********************************************************************* * * * THE MMU EXPERT VERSION 1.32 (1991-11-20) * * * * (C) 1991 by RELOG RESEARCH, ZURICH/SWITZERLAND * * * * WRITTEN BY F.BÜRGEL * * * ********************************************************************* J u s t t o m e n t i o n . . . -------------------------------------------------------------------- DISTRIBUTION: MMUx v1.32 is freely distributable. I wish to emphasize V1.32 NOTE THAT THE AUTHOR MAY CHANGE THE STATUS OF LATER VERSIONS OF THE MMU EXPERT. Only this version is free. DISCLAIMER: RELOG AG does not accept any responsibility for this program as to reliability, correctness etc. You use MMUx completely at your own risk. CONTACT For questions, bug reports, ideas contact us at buergel@amiga.physik.unizh.ch or BIX: hardwiz Updates, new and other interesting tools will always first be available for anonymous FTP at amiga.physik.unizh.ch (130.60.80.80). W h a t i s i t ? -------------------------------------------------------------------- The MMU expert is the first in a series of MMU tools from RELOG. MMUx will from now on be upgraded step by step. The basic features of the current version are - find the translation (logical-to-physical) for an address - display attributes associated with the translation - display information concerning the translation table such as - addresses of descriptors responsible for translation - levels, indexes, masks, block sizes encountered - scan fake translation tables for own experimenting - notify errors in translation tables The next version will allow to change the page attributes. M M U x I n s t r u c t i o n s -------------------------------------------------------------------- To find the translation to a specific address enter MMUx -a n where is the address in either decimal or hex notation. Hex numbers are automagically recognized except in ambiguous cases. There, you must add the usual $ identifier. Examples: MMUx -a fc0000 will translate $fc0000. MMUx -a 100 will translate 100 or $64. MMUx -a $100 will translate $100. MMUx will display only the translation (physical address) and the page attributes. The page attributes are the qualities applied to the memory region that is translated. For example, you will find that SetCPU applies writeprotection to the KickStart image. More about page attributes later in this documentation. VERBOSE OPERATION Using option v, you get a more verbose information output. Example: MMUX -a 40a -v will generate an output like the following MMU logical space is 4GB, page size is 1kB. Translation: $40A, page address $400. Regular short format page descriptor at level C. Page attributes: Used,Modified,CacheInhibit. Inherited attr.: none. No function code lookup. Descriptor path: $284A60,$2847F0,$28A0E4 Level path: (root),A,B,C Index path: $0,$0,$1 Mask path: $FF000000,$FC0000,$3FC00 Blksize path: 24,18,10 In this example, _The Enforcer_ was switched on. What do these lines mean: The LOGICAL SPACE is the space the user and all application software sees. Without the MMU, this space is 16MB on every 68000 and 4GB on the 020/030 except if hardware restricts it by cutting some of the high order address lines. The MMU however allows to cut this space down, for example, to emulate the address space of the 68000. SetCPU for example, limits the address space to 16MB. Any access to higher addresses will result in an access to the same 16MB address space as if the high order address bits were ignored. This is necessary in order to prevent software that has '32bit bugs' from crashing. The PAGE SIZE is something not easy to explain. For the beginner, it is sufficient to know that the MMU is unable to handle random translations from every one address into another, but instead forces translations to go from entire pages to pages. The smallest possible page size is 256 bytes. The TRANSLATION is nothing else but the physical address resulting from the translation of the specified logical address. The PAGE ADDRESS is the base address of the page the translated physical address is located in. To be exact, what MMUx shows here is not the address of the page defined by the (transparent) ATC entry but the page address specified in the page descriptor for this translation. In the case of non-earlytermination, this is the address of the page. The PAGE DESCRIPTOR is the entry in the translation tree that actually describes where the translation goes to. It does so by means of the page address. This address must be aligned to the pagesize in use. To translate, the MMU adds the low order bits of the logical address (only those not used as index into tables). The page descriptor also holds the attributes one wants to attach to the memory region. A page descriptor can be one of the following types: -Invalid (in that case, there is no translation) -Regular -Early terminating (in that case, it describes an array of pages rather than a single page) -Indirect (Avoiding confusion is a little difficult: An indirect descriptor according to MOTOROLA points to a page descriptor. MMUx quotes 'IND' level for a page descriptor pointed to