1. Hitachi neither warrants nor grants licenses of any rights of Hitachi’s or any third party’s
patent, copyright, trademark, or other intellectual property rights for information contained in
this document. Hitachi bears no responsibility for problems that may arise with third party’s
rights, including intellectual property rights, in connection with use of the information
contained in this document.
2. Products and product specifications may be subject to change without notice. Confirm that you
have received the latest product standards or specifications before final design, purchase or use.
3. Hitachi makes every attempt to ensure that its products are of high quality and reliability.
However, contact Hitachi’s sales office before using the product in an application that demands
especially high quality and reliability or where its failure or malfunction may directly threaten
human life or cause risk of bodily injury, such as aerospace, aeronautics, nuclear power,
combustion control, transportation, traffic, safety equipment or medical equipment for life
support.
4. Design your application so that the product is used within the ranges guaranteed by Hitachi
particularly for maximum rating, operating supply voltage range, heat radiation characteristics,
installation conditions and other characteristics. Hitachi bears no responsibility for failure or
damage when used beyond the guaranteed ranges. Even within the guaranteed ranges, consider
normally foreseeable failure rates or failure modes in semiconductor devices and employ
systemic measures such as fail-safes, so that the equipment incorporating Hitachi product does
not cause bodily injury, fire or other consequential damage due to operation of the Hitachi
product.
5. This product is not designed to be radiation resistant.
6. No one is permitted to reproduce or duplicate, in any form, the whole or part of this document
without written approval from Hitachi.
7. Contact Hitachi’s sales office for any questions regarding this document or Hitachi
semiconductor products.
Page 3
Preface
The SH7708, SH7708S, and SH7708R(SH7708 Series) use a RISC (reduced instruction set
computer) type CPU to achieve high-performance computational processing. Also incorporating
the peripheral functions required for system configuration plus power-down features essential for
microcontroller application systems, the SH7708 Series is a new-generation RISC microcontroller
(SuperH RISC engine).
The SH7708 Series have a RISC type instruction set, with basic instructions executed in one
state, offering a drastic improvement in instruction execution speed. It also has an on-chip 32-bit
multiplier (producing a 64-bit result) capable of high-speed multiply-and-accumulate operations.
The SH7708 Series’s instructions are upward-compatible with those of the SH-1 and SH-2,
facilitating migration from these series to the SH7708 Series.
SH7708R is completely pin compatible with the SH7708S. On-chip supporting modules that
enable a user system to be configured with a minimum of components include oscillation circuits,
an interrupt controller (INTC), timers, a realtime clock (RTC), and a serial communication
interface (SCI). A user break controller (UBC) is provided as an on-chip module supporting
program development, allowing easy configuration of a simple debugger.
On-chip cache memory improves CPU processing performance, and a built-in memory
management unit (MMU) performs address translation between a 4-gigabyte virtual space and
physical space. An on-chip bus state controller (BSC) provides more efficient external memory
access, and enables direct connection to synchronous DRAM, DRAM, and pseudo-SRAM without
the need for glue logic.
This hardware manual describes the hardware of the SH7708 Series. Details of instructions can be
found in the programming manual.
Related Manuals
SH7708Series instructions
SH-3/SH-3E/SH3-DSP Programming Manual
Please consult your Hitachi sales representative for details of development environment system.
Page 4
Page 5
Contents
Section 1 Overview and Pin Functions ...............................................1
1.1 SH7708 Series Features ........................................................................................1
B.2 Register Bit List .................................................................................................598
B.3 Register States in Reset and Power-Down States.......................................................604
Appendix C Delay Time Variation Due to Load Capacitance......................608
Appendix D Package Dimensions.....................................................609
10
Page 15
Section 1 Overview and Pin Functions
1.1SH7708 Series Features
The SH7708, SH7708S, and SH7708R(SH7708 Series) are 32-bit RISC (reduced instruction set
computer) microcomputers, featuring object code upward-compatibility with SH-1 and SH-2
microcomputers. The SH7708R is completely pin compatible with the SH7708S. It includes an 8kbyte cache with a choice of write-back or write-through mode, and an MMU (memory
management unit) with a 128-entry 4-way set associative TLB (translation lookaside buffer).
The SH7708 Series have an on-chip bus state controller (BSC) that allows direct connection to
DRAM, synchronous DRAM (SDRAM), and pseudo-SRAM (PSRAM) without external circuitry.
Its 16-bit fixed-length instruction set enables program code size to be reduced by almost 50%
compared with 32-bit instructions.
The features of the SH7708 Series are summarized in table 1.1.
1
Page 16
Table 1.1 SH7708 Series Features
ItemFeatures
CPU
Operating modes,
clock pulse
generator
• Original Hitachi SuperH RISC engine architecture
• 32-bit internal data bus
• General-register machine
Sixteen 32-bit general registers (eight 32-bit bank registers)
Five 32-bit control registers
Four 32-bit system registers
• RISC-type instruction set (upward compatibility with the SH-1 and SH-2
• Instruction execution time: one instruction/cycle for basic instructions
• Logical address space: 4 Gbytes (448-Mbyte actual memory space)
• Space identifier ASID: 8 bits, 256 logical address spaces
• On-chip multiplier
• Five-stage pipeline
• Clock mode: selected from an on-chip oscillator module, a frequency-
doubling circuit, or a clock output by combining them by PLL synchronization
• Processing states:
Power-on reset state
Manual reset state
Exception processing state
Program execution state
Power-down state
Bus-released state
• Contents of TLB can be accessed directly by address mapping (can be used
as on-chip memory)
• 5 external interrupt pins (NMI, IRL0 to IRL3)
• Encoded input of 15 external interrupt sources via pins IRL0 to IRL3
• On-chip peripheral interrupts: priority levels set for each module
• Supports debugging by user break interrupts
• 2 break channels
• Addresses, data values, type of access, and data size can all be set as
break conditions
• Supports a sequential break function
3
Page 18
Table 1.1 SH7708 Series Features (cont)
ItemFeatures
Bus state
controller
(BSC)
Timer
Realtime clock
(RTC)
Serial communication interface
(SCI)
Package
Note: SH7708S only
• Supports external memory access
32/16/8-bit external data bus
• Physical address space divided into seven areas, each a maximum 64
Mbytes, with the following features settable for each area:
Bus size (8, 16, or 32 bits)
Number of wait cycles (also supports a hardware wait function)
Setting the type of space enables direct connection to DRAM,
synchronous DRAM, pseudo-SRAM, and burst ROM
Supports fast page mode and EDO for DRAM
Supports PCMCIA interface
Outputs chip select signal (CS0–CS6) for corresponding area
• DRAM/synchronous DRAM/pseudo-SRAM refresh function
Programmable refresh interval
Supports CAS-before-RAS refresh and self-refresh modes
• DRAM/synchronous DRAM/pseudo-SRAM burst access function
• Usable as either big- or little-endian machine
• 3-channel auto-reload type 32-bit timer
• Input capture function
• 6 types of counter input clock can be selected
• Maximum resolution: 2 MHz
• On-chip clock and calendar functions
• On-chip 32-kHz crystal oscillator circuit with a maximum resolution (interrupt
cycle) of 1/256 second
• Selection of asynchronous or synchronous mode
• Full-duplex communication
• Supports smart card interface
• 144-pin plastic QFP(FP-144)
• 144-pin plastic TQFP (TFP-144) *
4
Page 19
Table 1.1 SH7708 Series Features (cont)
ItemFeatures
Product Line-up
Product
Number
SH77083.3V±0.3V60MHzHD6417708F60144-pin
SH7708S3.3V±0.3V60MHzHD6417708SF60
SH7708R3.15-3.6V
On-chip
Voltage
(typ.)
Operation
Frequency
100MHzHD6417708RF100144-pin
ModelPackage
Plastic LQFP
(FP-144F)
HD6417708STF60144-pin
Plastic TQFP
(TFP-144)
Plastic L-QFP
(FP-144F)
5
Page 20
1.2Block Diagram
Figure 1.1 shows a block diagram of the SH7708 Series.
2.Power supply pins for the on-chip RTC and on-chip PLL. These pins must be
connected to the power supply even if the RTC or PLL are not used.
3.Power supply pins for the on-chip PLL. Except in hardware standby mode,
these pins must be connected to the power supply even if the PLL is not used.
4. SH7708:Vcc
SH7708S,SH7708R:CA
Figure 1.2 Pin Arrangement
7
Page 22
1.3.2SH7708 Series Pin Functions
Table 1.2 SH7708 Series Pin Functions
No.TerminalI/ODescription
1D27I/OData bus
2D26I/OData bus
3D25I/OData bus
4D24I/OData bus
5D23/Port7I/ OData bus/port
6V
7V
32D4I/OData bus
33D3I/OData bus
34D2I/OData bus
35D1I/OData bus
36D0I/OData bus
37A0OAddress bus
38A1OAddress bus
39A2OAddress bus
40A3OAddress bus
41V
42V
SS
CC
43A4OAddress bus
44A5OAddress bus
45A6OAddress bus
46A7OAddress bus
47A8OAddress bus
48A9OAddress bus
49V
50V
SS
CC
51A10OAddress bus
52A11OAddress bus
53A12OAddress bus
54V
55V
SS
CC
56A13OAddress bus
57A14OAddress bus
58A15OAddress bus
59V
60V
SS
CC
PowerPower (0 V)
PowerPower (3.3 V)
PowerPower (0 V)
PowerPower (3.3 V)
PowerPower (0 V)
PowerPower (3.3 V)
PowerPower (0 V)
PowerPower (3.3 V)
PowerPower (0 V)
PowerPower (3.3 V)
9
Page 24
Table 1.2 SH7708 Series Pin Functions (cont)
No.TerminalI/ODescription
61A16OAddress bus
62A17OAddress bus
63A18OAddress bus
64A19OAddress bus
65A20OAddress bus
66A21OAddress bus
67A22OAddress bus
68V
69V
SS
CC
70A23OAddress bus
71A24OAddress bus
72A25OAddress bus
73VSS(PLL1)*
2
74CAP1OExternal capacitance pin for PLL1
75VCC(PLL1)*
76VSS(PLL2)*
2
2
77CAP2OExternal capacitance pin for PLL2
78VCC(PLL2)*
117WE3/DQMUU/ICIOWROD31–D24 selection signal/IO write
118WE2/DQMUL/ICIORDOD23–D16 selection signal/IO read
119CASHH/CAS2HOD31–D24/D15–D8 selection signal
120CASHL/CAS2LOD23–D16/D7–D0 selection signal
121V
SS
PowerPower (0 V)
PowerPower (3.3 V)
PowerPower (0 V)
PowerPower (3.3 V)
PowerPower (0 V)
11
Page 26
Table 1.2 SH7708 Series Pin Functions (cont)
No.TerminalI/ODescription
122V
CC
123WE1/DQMLUOD15–D8 selection signal
124WE0/DQMLLOD7–D0 selection signal
125CASLHOD15–D8 selection signal
126CASLL/CAS/OEOD7–D0 selection/memory selection signal
127V
128V
SS
CC
129RAS/CEORAS for DRAM, SDRAM/CE for PSRAM
130MD5/RAS2I/OOperating mode pin/RAS for DRAM
131CKEOClock enable control for SDRAM
132WAITIHardware wait request
133V
SS
134TCLKI/OClock I/O for TMU/RTC
135VCC (RTC)*
3
136XTAL2OCrystal oscillator pin for on-chip RTC
137EXTAL2ICrystal oscillator pin for on-chip RTC
138VSS (RTC)*
139V
CC
3
140D31I/OData bus
141D30I/OData bus
142D29I/OData bus
143D28I/OData bus
144V
SS
Notes: 1. Except in hardware standby mode, connect all VCC and VSS pins to the system power
supply (power should be supplied constantly). In hardware standby mode, power should
be supplied at least to V
pins other than VCC (RTC) and VSS (RTC), hold the CA pin low.
