.2.1 address retry in (core_artry_in ) following are the state meaning and timing comments for core_artry_in . state meaning asserted?if the g2 core is the address bus master, core_artry_in indicates that the core must retry the preceding address tenure and immediately negate core_br (if asserted). if the associated data f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-27 signal descriptions tenure has already started, the core also aborts the data tenure immediately, even if the burst data has been received. if the core is not the address bus master, this input indicates that the core should immediately negate core_br for one bus clock cycle following the assertion of core_artry_in by the snooping bus master to allow an opportunity for a copy-back operation to main memory. note that the subsequent address presented on the address bus may not be the same one associated with the assertion of core_artry_in . negated?indicates that the core does not need to retry the last address tenure. timing comments assertion?may occur as early as the second cycle following the assertion of core_ts_out , and must occur by the bus clock cycle immediately following the assertion of core_aack if an address retry is required. negation?must occur during the second cycle after the assertion of core_aack . 8.3.5.2.2 address retry out (core_artry_out ) the core also implements address retry output enable and address retry high-impedance enable signals. core_artry_out acts as follows: if core_artry_tre is asserted, the output is in one of the following three states?high impedance, driven high, or driven low. if core_artry_tre is negated, the output is either driven to the high or low state. in this case, a valid value on core_artry_out exists when core_artry_oe is asserted. following are the state meaning and timing comments for core_artry_out . state meaning asserted?indicates that the g2 core detects a condition in which a snooped address tenure must be retried. if the core needs to update memory as a result of the snoop that caused the retry, the core asserts core_br the second cycle after core_aack if core_artry_out is asserted. negated?indicates that the core does not need the snooped address tenure to be retried. timing comments assertion?asserted the third bus cycle following the assertion of core_ts_in if a retry is required and remains asserted until one cycle after the core_aack is asserted. negation?occurs on the second bus cycle after the assertion of core_aack and remains asserted for a minimum of one-half bus cycle (depends on clock mode) before it is negated for one bus cycle. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-28 g2 powerpc core reference manual motorola signal descriptions high impedance?indicates that the core does not need the snooped address tenure to be retired. occurs two bus cycles after core_aack is asserted, after the negation of core_artry_oe, if core_artry_tre is asserted. if core_artry_tre is negated, core_artry_out is always driven. 8.3.5.2.3 address retry output enable (core_artry_oe)?output core_artry_oe is an output-enable indicator to its corresponding bus signals. following are the state meaning and timing comments for core_artry_oe. state meaning asserted?indicates that the g2 core is driving a valid core_artry_out . negated?indicates one of the following two conditions: if core_artry_tre is negated, negated core_artry_oe indicates that the core is not driving a valid core_artry_out value. if core_artry_tre is asserted, negated core_artry_oe indicates that core_artry_out is in the high-impedance state. timing comments assertion?asserted the second bus cycle following the assertion of core_ts_in if a retry is required and it remains asserted until one bus cycle after core_aack is asserted. negation?occurs the second bus cycle after the assertion of core_aack and remains asserted for a minimum of one-half bus cycle (depends on clock mode) before it is negated for one bus cycle. note that negation of core_artry_oe may force core_artry_out to the high-impedance state, if core_artry_tre is asserted. 8.3.5.2.4 address retry high-impedance enable (core_artry_tre)?input following are the state meaning and timing comments for core_artry_tre. core_artry_tre is a high-impedance enable signal on the g2 core and can be used to create an external bidirectional core_artry signal. when the related input/output signals (core_artry_in and core_artry_out ) are wire-ored together, the resulting signal functions similar to a bidirectional 60x bus signal when core_artry_tre is asserted. see section 8.2.2.2, ?logic gate equivalent and bidirectional signals,? for more information. state meaning asserted?core_artry_oe controls whether core_artry_out is driven or forced to a high-impedance state. negated?indicates core_artry_out is always driven. timing comments assertion/negation?must be set up prior to negation of the core_hreset signal and remain stable during core operation. this is a static configuration. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-29 signal descriptions 8.3.6 data bus arbitration signals like the address bus arbitration signals, data bus arbitration signals maintain an orderly process for determining 60x data bus mastership. note that there is no data bus arbitration signal equivalent to the address bus arbitration signal core_br (bus request) because, except for address-only transactions, core_ts_out implies data bus requests. for a detailed description on how these signals interact, see section 9.4.1, ?data bus arbitration.? one special signal, core_dbwo , allows the core to be configured dynamically to write data out of order with respect to read data. for detailed information about using core_dbwo , see section 9.10, ? using core_dbwo (data bus write only).? 8.3.6.1 data bus grant (core_dbg )?input following are the state meaning and timing comments for the core_dbg input. state meaning asserted?indicates that the core may, with the proper qualification, assume mastership of the data bus. the core derives a qualified data bus grant when core_dbg is asserted and core_dbb_out , core_drtry , and core_artry_out are negated; that is, the data bus is not busy (core_dbb_out is negated), there is no outstanding attempt to retry the current data tenure (core_drtry is negated), and there is no outstanding attempt to perform an core_artry_out of the associated address tenure. negated?indicates that the core must hold off its data tenures. timing comments assertion?may occur any time to indicate the core is free to take data bus mastership. it is not sampled until core_ts_out is asserted. negation?may occur at any time to indicate the core cannot assume data bus mastership. 8.3.6.2 data bus write only (core_dbwo )?input following are the state meaning and timing comments for the core_dbwo input. state meaning asserted?indicates that the core may perform the data bus tenure for an outstanding write address even if a read address is pipelined before the write address. refer to section 9.10, ? using core_dbwo (data bus write only),? for detailed instructions on using core_dbwo . negated?indicates that the core must perform the data bus tenures in the same order as the address tenures. timing comments assertion?must occur no later than a qualified core_dbg for an outstanding write tenure. core_dbwo is only recognized by the core on the clock of a qualified core_dbg . if no write requests are pending, f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-30 g2 powerpc core reference manual motorola signal descriptions the core ignores core_dbwo and assumes data bus ownership for the next pending read request. negation?may occur any time after a qualified core_dbg and before the next assertion of core_dbg . 8.3.6.3 data bus busy there is both a data bus busy input and data bus busy output signal on the g2 core. data bus busy output enable and high-impedance enable signals are also implemented on the g2 core. 8.3.6.3.1 data bus busy in (core_dbb_in ) following are the state meaning and timing comments for core_dbb_in . state meaning asserted?indicates that another device is the bus master. negated?indicates that the data bus is free (with proper qualification, see core_dbg ) for use by the core. timing comments assertion?must occur when the core must be prevented from using the data bus. negation?may occur whenever the data bus is available. 8.3.6.3.2 data bus busy out (core_dbb_out ) the core also implements data bus busy output enable and data bus busy high-impedance enable signals. core_dbb_out acts as follows: if core_dbb_tre is asserted, the output is in one of the following three states?high impedance, driven high, or driven low. if core_dbb_tre is negated, the output is either driven to the high or low state. in this case, a valid value on core_dbb_out exists when core_dbb_oe is asserted. following are the state meaning and timing comments for core_dbb_out . state meaning asserted?indicates that the core is the 60x data bus master. the g2 core always assumes data bus mastership if it needs the data bus and is given a qualified data bus grant (see core_dbg ). negated?indicates that the core is not using the data bus. timing comments assertion?occurs during the bus clock cycle following a qualified core_dbg . negation?occurs for a minimum of one-half bus clock cycle (dependent on clock mode) following the assertion of the final core_ta . f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-31 signal descriptions high impedance?occurs after core_dbb_out is negated, after the negation of core_dbb_oe, if core_dbb_tre is asserted. if core_dbb_tre is negated, core_dbb_out is always driven. 8.3.6.3.3 data bus busy output enable (core_dbb_oe)?output core_dbb_oe is an output-enable indicator to its corresponding bus signals. following are the state meaning and timing comments for core_dbb_oe. state meaning asserted?indicates that the core is driving a valid core_dbb_out . negated?indicates one of the following two conditions: if core_dbb_tre is negated, negated core_dbb_oe indicates that the core is not driving a valid core_dbb_out value. if core_dbb_tre is asserted, negated core_dbb_oe indicates that core_dbb_out is in the high-impedance state. timing comments assertion/negation?asserted after a qualified core_dbg is asserted. remains asserted for a minimum of one-half bus clock cycle following the assertion of output signals core_ta , core_tea , or core_artry_out. note that negation of core_dbb_oe may force core_dbb_out to the high-impedance state, if core_dbb_tre is asserted. 8.3.6.3.4 data bus busy high-impedance enable (core_dbb_tre)?input following are the state meaning and timing comments for core_dbb_tre. core_dbb_tre is a high-impedance enable signal on the g2 core and can be used to create an external bidirectional core_dbb signal. when the related input/output signals (core_dbb_in and core_dbb_out ) are wire-ored together, the resulting signal functions similar to a bidirectional 60x bus signal when core_dbb_tre is asserted. see section 8.2.2.2, ?logic gate equivalent and bidirectional signals,? for more information. state meaning asserted?core_dbb_oe controls whether core_dbb_out is driven or forced to a high-impedance state. negated?indicates that core_dbb_out is always driven. timing comments assertion/negation?must be set up prior to negation of the core_hreset signal and remain stable during core operation. this is a static configuration. 8.3.7 data transfer signals like the address transfer signals, the data transfer signals are used to transmit data and to generate and monitor parity for the data transfer. for a detailed description of how the data transfer signals interact, see section 9.4.3, ?data transfer.? f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-32 g2 powerpc core reference manual motorola signal descriptions 8.3.7.1 data bus the data bus consists of 64 input and 64 output signals on the g2 core. the data bus has two halves?data bus high (dh) and data bus low (dl). see table 8-10 for the data bus lane assignments. the data bus is driven once for noncached transactions and four times for cache transactions (bursts). the dh and dl signals are split into input, output, and input enable signals on the g2 core. 8.3.7.1.1 data bus in (core_dh_in[0:31], core_dl_in[0:31]) following are the state meaning and timing comments for core_dh_in[0:31] and core_dl_in[0:31]. state meaning asserted/negated?represents the state of data during a data read transaction. timing comments assertion/negation?data must be valid on the same bus clock cycle that core_ta is asserted. 8.3.7.1.2 data bus input enable (core_dh_ien, core_dl_ien)?output core_dh_ien and core_dl_ien are input enable indicators to their corresponding bus signals. following are the state meaning and timing comments for core_dh_ien and core_dl_ien. note that not all input signals have input enable signals. state meaning asserted?indicates that the g2 core is expecting valid data bus input. negated?indicates that the received data bus input is ignored. timing comments assertion/negation?valid data must be present to data bus input signals when core_dh_ien or core_dl_ien is asserted to the system logic. these signals allow integrators to support either a bidirectional or unidirectional data bus interface. table 8-10. data bus lane assignments data bus signals byte lane dh[0:7] 0 dh[8:15] 1 dh[16:23] 2 dh[24:31] 3 dl[0:7] 4 dl[8:15] 5 dl[16:23] 6 dl[24:31] 7 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-33 signal descriptions 8.3.7.1.3 data bus out (core_dh_out[0:31], core_dl_out[0:31])?output the core also implements data bus output enable and data bus high-impedance enable signals. core_dh_out[0:31] and core_dl_out[0:31] act as follows: if core_d_tre is asserted, the outputs are in one of the following three states?high impedance, driven high, or driven low. if core_d_tre is negated, the outputs are either driven to the high or low state. in this case, valid values on core_dh_out[0:31] and core_dl_out[0:31] exist when core_d_oe is asserted. following are the state meaning and timing comments for core_dh_out[0:31] and core_dl_out[0:31]. state meaning asserted/negated?represent the state of data during a data write. byte lanes not selected for data transfer do not supply valid data. timing comments assertion/negation?occurs one clock cycle after qualified data bus grant (coincides with core_dbb_out ). high impedance?occurs on the bus clock cycle after core_ta is asserted, after the negation of core_d_oe, if core_d_tre is asserted. if core_d_tre is negated, core_dh_out[0:31] and core_dl_out[0:31] are always driven. 8.3.7.1.4 data bus output enable (core_d_oe)?output core_d_oe is an output-enable indicator to its corresponding bus signals. following are the state meaning and timing comments for core_d_oe. state meaning asserted?indicates that the core is driving a valid data and data parity. negated?indicates one of the following two conditions: if core_d_tre is negated, negated core_d_oe indicates that the core is not driving valid core_dh_out[0:31] and core_dl_out[0:31] values. if core_d_tre is asserted, negated core_d_oe indicates that core_dh_out[0:31] and core_dl_out[0:31] are in the high-impedance state. timing comments assertion/negation?occurs one clock cycle after qualified data bus grant (coincides with core_dbb_out ). note that negation of core_d_oe may force the data bus and data attribute signals to the high-impedance state, if core_d_tre is asserted. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-34 g2 powerpc core reference manual motorola signal descriptions 8.3.7.1.5 data bus high-impedance enable (core_d_tre)?input following are the state meaning and timing comments for core_d_tre. core_d_tre is a high-impedance enable signal on the g2 core and can be used to create an external bidirectional data bus. when the related input/output signals are wire-ored together, the resulting bus functions similar to a bidirectional 60x data bus when core_d_tre is asserted. see section 8.2.2.2, ?logic gate equivalent and bidirectional signals,? for more information. state meaning asserted?core_d_oe controls whether the data bus output signals are driven or forced to a high-impedance state. negated?indicates that data bus signals are always driven. timing comments assertion/negation?must be set up prior to negation of the core_hreset signal and remain stable during core operation. this is a static configuration. 8.3.7.2 data bus parity (dp[0:7]) there are eight data bus parity inputs and eight data bus parity output signals on the g2 core. the core also implements a data bus parity input enable signal. the byte assignments are listed in table 8-11. 8.3.7.2.1 data bus parity in (core_dp_in[0:7]) following are the state meaning and timing comments for core_dp_in[0:7]. state meaning asserted/negated?should represent odd parity for each byte of read data. parity is checked on all data byte lanes, regardless of the size of the transfer. detected even parity causes a checkstop if data parity errors are enabled in the hid0 register. (see core_dpe .) timing comments assertion/negation?the same as core_dl_in[0:31]. table 8-11. data bus parity signal assignments data bus parity signal data bus byte assignment dp0 dh[0:7] dp1 dh[8:15] dp2 dh[16:23] dp3 dh[24:31] dp4 dl[0:7] dp5 dl[8:15] dp6 dl[16:23] dp7 dl[24:31] f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-35 signal descriptions 8.3.7.2.2 data bus parity input enable (core_dp_ien)?output core_dp_ien is an input-enable indicator to its corresponding bus signals. following are the state meaning and timing comments for core_dp_ien when core_dp_tre is negated. state meaning asserted?indicates that the g2 core is excepting valid data bus parity. negated?indicates that the data bus parity input is ignored. timing comments assertion/negation?valid data must be presented to core_dp_in[0:7] when core_dp_ien is asserted to the system logic. these signals allow integrators to support either a bidirectional or unidirectional data bus parity interface. 8.3.7.2.3 data bus parity out (core_dp_out[0:7]) following are the state meaning and timing comments for core_dp_out[0:7]. state meaning asserted/negated?represents odd parity for each of 8 bytes of data for write transactions. odd parity means that an odd number of bits, including the parity bit, are driven high. timing comments assertion/negation?the same as core_dl_out[0:31]. high impedance?the same as core_dl_out[0:31]. 8.3.7.3 data parity error (core_dpe )?output the core_dpe signal is an output signal (output-only) on the g2 core. the core also implements data parity error output enable and data parity error high-impedance enable signals. core_dpe acts as follows: if core_dpe_tre is asserted, the output is in one of the following three states?high impedance, driven high, or driven low. if core_dpe_tre is negated, the output is either driven to the high or low state. in this case, a valid value on core_dpe exists when core_dpe_oe is asserted. following are the state meaning and timing comments for the core_dpe output. state meaning asserted?indicates that incorrect data bus parity was detected during a read transaction when hid0[ebd] is enabled. internally, the core can take a machine check interrupt or enter a checkstop state. negated?indicates correct data bus parity on the data bus. timing comments assertion?occurs on the second bus clock cycle after core_ta is asserted to the core, unless core_ta is canceled by an assertion of core_drtry or core_artry (in certain cases). f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-36 g2 powerpc core reference manual motorola signal descriptions negation/high impedance?occurs on the third bus clock cycle after core_ta is asserted, if core_dpe_tre is asserted. if core_dpe_tre is negated, core_dpe is always driven. 8.3.7.3.1 data parity error output enable (core_dpe_oe)?output core_dpe_oe is an output-enable indicator to its corresponding bus signals. following are the state meaning and timing comments for core_dpe_oe. state meaning asserted?indicates that the core is driving a valid core_dpe . negated?indicates one of the following two conditions: if core_dpe_tre is negated, negated core_dpe_oe indicates that the core is not driving a valid core_dpe value. if core_dpe_tre is asserted, negated core_dpe_oe indicates that core_dpe is in the high-impedance state. timing comments assertion?asserted on the second bus clock cycle after core_ta is asserted to detect the incorrect parity, unless core_ta is canceled by an assertion of core_drtry or core_artry (in certain cases). negation?occurs on the third bus clock cycle after core_ta is asserted. note that the negation of core_dpe_oe may force core_dpe to the high-impedance state, if core_dpe_tre is asserted. 8.3.7.3.2 data parity error high-impedance enable (core_dpe_tre)?input following are the state meaning and timing comments for core_dpe_tre. core_dpe_tre is a high-impedance enable signal on the g2 core and can be used to create a three-statable version of core_dpe externally. the resulting core_dpe signal functions similar to a 60x bus signal when core_dpe_tre is asserted. state meaning asserted?core_dpe_oe controls whether the data parity error output signal is driven or forced to a high-impedance state. negated?indicates that core_dpe is always driven. timing comments assertion/negation?must be set up prior to negation of the core_hreset signal and remain stable during core operation. this is a static configuration. 8.3.7.4 data bus disable (core_dbdis )?input the core_dbdis signal is an input signal (input-only) on the g2 core. following are the state meaning and timing comments for the core_dbdis input. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-37 signal descriptions state meaning asserted?indicates (for a write transaction) that the core must release the data bus and the data bus parity signals to high impedance during the following cycle. the data tenure remains active, core_dbb_out remains driven, and the transfer termination signals are still monitored by the core. negated?indicates the data bus should remain normally driven. core_dbdis is ignored during read transactions. timing comments assertion/negation?may be asserted on any clock cycle when the core is driving, or will be driving the data bus; may remain asserted for multiple cycles. 8.3.8 data transfer termination signals data termination signals are required after each data beat in a data transfer. note that in a single-beat transaction, the data termination signals also indicate the end of the tenure. while in burst accesses, the data termination signals apply to individual beats and indicate the end of the tenure only after the final data beat. for a detailed description of how these signals interact, see section 9.4.4, ?data transfer termination.? 8.3.8.1 transfer acknowledge (core_ta )?input following are the state meaning and timing comments for the core_ta input. state meaning asserted?indicates that a single-beat data transfer completed successfully or that a data beat in a burst transfer completed successfully (unless core_drtry is asserted on the next bus clock cycle). note that core_ta must be asserted for each data beat in a burst transaction, and must be asserted during assertion of core_drtry . for more information, see section 9.4.4, ?data transfer termination.? negated?(during assertion of core_dbb_out ) indicates that, until core_ta is asserted, the core must continue to drive the data for the current write or must wait to sample the data for reads. timing comments assertion?must not occur before core_aack for the current transaction (if the address retry mechanism is to be used to prevent invalid data from being used by the processor); otherwise, assertion may occur at any time during the assertion of core_dbb_out . the system can withhold assertion of core_ta to indicate that the core should insert wait states to extend the duration of the data beat. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-38 g2 powerpc core reference manual motorola signal descriptions negation?must occur after the bus clock cycle of the final (or only) data beat of the transfer. for a burst transfer, the system can assert core_ta for one bus clock cycle and then negate it to advance the burst transfer to the next beat and insert wait states during the next beat. (note: when the core is configured for 1:1 clock mode and is performing a burst read into the data cache, the core requires one wait state between the assertion of core_ts and the first assertion of core_ta for that transaction. if no-drtry mode is also selected, the core requires two wait states for 1:1 clock mode, or one wait state for 1.5:1 clock mode.) 8.3.8.2 data retry (core_drtry )?input following are the state meaning and timing comments for the core_drtry input. state meaning asserted?indicates that the core must invalidate the data from the previous read operation. negated?indicates that data presented with core_ta on the previous read operation is valid. note that core_drtry is ignored for write transactions. timing comments assertion?must occur during the bus clock cycle immediately after core_ta is asserted if a retry is required. core_drtry may be held asserted for multiple bus clock cycles. when core_drtry is negated, data must have been valid on the previous clock with core_ta asserted. negation?must occur during the bus clock cycle after a valid data beat. this may occur several cycles after core_dbb_out is negated, effectively extending the data bus tenure. start-up?core_drtrymode is sampled at the negation of core_hreset ; if core_drtrymode is asserted, no-drtry mode is selected. if core_drtrymode is negated at start-up, core_drtry is enabled. 8.3.8.3 transfer error acknowledge (core_tea )?input following are the state meaning and timing comments for the core_tea input. state meaning asserted?indicates that a bus error occurred. causes a machine check exception (and possibly causes the processor to enter checkstop state if machine check enable bit is cleared (msr[me] = 0)). for more information, see section 5.5.2.2, ?checkstop state (msr[me] = 0).? assertion terminates the current transaction; that is, assertion of core_ta and core_drtry are ignored. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-39 signal descriptions the assertion of core_tea causes the negation of core_dbb_out in the next clock cycle. however, data entering the gpr or the cache is not invalidated. negated?indicates that no bus error was detected . timing comments assertion?may be asserted while core_dbb_out is asserted, and the cycle after core_ta during a read operation. core_tea should be asserted for one cycle only. negation?core_tea must be negated no later than the negation of core_dbb_out . 8.3.9 interrupt and checkstop signals most interrupt and checkstop signals are input signals that indicate when exceptions are received, when checkstop conditions have occurred, and when the core must be reset. the g2 core generates the output signal core_ckstp_out when it detects a checkstop condition. for further detailed description of these signals, see section 9.7, ?interrupt, checkstop, and reset signals.? 8.3.9.1 external interrupt (core_int )?input following are the state meaning and timing comments for the core_int input. state meaning asserted?the core initiates an interrupt exception if msr[ee] is set; otherwise, the core ignores the interrupt. to guarantee that the core takes the external interrupt, core_int must be held asserted until the core takes the interrupt. negated?indicates that normal operation should proceed. see section 9.7.1, ?external interrupts.? timing comments assertion?may occur at any time and may be asserted asynchronously to the input clocks. the core_int input is level-sensitive. negation?should not occur until the external interrupt exception is taken. 8.3.9.2 critical interrupt (core_cint )?input: g2_le core-only following are the state meaning and timing comments for the core_cint input on the g2_le core. see section 5.5.10, ?critical interrupt exception (0x00a00)?g2_le only,? for more information. state meaning asserted?the core initiates an interrupt exception if msr[ce] is set; otherwise, the core ignores the interrupt. to guarantee that the f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-40 g2 powerpc core reference manual motorola signal descriptions core takes the critical interrupt, core_cint must be held asserted until the core takes the interrupt. negated?indicates that normal operation should proceed. see section 9.7.1, ?external interrupts.? timing comments assertion?may occur at any time and may be asserted asynchronously to the input clocks. the core_cint input is level-sensitive. negation?should not occur until the critical interrupt exception is taken. 8.3.9.3 system management interrupt (core_smi )?input following are the state meaning and timing comments for the core_smi input. see section 5.5.17, ?system management interrupt (0x01400),? for more information. state meaning asserted?the core initiates a system management interrupt exception if msr[ee] is set; otherwise, the core ignores the exception condition. the system must hold core_smi asserted until the exception is taken. negated?indicates that normal operation should proceed. see section 9.7.1, ?external interrupts.? timing comments assertion?may occur at any time and may be asserted asynchronously to the input clocks. the core_smi input is level-sensitive. . negation?should not occur until the interrupt exception is taken. 8.3.9.4 machine check interrupt (core_mcp )?input following are the state meaning and timing comments for the core_mcp input. state meaning asserted?the core initiates a machine check interrupt exception if msr[me] and hid0[emcp] are set; if msr[me] is cleared and hid0[emcp] is set, the core terminates operation by internally gating off all clocks, and releasing all outputs (except core_ckstp_out ) to the high-impedance state. if hid0[emcp] is cleared, the core ignores the interrupt condition. core_mcp must be held asserted for at least two bus clock cycles. negated?indicates that normal operation should proceed. see section 9.7.1, ?external interrupts.? timing comments assertion?may occur at any time and may be asserted asynchronously to the input clocks. core_mcp is negative edge-sensitive. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-41 signal descriptions negation?may be negated two bus cycles after assertion. 8.3.9.5 checkstop signals there is both an checkstop input and checkstop output signal on the g2 core. the core also implements checkstop output enable and checkstop high-impedance enable signals. 8.3.9.5.1 checkstop input (core_ckstp_in ) following are the state meaning and timing comments for core_ckstp_in . state meaning asserted?indicates that the core must terminate operation by internally gating off all clocks, and releasing all outputs (except core_ckstp_out ) to the high-impedance state. once core_ckstp_in is asserted, it must remain asserted until the system has been reset. negated?indicates that normal operation should proceed. see section 9.7.2, ?checkstops.? timing comments assertion?may occur at any time and may be asserted asynchronously to the input clocks. negation?may occur anytime after core_ckstp_out is asserted. 8.3.9.5.2 checkstop output (core_ckstp_out ) the core_ckstp_out signal is output only on the g2 core. the core also implements checkstop output enable and checkstop high-impedance enable signals. core_ckstp_out acts as follows: if core_ckstp_tre is asserted, the output is in one of the following three states?high impedance, driven high, or driven low. if core_ckstp_tre is negated, the output is either driven to the high or low state. in this case, a valid value on core_ckstp_out exists when core_ckstp_oe is asserted. following are the state meaning and timing comments for the core_ckstp_out output. state meaning asserted?indicates that the core has detected a checkstop condition and has ceased operation. negated?indicates that the core is operating normally. see section 9.7.2, ?checkstops.? timing comments assertion?may occur at any time and is asserted asynchronously to core_sysclk. negation?is negated upon assertion of core_hreset. high impedance?occurs after the negation of core_ckstp_oe, if core_ckstp_tre is asserted. if core_ckstp_tre is negated, core_ckstp_out is always driven. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-42 g2 powerpc core reference manual motorola signal descriptions 8.3.9.5.3 checkstop output enable (core_ckstp_oe)?output core_ckstp_oe is an output-enable indicator to its corresponding bus signals. following are the state meaning and timing comments for core_ckstp_oe. state meaning asserted?indicates that the core is driving a valid core_ckstp_out . negated?indicates one of the following two conditions: if core_ckstp_tre is negated, negated core_ckstp_oe indicates that the core is not driving a valid core_ckstp_out value. if core_ckstp_tre is asserted, negated core_ckstp_oe indicates that core_ckstp_out is in the high-impedance state. timing comments assertion/negation?core_ckstp_oe is valid after core_ckstp_out is asserted (asynchronous to core_sysclk). note that negation of core_ckstp_oe may force core_ckstp_out to the high-impedance state, if core_artry_tre is asserted. 8.3.9.5.4 checkstop high-impedance enable (core_ckstp_tre)?input core_ckstp_tre is a high-impedance enable signal on the g2 core and can be used to create a bidirectional core_ckstp signal. when the related input/output signals (core_ckstp_in and core_ckstp_out ) are wire-ored together, the resulting signal functions similar to a bidirectional 60x bus signal when core_ckstp_tre is asserted. see section 8.2.2.2, ?logic gate equivalent and bidirectional signals,? for more information. following are the state meaning and timing comments for core_ckstp_tre. state meaning asserted?core_ckstp_oe controls whether core_ckstp_out is driven or forced to a high-impedance state. negated?indicates that core_ckstp_out is always driven. timing comments assertion/negation?must be set up prior to negation of the core_hreset signal and remain stable during core operation. this is a static configuration. 8.3.10 reset signals there are two reset signals on the g2 core?hard reset (core_hreset ) and soft reset (core_sreset ). additionally, there is a group of reset configuration signals. descriptions of the reset signals are as follows. 8.3.10.1 hard reset (core_hreset )?input the core_hreset input must be used at power-on to properly reset the core. the reset configuration signals are sampled at the negation of core_hreset . following are the state meaning and timing comments for the core_hreset input. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-43 signal descriptions state meaning asserted?initiates a hard reset operation. causes a reset exception as described in section 5.5.1.1, ?hard reset and power-on reset.? output drivers are released to high impedance within five clock cycles after the assertion of core_hreset . negated?indicates that normal operation should proceed. see section 9.7.3, ?reset inputs.? the reset configuration signals are also sampled at the negation of core_hreset . timing comments assertion?may occur at any time and may be asserted asynchronously to the core input clock; must be held asserted for a minimum of 255 clock cycles after the pll lock time has been met. refer to the appropriate hardware specifications for further timing comments. negation?may occur any time after the minimum reset pulse width has been met. 8.3.10.2 soft reset (core_sreset )?input the core_sreset signal is input only. following are the state meaning and timing comments for the core_sreset input. state meaning asserted? initiates processing for a reset exception as described in section 5.5.1.2, ?soft reset.? negated?indicates that normal operation should proceed. see section 9.7.3, ?reset inputs.? timing comments assertion?may occur at any time and may be asserted asynchronously to the core input clock. core_sreset is negative edge-sensitive. negation?may be negated two bus cycles after assertion. 8.3.10.3 reset configuration signals there are five reset configuration signals on the g2 core that are sampled at the negation of core_hreset . 8.3.10.3.1 32-bit mode (core_32bitmode )?input following are the state meaning and timing comments for the core_32bitmode input. state meaning asserted?causes the core to be configured for 32-bit mode operation. see section 9.6.1, ?32-bit data bus mode,? for more information on the differences between 32- and 64-bit mode operation. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-44 g2 powerpc core reference manual motorola signal descriptions negated?causes the core to be configured for 64-bit mode operation. timing comments assertion/negation?this signal is sampled during assertion of core_hreset and must be stable five cycles before the negation of core_hreset as defined in the hardware specification. 