by an indirect descriptor) In addition, a page descriptor can be either short or long format. The size is 4 bytes for the short, 8 bytes for the long format. The long format (which is almost useless except on the 68851) allows to specify some additional attributes, namely the access levels not supported by the 68030. The PAGE ATTRIBUTES (as described earlier) attach qualities to the memory inside the page. Of these, 'Used' and 'Modified' are not selectable qualities but rather information feedback from the MMU. The following page attributes exist -WriteProt page cannot be written to -Used page has been accessed -Modified page has been written to -Lock descriptor is to be kept locked in mmu cache -CacheInhibit memory is cache-disabled -Gate can be used for module descriptors -Supervisor can be used only in supervisor mode -SharedGlobally use one single ATC entry for all task mappings Of these, the following are invalid for the 68030: -Lock not implemented -Gate makes no sense, because no access levels implemented -Shared Globally no use, because no task alias feature INHERITED PAGE ATTRIBUTES are page attributes that can be specified in higher levels of the translation tree and are applied to all subsequent pages. The following attributes are inheritable: -WriteProt -Supervisor -SharedGlobally Inherited page attributes cannot be removed for a single page. Indirect descriptors do not contain attributes. (!) FUNCTION CODE LOOKUP is a mode which uses different translation tables for all address space types, eg User/Supervisor, Instruction/Data The DESCRIPTOR PATH shows the addresses of all descriptors used in the translation tree. The order is the same as listed in the level path. The LEVEL PATH shows the levels of the translation tree that were passed. The following levels can be gone through: root,FCL,A,B,C,D,ind. Levels A-D correspond to the 'normal' translation table levels. ROOT is always used and corresponds to the descriptor in the root pointer. Note that there will be no information about root in the other path lists, e.g the other lists always start at level A or FCL. FCL level is special in that it does not use mask or blocksize and must always come first (immediately after root). IND means indirect and is special in that it must be the last level and does not use mask, index or blocksize. Also, the descriptor doing the indirection (here quoted as A..D) does not supply attributes. The INDEX PATH shows the indexes into the table arrays this translation forced. The MASK PATH shows the masks that were used to cut out indexes from the logical address. The BLOCKSIZE PATH shows the sizes of the blocks associated with each level of the translation tree. The size is stated in # bits. TRANSPARENT TRANSLATION The 68030 has an additional pair of transparent translation registers. These are not included in the 68851 (so what are they anyway...). Transparent translation means defining a window in the logical address space that is treated as if no MMU were present. I dont see many applications for this. One might be to have a fast I/O space without the possible latency caused by table searches. The Amiga does not need this feature, yet there is some TT set up by the bootrom of the Amiga 3000. MMUx does not compare wheter your requested address falls into a TT window. So be aware of the fact. To see the transparent translations, add option -SHOWTT. The output on my A3000 looks like this: Reg. TT0: modes= read, fc allowed: 1 2 5 6. Transparent translation for $04..$07XXXXXX. Reg. TT1: modes= read/write, fc allowed: 1 2 5 6. Transparent translation for $40..$7FXXXXXX. The two registers TT0, TT1 are equivalent. They allow to set up two independent transparent translations. In this case, we have a 64MB transparent window from $4000000 to $7ffffff (which is the A3000 RAM space) but only for read access. Further we have - for some reason - a second window, 1GB in size, located from $40000000 to $7fffffff, without read/write restriction. Transparently translated regions can have an attribute: cache inhibit is possible. M M U x C o m m a n d L i n e O p t i o n s -------------------------------------------------------------------- The MMU Expert V1.32 (1991-11-20) © RELOG RESEARCH Usage: MMUx -address=a n [-fc n] [-showtt=st] [-verbose=v] [-table=t n] Note: Options must be preceded by a '-'. You can use either the long or the short notation in upper or lower case. Some options require parameters. A 'n' stands for numeric, 's' stands for string parameter. Char means just one character. Note that string parameters can be put within quotation marks. This is necessary when SPACEs or TABs are contained in the string. Also, all string parameters without quotation marks are automatically uppercased. To generate some characters filtered by Shell, the following sequences can be used: \s => $ \n => [ENTER],[CR] or ^J \t => Tab \0 => ^@ ADDRESS,A This option is mandatory. Specify the address to examine in hex or dec format. VERBOSE,V Generates a more verbose output. FC Allows to select an address space for the logical address to translate using a function code (3 