2. Power should be supplied regardless of whether or not the on-chip PLL is used.
3. Power should be supplied regardless of whether or not the RTC is used.
PowerPower (3.3 V)
PowerPower (0 V)
PowerPower (3.3 V)
PowerPower (0 V)
PowerPower (3.3 V)
PowerPower (0 V)
PowerPower (3.3 V)
PowerPower (0 V)
(RTC) and VSS (RTC). If power is not supplied to VCC and V
CC
SS
12
Page 27
Section 2 CPU
2.1Register Configuration
2.1.1Privileged Mode and Banks
Processor Modes: There are two processor modes: user mode and privileged mode. The
SH7708 Series normally operates in user mode, and enters privileged mode when an exception
occurs or an interrupt is accepted. There are three kinds of registers—general registers, system
registers, and control registers—and the registers that can be accessed differ in the two processor
modes.
General Registers: There are 16 general registers, designated R0 to R15. General registers R0
to R7 are banked registers which are switched by a processor mode change. In privileged mode, the
register bank bit (RB) in the status register (SR) defines which banked register set is accessed as
general registers, and which set is accessed only through the load control register (LDC) and store
control register (STC) instructions.
When the RB bit is 1, BANK1 general registers R0_BANK1–R7_BANK1 and non-banked general
registers R8–R15 function as the general register set, with BANK0 general registers R0_BANK0–
R7_BANK0 accessed only by the LDC/STC instructions.
When the RB bit is 0, BANK0 general registers R0_BANK0–R7_BANK0 and nonbanked general
registers R8–R15 function as the general register set, with BANK1 general registers R0_BANK1–
R7_BANK1 accessed only by the LDC/STC instructions. In user mode, the 16 registers
comprising bank 0 general registers R0_BANK0–R7_BANK0 and non-banked registers R8–R15
can be accessed as general registers R0–R15, and bank 1 general registers R0_BANK1–
R7_BANK1 cannot be accessed.
Control Registers: Control registers comprise the global base register (GBR) and status
register (SR) which can be accessed in both processor modes, and the saved status register (SSR),
saved program counter (SPC), and vector base register (VBR) which can only be accessed in
privileged mode. Some bits of the status register (such as the RB bit) can only be accessed in
privileged mode.
System Registers: System registers comprise the multiply and accumulate registers
(MACL/MACH), the procedure register (PR), and the program counter (PC). Access to these
registers does not depend on the processor mode.
The register configuration in each mode is shown in figures 2.1 and 2.2.
Switching between user mode and privileged mode is controlled by the processor mode bit (MD) in
the status register.
Note: Initialized by a power-on reset or manual reset.
2.1.2General Registers
There are 16 general registers, designated R0 to R15 (figure 2.3). General registers R0 to R7 are
banked registers, with a different R0–R7 register bank (R0_BANK0–R7_BANK0 or R0_BANK1–
R7_BANK1) being accessed according to the processor mode. For details, see section 2.1.1,
Privileged Mode and Banks.
310
1, *2
R0*
2
R1*
2
R2*
2
R3*
2
R4*
2
R5*
2
R6*
2
R7*
R8
R9
R10
R11
R12
R13
R14
R15
16
General Registers
Notes:
1.
R0 functions as an index register in the indexed
register-indirect addressing mode and indexed
GBR-indirect addressing mode. In some instructions,
only R0 can be used as the source register or
destination register.
2.
R0–R7 are banked registers.
In privileged mode, SR.RB specifies which banked
registers are accessed as general registers
(R0_BANK0–R7_BANK0 or R0_BANK1–R7_BANK1).
Figure 2.3 General Registers
Page 31
2.1.3System Registers
System registers can be accessed by the LDS and STS instructions. When an exception occurs, the
contents of the program counter (PC) are saved in the saved program counter (SPC). The SPC
contents are restored to the PC by the RTE instruction used at the end of the exception handling.
There are four system registers, as follows.
• Multiply and accumulate high register (MACH)
• Multiply and accumulate low register (MACL)
• Procedure register (PR)
• Program counter (PC)
The system register configuration is shown in figure 2.4.
310
MACH
MACL
310
PR
310
PC
System Registers
Multiply and Accumulate High and Low Registers
(MACH/L)
Store the results of multiply-and-accumulate operations.
Its contents are undefined after a reset.
Procedure Register (PR)
Stores the return address for exiting a subroutine
procedure.
Its contents are undefined after a reset.
Program Counter (PC)
Indicates the address four addresses (two instructions)
ahead of the currently executing instruction. Initialized
to H'A0000000 by a reset.
Figure 2.4 System Registers
2.1.4Control Registers
Control registers can be accessed in privileged mode using the LDC and STC instructions. The
GBR register can also be accessed in user mode. There are five control registers, as follows:
• Status register (SR)
• Saved status register (SSR)
• Saved program counter (SPC)
• Global base register (GBR)
• Vector base register (VBR)
17
Page 32
310
SSR
Saved Status Register (SSR)
Stores current SR value at time of exception to indicate processor
status in return to instruction stream from exception handler.
Its contents are undefined after a reset.
310
SPC
310
GBR
310
VBR
3129 28 2710 9 8 701 3
30
0RB
MDBLM Q0––––––––––––––––––––––––––––0I3 I2 I1 I0 0 0 S T
MD:
Processor operation mode bit: Indicates the processor operation mode as follows:
MD =1: Privileged mode; MD = 0: User mode
MD is set to 1 on generation of an exception or interrupt , and is initialized to 1 by a reset.
RB:
Register bank bit: Determines the bank of general registers R0–R7 used in processing mode.
RB = 1: R0_BANK1–R7_BANK1 and R8–R15 are general registers, and R0_BANK0–
R7_BANK0 can be accessed by LDC/STC instructions.
RB = 0: R0_BANK0–R7_BANK0 and R8–R15 are general registers, and R0_BANK1–
R7_BANK1 can be accessed by LDC/STC instructions.
RB is set to 1 on generation of an exception or interrupt , and is initialized to 1 by a reset.
BL:
Block bit
BL = 1: Exceptions and interrupts are suppressed. See section 4, Exception
Handling, for details.
BL = 0: Exceptions and interrupts are accepted.
M and Q bits:
I3–I0 bits:
Note:
BL is set to 1 on generation of an exception or interrupt , and is initialized to 1 by a reset.
Used by the DIV0S/U and DIV1 instructions.
Interrupt mask bits: 4-bit field indicating the interrupt request mask level.
I3–I0 do not change to the interrupt acceptance level when an interrupt is generated.
Initialized to B'1111 by a reset.
S bit:
Used by the MAC instruction.
T bit:
Used by the MOVT, CMP/cond, TAS, TST, BT, BF, SETT, CLRT, and DT instructions to
indicate true (1) or false (0).
Used by the ADDV/C, SUBV/C, DIV0U/S, DIV1, NEGC, SHAR/L, SHLR/L, ROTR/L, and
ROTCR/L instructions to indicate a carry, borrow, overflow, or underflow.
0 bits:
These bits always read 0, and the write value should always be 0.
The M, Q, S, and T bits can be set or cleared by special instructions in user mode.
Their values are undefined after a reset. All other bits can be read or written in privileged mode.
Saved Program Counter (SPC)
Stores current PC value at time of exception to indicate return
address at completion of exception handling.
Its contents are undefined after a reset.
Global Base Register (GBR)
Stores base address of GBR-indirect addressing mode.
The GBR-indirect addressing mode is used for on-chip supporting
module register area data transfers and logic operations.
The GBR register can also be accessed in user mode.
Its contents are undefined after a reset.
Vector Base Register (VBR)
Stores base address of exception handling vector area.
Initialized to H'0000000 by a reset.
Status
register
(SR)
18
Figure 2.5 Register Set Overview, Control Registers
Page 33
2 . 2Data Formats
2.2.1Data Format in Registers
Register operands are always longwords (32 bits, figure 2.6). When a memory operand is only a
byte (8 bits) or a word (16 bits), it is sign-extended into a longword when loaded into a register.
310
Longword
Figure 2.6 Longword
2.2.2Data Format in Memory
Memory data formats are classified into bytes, words, and longwords. Memory can be accessed in
8-bit byte, 16-bit word, or 32-bit longword form. A memory operand less than 32 bits in length is
sign-extended before being stored in a register.
A word operand must be accessed starting from a word boundary (even address of a 2-byte unit:
address 2n), and a longword operand starting from a longword boundary (even address of a 4-byte
unit: address 4n). An address error will result if this rule is not observed. A byte operand can be
accessed from any address.
Big-endian or little-endian byte order can be selected for the data format. The endian mode should be
set with the MD5 external pin in a power-on reset. Big-endian mode is selected when the MD5 pin
is low, and little-endian when high. The endian mode cannot be changed dynamically. Bit positions
are numbered left to right from most-significant to least-significant. Thus, in a 32-bit longword,
the leftmost bit, bit 31, is the most significant bit and the rightmost bit, bit 0, is the least
significant bit.
The data format in memory is shown in figure 2.7. In little-endian mode, data written in byte-size
(8-bit) units should be read in byte-size units, and data written in word-size (16-bit) units should be
read in word-size units.
19
Page 34
Address A
Address A + 4
Address A + 8
Address A + 1 Address A + 3
Address A
237
31015
Byte0 Byte1 Byte2 Byte3
Word0
LongwordLongword
Word1
Address A + 10 Address A + 8
Address A + 11
31015
Byte3 Byte2 Byte1 Byte0
Word1
Address A + 9Address A + 2
237
Word0
Address A + 8
Address A + 4
Address A
Big-endian mode
Little-endian mode
Figure 2.7 Byte, Word, and Longword Alignment
2.3Instruction Features
2.3.1Execution Environment
Data Length: The SH7708 Series instruction set is implemented with fixed-length 16-bit wide
instructions executed in a pipelined sequence with single-cycle execution for most instructions. All
operations are executed in 32-bit longword units. Memory can be accessed in 8-bit byte, 16-bit
word, or 32-bit longword units, with byte or word units sign-extended into 32-bit longwords.