8.3.10.3.2 reduced pinout mode (core_redpinmode)?input following are the state meaning and timing comments for the core_redpinmode input. state meaning asserted?causes the processor to be configured for reduced pinout mode operation at core_hreset . negated?causes the core to be configured for normal pinout mode operation at core_hreset . timing comments assertion/negation?this signal is sampled during assertion of core_hreset and must be stable five cycles before the negation of core_hreset as defined in the hardware specification. 8.3.10.3.3 msr ip bit set mode (core_msrip)?input following are the state meaning and timing comments for the core_msrip input. state meaning asserted?causes msr[ip] to be initialized to a one at core_hreset . this causes the reset vector to be fetched from address 0xfffn_nnnn. see table 2-4 for more information on the operation of the core when msr[ip] = 1. negated?causes msr[ip] to be initialized to zero. this causes the reset vector to be fetched from address 0x000n_nnnn. timing comments assertion/negation?this signal is sampled during assertion of core_hreset and must be stable five cycles before the negation of core_hreset as defined in the hardware specification. 8.3.10.3.4 drtry mode (core_drtrymode)?input following are the state meaning and timing comments for the core_drtrymode input. state meaning asserted?causes the core to be configured for normal drtry mode operation at core_hreset . negated?causes the core to be configured for no_drtry mode operation at core_hreset . timing comments assertion/negation?this signal is sampled during assertion of core_hreset and must be stable five cycles before the negation of core_hreset as defined in the hardware specification. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-45 signal descriptions 8.3.10.3.5 true little-endian mode (core_tle)?input following are the state meaning and timing comments for the core_tle input on the g2_le core. state meaning asserted?causes msr[le], msr[ile], and hid2[let] to be initialized to ones at core_hreset . see table 2-8 for more information on the operation of the core when hid2[let] = 1. negated?causes msr[le], msr[ile], and hid2[let] to be initialized to zeros at core_hreset . timing comments assertion/negation?this signal is sampled during assertion of core_hreset and must be stable five cycles before the negation of core_hreset as defined in the hardware specification. 8.3.10.3.6 system version register (core_svr[0:31])?input following are the state meaning for the core_svr[0:31] inputs on the g2_le core. state meaning asserted/negated?identify the system version and revision level of the system on a chip (soc) level of integration. the value of these signals is loaded into the system version register (svr) at the negation of core_hreset . for further detailed description of the associated register, see section 2.1.2.12, ?system version register (svr)?g2_le only.? timing comments assertion/negation?these signals are sampled during assertion of core_hreset and must be stable five cycles before the negation of core_hreset as defined in the hardware specification. 8.3.11 processor status signals processor status signals indicate the state of the processor. this includes the memory reservation, machine quiesce control, time base enable, and core_tlbisync signals. 8.3.11.1 quiescent acknowledge (core_qack )?input following are the state meaning and timing comments for the core_qack input. state meaning asserted?indicates that all bus activity that requires snooping has terminated or paused, and that the core may enter the quiescent (or low-power) state. negated?indicates that the core may not enter a quiescent state and must continue snooping the bus. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-46 g2 powerpc core reference manual motorola signal descriptions timing comments assertion/negation?may occur on any cycle following the assertion of core_qreq , and must be held asserted for a minimum of one bus clock cycle. 8.3.11.2 quiescent request (core_qreq )?output following are the state meaning and timing comments for the core_qreq signal. state meaning asserted?indicates that the core is requesting all bus activity normally required to be snooped to terminate or to pause so the core may enter the quiescent (low-power) state. once the core enters a quiescent state, it no longer snoops bus activity. negated?indicates that the core is not making a request to enter the quiescent state. timing comments assertion/negation?may assert on any cycle. core_qreq remains asserted for the duration of the quiescent state. 8.3.11.3 reservation (core_rsrv )?output following are the state meaning and timing comments for the core_rsrv output. state meaning asserted/negated?represents the state of the reservation coherency bit in the reservation address register that is used by the lwarx and stwcx. instructions. see section 9.8.1, ?support for the lwarx/stwcx. instruction pair.? timing comments assertion/negation?occurs synchronously with respect to bus clock cycles. the execution of an lwarx instruction sets the internal reservation condition. 8.3.11.4 time base enable (core_tben)?input following are the state meanings and timing comments for the core_tben input. state meaning asserted?indicates that the time base should continue clocking. this input is essentially a count enable control for the time base counter. negated?indicates that the time base should stop clocking. timing comments assertion/negation?may occur on any cycle. 8.3.11.5 tlbi sync (core_tlbisync )?input following are the state meaning and timing comments for the core_tlbisync input. state meaning asserted?indicates that instruction execution should stop after execution of a tlbsync instruction. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-47 signal descriptions negated?indicates that the instruction execution may continue or resume after the completion of a tlbsync instruction. timing comments assertion/negation?may occur on any cycle. 8.3.11.5.1 output enable (core_outputs_oe)?output for the g2 core, core_outputs_oe is associated with the core_qreq , core_br , core_rsrv , and core_iabr signals; for the g2_le core, core_outputs_oe is also associated with core_iabr2 , core_dabr , and core_dabr2 . core_outputs_oe does not control any of these signals from the core. the signals listed above are always driven in normal operation. following are the state meaning and timing comments for the core_outputs_oe output signal. note that no high-impedance signal is associated with core_outputs_oe. state meaning asserted?indicates that the associated output signals are always driving valid data. negated?indicates that the associated output signals are not driving valid data (does not occur in normal operation). timing comments assertion/negation?in normal operation core_outputs_oe is asserted on the third clock cycle after core_hreset is negated. 8.3.12 cop/scan interface the g2 core has extensive on-chip test capability including the following: built-in instruction and data cache self-test (bist) debug control/observation (cop) boundary scan (ieee 1149.1 compliant interface) lssd test control the bist hardware is not used as part of the power-on reset (por) sequence. the cop and boundary scan logic are not used under typical operating conditions. detailed descriptions of the g2 core test functions is beyond the scope of this document; however, sufficient information has been provided to allow the system designer to disable the test functions that would impede normal operation. the cop/scan interface is shown in figure 8-4. for more information, see section 9.9, ?ieee 1149.1-compliant interface.? f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-48 g2 powerpc core reference manual motorola signal descriptions figure 8-4. ieee 1149.1-compliant boundary scan interface these signals are not used during normal operation. core_tms, core_tdi, and core_trst have internal pull-up resistors provided; core_tck does not. for normal operation, core_tms and core_tdi may be left unconnected, and core_tck must be set high or low. the core_trst signal must be asserted sometime during power-up for jtag logic initialization. note that if core_trst is tied low, unnecessary power is consumed. 8.3.12.1 jtag test clock (core_tck)?input the jtag test clock (core_tck) signal is an input on the g2 core. following are the state meaning and timing comments for the core_tck input signal. state meaning asserted/negated?this input should be driven by a free-running clock signal. input signals to the test access port are clocked in on the rising edge of core_tck. changes to the test access port output signals occur on the falling edge of core_tck. the test logic allows core_tck to be stopped. timing comments assertion/negation?core_tck should not be used during normal operation and always must be set to either a high or low logic state. 8.3.12.2 jtag test data input (core_tdi)?input following is the state meaning and timing comments for the core_tdi input signal. state meaning asserted/negated?the value presented on this signal on the rising edge of core_tck is clocked into the selected jtag test instruction or data register. timing comments assertion/negation?core_tdi should not be used during normal operation and always must be set to a high or low logic state. note that this input contains an internal pull-up resistor to ensure that an unterminated input appears as a high signal level to the test logic. core_tdi (test data input) core_tms (test mode select) core_tck (test clock input) core_tdo (test data output) core_trst (test reset) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-49 signal descriptions 8.3.12.3 jtag test data output (core_tdo)?output the jtag test data output signal is an output on the g2 core. following are the state meaning and timing comments for the core_tdo output signal. state meaning asserted/negated?the contents of the selected internal instruction or data register are shifted out onto this signal on the falling edge of core_tck. the core_tdo signal remains in a high-impedance state except when scanning of data is in progress. timing comments assertion/negation?core_tdo should not be used for normal operation and is only valid when core_tdo_oe is asserted. 8.3.12.3.1 jtag test data output enable (core_tdo_oe)?output the jtag test data output enable signal is an output on the g2 core. following are the state meaning and timing comments for the core_tdo_oe output signal. state meaning asserted?indicates that the g2 core is driving a valid core_tdo during the shiftdr or shiftid state of the tap controller. negated?indicates that the core is not driving a valid core_tdo value. timing comments assertion/negation?the core_tdo signal is always driven, regardless of the state of core_tdo_oe. also, core_tdo is always driven when core_lssd_mode is asserted and scanned. 8.3.12.4 jtag test mode select (core_tms)?input the test mode select (core_tms) signal is an input on the g2 core. following are the state meaning for the core_tms input signal. state meaning asserted/negated?this signal is decoded by the internal jtag tap controller to distinguish the primary operation of the test support circuitry. timing comments assertion/negation?core_tms should not be used during normal operation and always must be set to either a high or low logic state. note that this input contains an internal pull-up resistor to ensure that an unterminated input appears as a high signal level to the test logic. 8.3.12.5 jtag test reset (core_trst )?input the test reset (core_tr st ) signal is an input on the g2 core. following are the state meaning and timing comments for the core_trst input signal. state meaning asserted?this input causes asynchronous initialization of the internal jtag test access port controller. note that the signal must be f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-50 g2 powerpc core reference manual motorola signal descriptions asserted during the assertion of core_h reset in order to properly initialize the jtag test access port. the core_trst signal must be asserted to properly initialize the boundary scan chain. this may be accomplished by connecting it to core_hreset , using logic to or any external jtag core_trst drivers. negated?indicates normal operation. timing comments assertion/negation?this input contains an internal pull-up resistor to ensure that an unterminated input appears as a high signal level (negated) to the test logic. 8.3.12.6 tlm tap enable (core_tap_en)?input the test linking module test access point enable (core_tap_en) signal is an input on the g2 core. following are the state meaning and timing comments for the core_tap_en input signal. state meaning asserted?indicates that the test access point controller of the g2 core is in normal mode of operation which is controlled by core_tms. negated?indicates that the core test access point enables the tlm function. timing comments assertion/negation?this input signal should be either driven at low logic state during normal operation or not connected to tlm logic. 8.3.12.7 test linking module select (core_tlmsel)?output the test linking module select (core_tlmsel) signal is an output on the g2 core. following are the state meaning and timing comments for core_tlmsel. state meaning asserted?indicates that the core test access point controller selects the tlm register by issuing a tlm instruction. negated?indicates normal operation. timing comments assertion/negation?the test access point controller transitions to run/test/ideal state until the core_tlmsel signal is re-enabled. 8.3.13 test interface test interface signals like lssd test clock or test control signals are used in the g2 core for production testing. core_l1_tstclk, core_l2_tsclk, and core_lssd_mode are the test clock and test control signals. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-51 signal descriptions 8.3.13.1 disable (core_disable)?input the disable (core_disable) signal is an input on the g2 core. following are the state meaning and timing comments for core_disable. state meaning asserted?all output signals are negated or forced to a high-impedance state. the core enters a sleep mode, and instruction fetching and dispatching are disabled. negated?the g2 core is in normal operating mode. timing comments assertion/negation?the core_disable signal should be asserted or negated when core_hreset is asserted and should remain asserted or negated until core_hreset is negated. 8.3.13.2 lssd test clock (core_l1_tstclk, core_l2_tstclk)?input the lssd test clock signals are inputs on the g2 core. following are the state meaning and timing comments for the core_l1_tstclk and core_l2_tstclk input signals. state meaning asserted?indicates the high phase of the test clock. negated?indicates the low phase of the test clock. timing comments assertion/negation?core_l1_tstclk or core_l2_tstclk are driven during normal operating mode and clocked during lssd test mode. 8.3.13.3 lssd test control (core_lssd_mode )?input the lssd test control (core_lssd_mode ) signal is an input on the g2 core. following are the state meaning and timing comments for the core_lssd_mode input signal. state meaning asserted?indicates that the core is in lssd mode for manufacturing tests where core_pll_cfg[0:4] is set to 0x00011 to bypass the core_sysclk. in lssd mode core_l1_tstclk and core_l2_tstclk control clocking instead of core_sysclk. negated?the g2 core is in normal operating mode. in normal operating mode core_l1_tstclk and core_l2_tstclk are tied to high state. the setting of core_pll_cfg[0:4] is changed through the setting of core-bus frequency ratio where the core clock frequency is the multiple of core_sysclk frequency. timing comments assertion/negation?the system must negate core_lssd_mode and must keep it stable in normal operation. 8.3.14 debug control signals this section describes the signals that are implemented to control debug features such as address matching, combinational matching, and watchpoint of the powerpc architecture f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-52 g2 powerpc core reference manual motorola signal descriptions with respect to the g2 and g2_le cores. the control signals?core_iabr , core_iabr2 , core_dabr , and core_dabr2 are watchpoint/breakpoint indicator signals. 8.3.14.1 instruction address breakpoint register watchpoint (core_iabr )?output the instruction address breakpoint register (core_iabr ) signal is an output on the g2 core. see section 2.1.2.14, ?instruction address breakpoint registers (iabr and iabr2),? for more information. following are the state meaning and timing comments for the core_iabr input signal. state meaning asserted?indicates that the iabr register has matched with the instruction address breakpoint condition set in the ibcr. see section 2.1.2.14.1, ?instruction address breakpoint control registers (ibcr)?g2_le only,? for more information. negated?indicates that iabr has not matched or ibcr has disabled the breakpoint. timing comments assertion/negation?occurs synchronously with respect to bus clock cycles. 8.3.14.2 instruction address breakpoint register watchpoint (core_iabr2 )?output the instruction address breakpoint register (core_iabr2 ) signal is an output on the g2_le core. see section 2.1.2.14, ?instruction address breakpoint registers (iabr and iabr2),? for more information. following are the state meaning and timing comments for the core_iabr2 input signal. state meaning asserted?indicates that the iabr2 register has matched with the instruction address breakpoint condition set in the ibcr. see section 2.1.2.14.1, ?instruction address breakpoint control registers (ibcr)?g2_le only,? for more information. negation?indicates that iabr2 has not matched or ibcr has disabled the breakpoint. timing comments assertion/negation?occurs synchronously with respect to bus clock cycles. 8.3.14.3 data address breakpoint register watchpoint (core_dabr )?output the data address breakpoint register (core_dabr ) signal is an output on the g2_le core. see section 2.1.2.15, ?data address breakpoint register (dabr and dabr2)?g2_le only,? for more information. following is the state meaning and timing comments for the core_dabr input signal. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-53 signal descriptions state meaning asserted?indicates that the dabr register has matched with the data address breakpoint condition set in the dbcr. see section 2.1.2.15.1, ?data address breakpoint control registers (dbcr)?g2_le-only,? for more information. negation?indicates that dabr has not matched or dbcr has disabled the breakpoint. timing comments assertion/negation?occurs synchronously with respect to bus clock cycles. 8.3.14.4 data address breakpoint register watchpoint (core_dabr2 )?output the data address breakpoint register (core_dabr2 ) signal is an output on the g2_le core. see section 2.1.2.15, ?data address breakpoint register (dabr and dabr2)?g2_le only,? for more information. following is the state meaning and timing comments for the core_dabr2 input signal. state meaning asserted?indicates that the dabr2 register has matched the data breakpoint condition set in the dbcr. see section 2.1.2.15.1, ?data address breakpoint control registers (dbcr)?g2_le-only,? for more information. negation?indicates that dabr2 has not matched or dbcr has disabled the breakpoint. timing comments assertion/negation?occurs synchronously with respect to bus clock cycles. 8.3.15 clock signals the clock signal inputs of the g2 core determine the system clock frequency and provide a flexible clocking scheme that allow the processor to operate at an integer multiple of the system clock frequency. refer to the appropriate hardware specifications for exact timing relationships of the clock signals. 8.3.15.1 system clock (core_sysclk)?input the core requires a single system clock (core_sysclk) input. this input sets the frequency of operation for the bus interface. internally, the core uses a phase-locked loop (pll) circuit to generate a master clock for all of the cpu circuitry (including the bus interface circuitry) which is phase-locked to the core_sysclk input. the master clock may be set to an integer or half-integer multiple of the sysclk frequency allowing the cpu core to operate at an f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-54 g2 powerpc core reference manual motorola signal descriptions equal or greater frequency than the bus interface. the hardware specification lists available frequency multipliers. state meaning asserted/negated?the core_sysclk input is the primary clock input for the core, and represents the bus clock frequency for core_sysclk bus operation. internally, the core may be operating at an integer or half-integer multiple of the bus clock frequency. timing comments duty cycle?refer to the appropriate hardware specifications for timing comments. note: core_sysclk is used as the frequency reference for the internal pll clock generator, and must not be suspended or varied during normal operation to ensure proper pll operation. 8.3.15.2 test clock output (core_clk_out) the g2 core provides the core_clk_out signal for test purposes. it allows the monitoring of the processor and bus clock frequencies. the frequency of core_clk_out is determined by the configuration of hid0[sbclk,eclk], as shown in table 8-12. note that core_clk_out is driven at the processor frequency during the assertion of core_hreset ; when core_hreset is negated, core_clk_out enters the default high-impedance state. following are the state meaning and timing comments for core_clk_out. state meaning asserted/negated?provides pll clock output for pll testing and monitoring. the core_clk_out signal clocks at either the processor clock frequency, bus clock frequency, or half-bus clock frequency if enabled by the appropriate hid0 bits; the default state of core_clk_out is high impedance. core_clk_out is provided only for testing. timing comments assertion/negation?refer to the appropriate hardware specifications for timing comments. table 8-12. core_clk_out signal configuration hid0[sbclk] hid0[eclk] core_clk_out state 0 0 bus clock frequency 0 1 core/processor clock frequency 1 0 bus clock frequency 1 1 core/processor clock frequency f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 8. signal descriptions 8-55 signal descriptions 8.3.15.3 pll configuration (core_pll_cfg[0:4])?input the pll is configured by core_pll_cfg[0:4]. for a given core_sysclk (bus) frequency, the pll configuration signals set the internal cpu frequency of operation. table 8-13 shows the pll configuration options. following are the state meaning and timing comments for the core_pll_cfg[0:4] input. state meaning asserted/negated? configures the operation of the pll and the internal processor clock frequency. settings are based on the desired bus, vco divider, and internal frequency of operation. timing comments assertion/negation?must remain stable during operation; should only be changed during the assertion of core_hreset or during sleep mode. table 8-13. core pll configuration pll_cfg[0:4] bus-to-core multiplier vco divider 0x02 1x 8 0x01 1x 4 0x0c 1.5x 8 0x00 1.5x 4 0x18 1.5x 2 0x05 2x 4 0x04 2x 2 0x11 2.5x 4 0x06 2.5x 2 0x10 3x 4 0x08 3x 2 0x0e 3.5x 2 0x0a 4x 2 0x07 4.5x 2 0x0b 5x 2 0x09 5.5x 2 0x0d 6x 2 0x12, 6.5x 2 0x14 7x 2 0x16 7.5x 2 0x1c 8x 2 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 8-56 g2 powerpc core reference manual motorola signal descriptions 0x03, 0x13 pll off or bypassed 1 pll off?sysclk drives core clocks directly, 1x bus-to-core defaulted 0x0f, 0x1f pll off 1 pll off?no core clocking occurs 0x15, 0x17, 0x19, 0x1a, 0x1b, 0x1d, 0x1e reserved these decodings are reserved for future use and should not be used. 1 when pll off or bypassed, the ac timing for the core interface is undefined. see hardware specification for more details on setup and hold time. table 8-13. core pll configuration (continued) pll_cfg[0:4] bus-to-core multiplier vco divider f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-1 chapter 9 core interface operation this chapter describes the 60x bus interface of the g2 core and its operation. it shows how the core signals, defined in chapter 8, ?signal descriptions,? interact to perform address and data transfers. for a detailed discussion about the 60x bus interface, multiple bus masters, and memory coherency, refer to the powerpc microprocessor family: the bus interface for 32-bit microprocessors. 9.1 overview the core interface prioritizes requests for bus operations from the instruction and data caches and performs bus operations following the 60x bus protocol. it includes address register queues, prioritization logic, and the bus control unit. the core interface latches snoop addresses for snooping in the data cache and address register queues, snoops for direct-store reply operations and reservations controlled by the load word and reserve indexed ( lwarx ) and store word conditional indexed ( stwcx. ) instructions, and maintains the touch load address for the data cache. the interface allows one level of pipelining; that is, with certain restrictions described in subsequent sections, there can be as many as two outstanding transactions at any given time. accesses are prioritized with load operations preceding store operations. instructions are automatically fetched from the memory system into the instruction unit where they are dispatched to the execution units or forwarded to the branch processing unit at a peak rate of three instructions per clock (see section 7.3, ?timing considerations?). conversely, load and store instructions explicitly specify the movement of operands to and from the general-purpose and floating-point registers (gprs and fprs) and the memory system. when the g2 core encounters an instruction or data access, it calculates the logical address (effective address) and uses the low-order address bits to check for a hit in the on-chip, 16-kbyte instruction or data caches. during cache lookup, the instruction and data memory management units (mmus) use the higher-order address bits to calculate the virtual address, allowing them to calculate the physical address (real address). the physical address bits are then compared with the corresponding cache tag bits to determine if a cache hit occurred. if the access misses in the corresponding cache, the physical address is used to access system memory. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-2 g2 powerpc core reference manual motorola overview in addition to loads, stores, and instruction fetches, the core performs software table search operations following tlb misses, cache cast-out operations when least recently used (lru) cache lines are written to memory after a cache miss, and cache-line snoop push-out operations when a modified cache line experiences a snoop hit from another bus master. figure 9-1 shows the address path from the execution units and instruction fetcher, through the translation logic to the caches and system interface logic. the core uses separate address and data buses and a variety of control and status signals for performing reads and writes. the address bus is 32 bits wide and the data bus can be configured to be 32 or 64 bits wide on reset. the interface is synchronous?all core inputs are sampled at and all outputs are driven from the rising edge of the bus clock. the bus can run at the full processor-clock frequency or at an integer division of the processor-clock speed. the implementation of the internal voltage of the g2 core is process dependent; all i/o signals for the device depends on the system level requirement. note that the g2 core has no direct external i/o connection. 9.1.1 operation of the instruction and data caches the g2 core contains independent instruction and data caches. each cache is a physically- addressed, 16-kbyte cache with four-way set-associativity. both caches consist of 128 sets of four 8-word cache lines. because the on-chip data cache is a write-back primary cache, the predominant type of transaction is burst-read memory operations, followed by burst-write memory operations, and single-beat (noncacheable or write-through) memory read and write operations. additionally, there can be address-only operations, variants of the burst and single-beat operations (such as, global memory operations that are snooped and atomic memory operations), and address retry activity (such as, when a snooped read access hits a modified line in the cache). because data cache tags are single-ported, simultaneous load or store and snoop accesses cause resource contention. snoop accesses have the highest priority and are given first access to the tags, unless the snoop access coincides with a tag write; in this case, the snoop is retried and must re-arbitrate for cache access. loads or stores deferred due to snoop accesses are performed during the clock cycle following the snoop. the core supports a three-state coherency protocol (mei) that is a subset of the mesi (modified/exclusive/ shared/invalid) four-state protocol and operates coherently in systems that contain four-state caches. with the exception of the dcbz instruction, the core does not broadcast cache control instructions. the cache control instructions are intended for the management of the local cache but not for other caches in the system. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-3 overview figure 9-1. g2 core block diagram 64-bi t 64-bit (two instructions) 32-bit branch processing unit 32-/64-bit data bus 32-bit address bus instruction unit integer unit floating- point unit fpr file fp rename registers 16-kbyte d cache tags sequential fetcher ctr cr lr + * / fpscr system register unit + * / core interface d mmu srs dtlb dbat array touch load buffer copy-back buffer 64-bit dispatch unit 64-bit (two instructions) power dissipation control completion unit time base counter/ decrementer clock multiplier jtag/cop interface xer i mmu srs itlb ibat array 16-kbyte i cache tags 64-bit 64-bit 32-bit gpr file load/store unit + 64-bit gp rename registers instruction queue + f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-4 g2 powerpc core reference manual motorola overview cache lines in the core are loaded in four beats of 64 bits each (or eight 32-bit beats when operating in 32-bit bus mode). the burst load is performed as a critical-double-word-first operation. the cache that is being loaded is blocked to internal accesses until the load completes (that is, no hits under misses). the critical-double-word is simultaneously written to the cache and forwarded to the requesting unit, minimizing stalls due to load delays. cache lines are selected for replacement based on an lru algorithm. each time a cache line is accessed, it is tagged as the most recently used line of the set. when a miss occurs, if all lines in the set are marked as valid, the lru line is replaced with the new data. when data to be replaced is in the modified state, the modified data is written into a write-back buffer while the missed data is being read from memory. when the load completes, the core pushes the replaced line from the write-back buffer to main memory in a burst write operation. 9.1.2 operation of the system interface memory accesses can occur in single-beat (1 to 8 bytes) and four-beat (32 bytes) burst data transfers when the core is configured with a 64-bit data bus (core_32bitmode signal is negated at reset). when the core is in the optional 32-bit data bus mode (core_32bitmode signal is asserted at reset), memory accesses can occur in single-beat (1 to 4 bytes), two-beat (8 bytes), and eight-beat (32 bytes) bursts. the address and data buses are independent for memory accesses to support pipelining and split transactions. the core can pipeline as many as two transactions and has limited support for out-of-order split-bus transactions. access to the 60x bus interface is granted through an arbitration mechanism external to the core that allows devices to compete for bus mastership. this arbitration mechanism is flexible, allowing the core to be integrated into systems that implement various fairness and bus-parking procedures to avoid arbitration overhead. typically, memory accesses are weakly ordered?sequences of operations, including load/store string and multiple instructions, do not necessarily complete in the order they begin?maximizing the bus efficiency without sacrificing data coherency. the core allows load operations to precede store operations (except when a dependency exists). in addition, the core can be configured to reorder high-priority store operations ahead of lower-priority store operations. because the processor can dynamically optimize run-time ordering of load/store traffic, overall performance is improved. note that the synchronize ( sync ) instruction can be used to enforce strong ordering. the following sections describe how the g2 core interface operates, providing detailed timing diagrams that show how the signals interact. a collection of more general timing diagrams are included as examples of typical bus operations. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-5 memory access protocol 9.1.3 optional 32-bit data bus mode the g2 core supports an optional 32-bit data bus mode, which differs from the 64-bit data bus mode only in the byte lanes involved in data transfers and the number of data beats performed. a data tenure in the 32-bit data bus mode takes one, two, or eight beats depending on the transfer size and the cache mode for the address. for additional information, see section 9.6.1, ?32-bit data bus mode.? 9.1.4 direct-store accesses the g2 core does not support the extended transfer protocol for accesses to the direct-store storage space. if sr[t] is set, the memory access is a direct-store access. an attempt to access to a direct-store segment results in a dsi exception. 9.2 memory access protocol figure 9-2 shows that the address and data tenures are distinct from one another and that both consist of three phases?arbitration, transfer, and termination. address and data tenures are independent (indicated in figure 9-2 by the fact that the data tenure begins before the address tenure ends), which allows split-bus transactions to be implemented at the system level in multiprocessor systems. figure 9-2 shows a data transfer that consists of a single-beat transfer of as many as 64 bits. four-beat burst transfers of 32-byte cache lines require data transfer termination signals for each beat of data. figure 9-2. overlapping tenures on the bus for a single-beat transfer arbitration transfer termination address tenure arbitration single-beat transfer termination data tenure independent address and data f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-6 g2 powerpc core reference manual motorola memory access protocol the basic functions of the address and data tenures are as follows: address tenure ? arbitration: during arbitration, address bus arbitration signals are used to gain address bus mastership. ? transfer: after the core is the address bus master, it transfers the address on the address bus. the address signals and the transfer attribute signals control the address transfer. the address parity and address parity error signals ensure the integrity of the address transfer. ? termination: after the address transfer, the system signals that the address tenure is completed or that it must be repeated. data tenure ? arbitration: to begin the data tenure, the core arbitrates for data bus mastership. ? transfer: after the core is the data bus master, it samples the data bus for read operations or drives the data bus for write operations. the data parity and data parity error signals ensure the integrity of the transfer. ? termination: data termination signals are required after each beat. note that in a single-beat transaction, the data termination signals also indicate the end of the tenure, while in burst accesses, the data termination signals apply to individual beats and indicate the end of the tenure only after the final data beat. the core generates an address-only bus transfer during the execution of the dcbz instruction, and uses only the address bus with no data transfer involved. additionally, the core retry capability provides an efficient snooping protocol for systems with multiple memory systems (including caches) that must remain coherent. 