bits). Default is 1 (user-data). Others are: 2=user-program, 5=supervisor-data, 6=supervisor-program TABLE,T This option uses a table at address n instead of the table currently used by the system. The table must start with ULONG CRP_HI ULONG CRP_LO ULONG SRP_HI ULONG SRP_LO ULONG TC The pointers in the table must point to the absolute (heeelp!..) addresses the subtables are located at. To generate such a curious thing, you can use an assembler and either * generate an object file, locate it using AbsLoad or a similar tool, then load it to memory using a monitor or * force the assembler to put code to the absolute memory location or * manually poke to memory This option will soon be updated to accept a text file with the translation table 'source code'. M M U x M e s s a g e s a n d E r r o r s -------------------------------------------------------------------- ** Input line too long! You may not enter more than 250 chars as argument or at prompts. ** Missing numerical parameter to option %s. Options a, t and fc must be given a number. ** Unexpected argument "%s". Specify only file name. More than one name has been given. Check for '-' before options. ** Missing address. You have not specified the address to translate. ** Unrecognized option '%s' - Options are: a,fc,t,v ** Input file <%s> too short or corrupt. There was a disk / file error reading the file. ** Can't open <%s> - DOS error %ld. Hint: 205 means 'file not found'... ** Can't get memory (%ld bytes) for source file! - ** The MMU is not enabled. There is nothing to examine. ** Root pointer early terminating - no table. The translation is 1:1. ** Address %lx is out of MMU mapped space! Range is limited to %s by means of initial shift. The address may be translated. To see the translation, reduce it to fit to the limit. ** Address %lx is out of MMU mapped space! Range is limited to %s by means of upper index limit. Root level limit violation. The address cannot be accessed. ** Limit violation at level %ls - no translation. The address cannot be accessed. ** Page limit violation at level %ls - no translation. An early terminating long format page descriptor may limit the access range of subsequent pages. The address cannot be accessed. ** Index is $%x, low limit is $%x, high is $%x. Shows you the limit violation in more detail. ** Invalid %ls descriptor at level %ls - no translation. ** Descriptor contents: $%08lx. The address cannot be accessed. Invalid type descriptors are often used to keep information associated with the invalidity. For example, a virtual memory system may use the page descriptors of swapped out pages to store the disk block number it has copied the page to. ** Indirect is not page descriptor - no translation. A heavy case of an unusable table. ** Erroneous page address %lx truncated to %lx. A page address has been specified not to fit the possible page boundaries. ** MMU configuration (TC) error! A table was specified in memory. The value specified for the TC register (offset $10 from beginning) is invalid because it does not follow the magic rules 'IS+A+B+C+D+PS = 32' and PS >= 8. Attempting to write this value to the TC register will cause an MMU configuration error exception. ** MMU configuration (CRP/SRP) error! A table was specified in memory. The value specified for either CRP or SRP has a descriptor type 'invalid' which may not be used in the root pointers. This rule applies to SRP only if the SRP enable bit in the TC register is set. Attempting to write this value to the CRP/SRP register will cause an MMU configuration error exception. ** Fatal: Table cannot be accessed! The translation table itself is access protected and cannot be examined. Future versions of The MMU Expert will be powerful enough to crack that. M M U x B u g s / R e s t r i c t i o n s -------------------------------------------------------------------- * The current version of The MMU Expert does not know about Transparent Translation. * It will not work on the 68040 - crashes should not occur. The 68040 MMU is completely different from the original 68851. * It will not work when the translation table is access protected. No other bugs are known. Some invalid bits hidden in descriptors may be accepted unreported. Future versions of The MMU Expert will get more and more angry when they find any of them. M M U x H i s t o r y -------------------------------------------------------------------- v0.01 91-07-03 project started v0.05 91-07-20 main routine rewritten (DIV./MUL. replaced by shift) v0.11 91-07-25 now working for levels A...D v0.15 91-08-06 main routine rewritten to work in supervisor mode (I might need it in a berr handler later!) v0.17 91-08-07 limit violation check added v0.20 91-08-08 indirection support added v0.21 91-08-08 page limit violation detected v0.23 91-09-08 option memtable added v0.24 91-09-08 FCL support added v0.27 91-09-17 table prot detect, memtable MMU config check added v0.29 91-09-17 bugs in FCL and indirection fixed v0.30 91-09-20 small bug fixed v0.31 91-11-10 embarassing detail fixed (considered only 3 levels) v0.32 91-11-20 transparent translation info added