Literals are sign-extended in arithmetic operations (MOV, ADD, and CMP/EQ instructions) and
zero-extended in logical operations (TST, AND, OR, and XOR instructions).
Load/Store Architecture: The SH7708 Series features a load-store architecture in which basic
operations are executed in registers. Operations requiring memory access are executed in registers
following register loading, except for bit-manipulation operations such as logical AND functions,
which are executed directly in memory.
Delayed Branching: Unconditional branching is implemented as delayed branch operations.
Pipeline disruptions due to branching are minimized by the execution of the instruction following
the delayed branch instruction prior to branching. Conditional branch instructions are of two kinds,
delayed and normal.
BRATRGET
ADDR1, R0;ADD is executed prior to branching to TRGET
20
Page 35
T bit: The T bit in the status register (SR) is used to indicate the result of compare operations,
and is read as a TRUE/FALSE condition determining if a conditional branch is taken or not. To
improve processing speed, the T bit logic state is modified only by specific operations. An
example of how the T bit may be used in a sequence of operations is shown below.
ADD#1, R0;T bit not modified by ADD operation
CMP/EQR1, R0;T bit set to 1 when R0 = 0
BTTRGET;branch taken to TRGET when T bit = 1 (R0 = 0)
Literals: Byte-length literals are inserted directly into the instruction code as immediate data. To
maintain the 16-bit fixed-length instruction code, word or longword literals are stored in a table in
main memory rather than inserted directly into the instruction code. The memory table is accessed
by the MOV instruction using PC-relative addressing with displacement, as follows:
MOV.W@(disp, PC), R0
Absolute Addresses: As with word and longword literals, absolute addresses must also be
stored in a table in main memory. The value of the absolute address is transferred to a register and
the operand access is specified by indexed register-indirect addressing, with the absolute address
loaded (like word and longword immediate data) during instruction execution.
16-Bit and 32-Bit Displacements: In the same way, 16-bit and 32-bit displacements also
must be stored in a table in main memory. Exactly like absolute addresses, the displacement value
is transferred to a register and the operand access is specified by indexed register-indirect addressing,
loading the displacement (like word and longword immediate data) during instruction execution.
21
Page 36
2.3.2Addressing Modes
Addressing modes and effective address calculation methods are shown in table 2.2.
Table 2.2 Addressing Modes and Effective Addresses
Addressing
Mode
Register direct RnEffective address is register Rn. (Operand is
Register
indirect
Register
indirect with
post-increment
Register
indirect with
pre-decrement
Instructio
n Format Effective Address Calculation MethodCalculation Formula
register Rn contents.)
@RnEffective address is register Rn contents.
RnRn
@Rn+Effective address is register Rn contents. A
constant is added to Rn after instruction
execution: 1 for a byte operand, 2 for a word
operand, 4 for a longword operand.
Rn
Rn + 1/2/4
1/2/4
@–RnEffective address is register Rn contents,
decremented by a constant beforehand: 1 for
a byte operand, 2 for a word operand, 4 for a
longword operand.
Table 2.2 Addressing Modes and Effective Addresses (cont)
Addressing
Mode
Register
indirect with
displacement
Indexed
register indirect
GBR indirect
with
displacement
Instructio
n Format Effective Address Calculation MethodCalculation Formula
@(disp:4,
Rn)
@(R0, Rn) Effective address is sum of register Rn and
Effective address is register Rn contents
with 4-bit displacement disp added. After
disp is zero-extended, it is multiplied by 1
(byte), 2 (word), or 4 (longword), according to
the operand size.
Rn
disp
(zero-extended)
1/2/4
+
×
Rn
+ disp × 1/2/4
Byte: Rn + disp
Word: Rn + disp × 2
Longword:
Rn + disp × 4
Rn + R0
R0 contents.
Rn
+
Rn + R0
R0
@(disp:8,
GBR)
Effective address is register GBR contents
with 8-bit displacement disp added. After
disp is zero-extended, it is multiplied by 1
(byte), 2 (word), or 4 (longword), according to
the operand size.
Byte: GBR + disp
Word: GBR + disp × 2
Longword:
GBR + disp × 4
Indexed GBR
indirect
GBR
disp
(zero-extended)
1/2/4
+
×
GBR
+ disp × 1/2/4
@(R0, GBR)Effective address is sum of register GBR and
R0 contents.
GBR
+
GBR + R0
R0
GBR + R0
23
Page 38
Table 2.2 Addressing Modes and Effective Addresses (cont)
Addressing
Mode
PC-relative
with
displacement
Instructio
n Format Effective Address Calculation MethodCalculation Formula
@(disp:8,
PC)
Effective address is register PC contents
with 8-bit displacement disp added. After
disp is zero-extended, it is multiplied by 2
(word), or 4 (longword), according to the
operand size. With a longword operand, the
lower 2 bits of PC are masked.
PC
(for longword)
&
H'FFFFFFFC
+
disp
(zero-extended)
x
2/4
PC + disp × 2
or
PC&H'FFFFFFFC
+ disp × 4
PC-relativedisp:8Effective address is register PC contents
with 8-bit displacement disp added after
being sign-extended and multiplied by 2.
PC
disp
+
PC + disp × 2
(sign-extended)
×
Word: PC + disp × 2
Longword:
PC & H'FFFF FFFC +
disp × 4
PC + disp × 2
24
2
disp:12Effective address is register PC contents
with 12-bit displacement disp added after
being sign-extended and multiplied by 2.
PC
disp
(sign-extended)
2
+
PC + disp × 2
×
PC + disp × 2
Page 39
Table 2.2 Addressing Modes and Effective Addresses (cont)
Addressing
Mode
PC-relativeRnEffective address is sum of register PC and
Immediate#imm:88-bit immediate data imm of TST, AND, OR, or
Note: For the addressing modes below that use a displacement (disp), the assembler descriptions
in this manual show the value before scaling (x1, x2, or x4) is performed according to the
operand size. This is done to clarify the operation of the IC. Refer to the relevant assembler
notation rules for the actual assembler descriptions.
@ (disp:4, Rn) ; Register indirect with displacement
@ (disp:8, Rn) ; GBR indirect with displacement
@ (disp:8, PC) ; PC-relative with displacement
disp:8, disp:12; PC-relative
Instructio
n Format Effective Address Calculation MethodCalculation Formula
PC + Rn
Rn contents.
PC
+
Rn
XOR instruction is zero-extended.
#imm:88-bit immediate data imm of MOV, ADD, or
CMP/EQ instruction is sign-extended.
#imm:88-bit immediate data imm of TRAPA
instruction is zero-extended and multiplied
by 4.
PC + Rn
—
—
—
25
Page 40
2.3.3Instruction Formats
Table 2.3 explains the meaning of instruction formats and source and destination operands. The
meaning of the operands depends on the operation code. The following symbols are used.
xxxx:Operation code
mmmm: Source register
nnnn:Destination register
iiii:Immediate data
dddd:Displacement
Table 2.3 Instruction Formats
Instruction Format
0 format
n format
m format
150
xxxxxxxxxxxxxxxx
150
xxxxxxxxxxxxnnnn
150
mmmm
xxxxxxxx
xxxx
Source
Operand
——NOP
—nnnn: register
Control register or
system register
Control register or
system register
mmmm: register
direct
mmmm: register
indirect with postincrement
mmmm: register
indirect
mmmm: PCrelative using Rm
Destination
Operand
direct
nnnn: register
direct
nnnn: register
indirect with
pre-decrement
Control register
or system
register
Control register
or system
register
—JMP@Rm
—BRAFR m
Instruction
Example
MOVT Rn
STS
MACH,Rn
STC.L
SR,@–Rn
LDC
Rm,SR
LDC.L
@Rm+,SR
26
Page 41
Table 2.3 Instruction Formats (cont)
Instruction Format
nm format
md format
nd4 format
150
xxxxxxxx
150
xxxxdddd
150
xxxx
nnnn
xxxx
xxxx
mmmm
mmmm
nnnn
dddd
Source
Operand
mmmm: register
direct
mmmm: register
direct
mmmm: register
indirect with postincrement
(multiply-andaccumulate
operation)
nnnn: * register
indirect with postincrement
(multiply-andaccumulate
operation)
Note: In a multiply-and-accumulate instruction, nnnn is the source register.
28
Page 43
2. 4Instruction Set
2.4.1Instruction Set Classified by Function
The SH7708 Series instruction set includes 68 basic instruction types, as listed in table 2.4.
Table 2.4 Classification of Instructions
Operatio
ClassificationTypes
Data transfer5MOVData transfer39
Arithmetic21ADDBinary addition33
operations
n CodeFunction
MOVAEffective address transfer
MOVTT bit transfer
SWAPSwap of upper and lower bytes
XTRCTExtraction of middle of linked registers
ADDCBinary addition with carry
ADDVBinary addition with overflow check
CMP/condComparison
DIV1Division
DIV0SInitialization of signed division
DIV0UInitialization of unsigned division
DMULSSigned double-precision multiplication
DMULUUnsigned double-precision multiplication
DTDecrement and test
EXTSSign extension
EXTUZero extension
MACMultiply-and-accumulate operation,
MULSSigned multiplication
MULUUnsigned multiplication
NEGNegation
NEGCNegation with borrow
SUBBinary subtraction
SUBCBinary subtraction with borrow
SUBVBinary subtraction with underflow check
NOTBit inversion
ORLogical OR
TASMemory test and bit set
TSTLogical AND and T bit set
XORExclusive OR
ROTROne-bit right rotation
ROTCLOne-bit left rotation with T bit
ROTCROne-bit right rotation with T bit
SHALOne-bit arithmetic left shift
SHAROne-bit arithmetic right shift
SHLLOne-bit logical left shift
SHLLnn-bit logical left shift
SHLROne-bit logical right shift
SHLRnn-bit logical right shift
SHADDynamic arithmetic shift
SHLDDynamic logical shift
No. of
Instructio
ns
30
Page 45
Table 2.4 Classification of Instructions (cont)
Operatio
ClassificationType
s
Branch9BFConditional branch, delayed conditional
System15CLRTT bit clear75
control
Total: 68188
n CodeFunction
branch (T = 0)
BTConditional branch, delayed conditional
branch (T = 1)
BRAUnconditional branch
BRAFUnconditional branch
BSRBranch to subroutine procedure
BSRFBranch to subroutine procedure
JMPUnconditional branch
JSRBranch to subroutine procedure
RTSReturn from subroutine procedure
CLRMACMAC register clear
CLRSClear S bit
LDCLoad to control register
LDSLoad to system register
LDTLBLoad PTE to TLB
NOPNo operation
PREFPrefetch data to cache
RTEReturn from exception handling
SETSSet S bit
SETTSet T bit
SLEEPShift to power-down mode
STCStore from control register
STSStore from system register
TRAPATrap exception handling
No. of
Instructio
ns
11
Table 2.5 lists the SH7708 Series instruction code formats.