9.2.1 arbitration signals arbitration for both address and data bus mastership is performed by a central, external arbiter and, minimally, by the arbitration signals shown in section 8.3.1, ?address bus arbitration signals.? most arbiter implementations require additional signals to coordinate bus master/slave/snooping activities. note that two arbitration signals?address bus busy (core_abb x ) and data bus busy (core_dbb x ) are both inputs and outputs on the g2 core. these signals are inputs unless the mpc603e has mastership of one or both of the respective buses; they must be connected high through pull-up resistors so that they remain negated when no devices have control of the buses. the following list describes the address arbitration signals: core_br (bus request)?assertion indicates that the core is requesting mastership of the address bus. core_bg (bus grant)?assertion indicates that the core may, with the proper qualification, assume mastership of the address bus. a qualified bus grant occurs f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-7 memory access protocol when core_bg is asserted and core_abb_in and core_artry_in (after core_aack ) are not asserted. if the g2 core is parked, core_br need not be asserted for the qualified bus grant. core_abb_out (address bus busy)?assertion by the core indicates that the core is the address bus master. the following list describes the data arbitration signals: core_dbg (data bus grant)?indicates that the core may, with the proper qualification, assume mastership of the data bus. a qualified data bus grant occurs when core_dbg is asserted while core_dbb_in , core_drtry , and core_artry_in are negated; that is, the data bus is not busy (core_dbb_in is negated), there is no outstanding attempt to retry the current data tenure (core_drtry is negated), and there is no outstanding attempt to perform an core_artry_in of the associated address tenure. core_dbb x is driven by the current bus master, core_drtry is driven only by the system, and core_artry is driven from the bus, but only for the address tenure associated with the current data tenure (that is, not from another address tenure). core_dbwo (data bus write only)?assertion indicates that the core may perform the data bus tenure for an outstanding write address even if a read address is pipelined before the write address. if core_dbwo is asserted, the core assumes data bus mastership for a pending data bus write operation; the core takes the data bus for a pending read operation if this input is asserted along with core_dbg and no write is pending. care must be taken with core_dbwo to ensure the desired write is queued (for example, a cache-line snoop push-out operation). core_dbb_out (data bus busy)?assertion by the core indicates that the core is the data bus master. the core always assumes data bus mastership if it needs the bus and is given a qualified data bus grant (see core_dbg ). for more detailed information on the arbitration signals, refer to section 8.3.1, ?address bus arbitration signals,? and section 8.3.6, ?data bus arbitration signals.? 9.2.2 address pipelining and split-bus transactions the 60x bus protocol provides independent address and data bus capability to support pipelined and split-bus transaction system organizations. address pipelining allows the address tenure of a new bus transaction to begin before the data tenure of the current transaction has finished. split-bus transaction capability allows other bus activity to occur (either from the same master or from different masters) between the address and data tenures of a transaction. while this capability does not inherently reduce memory latency, support for address pipelining and split-bus transactions can greatly improve effective bus/memory throughput. for this reason, these techniques are most effective in shared-memory multiprocessor f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-8 g2 powerpc core reference manual motorola memory access protocol implementations where bus bandwidth is an important measurement of system performance. external arbitration is required in systems in which multiple devices must compete for the system bus. the design of the external arbiter affects pipelining by regulating address bus grant (core_bg ), data bus grant (core_dbg ), and address acknowledge (core_aack ) signals. for example, a one-level pipeline is enabled by asserting core_aack to the current address bus master and granting mastership of the address bus to the next requesting master before the current data bus tenure has completed. two address tenures can occur before the current data bus tenure completes. the core can pipeline its own transactions to a depth of one level (intraprocessor pipelining); however, the 60x bus protocol does not constrain the maximum number of levels of pipelining that can occur on the bus between multiple masters (interprocessor pipelining). the external arbiter must control the pipeline depth and synchronization between masters and slaves. in a pipelined implementation, data bus tenures are kept in strict order with respect to address tenures. however, external hardware can further decouple the address and data buses, allowing the data tenures to occur out of order with respect to the address tenures. this requires some form of system tag to associate the out-of-order data transaction with the proper originating address transaction (not defined for the g2 core interface). individual bus requests and data bus grants from each processor can be used by the system to implement tags to support interprocessor, out-of-order transactions. the g2 core supports a limited intraprocessor out-of-order, split-transaction capability via the data bus write only (core_dbwo ) signal. for more information concerning the use of core_dbwo , see section 9.10, ? using core-dbwo (data bus write only).? 9.2.3 timing diagram conventions table 9-1 shows the conventions used in the timing diagrams. this is a synchronous interface?all core input signals are sampled and output signals are driven on the rising edge of the bus clock cycle. table 9-1. timing diagram legend feature example description grey core_artry_in core input while the core is the bus master bold overbar core_br core output while the core is the bus master plain data core input or output while the core is the bus master + addr+ core output (grouped: here, address plus attributes) plain overbar qual_bg internal core signal inaccessible to the user, but used in diagrams to clarify operations f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-9 address bus tenure 9.3 address bus tenure this section describes the address bus arbitration, transfer, and termination phases. 9.3.1 address bus arbitration when the core needs access to the 60x bus and it is not parked (core_bg is negated), it asserts bus request (core_br ) until it is granted mastership of the bus and the bus is available (see figure 9-3). the external arbiter must grant master-elect status to the potential master by asserting the bus grant (core_bg ) signal. the core requesting the bus determines that the bus is available when the core_abb_in signal is negated. when the address bus is not busy (core_abb_in is negated), core_bg is asserted, and the address retry (core_artry ) input is negated. this is referred to as a qualified bus grant. the core assumes address bus mastership by asserting core_abb_out when it receives a qualified bus grant. external arbiters must allow only one device at a time to be the address bus master. in implementations where no other device can be a master, core_bg can be grounded (always asserted) to continually grant mastership of the address bus to the core. if the core asserts core_br before the external arbiter asserts core_bg , the core is considered to be unparked, as shown in figure 9-3. figure 9-4 shows the parked case, where a qualified bus grant exists on the clock edge following a need_bus condition. note that the bus clock cycle required for arbitration is eliminated if the core is parked, reducing overall memory curled arrow dependency zig-zag indication that some clocks may have been skipped unshaded a valid output or input signal or bus that can be in any of the possible states indicated shaded core nonsampled input or indeterminately driven output among the possible states indicated. dot signal with sample point dot on dotted vertical line a sampled condition (dot on high or low state) with multiple dependencies dotted signal timing for a signal had it been asserted table 9-1. timing diagram legend (continued) feature example description f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-10 g2 powerpc core reference manual motorola address bus tenure latency for a transaction. the core always negates core_abb_out for at least one bus clock cycle after core_aack is asserted, even if it is parked and has another transaction pending. typically, bus parking is provided to the device that was the most recent bus master. however, system designers may choose other schemes, such as providing unrequested bus grants in situations where it is easy to correctly predict the next device requesting bus mastership. when the core receives a qualified bus grant, it assumes address bus mastership by asserting core_abb_out and negating core_br . meanwhile, the core drives the address for the requested access onto the address bus and asserts core_ts_out to indicate the start of a new transaction. note that the core may assert core_br without using the bus after it receives the qualified bus grant when external bus arbitration logic is designed. for example, in a system using bus snooping, if the core asserts core_br to perform a replacement copy-back operation, another device can invalidate that line before the core is granted mastership of the bus. in that case, once the core is granted the bus, it no longer needs to perform the copy-back operation; therefore, the core does not assert core_abb_out and does not use the bus for the copy-back operation. note that the core asserts core_br for at least 1 clock cycle in these instances. figure 9-3. address bus arbitration ?101 bus clock need_bus core_br core_bg core_abb_in core_artry qual_bg core_abb_out f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-11 address bus tenure figure 9-4. address bus arbitration showing bus parking 9.3.2 address transfer during the address transfer, the physical address and all attributes of the transaction are transferred from the bus master to slave devices. snooping logic may monitor the transfer to enforce cache coherency; see description of bus snooping in section 9.3.3, ?address transfer termination.? the signals used in the address transfer include the following signal groups: address transfer start signal: transfer start (core_ts_out ) address transfer signals: address bus (core_a_out[0:31]), address parity (core_ap_out[0:3]), and address parity error (core_ape ). address transfer attribute signals: transfer type (core_tt_out[0:4]), transfer code (core_tc[0:1]), transfer size (core_tsiz[0:2]), transfer burst (core_tbst ), cache inhibit (core_ci ), write-through (core_wt ), global (core_gbl_out ), and cache set element (core_cse[0:1]). figure 9-5 shows that the timing for all of these signals, except core_ts_out and core_ape , is identical. all of the address transfer and address transfer attribute signals are combined into the addr+ grouping in figure 9-5. the core_ts_out signal indicates that the core has begun an address transfer and that the address and transfer attributes are valid (within the context of a synchronous bus). the core always asserts core_ts_out coincident with core_abb_out . as an input, core_ts_in need not coincide with the assertion of core_abb_in need_bus core_br core_bg core_abb_in core_artry qual_bg core_abb_out bus clock ?1 0 1 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-12 g2 powerpc core reference manual motorola address bus tenure on the bus (that is, core_ts_in can be asserted with, or on, a subsequent clock cycle after core_abb_in is asserted; the core tracks this transaction correctly). in figure 9-5, the address transfer occurs during bus clock cycles 1 and 2 (arbitration occurs in bus clock cycle 0 and the address transfer is terminated in bus clock 3). in this diagram, the address bus termination input, core_aack , is asserted to the core on the bus clock following assertion of core_ts_out (as shown by the dependency line). this is the minimum duration of the address transfer for the core; the duration can be extended by delaying the assertion of core_aack for one or more bus clocks. figure 9-5. address bus transfer 9.3.2.1 address bus parity the core always generates 1 bit of correct odd-byte parity for each of the 4 bytes of address when a valid address is on the bus. the calculated values are placed on the core_ap_out[0:3] outputs when the core is the address bus master. if the core is not the master, and core_ts_in and core_gbl_in are asserted together (qualified condition for snooping memory operations), the calculated values are compared with the core_ap_in[0:3] inputs. if there is an error and address parity checking is enabled (hid0[eba] is set), the core_ape output is asserted. an address bus parity error causes a checkstop condition if msr[me] is cleared. for more information about checkstop conditions, see chapter 5, ?exceptions.? 9.3.2.2 address transfer attribute signals the transfer attribute signals include several encoded signals such as the transfer type (both core_tt_in[0:4], core_tt_out[0:4]) signals, transfer burst (core_tbst_out ) signal, transfer size (core_tsize[0:2]) signals, and transfer code (core_tc[0:1]) signals. section 8.3.4, ?address 01234 qual_bg core_ts_out core_abb_out addr+ core_aack core_artry bus clock f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-13 address bus tenure transfer attribute signals,? describes the encodings for the address transfer attribute signals. 9.3.2.2.1 transfer type (core_tt_in[0:4], core_tt_out[0:4]) signals snooping logic should fully decode the transfer type input signals if the core_gbl_in signal is asserted. slave devices can sometimes use the individual transfer type signals without fully decoding the group. for a complete description of the encoding for the transfer type signals, refer to table 8-5 and table 8-6. 9.3.2.2.2 transfer size (core_tsiz[0:2]) signals the transfer size signals (core_tsiz[0:2]) indicate the size of the requested data transfer as shown in table 9-2. these signals may be used along with core_tbst_out and core_a_out[29:31] to determine which portion of the data bus contains valid data for a write transaction or which portion of the bus should contain valid data for a read transaction. note that for a burst transaction (as indicated by the assertion of core_tbst_out ), core_tsiz[0:2] are always set to 0b010. therefore, if core_tbst_out is asserted, the memory system should transfer a total of 8 words (32 bytes), regardless of the core_tsiz[0:2] encoding. the basic coherency size of the bus is defined to be 32 bytes (corresponding to one cache line). data transfers that cross an aligned, 32-byte boundary either must present a new address onto the bus at that boundary (for coherency consideration) or must operate as noncoherent data with respect to the core. the core never generates a bus transaction with a transfer size of 5, 6, or 7 bytes. table 9-2. transfer size signal encodings core_tbst_out core_tsiz[0:2] transfer size 32-bit bus mode 64-bit bus mode core_tsiz0 core_tsiz1 core_tsiz2 asserted 0 1 0 8-word burst 8 beats 4 beats negated 0 0 0 8 bytes 2 beats 1 beat negated 0 0 1 1 byte 1 beat 1 beat negated 0 1 0 2 bytes 1 beat 1 beat negated 0 1 1 3 bytes 1 beat 1 beat negated 1 0 0 4 bytes 1 beat 1 beat negated 1 0 1 5 bytes (n/a) n/a n/a negated 1 1 0 6 bytes (n/a) n/a n/a negated 1 1 1 7 bytes (n/a) n/a n/a f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-14 g2 powerpc core reference manual motorola address bus tenure 9.3.2.3 burst ordering during data transfers during burst data transfer operations, 32 bytes of data (one cache line) are transferred to or from the cache in order. burst write transfers are always performed zero-double-word-first, but because burst reads are performed critical-double-word-first, a burst read transfer may not start with the first double word of the cache line, and the cache line fill may wrap around the end of the cache line. this section describes burst ordering for the core when operating in either the 64- or 32-bit bus mode. table 9-3 describes the burst ordering when the core is configured with a 64-bit data bus. table 9-4 describes the burst ordering when the core is configured with a 32-bit bus. 9.3.2.4 effect of alignment in data transfers (64-bit bus) table 9-5 lists the aligned transfers that can occur on the 60x bus when configured with a 64-bit width. in these transfers data is aligned to an address that is an integer multiple of the table 9-3. burst ordering?64-bit bus data transfer for starting address core_a_out x : a_out[27:28] = 00 a_out[27:28] = 01 a_out[27:28] = 10 a_out[27:28] = 11 first data beat dw0 dw1 dw2 dw3 second data beat dw1 dw2 dw3 dw0 third data beat dw2 dw3 dw0 dw1 fourth data beat dw3 dw0 dw1 dw2 note: core_a_out[29:31] are always 0b000 for burst transfers by the core. table 9-4. burst ordering?32-bit bus data transfer for starting address core_a_out x : a_out[27:28] = 00 a_out[27:28] = 01 a_out[27:28] = 10 a_out[27:28] = 11 first data beat dw0-upper_word dw1-upper_word dw2-upper_word dw3-upper_word second data beat dw0-lower_word dw1-lower_word dw2-lower_word dw3-lower_word third data beat dw1-upper_word dw2-upper_word dw3-upper_word dw0-upper_word fourth data beat dw1-lower_word dw2-lower_word dw3-lower_word dw0-lower_word fifth data beat dw2-upper_word dw3-upper_word dw0-upper_word dw1-upper_word sixth data beat dw2-lower_word dw3-lower_word dw0-lower_word dw1-lower_word seventh data beat dw3-upper_word dw0-upper_word dw1-upper_word dw2-upper_word eighth data beat dw3-lower_word dw0-lower_word dw1-lower_word dw2-lower_word note: core_a_out[29:31] are always 0b000 for burst transfers by the core. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-15 address bus tenure size of the data. for example, table 9-5 shows that 1-byte data is always aligned; however, for a 4-byte word to be aligned, it must be at on an address that is a multiple of 4. the g2 core supports misaligned memory operations, although their use may substantially degrade performance. misaligned memory transfers address memory that is not aligned to the size of the data being transferred (such as, a word read of an odd byte address). although most of these operations hit in the primary cache (or generate burst memory operations if they miss), the core interface supports misaligned transfers within a word (32-bit aligned) boundary, as shown in table 9-6. note that the 4-byte transfer in table 9-6 is only one example of misalignment. as long as the attempted transfer does not cross a word boundary, the core can transfer the data on the misaligned address (for example, a half-word read from an odd byte-aligned address). an attempt to address data that crosses a word boundary requires two bus transfers to access the data. note that an attempt to load or store a floating-point operand that is not word-aligned results in a floating-point alignment exception. for more information, refer to section 5.5.6, ?alignment exception (0x00600).? table 9-5. aligned data transfers (64-bit bus) transfer size tsiz0 tsiz1 tsiz2 core_a_out [29:31] data bus byte lanes 1 1 a: these entries indicate the byte portions of the requested operand that are read or written during that bus transaction. ?: these entries are not required and are ignored during read transactions and are driven with undefined data during all write transactions. 01234567 byte 0 0 1 0 0 0 a ??????? 0 0 1 0 0 1 ? a ?????? 0 0 1 0 1 0 ?? a ????? 0 0 1 0 1 1 ??? a ???? 0 0 1 1 0 0 ???? a ??? 0 0 1 1 0 1 ????? a ?? 0 0 1 1 1 0 ?????? a ? 0 0 1 1 1 1 ??????? a half word 0 1 0 0 0 0 a a ?????? 0 1 0 0 1 0 ?? a a ???? 0 1 0 1 0 0 ???? a a ?? 0 1 0 1 1 0 ?????? a a word 1 0 0 0 0 0 a a a a ???? 1 0 0 1 0 0 ???? a a a a double word 0 0 0 0 0 0 aaaaaaaa f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-16 g2 powerpc core reference manual motorola address bus tenure due to the performance degradations associated with misaligned memory operations, they are best avoided. address translation logic can also generate substantial exception overhead when the load/store multiple and load/store string instructions access misaligned data, another reason to avoid using these instructions. it is strongly recommended that software attempt to align code and data where possible. 9.3.2.5 effect of alignment in data transfers (32-bit bus) the aligned data transfer cases for 32-bit data bus mode are shown in table 9-7. all of the transfers require a single data beat (if caching-inhibited or write-through) except for double-word cases which require two data beats. the double-word case is only generated by the core for load or store double operations to/from the floating-point gprs. all caching-inhibited instruction fetches are performed as word operations. table 9-6. misaligned data transfers (4-byte examples) transfer size (4 bytes) tsiz[0:2] core_a_out [29:31] data bus byte lanes 01234567 aligned 1 0 0 0 0 0 aaaa ???? misaligned: first access0 1 1 0 0 1 a a a ???? second access0 0 1 1 0 0 ???? a ??? misaligned: first access0 1 0 0 1 0 ?? a a ???? second access0 1 0 1 0 0 ???? a a ?? misaligned: first access0 0 1 0 1 1 ??? a ???? second access0 1 1 1 0 0 ???? a a a ? aligned 1 0 0 1 0 0 ???? aaaa misaligned: first access0 1 1 1 0 1 ????? a a a second access0 0 1 0 0 0 a ??????? misaligned: first access0 1 0 1 1 0 ?????? a a second access0 1 0 0 0 0 a a ?????? misaligned: first access0 0 1 1 1 1 ??????? a second access0 1 1 0 0 0 a a a ????? notes : a: byte lane used. ? : byte lane not used. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-17 address bus tenure misaligned data transfers when the core is configured with a 32-bit data bus operate in the same way as when configured with a 64-bit data bus, with the exception that only the core_dh_out[0:31] or core_dh_in[0:31] data bus is used. see table 9-8 for an example of a 4-byte misaligned transfer starting at each possible byte address within a double word. table 9-7. aligned data transfers (32-bit bus mode) transfer size tsiz0 tsiz1 tsiz2 core_a_out [29:31] data bus byte lanes 01234567 byte 0 0 1 0 0 0 a???xxxx 0 0 1 0 0 1 ?ax?xxxx 0 0 1 0 1 0 ??a?xxxx 0 0 1 0 1 1 ???axxxx 0 0 1 1 0 0 a???xxxx 0 0 1 1 0 1 ?a??xxxx 0 0 1 1 1 0 ??a?xxxx 0 0 1 1 1 1 ???axxxx half word 0 1 0 0 0 0 aa??xxxx 0 1 0 0 1 0 ??aaxxxx 0 1 0 1 0 0 aa??xxxx 0 1 0 1 1 0 ??aaxxxx word 1 0 0 0 0 0 aaaa xxxx 1 0 0 1 0 0 aaaa xxxx double word0 0 0 0 0 0 aaaa xxxx second beat0 0 0 0 0 0 aaaa xxxx notes: a: byte lane used. ? : byte lane not used. x: byte lane not used in 32-bit bus mode. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-18 g2 powerpc core reference manual motorola address bus tenure 9.3.2.5.1 alignment of external control instructions the size of the data transfer associated with the eciwx and ecowx instructions is always 4 bytes. however, if either of these instructions is misaligned and crosses any word boundary, the core generates two bus operations, each smaller than 4 bytes. for the first bus operation, bits core_a_out[29:31] equal bits 29?31 of the effective address of the instruction, which is 0b101, 0b110, or 0b111. the size associated with the first bus operation will be 3, 2, or 1 bytes, respectively. for the second bus operation, bits core_a_out[29:31] equal 0b000 and the size associated with the operation is 1, 2, or 3 bytes, respectively. for both operations, core_tbst_out and core_tsiz[0:2] are redefined to specify the resource id (rid). the resource id is copied from bits 28?31 of the ear. for eciwx / ecowx operations, ear[28] is set if core_tbst_out is high. the size of the second bus operation cannot be deduced from the operation itself; the system must determine how many bytes were transferred on the first bus operation to determine the size of the second operation. furthermore, the two bus operations associated with such a misaligned external control instruction are not atomic. that is, the core may initiate other types of memory operations table 9-8. misaligned 32-bit data bus transfer (4-byte examples) transfer size (4 bytes) core_tsiz [0:2] core_a-out [29:31] data bus byte lanes 01234567 aligned 1 0 0 0 0 0 aaaa xxxx misaligned:first access0 1 1 0 0 1 aaaxxxx second access0 0 1 1 0 0 a???xxxx misaligned:first access0 1 0 0 1 0 ??aaxxxx second access0 1 0 1 0 0 aa?xxxxx misaligned:first access0 0 1 0 1 1 ???axxxx second access0 1 1 1 0 0 aaa?xxxx aligned 1 0 0 1 0 0 aaaa xxxx misaligned:first access0 1 1 1 0 1 ?aaaxxxx second access0 0 1 0 0 0 a???xxxx misaligned:first access0 1 0 1 1 0 ??aaxxxx second access0 1 0 0 0 0 aa??xxxx misaligned:first access0 0 1 1 1 1 ???axxxx second access0 1 1 0 0 0 aaa?xxxx notes: a: byte lane used. ? : byte lane not used. x : byte lane not used in 32-bit bus mode. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-19 address bus tenure between the two transfers. also, the two bus operations associated with a misaligned ecowx may be interrupted by an eciwx bus operation, and vice versa. the core guarantees that the two operations associated with a misaligned ecowx cannot be interrupted by another ecowx operation. because a misaligned external control address is considered a programming error, the system may choose to assert core_tea or otherwise cause an exception when a misaligned external control bus operation occurs. 9.3.2.6 transfer code (core_tc[0:1]) signals the core_tc0 and core_tc1 signals provide supplemental information about the corresponding address. note that the core_tc x signals can be used with both core_tt_in[0:4] and core_tt_out[0:4], and both core_tbst_in and core_tbst_out signals to further define the current transaction. table 9-9 shows the encodings of the core_tc[0:1] signals. 9.3.3 address transfer termination the address tenure of a bus operation is terminated when completed with the assertion of core_aack , or retried with the assertion of core_artry_in . the g2 core does not terminate the address transfer until the core_aack (address acknowledge) input is asserted; therefore, the system can extend the address transfer phase by delaying the assertion of core_aack to the g2 core. core_aack can be asserted as early as the bus clock cycle following core_ts_in (see figure 9-6), which allows a minimum address tenure of two bus cycles. however, when the core clock is configured for 1:1 or 1.5:1 processor core-to-bus clock mode, the core_artry_out snoop response cannot be determined in the minimum allowed address tenure period. thus, in a system with two or more g2 cores using 1:1 or 1.5:1 clock mode, core_aack must not be asserted until the third clock of the address tenure (one address wait state) to allow the snooping g2 cores an opportunity to assert core_artry_in on the bus. for other clock configurations (2:1, 2.5:1, 3:1, 3.5:1, and 4:1), the core_artry_out snoop response can be determined in the minimum address tenure period, and core_aack may be asserted as early as the second bus clock of the address tenure. as shown in figure 9-6, these signals are asserted for one bus clock cycle, three-stated for half of the next bus clock table 9-9. transfer code encoding core_tc[0:1] read write 0 0 data transaction any write 0 1 touch load n/a 1 0 instruction fetch n/a 1 1 (reserved) n/a f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-20 g2 powerpc core reference manual motorola address bus tenure cycle, driven high until the following bus cycle, and finally three-stated. note that core_aack must be asserted for only one bus clock cycle. the address transfer can be terminated with the requirement to retry if core_artry_in is asserted anytime during the address tenure and through the cycle following core_aack . the assertion causes the entire transaction (address and data tenure) to be rerun. as a snooping device, the g2 core asserts core_artry_out for a snooped transaction that hits modified data in the data cache that must be written back to memory, or if the snooped transaction could not be serviced. as a bus master, the core responds to an assertion of core_artry_out by aborting the bus transaction and re-requesting the bus. note that after recognizing an assertion of core_artry_out and aborting the transaction in progress, the g2 core is not guaranteed to run the same transaction the next time it is granted the bus due to internal reordering of load and store operations. if an address retry is required, the core_artry_in response is asserted by a bus snooping device as early as the second cycle after the assertion of core_ts_out (or until the third cycle following core_ts_out if 1:1 or 1.5:1 processor core to bus clock ratio is selected). once asserted, core_artry_in must remain asserted through the cycle after the assertion of core_aack . the assertion of core_artry_in during the cycle after the assertion of core_aack is referred to as a qualified core_artry_in . an earlier assertion of core_artry_in during the address tenure is referred to as an early core_artry_in . as a bus master, the g2 core recognizes either an early or qualified core_artry_in and prevents the data tenure associated with the retried address tenure. if the data tenure has already begun, the core aborts and terminates the data tenure immediately even if the burst data has been received. if the assertion of core_artry_in is received up to or on the bus cycle following the first (or only) assertion of core_ta for the data tenure, the core ignores the first data beat, and if it is a load operation, does not forward data internally to the cache and execution units. if core_artry_in is asserted after the first (or only) assertion of core_ta , improper operation of the bus interface may result. during the clock of a qualified core_artry_in , the g2 core also determines if it should negate core_br and ignore core_bg on the following cycle. on the following cycle, only the snooping master that asserted core_artry_in and needs to perform a snoop copy-back operation is allowed to assert core_br . this guarantees the snooping master an opportunity to request and be granted the bus before the just-retried master can restart its transaction. note that a nonclocked bus arbiter may detect the assertion of address bus request by the bus master that asserted core_artry_in , and return a qualified bus grant one cycle earlier than shown in figure 9-6. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-21 data bus tenure figure 9-6. snooped address cycle with core_artry_out 9.4 data bus tenure this section describes the data bus arbitration, transfer, and termination phases defined by the g2 core memory access protocol. the phases of the data tenure are identical to those of the address tenure, underscoring the symmetry in the control of the two buses. 9.4.1 data bus arbitration data bus arbitration uses the data arbitration signal group?core_dbg , core_dbwo , and both core_dbb signals. additionally, the combination of core_ts_out and tt[0:4] provides information about the data bus request to external logic. the core_ts_out signal is an implied data bus request from the core; the arbiter must qualify core_ts_out with the transfer type core_tt_out encodings to determine if the current address transfer is an address-only operation, which does not require a data bus transfer (see figure 9-6). if the data bus is needed, the arbiter grants data bus mastership by asserting the core_dbg input to the core. as with the address bus arbitration phase, the g2 core must qualify the core_dbg input with a number of input signals before assuming bus mastership, as shown in figure 9-7. 12 34567 core_ts_in core_abb_in addr core_aack core_artry_out core_br qual_bg core_abb_out 8 bus clock f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-22 g2 powerpc core reference manual motorola data bus tenure figure 9-7. data bus arbitration a qualified data bus grant can be expressed as the following: qualified data bus grant = core_dbg asserted while core_dbb_out , core_drtry , and core_artry_out (associated with the data bus operation) are negated. when a data tenure overlaps with its associated address tenure, a qualified core_artry_out assertion coincident with a data bus grant signal does not result in data bus mastership (core_dbb_out is not asserted). otherwise, the g2 core always asserts core_dbb_out on the bus clock cycle after recognition of a qualified data bus grant. because the core can pipeline transactions, there may be an outstanding data bus transaction when a new address transaction is retried. in this case, the core becomes the data bus master to complete the previous transaction. 9.4.1.1 using the core_dbb_out signal the core_dbb_out signal should be connected between masters if data tenure scheduling is left to the masters. optionally, the memory system can control data tenure scheduling directly with core_dbg . however, it is possible to ignore the core_dbb_out signal in the system if the core_dbb_out input is not used as the final data bus allocation control between data bus masters, and if the memory system can track the start and end of the data tenure. if core_dbb_out is not used to signal the end of a data tenure, core_dbg is only asserted to the next bus master the cycle before the cycle that the next bus master may actually begin its data tenure, rather than asserting it earlier (usually during another master?s data tenure) and allowing the negation of core_dbb_out to be the final gating signal for a qualified data bus grant. even if core_dbb_out is ignored in the system, the g2 core always recognizes its own assertion of core_dbb_out and requires one cycle after data tenure completion to 0123 core_ts_out core_dbg core_dbb_in core_drtry qual_dbg core_dbb_out bus clock f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-23 data bus tenure negate its own core_dbb_out before recognizing a qualified data bus grant for another data tenure. if dbb is ignored in the system, it must still be connected to a pull-up resistor on the g2 core to ensure proper operation. 9.4.2 data bus write only as a result of address pipelining, the core may have up to two data tenures queued to perform when it receives a qualified core_dbg . generally, the data tenures should be performed in strict order (the same order) as their address tenures were performed. the core, however, also supports a limited out-of-order capability with the data bus write only (core_dbwo ) input. when recognized on the clock of a qualified core_dbg , core_dbwo may direct the core to perform the next pending data write tenure even if a pending read tenure would have normally been performed first. for more information on the operation of core_dbwo , refer to section 9.10, ? using core-dbwo (data bus write only).? if the g2 core has any data tenures to perform, it always accepts data bus mastership to perform a data tenure when it recognizes a qualified core_dbg . if core_dbwo is asserted with a qualified core_dbg and no write tenure is queued to run, the g2 core still takes mastership of the data bus to perform the next pending read data tenure. generally, core_dbwo should only be used to allow a copy-back operation (burst write) to occur before a pending read operation. if core_dbwo is used for single-beat write operations, it may negate the effect of the eieio instruction by allowing a write operation to precede a program-scheduled read operation. 9.4.3 data transfer the data transfer signals include both input and output signals of core_dh[0:31], core_dl[0:31], core_dp[0:7], and only output signal of core_dpe . for memory accesses, both input and output signals of core_dh and core_dl form a 64-bit data path for read and write operations. the g2 core transfers data in either single- or four-beat burst transfers when configured with a 64-bit data bus; when configured with a 32-bit data bus, the g2 core performs one-, two-, and eight-beat data transfers. single-beat operations can transfer from 1 to 8 bytes at a time and can be misaligned; see section 9.3.2.4, ?effect of alignment in data transfers (64-bit bus).? burst operations always transfer eight words and are aligned on eight-word address boundaries. burst transfers can achieve significantly higher bus throughput than single-beat operations. the type of transaction initiated by the g2 core depends on whether the code or data is cacheable and, for store operations, whether the cache is considered in write-back or write-through mode, which software controls on either a page or block basis. burst transfers support cacheable operations only; that is, memory structures must be marked as f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-24 g2 powerpc core reference manual motorola data bus tenure cacheable (and write-back for data store operations) in the respective page or block descriptor to take advantage of burst transfers. the core output core_tbst_out indicates to the system whether the current transaction is a single- or four-beat transfer (except during eciwx / ecowx transactions, when it signals the state of ear[28]). a burst transfer has an assumed address order. for load or store operations that miss in the cache (and are marked as cacheable and, for stores, write-back), the g2 core uses the double-word-aligned address associated with the critical code or data that initiated the transaction. this minimizes latency by allowing the critical code or data to be forwarded to the processor before the rest of the cache line is filled. for all other burst operations, however, the cache line is transferred beginning with the eight-word-aligned data. the g2 core does not directly support dynamic interfacing to subsystems with less than a 64-bit data path. it does, however, provide a static 32-bit data bus mode; for more information, see section 9.1.3, ?optional 32-bit data bus mode.? 9.4.4 data transfer termination four signals are used to terminate data bus transactions?core_ta , core_drtry (data retry), core-tea (transfer error acknowledge), and core_artry_in . the core_ta signal indicates normal termination of data transactions. it must always be asserted on the bus cycle coincident with the data that it is qualifying. it may be withheld by the slave for any number of clocks until valid data is ready to be supplied or accepted. core_drtry indicates invalid read data in the previous bus clock cycle. core_drtry extends the current data beat and does not terminate it. if it is asserted after the last (or only) data beat, the core negates core_dbb_out but still considers the data beat active and waits for another assertion of core_ta . core_drtry is ignored on write operations. core_tea indicates a nonrecoverable bus error event. upon receiving a final (or only) termination condition, the core always negates core_dbb_out for one cycle. if core_drtry is asserted by the memory system to extend the last (or only) data beat past the negation of core_dbb_out , the memory system should three-state the data bus on the clock after the final assertion of core_ta , even though it will negate core_drtry on that clock. this is to prevent a potential momentary data bus conflict if a write access begins on the following cycle. the core_tea signal is used to signal a nonrecoverable error during the data transaction. it may be asserted on any cycle during core_dbb_out , or on the cycle after a qualified core_ta during a read operation, except when no-core_drtry mode is selected (where no-core_drtry mode cancels checking the cycle after core_ta ). the assertion of core_tea terminates the data tenure immediately, even if in the middle of a burst; however, it does not prevent incorrect data that has just been acknowledged with core_ta from being written into the g2 core cache or gprs. the assertion of core_tea initiates either a machine check exception or a checkstop condition based on the setting of the msr. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-25 data bus tenure an assertion of core_artry_in causes the data tenure to be terminated immediately if core_artry_in is for the address tenure associated with the data tenure in operation. if core_artry_out is connected for the g2 core, the earliest allowable assertion of core_ta to the core is directly dependent on the earliest possible assertion of core_artry_in to the g2 core; see section 9.3.3, ?address transfer termination.? if the g2 core clock is configured for 1:1 or 1.5:1 (processor clock to bus clock ratio) mode and the core is performing a burst read into its data cache, at least one wait state must be provided between the assertion of core_ts and the first assertion of core_ta for that transaction. if no-core_drtry mode is also selected, at least two wait states must be provided. the wait states are required due to possible resource contention in the data cache caused by a block replacement (or cast-out) required in connection with the new linefill. these wait states may be provided by withholding the assertion of core_ta to the g2 core for that data tenure, or by withholding core_dbg to the core, thereby delaying the start of the data tenure. this restriction applies only to burst reads into the data cache when configured in 1:1 or 1.5:1 clock modes. (it does not apply to instruction fetches, write operations, noncachable read operations, or non-1:1 or non-1.5:1 clock modes.) 9.4.4.1 normal single-beat termination normal termination of a single-beat data read operation occurs when core_ta is asserted by a responding slave. the core_tea and core_drtry signals must remain negated during the transfer (see figure 9-8). figure 9-8. normal single-beat read termination core_ts_out qual_dbg core_dbb_out data core_ta_in core_drtry core_aack bus clock 01234 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-26 g2 powerpc core reference manual motorola data bus tenure the core_drtry signal is not sampled during data writes, as shown in figure 9-9. figure 9-9. normal single-beat write termination 9.4.4.2 normal burst termination normal termination of a burst transfer occurs when core_ta is asserted for four bus clock cycles, as shown in figure 9-10. the bus clock cycles in which core_ta is asserted need not be consecutive, thus allowing pacing of the data transfer beats. for read bursts to terminate successfully, core_tea and core_drtry must remain negated during the transfer. for write bursts, core_tea must remain negated for a successful transfer. core_drtry is ignored during data writes. figure 9-10. normal burst transaction 0123 core_ts_in qual_dbg core_dbb_out data core_ta_in core_drtry core_aack bus clock 12 34 5 6 7 core_ts_out qual_dbg core_dbb_out data core_ta_in core_drtry bus clock f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-27 data bus tenure for read bursts, core_drtry may be asserted one bus clock cycle after core_ta is asserted to signal that the data presented with core_ta is invalid and that the processor must wait for the negation of core_drtry before forwarding data to the processor (see figure 9-11). thus, a data beat can be terminated by a predicted branch with core_ta and then one bus clock cycle later confirmed with the negation of core_drtry . the core_drtry signal is valid only for read transactions. core_ta must be asserted on the bus clock cycle before the first bus clock cycle of the assertion of core_drtry ; otherwise the results are undefined. the core_drtry signal extends data bus mastership such that other processors cannot use the data bus until core_drtry is negated. therefore, in the example shown in figure 9-11, core_dbb_out cannot be asserted until bus clock cycle 5. this is true for both read and write operations even though core_drtry does not extend bus mastership for write operations. figure 9-11. termination with drtry figure 9-12 shows the effect of using core_drtry during a burst read. it also shows the effect of using core_ta to pace the data transfer rate. notice that in bus clock cycle 3 in figure 9-12, core_ta is negated for the second data beat. the g2 core data pipeline does not proceed until bus clock cycle 4, when core_ta is reasserted. note that core_drtry is useful for systems that implement predicted forwarding of data such as those with direct-mapped, second-level caches where hit/miss is determined on the following bus clock cycle, or for parity- or ecc-checked memory systems. note that core_drtry may not be implemented on other processors of this family. 9.4.4.3 data transfer termination due to a bus error the core_tea signal indicates that a bus error occurred. it may be asserted while core_dbb_out (and/or core_drtry for read operations) is asserted. asserting core_tea to the 12 34 5 core_ts_out qual_dbg core_dbb_out data core_ta_in core_drtry bus clock f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-28 g2 powerpc core reference manual motorola data bus tenure core terminates the transaction; that is, further assertions of core_ta and core_drtry are ignored and core_dbb_out is negated; see figure 9-12. figure 9-12. read burst with core_ta wait states and core_drtry assertion of the core_tea signal causes a machine check exception (and possibly a checkstop condition within the core). for more information, see section 5.5.2, ?machine check exception (0x00200).? note also that the g2 core does not implement a synchronous error capability for memory accesses. this means that the exception instruction pointer does not point to the memory operation that caused the assertion of core_tea , but to the instruction about to be executed (perhaps several instructions later). however, assertion of core_tea does not invalidate data entering the gpr or the cache. additionally, the corresponding address of the access that caused core_tea to be asserted is not latched by the g2 core. to recover, the exception handler must determine and remedy the cause of the core_tea , or the g2 core must be reset; therefore, this function should only be used to flag fatal system conditions to the processor (such as parity or uncorrectable ecc errors). after the g2 core has committed to run a transaction, that transaction must eventually complete. address retry causes the transaction to be restarted; core_ta wait states and core_drtry assertion for reads delay termination of individual data beats. eventually, however, the system must either terminate the transaction or assert the core_tea signal (and vector the core into a machine check exception.) for this reason, care must be taken to check for the end of physical memory and the location of certain system facilities to avoid memory accesses that result in the generation of machine check exceptions. note that core_tea generates a machine check exception depending on msr[me]. clearing the machine check exception enable control bits leads to a true checkstop condition (instruction execution halted and processor clock stopped). 123456789 core_ts_in qual_dbg core_dbb_out data core_ta_in core_drtry bus clock f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-29 data bus tenure 9.4.5 memory coherency?mei protocol the g2 core provides dedicated hardware to provide memory coherency by snooping bus transactions. the address retry capability enforces the three-state, mei cache-coherency protocol (see figure 9-13). the global (core_gbl_out ) output signal indicates whether the current transaction must be snooped by other snooping devices on the bus. address bus masters assert core_gbl_out to indicate that the current transaction is a global access (that is, an access to memory shared by more than one device). if core_gbl_in is not asserted for the transaction, that transaction is not snooped. when other devices detect the core_gbl_in input asserted, they must respond by snooping the broadcast address. normally, core_gbl_out reflects the m-bit value specified for the memory reference in the corresponding translation descriptor. note that care must be taken to minimize the number of pages marked as global, because the retry protocol discussed in the previous section 9.4.4, ?data transfer termination? is used to enforce coherency and can require significant bus bandwidth. when the g2 core is not the address bus master, core_gbl_out is an input. the core snoops a transaction if core_ts and core_gbl_out are asserted together in the same bus clock cycle (this is a qualified snooping condition). no snoop update to the core cache occurs if the snooped transaction is not marked global. this includes invalidation cycles. when the g2 core detects a qualified snoop condition, the address associated with the core_ts is compared against the data cache tags. snooping completes if no hit is detected. however, if the address hits in the cache, the core reacts according to the mei protocol shown in figure 9-13, assuming the wim bits are set to write-back, caching-allowed, and coherency-enforced modes (wim = 001). the g2 core on-chip data cache is implemented as a four-way set-associative cache. to facilitate external monitoring of the internal cache tags, the cache set entry (core_cse[0:1]) signals indicate which cache set is being replaced on read operations. note that these signals are valid only for core burst operations; for all other bus operations, core_cse[0:1] should be ignored. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-30 g2 powerpc core reference manual motorola data bus tenure figure 9-13. mei cache coherency protocol?state diagram (wim = 001) table 9-10 shows the core_cse encodings. table 9-10. core_cse[0:1] signals core_cse[0:1] cache set element 00 set 0 01 set 1 10 set 2 11 set 3 rh wh rh wh sh sh/cir wm sh/crw rm sh/crw bus transactions sh = snoop hit rh = read hit rm = read miss wh = write hit wm = write miss sh/crw = snoop hit, cacheable read/write sh/cir = snoop hit, cache inhibited read = cache line fill = snoop push wh exclusive modified invalid f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-31 timing examples 9.5 timing examples this section shows timing diagrams for various scenarios. figure 9-14 illustrates the fastest single-beat reads possible for the g2 core. this figure shows both minimal latency and maximum single-beat throughput. by delaying the data bus tenure, the latency increases, but, because of split-transaction pipelining, the overall throughput is not affected unless the data bus latency causes the third address tenure to be delayed. note that all bidirectional signals are three-stated between bus tenures. figure 9-14. fastest single-beat reads 1 2 3 4 5 6 7 8 9 10 11 12 core_br core_bg core_abb_out core_ts_in core_a_out[0:31] core_tt_in[0:4] core_tbst_in core_gbl_out core_aack core_artry_out core_dbg core_dbb_out core_d[0:63] core_ta core_drtry core_tea cpu a cpu a cpu a read read read in in in bus clock f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-32 g2 powerpc core reference manual motorola timing examples figure 9-15 illustrates the fastest single-beat writes supported by the core. all bidirectional signals are three-stated between bus tenures. figure 9-15. fastest single-beat writes core_br core_bg core_abb_out core_ts_out core_a_in[0:31] core_tt_out[0:4] core_tbst_out core_gbl_out core_aack core_artry_out core_dbg_out core_dbb_out core_d_out[0:63] core_ta_out core_drtry core_tea_out cpu a cpu a cpu a sbw sbw sbw out out out 1 2 3 4 5 6 7 8 9 10 11 12 bus clock f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-33 timing examples figure 9-16 shows three ways to delay single-beat reads showing data-delay controls: the core_ta signal can remain negated to insert wait states in clock cycles 3 and 4. for the second access, core_dbg could have been asserted in clock cycle 6. in the third access, core_drtry is asserted in clock cycle 11 to flush the previous data. note that all bidirectional signals are three-stated between bus tenures. the pipelining shown in figure 9-16 can occur if the second access is not another load (for example, an instruction fetch). figure 9-16. single-beat reads showing data-delay controls read read read core_br core_bg core_abb_out core_ts_out core_a_in0:31] core_tt_out[0:4] core_tbst_out core_gbl_out core_aack core_artry_out core_dbg_out core_dbb_out core_d[0:63] core_ta_out core_drtry core_tea_out cpu a cpu a cpu a in in bad in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 bus clock f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-34 g2 powerpc core reference manual motorola timing examples figure 9-17 shows data-delay controls in a single-beat write operation. note that all bidirectional signals are three-stated between bus tenures. data transfers are delayed in the following ways: the core_ta signal is held negated to insert wait states in clocks 3 and 4. in clock 6, core_dbg is held negated, delaying the start of the data tenure. the last access is not delayed (core_drtry is valid only for read operations). figure 9-17. single-beat writes showing data-delay controls core_br core_bg core_abb_out core_ts_out core_a_in[0:31] core_tt_out0:4] core_tbst_out core_gbl_out core_aack core_artry_out core_dbg_out core_dbb_out core_d[0:63] core_ta_out core_drtry core_tea_out cpu a cpu a cpu a sbw sbw sbw out out out 1 2 3 4 5 6 7 8 9 10 11 12 bus clock f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-35 timing examples figure 9-18 shows the use of data-delay controls with burst transfers. note that all bidirectional signals are three-stated between bus tenures. note the following: the first data beat of bursted read data (clock 0) is the critical quad word in 64-bit mode. the write burst shows the use of core_ta signal negation to delay the third data beat. the final read burst shows the use of core_drtry on the third data beat. the address for the third transfer is delayed until the first transfer completes. figure 9-18. burst transfers with data-delay controls core_br core_bg core_abb_out core_ts_out ] ] core_tbst_out core_gbl_out core_aack core_artry_out core_dbg_out core_dbb_ou t core_ta_out core_drtry core_tea_out cpu a in 0 cpu a cpu a read write read in 1 in 2 out 0 out 1 out 2 out 3 in 0 in 1 in 2 in 3 in 2 1 2 3 4 5 6 7 8 9 1011121314151617181920 bus clock core_br core_bg core_abb_out core_ts_out core_a_in[0:31] core_tt_out[0:4] core_tbst_out core_gbl_out core_aack core_artry_out core_dbg_out core_dbb_ou t core_d[0:63] core_ta_out core_drtry core_tea_out in 3 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-36 g2 powerpc core reference manual motorola timing examples figure 9-19 shows the use of the core_tea signal. note that all bidirectional signals are three-stated between bus tenures. note the following: the first data beat of the read burst (in clock 0) is the critical quad word. the core_tea signal truncates the burst write transfer on the third data beat. the g2 core eventually causes an exception to be taken on the core_tea event. figure 9-19. use of transfer error acknowledge (tea ) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 core_br core_bg core_abb_out core_ts_out core_a_in[0:31] core_tt_out[0:4] core_tbst_out core_gbl_out core_aack core_artry_out core_dbg_out core_dbb_out core_d[0:63] core_ta_out core_drtry core_tea_out cpu a in 0 cpu a cpu a read write read in 1 in 2 in 3 out 0 out 1 out 2 in 0 in 1 in 3 in 2 bus clock in 3 in 3 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-37 optional bus configurations 9.6 optional bus configurations the g2 core supports the following three optional bus configurations that are selected by the assertion or negation of core_drtry , core_tlbisync , and core_qack during the negation of core_hreset . 32-bit data bus mode (see section 9.6.1, ?32-bit data bus mode,? for details) no-core_drtry mode (see section 9.6.2, ? no_core_drtry mode,? for details) reduced-pinout mode (see section 9.6.3, ?reduced-pinout mode,? for details) the operation and selection of the optional bus configurations are described in the following sections. 9.6.1 32-bit data bus mode the g2 core supports an optional 32-bit data bus mode, which differs from the 64-bit data bus mode only in the byte lanes involved in the transfer and the number of data beats performed. when the g2 core in 32-bit data bus mode, only byte lanes 0 through 3 are used corresponding to core_dh[0:31] (both input and output signals) and core_dp[0:3] (both input and output signals). byte lanes 4 through 7 corresponding to core_dl[0:31] (both input and output signals) and core_dp[4:7] (both input and output signals) are never used in this mode. the unused data bus signals are not sampled by the core during read operations, and they are driven low during write operations. a data tenure in the 32-bit data bus mode takes one, two, or eight beats depending on the transfer size (see table 9-2 for details) and the cache mode for the address. data transactions of one or two data beats are performed for caching-inhibited load/store or write-through store operations. these transactions do not assert the core_tbst_out signal even though a two-beat burst may be performed (having the same core_tbst_out and core_tsiz[0:2] encodings as the 64-bit data bus mode). single-beat data transactions are performed for bus operations of 4 bytes or less, and double-beat data transactions are performed for 8-byte operations only. the core only generates an 8-byte operation for a double-word-aligned load or store double operation to or from the floating-point gprs. all cache-inhibited instruction fetches are performed as word (single-beat) operations. data transactions of eight data beats are performed for burst operations that load into or store from the core internal caches. these transactions transfer 32 bytes in the same way as in 64-bit data bus mode, asserting the core_tbst_out signal, and signaling a transfer size of 2 (core_tsiz[0:2] = 0b010). the same bus protocols apply for arbitration, transfer, and termination of the address and data tenures in the 32-bit data bus mode as they apply to the 64-bit data bus mode. late core_artry_in cancellation of the data tenure applies on the bus clock after the first data beat is acknowledged (after the first core_ta ) for word or smaller transactions, or on the bus clock after the second data beat is acknowledged (after the second core_ta ) for double-word f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-38 g2 powerpc core reference manual motorola optional bus configurations or burst operations (or coincident with respective core_ta if no-core_drtry mode is selected). an example of an 8-beat data transfer while the core is in the 32-bit data bus mode is shown in figure 9-20. figure 9-20. 32-bit data bus transfer (8-beat burst) core_ts_out core_abb_out addr core_tbst_out core_aack core_artry_out core_dbb_out core_dh[0:31] core_ta_out core_drtry core_tea_out 01234567 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-39 optional bus configurations an example of a two-beat data transfer (with core_drtry asserted during each data tenure) is shown in figure 9-21. figure 9-21. 32-bit data bus transfer (two-beat burst with drtry ) the g2 core selects 64- or 32-bit data bus mode at startup by sampling the state of the core_tlbisync signal at the negation of core_hreset . if the core_tlbisync signal is negated at the negation of core_hreset , 64-bit data mode is entered by the core. if core_tlbisync is asserted at the negation of core_hreset , 32-bit data mode is entered. 9.6.2 no-core_drtry mode the g2 core supports an optional mode to disable the use of the data retry function provided through core_drtry . the no-core_drtry mode allows the forwarding of data during load operations to the processor core one bus cycle sooner than in the normal bus protocol. the bus protocol specifies that, during load operations, the memory system can normally cancel data that was read by the master on the bus cycle after core_ta was asserted. this late cancellation protocol requires the core to hold any loaded data at the bus interface for one additional bus clock to verify that the data is valid before forwarding it to the processor core. for systems that do not implement the core_drtry function, the core provides an optional no-core_drtry mode that eliminates this one-cycle stall during all load operations and allows for the forwarding of data to the internal cpu immediately when core_ta is recognized. when the g2 core is in no-core_drtry mode, data can no longer be canceled the cycle after it is acknowledged by an assertion of core_ta . data is immediately forwarded to the core_ts_out core_abb_out addr core_tbst_out core_aack core_artry_out core_dbb_out core_dh[0:31] core_ta_out core_drtry core_tea_out 01 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-40 g2 powerpc core reference manual motorola interrupt, checkstop, and reset signals processor core, and any attempt at late cancellation by the system may cause improper operation by the core. when the g2 core is following normal bus protocol, data may be canceled the bus cycle after core_ta by either of two means?late cancellation by core_drtry , or late cancellation by core_artry_in . when no-core_drtry mode is selected, both cancellation cases must be disallowed in the system design for the bus protocol. when no-core_drtry mode is selected, the system must ensure that core_drtry is not asserted to the core which may cause improper operation of the bus interface. the system must also ensure that an assertion of core_artry_in by a snooping device must occur no later than the first assertion of core_ta to the core but not on the cycle after the first assertion of core_ta . other than the inability to cancel data that was read by the master on the bus cycle after core_ta was asserted, the bus protocol for the core is identical to that for the basic transfer bus protocols described in this chapter, as well as for 32-bit data bus mode. the g2 core selects the desired core_drtry mode at startup by sampling the state of the core_drtry signal itself at the negation of core_hreset . if core_drtry is negated at the negation of core_hreset , normal operation is selected. if core_drtry is asserted at the negation of core_hreset , no-core_drtry mode is selected. 9.6.3 reduced-pinout mode the g2 core provides an optional reduced-pinout mode, which idles the switching of numerous signals for reduced power consumption. both input and output signals of the core_dl[0:31], core_dp[0:7], core_ap[0:3], core_ape , core_dpe , and core_rsrv signals are disabled when the reduced-pinout mode is selected. note that the 32-bit data bus mode is implicitly selected when the reduced-pinout mode is enabled. in reduced-pinout mode, the bidirectional and output signals disabled are always driven low during the periods when they would normally have been driven by the core. the open-drain outputs (core_ape and core_dpe ) are always three-stated. the bidirectional inputs are always turned-off at the input receivers of the core and are not sampled. the g2 core selects either full-pinout or reduced-pinout mode at startup by sampling the state of the core_qack signal at the negation of core_hreset . if core_qack is asserted at the negation of core_hreset , full-pinout mode is selected by the core. if core_qack is negated at the negation of core_hreset , reduced-pinout mode is selected. 9.7 interrupt, checkstop, and reset signals this section describes external interrupts, checkstop operations, and hard and soft reset inputs. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-41 interrupt, checkstop, and reset signals 9.7.1 external interrupts asserting the external interrupt input signals (core_int , core_smi , and core_mcp ) of the core eventually forces the processor to take an external interrupt exception, or a system management interrupt exception if the msr[ee] is set, or the machine check interrupt if msr[me] and hid0[emcp] are set. 9.7.2 checkstops asserting the g2 core has two checkstop input signals?core_ckstp_in (non-maskable) and core_mcp (enabled when msr[me] is cleared and hid0[emcp] is set), and a checkstop output (core_ckstp_out ). if core_ckstp_in or core_mcp is asserted, the core halts operations by gating off all internal clocks. the core asserts core_ckstp_out if core_ckstp_in is asserted. if core_ckstp_out is asserted by the core, it has entered the checkstop state and processing has halted internally. the core_ckstp_out signal can be asserted for various reasons including receiving a core_tea signal and detection of external parity errors. for more information about checkstop state, see section 5.5.2.2, ?checkstop state (msr[me] = 0).? 9.7.3 reset inputs the g2 core has two reset inputs, described as follows: core_hreset (hard reset)?core_hreset is used for power-on reset sequences, or for situations in which the core must go through the entire cold-start sequence of internal hardware initializations. core_sreset (soft reset)?the soft reset input provides warm reset capability. this input can be used to avoid forcing the core to complete the cold start sequence. when either reset input is negated, the processor attempts to fetch code from the system reset exception vector. the vector is located at offset 0x00100 from the exception prefix (all zeros or ones, depending on the setting of the exception prefix bit in the machine state register (msr[ip]). the ip bit is set for core_hreset . 9.7.4 core quiesce control signals the core quiesce control signals (core_qreq and core_qack allow the processor to enter a low power state and bring bus activity to a quiescent state in an orderly fashion. the system quiesce state is entered by configuring the processor to assert the core_qreq output. this signal allows the system to terminate or pause any bus activities that are normally snooped. when the system is ready to enter the system quiesce state, it asserts core_qack . at this time, the core may enter a quiescent (low-power) state during which it stops snooping bus activity. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-42 g2 powerpc core reference manual motorola processor state signals 9.8 processor state signals this section describes the g2 core support for atomic update and memory through the use of the lwarx / stwcx . instruction pair and includes a description of the core core_tlbisync input. 9.8.1 support for the lwarx/stwcx. instruction pair the load word and reserve indexed ( lwarx ) and the store word conditional indexed ( stwcx .) instructions provide a means for atomic memory updating. memory can be updated atomically by setting a reservation on the load and checking that the reservation is still valid before the store is performed. in the core, the reservations are made on behalf of aligned, 32-byte sections of the memory address space. the reservation (core_rsrv ) output signal is driven synchronously with the bus clock and reflects the status of the reservation coherency bit in the reservation address buffer (see section 3.9, ?instruction and data cache operation? for more information). see section 8.3.11.3, ? reservation core_rsrv ?output,? for information about timing. 9.8.2 core_tlbisync input the core_tlbisync input allows for the hardware synchronization of changes to mmu tables when the core and another dma master share the same mmu translation tables in system memory. it is asserted by a dma master when it is using shared addresses that could be changed in the mmu tables by the core during the dma master?s tenure. asserting the core_tlbisync input to the g2 core prevents it from completing any instructions past a tlbsync instruction. generally, during the execution of an eciwx or ecowx instruction by the core, the selected dma device should assert the core core_tlbisync signal and keep it asserted during its dma tenure if it is using a shared translation address. subsequent instructions should include a sync and tlbsync instruction before any mmu table changes are performed. this prevents the core from making table changes disruptive to the other master during the dma period. 9.9 ieee 1149.1-compliant interface the g2 core boundary-scan interface is a fully-compliant implementation of the ieee 1149.1 standard. this section describes the core ieee 1149.1 (jtag) interface. 9.9.1 ieee 1149.1 interface description the g2 core has five dedicated jtag signals (described in table 9-11). the core_tdi and core_tdo scan ports are used to scan instructions, as well as data, into the various scan registers for jtag operations. the scan operation is controlled by the test access port f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-43 using core_dbwo (data bus write only) (core_tap_en) controller, which in turn is controlled by the core_tms input sequence. the scan data is latched in at the rising edge of core_tck. test reset (core_trst ) is a jtag optional signal used to reset the tap controller asynchronously. the core_trst signal assures that the jtag logic does not interfere with the normal operation of the chip, and can be asserted coincident with the assertion of the core_hreset signal. the g2_le core implements the jtag/cop in the same manner as does the g2 core implementation with the exception of the introduction of the 33-bit run_n counter register in which the most-significant 32 bits form a 32-bit counter. the function of the least-significant bit remains unchanged. the run_n counter is used by the cop to control the number of processor cycles that the processor runs before halting. 9.10 using core_dbwo (data bus write only) the g2 core supports split-transaction pipelined transactions. it supports a limited out-of-order capability for its own pipelined transactions through the core_dbwo signal. when recognized on the clock of a qualified core_dbg , the assertion of core_dbwo directs the core to perform the next pending data write tenure (if any), even if a pending read tenure would have normally been performed because of address pipelining. the core_dbwo signal does not reorder write tenures with respect to other write tenures from the same core. it only allows that a write tenure be performed ahead of a pending read tenure from the same core. in general, an address tenure on the bus is followed strictly in order by its associated data tenure. transactions pipelined by the core complete strictly in order. however, the core can run bus transactions out of order only when the external system allows the core to perform a cache-line-snoop-push-out operation (or other write transaction, if pending in the core write queues) between the address and data tenures of a read operation through the use of core_dbwo . this effectively envelops the write operation within the read operation. figure 9-22 shows how core_dbwo is used to perform an enveloped write transaction. table 9-11. ieee interface pin descriptions signal name input/output weak pullup provided ieee 1149.1 function core_tdi input yes serial scan input signal core_tdo output no serial scan output signal core_tms input yes tap controller mode signal core_tck input yes scan clock core_trst input yes tap controller reset f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-44 g2 powerpc core reference manual motorola using core_dbwo (data bus write only) figure 9-22. core_dbwo transaction note that although the g2 core can pipeline any write transaction behind the read transaction, special care should be used when using the enveloped write feature. it is envisioned that most core implementations will not need this capability; for these applications, core_dbwo should remain negated. in cores where this capability is needed, core_dbwo should be asserted under the following scenario: 1. the g2 core initiates a read transaction (either single-beat or burst) by completing the read address tenure with no address retry. 2. then, the g2 core initiates a write transaction by completing the write address tenure, with no address retry. 3. at this point, if core_dbwo is asserted with a qualified data bus grant to the g2 core, the g2 core asserts core_dbb_out and drives the write data onto the data bus, out of order with respect to the address pipeline. the write transaction concludes with the core negating core_dbb_out . 4. the next qualified data bus grant signals the g2 core to complete the outstanding read transaction by latching the data on the bus. this assertion of core_dbg should not be accompanied by an asserted core_dbwo . any number of bus transactions by other bus masters can be attempted between any of these steps. note the following regarding core_dbwo : core_dbwo can be asserted if no data bus read is pending, but it has no effect on write ordering. the ordering and presence of data bus writes is determined by the writes in the write queues at the time core_bg is asserted for the write address (not core_dbg ). if a particular write is desired (for example, a cache-line-snoop-push-out operation), core_aack core_dbg abb core_bg (2) (1) dbb enveloped write core_dbwo transaction (1) (2) read address write address write data read data f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 9. core interface operation 9-45 using core_dbwo (data bus write only) then core_bg must be asserted after that particular write is in the queue and it must be the highest priority write in the queue at that time. a cache-line-snoop-push-out operation may be the highest priority write, but more than one may be queued. because more than one write may be in the write queue when core_dbg is asserted for the write address, more than one data bus write may be enveloped by a pending data bus read. the arbiter must monitor bus operations and coordinate the various masters and slaves with respect to the use of the data bus when core_dbwo is used. individual core_dbg signals associated with each bus device should allow the arbiter to synchronize both pipelined and split-transaction bus organizations. individual core_dbg and core_dbwo signals provide a primitive form of source-level tagging for the granting of the data bus. note that use of core_dbwo allows some operation-level tagging with respect to the g2 core and the use of the data bus. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 9-46 g2 powerpc core reference manual motorola using core_dbwo (data bus write only) f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 10. power management 10-1 chapter 10 power management the g2 core is the first processor core specifically designed for low-power operation. it provides both automatic and program-controllable power reduction modes for progressive reduction of power consumption. this chapter describes the hardware support provided by the g2 core for power management. 