31
Page 46
Table 2.5 Instruction Code Format
ItemFormatExplanation
Instruction
mnemonic
Instruction
code
Operation→, ←
Privileged
mode
Execution
cycles
T bitValue of T bit after instruction is executed
Note: Scaling (×1, ×2, ×4) is performed according to the instruction operand size.
Notes: 1. The table shows the minimum number of execution cycles. The actual number of
instruction execution cycles will increase in cases such as the following:
• When there is contention between an instruction fetch and data access
• When the destination register in a load (memory-to-register) instruction is also used
by the next instruction
2. With the addressing modes using displacement (disp) listed below, the assembler
descriptions in this manual show the value before scaling (×1, ×2, or ×4) is performed.
This is done to clarify the operation of the chip. For the actual assembler descriptions,
refer to the individual assembler notation rules.
@ (disp:4, Rn) ; Register-indirect with displacement
@ (disp:8, Rn) ; GBR-indirect with displacement
@ (disp:8, PC) ; PC-relative with displacement
1101 RndispMOV.L @(disp:8,PC),Rn
1110 Rnim mMOV#imm:8,Rn
1111 ************
Note: See the SH-3/SH-3E/SH3-DSP Programming Manual for details.
Fx: 0000Fx: 0001Fx: 0010Fx: 0011 to 1111
MD: 00MD: 01MD: 10MD: 11
MOV.W
R0,@(disp:4,Rn)
@(disp:4,Rm),R0
R0,@(disp:8,GBR)
@(disp:8,GBR),R0
#imm:8,@(R0,GBR)
R0,@(disp:4,Rn)
MOV.W
@(disp:4,Rm),R0
MOV.W
R0,@(disp:8,GBR)
MOV.W
@(disp:8,GBR),R0
AND.B
#imm:8,@(R0,GBR)
MOV.L
R0,@(disp:8,GBR)
MOV.L
@(disp:8,GBR),R0
XOR.B
#imm:8,@(R0,GBR)
TRAPA #imm:8
MOVA
@(disp:8,PC),R0
OR.B
#imm:8,@(R0,GBR)
47
Page 62
2.5Processor States and Processor Modes
2.5.1Processor States
The SH7708 Series has five processor states: the reset state, exception-handling state, bus-released
state, program execution state, and power-down state.
Reset State: In this state the CPU is reset. The reset state is entered when the RESET pin goes
low. The CPU enters the power-on reset state if the BREQ pin is high, or the manual reset state if
the BREQ pin is low. See section 4, Exception Handling, for more information on resets.
In the power-on reset state, the internal states of the CPU and the on-chip supporting module
registers are initialized. In the manual reset state, the internal states of the CPU and registers of onchip supporting modules other than the bus state controller (BSC) are initialized. Since the BSC is
not initialized in the manual reset state, refreshing operations continue. Refer to the register
configurations in the relevant sections for further details.
Exception-Handling State: This is a transient state during which the CPU’s processor state
flow is altered by a reset, general exception, or interrupt exception handling.
In the case of a reset, the CPU branches to address H'A0000000 and starts executing the user-coded
exception handling program.
In the case of a general exception or interrupt, the program counter (PC) contents are saved in the
saved program counter (SPC) and the status register (SR) contents are saved in the saved status
register (SSR). The CPU branches to the start address of the user-coded exception service routine
found from the sum of the contents of the vector base address and the vector offset. See section 4,
Exception Processing, for more information on resets, general exceptions, and interrupts.
Program Execution State: In this state the CPU executes program instructions in sequence.
Power-Down State: In the power-down state, CPU operation halts and power consumption is
reduced. The power-down state is entered by means of the SLEEP instruction or the CA pin*.
There are three modes in the power-down state: sleep mode, standby mode and hardware standby
mode. See section 8, Power-Down Modes, for more information.
Note:SH7708S,SH7708R only
Bus-Released State: In this state the CPU has released the bus to a device that requested it.
Transitions between the states are shown in figure 2.8.
48
Page 63
From any state except
hardware standby mode when
RESET = 0 and BREQ = 1
From any state except
hardware standby mode when
RESET = 0 and BREQ = 0
Power-on reset
state
RESET = 1,
BREQ = 1
Interrupt
Bus-released state
Bus
request
Sleep mode
CA = 1, RESET = 0, BREQ = 1
Note: Driving the CA pin low in any state will cause a transition to hardware standby mode (SH7708S,SH7708R only).
Bus request
Bus request clearance
Bus
request
clearance
Bus request
clearance
Bus request
SLEEP
instruction
with STBY
bit cleared
Exception
interrupt
RESET = 0,
BREQ = 1
Exception-handling state
End of exception
transition
processing
Program execution state
Hardware standby mode*
Manual reset
RESET = 1,
BREQ = 0
SLEEP
instruction
with STBY
bit set
Standby mode
state
Reset state
Interrupt
Power-down state
Figure 2.8 Processor State Transitions
2.5.2Processor Modes
There are two processor modes: privileged mode and user mode. The processor mode is determined
by the processor mode bit (MD) in the status register (SR). User mode is selected when the MD
bit is 0, and privileged mode when the MD bit is 1. When the reset state or exception state is
entered, the MD bit is set to 1. When exception handling ends, the MD bit is cleared to 0 and user
mode is entered. There are certain registers and bits which can only be accessed in privileged mode.
49
Page 64
50
Page 65
Section 3 Memory Management Unit (MMU)
3 .1Overview
3.1.1Features
The SH7708 Series has an on-chip memory management unit (MMU) that implements address
translation. The SH7708 Series features a resident translation lookaside buffer (TLB) that caches
information for user-created address translation tables located in external memory. It enables highspeed translation of virtual addresses into physical addresses. Address translation uses the paging
system and supports two page sizes (1 kbyte and 4 kbytes). The access right to virtual address
space can be set for privileged and user modes to provide memory protection.
3.1.2Role of MMU
The MMU is a feature designed to make efficient use of physical memory. As shown in figure 3.1,
if a process is smaller in size than the physical memory, the entire process can be mapped onto
physical memory. However, if the process increases in size to the extent that it no longer fits into
physical memory, it becomes necessary to partition the process and to map those parts requiring
execution onto memory as occasion demands ((1)). Having the process itself consider this mapping
onto physical memory would impose a large burden on the process. To lighten this burden, the
idea of virtual memory was born as a means of performing en bloc mapping onto physical
memory ((2)). In a virtual memory system, substantially more virtual memory than physical
memory is provided, and the process is mapped onto this virtual memory. Thus a process only has
to consider operation in virtual memory. Mapping from virtual memory to physical memory is
handled by the MMU. The MMU is normally controlled by the operating system, switching
physical memory to allow the virtual memory required by a process to be mapped onto physical
memory in a smooth fashion. Switching of physical memory is carried out via secondary storage,
etc.
The virtual memory system that came into being in this way is particularly effective in a timesharing system (TSS) in which a number of processes are running simultaneously ((3)). If
processes running in a TSS had to take mapping onto virtual memory into consideration while
running, it would not be possible to increase efficiency. Virtual memory is thus used to reduce this
load on the individual processes and so improve efficiency ((4)). In the virtual memory system,
virtual memory is allocated to each process. The task of the MMU is to perform efficient mapping
of these virtual memory areas onto physical memory. It also has a memory protection feature that
prevents one process from inadvertently accessing another process’s physical memory.
When address translation from virtual memory to physical memory is performed using the MMU,
it may happen that the relevant translation information is not recorded in the MMU, with the
result that one process may inadvertently access the virtual memory allocated to another process. In
51
Page 66
this case, the MMU will generate an exception, change the physical memory mapping, and record
the new address translation information.
Although the functions of the MMU could also be implemented by software alone, the need for
translation to be performed by software each time a process accesses physical memory would result
in poor efficiency. For this reason, a buffer for address translation (translation lookaside buffer:
TLB) is provided in hardware to hold frequently used address translation information. The TLB can
be described as a cache for storing address translation information. Unlike cache memory, however,
if address translation fails—that is, if an exception is generated—switching of address translation
information is normally performed by software. This makes it possible for memory management
to be performed flexibly by software.
The MMU has two methods of mapping from virtual memory to physical memory: a paging
method using fixed-length address translation, and a segment method using variable-length address
translation. With the paging method, the unit of translation is a fixed-size address space (usually of
1 to 64 kbytes) called a page.
In the following text, SH7708 Series address space in virtual memory is referred to as virtual
address space, and address space in physical memory as physical memory space.
Virtual
memory
MMU
Physical
memory
Process 1
Physical
memory
Process 1
Physical
memory
Process 1
52
(1)
Process 1
Process 2
Process 3
Physical
memory
(3)
Process 1
Process 2
Process 3
Figure 3.1 MMU Functions
Virtual
memory
MMU
(2)
Physical
memory
(4)
Page 67
3.1.3SH7708 Series MMU
Virtual Address Map: The SH7708 Series uses 32-bit virtual addresses to access a 4-Gbyte
virtual address space that is divided into several areas. Address space mapping is shown in figure
3.2.
In privileged mode, there are five areas, P0–P4. The P0 and P3 areas are mapped onto physical
address space in page units, in accordance with address translation table information. Addresses
H'7F000000–H'7FFFFFFF in the P0 area can be used as on-chip RAM space by making a setting
in the cache control register (CCR) (see section 5, Cache). In this case, mapping by means of the
address translation table is not performed for the on-chip RAM space. Write-back or write-through
can be selected for write access by means of a CCR setting.
Mapping of the P1 area is fixed to physical address space (H'00000000 to H'1FFFFFFF). In the
P1 area, setting a virtual address MSBs (bit 31) to 0 generates the corresponding physical address.
P1 area access can be cached, and the cache control register (CCR) is set to indicate whether to
cache or not. Write access is processed as write-through (SH7708). A CCR setting can be made to
select write-back or write-through.
Mapping of the P2 area is fixed to physical address space (H'00000000 to H'1FFFFFFF). In the
P2 area, setting the top three virtual address bits (bits 31, 30, and 29) to 0 generates the
corresponding physical address. P2 area access cannot be cached.
The P1 and P2 areas are not mapped by the address translation table, so the TLB is not used and no
exceptions like TLB misses occur. Initialization of MMU-related registers, exception processing
handling, and the like are located in the P1 and P2 areas. Because the P1 area is cached, handlers
that require high-speed processing are placed there.