10.1 overview the g2 core has explicit power management features that are described in this chapter. note that the design of the g2 core is fully static, allowing the internal processor core state to be preserved when no internal clock is present. the device drivers must be modified for power management as operating systems service i/o requests by system calls to the device drivers. when a device driver is called to reduce the power of a device, it needs to be able to check the power state of the device, save the device configuration parameters, and put the device into a power-saving mode. furthermore, every time the device driver is called, it needs to check the power status of the device and restore the device to the full-on state, if the device is in a power-saving mode. 10.2 dynamic power management dynamic power management (dpm) automatically powers up and down the individual execution units of the g2 core, based on the contents of the instruction stream. for example, if no floating-point instructions are being executed, the floating-point unit is automatically powered down. power is not actually removed from the execution unit; instead, each execution unit has an independent clock input, which is automatically controlled on a clock-by-clock basis. because cmos circuits consume negligible power when they are not switching, stopping the clock to an execution unit effectively eliminates its power consumption. the operation of dpm is completely transparent to software or any external hardware. dynamic power management is enabled by setting hid0[dpm] on power-up following a hard reset sequence (core_hreset ). f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 10-2 g2 powerpc core reference manual motorola programmable power modes 10.3 programmable power modes hardware can enable a power management state through external asynchronous interrupts. the hardware interrupt causes the transfer of program flow to interrupt handler code. the appropriate mode is then set by the software. the g2 core provides a separate interrupt and interrupt vector for power management?the system management interrupt (core_smi ). the g2 core also contains a decrementer timer that allows it to enter the nap or doze mode for a predetermined period and then return to full power operation through the decrementer interrupt exception. the g2 core provides four power modes selectable by setting the appropriate control bits in the msr and hid0. the four power modes are described briefly as follows: full-power?this is the default power state of the g2 core. the g2 core is fully powered and the internal functional units are operating at the full processor clock speed. if the dynamic power management mode is enabled, functional units that are idle will automatically enter a low-power state without affecting performance, software execution, or external hardware. doze?all the functional units of the g2 core are disabled except for the time base/decrementer registers and the bus snooping logic. when the processor is in doze mode, an external asynchronous interrupt, system management interrupt, decrementer exception, hard or soft reset, or machine check input (core_mcp ) brings the g2 core into the full-power state. the core in doze mode maintains the a phase-locked loop (pll) in a fully powered state and locked to the system external clock input (core_sysclk) so a transition to the full-power state takes only a few processor clock cycles. nap?the nap mode further reduces power consumption by disabling bus snooping, leaving only the time base register and the pll in a powered state. the core returns to the full-power state upon receipt of an external asynchronous interrupt, system management interrupt, decrementer exception, hard or soft reset, or machine check input (core_ mcp ) signal. a return to full-power state from a nap state takes only a few processor clock cycles. sleep?sleep mode reduces power consumption to a minimum by disabling all internal functional units; then external system logic may disable the pll and core_sysclk. returning the core to the full-power state requires the enabling of the pll and core_sysclk, followed by the assertion of an external asynchronous interrupt, system management interrupt, hard or soft reset, or core_ mcp signal after the time required to relock the pll. note that the g2 core cannot switch from one power management mode to another without first returning to full-on mode. the nap and sleep modes disable bus snooping; therefore, a hardware handshake using core_qreq and core_qack is provided to ensure coherency before the core enters these power management modes. table 10-1 summarizes the four power states for the core. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 10. power management 10-3 programmable power modes 10.3.1 power management modes the following sections describe the characteristics of the g2 core power management modes, the requirements for entering and exiting the various modes, and the system capabilities provided by the g2 core while the power management modes are active. 10.3.1.1 full-power mode with dpm disabled full-power mode with dpm disabled is selected when the dpm enable bit in hid0[dpm] is cleared. the following characteristics apply: default state following power-up and core_hreset all functional units are operating at full processor speed at all times 10.3.1.2 full-power mode with dpm enabled full-power mode with dpm enabled (hid0[dpm] = 1) provides on-chip power management without affecting the functionality or performance of the g2 core as follows: required functional units are operating at full processor speed functional units are clocked only when needed no software or hardware intervention required after mode is set software/hardware and performance transparent 10.3.1.3 doze mode doze mode disables most functional units but maintains cache coherency by enabling the bus interface unit and snooping. a snoop hit causes the g2 core to enable the data cache, copy the data back to memory, disable the cache, and fully return to the doze mode. table 10-1. g2 core programmable power modes pm mode functioning units activation method full-power wake-up method full power all units active ? ? full power (with dpm) requested logic by demand by instruction dispatch ? doze bus snooping data cache as needed decrementer timer controlled by sw external asynchronous exceptions decrementer interrupt reset nap decrementer timer controlled by hardware and software external asynchronous exceptions decrementer interrupt reset sleep none controlled by hardware and software external asynchronous exceptions reset f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 10-4 g2 powerpc core reference manual motorola programmable power modes doze mode is characterized by the following features: most functional units disabled bus snooping and time base/decrementer still enabled pll running and locked to internal core_sysclk to enter the doze mode, the following conditions must occur: set doze bit (hid0[8] = 1), msr[pow] is set g2 core enters doze mode after several processor clocks to return to full-power mode, the following conditions must occur: assert internal core_int , core_smi , or core_mcp signals or decrementer interrupts hard reset or soft reset transition to full-power state occurs only after a few processor cycles 10.3.1.4 nap mode the nap mode disables the g2 core except for the processor pll and time base/decrementer. the time base can be used to restore the core to a full-on state after a specified period. because bus snooping is disabled for nap and sleep mode, a hardware handshake using the quiesce request (core_qreq ) and quiesce acknowledge (core_qack ) signals are required to maintain data coherency. the g2 core asserts the core_qreq signal to indicate that it is ready to disable bus snooping, including all bus activity. once the processor has entered a quiescent state, it no longer snoops bus activity. when the system logic has ensured that snooping is no longer necessary, it allows the processor to enter the nap (or sleep) mode and causes the assertion of the g2 core core_qack input signal for the duration of the nap mode period. nap mode is characterized by the following features: time base/decrementer still enabled most functional units disabled (including bus snooping) pll running and locked to internal core_sysclk to enter the nap mode, the following conditions must occur: set nap bit (hid0[9] = 1), msr[pow] bit is set g2 core asserts core_qreq system asserts core_qack the processor core enters nap mode after several processor clocks f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 10. power management 10-5 programmable power modes to return to full-power mode, one of the following conditions must occur: assert core_int , core_smi , or core_mcp internal signals decrementer exception interrupt hard reset or soft reset transition to full-power takes only a few processor cycles. core_qack can remain asserted; however, core_qreq negates before any bus transaction begins. 10.3.1.5 sleep mode sleep mode consumes the least amount of power of the four modes, since all functional units are disabled. to conserve the maximum amount of power, the pll and internal core_sysclk signals can be disabled. due to the fully static design of the g2 core, the internal processor state is preserved when no internal clock is present. because the time base and decrementer are disabled while the g2 core is in sleep mode, the time base contents must be updated from an external time base following sleep mode, if accurate time-of-day maintenance is required. before entering sleep mode, the g2 core asserts core_qreq to indicate that it is ready to disable bus snooping. when the system has ensured that snooping is no longer necessary, the system logic allows the g2 core to enter sleep mode by asserting core_qack for the duration of the sleep mode period. sleep mode is characterized by the following features: all functional units disabled (including bus snooping and time base) all nonessential input receivers disabled internal clock regenerators disabled pll and core_sysclk can be disabled to enter sleep mode, the following conditions must occur: set sleep bit (hid0[10] = 1), msr[pow] is set g2 core asserts core_qreq system logic asserts core_qack g2 core enters sleep mode after several processor clocks to return to full-power mode, the following conditions must occur: assert core_int , core_smi , or core_mcp internal signals hard reset or soft reset to return to full-power mode after pll and core_sysclk are disabled in sleep mode, the following conditions must occur: enable core_sysclk f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 10-6 g2 powerpc core reference manual motorola example code sequence for entering processor sleep mode reconfigure pll into desired processor clock mode system logic waits for pll startup and relock time (100 sec) system logic asserts one of the sleep recovery signals (for example, core_int or core_smi ) 10.3.2 power management software considerations because the g2 core is a dual issue processor core with out-of-order execution capability, care must be taken in how the power management modes are entered. furthermore, nap and sleep modes require all outstanding bus operations to be completed before the power management mode is entered. section 10.4, ?example code sequence for entering processor sleep mode,? provides an example software sequence for putting the g2 core into sleep mode. normally, during system configuration time, one of the power management modes would be selected by setting the appropriate hid0 mode bit. later on, the power management mode is invoked by setting msr[pow]. to ensure a clean transition into and out of the power management mode, set msr[ee] (external interrupt enable) and execute the following code sequence: sync mtmsr[pow = 1] isync loop: b loop 10.4 example code sequence for entering processor sleep mode the following is a sample code sequence for entering g2 core sleep mode. ********************************************************************* # set up g2 core hid0 power management bits #********************************************************************* #******processor hid and external interrupt initialization******************* # # set up hid registers for the various processors of this family # hid setup taken from minix's mpxpowerpc.s mfspr r31, pvr # pvr reg srawi r31, r31, 16 resettest603: cmpi 0, 0, r31, 3 bne cr0, endhidsetup addi r0, r0, 0 oris r0, r0, 0x8000 # enable machine check pin emcp oris r0, r0, 0x0010 # enable dynamic power mgmt dpm oris r0, r0, 0x0020 # enable sleep power mode ori r0, r0, 0x8000 # enable the icache ice f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 10. power management 10-7 example code sequence for entering processor sleep mode ori r0, r0, 0x4000 # enable the dcache dce ori r0, r0, 0x0800 # invalidate icache icfi ori r0, r0, 0x0400 # invalidate dcache dcfi mtspr hid0, r0 isync #****************************************************************** # then when the processor is in a loop, force an smi interrupt #****************************************************************** .orig 0x00001400 # system management interrupt # force big-endian mode stw r0,0x05f8,r0 # need nop every second inst. stw r0,0x05fc,r0 mfmsr r0 ori r0,r0,r0 ori r0,r0,0x0001 # force big-endian le bit ori r0,r0,r0 xori r0,r0,0x0001 # force big-endian le bit ori r0,r0,r0 mtmsr r0 ori r0,r0,r0 isync ori r0,r0,r0 # save off additional registers to be corrupted stw r20,0x05f4,r0 mfspr r21, srr0 # put srr0 in r21 stw r21,0x05f0,r0 # put r21 in 0x05f0 mfspr r22, srr1 # put srr1 in r22 stw r22,0x05ec,r0 # put r22 in 0x05ec stw r23,0x05e8,r0 mfcr r23 stw r23,0x05e4,r0 xor r0,r0,r0 #****************************************************************** # set msr pow bit to go into sleep mode sync mfmsr r5 # get msr addis r3, r0, 0x0004 # turn on pow bit ori r3, r3, 0x0000 # turn on me bit 19 or r5, r3, r5 mtmsr r5 isync addis r20, r0, 0x0000 ori r20, r20, 0x0002 stay_here: addic. r20, r20, -1 # subtract 1 from r20 and set cc bgt cr0, stay_here # loop if positive # restore corrupted registers lwz r23,0x05e4,r0 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 10-8 g2 powerpc core reference manual motorola example code sequence for entering processor sleep mode mtcrf 0xff,r23 lwz r23,0x05e8,r0 lwz r22,0x05ec,r0 mtspr srr1, r22 lwz r21,0x05f0,r0 mtspr srr0, r21 lwz r20,0x05f4,r0 lwz r0,0x05fc,r0 sync rfi #****************************************************************** # to get out of sleep mode, do a soft reset #****************************************************************** .orig 0x00000100 # reset handler in low memory # force big-endian mode stw r0,0x05f8,r0 # need nop every second inst. stw r0,0x05fc,r0 mfmsr r0 ori r0,r0,r0 ori r0,r0,0x0001 # force big-endian le bit ori r0,r0,r0 xori r0,r0,0x0001 # force big-endian le bit ori r0,r0,r0 mtmsr r0 ori r0,r0,r0 isync ori r0,r0,r0 # save off additional registers to be corrupted stw r20,0x05f4,r0 stw r21,0x05f0,r0 stw r22,0x05ec,r0 stw r23,0x05e8,r0 mfcr r23 stw r23,0x05e4,r0 xor r0,r0,r0 # restore corrupted registers lwz r23,0x05e4,r0 mtcrf 0xff,r23 lwz r23,0x05e8,r0 lwz r22,0x05ec,r0 lwz r21,0x05f0,r0 lwz r20,0x05f4,r0 lwz r0,0x05fc,r0 sync rfi #****************************************************************** f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 11. debug features 11-1 chapter 11 debug features this chapter describes the debug features of the powerpc architecture with respect to the g2_le core. both the g2 and g2_le include the trace facility debug feature. however, the g2_le core has improved debug capability by enhancing the jtag/cop interface. the enhanced debug features are described as follows: addition of three breakpoint registers inclusions of watchpoint/breakpoint indication signals?core_iabr , core_iabr2 , core_dabr , and core_dabr2 addition of cop_svr instruction new force-single-step operation instruction 11.1 breakpoint facilities the g2_le core provides enhanced debug facilities?instruction address breakpoint, data address breakpoint, and program single stepping to enable software debug events. the existing iabr and single-step functions are facilitated by the new debug features. the debug facilities consist of a set of debug control registers (dbcr, ibcr), a set of instruction address breakpoint registers (iabr, iabr2), and a set of data address breakpoint registers (dabr, dabr2). the basic operation of the dabrs are similar to that of the mpc750 processor. for information on the mpc750, see the mpc750 risc microprocessor family user?s manual . these registers are used together to enable various breakpoint functions. these registers are accessible to only supervisor-level programs by the mfspr and mtspr instructions. the spr address for the registers can be found in table 3-33 of chapter 3, ?instruction set model.? 11.1.1 instruction address breakpoint registers (iabr, iabr2) iabr and iabr2 can be used to cause a breakpoint exception if a specified instruction address is encountered. the iabr and iabr2 control the instruction address breakpoint exception. iabr[cea] and iabr2[cea] hold the effective address to which each f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 11-2 g2 powerpc core reference manual motorola breakpoint facilities instruction?s address is compared. the exception is enabled by setting iabr[be]. the exception is taken when there is an instruction address breakpoint match on the next instruction to complete. the instruction tagged with the match cannot complete before the instruction address breakpoint exception (0x01300) is taken. the address of the instruction that matches the breakpoint condition is stored in srr0. the tagged instruction retires after returning from the exception ( rfi or rfci ). the results are then committed to the destination registers and address. if the iabr or iabr2 values are set to any exception vector range, an unrecoverable state occurs. the iabr or iabr2 values should never be set to match within the instruction address breakpoint exception handler. failure to prohibit a breakpoint within any handler may result in an indeterminate or unrecoverable processor state. see section 2.1.2.14, ?instruction address breakpoint registers (iabr and iabr2),? for bit descriptions. 11.1.2 instructional address control register (ibcr) ibcr is a supervisor-level spr. it controls the compare and match type conditions for iabr and iabr2. note that iabr and iabr2 must be enabled before the effects of ibcr are realized. see section 2.1.2.14.1, ?instruction address breakpoint control registers (ibcr)?g2_le only,? for bit descriptions. 11.1.3 data address breakpoint registers (dabr, dabr2) the dabr and dabr2 registers are used to cause a breakpoint exception if the specified address is encountered. dabr[cea] and dabr2[cea] hold an effective address to which each address of data access is compared. the breakpoint translation matches when a data address breakpoint matches (msr[dr] = dabr[bt]). the data address write and data address read exceptions are enabled by setting dabr[wbe,rbe] and dabr2[wbe,rbe]. the data tagged with the match does not complete before the breakpoint exception is taken. the dsi exception (0x00300) occurs when there is a data address breakpoint match. the dsi exception is taken before the load or store instruction is executed. when the exception is taken, dar is set to the data address that causes the breakpoint and dsisr[dabr] is set to indicate a data address breakpoint. the address of the instruction associated with the breakpoint condition is stored in srr0. the instruction retires after returning from the dsi exception, and all registers and memory accesses are committed to memory. an unrecoverable state occurs whenever dabr or dabr2 values are set to an exception vector. these values must not be set to match within the dsi exception handler or the g2_le core may enter an indeterminate or unrecoverable processor core state. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 11. debug features 11-3 breakpoint facilities 11.1.4 data address control register (dbcr) dbcr is a supervisor-level spr on the g2_le core that controls the compare type and match type conditions for dabr and dabr2. note that dabr or dabr2 or both breakpoint registers must be enabled before the effects of dbcr are realized. see section 2.1.2.15.1, ?data address breakpoint control registers (dbcr)?g2_le-only,? for bit descriptions. 11.1.5 other debug resources in addition to the four breakpoint registers and the two breakpoint control registers, other internal register values control and monitor the effects of breakpoint conditions. table 11-1 shows these registers and their bits. 11.1.6 software debug features software programming model interface controls debug features including instruction and data breakpoints. when an instruction or data address breakpoint register is enabled and the conditions are met, an instruction address breakpoint exception (0x01300) or dsi exception (0x00300) occurs. the cause of a dsi exception can be determined by the setting of dsisr[dabr]. a data address breakpoint exception occurs when the data in dabr[bt] or dabr2[bt] matches the next data access (load or store instruction) to complete in the completion unit (see section 2.1.2.15.1, ?data address breakpoint control registers (dbcr)?g2_le-only,? for more details). the dar contains the address of the matching data address breakpoint determined by dabr, dabr2, and dbcr. table 11-1. other debug and support register bits register bits name description msr 17 pr privilege level. breakpoint registers can only be accessed when this bit is cleared (supervisor mode). 21 se single-step trace enable. 0 the processor executes instructions normally. 1 the processor generates a trace exception upon the successful completion of the next instruction. 22 be branch trace enable 0 the processor executes branch instructions normally. 1 the processor generates a trace exception upon the successful completion of a branch instruction. hid0 0?31 ? see table 2-5 for details. dar 0?31 ? data address register. dar is loaded with the effective address of a data breakpoint condition that matches. dsisr 9 dabr set if dabr exception occurs. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 11-4 g2 powerpc core reference manual motorola expanded debugging facilities in breakpoint registers iabr[be] and iabr2[be] enable and control instruction address breakpoint, and ibcr controls match conditions (see section 2.1.2.14.1, ?instruction address breakpoint control registers (ibcr)?g2_le only,? for more details). dabr[29?31] and dabr2[29?31] enable and control data address breakpoint and dbcr controls match conditions. when msr[se] (single-step trace enable) is set, the processor core generates a trace exception (0x00d00) upon the successful completion of the next instruction. when the msr[be] (branch trace enable) is set, the processor core generates a trace exception (0x00d00) upon the successful completion of a branch instruction. 11.2 expanded debugging facilities in breakpoint registers breakpoint, single-step, and branch trace enable, address and combinational matching are additional debugging facilities provided by the breakpoint registers (dabr, dabr2, iabr, and iabr2). 11.2.1 breakpoint enabled when an instruction address breakpoint is set, and a condition is matched, an instruction address breakpoint exception (0x01300) occurs along with executing the matched instruction. the instruction retires after it has returned from the exception. when a data and a condition are matched, a dsi exception (0x00300) occurs along with executing the matched instruction. the instruction retires after it has returned from the exception and has updated all memory or registers. 11.2.2 single-step enabled single-stepping can be a very useful tool in software debugging. this debug feature executes one instruction before it takes a trace exception. in trace exception, the result is being examined after that one instruction has executed. when msr[se] (single-step trace enable) is set, the processor generates a trace exception (0x00d00) upon the successful completion of the next instruction. a trace exception is not taken for an isync , sync , rfi , rfci , or mtmsr instructions. if softstop or hardstop is enabled, and msr[se] bit is set, the machine with stop before the present instruction is retired and not take a trace exception. msr can be set by using mtmsr or by setting the srr0 bit corresponding to msr[se] before returning from an interrupt. if the srr0 is set after returning from the interrupt, single-step is enabled by executing one instruction along with taking the trace exception. a typical software debugging procedure is to set a instruction address breakpoint at the instruction address to be single stepped. when the iabr exception is taken, the exception f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 11. debug features 11-5 watchpoint signaling routine should disable the instruction address breakpoint and set srr0 to set the msr[se] on the rfi . the trace exception is taken after the iabr exception is executed. in any exception, the value of msr is saved in srr0. msr[se] is no longer set along with single-step is disabled. finally, the trace exception examines the result through a routine and sets srr0 to disable msr[se] on the rfi or to execute the next instruction. single-stepping skips isync , sync , rfi , rfci , and branch instruction s because they do not enter the instruction pipeline. the branch trace may be used for rfi , rfci , and branch instruction s. also, single-step debugging condition over a mtmsr may give unwanted results. once msr is updated, single stepping may be disabled and the g2 core continues executing instructions without this debugging conditions. thus, it is recommended to disable and enable msr[se] by using srr0 within an interrupt. therefore, rfi is responsible for setting or configuring msr[se]. 11.2.3 branch trace enabled when msr[be] (branch trace enable) is set, the processor generates a trace exception (0x00d00) upon the successful completion of a branch instruction. if softstop or hardstop is enabled, and msr[se] is set, the machine stops before the present instruction is retired, and does not take a trace exception. 11.2.4 address matching on g2 and g2_le a match occurs when an address equals to an effective address in a breakpoint register. the g2_le can match addresses on greater than or equal or less than as an additional matching condition for ibcr and dbcr. 11.2.5 combinational matching an address match can be signaled after an or function of the two compared addresses match or the and of the two addresses match, depending on the setting of ibcr and dbcr associated with the enabled breakpoint registers. this feature along with matching on greater than and less than allows a breakpoint to be set inside or outside a range of two addresses. the instruction address breakpoints and data address breakpoints always work independently of each other. for more details, see section 2.1.2.14.1, ?instruction address breakpoint control registers (ibcr)?g2_le only? and section 2.1.2.15.1, ?data address breakpoint control registers (dbcr)?g2_le-only.? 11.3 watchpoint signaling there is a mechanism to enable address matching but it also disables the signaling of an exception on a softstop. this allows observing address matching on the watchpoint signals f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 11-6 g2 powerpc core reference manual motorola exception vectors and priority only. watchpoint signals allow external observability of breakpoint matches and address matching is the output to the watchpoint signals (core_iabr , core_iabr2 , core_dabr , and core_dabr2 ). these four watchpoint signals are asserted for at least one bus clock cycle. when dbcr and ibcr are configured for combinational signal type or, the watchpoint signals?core_iabr , core_iabr2 and core_dabr , core_dabr2 ?reflect their respective breakpoints. when dbcr and ibcr are configured for combinational signal type and, only the core_iabr2 and core_dabr2 watchpoint signals are asserted when the and condition is met. ibcr[dns] and dbcr[dns] inhibit the signal transition on the core signal pins. 11.4 exception vectors and priority table 11-2 lists exception vectors which are associated with debug and breakpoint events. breakpoint events do not change other exception vectors and conditions 11.5 instruction address breakpoint examples the address matching for the instruction address breakpoint register has the following four possible conditions for the specific register signals: instruction?s effective address = iabr_addr (value in iabr[cea]) instruction?s effective address = iabr_addr or instruction?s effective address = iabr2_addr (value in iabr2[cea]) iabr_addr < instruction?s effective address < iabr2_addr instruction?s effective address < iabr_addr or instruction?s effective address > iabr2_addr table 11-3 describes the instruction address breakpoint register for a single address matching conditions. table 11-2. related debug exceptions and conditions exception type vector offset causing condition data access 00300 a data address breakpoint exception occurs when a match condition exists for the effective address of the data access in either dabr or dabr2 for the next read or write data access, and wbe and rbe, dabr enable bits are set for read or write, respectively. a data breakpoint event is determined by setting dsisr[dabr], which causes a data access exception. the dar contains the address of the breakpoint match condition. trace 00d00 the trace exception is taken when msr[se] = 1 or when the currently completing instruction is a branch instruction and msr[be] = 1. instruction address breakpoint 01300 an instruction address breakpoint exception occurs when a match condition exists for the effective address of the instruction access in either iabr or iabr2 for the next instruction to complete in the completion unit, and wbe, iabr enable bit is set. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola chapter 11. debug features 11-7 instruction address breakpoint examples this matches when the instruction?s effective address = iabr_addr. table 11-4 describes the instruction address breakpoint registers when an address can match one or the other possible addresses (an or condition). this matches when the instruction?s effective address = iabr_addr or the instructions effective address = iabr2_addr. table 11-5 describes the instruction address breakpoint register for an address matching inside an address range condition. this matches when iabr_addr instruction?s effective address < iabr2_addr. table 11-6 describes the instruction address breakpoint register for an address matching outside an address range condition. table 11-3. single address matching (g2 core emulation) register field name condition register field name condition iabr[cea] iabr_addr iabr2[cea] ? iabr[be] 1 iabr2[be] 0 ibcr[cnt] 0 ? ? ibcr[sig_type] or ? ? ibcr[cmp1] = ibcr[cmp2] ? table 11-4. two addresses or matching register field name condition register field name condition iabr[cea] iabr_addr iabr2[cea] iabr2_addr iabr[be] 1 iabr2[be] 1 ibcr[cnt] 0 ? ? ibcr[sig_type] or ? ? ibcr[cmp1] = ibcr[cmp2] = table 11-5. address matching for inside address range register field name condition register field name condition iabr[cea] iabr_addr iabr2[cea] iabr2_addr iabr[be] 1 iabr2[be] 1 ibcr[cnt] 0 ? ? ibcr[sig_type] and ? ? ibcr[cmp1] > ibcr[cmp2] < f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . 11-8 g2 powerpc core reference manual motorola synchronization requirements this matches when the instruction?s effective address < iabr_addr or the instruction?s effective address iabr2_addr. the breakpoint match can be observed externally through watchpoint signals. when dcbr[sig_type] or icbr[sig_type] is cleared for an or signal type, the watchpoint signals?core_iabr , core_iabr 2, core_dabr , and core_dabr2 ?reflect their respective breakpoints. when dcbr[sig_type] or icbr[sig_type] is set for an and signal type, the watchpoint signals core_iabr2 and core_dabr2 are asserted when the and condition is met.the watchpoint signal has to asserted for at least one bus clock cycle. for more details, see section 2.1.2.14.1, ?instruction address breakpoint control registers (ibcr)?g2_le only,? and section 2.1.2.15.1, ?data address breakpoint control registers (dbcr)?g2_le-only.? 11.6 synchronization requirements an isync instruction must follow the setting of the mtspr of the breakpoint related registers, msr, hid0, iabr, iabr2, dabr, dabr2, ibcr, and dbcr to ensure that the breakpoint condition is set. ibcr and dbcr should be set before enabling the breakpoint. the breakpoint should be cleared before changing bits in the ibcr and dcbr. for more details, see section 5.5.16, ?instruction address breakpoint exception (0x01300).? an unrecoverable state occurs at anytime if one of the register values of iabr, iabr2, dabr, and dabr2 are set to an exception vector. the iabr or iabr2 values must not be set to match within the instruction address breakpoint exception handler. the dabr or dabr2 values must not be set to the dsi exception handler. failure to prohibit a breakpoint within the instruction address breakpoint exception or dsi handler may result an unrecoverable and indeterminate processor core state. if an iabr match and dabr match occur on the same instruction, the instruction address breakpoint exception is taken before the dsi exception. if an iabr match occurs on a branch instruction, the instruction address breakpoint exception is set to the effective address of the branch instruction. table 11-6. address matching for outside address range signal condition signal condition iabr[cea] iabr_addr iabr2[cea] iabr2_addr iabr[be] 1 iabr2[be] 1 ibcr[cnt] 0 ? ? ibcr[sig_type] or ? ? ibcr[cmp1] < ibcr[cmp2] > f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-1 appendix a powerpc instruction set listings this appendix lists the g2 core microprocessor?s instruction set as well as the additional powerpc instructions not implemented in the g2. instructions are sorted by mnemonic, opcode, function, and form. also included is a quick reference table that contains general information, such as the architecture level, privilege level, and form, and indicates if the instruction is 64-bit and optional. note that split fields representing the concatenation of sequences from left to right, are shown in lowercase. for more information refer to chapter 8, ?instruction set,? in the programming environments manual. the following key applies to the tables in this appendix. a.1 instructions sorted by mnemonic table a-1 lists the instructions implemented in the powerpc architecture in alphabetical order by mnemonic. key: reserved bits instruction not implemented in the g2 core table a-1. complete instruction list sorted by mnemonic name 0 5 6 7 8 9 1011121314151617181920 21 22232425262728293031 add x 31 d a b oe 266 rc addc x 31 d a b oe 10 rc adde x 31 d a b oe 138 rc addi 14 d a simm addic 12 d a simm addic. 13 d a simm addis 15 d a simm addme x 31 d a 0 0 0 0 0 oe 234 rc addze x 31 d a 0 0 0 0 0 oe 202 rc and x 31 s a b 28 rc andc x 31 s a b 60 rc andi. 28 s a uimm andis. 29 s a uimm f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-2 g2 powerpc core reference manual motorola instructions sorted by mnemonic b x 18 li aa lk bc x 16 bo bi bd aa lk bcctr x 19 bo bi 0 0 0 0 0 528 lk bclr x 19 bo bi 0 0 0 0 0 16 lk cmp 31 crfd 0l a b 0 0 cmpi 11 crfd 0l a simm cmpl 31 crfd 0l a b 32 0 cmpli 10 crfd 0l a uimm cntlzd x 1 31 s a 0 0 0 0 0 58 rc cntlzw x 31 s a 0 0 0 0 0 26 rc crand 19 crbd crba crbb 257 0 crandc 19 crbd crba crbb 129 0 creqv 19 crbd crba crbb 289 0 crnand 19 crbd crba crbb 225 0 crnor 19 crbd crba crbb 33 0 cror 19 crbd crba crbb 449 0 crorc 19 crbd crba crbb 417 0 crxor 19 crbd crba crbb 193 0 dcbf 31 0 0 0 0 0 a b 86 0 dcbi 2 31 0 0 0 0 0 a b 470 0 dcbst 31 0 0 0 0 0 a b 54 0 dcbt 31 0 0 0 0 0 a b 278 0 dcbtst 31 0 0 0 0 0 a b 246 0 dcbz 31 0 0 0 0 0 a b 1014 0 divd x 1 31 d a b oe 489 rc divdu x 1 31 d a b oe 457 rc divw x 31 d a b oe 491 rc divwu x 31 d a b oe 459 rc eciwx 31 d a b 310 0 ecowx 31 s a b 438 0 eieio 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 854 0 eqv x 31 s a b 284 rc extsb x 31 s a 0 0 0 0 0 954 rc extsh x 31 s a 0 0 0 0 0 922 rc extsw x 1 31 s a 0 0 0 0 0 986 rc fabs x 63 d 0 0 0 0 0 b 264 rc fadd x 63 d a b 0 0 0 0 0 21 rc table a-1. complete instruction list sorted by mnemonic (continued) name 0 5 6 7 8 9 1011121314151617181920 21 22232425262728293031 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-3 instructions sorted by mnemonic fadds x 59 d a b 0 0 0 0 0 21 rc fcfid x 1 63 d 0 0 0 0 0 b 846 rc fcmpo 63 crfd 0 0 a b 32 0 fcmpu 63 crfd 0 0 a b 0 0 fctid x 1 63 d 0 0 0 0 0 b 814 rc fctidz x 1 63 d 0 0 0 0 0 b 815 rc fctiw x 63 d 0 0 0 0 0 b 14 rc fctiwz x 63 d 0 0 0 0 0 b 15 rc fdiv x 63 d a b 0 0 0 0 0 18 rc fdivs x 59 d a b 0 0 0 0 0 18 rc fmadd x 63 d a b c 29 rc fmadds x 59 d a b c 29 rc fmr x 63 d 0 0 0 0 0 b 72 rc fmsub x 63 d a b c 28 rc fmsubs x 59 d a b c 28 rc fmul x 63 d a 0 0 0 0 0 c 25 rc fmuls x 59 d a 0 0 0 0 0 c 25 rc fnabs x 63 d 0 0 0 0 0 b 136 rc fneg x 63 d 0 0 0 0 0 b 40 rc fnmadd x 63 d a b c 31 rc fnmadds x 59 d a b c 31 rc fnmsub x 63 d a b c 30 rc fnmsubs x 59 d a b c 30 rc fres x 3 59 d 0 0 0 0 0 b 0 0 0 0 0 24 rc frsp x 63 d 0 0 0 0 0 b 12 rc frsqrte x 3 63 d 0 0 0 0 0 b 0 0 0 0 0 26 rc fsel x 3 63 d a b c 23 rc fsqrt x 3 63 d 0 0 0 0 0 b 0 0 0 0 0 22 rc fsqrts x 3 59 d 0 0 0 0 0 b 0 0 0 0 0 22 rc fsub x 63 d a b 0 0 0 0 0 20 rc fsubs x 59 d a b 0 0 0 0 0 20 rc icbi 31 0 0 0 0 0 a b 982 0 isync 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 150 0 lbz 34 d a d lbzu 35 d a d lbzux 31 d a b 119 0 lbzx 31 d a b 87 0 table a-1. complete instruction list sorted by mnemonic (continued) name 0 5 6 7 8 9 1011121314151617181920 21 22232425262728293031 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-4 g2 powerpc core reference manual motorola instructions sorted by mnemonic ld 1 58 d a ds 0 ldarx 1 31 d a b 84 0 ldu 1 58 d a ds 1 ldux 1 31 d a b 53 0 ldx 1 31 d a b 21 0 lfd 50 d a d lfdu 51 d a d lfdux 31 d a b 631 0 lfdx 31 d a b 599 0 lfs 48 d a d lfsu 49 d a d lfsux 31 d a b 567 0 lfsx 31 d a b 535 0 lha 42 d a d lhau 43 d a d lhaux 31 d a b 375 0 lhax 31 d a b 343 0 lhbrx 31 d a b 790 0 lhz 40 d a d lhzu 41 d a d lhzux 31 d a b 311 0 lhzx 31 d a b 279 0 lmw 4 46 d a d lswi 4 31 d a nb 597 0 lswx 4 31 d a b 533 0 lwa 1 58 d a ds 2 lwarx 31 d a b 20 0 lwaux 1 31 d a b 373 0 lwax 1 31 d a b 341 0 lwbrx 31 d a b 534 0 lwz 32 d a d lwzu 33 d a d lwzux 31 d a b 55 0 lwzx 31 d a b 23 0 mcrf 19 crfd 0 0 crfs 0 0 0 0 0 0 0 0 0 mcrfs 63 crfd 0 0 crfs 0 0 0 0 0 0 0 64 0 mcrxr 31 crfd 0 0 0 0 0 0 0 0 0 0 0 0 512 0 table a-1. complete instruction list sorted by mnemonic (continued) name 0 5 6 7 8 9 1011121314151617181920 21 22232425262728293031 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-5 instructions sorted by mnemonic mfcr 31 d 0 0 0 0 0 0 0 0 0 0 19 0 mffs x 63 d 0 0 0 0 0 0 0 0 0 0 583 rc mfmsr 2 31 d 0 0 0 0 0 0 0 0 0 0 83 0 mfspr 5 31 d spr 339 0 mfsr 2 31 d 0sr 0 0 0 0 0 595 0 mfsrin 2 31 d 0 0 0 0 0 b 659 0 mftb 31 d tbr 371 0 mtcrf 31 s 0 crm 0 144 0 mtfsb0 x 63 crbd 0 0 0 0 0 0 0 0 0 0 70 rc mtfsb1 x 63 crbd 0 0 0 0 0 0 0 0 0 0 38 rc mtfsf x 63 0fm 0b 711 rc mtfsfi x 63 crfd 0 0 0 0 0 0 0 imm 0 134 rc mtmsr 2 31 s 0 0 0 0 0 0 0 0 0 0 146 0 mtspr 5 31 s spr 467 0 mtsr 2 31 s 0sr 0 0 0 0 0 210 0 mtsrin 2 31 s 0 0 0 0 0 b 242 0 mulhd x 1 31 d a b 0 73 rc mulhdu x 1 31 d a b 0 9 rc mulhw x 31 d a b 075rc mulhwu x 31 d a b 011rc mulld x 1 31 d a b oe 233 rc mulli 7da simm mullw x 31 d a b oe 235 rc nand x 31 s a b 476 rc neg x 31 d a 0 0 0 0 0 oe 104 rc nor x 31 s a b 124 rc or x 31 s a b 444 rc orc x 31 s a b 412 rc ori 24 s a uimm oris 25 s a uimm rfi 2 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 50 0 rldcl x 1 30 s a b mb 8 rc rldcr x 1 30 s a b me 9 rc rldic x 1 30 s a sh mb 2 sh rc rldicl x 1 30 s a sh mb 0 sh rc rldicr x 1 30 s a sh me 1 sh rc rldimi x 1 30 s a sh mb 3 sh rc table a-1. complete instruction list sorted by mnemonic (continued) name 0 5 6 7 8 9 1011121314151617181920 21 22232425262728293031 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-6 g2 powerpc core reference manual motorola instructions sorted by mnemonic rlwimi x 20 s a sh mb me rc rlwinm x 21 s a sh mb me rc rlwnm x 23 s a b mb me rc sc 17 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 slbia 1, 2, 3 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 498 0 slbie 1, 2, 3 31 0 0 0 0 0 0 0 0 0 0 b 434 0 sld x 1 31 s a b 27 rc slw x 31 s a b 24 rc srad x 1 31 s a b 794 rc sradi x 1 31 s a sh 413 sh rc sraw x 31 s a b 792 rc srawi x 31 s a sh 824 rc srd x 1 31 s a b 539 rc srw x 31 s a b 536 rc stb 38 s a d stbu 39 s a d stbux 31 s a b 247 0 stbx 31 s a b 215 0 std 1 62 s a ds 0 stdcx. 1 31 s a b 214 1 stdu 1 62 s a ds 1 stdux 1 31 s a b 181 0 stdx 1 31 s a b 149 0 stfd 54 s a d stfdu 55 s a d stfdux 31 s a b 759 0 stfdx 31 s a b 727 0 stfiwx 3 31 s a b 983 0 stfs 52 s a d stfsu 53 s a d stfsux 31 s a b 695 0 stfsx 31 s a b 663 0 sth 44 s a d sthbrx 31 s a b 918 0 sthu 45 s a d sthux 31 s a b 439 0 sthx 31 s a b 407 0 table a-1. complete instruction list sorted by mnemonic (continued) name 0 5 6 7 8 9 1011121314151617181920 21 22232425262728293031 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-7 instructions sorted by mnemonic stmw 4 47 s a d stswi 4 31 s a nb 725 0 stswx 4 31 s a b 661 0 stw 36 s a d stwbrx 31 s a b 662 0 stwcx. 31 s a b 150 1 stwu 37 s a d stwux 31 s a b 183 0 stwx 31 s a b 151 0 subf x 31 d a b oe 40 rc subfc x 31 d a b oe 8 rc subfe x 31 d a b oe 136 rc subfic 08 d a simm subfme x 31 d a 0 0 0 0 0 oe 232 rc subfze x 31 d a 0 0 0 0 0 oe 200 rc sync 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 598 0 td 1 31 to a b 68 0 tdi 1 02 to a simm tlbia 2, 3 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 370 0 tlbie 2, 3 31 0 0 0 0 0 0 0 0 0 0 b 306 0 tlbld 2, 6 31 0 0 0 0 0 0 0 0 0 0 b 978 0 tlbli 2, 6 31 0 0 0 0 0 0 0 0 0 0 b 1010 0 tlbsync 2, 3 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 566 0 tw 31 to a b 4 0 twi 03 to a simm xor x 31 s a b 316 rc xori 26 s a uimm xoris 27 s a uimm 1 64-bit instruction 2 supervisor-level instruction 3 optional in the powerpc architecture 4 load and store string or multiple instruction 5 supervisor- and user-level instruction 6 g2 core implementation-specific instruction table a-1. complete instruction list sorted by mnemonic (continued) name 0 5 6 7 8 9 1011121314151617181920 21 22232425262728293031 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-8 g2 powerpc core reference manual motorola instructions sorted by opcode a.2 instructions sorted by opcode table a-2 lists the instructions defined in the powerpc architecture in numeric order by opcode. table a-2. complete instruction list sorted by opcode name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 tdi 1 0 0 0 0 1 0 to a simm twi 0 0 0 0 1 1 to a simm mulli 0 0 0 1 1 1 d a simm subfic 0 0 1 0 0 0 d a simm cmpli 0 0 1 0 1 0 crfd 0l a uimm cmpi 0 0 1 0 1 1 crfd 0l a simm addic 0 0 1 1 0 0 d a simm addic. 0 0 1 1 0 1 d a simm addi 0 0 1 1 1 0 d a simm addis 0 0 1 1 1 1 d a simm bc x 0 1 0 0 0 0 bo bi bd aa lk sc 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 b x 0 1 0 0 1 0 li aa lk mcrf 0 1 0 0 1 1 crfd 0 0 crfs 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 bclr x 0 1 0 0 1 1 bo bi 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 lk crnor 0 1 0 0 1 1 crbd crba crbb 0 0 0 0 1 0 0 0 0 1 0 rfi 0 1 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 1 0 0 crandc 0 1 0 0 1 1 crbd crba crbb 0 0 1 0 0 0 0 0 0 1 0 isync 0 1 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 1 1 0 0 crxor 0 1 0 0 1 1 crbd crba crbb 0 0 1 1 0 0 0 0 0 1 0 crnand 0 1 0 0 1 1 crbd crba crbb 0 0 1 1 1 0 0 0 0 1 0 crand 0 1 0 0 1 1 crbd crba crbb 0 1 0 0 0 0 0 0 0 1 0 creqv 0 1 0 0 1 1 crbd crba crbb 0 1 0 0 1 0 0 0 0 1 0 crorc 0 1 0 0 1 1 crbd crba crbb 0 1 1 0 1 0 0 0 0 1 0 cror 0 1 0 0 1 1 crbd crba crbb 0 1 1 1 0 0 0 0 0 1 0 bcctr x 0 1 0 0 1 1 bo bi 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 lk rlwimi x 0 1 0 1 0 0 s a sh mb me rc rlwinm x 0 1 0 1 0 1 s a sh mb me rc rlwnm x 0 1 0 1 1 1 s a b mb me rc ori 0 1 1 0 0 0 s a uimm oris 0 1 1 0 0 1 s a uimm xori 0 1 1 0 1 0 s a uimm xoris 0 1 1 0 1 1 s a uimm f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-9 instructions sorted by opcode andi. 0 1 1 1 0 0 s a uimm andis. 0 1 1 1 0 1 s a uimm rldicl x 1 0 1 1 1 1 0 s a sh mb 0 0 0 sh rc rldicr x 1 0 1 1 1 1 0 s a sh me 0 0 1 sh rc rldic x 1 0 1 1 1 1 0 s a sh mb 0 1 0 sh rc rldimi x 1 0 1 1 1 1 0 s a sh mb 0 1 1 sh rc rldcl x 1 0 1 1 1 1 0 s a b mb 0 1 0 0 0 rc rldcr x 1 0 1 1 1 1 0 s a b me 0 1 0 0 1 rc cmp 0 1 1 1 1 1 crfd 0 l a b 0 0 0 0 0 0 0 0 0 0 0 tw 0 1 1 1 1 1 to a b 0 0 0 0 0 0 0 1 0 0 0 subfc x 0 1 1 1 1 1 d a b oe 0 0 0 0 0 0 1 0 0 0 rc mulhdu x 1 0 1 1 1 1 1 d a b 0 0 0 0 0 0 0 1 0 0 1 rc addc x 0 1 1 1 1 1 d a b oe 0 0 0 0 0 0 1 0 1 0 rc mulhwu x 0 1 1 1 1 1 d a b 0 0 0 0 0 0 0 1 0 1 1 rc mfcr 0 1 1 1 1 1 d 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 1 0 lwarx 0 1 1 1 1 1 d a b 0 0 0 0 0 1 0 1 0 0 0 ldx 1 0 1 1 1 1 1 d a b 0 0 0 0 0 1 0 1 0 1 0 lwzx 0 1 1 1 1 1 d a b 0 0 0 0 0 1 0 1 1 1 0 slw x 0 1 1 1 1 1 s a b 0 0 0 0 0 1 1 0 0 0 rc cntlzw x 0 1 1 1 1 1 s a 0 0 0 0 0 0 0 0 0 0 1 1 0 1 0 rc sld x 1 0 1 1 1 1 1 s a b 0 0 0 0 0 1 1 0 1 1 rc and x 0 1 1 1 1 1 s a b 0 0 0 0 0 1 1 1 0 0 rc cmpl 0 1 1 1 1 1 crfd 0 l a b 0 0 0 0 1 0 0 0 0 0 0 subf x 0 1 1 1 1 1 d a b oe 0 0 0 0 1 0 1 0 0 0 rc ldux 1 0 1 1 1 1 1 d a b 0 0 0 0 1 1 0 1 0 1 0 dcbst 0 1 1 1 1 1 0 0 0 0 0 a b 0 0 0 0 1 1 0 1 1 0 0 lwzux 0 1 1 1 1 1 d a b 0 0 0 0 1 1 0 1 1 1 0 cntlzd x 1 0 1 1 1 1 1 s a 0 0 0 0 0 0 0 0 0 1 1 1 0 1 0 rc andc x 0 1 1 1 1 1 s a b 0 0 0 0 1 1 1 1 0 0 rc td 1 0 1 1 1 1 1 to a b 0 0 0 1 0 0 0 1 0 0 0 mulhd x 1 0 1 1 1 1 1 d a b 0 0 0 0 1 0 0 1 0 0 1 rc mulhw x 0 1 1 1 1 1 d a b 0 0 0 0 1 0 0 1 0 1 1 rc mfmsr 0 1 1 1 1 1 d 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 0 1 1 0 ldarx 1 0 1 1 1 1 1 d a b 0 0 0 1 0 1 0 1 0 0 0 dcbf 0 1 1 1 1 1 0 0 0 0 0 a b 0 0 0 1 0 1 0 1 1 0 0 lbzx 0 1 1 1 1 1 d a b 0 0 0 1 0 1 0 1 1 1 0 neg x 0 1 1 1 1 1 d a 0 0 0 0 0 oe 0 0 0 1 1 0 1 0 0 0 rc table a-2. complete instruction list sorted by opcode (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-10 g2 powerpc core reference manual motorola instructions sorted by opcode lbzux 0 1 1 1 1 1 d a b 0 0 0 1 1 1 0 1 1 1 0 nor x 0 1 1 1 1 1 s a b 0 0 0 1 1 1 1 1 0 0 rc subfe x 0 1 1 1 1 1 d a b oe 0 0 1 0 0 0 1 0 0 0 rc adde x 0 1 1 1 1 1 d a b oe 0 0 1 0 0 0 1 0 1 0 rc mtcrf 0 1 1 1 1 1 s 0 crm 0 0 0 1 0 0 1 0 0 0 0 0 mtmsr 0 1 1 1 1 1 s 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 1 0 0 stdx 1 0 1 1 1 1 1 s a b 0 0 1 0 0 1 0 1 0 1 0 stwcx. 0 1 1 1 1 1 s a b 0 0 1 0 0 1 0 1 1 0 1 stwx 0 1 1 1 1 1 s a b 0 0 1 0 0 1 0 1 1 1 0 stdux 1 0 1 1 1 1 1 s a b 0 0 1 0 1 1 0 1 0 1 0 stwux 0 1 1 1 1 1 s a b 0 0 1 0 1 1 0 1 1 1 0 subfze x 0 1 1 1 1 1 d a 0 0 0 0 0 oe 0 0 1 1 0 0 1 0 0 0 rc addze x 0 1 1 1 1 1 d a 0 0 0 0 0 oe 0 0 1 1 0 0 1 0 1 0 rc mtsr 0 1 1 1 1 1 s 0sr 0 0 0 0 0 0 0 1 1 0 1 0 0 1 0 0 stdcx. 1 0 1 1 1 1 1 s a b 0 0 1 1 0 1 0 1 1 0 1 stbx 0 1 1 1 1 1 s a b 0 0 1 1 0 1 0 1 1 1 0 subfme x 0 1 1 1 1 1 d a 0 0 0 0 0 oe 0 0 1 1 1 0 1 0 0 0 rc mulld 1 0 1 1 1 1 1 d a b oe 0 0 1 1 1 0 1 0 0 1 rc addme x 0 1 1 1 1 1 d a 0 0 0 0 0 oe 0 0 1 1 1 0 1 0 1 0 rc mullw x 0 1 1 1 1 1 d a b oe 0 0 1 1 1 0 1 0 1 1 rc mtsrin 0 1 1 1 1 1 s 0 0 0 0 0 b 0 0 1 1 1 1 0 0 1 0 0 dcbtst 0 1 1 1 1 1 0 0 0 0 0 a b 0 0 1 1 1 1 0 1 1 0 0 stbux 0 1 1 1 1 1 s a b 0 0 1 1 1 1 0 1 1 1 0 add x 0 1 1 1 1 1 d a b oe 0 1 0 0 0 0 1 0 1 0 rc dcbt 0 1 1 1 1 1 0 0 0 0 0 a b 0 1 0 0 0 1 0 1 1 0 0 lhzx 0 1 1 1 1 1 d a b 0 1 0 0 0 1 0 1 1 1 0 eqv x 0 1 1 1 1 1 s a b 0 1 0 0 0 1 1 1 0 0 rc tlbie 2 , 3 0 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 b 0 1 0 0 1 1 0 0 1 0 0 eciwx 0 1 1 1 1 1 d a b 0 1 0 0 1 1 0 1 1 0 0 lhzux 0 1 1 1 1 1 d a b 0 1 0 0 1 1 0 1 1 1 0 xor x 0 1 1 1 1 1 s a b 0 1 0 0 1 1 1 1 0 0 rc mfspr 4 0 1 1 1 1 1 d spr 0 1 0 1 0 1 0 0 1 1 0 lwax 1 0 1 1 1 1 1 d a b 0 1 0 1 0 1 0 1 0 1 0 lhax 0 1 1 1 1 1 d a b 0 1 0 1 0 1 0 1 1 1 0 tlbia 2, 3 0 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 1 1 0 0 1 0 0 mftb 0 1 1 1 1 1 d tbr 0 1 0 1 1 1 0 0 1 1 0 lwaux 1 0 1 1 1 1 1 d a b 0 1 0 1 1 1 0 1 0 1 0 table a-2. complete instruction list sorted by opcode (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-11 instructions sorted by opcode lhaux 0 1 1 1 1 1 d a b 0 1 0 1 1 1 0 1 1 1 0 sthx 0 1 1 1 1 1 s a b 0 1 1 0 0 1 0 1 1 1 0 orc x 0 1 1 1 1 1 s a b 0 1 1 0 0 1 1 1 0 0 rc sradi x 1 0 1 1 1 1 1 s a sh 1 1 0 0 1 1 1 0 1 1 sh rc slbie 1, 2, 3 0 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 b 0 1 1 0 1 1 0 0 1 0 0 ecowx 0 1 1 1 1 1 s a b 0 1 1 0 1 1 0 1 1 0 0 sthux 0 1 1 1 1 1 s a b 0 1 1 0 1 1 0 1 1 1 0 or x 0 1 1 1 1 1 s a b 0 1 1 0 1 1 1 1 0 0 rc divdu x 1 0 1 1 1 1 1 d a b oe 0 1 1 1 0 0 1 0 0 1 rc divwu x 0 1 1 1 1 1 d a b oe 0 1 1 1 0 0 1 0 1 1 rc mtspr 4 0 1 1 1 1 1 s spr 0 1 1 1 0 1 0 0 1 1 0 dcbi 0 1 1 1 1 1 0 0 0 0 0 a b 0 1 1 1 0 1 0 1 1 0 0 nand x 0 1 1 1 1 1 s a b 0 1 1 1 0 1 1 1 0 0 rc divd x 1 0 1 1 1 1 1 d a b oe 0 1 1 1 1 0 1 0 0 1 rc divw x 0 1 1 1 1 1 d a b oe 0 1 1 1 1 0 1 0 1 1 rc slbia 1, 2, 3 0 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 0 0 1 0 0 mcrxr 0 1 1 1 1 1 crfd 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 lswx 5 0 1 1 1 1 1 d a b 1 0 0 0 0 1 0 1 0 1 0 lwbrx 0 1 1 1 1 1 d a b 1 0 0 0 0 1 0 1 1 0 0 lfsx 0 1 1 1 1 1 d a b 1 0 0 0 0 1 0 1 1 1 0 srw x 0 1 1 1 1 1 s a b 1 0 0 0 0 1 1 0 0 0 rc srd x 1 0 1 1 1 1 1 s a b 1 0 0 0 0 1 1 0 1 1 rc tlbsync 2, 3 0 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 1 0 1 1 0 0 lfsux 0 1 1 1 1 1 d a b 1 0 0 0 1 1 0 1 1 1 0 mfsr 0 1 1 1 1 1 d 0sr 0 0 0 0 0 1 0 0 1 0 1 0 0 1 1 0 lswi 5 0 1 1 1 1 1 d a nb 1 0 0 1 0 1 0 1 0 1 0 sync 0 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 1 0 1 1 0 0 lfdx 0 1 1 1 1 1 d a b 1 0 0 1 0 1 0 1 1 1 0 lfdux 0 1 1 1 1 1 d a b 1 0 0 1 1 1 0 1 1 1 0 mfsrin 2 0 1 1 1 1 1 d 0 0 0 0 0 b 1 0 1 0 0 1 0 0 1 1 0 stswx 5 0 1 1 1 1 1 s a b 1 0 1 0 0 1 0 1 0 1 0 stwbrx 0 1 1 1 1 1 s a b 1 0 1 0 0 1 0 1 1 0 0 stfsx 0 1 1 1 1 1 s a b 1 0 1 0 0 1 0 1 1 1 0 stfsux 0 1 1 1 1 1 s a b 1 0 1 0 1 1 0 1 1 1 0 stswi 5 0 1 1 1 1 1 s a nb 1 0 1 1 0 1 0 1 0 1 0 stfdx 0 1 1 1 1 1 s a b 1 0 1 1 0 1 0 1 1 1 0 stfdux 0 1 1 1 1 1 s a b 1 0 1 1 1 1 0 1 1 1 0 table a-2. complete instruction list sorted by opcode (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-12 g2 powerpc core reference manual motorola instructions sorted by opcode lhbrx 0 1 1 1 1 1 d a b 1 1 0 0 0 1 0 1 1 0 0 sraw x 0 1 1 1 1 1 s a b 1 1 0 0 0 1 1 0 0 0 rc srad x 1 0 1 1 1 1 1 s a b 1 1 0 0 0 1 1 0 1 0 rc srawi x 0 1 1 1 1 1 s a sh 1 1 0 0 1 1 1 0 0 0 rc eieio 0 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 1 0 1 0 1 1 0 0 sthbrx 0 1 1 1 1 1 s a b 1 1 1 0 0 1 0 1 1 0 0 extsh x 0 1 1 1 1 1 s a 0 0 0 0 0 1 1 1 0 0 1 1 0 1 0 rc extsb x 0 1 1 1 1 1 s a 0 0 0 0 0 1 1 1 0 1 1 1 0 1 0 rc tlbld 2, 6 0 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 b 1 1 1 1 0 1 0 0 1 0 0 icbi 0 1 1 1 1 1 0 0 0 0 0 a b 1 1 1 1 0 1 0 1 1 0 0 stfiwx 3 0 1 1 1 1 1 s a b 1 1 1 1 0 1 0 1 1 1 0 extsw 1 0 1 1 1 1 1 s a 0 0 0 0 0 1 1 1 1 0 1 1 0 1 0 rc tlbli 2, 6 0 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 b 1 1 1 1 1 1 0 0 1 0 0 dcbz 0 1 1 1 1 1 0 0 0 0 0 a b 1 1 1 1 1 1 0 1 1 0 0 lwz 1 0 0 0 0 0 d a d lwzu 1 0 0 0 0 1 d a d lbz 1 0 0 0 1 0 d a d lbzu 1 0 0 0 1 1 d a d stw 1 0 0 1 0 0 s a d stwu 1 0 0 1 0 1 s a d stb 1 0 0 1 1 0 s a d stbu 1 0 0 1 1 1 s a d lhz 1 0 1 0 0 0 d a d lhzu 1 0 1 0 0 1 d a d lha 1 0 1 0 1 0 d a d lhau 1 0 1 0 1 1 d a d sth 1 0 1 1 0 0 s a d sthu 1 0 1 1 0 1 s a d lmw 5 1 0 1 1 1 0 d a d stmw 5 1 0 1 1 1 1 s a d lfs 1 1 0 0 0 0 d a d lfsu 1 1 0 0 0 1 d a d lfd 1 1 0 0 1 0 d a d lfdu 1 1 0 0 1 1 d a d stfs 1 1 0 1 0 0 s a d stfsu 1 1 0 1 0 1 s a d stfd 1 1 0 1 1 0 s a d table a-2. complete instruction list sorted by opcode (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-13 instructions sorted by opcode stfdu 1 1 0 1 1 1 s a d ld 1 1 1 1 0 1 0 d a ds 0 0 ldu 1 1 1 1 0 1 0 d a ds 0 1 lwa 1 1 1 1 0 1 0 d a ds 1 0 fdivs x 1 1 1 0 1 1 d a b 0 0 0 0 0 1 0 0 1 0 rc fsubs x 1 1 1 0 1 1 d a b 0 0 0 0 0 1 0 1 0 0 rc fadds x 1 1 1 0 1 1 d a b 0 0 0 0 0 1 0 1 0 1 rc fsqrts x 3 1 1 1 0 1 1 d 0 0 0 0 0 b 0 0 0 0 0 1 0 1 1 0 rc fres x 3 1 1 1 0 1 1 d 0 0 0 0 0 b 0 0 0 0 0 1 1 0 0 0 rc fmuls x 1 1 1 0 1 1 d a 0 0 0 0 0 c 1 1 0 0 1 rc fmsubs x 1 1 1 0 1 1 d a b c 1 1 1 0 0 rc fmadds x 1 1 1 0 1 1 d a b c 1 1 1 0 1 rc fnmsubs x 1 1 1 0 1 1 d a b c 1 1 1 1 0 rc fnmadds x 1 1 1 0 1 1 d a b c 1 1 1 1 1 rc std 1 1 1 1 1 1 0 s a ds 0 0 stdu 1 1 1 1 1 1 0 s a ds 0 1 fcmpu 1 1 1 1 1 1 crfd 0 0 a b 0 0 0 0 0 0 0 0 0 0 0 frsp x 1 1 1 1 1 1 d 0 0 0 0 0 b 0 0 0 0 0 0 1 1 0 0 rc fctiw x 1 1 1 1 1 1 d 0 0 0 0 0 b 0 0 0 0 0 0 1 1 1 0 fctiwz x 1 1 1 1 1 1 d 0 0 0 0 0 b 0 0 0 0 0 0 1 1 1 1 rc fdiv x 1 1 1 1 1 1 d a b 0 0 0 0 0 1 0 0 1 0 rc fsub x 1 1 1 1 1 1 d a b 0 0 0 0 0 1 0 1 0 0 rc fadd x 1 1 1 1 1 1 d a b 0 0 0 0 0 1 0 1 0 1 rc fsqrt x 3 1 1 1 1 1 1 d 0 0 0 0 0 b 0 0 0 0 0 1 0 1 1 0 rc fsel x 3 1 1 1 1 1 1 d a b c 1 0 1 1 1 rc fmul x 1 1 1 1 1 1 d a 0 0 0 0 0 c 1 1 0 0 1 rc frsqrte x 3 1 1 1 1 1 1 d 0 0 0 0 0 b 0 0 0 0 0 1 1 0 1 0 rc fmsub x 1 1 1 1 1 1 d a b c 1 1 1 0 0 rc fmadd x 1 1 1 1 1 1 d a b c 1 1 1 0 1 rc fnmsub x 1 1 1 1 1 1 d a b c 1 1 1 1 0 rc fnmadd x 1 1 1 1 1 1 d a b c 1 1 1 1 1 rc fcmpo 1 1 1 1 1 1 crfd 0 0 a b 0 0 0 0 1 0 0 0 0 0 0 mtfsb1 x 1 1 1 1 1 1 crbd 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 1 0 rc fneg x 1 1 1 1 1 1 d 0 0 0 0 0 b 0 0 0 0 1 0 1 0 0 0 rc mcrfs 1 1 1 1 1 1 crfd 0 0 crfs 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 mtfsb0 x 1 1 1 1 1 1 crbd 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 1 0 rc fmr x 1 1 1 1 1 1 d 0 0 0 0 0 b 0 0 0 1 0 0 1 0 0 0 rc table a-2. complete instruction list sorted by opcode (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-14 g2 powerpc core reference manual motorola instructions sorted by opcode mtfsfi x 1 1 1 1 1 1 crfd 0 0 0 0 0 0 0 imm 0 0 0 1 0 0 0 0 1 1 0 rc fnabsxv 1 1 1 1 1 1 d 0 0 0 0 0 b 0 0 1 0 0 0 1 0 0 0 rc fabs x 1 1 1 1 1 1 d 0 0 0 0 0 b 0 1 0 0 0 0 1 0 0 0 rc mffs x 1 1 1 1 1 1 d 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 1 1 1 rc mtfsf x 1 1 1 1 1 1 0fm 0 b 1 0 1 1 0 0 0 1 1 1 rc fctid x 1 1 1 1 1 1 1 d 0 0 0 0 0 b 1 1 0 0 1 0 1 1 1 0 rc fctidz x 1 1 1 1 1 1 1 d 0 0 0 0 0 b 1 1 0 0 1 0 1 1 1 1 rc fcfid x 1 1 1 1 1 1 1 d 0 0 0 0 0 b 1 1 0 1 0 0 1 1 1 0 rc 1 64-bit instruction 2 supervisor-level instruction 3 optional in the powerpc architecture 4 supervisor- and user-level instruction 5 load and store string or multiple instruction 6 g2 core implementation-specific instruction table a-2. complete instruction list sorted by opcode (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-15 instructions grouped by functional categories a.3 instructions grouped by functional categories table a-3 through table a-30 list the powerpc instructions grouped by function. table a-3. integer arithmetic instructions name 0 5678910111213141516171819202122232425262728293031 add x 31 d a b oe 266 rc addc x 31 d a b oe 10 rc adde x 31 d a b oe 138 rc addi 14 d a simm addic 12 d a simm addic. 13 d a simm addis 15 d a simm addme x 31 d a 0 0 0 0 0 oe 234 rc addze x 31 d a 0 0 0 0 0 oe 202 rc divd x 1 1 64-bit instruction 31 d a b oe 489 rc divdu x 1 31 d a b oe 457 rc divw x 31 d a b oe 491 rc divwu x 31 d a b oe 459 rc mulhd x 1 31 d a b 0 73 rc mulhdu x 1 31 d a b 0 9 rc mulhw x 31 d a b 075rc mulhwu x 31 d a b 011rc mulld 1 31 d a b oe 233 rc mulli 07 d a simm mullw x 31 d a b oe 235 rc neg x 31 d a 0 0 0 0 0 oe 104 rc subf x 31 d a b oe 40 rc subfc x 31 d a b oe 8 rc subfic x 08 d a simm subfe x 31 d a b oe 136 rc subfme x 31 d a 0 0 0 0 0 oe 232 rc subfze x 31 d a 0 0 0 0 0 oe 200 rc f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-16 g2 powerpc core reference manual motorola instructions grouped by functional categories table a-4. integer compare instructions name 0 5 6 7 8 9 101112131415161718192021222324252627282930 31 cmp 31 crfd 0l a b 0 0 0 0 0 0 0 0 0 0 0 cmpi 11 crfd 0l a simm cmpl 31 crfd 0l a b 32 0 cmpli 10 crfd 0l a uimm table a-5. integer logical instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 and x 31 s a b 28 rc andc x 31 s a b 60 rc andi. 28 s a uimm andis. 29 s a uimm cntlzd x 1 1 64-bit instruction 31 s a 0 0 0 0 0 58 rc cntlzw x 31 s a 0 0 0 0 0 26 rc eqv x 31 s a b 284 rc extsb x 31 s a 0 0 0 0 0 954 rc extsh x 31 s a 0 0 0 0 0 922 rc extsw x 1 31 s a 0 0 0 0 0 986 rc nand x 31 s a b 476 rc nor x 31 s a b 124 rc or x 31 s a b 444 rc orc x 31 s a b 412 rc ori 24 s a uimm oris 25 s a uimm xor x 31 s a b 316 rc xori 26 s a uimm xoris 27 s a uimm f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-17 instructions grouped by functional categories table a-6. integer rotate instructions name 0 5678910111213141516171819202122232425262728293031 rldcl x 1 1 64-bit instruction 30 s a b mb 8 rc rldcr x 1 30 s a b me 9 rc rldic x 1 30 s a sh mb 2 sh rc rldicl x 1 30 s a sh mb 0 sh rc rldicr x 1 30 s a sh me 1 sh rc rldimi x 1 30 s a sh mb 3 sh rc rlwimi x 22 s a sh mb me rc rlwinm x 20 s a sh mb me rc rlwnm x 21 s a sh mb me rc table a-7. integer shift instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 sld x 1 1 64-bit instruction 31 s a b 27 rc slw x 31 s a b 24 rc srad x 1 31 s a b 794 rc sradi x 1 31 s a sh 413 sh rc sraw x 31 s a b 792 rc srawi x 31 s a sh 824 rc srd x 1 31 s a b 539 rc srw x 31 s a b 536 rc f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-18 g2 powerpc core reference manual motorola instructions grouped by functional categories table a-8. floating-point arithmetic instructions name 0 5 6 7 8 9 101112131415161718192021222324252627282930 31 fadd x 63 d a b 0 0 0 0 0 21 rc fadds x 59 d a b 0 0 0 0 0 21 rc fdiv x 63 d a b 0 0 0 0 0 18 rc fdivs x 59 d a b 0 0 0 0 0 18 rc fmul x 63 d a 0 0 0 0 0 c 25 rc fmuls x 59 d a 0 0 0 0 0 c 25 rc fres x 1 59 d 0 0 0 0 0 b 0 0 0 0 0 24 rc frsqrte x 1 63 d 0 0 0 0 0 b 0 0 0 0 0 26 rc fsub x 63 d a b 0 0 0 0 0 20 rc fsubs x 59 d a b 0 0 0 0 0 20 rc fsel x 1 63 d a b c 23 rc fsqrt x 1 63 d 0 0 0 0 0 b 0 0 0 0 0 22 rc fsqrts x 1 59 d 0 0 0 0 0 b 0 0 0 0 0 22 rc 1 optional in the powerpc architecture table a-9. floating-point multiply-add instructions name 0 5678910111213141516171819202122232425262728293031 fmadd x 63 d a b c 29 rc fmadds x 59 d a b c 29 rc fmsub x 63 d a b c 28 rc fmsubs x 59 d a b c 28 rc fnmadd x 63 d a b c 31 rc fnmadds x 59 d a b c 31 rc fnmsub x 63 d a b c 30 rc fnmsubs x 59 d a b c 30 rc table a-10. floating-point rounding and conversion instructions name 0 5678910111213141516171819202122232425262728293031 fcfid x 1 1 64-bit instruction 63 d 0 0 0 0 0 b 846 rc fctid x 1 63 d 0 0 0 0 0 b 814 rc fctidz x 1 63 d 0 0 0 0 0 b 815 rc fctiw x 63 d 0 0 0 0 0 b 14 rc fctiwz x 63 d 0 0 0 0 0 b 15 rc frsp x 63 d 0 0 0 0 0 b 12 rc f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-19 instructions grouped by functional categories table a-11. floating-point compare instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 fcmpo 63 crfd 0 0 a b 32 0 fcmpu 63 crfd 0 0 a b 0 0 table a-12. floating-point status and control register instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 mcrfs 63 crfd 0 0 crfs 0 0 0 0 0 0 0 64 0 mffs x 63 d 0 0 0 0 0 0 0 0 0 0 583 rc mtfsb0 x 63 crbd 0 0 0 0 0 0 0 0 0 0 70 rc mtfsb1 x 63 crbd 0 0 0 0 0 0 0 0 0 0 38 rc mtfsf x 31 0fm 0b 711 rc mtfsfi x 63 crfd 0 0 0 0 0 0 0 imm 0134rc table a-13. integer load instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 lbz 34 d a d lbzu 35 d a d lbzux 31 d a b 119 0 lbzx 31 d a b 87 0 ld 1 58 d a ds 0 ldu 1 58 d a ds 1 ldux 1 31 d a b 53 0 ldx 1 31 d a b 21 0 lha 42 d a d lhau 43 d a d lhaux 31 d a b 375 0 lhax 31 d a b 343 0 lhz 40 d a d lhzu 41 d a d lhzux 31 d a b 311 0 lhzx 31 d a b 279 0 lwa 1 58 d a ds 2 lwaux 1 31 d a b 373 0 lwax 1 31 d a b 341 0 lwz 32 d a d lwzu 33 d a d f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-20 g2 powerpc core reference manual motorola instructions grouped by functional categories lwzux 31 d a b 55 0 lwzx 31 d a b 23 0 1 64-bit instruction table a-14. integer store instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 stb 38 s a d stbu 39 s a d stbux 31 s a b 247 0 stbx 31 s a b 215 0 std 1 1 64-bit instruction 62 s a ds 0 stdu 1 62 s a ds 1 stdux 1 31 s a b 181 0 stdx 1 31 s a b 149 0 sth 44 s a d sthu 45 s a d sthux 31 s a b 439 0 sthx 31 s a b 407 0 stw 36 s a d stwu 37 s a d stwux 31 s a b 183 0 stwx 31 s a b 151 0 table a-15. integer load and store with byte-reverse instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 lhbrx 31 d a b 790 0 lwbrx 31 d a b 534 0 sthbrx 31 s a b 918 0 stwbrx 31 s a b 662 0 table a-16. integer load and store multiple instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 lmw 1 1 load and store string or multiple instruction 46 d a d stmw 1 47 s a d table a-13. integer load instructions (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-21 instructions grouped by functional categories table a-17. integer load and store string instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 lswi 1 1 load and store string or multiple instruction 31 d a nb 597 0 lswx 1 31 d a b 533 0 stswi 1 31 s a nb 725 0 stswx 1 31 s a b 661 0 table a-18. memory synchronization instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 eieio 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 854 0 isync 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 150 0 ldarx 1 1 64-bit instruction 31 d a b 84 0 lwarx 31 d a b 20 0 stdcx 1 31 s a b 214 1 stwcx. 31 s a b 150 1 sync 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 598 0 table a-19. floating-point load instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 lfd 50 d a d lfdu 51 d a d lfdux 31 d a b 631 0 lfdx 31 d a b 599 0 lfs 48 d a d lfsu 49 d a d lfsux 31 d a b 567 0 lfsx 31 d a b 535 0 table a-20. floating-point store instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 stfd 54 s a d stfdu 55 s a d stfdux 31 s a b 759 0 stfdx 31 s a b 727 0 stfiwx 1 31 s a b 983 0 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-22 g2 powerpc core reference manual motorola instructions grouped by functional categories stfs 52 s a d stfsu 53 s a d stfsux 31 s a b 695 0 stfsx 31 s a b 663 0 1 optional in the powerpc architecture table a-21. floating-point move instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 fabs x 63 d 0 0 0 0 0 b 264 rc fmr x 63 d 0 0 0 0 0 b 72 rc fnabs x 63 d 0 0 0 0 0 b 136 rc fneg x 63 d 0 0 0 0 0 b 40 rc table a-22. branch instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 b x 18 li aa lk bc x 16 bo bi bd aa lk bcctr x 19 bo bi 0 0 0 0 0 528 lk bclr x 19 bo bi 0 0 0 0 0 16 lk table a-23. condition register logical instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 crand 19 crbd crba crbb 257 0 crandc 19 crbd crba crbb 129 0 creqv 19 crbd crba crbb 289 0 crnand 19 crbd crba crbb 225 0 crnor 19 crbd crba crbb 33 0 cror 19 crbd crba crbb 449 0 crorc 19 crbd crba crbb 417 0 crxor 19 crbd crba crbb 193 0 mcrf 19 crfd 0 0 crfs 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 table a-20. floating-point store instructions (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-23 instructions grouped by functional categories table a-24. system linkage instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 rfi 1 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 50 0 sc 17 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 supervisor-level instruction table a-25. trap instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 td 1 1 64-bit instruction 31 to a b 68 0 tdi 1 03 to a simm tw 31 to a b 4 0 twi 03 to a simm table a-26. processor control instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 mcrxr 31 crfs 0 0 0 0 0 0 0 0 0 0 0 0 512 0 mfcr 31 d 0 0 0 0 0 0 0 0 0 0 19 0 mfmsr 1 1 supervisor-level instruction 31 d 0 0 0 0 0 0 0 0 0 0 83 0 mfspr 2 2 supervisor- and user-level instruction 31 d spr 339 0 mftb 31 d tpr 371 0 mtcrf 31 s 0 crm 0144 0 mtmsr 1 31 s 0 0 0 0 0 0 0 0 0 0 146 0 mtspr 2 31 d spr 467 0 table a-27. cache management instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 dcbf 31 0 0 0 0 0 a b 86 0 dcbi 1 1 supervisor-level instruction 31 0 0 0 0 0 a b 470 0 dcbst 31 0 0 0 0 0 a b 54 0 dcbt 31 0 0 0 0 0 a b 278 0 dcbtst 31 0 0 0 0 0 a b 246 0 dcbz 31 0 0 0 0 0 a b 1014 0 icbi 31 0 0 0 0 0 a b 982 0 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-24 g2 powerpc core reference manual motorola instructions grouped by functional categories table a-28. segment register manipulation instructions name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 mfsr 1 31 d 0sr 0 0 0 0 0 595 0 mfsrin 1 31 d 0 0 0 0 0 b 659 0 mtsr 1 31 s 0sr 0 0 0 0 0 210 0 mtsrin 1 31 s 0 0 0 0 0 b 242 0 1 supervisor-level instruction table a-29. lookaside buffer management instructions name 0 5678910111213141516171819202122232425262728293031 slbia 1, 2, 3 1 supervisor-level instruction 2 64-bit instruction 3 optional in the powerpc architecture 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 498 0 slbie 1, 2, 3 31 0 0 0 0 0 0 0 0 0 0 b 434 0 tlbia 1, 3 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 370 0 tlbie 1, 3 31 0 0 0 0 0 0 0 0 0 0 b 306 0 tlbld 1, 4 4 g2 core implementation-specific instruction 31 0 0 0 0 0 0 0 0 0 0 b 978 0 tlbli 1, 4 31 0 0 0 0 0 0 0 0 0 0 b 1010 0 tlbsync 1, 3 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 566 0 table a-30. external control instructions name 0 5678910111213141516171819202122232425262728293031 eciwx 31 d a b 310 0 ecowx 31 s a b 438 0 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-25 instructions sorted by form a.4 instructions sorted by form table a-31 through table a-45 list the powerpc instructions grouped by form. table a-31. i-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd li aa lk specific instruction b x 18 li aa lk table a-32. b-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd bo bi bd aa lk specific instruction bc x 16 bo bi bd aa lk table a-33. sc-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 specific instruction sc 17 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 table a-34. d-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd d a d opcd d a simm opcd s a d opcd s a uimm opcd crfd 0l a simm opcd crfd 0l a uimm opcd to a simm specific instruction addi 14 d a simm addic 12 d a simm f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-26 g2 powerpc core reference manual motorola instructions sorted by form addic. 13 d a simm addis 15 d a simm andi. 28 s a uimm andis. 29 s a uimm cmpi 11 crfd 0l a simm cmpli 10 crfd 0l a uimm lbz 34 d a d lbzu 35 d a d lfd 50 d a d lfdu 51 d a d lfs 48 d a d lfsu 49 d a d lha 42 d a d lhau 43 d a d lhz 40 d a d lhzu 41 d a d lmw 1 46 d a d lwz 32 d a d lwzu 33 d a d mulli 7da simm ori 24 s a uimm oris 25 s a uimm stb 38 s a d stbu 39 s a d stfd 54 s a d stfdu 55 s a d stfs 52 s a d stfsu 53 s a d sth 44 s a d sthu 45 s a d stmw 1 47 s a d stw 36 s a d stwu 37 s a d subfic 08 d a simm table a-34. d-form (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-27 instructions sorted by form tdi 2 02 to a simm twi 03 to a simm xori 26 s a uimm xoris 27 s a uimm 1 load and store string or multiple instruction 2 64-bit instruction table a-35. ds-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd d a ds xo opcd s a ds xo specific instructions ld 1 1 64-bit instruction 58 d a ds 0 ldu 1 58 d a ds 1 lwa 1 58 d a ds 2 std 1 62 s a ds 0 stdu 1 62 s a ds 1 table a-36. x-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd d a b xo 0 opcd d a nb xo 0 opcd d 0 0 0 0 0 b xo 0 opcd d 0 0 0 0 0 0 0 0 0 0 xo 0 opcd d 0sr 0 0 0 0 0 xo 0 opcd s a b xo rc opcdsab xo 1 opcdsab xo 0 opcd s a nb xo 0 opcd s a 0 0 0 0 0 xo rc opcd s 0 0 0 0 0 b xo 0 opcd s 0 0 0 0 0 0 0 0 0 0 xo 0 opcd s 0sr 0 0 0 0 0 xo 0 opcd s a sh xo rc table a-34. d-form (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-28 g2 powerpc core reference manual motorola instructions sorted by form opcd crfd 0l a b xo 0 opcd crfd 0 0 a b xo 0 opcd crfd 0 0 crfs 0 0 0 0 0 0 0 xo 0 opcd crfd 0 0 0 0 0 0 0 0 0 0 0 0 xo 0 opcd crfd 0 0 0 0 0 0 0 imm 0xorc opcd to a b xo 0 opcd d 0 0 0 0 0 b xo rc opcd d 0 0 0 0 0 0 0 0 0 0 xo rc opcd crbd 0 0 0 0 0 0 0 0 0 0 xo rc opcd 0 0 0 0 0 a b xo 0 opcd 0 0 0 0 0 0 0 0 0 0 b xo 0 opcd 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 xo 0 specific instructions and x 31 s a b 28 rc andc x 31 s a b 60 rc cmp 31 crfd 0l a b 0 0 cmpl 31 crfd 0l a b 32 0 cntlzd x 1 31 s a 0 0 0 0 0 58 rc cntlzw x 31 s a 0 0 0 0 0 26 rc dcbf 31 0 0 0 0 0 a b 86 0 dcbi 2 31 0 0 0 0 0 a b 470 0 dcbst 31 0 0 0 0 0 a b 54 0 dcbt 31 0 0 0 0 0 a b 278 0 dcbtst 31 0 0 0 0 0 a b 246 0 dcbz 31 0 0 0 0 0 a b 1014 0 eciwx 31 d a b 310 0 ecowx 31 s a b 438 0 eieio 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 854 0 eqv x 31 s a b 284 rc extsb x 31 s a 0 0 0 0 0 954 rc extsh x 31 s a 0 0 0 0 0 922 rc extsw x 1 31 s a 0 0 0 0 0 986 rc fabs x 63 d 0 0 0 0 0 b 264 rc fcfid x 1 63 d 0 0 0 0 0 b 846 rc fcmpo 63 crfd 0 0 a b 32 0 table a-36. x-form (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-29 instructions sorted by form fcmpu 63 crfd 0 0 a b 0 0 fctid x 1 63 d 0 0 0 0 0 b 814 rc fctidz x 1 63 d 0 0 0 0 0 b 815 rc fctiw x 63 d 0 0 0 0 0 b 14 rc fctiwz x 63 d 0 0 0 0 0 b 15 rc fmr x 63 d 0 0 0 0 0 b 72 rc fnabs x 63 d 0 0 0 0 0 b 136 rc fneg x 63 d 0 0 0 0 0 b 40 rc frsp x 63 d 0 0 0 0 0 b 12 rc icbi 31 0 0 0 0 0 a b 982 0 lbzux 31 d a b 119 0 lbzx 31 d a b 87 0 ldarx 1 31 d a b 84 0 ldux 1 31 d a b 53 0 ldx 1 31 d a b 21 0 lfdux 31 d a b 631 0 lfdx 31 d a b 599 0 lfsux 31 d a b 567 0 lfsx 31 d a b 535 0 lhaux 31 d a b 375 0 lhax 31 d a b 343 0 lhbrx 31 d a b 790 0 lhzux 31 d a b 311 0 lhzx 31 d a b 279 0 lswi 3 31 d a nb 597 0 lswx 3 31 d a b 533 0 lwarx 31 d a b 20 0 lwaux 1 31 d a b 373 0 lwax 1 31 d a b 341 0 lwbrx 31 d a b 534 0 lwzux 31 d a b 55 0 lwzx 31 d a b 23 0 mcrfs 63 crfd 0 0 crfs 0 0 0 0 0 0 0 64 0 mcrxr 31 crfd 0 0 0 0 0 0 0 0 0 0 0 0 512 0 mfcr 31 d 0 0 0 0 0 0 0 0 0 0 19 0 mffs x 63 d 0 0 0 0 0 0 0 0 0 0 583 rc table a-36. x-form (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-30 g2 powerpc core reference manual motorola instructions sorted by form mfmsr 2 31 d 0 0 0 0 0 0 0 0 0 0 83 0 mfsr 2 31 d 0sr 0 0 0 0 0 595 0 mfsrin 2 31 d 0 0 0 0 0 b 659 0 mtfsb0 x 63 crbd 0 0 0 0 0 0 0 0 0 0 70 rc mtfsb1 x 63 crfd 0 0 0 0 0 0 0 0 0 0 38 rc mtfsfi x 63 crbd 0 0 0 0 0 0 0 imm 0134rc mtmsr 2 31 s 0 0 0 0 0 0 0 0 0 0 146 0 mtsr 2 31 s 0sr 0 0 0 0 0 210 0 mtsrin 2 31 s 0 0 0 0 0 b 242 0 nand x 31 s a b 476 rc nor x 31 s a b 124 rc or x 31 s a b 444 rc orc x 31 s a b 412 rc slbia 1, 2, 4 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 498 0 slbie 1, 2, 4 31 0 0 0 0 0 0 0 0 0 0 b 434 0 sld x 1 31 s a b 27 rc slw x 31 s a b 24 rc srad x 1 31 s a b 794 rc sraw x 31 s a b 792 rc srawi x 31 s a sh 824 rc srd x 1 31 s a b 539 rc srw x 31 s a b 536 rc stbux 31 s a b 247 0 stbx 31 s a b 215 0 stdcx. 1 31 s a b 214 1 stdux 1 31 s a b 181 0 stdx 1 31 s a b 149 0 stfdux 31 s a b 759 0 stfdx 31 s a b 727 0 stfiwx 4 31 s a b 983 0 stfsux 31 s a b 695 0 stfsx 31 s a b 663 0 sthbrx 31 s a b 918 0 sthux 31 s a b 439 0 sthx 31 s a b 407 0 stswi 3 31 s a nb 725 0 table a-36. x-form (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-31 instructions sorted by form stswx 3 31 s a b 661 0 stwbrx 31 s a b 662 0 stwcx. 