The P4 area is used for mapping on-chip control register addresses.
In user mode, the 2 Gbytes of virtual address space from H'00000000 to H'7FFFFFFF (area U0)
can be accessed. U0 is mapped onto physical address space in page units. As with the P0 area,
addresses H'7000000–H'7FFFFFFF can be used as on-chip RAM space by making a setting in the
cache control register (CCR). In this case, mapping by means of the address translation table is not
performed for the on-chip RAM space. The 2 Gbytes of virtual address space from H'80000000 to
H'FFFFFFFF cannot be accessed in user mode. Attempting to do so creates an address error.
Write-back or write-through mode can be selected for write accesses by means of a CCR setting.
53
Page 68
H'00000000H'00000000
H'7F000000
H'80000000
H'A0000000
H'C0000000
H'E0000000
H'FFFFFFFF
2 Gbyte virtual space,
cacheable
(write-back/write-through)
On-chip RAM space
0.5 Gbyte fixed physical
space, cacheable
(write-through: SH7708)
(write-back/write-through:
SH7708S, SH7708R)
0.5 Gbyte fixed
physical space,
non-cacheable
0.5 Gbyte virtual space,
cacheable
(write-back/write-through)
0.5 Gbyte control space,
non-cacheable
Area P0
Area P1
Area P2
Area P3
Area P4
H'7F000000
H'80000000
H'FFFFFFFF
2 Gbyte virtual space,
cacheable
(write-back/write-through)
On-chip RAM space
Address error
Area U0
54
Privileged mode
User mode
Figure 3.2 Virtual Address Space Mapping
Page 69
Physical Address Space: The SH7708 Series supports a 32-bit physical address space, but the
upper 3 bits are actually ignored and treated as a shadow. See section 10, Bus State Controller, for
details.
Single Address Translation: When the MMU is enabled, the virtual address space is divided
into units called pages. Physical addresses are translated in page units. Address translation tables in
external memory hold information such as the physical address that corresponds to the virtual
address and memory protection codes. With the TLB, the contents of address translation tables in
external memory are cached to speed up address translation. When an access to areas P1 or P2
occurs, there is no TLB access and the physical address is defined uniquely by the hardware. If it
belongs to areas P0, P3 or U0, the TLB is searched by virtual address and, if that virtual address is
registered in the TLB, the access hits the TLB. The corresponding physical address and the page
control information are read from the TLB and the physical address is determined.
If the virtual address is not registered in the TLB, a TLB miss exception occurs and processing will
shift to the TLB miss handler. In the TLB miss handler, the TLB address translation table in
external memory is searched and the corresponding physical address and the page control
information are registered in the TLB. After returning from the handler, the instruction that caused
the TLB miss is re-executed. When the MMU is enabled, address translation information that
results in a physical address space of H'80000000–H'FFFFFFFF should not be registered in the
TLB.
When the MMU is disabled, the virtual address is used directly as the physical address. As the
SH7708 Series supports a 29-bit address space as the physical address space, the top 3 bits of the
physical address are ignored, and constitute a shadow space (see section 10, Bus State Controller
(BSC)). For example, addresses H'00001000 in the P0 area, H'80001000 in the P1 area,
H'A0001000 in the P2 area, and H'C0001000 in the P3 area are all mapped onto the same physical
address. When access to these addresses is performed with the cache enabled, an address with the top
3 bits of the physical address masked to 0 is stored in the cache address array to ensure data
congruity.
Single Virtual Memory Mode and Multiple Virtual Memory Mode: There are two
virtual memory modes: single virtual memory mode and multiple virtual memory mode. In single
virtual memory mode, multiple processes run in parallel using the virtual address space exclusively
and the physical address corresponding to a given virtual address is specified uniquely. In multiple
virtual memory mode, multiple processes run in parallel sharing the virtual address space, so a
given virtual address may be translated into different physical addresses depending on the process.
Either single or multiple virtual mode is selected according to the value set in the MMU control
register. The items used in address comparison are the VPN and ASID. The VPN of the virtual
address used to access external memory is compared with the VPN of the TLB entry selected by the
index number.
55
Page 70
Address Space Identifier (ASID): When multiple processes run in parallel sharing the same
virtual address space and the processes have unique address translation tables, the virtual space can
be multiplexed. The ASID is 8 bits in length and is held in PTEH within the MMU indicating the
current process. With ASID, the TLB need not be purged when the process is switched.
When multiple processes run in parallel using the virtual address space exclusively, the physical
address corresponding to a given virtual address is specified uniquely. For this kind of single virtual
memory, the ASID becomes a key to protect memory (see section 3.4.2).
3.1.4Register Configuration
A register that has an undefined initial value must be initialized by the software. Table 3.1 shows
the configuration of the MMU control registers.
Table 3.1 Register Configuration
NameAbbreviationR/WSizeInitial
Value*
Page table entry register
high
Page table entry register lowPTELR/W LongwordUndefinedH'FFFFFFF4
Translation table base
register
TLB exception address
register
MMU control registerMMUCRR/WLongword*
Notes: 1. Initialized by a power-on reset or manual reset.
2. SV bit: undefined
Other bits: 0
PTEHR/WLongwordUndefinedH'FFFFFFF0
TTBR/WLongwordUndefinedH'FFFFFFF8
TEAR/W LongwordUndefinedH'FFFFFFFC
1
2
Address
H'FFFFFFE0
56
Page 71
3.2Register Description
There are five registers for MMU processing. These are all peripheral module registers, so they are
located in address space area P4 and can only be accessed from privileged mode by specifying the
address. These registers consist of:
1. The page table entry register high (PTEH) register residing at address H'FFFFFFF0, which
consists of a virtual page number (VPN) and ASID. The VPN set is the VPN of the virtual
address at which the exception is generated in the case of an MMU exception or address error
exception. When the page size is 4 kbytes, the VPN is the upper 20 bits of the virtual address,
but in this case the upper 22 bits of the virtual address are set. The VPN can also be modified
by software. As the ASID, software sets the number of the currently executing process. The
VPN and ASID are recorded in the TLB by the LDTLB instruction.
2. The page table entry register low (PTEL) register residing at address H'FFFFFFF4, and used to
store the physical page number and page management information to be recorded in the TLB by
the LDTLB instruction. The contents of this register are only modified in response to a
software command.
3. The translation table base register (TTB) residing at address H'FFFFFFF8, which points to the
base address of the current page table. The hardware does not set any value in TTB
automatically. TTB is available to software for general purposes.
4. The TLB exception address register (TEA) register residing at address H'FFFFFFFC, which
stores the virtual address corresponding to a TLB or address error exception. This value remains
valid until the next exception or interrupt.
5. The MMU control register (MMUCR) residing at address H'FFFFFFF0, which makes the
MMU settings described in figure 3.3. Any program that modifies MMUCR should reside in
the P1 or P2 area.
57
Page 72
The MMU registers are shown in figure 3.3.
317
VPN
PTEH
316 4 3 2 1 010
PPN
PTEL
31
TTB
TTB
31
Virtual address causing TLB-related
or address error exception
TEA
31846573210
0
MMUCR
0: Reserved bits (except MMUCR): Always read as 0. Writing is ignored.
(MMUCR) :Except bit 3 is read as 0. Bit 3 is don't care. Writing is
should be 0.
SV: Single virtual memory mode bit. Set to 1 for single virtual memory mode, cleared
to 0 for multiple virtual memory mode.
RC: A 2-bit random counter, automatically updated by hardware according to the
following rules in the event of an MMU exception. When a TLB miss exception
occurs, all TLB entry ways corresponding to the virtual address at which the
exception occurred are checked, and if all ways are valid, 1 is added to RC; if
there is one or more invalid way, they are set by priority from way 0, in the order:
way 0, way 1, way 2, way 3. In the event of an MMU exception other than a TLB
miss exception, the way which caused the exception is set in RC.
TF: TLB flush bit. Write 1 to flush the TLB (clear all valid bits of the TLB to 0). Always
reads 0.
IX: Index mode bit. When 0, VPN bits 16–12 are used as the TLB index number.
When 1, the value obtained by EX-ORing ASID bits 4–0 in PTEH and VPN bits
16–12 are used as the TLB index number.
AT: Address translation bit. Enables/disables the MMU.
0: MMU disabled
89
V00SH 0
SVRC000 TF IX AT
ASID0
7
PR SZ C D
010
0
0
58
Figure 3.3 MMU Register Contents
Page 73
3. 3TLB Functions
3.3.1Configuration of the TLB
The TLB caches address translation table information located in external memory. The address
translation table stores the physical page number translated from the virtual page number and the
control information for the page, which is the unit of address translation. Figure 3.4 shows the
overall TLB configuration. The TLB is 4-way set associative with 128 entries. There are 32 entries
for each way. Figure 3.5 shows the configuration of virtual addresses and TLB entries.
Way 0–3Way 0–3
Entry 0
Entry 1
Entry 31
VPN(11–10)VPN(31–17)ASID(7–0)
Address arrayData array
VEntry 0
Entry 1
Entry 31
PPN(31–10) PR(1–0)
Figure 3.4 Overall Configuration of the TLB
SZ C D SH
59
Page 74
319
VPN
Virtual address (1-kbyte page)
010
Offset
31110
VPN
12
Offset
Virtual address (4-kbyte page)
(15)(2)(2)(22)(8)(1)(1)(1)(1) (1)
VPN (31–17) VPN (11–10) ASID SH SZ VPRPPNC D
TLB entry
VPN: Virtual page number. Top 22 bits of virtual address for a 1-kbyte page, or top 20 bits of virtual
address for a 4-kbyte page. Since VPN bits 16-12 are used as the index number, they are
not stored in the TLB entry.
ASID: Address space identifier. Indicates the process that can access a virtual page. In single
virtual memory mode and user mode, or in multiple virtual memory mode, if the SH bit is 0,
the address is compared with the ASID in PTEH when address comparison is performed.
SH: Share status bit
0 = Page not shared between processes
1 = Page shared between processes
SZ: Page size bit
0 = 1-kbyte page
1 = 4-kbyte page
V: Valid bit. Indicates whether entry is valid.
0 = Invalid
1 = Valid
Cleared to 0 by a power-on reset. Not affected by a manual reset.
PPN: Physical page number. Top 22 bits of physical address. PPN bits 11-10 are not used in the
case of a 4-kbyte page. Attention must be paid to the synonym problem in the case of a
1-kbyte page (see section 3.4.4).
Set the most significant bit to 0.
PR: Protection key field. 2-bit field encoded to define the access rights to the page.
00: Reading only is possible in privileged mode.
01: Reading/writing is possible in privileged mode.
10: Reading only is possible in privileged/user mode.
11: Reading/writing is possible in privileged/user mode.
C: Cacheable bit. Indicates whether the page is cacheable.
0: Non-cacheable
1: Cacheable
D: Dirty bit. Indicates whether the page has been written to.