31 s a b 150 1 stwux 31 s a b 183 0 stwx 31 s a b 151 0 sync 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 598 0 td 1 31 to a b 68 0 tlbia 2, 4 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 370 0 tlbie 2, 4 31 0 0 0 0 0 0 0 0 0 0 b 306 0 tlbld 2, 5 31 0 0 0 0 0 0 0 0 0 0 b 978 0 tlbli 2, 5 31 0 0 0 0 0 0 0 0 0 0 b 1010 0 tlbsync 2, 4 31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 566 0 tw 31 to a b 4 0 xor x 31 s a b 316 rc 1 64-bit instruction 2 supervisor- and user-level instruction 3 load and store string or multiple instruction 4 optional in the powerpc architecture 5 g2 core implementation-specific instruction table a-37. xl-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd bo bi 0 0 0 0 0 xo lk opcd crbd crba crbb xo 0 opcd crfd 0 0 crfs 0 0 0 0 0 0 0 xo 0 opcd 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 xo 0 specific instructions bcctr x 19 bo bi 0 0 0 0 0 528 lk bclr x 19 bo bi 0 0 0 0 0 16 lk crand 19 crbd crba crbb 257 0 crandc 19 crbd crba crbb 129 0 creqv 19 crbd crba crbb 289 0 crnand 19 crbd crba crbb 225 0 crnor 19 crbd crba crbb 33 0 cror 19 crbd crba crbb 449 0 crorc 19 crbd crba crbb 417 0 table a-36. x-form (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-32 g2 powerpc core reference manual motorola instructions sorted by form crxor 19 crbd crba crbb 193 0 isync 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 150 0 mcrf 19 crfd 0 0 crfs 0 0 0 0 0 0 0 0 0 rfi 1 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 50 0 1 supervisor-level instruction table a-38. xfx-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd d spr xo 0 opcd d 0 crm 0xo 0 opcd s spr xo 0 opcd d tbr xo 0 specific instructions mfspr 1 1 supervisor- and user-level instruction 31 d spr 339 0 mftb 31 d tbr 371 0 mtcrf 31 s 0 crm 0144 0 mtspr 1 31 d spr 467 0 table a-39. xfl-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd 0fm 0b xo rc specific instructions mtfsf x 63 0fm 0b 711 rc table a-40. xs-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd s a sh xo sh rc specific instructions sradi x 1 1 64-bit instruction 31 s a sh 413 sh rc table a-37. xl-form (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-33 instructions sorted by form table a-41. xo-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd d a b oe xo rc opcd d a b 0xorc opcd d a 0 0 0 0 0 oe xo rc specific instructions add x 31 d a b oe 266 rc addc x 31 d a b oe 10 rc adde x 31 d a b oe 138 rc addme x 31 d a 0 0 0 0 0 oe 234 rc addze x 31 d a 0 0 0 0 0 oe 202 rc divd x 1 1 64-bit instruction 31 d a b oe 489 rc divdu x 1 31 d a b oe 457 rc divw x 31 d a b oe 491 rc divwu x 31 d a b oe 459 rc mulhd x 1 31 d a b 0 73 rc mulhdu x 1 31 d a b 0 9 rc mulhw x 31 d a b 075rc mulhwu x 31 d a b 011rc mulld x 1 31 d a b oe 233 rc mullw x 31 d a b oe 235 rc neg x 31 d a 0 0 0 0 0 oe 104 rc subf x 31 d a b oe 40 rc subfc x 31 d a b oe 8 rc subfe x 31 d a b oe 136 rc subfme x 31 d a 0 0 0 0 0 oe 232 rc subfze x 31 d a 0 0 0 0 0 oe 200 rc table a-42. a-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd d a b 0 0 0 0 0 xo rc opcd d a b c xo rc opcd d a 0 0 0 0 0 c xo rc opcd d 0 0 0 0 0 b 0 0 0 0 0 xo rc f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-34 g2 powerpc core reference manual motorola instructions sorted by form specific instructions fadd x 63 d a b 0 0 0 0 0 21 rc fadds x 59 d a b 0 0 0 0 0 21 rc fdiv x 63 d a b 0 0 0 0 0 18 rc fdivs x 59 d a b 0 0 0 0 0 18 rc fmadd x 63 d a b c 29 rc fmadds x 59 d a b c 29 rc fmsub x 63 d a b c 28 rc fmsubs x 59 d a b c 28 rc fmul x 63 d a 0 0 0 0 0 c 25 rc fmuls x 59 d a 0 0 0 0 0 c 25 rc fnmadd x 63 d a b c 31 rc fnmadds x 59 d a b c 31 rc fnmsub x 63 d a b c 30 rc fnmsubs x 59 d a b c 30 rc fres x 1 59 d 0 0 0 0 0 b 0 0 0 0 0 24 rc frsqrte x 1 63 d 0 0 0 0 0 b 0 0 0 0 0 26 rc fsel x 1 63 d a b c 23 rc fsqrt x 1 63 d 0 0 0 0 0 b 0 0 0 0 0 22 rc fsqrts x 1 59 d 0 0 0 0 0 b 0 0 0 0 0 22 rc fsub x 63 d a b 0 0 0 0 0 20 rc fsubs x 59 d a b 0 0 0 0 0 20 rc 1 optional in the powerpc architecture table a-43. m-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd s a sh mb me rc opcd s a b mb me rc specific instructions rlwimi x 20 s a sh mb me rc rlwinm x 21 s a sh mb me rc rlwnm x 23 s a b mb me rc table a-42. a-form (continued) name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-35 instructions sorted by form table a-44. md-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd s a sh mb xo sh rc opcd s a sh me xo sh rc specific instructions ridicx 1 1 64-bit instruction 30 s a sh mb 2 sh rc rldicl x 1 30 s a sh mb 0 sh rc rldicr x 1 30 s a sh me 1 sh rc rldimi x 1 30 s a sh mb 3 sh rc table a-45. mds-form name 0 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 opcd s a b mb xo rc opcd s a b me xo rc specific instructions rldcl x 1 1 64-bit instruction 30 s a b mb 8 rc rldcr x 1 30 s a b me 9 rc f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-36 g2 powerpc core reference manual motorola instruction set legend a.5 instruction set legend table a-46 provides general information on the powerpc instruction set (such as the architectural level, privilege level, and form). table a-46. powerpc instruction set legend uisa vea oea supervisor level optional 64-bit form add x xo addc x xo adde x xo addi d addic d addic. d addis d addme x xo addze x xo and x x andc x x andi. d andis. d b x i bc x b bcctr x xl bclr x xl cmp x cmpi d cmpl x cmpli d cntlzd x 1 x cntlzw x x crand xl crandc xl creqv xl crnand xl crnor xl cror xl crorc xl crxor xl f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-37 instruction set legend dcbf x dcbi 2 ? x dcbst x dcbt x dcbtst x dcbz x divd x 1 xo divdu x 1 xo divw x xo divwu x xo eciwx ? x ecowx ? x eieio x eqv x x extsb x x extsh x x extsw x 1 x fabs x x fadd x a fadds x a fcfid x 1 x fcmpo x fcmpu x fctid x 1 x fctidz x 1 x fctiw x x fctiwz x x fdiv x a fdivs x a fmadd x a fmadds x a fmr x x fmsub x a fmsubs x a fmul x a table a-46. powerpc instruction set legend (continued) uisa vea oea supervisor level optional 64-bit form f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-38 g2 powerpc core reference manual motorola instruction set legend fmuls x a fnabs x x fneg x x fnmadd x a fnmadds x a fnmsub x a fnmsubs x a fres x 3 ? a frsp x x frsqrte x 3 ? a fsel x 3 ? a fsqrt x 3 a fsqrts x 3 a fsub x a fsubs x a icbi x isync xl lbz d lbzu d lbzux x lbzx x ld 1 ds ldarx 1 x ldu 1 ds ldux 1 x ldx 1 x lfd d lfdu d lfdux x lfdx x lfs d lfsu d lfsux x lfsx x lha d table a-46. powerpc instruction set legend (continued) uisa vea oea supervisor level optional 64-bit form f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-39 instruction set legend lhau d lhaux x lhax x lhbrx x lhz d lhzu d lhzux x lhzx x lmw 4 d lswi 4 x lswx 4 x lwa 1 ds lwarx x lwaux 1 x lwax 1 x lwbrx x lwz d lwzu d lwzux x lwzx x mcrf xl mcrfs x mcrxr x mfcr x mffs x x mfmsr 2 ? x mfspr 5 ?? xfx mfsr 2 ? x mfsrin 2 ? x mftb xfx mtcrf xfx mtfsb0 x x mtfsb1 x x mtfsf x xfl mtfsfi x x table a-46. powerpc instruction set legend (continued) uisa vea oea supervisor level optional 64-bit form f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-40 g2 powerpc core reference manual motorola instruction set legend mtmsr 2 ? x mtspr 5 ?? xfx mtsr 2 ? x mtsrin 2 ? x mulhd x 1 xo mulhdu x 1 xo mulhw x xo mulhwu x xo mulld x 1 xo mulli d mullw x xo nand x x neg x xo nor x x or x x orc x x ori d oris d rfi 2 ? xl rldcl x 1 mds rldcr x 1 mds rldic x 1 md rldicl x 1 md rldicr x 1 md rldimi x 1 md rlwimi x m rlwinm x m rlwnm x m sc ? sc slbia 1, 2, 3 x slbie 1, 2, 3 x sld x 1 x slw x x srad x 1 x sradi x 1 xs table a-46. powerpc instruction set legend (continued) uisa vea oea supervisor level optional 64-bit form f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix a. powerpc instruction set listings a-41 instruction set legend sraw x x srawi x x srd x 1 x srw x x stb d stbu d stbux x stbx x std 1 ds stdcx. 1 x stdu 1 ds stdux 1 x stdx 1 x stfd d stfdu d stfdux x stfdx x stfiwx 3 ? x stfs d stfsu d stfsux x stfsx x sth d sthbrx x sthu d sthux x sthx x stmw 4 d stswi 4 x stswx 4 x stw d stwbrx x stwcx. x stwu d stwux x table a-46. powerpc instruction set legend (continued) uisa vea oea supervisor level optional 64-bit form f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . a-42 g2 powerpc core reference manual motorola instruction set legend stwx x subf x xo subfc x xo subfe x xo subfic d subfme x xo subfze x xo sync x td 1 x tdi 1 d tlbia 2, 3 x tlbie 2, 3 ? x tlbld 2, 6 x tlbli 2, 6 x tlbsync 2, 3 ? x tw x twi d xor x x xori d xoris d 1 64-bit instruction 2 supervisor-level instruction 3 optional in the powerpc architecture 4 load and store string or multiple instruction 5 supervisor- and user-level instruction 6 g2 core implementation-specific instruction table a-46. powerpc instruction set legend (continued) uisa vea oea supervisor level optional 64-bit form f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix b. revision history b-1 appendix b revision history this appendix provides a list of the major differences between the g2 powerpc core reference manual , revision 0 and the g2 powerpc core reference manual , revision 1. b.1 revision changes from revision 0 to revision 1 major changes to the g2 powerpc core reference manual from revision 0 to revision 1 are as follows: section, page changes book added trademark information for powerpc. added tab pages, glossary, appendix b, and index. xxv under the heading ?organization,? in the first bullet, replace the statement in parenthesis in the second sentence with the following: (including instruction and data cache way-locking for the g2 core) 1.3.3.3, 1-26 cache way-locking is a feature of both the g2 core and the g2_le. remove ?g2_le-only? from the heading and replace the paragraph with the following: the g2 core implements instruction and data cache way-locking, which guarantees that certain memory accesses will hit in the cache. this provides deterministic access times for those accesses. see chapter 4, ?instruction and data cache operation,? for more information. 1.4, 1-40 in table 1-6, ?differences between g2 and g2_le cores,? replace the rows on cache locking with the following: supports instruction cache way-locking in addition to entire instruction cache locking hid2 register controls instruction cache way-locking. the instruction cache way-locking is useful for locking blocks of instructions into the instruction cache for time-critical applications that require deterministic behavior. supports data cache way-locking in addition to entire data cache locking hid2 register controls data cache way-locking. it is useful for locking blocks of data into the data cache for time-critical applications where deterministic behavior is required. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . b-2 g2 powerpc core reference manual motorola revision changes from revision 0 to revision 1 2.1.2.1, 2-11 in table 2-5 ,?hid0 bit functions,? replace the description of bit 1 with the following: 2.1.2.3, 2-14 replace the first sentence of the first paragraph with the following: the g2 core implements an additional hardware implementation-dependent hid2 register, shown in figure 2-4, which enables cache way-locking; the g2_le core also enables true little-endian mode and the new additional bat registers. 2.1.2.3, 2-15 replace figure 2-4,?hardware implementation-dependent register 2 (hid2)? with the following: 2.1.2.3, 2-15 in table 2-8, ?hid2 bit descriptions,? replace the description of bit 15 with the following: chapter 4, 4-1 replace the last sentence of the second paragraph with the following: it also describes the cache way-locking features provided in the g2 core. 4.2.3.3, 4-5 replace the second paragraph with the following: note that the g2 core also provides instruction cache way-locking in addition to entire instruction cache locking as described in section 4.12, ?cache locking.? 4.3.3.3, 4-7 replace the second paragraph with the following: note that the g2 core also provides instruction cache way-locking in addition to entire data cache locking as described in section 4.12, ?cache locking.? 4.5.2, 4-10 in figure 4-3, ?double-word address ordering? critical-double-word-first,? remove ?g2_le core cache address? from the first heading and replace it with the ?g2 core cache address.? 1? reserved 15 ? reserved 31 27 26 24 23 19 18 14 13 12 4 0 iwlck[0?2] 0 0 00000 000 hbe dwlck[0?2] 000 0000 0 3 5 00 let 15 0 0 0 16 reserved 00 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola appendix b. revision history b-3 revision changes from revision 0 to revision 1 4.12, 4-32 replace the first paragraph with the following: this section describes the entire cache locking and cache way-locking features of the g2 core. 4.12.1, 4-32 the title of the second bullet should be: ?way-locking.? 4.12.2, 4-33 the title of table 4-11 should read, ?hid2 bits used to perform cache way-locking.? 4.12.3.1, 4-34 replace the first paragraph with the following: this section describes the procedures for performing data cache locking on the g2 core. 4.12.3.1.3, 4-35 in table 4-14, ?msr bits for disabling exceptions,? replace the description of bit 24 with the following: 4.12.3.1.7, 4-37 replace the first paragraph with the following: data cache way-locking is controlled by hid2[dwlck], bits 24?26. table 4-15 shows the hid2[dwlck[0?2]] settings for the g2 core embedded processor. 4.12.3.1.7, 4-37 the title of table 4-15 should read, ?g2 core dwlck[0?2] encodings.? replace the paragraph after table 4-15 with the following: the following assembly code locks way 0 of the g2 core data cache: 4.12.3.2, 4-38 replace the first paragraph with the following: this section describes the procedures for performing instruction cache locking on the g2 core. 4.12.3.2.3, 4-40 in table 4-17, ?msr bits for disabling exceptions,? replace the description of bit 24 with the following: 4.12.3.2.6, 4-42 remove ?(g2_le only)? from the heading and replace the first paragraph with the following: instruction cache way-locking is controlled by the hid2[iwlck], bits 16?18. table 4-18 shows the hid2[iwlck[0?2]] settings for the g2 core embedded processor. 4.12.3.2.6, 4-42 the title of table 4-18 should read, ?g2 core iwlck[0?2] encodings.? replace the paragraph after table 4-18 with the following: 24 ce critical interrupt enable 24 ce critical interrupt enable f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . b-4 g2 powerpc core reference manual motorola revision changes from revision 0 to revision 1 the following assembly code locks way 0 of the g2 core instruction cache: 4.12.3.2.7, 4-42 replace the last paragraph with the following: in the second method, the instruction cache block invalidate ( icbi) instruction can be used to invalidate individual cache blocks. the icbi instruction invalidates blocks in an entirely locked instruction cache. the icbi instruction also may invalidate way-locked blocks within the instruction cache. 6.5.2.2.2, 6-43 replace the third line, ? bdnzf 0, im1,? of function ?im1,? with the following: bdnzf eq, im1 replace the fourteenth line, ? srw r1, r1, 8,? of function ?im1,? with the following: srwi r1, r1, 8 8.3.15.3, 8-55 replace ?timing comments,? with the following: assertion/negation?must remain stable during operation; should only be changed during the assertion of core_hreset or during sleep mode. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola glossary of terms and abbreviations glossary-1 glossary of terms and abbreviations the glossary contains an alphabetical list of terms, phrases, and abbreviations used in this book. some of the terms and definitions included in the glossary are reprinted from ieee standard 754-1985, ieee standard for binary floating-point arithmetic , copyright ?1985 by the institute of electrical and electronics engineers, inc. with the permission of the ieee. a architecture. a detailed specification of requirements for a processor or computer system. it does not specify details of how the processor or computer system must be implemented; instead it provides a template for a family of compatible implementations . asynchronous exception. exceptions that are caused by events external to the processor?s execution. in this document, the term asynchronous exception is used interchangeably with the word interrupt . atomic access. a bus access that attempts to be part of a read-write operation to the same address uninterrupted by any other access to that address (the term refers to the fact that the transactions are indivisible). the powerpc architecture implements atomic accesses through the lwarx / stwcx. instruction pair. b bat (block address translation) mechanism. a software-controlled array that stores the available block address translations on-chip. beat. a single state on the g2 bus interface that may extend across multiple bus cycles. a g2 transaction can be composed of multiple address or data beats . biased exponent. an exponent whose range of values is shifted by a constant (bias). typically a bias is provided to allow a range of positive values to express a range that includes both positive and negative values. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . glossary-2 g2 powerpc core reference manual motorola big-endian. a byte-ordering method in memory where the address n of a word corresponds to the most-significant byte . in an addressed memory word, the bytes are ordered (left to right) 0, 1, 2, 3, with 0 being the most-significant byte . see little-endian . block. an area of memory that ranges from 128 kbytes to 256 mbytes whose size, translation, and protection attributes are controlled by the bat mechanism. boundedly undefined. a characteristic of certain operation results that are not rigidly prescribed by the powerpc architecture. boundedly- undefined results for a given operation may vary among implementations and between execution attempts in the same implementation. although the architecture does not prescribe the exact behavior for when results are allowed to be boundedly undefined , the results of executing instructions in contexts where results are allowed to be boundedly undefined are constrained to ones that could have been achieved by executing an arbitrary sequence of defined instructions, in valid form, starting in the state the machine was in before attempting to execute the given instruction. branch folding. the replacement with target instructions of a branch instruction and any instructions along the not-taken path when a branch is either taken or predicted as taken. branch prediction. the process of guessing whether a branch will be taken. such predictions can be correct or incorrect; the term ?predicted? as it is used here does not imply that the prediction is correct (successful). the powerpc architecture defines a means for static branch prediction as part of the instruction encoding. branch resolution. the determination of whether a branch is taken or not taken. a branch is said to be resolved when the processor can determine which instruction path to take. if the branch is resolved as predicted, the instructions following the predicted branch that may have been speculatively executed can complete (see completion ). if the branch is not resolved as predicted, instructions on the mispredicted path, and any results of speculative execution, are purged from the pipeline and fetching continues from the nonpredicted path. burst. a multiple-beat data transfer whose total size is typically equal to a cache block. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola glossary of terms and abbreviations glossary-3 bus clock. clock that causes the bus state transitions. bus master. the owner of the address or data bus; the device that initiates or requests the transaction. c cache. high-speed memory containing recently accessed data or instructions (subset of main memory). cache block. a small region of contiguous memory that is copied from memory into a cache . the size of a cache block may vary among processors; the maximum block size is one page . in powerpc processors, cache coherency is maintained on a cache-block basis. note that the term cache block is often used interchangeably with ?cache line.? cache coherency. an attribute wherein an accurate and common view of memory is provided to all devices that share the same memory system. caches are coherent if a processor performing a read from its cache is supplied with data corresponding to the most recent value written to memory or to another processor?s cache. cache flush. an operation that removes from a cache any data from a specified address range. this operation ensures that any modified data within the specified address range is written back to main memory. this operation is generated typically by a data cache block flush ( dcbf ) instruction. caching-inhibited. a memory update policy in which the cache is bypassed and the load or store is performed to or from main memory. cast out. a cache block that must be written to memory when a cache miss causes a cache block to be replaced. changed bit. one of two page history bits found in each page table entry (pte). the processor sets the changed bit if any store is performed into the page . see also page access history bits and referenced bit . clean. an operation that causes a cache block to be written to memory, if modified, and then left in a valid, unmodified state in the cache. clear. to cause a bit or bit field to register a value of zero. see also set . completion. completion occurs when an instruction has finished executing, written back any results, and is removed from the completion queue (cq). when an instruction completes, it is guaranteed that this instruction and all previous instructions can cause no exceptions. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . glossary-4 g2 powerpc core reference manual motorola context synchronization. an operation that ensures that all instructions in execution complete past the point where they can produce an exception , that all instructions in execution complete in the context in which they began execution, and that all subsequent instructions are fetched and executed in the new context. context synchronization may result from executing specific instructions (such as isync or rfi ) or when certain events occur (such as an exception ). copy-back operation. a cache operation in which a cache line is copied back to memory to enforce cache coherency. copy-back operations consist of snoop push-out operations and cache cast-out operations. d denormalized number. a nonzero floating-point number whose exponent has a reserved value, usually the format's minimum, and whose explicit or implicit leading significand bit is zero. direct-mapped cache. a cache in which each main memory address can appear in only one location within the cache, operates more quickly when the memory request is a cache hit. direct-store segment access. an access to an i/o address space. the g2 defines separate memory-mapped and i/o address spaces, or segments, distinguished by the corresponding segment register t bit in the address translation logic of the g2. if the t bit is cleared, the memory reference is a normal memory-mapped access and can use the virtual memory management hardware of the g2. if the t bit is set, the memory reference is a direct-store access. e effective address (ea). the 32-bit address specified for a load, store, or an instruction fetch. this address is then submitted to the mmu for translation to either a physical memory address or an i/o address. exception. a condition encountered by the processor that requires special, supervisor-level processing. exception handler. a software routine that executes when an exception is taken. normally, the exception handler corrects the condition that caused the exception, or performs some other meaningful task (that may include aborting the program that caused the exception). the address for each exception handler is identified by an exception vector offset defined by the architecture and a prefix selected via the msr. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola glossary of terms and abbreviations glossary-5 exclusive state. mei state (e) in which only one caching device contains data that is also in system memory. execution synchronization. a mechanism by which all instructions in execution are architecturally complete before beginning execution (appearing to begin execution) of the next instruction. similar to context synchronization but doesn't force the contents of the instruction buffers to be deleted and refetched. exponent. in the binary representation of a floating-point number, the exponent is the component that normally signifies the integer power to which the value two is raised in determining the value of the represented number. see also biased exponent . f fall-through (branch fall-through). a not-taken branch. on the g2 core, fall-through branch instructions are removed from the instruction stream at dispatch. that is, these instructions are allowed to fall through the instruction queue through the dispatch mechanism, without either being passed to an execution unit and or given a position in the cq. feed-forwarding. a g2 feature that reduces the number of clock cycles that an execution unit must wait to use a register. when the source register of the current instruction is the same as the destination register of the previous instruction, the result of the previous instruction is routed to the current instruction at the same time that it is written to the register file. with feed-forwarding, the destination bus is gated to the waiting execution unit over the appropriate source bus, saving the cycles which would be used for the write and read. fetch. retrieving instructions from either the cache or main memory and placing them into the instruction queue. finish. finishing occurs in the last cycle of execution. in this cycle, the cq entry is updated to indicate that the instruction has finished executing. floating-point register (fpr). any of the 32 registers in the floating-point register file. these registers provide the source operands and destination results for floating-point instructions. load instructions move data from memory to fprs and store instructions move data from fprs to memory. the fprs are 64 bits wide and store floating-point values in double-precision format. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . glossary-6 g2 powerpc core reference manual motorola floating-point unit. the functional unit in the g2 processor responsible for executing all floating-point instructions. flush. an operation that causes a cache block to be invalidated and the data, if modified, to be written to memory. folding. see branch folding . fraction. in the binary representation of a floating-point number, the field of the significand that lies to the right of its implied binary point. g general-purpose register (gpr). any of the 32 registers in the general-purpose register file. these registers provide the source operands and destination results for all integer data manipulation instructions. integer load instructions move data from memory to gprs and store instructions move data from gprs to memory. guarded. the guarded attribute pertains to out-of-order execution. when a page is designated as guarded, instructions and data cannot be accessed out-of-order. h harvard architecture. an architectural model featuring separate caches and other memory management resources for instructions and data. hashing. an algorithm used in the page table search process. i ieee 754. a standard written by the institute of electrical and electronics engineers that defines operations and representations of binary floating-point numbers. illegal instructions. a class of instructions that are not implemented for a particular powerpc processor. these include instructions not defined by the powerpc architecture. in addition, for 32-bit implementations, instructions that are defined only for 64-bit implementations are considered to be illegal instructions. for 64-bit implementations instructions that are defined only for 32-bit implementations are considered to be illegal instructions. implementation. a particular processor that conforms to the powerpc architecture, but may differ from other architecture-compliant implementations for example in design, feature set, and implementation of optional features. the powerpc architecture has many different implementations. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola glossary of terms and abbreviations glossary-7 imprecise exception. a type of synchronous exception that is allowed not to adhere to the precise exception model (see precise exception ). the powerpc architecture allows only floating-point exceptions to be handled imprecisely. instruction queue. a holding place for instructions fetched from the current instruction stream. integer unit. the functional unit in the g2 responsible for executing all integer instructions. in-order. an aspect of an operation that adheres to a sequential model. an operation is said to be performed in-order if, at the time that it is performed, it is known to be required by the sequential execution model. see out-of-order . instruction latency. the total number of clock cycles necessary to execute an instruction and make ready the results of that instruction. interrupt. an external signal that causes the g2 to suspend current execution and take a predefined exception. k key bits. a set of key bits referred to as ks and kp in each segment register and each bat register. the key bits determine whether supervisor or user programs can access a page within that segment or block . kill. an operation that causes a cache block to be invalidated without writing any modified data to memory. l latency. the number of clock cycles necessary to execute an instruction and make ready the results of that execution for a subsequent instruction. l2 cache. see secondary cache . least-significant bit (lsb). the bit of least value in an address, register, field, data element, or instruction encoding. least-significant byte (lsb). the byte of least value in an address, register, data element, or instruction encoding. little-endian. a byte-ordering method in memory where the address n of a word corresponds to the least-significant byte . in an addressed memory word, the bytes are ordered (left to right) 3, 2, 1, 0, with 3 being the most-significant byte . see big-endian . f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . glossary-8 g2 powerpc core reference manual motorola m mantissa. the decimal part of logarithm. mei (modified/exclusive/invalid). cache coherency protocol used to manage caches on different devices that share a memory system. note that the powerpc architecture does not specify the implementation of a mei protocol to ensure cache coherency. memory access ordering. the specific order in which the processor performs load and store memory accesses and the order in which those accesses complete. memory-mapped accesses. accesses whose addresses use the page or block address translation mechanisms provided by the mmu and that occur externally with the bus protocol defined for memory. memory coherency. an aspect of caching in which it is ensured that an accurate view of memory is provided to all devices that share system memory. memory consistency. refers to agreement of levels of memory with respect to a single processor and system memory (for example, on-chip cache, secondary cache, and system memory). memory management unit (mmu). the functional unit that is capable of translating an effective (logical) address to a physical address, providing protection mechanisms, and defining caching methods. modified state. mei state (m) in which one, and only one, caching device has the valid data for that address. the data at this address in external memory is not valid. most-significant bit (msb). the highest-order bit in an address, registers, data element, or instruction encoding. most-significant byte (msb). the highest-order byte in an address, registers, data element, or instruction encoding. n nan. an abbreviation for not a number; a symbolic entity encoded in floating-point format. there are two types of nans?signaling nans and quiet nans. no-op. no-operation. a single-cycle operation that does not affect registers or generate bus activity. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola glossary of terms and abbreviations glossary-9 normalization. a process by which a floating-point value is manipulated such that it can be represented in the format for the appropriate precision (single- or double-precision). for a floating-point value to be representable in the single- or double-precision format, the leading implied bit must be a 1. o oea (operating environment architecture). the level of the architecture that describes powerpc memory management model, supervisor-level registers, synchronization requirements, and the exception model. it also defines the time-base feature from a supervisor-level perspective. implementations that conform to the powerpc oea also conform to the powerpc uisa and vea. optional. a feature, such as an instruction, a register, or an exception, that is defined by the powerpc architecture but not required to be implemented. out-of-order. an aspect of an operation that allows it to be performed ahead of one that may have preceded it in the sequential model, for example, speculative operations. an operation is said to be performed out-of-order if, at the time that it is performed, it is not known to be required by the sequential execution model. see in-order . out-of-order execution. a technique that allows instructions to be issued and completed in an order that differs from their sequence in the instruction stream. overflow. an condition that occurs during arithmetic operations when the result cannot be stored accurately in the destination register(s). for example, if two 32-bit numbers are multiplied, the result may not be representable in 32 bits. since the 32-bit registers of the g2 cannot represent this sum, an overflow condition occurs. p page. a region in memory. the oea defines a page as a 4-kbyte area of memory, aligned on a 4-kbyte boundary. page access history bits. the changed and referenced bits in the pte keep track of the access history within the page. the referenced bit is set by the mmu whenever the page is accessed for a read or write operation. the changed bit is set when the page is stored into. see changed bit and referenced bit . f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . glossary-10 g2 powerpc core reference manual motorola page fault. a page fault is a condition that occurs when the processor attempts to access a memory location that does not reside within a page not currently resident in physical memory . on powerpc processors, a page fault exception condition occurs when a matching, valid page table entry (pte[v] = 1) cannot be located. page table. a table in memory is comprised of page table entries , or ptes. it is further organized into eight ptes per pteg (page table entry group). the number of ptegs in the page table depends on the size of the page table (as specified in the sdr1 register). page table entry (pte). data structures containing information used to translate effective address to physical address on a 4-kbyte page basis. a pte consists of 8 bytes of information in a 32-bit processor and 16 bytes of information in a 64-bit processor. park. the act of allowing a bus master to maintain bus mastership without having to arbitrate. physical memory. the actual memory that can be accessed through the system?s memory bus. pipelining. a technique that breaks operations, such as instruction processing or bus transactions, into smaller distinct stages or tenures (respectively) so that a subsequent operation can begin before the previous one has completed. precise exceptions. a category of exception for which the pipeline can be stopped so instructions that preceded the faulting instruction can complete and subsequent instructions can be flushed and redispatched after exception handling has completed. see imprecise exceptions . primary opcode. the most-significant 6 bits (bits 0?5) of the instruction encoding that identifies the type of instruction. program order. the order of instructions in an executing program. more specifically, this term is used to refer to the original order in which program instructions are fetched into the instruction queue from the cache. protection boundary. a boundary between protection domains . protection domain. a protection domain is a segment, a virtual page, a bat area, or a range of unmapped effective addresses. it is defined only when the appropriate relocate bit in the msr (ir or dr) is 1. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola glossary of terms and abbreviations glossary-11 q quiesce. to come to rest. the processor is said to quiesce when an exception is taken or a sync instruction is executed. the instruction stream is stopped at the decode stage and executing instructions are allowed to complete to create a controlled context for instructions that may be affected by out-of-order, parallel execution. see context synchronization . quiet nan. a type of nan that can propagate through most arithmetic operations without signaling exceptions. a quiet nan is used to represent the results of certain invalid operations, such as invalid arithmetic operations on infinities or on nans, when invalid. see signaling nan . r ra. the r a instruction field is used to specify a gpr to be used as a source or destination. rb. the r b instruction field is used to specify a gpr to be used as a source. rd. the r d instruction field is used to specify a gpr to be used as a destination. rs. the r s instruction field is used to specify a gpr to be used as a source. real address mode. an mmu mode when no address translation is performed and the effective address specified is the same as the physical address. the processor?s mmu is operating in real address mode if its ability to perform address translation has been disabled through the msr registers ir and/or dr bits. record bit. bit 31 (or the rc bit) in the instruction encoding. when it is set, updates the condition register (cr) to reflect the result of the operation. referenced bit. one of two page history bits found in each page table entry . the processor sets the referenced bit whenever the page is accessed for a read or write. see also page access history bits . register indirect addressing. a form of addressing that specifies one gpr that contains the address for the load or store. register indirect with immediate index addressing. a form of addressing that specifies an immediate value to be added to the contents of a specified gpr to form the target address for the load or store. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . glossary-12 g2 powerpc core reference manual motorola register indirect with index addressing. a form of addressing that specifies that the contents of two gprs be added together to yield the target address for the load or store. rename register. temporary buffers used by instructions that have finished execution but have not completed. reservation. the processor establishes a reservation on a cache block of memory space when it executes an lwarx instruction to read a memory semaphore into a gpr. reservation station. a buffer between the dispatch and execute stages that allows instructions to be dispatched even though the results of instructions on which the dispatched instruction may depend are not available. retirement. removal of the completed instruction from the cq. risc (reduced instruction set computing). an architecture characterized by fixed-length instructions with nonoverlapping functionality and by a separate set of load and store instructions that perform memory accesses. s scan interface. the g2 test interface. secondary cache. a cache memory that is typically larger and has a longer access time than the primary cache. a secondary cache may be shared by multiple devices. also referred to as l2, or level-2, cache. set ( v ) . to write a nonzero value to a bit or bit field; the opposite of clear . the term ?set? may also be used to generally describe the updating of a bit or bit field. set ( n ) . a subdivision of a cache . cacheable data can be stored in a given location in one of the sets, typically corresponding to its lower-order address bits. because several memory locations can map to the same location, cached data is typically placed in the set whose cache block corresponding to that address was used least recently. see set-associative . set-associative. aspect of cache organization in which the cache space is divided into sections, called sets . the cache controller associates a particular main memory address with the contents of a particular set, or region, within the cache. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola glossary of terms and abbreviations glossary-13 shadowing. shadowing allows a register to be updated by instructions that are executed out of order without destroying machine state information. signaling nan. a type of nan that generates an invalid operation program exception when it is specified as arithmetic operands. see quiet nan . significand. the component of a binary floating-point number that consists of an explicit or implicit leading bit to the left of its implied binary point and a fraction field to the right. simplified mnemonics. assembler mnemonics that represent a more complex form of a common operation. slave. the device addressed by a master device. the slave is identified in the address tenure and is responsible for supplying or latching the requested data for the master during the data tenure. snooping. monitoring addresses driven by a bus master to detect the need for coherency actions. snoop push. response to a snooped transaction that hits a modified cache block. the cache block is written to memory and made available to the snooping device. split - transaction. a transaction with independent request and response tenures. split-transaction bus. a bus that allows address and data transactions from different processors to occur independently. stage. the term stage is used in two different senses, depending on whether the pipeline is being discussed as a physical entity or a sequence of events. in the latter case, a stage is an element in the pipeline during which certain actions are performed, such as decoding the instruction, performing an arithmetic operation, or writing back the results. typically, the latency of a stage is one processor clock cycle. some events, such as dispatch, write-back, and completion, happen instantaneously and may be thought to occur at the end of a stage. an instruction can spend multiple cycles in one stage. an integer multiply, for example, takes multiple cycles in the execute stage. when this occurs, subsequent instructions may stall. an instruction may also occupy more than one stage simultaneously, especially in the sense that a stage can be seen as a physical resource?for example, when instructions are dispatched they are assigned a place f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . glossary-14 g2 powerpc core reference manual motorola in the cq at the same time they are passed to the execute stage. they can be said to occupy both the complete and execute stages in the same clock cycle. stall. an occurrence when an instruction cannot proceed to the next stage. static branch prediction. mechanism by which software (for example, compilers) can hint to the machine hardware about the direction a branch is likely to take. store queue. holds store operations that have not been committed to memory, resulting from completed or retired instructions. superscalar. a superscalar processor is one that can dispatch multiple instructions concurrently from a conventional linear instruction stream. in a superscalar implementation, multiple instructions can be in the same stage at the same time. supervisor mode. the privileged operation state of a processor. in supervisor mode, software, typically the operating system, can access all control registers and can access the supervisor memory space, among other privileged operations. synchronization. a process to ensure that operations occur strictly in order . see context synchronization and execution synchronization . synchronous exception. an exception that is generated by the execution of a particular instruction or instruction sequence. there are two types of synchronous exceptions, precise and imprecise . system memory. the physical memory available to a processor. t tenure. the period of bus mastership. for the g2, there can be separate address bus tenures and data bus tenures. a tenure consists of three phases: arbitration, transfer, and termination. tlb (translation lookaside buffer). a cache that holds recently-used page table entries . throughput. the measure of the number of instructions that are processed per clock cycle. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola glossary of terms and abbreviations glossary-15 transaction. a complete exchange between two bus devices. a transaction is typically comprised of an address tenure and one or more data tenures, which may overlap or occur separately from the address tenure. a transaction may be minimally comprised of an address tenure only. transfer termination. signal that refers to both signals that acknowledge the transfer of individual beats (of both single-beat transfer and individual beats of a burst transfer) and to signals that mark the end of the tenure. u uisa (user instruction set architecture). the level of the architecture to which user-level software should conform. the uisa defines the base user-level instruction set, user-level registers, data types, floating-point memory conventions and exception model as seen by user programs, and the memory and programming models. underflow. a condition that occurs during arithmetic operations when the result cannot be represented accurately in the destination register. for example, underflow can happen if two floating-point fractions are multiplied and the result requires a smaller exponent and/or mantissa than the single-precision format can provide. in other words, the result is too small to be represented accurately. user mode. the operating state of a processor used typically by application software. in user mode, software can access only certain control registers and can access only user memory space. no privileged operations can be performed. also referred to as problem state. v vea (virtual environment architecture). the level of the architecture that describes the memory model for an environment in which multiple devices can access memory, defines aspects of the cache model, defines cache control instructions, and defines the time-base facility from a user-level perspective. implementations that conform to the powerpc vea also adhere to the uisa, but may not necessarily adhere to the oea. virtual address. an intermediate address used in the translation of an effective address to a physical address. virtual memory. the address space created using the memory management facilities of the processor. program access to virtual memory is possible only when it coincides with physical memory . f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . glossary-16 g2 powerpc core reference manual motorola w way. a location in the cache that holds a cache block, its tags and status bits. word. a 32-bit data element. write-back. a cache memory update policy in which processor write cycles are directly written only to the cache. external memory is updated only indirectly, for example, when a modified cache block is cast out to make room for newer data. write-through. a cache memory update policy in which all processor write cycles are written to both the cache and memory. f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola index index-1 index a aack signal, 8-26 abb signal, 8-12, 9-7 abe (address broadcast enable) bit, 4-23 active-low signals, 8-1 address breakpoint register, 2-10 address broadcast enable, 2-13 address bus address transfer attribute a n , 8-15 ape , 8-18, 9-12 ap n , 8-17 ci , 8-24 cse n , 8-25 gbl , 8-25 tbst , 8-23, 9-13 tc n , 8-24, 9-19 tsiz n , 8-22, 9-13 tt n , 8-19, 9-13 wt , 8-24 address transfer start ts , 8-14, 9-11 address transfer termination aack , 8-26 artry , 4-21, 8-26 terminating address transfer, 9-19 arbitration signals, 8-11, 9-6 bus arbitration abb , 8-12, 9-7 bg , 8-11, 9-6 br , 8-11, 9-6 bus parking, 9-11 tenure, 9-6 address bus parity signals, 8-1 address calculation branch instructions, 3-26 effective address, 3-9 floating-point load and store, 3-24 integer load and store, 3-19 address matching, 11-5 address queue, 4-2 address translation, see memory management unit addressing conventions addressing modes, 3-8 alignment, 3-2 aligned data transfer, 3-1, 9-14, 9-18 alignment, 5-4 data transfers, 3-1, 9-14 exception, 5-28, 6-15 rules, 3-2 a n signals, 8-15 and, 11-5, 11-6 ape signal, 8-18, 9-12 ap n signals, 8-17 arbitration, system bus, 9-9, 9-21 artry signal, 4-21, 8-26 asserted, 8-1 asynchronous maskable, 5-3 nonmaskable, 5-3 atomic memory references stwcx. , 3-28 using lwarx/stwcx. , 4-20 automatic power reduction mode, 10-1 b base/decrementer registers, 10-2 bat, 1-3, 4-11 bat registers g2_le only (bat4?bat7), 2-18 be, 5-13 iabr, 11-4 iabr2, 11-4 bg signal, 8-11, 9-6 bidirectional signals, 8-3 biu, 4-2, 4-8 block address translation, 4-34, 4-39, 6-20 bat registers implementation of bat array, 2-18 block address translation flow, 6-11 lower, 4-35, 4-39 selection of block address translation, 6-9 upper, 4-35, 4-39 block size mask, 2-19 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . index-2 g2 powerpc core reference manual motorola c?c boundedly undefined, definition, 3-6 bpu, 1-1 br signal, 8-11, 9-6 branch folding, 7-2, 7-17 branch instructions address calculation, 3-26 branch instructions, 3-26, a-22 condition register logical, 3-27, a-22 system linkage, 3-33, a-23 trap, 3-27, a-23 branch prediction, 7-1, 7-18 branch processing unit, 7-4 branch instruction timing, 7-20 execution timing, 7-16 latency, branch instructions, 7-26 overview, 1-9 branch resolution definition, 7-1 branch trace enable (be), 2-7, 11-3, 11-5 breakpoint condition, 11-2 enabled, 11-4 exception, 11-2 registers, 11-1 burst data transfers 32-bit data bus, 9-14 64-bit data bus, 9-14 transfers with data delays, timing, 9-35 burst transactions, 4-9 bus arbitration, see data bus bus configurations, 9-37, 9-39 bus interface unit (biu), 4-2 bus snooping, 10-2 byte ordering considerations, 5-21 default, 3-1, 3-9 byte-reverse instructions, 3-21, a-20 c c bit, 6-39 cache cache locking address translation data cache locking, 4-34 instruction cache locking, 4-39 bat examples, 4-34 data cache locking address translation, 4-34 disabling exceptions, 4-35 enabling, 4-34 entire cache locking, 4-37 invalidation, 4-36 invalidation (if locked), 4-38 loading, 4-37 locking, 4-34 msr bits, 4-35 way-locking, 4-37 disabling exceptions data cache locking, 4-35 instruction cache locking, 4-40 enabling data cache, 4-34 instruction cache, 4-38 entire cache locking definition, 4-32 instruction cache locking address translation, 4-39 disabling, 4-40 enabling, 4-38 entire cache locking, 4-42 invalidating instruction cache (if locked), 4-43 msr bits, 4-40 preloading instructions, 4-40 way-locking, 4-42 invalidation data cache, 4-36 data cache (if locked), 4-38 instruction cache (if locked), 4-43 loading data cache, 4-37 instruction cache preloading, 4-40 msr bits disabling exceptions, data cache locking, 4-35 disabling instruction cache locking, 4-40 organization, 4-32 procedures, 4-33 register summary, 4-32 terminology, 4-32 way-locking definition, 4-32 cache miss, 7-13 characteristics, 4-1 instructions, 3-31, 3-35, 4-22, a-23 mei state definition, 4-16 organization, instruction/data, 4-3-4-8 overview, 1-24 cache arbitration, 7-10 cache block push operation, 4-9 cache block, definition, 4-1 cache cast-out operation, 4-9 cache coherency actions on load operations, 4-19 actions on store operations, 4-19 copy-back operation, 4-12 in single-processor systems, 4-19 mei protocol, 4-15 out-of-order execution, 4-14 overview, 4-3 protocol, 4-3 reaction to bus operations, 4-20 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola index index-3 d?d wimg bits, 4-10, 4-14, 9-29 write-back mode, 4-12 cache hit, 7-10 cache locking, 4-31 cache management instructions, 3-31, 3-35, 4-22, a-23 cache operations basic data cache operations, 4-8 data cache transactions, 4-9 instruction cache fill operations, 4-4 overview, 1-13, 4-1 response to bus transactions, 4-20 cache unit memory performance, 7-22 operation of the cache, 9-2 overview, 4-1 cache-inhibited, 6-16 cache-inhibited accesses (i bit) cache interactions, 4-10 i-bit setting, 4-12 timing considerations, 7-23 ce, 5-13 dabr, 11-2 dabr2, 11-2 changed (c) bit, 6-11, 6-21 changed (c) bit maintenance recording, 6-21-6-24 changed (c) bit maintenance recording, 6-11 checkstop signal, 8-41, 9-41 state, 5-24 checkstop high-impedance enable (core_ckstp_tre) input, 8-42 checkstop output enable (core_ckstp_oe) output, 8-42 ci signal, 8-24 classes of instructions, 3-6 clean block operation, 4-20 clock signals clk_out, 8-54 pll_cfg n , 8-55 sysclk, 8-53 cmos, 10-1 combinational matching, 11-5 company or manufacturer id number, 2-4 compare and match type conditions, 11-2 compare instructions, 3-17, a-16 compare type and match type conditions, 11-3 completion considerations, 7-13 definition, 7-1 unit, 11-3 completion queue, 7-1, glossar y-3 context synchronization, 3-10 control bits, 10-2 conventions, xxxv, xli, 3-1 cop/scan interface, 8-47 cop_svr instruction, 11-1 copy-back mode, 7-22 core_cint signal, 8-39 core_dbwo signal, 9-43 cr logical instructions, 3-27 critical interrupt, 5-5, 5-16 exception enable (g2_le only), 2-7 registers (g2_le only), 2-10 cse n signals, 8-25 csrr0, 5-9, 5-11, 5-15, 5-16, 5-17 csrr1, 5-9, 5-11, 5-15, 5-16, 5-17, 5-18 d dabr, 11-1, 11-3 dsisr, 11-3 dabr{bt}, 11-3 dabr2, 11-1, 11-3 dabr2{bt}, 11-3 dar, 5-24, 11-2, 11-3 data accesses, 6-1 data address breakpoint control register, 2-10 match, 11-2 registers, 11-1 registers (dabr, dabr2), 11-2 data address control register (dbcr), 11-3 data address register, 5-26 data address translation, 2-8 data block address translation, 4-35, 4-39 data breakpoint registers, 2-10 data bus 32-bit data bus mode, 9-37 arbitration signals, 8-29, 9-7 bus arbitration, 9-21 data tenure, 9-6 data transfer, 8-31, 9-23 data transfer termination, 8-37, 9-24 data bus high, 8-32 data bus in (core_dh_in{0-31}, core_dl_in{0-31}), 8-32 data bus input enable (core_dh_ien, core_dl_ien) output, 8-32 data bus low, 8-32 data bus out (core_dh_out{0-31}, core_dl_out{0-31}) output, 8-33 data cache, 4-2 basic operations, 4-8 broadcasting, 4-7 bus transactions, 4-9 cache control, 4-6 configuration, 4-1 dcfi, dce, dlock bits, 4-6 disabling, 4-7 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . index-4 g2 powerpc core reference manual motorola e?e enable, 2-12 fill operations, 4-8 flash invalidate, 2-13 lock, 2-12 locking, 4-7 organization, 4-6 touch load operations, 4-8 touch load support, 4-8 way-lock, 2-16 data cache enable, 4-7 data cache flash invalidate, 4-6 data coherency, 10-4 data load translation miss, 5-5 data storage interrupt (dsi), see dsi exception data store translation miss, 5-5 data tlb miss on load exception, 5-36 data tlb miss on store exception, 5-37 data transfers alignment, 3-1, 9-14 burst ordering, 9-14 eciwx and ecowx instructions, alignment, 9-18 signals, 9-23 dbat, 1-3 dbb signal, 8-30, 9-7, 9-22 dbcr, 11-1 dbdis signal, 8-36 dbg signal, 8-29, 9-7 dbwo signal, 8-29, 9-7, 9-23 dcfi, 4-38 dcmp, 6-34, 6-37 dcmp and icmp registers, 6-34 debug control registers, 11-1 debug control signals, 8-51 decrementer, 5-5 exception, 10-2 interrupt, 5-32, 10-2 timer, 10-2 default power state, 10-2 defined instruction class, 3-7 destination registers, 11-2 dh n /dl n signals, 8-32 direct address translation (translation disabled) data accesses, 4-11, 6-9, 6-11, 6-19 instruction accesses, 4-11, 6-9, 6-11, 6-19 direct-store access on the 603e, 4-10 dispatch considerations, 7-13 dlock, 4-7, 4-37 dmiss, 6-37 dmiss/imiss registers, 6-34 dmmu, 6-25 dbcr, 11-6 double-word, 4-2 doze mode, 10-2 dpe signal, 8-35 dp n signals, 8-34 dr, 5-14 drtry signal, 8-38, 9-24, 9-27 dsi, 5-4, 11-2 dsi exception, 5-24, 11-2, 11-3, 11-4 dsisr, 5-1, 11-2 dtlb, 1-3 dynamic power management, 10-1 enable (dpm), 2-12 modes, 10-2 e ecc errors, 9-28 effective address, 11-2 effective address calculation address translation, 6-3 branches, 3-9, 3-26 loads and stores, 3-9, 3-19, 3-24 error termination, 9-27 exception, 11-2 exception little-endian mode, 2-7 exception prefix, 2-7 exception vector, 11-8 exception vector range, 11-2 exception vectors and priority, 11-6 exceptions alignment exception, 5-28 classifications, 5-2 critical interrupt, 5-33 data tlb miss on load, 5-36 data tlb miss on store, 5-37 decrementer interrupt, 5-32 dsi, 5-24 enabling and disabling, 5-14 external interrupt, 5-27 fp unavailable, 5-32 instruction address breakpoint, 5-6, 5-37 instruction related, 3-10 instruction tlb miss, 5-36 machine check, 5-22 overview, 1-26 processing, 5-9, 5-15 program, 5-31 register settings fpscr, 5-31 msr, 5-18 srr0/srr1, 5-10 reset, 5-19 returning from an exception handler, 5-16 summary, 3-10 system call, 5-34 system management interrupt, 5-39 trace, 5-34 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola index index-5 f?i execution synchronization, 3-10 execution unit, 1-9, 10-1 expanded debugging facilities in breakpoint registers, 11-4 external asynchronous interrupts, 10-2 external control instructions, 3-32, 9-18, a-24 external interrupt, 5-4 external interrupt enable, 2-7 external system logic, 10-2 f fe0, 5-13, 5-14 fe1, 5-13, 5-14 features list g2 g2_le, 1-3 finish cycle, definition, 7-2 floating-point available, 2-7 floating-point exception mode 0, 2-7 floating-point exception mode 1, 2-7 floating-point model fe0/fe1 bits, 5-14 fp arithmetic instructions, 3-16, a-18 fp compare instructions, 3-18, a-19 fp execution models, 3-4 fp load instructions, 3-24, a-21 fp move instructions, 3-18, a-22 fp multiply-add instructions, 3-16, a-18 fp rounding/conversion instructions, 3-17, a-18 fp store instructions, 3-25, a-21 fp unavailable exception, 5-32 fpscr instructions, 3-18, a-19 floating-point unavailable, 5-5 floating-point unit, 7-4 execution timing, 7-21 latency, fp instructions, 7-29 overview, 1-9 flow control instructions branch instruction address calculation, 3-26 branch instructions, 3-26 condition register logical, 3-27 flush block operation, 4-20 force branch indirect on bus, 2-13 force-single-step operation instruction, 11-1 fp, 5-13 fpr, 5-1 fpr0?fpr31, 2-2 fpscr, 5-1 fpscr instructions, 3-18, a-19 fpu, 1-1 full-power mode, 10-2 with dpm disabled, 10-3 fully static, 10-1 g g (guarded memory), 4-3 g2 features not present on pid6-603e, 1-5 overview, 1-1, 1-16 g2_le overview, 1-1 g2_le-specific instructions, 3-37 gbl signal, 8-25 gpr, 5-1 gpr0?gpr31, 2-2 guarded memory, 4-14 guarded memory bit (g bit) cache interactions, 4-10 g-bit setting, 4-13 h half-word, 4-2 handling, 5-2 hard reset and machine check, 5-17 hard reset sequence, 10-1 hardstop, 11-4 hardware handshake, 10-4 hash1/hash2 registers, 6-35 hashing functions primary pteg, 6-30 secondary pteg, 6-31 hid0 register dcfi, dce, dlock bits, 4-6 doze bit, 10-4 dpm enable bit, 10-3 icfi, ice, ilock bits, 4-5 nap bit, 10-4 hid0(dpm), 10-1 hid1 register bit settings, 2-14 pll configuration, 2-14, 8-55 high bat enable, 2-15 high-impedance control signal, 8-1 hreset signal, 8-42 i i (caching-inhibited), 4-3 iabr, 11-1 iabr2, 11-1 ibat, 1-3 ibcr, 11-1 ibcr(dns), 11-6 icfi, 4-43 icmp, 6-34 ieee 1149.1-compliant interface, 9-42 ile, 5-13 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . index-6 g2 powerpc core reference manual motorola i?i illegal instruction class, 3-7 ilock, 4-5 ilock control bit, 4-5 immu, 6-25 indeterminate processor core state, 11-8 input/output enable and high-impedance control signals, 8-3 instruction accesses, 6-1 instruction address breakpoint control register (ibcr), 2-10 examples, 11-6 exception, 5-37, 11-2, 11-3, 11-4 exception handler, 11-2, 11-8 registers, 11-1 instruction address translation, 2-7 instruction block address translation, 4-35, 4-39 instruction cache cache control bits, 4-4 cache fill operations, 4-4 configuration, 4-2 organization, 4-4 instruction cache enable, 2-12 instruction cache flash invalidate, 2-12 instruction cache lock, 2-12 instruction cache way-lock, 2-15 instruction queue, 7-8 instruction timing examples cache hit, 7-11, 7-14 execution unit, 7-16 instruction flow, 7-8 memory performance considerations, 7-22 overview, 1-32, 7-3 terminology, 7-1 instruction tlb miss exception, 5-36 instruction translation miss, 5-5 instruction unit, 1-8 instructional address control register (ibcr), 11-2 instructions branch address calculation, 3-26 branch instructions, 3-26, a-22 cache management instructions, 3-31, 3-35, 4-22, a-23 classes, 3-6 condition register logical, 3-27, a-22 defined instructions, 3-7 external control, 3-32, a-24 floating-point arithmetic, 3-16, a-18 compare, 3-17, a-19 fp load instructions, 3-24, a-21 fp move instructions, 3-18, a-22 fp status and control register, 3-18 fp store instructions, 3-25, a-21 fpscr isntructions, 3-18, a-19 multiply-add, 3-16, a-18 rounding and conversion, 3-17, a-18 g2-specific instructions, 3-37 illegal instructions, 3-7 integer arithmetic, 3-12, a-15 compare, 3-13, a-16 load, a-19 logical, 3-13, a-16 multiple, 3-22, a-20 rotate and shift, 3-14, a-17 store, 3-20, a-20 latency summary, 7-26 load and store address generation, floating-point, 3-24 address generation, integer, 3-19 byte-reverse instructions, 3-21, a-20 integer load, 3-20 integer multiple instructions, 3-22, a-20 integer store, 3-20 string instructions, 3-23, a-21 memory control, 3-31, 3-35, 4-22, a-23 memory synchronization, 3-28, 3-30, a-21 powerpc instructions, list form (format), a-25 function, a-15 legend, a-36 mnemonic, a-1 opcode, a-8 processor control, 3-28, 3-30, 3-33, a-23 reserved instructions, 3-8 segment register manipulation, 3-36, a-24 simplified mnemonics, 3-37 supervisor-level cache management, 3-36 system linkage, 3-33, a-23 tlb management instructions, 3-36, a-24 trap instructions, 3-27, a-23 int signal, 8-39, 9-41 integer arithmetic instructions, 3-12, a-15 integer compare instructions, 3-13, a-16 integer load instructions, 3-20, a-19 integer logical instructions, 3-13, a-16 integer multiple instructions, 3-22, a-20 integer rotate and shift instructions, 3-14, a-17 integer store instructions, 3-20, a-20 integer unit, 7-4 execution timing, 7-20 latency, integer instructions, 7-27 overview, 1-9 interrupt and checkstop signals, 8-39 interrupt vector, 10-2 interrupt, critical, 5-33 interrupt, external, 5-27 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola index index-7 j?m interrupt, see exceptions ip, 5-13, 5-15 isi, 5-4 itlb, 1-3 iu, 1-1 j jtag/cop interface, 11-1 interface signals, 8-2 k kill block operation, 4-20 l latency, 7-2, 7-26, 9-24 le, 5-14 little-endian mode enable, 2-8 load operations, memory coherency actions, 4-19 load/store address generation, 3-19, 3-24 byte-reverse instructions, 3-21, a-20 floating-point load instructions, 3-24, a-21 floating-point move instructions, 3-18, a-22 floating-point store instructions, 3-25, a-21 integer load instructions, 3-20, a-19 integer store instructions, 3-20, a-20 load/store multiple instructions, 3-22, a-20 memory synchronization instructions, 3-28, 3-30, a-21 string instructions, 3-23, a-21 load/store unit, 7-4 execution timing, 7-21 latency, load and store instructions, 7-30 logical addresses translation into physical addresses, 6-1 low-power operation, 10-1 lru algorithm, 4-5 lsu, 1-1 lwarx / stwcx. support, 9-42 lwarx/stwcx. atomic memory references, 4-20 m machine check, 5-4 machine check enable, 2-7 machine check exception checkstop state, 5-24 register settings enabled, 5-23 srr1 bit settings, 5-10 machine state register, 4-35 major processor design revision indicator, 2-5 manufacturing revision, 2-5 maskable asynchronous, 5-6 mcp signal, 8-40 me, 5-13 mei (modified, exclusive, or invalid, 4-3 mei protocol definition, mei states, 4-16 enforcing memory coherency, 9-29 hardware considerations, 4-17 memory accesses, 9-4 memory coherency bit (m bit) cache interactions, 4-10 i-bit setting, 4-12 m-bit setting, 4-12 timing considerations, 7-22 memory control instructions segment register manipulation, 3-36 tlb management, 3-36 user-level cache, 3-31, 3-35, 4-22 memory management unit address translation flow, 6-11 address translation mechanisms, 6-8, 6-11 block address translation, 6-9, 6-11, 6-20 block diagram, 6-5-6-7 data cache locking, 4-34 direct address translation, 4-11, 6-9, 6-11, 6-19 exceptions, 6-14 features summary, 6-2 general, 6-1 instruction cache locking, 4-39 instructions and registers, 6-17 memory protection, 6-10 overview, 1-31 page address translation, 6-8, 6-11, 6-27 page history status, 6-11, 6-21-6-24 page table search operation, 6-27 segment model, 6-21 software table search operation, 6-31, 6-36, 6-38 memory reservation, 4-2 memory synchronization instructions, 3-28, 3-30, a-21 stwcx. , 3-28 memory/cache access modes performance impact of copy-back mode, 7-22 see also wimg bits memory-coherent bit (m), 7-22 mesi, 1-3 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . index-8 g2 powerpc core reference manual motorola n?p minor processor design revision indicator, 2-5 misaligned accesses, 3-2 misaligned data transfer, 9-16 mmu, 1-3, 4-8 mode control bits, 4-2 move instructions, 3-18 msr (machine state register) bit settings, 2-6, 5-12 dr/ir bit, 2-7, 5-14 ee bit, 2-7, 5-13 fe0/fe1 bits, 5-14 pow bit, 2-6, 5-12 ri bit, 5-16 settings due to exception, 5-18 tgpr bit, 2-6, 5-13 msr{ee}, 10-6 msr{pow}, 10-6 msr{se}, 11-4 n nap mode, 10-2 no-drtry mode, 9-39 nondenormalized mode, support, 3-15 nonmaskable, asynchronous, 5-6 noopti, 2-13, 4-8 o operand conventions, 3-1 operand placement and performance, 3-4 operating environment architecture (oea), xxxii, 3-32, 6-1 optional instructions, a-36 or condition, 11-7 function, 11-5 operation, 11-6 other debug resources, 11-3 out-of-order data accesses, 4-14 output enable signals, 8-1 p page address translation page address translation flow, 6-27 page size, 6-21 selection of page address translation, 6-8, 6-14 table search operation, 6-27 tlb organization, 6-26 page history status r and c bit recording, 6-11, 6-21-6-24 page tables resources for table search operations, 6-32 software table search operation, 6-31, 6-36 sprg(4-7) registers, 2-8 table search for pte, 6-27 performance considerations, memory, 7-22 performance transparent functionality, 10-3 phase-locked loop, 10-2 physical address generation memory management unit, 6-1 physical block number, 2-19 pipeline instruction timing, definition, 7-2 pipeline stages, 7-7 superscalar/pipeline diagram, 7-5 pipelined execution unit, 7-4 power management doze mode, 10-3 doze, nap, sleep, dpm bits, 2-14 full-power mode, 10-3 nap mode, 10-4 programmable power modes, 10-3 sleep mode, 10-5 software considerations, 10-6 power management modes, 1-14, 10-3 power-on reset, 5-8, 5-19 power-on reset settings, 5-20 powerpc architecture instruction list, a-1, a-8, a-15 levels of implementation, 1-15 operating environment architecture (oea), xxxii, 3-32 user instruction set architecture (uisa), xxxi, 2-1 virtual environment architecture (vea), xxxi, 3-30 power-saving mode, 10-1 pr, 5-13 privilege level (pr), 2-7, 11-3 privilege levels, supervisor-level cache instruction, 3-36 privileged state, see supervisor mode problem state, see user mode process revision, 2-5 processor control instructions, 3-28, 3-30, 3-33, a-23 processor id type, 2-4 processor identification, 2-5 program, 5-5 program exception, 5-31 program order, definition, 7-2 program-controllable power reduction mode, 10-1 programmable power modes, 10-2 programmable power states doze mode, 10-3 full-power mode (dpm enabled/disabled), 10-3 nap mode, 10-4 sleep mode, 10-5 protection of memory areas no-execute protection, 6-12 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola index index-9 q?r options available, 6-10 protection violations, 6-14 ptegs (pte groups), 6-27 ptes (page table entries), 6-27 q qack signal, 8-45, 9-37, 9-40 qreq signal, 8-46, 9-41 qualified bus grant, 9-6 qualified data bus grant, 9-22 quiesce acknowledge signal, 10-4 quiesce request signal, 10-4 quiescent state, 10-4 r r bit, 6-39 read atomic operation, 4-20 read operation, 4-20 read with intent to modify operation, 4-20 read-with-intent-to-modify (rwitm), 4-8 read-with-intent-to-modify (rwitm) examples, 4-19 real address (ra), see physical address generation real addressing mode, see direct address translation recognition, 5-2 recoverable exception, 2-8 reduced-pinout mode, 9-40 referenced (r) bit, 6-11, 6-22 maintenance recording, 6-11, 6-21-6-24, 6-31 registers cache locking register summary, 4-32 cache locking registers hid0, 4-33 hid2, 4-33 msr, 4-33 configuration registers msr, 2-6 pvr, 2-4 exception handling registers dar, 2-8 dsisr, 2-9 sprg0?sprg3, 2-20, 5-11 srr0, 2-9 srr0/srr1, 2-19 implementation-specific registers dcmp/icmp, 2-16 dmiss/imiss, 2-16 hash1/hash2, 2-17 hid0/hid1, 2-10, 2-14 iabr, 2-21 rpa, 2-17 memory management registers bat, 2-8 sdr1, 2-8 sr, 2-8 supervisor-level bat, 2-8, 2-19 dar, 2-8 dcmp/icmp, 2-16, 6-34 dec, 2-9 dmiss/imiss, 2-16, 6-34 dsisr, 2-9 ear, 2-9 hash1/hash2, 2-17, 6-35 hid0/hid1, 2-10, 2-14 iabr, 2-21 msr, 2-6 pvr, 2-4 rpa, 2-17 sdr1, 2-8 sprg0?sprg3, 2-20, 5-11 sr, 2-8 srr0, 2-9 srr0/srr1, 2-19 tb, 2-9 user-level cr, 2-2 ctr, 2-4 fpr0?fpr31, 2-2 fpscr, 2-2 gpr0?gpr31, 2-2 lr, 2-4 tb, 2-4 tgpr0?tgpr3, 6-33 xer, 2-4 rename buffer, 7-2 rename register operation, 7-15 reservation station, 7-2 reserved instruction class, 3-8 reset hreset signal, 8-42 reset exception, 5-19 settings caused by hard reset, 5-20 sreset signal, 8-43, 9-41 reset configuration signals, 8-43 reset signals, 8-42 resource id, 9-18 retirement, definition, 7-2 ri, 5-14 risc, 1-1 rotate and shift instructions, 3-14, a-17 rpa (required physical address), 6-36 rsrv signal, 8-45, 8-46, 9-42 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . index-10 g2 powerpc core reference manual motorola s?s s se, 5-13 segment registers sr manipulation instructions, 3-36, a-24 segmented memory model, see memory management unit self-modifying code, 3-19 serializing instructions, 7-15 signal groupings address arbitration signals, 8-1 address transfer signals, 8-1 address transfer start signals, 8-1 address transfer termination signals, 8-1 clock signals, 8-2 data arbitration signals, 8-2 data transfer signals, 8-2 data transfer termination signals, 8-2 debug control, 8-2 high-impedance control signals, 8-2 input enable signals, 8-2 output enable signals, 8-2 processor status, 8-2 reset configuration signals, 8-2 system status signals, 8-2 test interface signals, 8-2 transfer attribute signals, 8-1 signals aack , 8-26 abb , 8-12, 9-7 address arbitration, 8-11, 9-6 address transfer, 9-11 address transfer attribute, 9-12 a n , 8-15 ape , 8-18 ap n , 8-17 artry , 8-26 bg , 8-11, 9-6 br , 8-11, 9-6 checkstop, 9-41 ci , 8-24 ckstp_in , 8-41 ckstp_out , 8-41 clk_out, 8-54 cop/scan interface, 8-47 core_cint , 8-39 core_dbwo , 9-43 cse n , 8-25 data arbitration, 9-7, 9-21 data transfer termination, 9-24 dbb , 8-30, 9-7, 9-22 dbdis , 8-36 dbg , 8-29, 9-7 dbwo , 8-29, 9-7, 9-23 dh n /dl n , 8-32 dpe , 8-35 dp n , 8-34 drtry , 8-38, 9-24, 9-27 gbl , 8-25 hreset , 8-42 int , 8-39, 9-41 mcp , 8-40 non-protocol specific tck (jtag test clock), 8-48 tdi (jtag test data input), 8-48 tdo (jtag test data output), 8-49 tms (jtag test mode select), 8-49 trst (jtag test reset), 8-49 pll_cfg n , 8-55 qack , 8-45, 9-37, 9-40 qreq , 8-46, 9-41 rsrv , 8-45, 8-46, 9-42 smi , 5-39, 8-40 sreset , 8-43, 9-41 ta , 8-37 tben, 8-46 tbst , 8-23, 9-24 tc n , 8-24, 9-19 tea , 8-38, 9-27 tlbisync , 8-46 ts , 8-14 tsiz n , 8-22, 9-13 tt n , 8-19, 9-13 wt , 8-24 single-beat reads with data delays, timing, 9-34 single-beat transactions, 4-9 single-beat transfer reads with data delays, timing, 9-33 reads, timing, 9-31 termination, 9-25 writes, timing, 9-32 single-step enabled, 11-4 functions, 11-1 trace enable (se), 2-7, 11-3 sleep mode, 10-2 smi signal, 5-39, 8-40 snoop operation, 4-20, 7-22 soft reset, 5-17 softstop, 11-4 software debug features, 11-3 software debugging, 11-4 software programming model interface, 11-3 software table search, sprg(4-7), 2-8 split-bus transaction, 9-7 sprg, 1-3, 5-11 sprg0?sprg3, conventional uses, 5-12 sreset signal, 8-43 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . motorola index index-11 t?t srr0, 5-9, 5-11, 5-15, 5-16, 5-17, 11-2 srr0/srr1 (status save/restore registers) bit settings for machine check exception, 5-10 bit settings for table search operations, 5-10 format, 2-19, 5-11 srr1, 5-9, 5-14, 5-15, 5-16, 5-18 sru, 1-1 stall, definition, 7-3 static branch prediction, 7-18 static design, 10-5 status save/restore register 0, 5-15 store operations memory coherency actions, 4-19 single-beat writes, 9-32 string instructions, 3-23, a-21 superscalar, 7-3 supervisor mode, see privilege levels supervisor-level programs, 11-1 supervisor-level registers summary, 2-4 supervisor-level spr, 11-2, 11-3 sync operation, 4-20 synchronization context/execution synchronization, 3-10 execution of rfi, 5-16 memory synchronization instructions, 3-28, 3-30, a-21 requirements, 11-8 synchronous imprecise, 5-2 precise, 5-2, 5-6 sysclk, 8-53 sysclk signal, 8-53 system call, 5-5 system call exception, 5-34 system interface overview, 1-34 system linkage instructions, 3-33, a-23 system management interrupt, 5-6, 5-39, 10-2 system memory base address, 2-10 system quiesce control signals, 9-41 system register unit, 7-4 execution timing, 7-21 latency, cr logical instructions, 7-27 latency, system register instructions, 7-26 system reset, 5-4 system status ckstp_in , 8-41 ckstp_out , 8-41 core_cint , 8-39 hreset , 8-42 int , 8-39 mcp , 8-40 qack , 8-45 qreq , 8-46 rsrv , 8-45, 8-46 smi , 8-40 sreset , 8-43 tben, 8-46 tlbisync , 8-46 system version register, 2-10 t ta signal, 8-37 table search operations algorithm, 6-27 software routines, 6-31, 6-36-6-48 srr1 bit settings, 5-10 table search flow (primary and secondary), 6-29 taken, 5-2 tben signal, 8-46 tbst signal, 8-23, 9-13, 9-24 tck (jtag test clock) signal, 8-48 tc n signals, 8-24, 9-19 tdi (jtag test data input) signal, 8-48 tdo (jtag test data output) signal, 8-49 tea signal, 8-38, 9-27 termination, 9-19, 9-24 test interface, 8-50 tgpr0?gpr3 registers, 6-33 throughput, 7-3 time base lower, 2-9 register, 10-2 upper, 2-9 time-of-day maintenance, 10-5 timing diagrams, interface address transfer signals, 9-11 burst transfers with data delays, 9-35 single-beat reads, 9-31 single-beat reads with data delays, 9-33 single-beat writes, 9-32 single-beat writes with data delays, 9-34 use of tea , 9-36 using dbwo , 9-43 timing, instruction bpu execution timing, 7-16 branch timing example, 7-20 cache arbitration, 7-10 cache hit, 7-10, 7-11, 7-14 fpu execution timing, 7-21 instruction dispatch, 7-13 instruction flow, 7-8 instruction scheduling guidelines, 7-23 iu execution timing, 7-20 latency summary, 7-26 load/store unit execution timing, 7-21 overview, 7-3 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . index-12 g2 powerpc core reference manual motorola u?w sru execution timing, 7-21 stage, definition, 7-2 tlb description, 6-25 invalidate, a-24 invalidate (tlbie instruction), 6-26, 6-48 tlb management instructions, 3-37, a-24 tlbisync signal, 8-46 tms (jtag test mode select) signal, 8-49 trace, 5-5 trace exception, 5-34, 11-4, 11-5 trace facility, 11-1 transactions, data cache, 4-9 transfer, 9-11, 9-23 transfer type signals, 8-1 translation control bit, 6-8 trap instructions, 3-27 trst (jtag test reset) signal, 8-49 true little-endian, 2-15 ts signal, 8-14, 9-11 tsiz n signals, 8-22, 9-13 tt n signals, 8-19, 9-13 u unidirectional/bidirectional signals, 8-5 unrecoverable state, 11-2, 11-8 use of tea , timing, 9-36 user mode, 5-1 user instruction set architecture (uisa), xxxi, 2-1 user-level registers summary, 2-2 using dbwo , timing, 9-43 v virtual page number, 6-29 virtual environment architecture (vea), xxxi, 3-30 w w (write-through), 4-3 watchpoint signaling, 11-5 watchpoint/breakpoint indication signals, 11-1 wimg, 4-6 wimg bits, 4-10, 9-29 wire-oring, 8-5 word, 4-2 write with atomic operation, 4-20 write with flush operation, 4-20 write with kill operation, 4-20 write-back mode, 4-12, 7-3 write-though memory area, 6-16 write-through mode (w bit) cache interactions, 4-10 timing considerations, 7-23 w-bit setting, 4-11 wt signal, 8-24 f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . register model instruction set model instruction and data cache operation exceptions memory management signal descriptions power management instruction timing revision history index powerpc instruction set listings glo ind a glossary of terms and abbreviations 1 2 3 5 6 7 8 9 4 10 11 debug features core interface operation b overview f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . overview register model instruction set model instruction and data cache operation exceptions memory management signal descriptions power management instruction timing revision history index powerpc instruction set listings glo ind a glossary of terms and abbreviations 1 2 3 4 5 6 7 8 9 4 10 11 debug features core interface operation b overview f r e e s c a l e s e m i c o n d u c t o r , i freescale semiconductor, inc. f o r m o r e i n f o r m a t i o n o n t h i s p r o d u c t , g o t o : w w w . f r e e s c a l e . c o m n c . . . |
Price & Availability of G2CORERM
 |
|
|
|
|
All Rights Reserved © IC-ON-LINE 2003 - 2022 |
| [Add Bookmark] [Contact Us] [Link exchange] [Privacy policy] |
|
Mirror Sites : [www.datasheet.hk]
[www.maxim4u.com] [www.ic-on-line.cn]
[www.ic-on-line.com] [www.ic-on-line.net]
[www.alldatasheet.com.cn]
[www.gdcy.com]
[www.gdcy.net] |