0 = Not written to
1 = Written to
60
Figure 3.5 Virtual Address and TLB Structure
Page 75
3.3.2TLB Indexing
The TLB uses a 4-way set associative scheme, so entries must be selected by index. VPN bits 16
to 12 are used as the index number regardless of the page size. The index number can be generated
in two different ways depending on the setting of the IX bit in MMUCR.
1. When IX = 0, VPN bits 16–12 alone are used as the index number
2. When IX = 1, VPN bits 16–12 are EX-ORed with ASID bits 4–0 to generate a 5-bit index
number
The second method is used to prevent lowered TLB efficiency that results when multiple processes
run simultaneously in the same virtual address space and a specific entry is selected by indexing of
each process. Figures 3.6 and 3.7 show the indexing schemes.
PTEH registerVirtual address
31161112170310
VPN0ASID
710
Index
VPN(31–17)VPN(11–10)
0
31
Exclusive-OR
Way 0–3
ASID(7–0)V
Address arrayData array
PPN(31–10) PR(1–0) SZ C D SH
ASID(4–0)
Figure 3.6 TLB Indexing (IX = 1)
61
Page 76
Virtual address
31161112170
Index
Way 0–3
VPN(31–17)VPN(11–10)
0
31
Address arrayData array
ASID(7–0)V
PPN(31–10) PR(1–0) SZ C D SH
Figure 3.7 TLB Indexing (IX = 0)
3.3.3TLB Address Comparison
The results of address comparison determine whether a specific virtual page number is registered in
the TLB. The virtual page number of the virtual address that accesses external memory is compared
to the virtual page number of the indexed TLB entry. The ASID within the PTEH is compared to
the ASID of the indexed TLB entry. All four ways are searched simultaneously. If the compared
values match, and the indexed TLB entry is valid (V bit = 1), the hit is registered.
It is necessary to have the software ensure that TLB hits do not occur simultaneously in more than
one way, as hardware operation is not guaranteed if this happens. For example, if there are two
identical TLB entries with the same VPN and a setting is made such that a TLB hit is made only
by a process with ASID = H'FF when one is in the shared state (SH = 1) and the other in the nonshared state (SH = 0), then if the ASID in PHE is set to H'FF, there is a possibility of
simultaneous TLB hits in both these ways. It is therefore necessary to ensure that this kind of
setting is not made by the software.
The object compared varies depending on the page management information (SZ, SH) in the TLB
entry. It also varies depending on whether the system supports multiple virtual memory or single
virtual memory.
The page size information determines whether VPN (11–10) is compared. VPN (11–10) is
compared for 1 kbyte pages (SZ = 0) but not for 4 kbyte pages (SZ = 1).
62
Page 77
The sharing information (SH) determines whether the PTEH.ASID and the ASID in the TLB entry
are compared. ASIDs are compared when there is no sharing between processes (SH = 0) but not
when there is sharing (SH = 1).
When single virtual memory is supported (MMUCR.SV = 1) and privileged mode is engaged
(SR.MD = 1), all process resources can be accessed. This means that ASIDs are not compared
when single virtual memory is supported and privileged mode is engaged. The objects of address
comparison are shown in figure 3.8.
In addition to the SH and SZ bits, the page management information of TLB entries also includes
D, C, and PR bits.
The D bit of a TLB entry indicates whether the page is dirty (i.e., has been written to). If the D bit
is 0, an attempt to write to the page results in an initial page write exception. For physical page
swapping between secondary memory and main memory, for example, pages are controlled so that
a dirty page is paged out of main memory only after that page is written back to secondary
memory. To record that there has been a write to a given page in the address translation table in
memory, an initial page write exception is used.
The C bit in the entry indicates whether the referenced page resides in a cacheable or non-cacheable
area of memory. The PR field specifies the access rights for the page in privileged and user modes
and is used to protect memory. Attempts at nonpermitted accesses result in TLB protection
violation exceptions.
Access states designated by the D, C, and PR bits are shown in table 3.2.
Table 3.2 Access States Designated by D, C, and PR Bits
Privileged ModeUser Mode
ReadingWritingReadingWriting
D bit0PermittedInitial page write
exception
1PermittedPermittedPermittedPermitted
C bit0Permitted
(no caching)
1Permitted
(with caching)
PR bit00PermittedTLB protection
01PermittedPermittedTLB protection
10PermittedTLB protection
11PermittedPermittedPermittedPermitted
Permitted
(no caching)
Permitted
(with caching)
violation
exception
violation
exception
PermittedInitial page write
exception
Permitted
(no caching)
Permitted
(with caching)
TLB protection
violation
exception
violation
exception
PermittedTLB protection
Permitted
(no caching)
Permitted
(with caching)
TLB protection
violation exception
TLB protection
violation exception
violation exception
64
Page 79
3. 4MMU Functions
3.4.1MMU Hardware Management
MMU hardware management is of the following two kinds.
1. The MMU decodes the virtual address accessed by a process and performs address translation by
controlling the TLB in accordance with the MMUCR settings.
2. In address translation, the MMU receives page management information from the TLB, and
determines the MMU exception and whether the cache is to be accessed (using the C bit). For
details of the determination method and the hardware processing, see section 3.5, MMU
Exceptions.
3.4.2MMU Software Management
There are three kinds of MMU software management, as follows.
1. MMU register setting. MMUCR setting, in particular, should be performed in areas P1 and P2
for which address translation is not performed. Also, since SV and IX bit changes constitute
address translation system changes, in this case, TLB flushing should be performed by
simultaneously writing 1 to the TF bit also. Since MMU exceptions are not generated in the
MMU disabled state with the AT bit cleared to 0, use in the disabled state must be avoided with
software that does not use the MMU.
2. TLB entry recording, deletion, and reading. TLB entry recording can be done in two ways—by
using the LDTLB instruction, or by writing directly to the memory-mapped TLB. For TLB
entry deletion and reading, the memory allocation TLB can be accessed. See section 3.4.3,
MMU Instruction (LDTLB), for details of the LDTLB instruction, and section 3.6, MemoryMapped TLB Configuration, for details of the memory-mapped TLB.
3. MMU exception handling. When an MMU exception is generated, it is handled on the basis of
information set from the hardware side. See section 3.5, MMU Exceptions, for details.
When single virtual memory mode is used, it is possible to create a state in which physical
memory access is enabled in privileged mode only by clearing the share status bit (SH) to 0 to
specify recording of all TLB entries. This strengthens inter-process memory protection, and enables
special access levels to be created in privileged mode only.
Recording a 1-kbyte page TLB entry may result in a synonym problem. See section 3.4.4,
Avoiding Synonym Problems.
65
Page 80
3.4.3MMU Instruction (LDLTB)
The load TLB instruction (LDTLB) is used to record TLB entries. When the IX bit in MMUCR is
0, the LDTLB instruction changes the TLB entry in the way specified by the RC bit in MMUCR
to the value specified by PTEH and PTEL, using VPN bits 16–12 specified in PTEH as the index
number. When the IX bit in MMUCR is 1, the EX-OR of VPN bits 16–12 specified in PTEH and
ASID bits 4–0 in PTEH are used as the index number.
Figure 3.9 shows the case where the IX bit in MMUCR is 0.
When an MMU exception occurs, the virtual page number of the virtual address that caused the
exception is set in PTEH by hardware. The way is set in the RC bit of MMUCR for each
exception according to the rules shown in figure 3.9. Consequently, if the LDTLB instruction is
issued after setting only PTEL in the MMU exception handling routine, TLB entry recording is
possible. Any TLB entry can be updated by software rewriting of PTEH and the RC bits in
MMUCR.
As the LDTLB instruction changes address translation information, there is a risk of destroying
address translation information if this instruction is issued in the P0, U0, or P3 area. Make sure,
therefore, that this instruction is issued in the P1 or P2 area. Also, an instruction associated with
an access to the P0, U0, or P3 area (such as the RTE instruction) should be issued at least two
instructions after the LDLTB instruction.
66
Page 81
MMUCR
3190
0SV 0 0 RC 0 TF IX AT
Index
Way selection
PTEH register
31171210 80
VPN0ASID VPN
Write
VPN(31–17) VPN(11–10) ASID(7–0) V
0
31
PTEL register
31100
PPN0 V 0 PR SZ C D SH 0
Write
Way 0 to 3
PPN(31–10) PR(1–0) SZ C D SH
Data arrayAddress array
Figure 3.9 Operation of LDTLB Instruction
3.4.4Avoiding Synonym Problems
When a 1-kbyte page is recorded in a TLB entry, a synonym problem may arise. If a number of
virtual addresses are mapped onto a single physical address, the same physical address data will be
recorded in a number of cache entries, and it will not be possible to guarantee data congruity. The
reason why this problem only occurs when using a 1-kbyte page is explained below with reference
to figure 3.10.
To achieve high-speed operation of the SH7708 Series cache, an index number is created using
virtual address bits 10–4. When a 4-kbyte page is used, virtual address bits 10–4 are included in the
offset, and since they are not subject to address translation, they are the same as physical address
bits 10–4. In cache-based address comparison and recording in the address array, since the cache tag
address is a physical address, physical address bits 31–10 are recorded.
When a 1-kbyte page is used, also, a cache index number is created using virtual address bits 10-4.
However, in the case of a 1-kbyte page, virtual address bit 10 is subject to address translation and
therefore may not be the same as physical address bit 10. Consequently, the physical address is
recorded in a different entry from that of the index number indicated by the physical address in the
cache address array.
67
Page 82
For example, assume that, with 1-kbyte page TLB entries, TLB entries for which the following
translation has been performed are recorded in two TLBs:
Virtual address 1 is recorded in cache entry H'00, and virtual address 2 in cache entry H'40. Since
the two virtual addresses are recorded in different cache entries despite the fact that the physical
addresses are the same, memory inconsistency will occur as soon as a write is performed to either
virtual address. Therefore, when recording a 1-kbyte TLB entry, if the physical address is the same
as a physical address already used in another TLB entry, it should be recorded in such a way that
physical address bit 10 is the same.
68
Page 83
When using a 4-kbyte page
Virtual address
31
VPN
12 1110
0
Offset
Physical address
31
PPN
When using a 1-kbyte page
Virtual address
31
VPN
Physical address
31
PPN
12 1110
Virtual address (10–4)
0
Offset
Physical address (31–10)
9
Offset
9
Offset
010
Virtual address (10–4)
010
Physical address (31–10)
Cache address
array
Cache address
array
Figure 3.10 Synonym Problem
69
Page 84
3. 5MMU Exceptions
There are four MMU exceptions: TLB miss, TLB protection violation, TLB invalid, and initial
page write.
3.5.1TLB Miss Exception
A TLB miss results when the virtual address and the address array of the selected TLB entry are
compared and no match is found. TLB miss exception handling includes both hardware and
software operations.
Hardware Operations: In a TLB miss, the SH7708 Series hardware executes a set of prescribed
operations, as follows:
1. The VPN field of the virtual address causing the exception is written to the PTEH register.
2. The virtual address causing the exception is written to the TEA register.
3. Either exception code H'040 for a load access, or H'060 for a store access, is written to the
EXPEVT register.
4. The PC value indicating the address of the instruction in which the exception occurred is
written to the save program counter (SPC). If the exception occurred in a delay slot, the PC
value indicating the address of the related delayed branch instruction is written to the SPC.
5. The contents of the status register (SR) at the time of the exception are written to the save
status register (SSR).
6. The mode (MD) bit in SR is set to 1 to place the SH7708 Series in privileged mode.
7. The block (BL) bit in SR is set to 1 to mask any further exception requests.
8. The register bank (RB) bit in SR is set to 1.
9. The RC field in the MMU control register (MMUCR) is incremented by 1 when all entries
indexed are valid. When some entries indexed are invalid, the smallest way number of them is
set in RC.
10.Execution branches to the address obtained by adding the value of the VBR contents and
H'00000400 to invoke the user-written TLB miss exception handler.
Software (TLB Miss Handler) Operations: The software searches the page tables in
external memory and allocates the required page table entry. Upon retrieving the required page table
entry, the software must execute the following operations:
1. Write the value of the physical page number (PPN) field and the protection key (PR), page size
(SZ), cacheable (C), dirty (D), share status (SH), and valid (V) bits of the page table entry
recorded in the address translation table in external memory into the PTEL register in the
SH7708 Series.
70
Page 85
2. If using software for way selection for entry replacement, write the desired value to the RC field
in MMUCR.
3. Issue the LDTLB instruction to load the contents of PTEH and PTEL into the TLB.
4. Issue the return from exception handler (RTE) instruction to terminate the handler routine and
return to the instruction stream. The RTE instruction should be issued at least two instructions
after the LDTLB instruction.
3.5.2TLB Protection Violation Exception
A TLB protection violation exception results when the virtual address and the address array of the
selected TLB entry are compared and a valid entry is found to match, but the type of access is not
permitted by the access rights specified in the PR field. TLB protection violation exception
handling includes both hardware and software operations.
Hardware Operations: In a TLB protection violation exception, the SH7708 Series hardware
executes a set of prescribed operations, as follows:
1. The VPN field of the virtual address causing the exception is written to the PTEH register.
2. The virtual address causing the exception is written to the TEA register.
3. Either exception code H'0A0 for a load access, or H'0C0 for a store access, is written to the
EXPEVT register.
4. The PC value indicating the address of the instruction in which the exception occurred is
written into SPC (if the exception occurred in a delay slot, the PC value indicating the address
of the related delayed branch instruction is written into SPC).
5. The contents of SR at the time of the exception are written to SSR.
6. The MD bit in SR is set to 1 to place the SH7708 Series in privileged mode.
7. The BL bit in SR is set to 1 to mask any further exception requests.
8. The register bank (RB) bit in SR is set to 1.
9. The way that generated the exception is set in the RC field in MMUCR.
10.Execution branches to the address obtained by adding the value of the VBR contents and
H'00000100 to invoke the TLB protection violation exception handler.
Software (TLB Protection Violation Handler) Operations: The software resolves the
TLB protection violation and issues the RTE (return from exception handler) instruction to
terminate the handler and return to the instruction stream. The RTE instruction should be issued at
least two instructions after the LDTLB instruction.
71
Page 86
3.5.3TLB Invalid Exception
A TLB invalid exception results when the virtual address is compared to a selected TLB entry
address array and a match is found but the entry is not valid (the V bit is 0). TLB invalid exception
handling includes both hardware and software operations.
Hardware Operations: In a TLB invalid exception, the SH7708 Series hardware executes a set
of prescribed operations, as follows:
1. The VPN number of the virtual address causing the exception is written to the PTEH register.
2. The virtual address causing the exception is written to the TEA register.
3. The way number causing the exception is written to RC in MMUCR.
4. Either exception code H'040 for a load access, or H'060 for a store access, is written to the
EXPEVT register.
5. The PC value indicating the address of the instruction in which the exception occurred is
written to the SPC. If the exception occurred in a delay slot, the PC value indicating the
address of the delayed branch instruction is written to the SPC.
6. The contents of SR at the time of the exception are written into SSR.
7. The mode (MD) bit in SR is set to 1 to place the SH7708 Series in privileged mode.
8. The block (BL) bit in SR is set to 1 to mask any further exception requests.
9. The register bank (RB) bit in SR is set to 1.
10.Execution branches to the address obtained by adding the value of the VBR contents and
H'00000100, and the TLB protection violation exception handler starts.
Software (TLB Invalid Exception Handler) Operations: The software searches the page
tables in external memory and assigns the required page table entry. Upon retrieving the required
page table entry, the software must execute the following operations:
1. Write the values of the physical page number (PPN) field and the values of the protection key
(PR), page size (SZ), cacheable (C), dirty (D), share status (SH), and valid (V) bits of the page
table entry recorded in external memory to the PTEL register.
2. If using software for way selection for entry replacement, write the desired value to the RC field
in MMUCR.
3. Issue the LDTLB instruction to load the contents of PTEH and PTEL into the TLB.
4. Issue the RTE instruction to terminate the handler and return to the instruction stream. The
RTE instruction should be issued after two LDTLB instructions.
72
Page 87
3.5.4Initial Page Write Exception
An initial page write exception results in a write access when the virtual address and the address
array of the selected TLB entry are compared and a valid entry with the appropriate access rights is
found to match, but the D (dirty) bit of the entry is 0 (the page has not been written to). Initial
page write exception handling includes both hardware and software operations.
Hardware Operations: In an initial page write exception, the SH7708 Series hardware executes
a set of prescribed operations, as follows:
1. The VPN field of the virtual address causing the exception is written to the PTEH register.
2. The virtual address causing the exception is written to the TEA register.
3. Exception code H'080 is written to the EXPEVT register.
4. The PC value indicating the address of the instruction in which the exception occurred is
written to the SPC. If the exception occurred in a delay slot, the PC value indicating the
address of the related delayed branch instruction is written to the SPC.
5. The contents of SR at the time of the exception are written to SSR.
6. The MD bit in SR is set to 1 to place the SH7708 Series in privileged mode.
7. The BL bit in SR is set to 1 to mask any further exception requests.
8. The register bank (RB) bit in SR is set to 1.
9. The way that caused the exception is set in the RC field in MMUCR.
10.Execution branches to the address obtained by adding the value of the VBR contents and
H'00000100 to invoke the user-written initial page write exception handler.
Software (Initial Page Write Handler) Operations: The software must execute the
following operations:
1. Retrieve the required page table entry from external memory.
2. Set the D bit of the page table entry in external memory to 1.
3. Write the value of the PPN field and the PR, SZ, C, D, SH, and V bits of the page table entry
in external memory to the PTEL register.
4. If using software for way selection for entry replacement, write the desired value to the RC field
in MMUCR.
5. Issue the LDTLB instruction to load the contents of PTEH and PTEL into the TLB.
6. Issue the RTE instruction to terminate the handler and return to the instruction stream. The
RTE instruction should be issued after two LDTLB instructions.
Figure 3.11 shows the flowchart for MMU exceptions.
73
Page 88
Start
TLB miss
exception
No
VPNs match?
PR checkPR check
00/011001/1100/1011
W
R/W?R/W?R/W?R/W?
No
No
Yes
User modePrivileged mode
RRRR
No
SH = 0
and (MMUCR.SV = 0
or SR.MD = 0)?
Yes
VPNs
and ASIDs
match?
Yes
V = 1?
Yes
User or
privileged?
WWW
D = 1?
No
TLB invalid
exception
74
TLB protection
Initial page
write
exception
Yes
violation
exception
No (noncacheable)Yes (cacheable)
Memory
access
C = 1?
Cache
access
Figure 3.11 MMU Exception Generation Flowchart
TLB protection
violation
Page 89
3.5.5Processing Flow in Event of MMU Exception (Same Processing Flow
for Address Error)
Figure 3.12 shows the MMU exception signals in instruction fetch mode.
IDEXMAWB
: Exception source stage
= Instruction fetch
IF
= Instruction decode
ID
= Instruction execution
EX
= Memory access
MA
= Write back
WB
= No operation
NOP
IF
IDEXMAWB
IDEXMAWB
MMU exception handler
NOP
NOP
IFIDEXMA WB
Handler transition
processing
Figure 3.12 MMU Exception Signals in Instruction Fetch
75
Page 90
Figure 3.13 shows the MMU exception signals in data access mode.
IFIDEX
IFIDEX
IFID
: Exception source stage
: Stage cancellation for instruction
that has begun execution
= Instruction fetch
IF
= Instruction decode
ID
= Instruction execution
EX
= Memory access
MA
= Write back
WB
= No operation
NOP
Figure 3.13 MMU Exception Signals in Data Access
MA WB
MA
WB
EXMAWB
IDEXMA WB
IDEX MAWB
IDEXMA WB
MMU exception handler
Handler transition
processing
NOP
NOP
IFIDEX MA WB
76
Page 91
3.6Memory-Mapped TLB
In order for TLB operations to be managed by software, TLB contents can be read or written to in
privileged mode using the MOV instruction. The TLB is assigned to the P4 area in virtual address
space. The TLB address array (VPN, V bit, and ASID) is assigned to H'F2000000–H'F2FFFFFF,
and the data array (PPN, PR, SZ, C, D, and SH bits) to H'F3000000–H'F3FFFFFF. The V bit in
the address array can also be accessed from the data array. Only longword access is possible for
both the address array and the data array.
3.6.1Address Array
The address array is assigned to H'F2000000 to H'F2FFFFFF. To access an address array, the
32-bit address field (for read/write operations) and 32-bit data field (for write operations) must be
specified. The address field specifies information for selecting the entry to be accessed; the data field
specifies the VPN, V bit and ASID to be written to the address array (figure 3.14 (1)).
In the address field, specify the entry address for selecting the entry (bits 16–12), W for selecting
the way (bits 9–8: 00 is way 0, 01 is way 1, 10 is way 2, 11 is way 3) and H'F2 to indicate
address array access (bits 31–24). The IX bit in MMUCR indicates whether an EX-OR is taken of
the entry address and ASID.
When writing, specify bit 7 as the A bit. The A bit indicates whether addresses are compared
during writing. When the A bit is 1, the VPNs of the four entries selected by the entry addresses
are compared to the VPN to be written into the address array specified in the data field. Writing
takes place to the way that has a hit. When a miss occurs, nothing is written to the address array
and no operation occurs. The way number specified in bits 9–8 is not used. The item compared is
determined by the SZ and SH bits of the entry selected by the entry address, the SV bit in
MMUCR and the MD bit in SR, just as in ordinary operations (see section 3.3.3).
When the A bit is 0, it is written to the entry selected with the entry address and way number
without comparing addresses.
When reading, the VPN (31–17, 11–10), V bit, and ASID of the entry specified by the entry
address and way number are read in the format of the data field in figure 3.14 without comparing
addresses. Zero is read in the data field (16–12).
To invalidate a specific entry, specify the entry and write 0 to its V bit. When 1 is specified for the
A bit, only the required VPN entry is invalidated.
77
Page 92
3.6.2Data Array
The data array is assigned to H'F3000000 to H'F3FFFFFF. To access a data array, the 32-bit
address field (for read/write operations), and 32-bit data field (for write operations) must be
specified. These are specified in the general register. The address section specifies information for
selecting the entry to be accessed; the data section specifies the longword data to be written to the
data array (figure 3.14 (2)).
In the address section, specify the entry address for selecting the entry (bits 16–12), W for selecting
the way (bits 9–8: 00 is way 0, 01 is way 1, 10 is way 2, 11 is way 3), and H'F3 to indicate data
array access (bits 31–24). The IX bit in MMUCR indicates whether an EX-OR is taken of the
entry address and ASID.
Both reading and writing use the longword of the data array specified by the entry address and way
number. The access size of the data array is fixed at longword.
78
Page 93
(1) TLB Address Array Access
Read access
3123
Address field
Data field
Write access
Address field
Data field
(2) TLB Data Array Access
Read/write access
Address field
Data field
11110010
3116
3123
11110010
31
Virtual page number
VPN:
Valid bit
V:
Association bit
A:
Way (00: Way 0, 01: Way 1, 10: Way 2, 11: Way 3)
W:
312324
11110011
31
24
24
VPN
*
PPN
17
16
VPN
**
17
17
16
VPN
*
17
16121011
**
1617
VPN
**
10
121011897
*
*
1011897
12
VPN
121011897
*
*
VPN
*
ASID::Address space identifier
*
121011897
*
*
897654 3 2 1 0
6
0
W
*
ASID0VVPN00
60
W
A
8970
V
Don’t care bit
W
ASID
*
DC SHPR SZ
0
*
0
**
0
*
XVXX
Valid bit
Physical page number
PPN:
Protection key field
PR:
Cacheable bit
C:
Share status bit
SH:
Virtual page number
VPN:
0 for read, don’t care bit for write
X:
Way (00: Way 0, 01: Way 1, 10: Way 2, 11: Way 3)
W:
Figure 3.14 Specifying Address and Data for Memory-Mapped TLB Access
V:
SZ:
D:
:
*
Page size bit
Dirty bit
Don’t care bit
79
Page 94
3.6.3Usage Examples
Invalidating Specific Entries: Specific TLB entries can be invalidated by writing 0 to the
entry’s V bit. When the A bit is 1, the VPN and ASID specified by the write data is compared to
the VPN and ASID within the TLB entry selected by the entry address and data is written to the
matching way. If no match is found, there is no operation. R0 specifies the write data and R1
specifies the address.
; R0=H'1547 381C R1=H'F201 3080
; MMUCR.IX=0
; VPN(31–17)=B'0001 0101 0100 011 VPN(11–10)=B'10 ASID=B'0001 1100
; corresponding entry association is made from the entry selected by
; the VPN(16–12)=B'1 0011 index, the V bit of the hit way is cleared to
; 0,achieving invalidation.
MOV.L R0,@R1
Reading the Data of a Specific Entry: This example reads the data section of a specific
TLB entry. The bit order indicated in the data field in figure 3.14 (2) is read. R0 specifies the
address and the data section of a selected entry is read to R1.
; R0=H'F300 4300 VPN(16-12)=B'00100 Way 3
; MOV.L @R0,R1
3.7Usage Note
Instructions that manipulate the MD or BL bit in register SR (the LDC Rm, SR instruction, LDC
@Rm+, SR instruction, and RTE instruction) and the following instruction, or the LDTLB
instruction, should be used with the TLB disabled or in a fixed physical address space (the P1 or P2
space).
80
Page 95
Section 4 Exception Handling
4 .1Overview
4.1.1Features
Exceptions are deviations from normal program execution that require special handling. The
processor responds to an exception by aborting execution of the current instruction (execution is
allowed to continue to completion in all interrupt requests) and passing control from the
instruction stream to the appropriate user-written exception handling routine. Here, all exceptions
other than resets and interrupts will be called general exceptions. There are thus three types of
exceptions: resets, general exceptions, and interrupts.
4.1.2Register Configuration
A register with an undefined initial value should be initialized by software. Table 4.1 lists the
registers used for exception handling.
Usually the contents of the program counter (PC) and status register (SR) are saved in the saved
program counter (SPC) and saved status register (SSR), respectively, and execution of the
exception handler is invoked from a vector address. The return from exception handler (RTE)
instruction is issued by the exception handler routine at the completion of the routine, restoring
the contents of the PC and SR to return to the processor status at the point of interruption and the
address where the exception occurred.
81
Page 96
A basic exception processing sequence consists of the following operations:
• The contents of the PC and SR are saved in the SPC and SSR, respectively.
• The block (BL) bit in SR is set to 1, masking any subsequent exceptions.
• The mode (MD) bit in SR is set to 1 to place the SH7708 Series in privileged mode.
• The register bank (RB) bit in SR is set to 1.
• An encoded value identifying the exception event is written to bits 11–0 of the exception event
(EXPEVT) or interrupt event (INTEVT) register.
• Instruction execution jumps to the designated exception processing vector address to invoke the
handler routine.
4.2.2Exception Handling Vector Addresses
The reset vector address is fixed at H'A0000000. The other three events are assigned offsets from
the vector base address by software. Translation lookaside buffer (TLB) miss exceptions have an
offset from the vector base address of H'00000400. The vector address offset for general exception
events other than TLB miss exceptions is H'00000100. The interrupt vector address offset is
H'00000600. The vector base address is loaded into the vector base register (VBR) by software. The
vector base address should reside in P1 or P2 fixed physical address space. Figure 4.1 shows the
relationship between the vector base address, the vector offset, and the vector table.
VBR
+ Vector offset
H'A000 0000
Vector table
Figure 4.1 Vector Table
In table 4.2, exceptions and their vector addresses are listed by exception type, instruction
completion status, relative acceptance priority, relative order of occurrence within an instruction
execution sequence and vector address for exceptions and their vector addresses.
82
Page 97
Table 4.2 Vectored Exception Events
Exception
Type
Current
InstructionException Event Priority*
1
Exceptio
n Order
Vector
Address
Vector
Offset
ResetAbortedPower-on1—H'A00000000 —
Manual reset1—H'A00000000 —
General
exception
events
Aborted
and retried
Address error
(instruction access)
TLB miss (instruction
21—H'00000100
22—H'00000400
access)
TLB invalid
23—H'00000100
(instruction access)
TLB protection
24—H'00000100
violation
(instruction access)
Reserved instruction
25—H'00000100
code exception
Illegal slot
25—H'00000100
instruction exception
Address error
26—H'00000100
(data access)
TLB miss
27—H'00000400
(data access)
TLB invalid (data
28—H'00000100
access)
TLB protection
29—H'00000100
violation
(data access)
Initial page write210—H'00000100
CompletedUnconditional trap
25—H'00000100
(TRAPA instruction)
User breakpoint trap 2n *
2
—H'00000100
83
Page 98
Table 4.2 Vectored Exception Events (cont)
Exception
Type
General
interrupt
requests
Notes: 1. Priorities are indicated from high to low, 1 being highest and 4 being lowest.
Current
InstructionException Event Priority*
CompletedNonmaskable
interrupt
External hardware
interrupt
Peripheral module
interrupt
2. The user defines the break point traps. 1 is a break point before instruction execution
and 11 is a break point after instruction execution. For an operand break point, use 11.
3. Use software to specify relative priorities of external hardware interrupts and peripheral
module interrupts (see section 6, Interrupt Controller (INTC)).
1
3——H'00000600
3
4*
3
4*
Exceptio
n Order
——H'00000600
——H'00000600
Vector
Address
Vector
Offset
4.2.3Acceptance of Exceptions
Processor resets and interrupts are asynchronous events unrelated to the instruction stream. All
exception events are prioritized to establish an acceptance order whenever two or more exception
events occur simultaneously. The power-on reset and manual reset may not occur simultaneously,
so they have the same priority.
All general exception events occur in a relative order in the execution sequence of an instruction
(i.e., execution order), but are handled at priority level 2 in instruction-stream order (i.e., program
order), where an exception detected in a preceding instruction is accepted prior to an exception
detected in a subsequent instruction.
Three general exception events (reserved instruction code exception, unconditional trap, and illegal
slot instruction exception) are detected in the decode stage of different instructions and are mutually
exclusive events in the instruction pipeline. They have the same execution priority. Figure 4.2
shows the order of general exception acceptance.
84
Page 99
Pipeline Sequence:
IFInstruction nIDEXMA
IFInstruction n + 1
IDEXMA
TLB miss (instruction access)
Instruction n + 2
Detection Order:
TLB miss (instruction n+1)
TLB miss (instruction n) and RIE (instruction n + 2) = simultaneous detection
Handling Order:Program Order:
TLB miss (instruction n)
Re-execution of instruction n
TLB miss (instruction n + 1)
IFIDEXMA
WB
TLB miss (data access)
WB
WB
RIE (reserved instruction exception)
1
2
Re-execution of instruction n + 1
RIE (instruction n + 2)
= Instruction fetch
IF
= Instruction decode
ID
= Instruction execution
EX
= Memory access
MA
= Write back
WB
3
Figure 4.2 Example of Acceptance Order of General Exceptions
All exceptions other than a reset are detected in the pipeline ID stage, and accepted on instruction
boundaries. However, an exception is not accepted between a delayed branch instruction and the
delay slot. A re-execution type exception detected in a delay slot is accepted before execution of the
delayed branch instruction. A completion type exception detected in a delayed branch instruction or
delay slot is accepted after execution of the delayed branch instruction. The delay slot here refers to
85
Page 100
the next instruction after a delayed unconditional branch instruction, or the next instruction when a
delayed conditional branch instruction is true.
4.2.4Exception Codes
Table 4.3 lists the exception codes written to bits 11–0 of the EXPEVT register (for reset or
general exceptions) or the INTEVT register (for general interrupt requests) to identify each specific
exception event. An additional exception register, the TRAPA (TRA) register, is used to hold the
8-bit immediate data in an unconditional trap (TRAPA instruction).
Table 4.3 Exception Codes
Exception TypeException EventException
Code
ResetPower-onH'000
Manual resetH'020
General exception eventsTLB miss/invalid (load)H'040