Subversion Repositories eco32

\chapter{ECO32 Architecture}
\mylabel{architecture}
 
The \eco is a general-purpose 32-bit RISC processor. Its instruction set is tailored to handle only the most basic computation steps at once, and to allow arbitrary combination of these basic steps for full flexibility. Instructions are executed sequentially. The \eco also includes the basic mechanisms to implement modern operating systems, such as interrupts, privileged instructions, and virtual memory. Operations on floating-point data types are not supported.
 
The \eco is a soft-core that must be used in a larger system-on-chip (SoC) design inside a field programmable gate array (FPGA). The \eco is connected to other on-chip resources using a uniform SoC bus architecture. These resources include a RAM controller, a ROM controller, and peripheral devices such as coprocessors, communication controllers, and controllers for external devices.
 
\section{Data Types}
\mylabel{data_types}
 
The following basic data types are processed by the \eco:
\begin{itemize}
\item \definition{Byte}: A unit of 8 bits
\item \definition{Half-Word}: A unit of 16 bits
\item \definition{Word}: A unit of 32 bits
\end{itemize}
The bits of each unit are written down starting from the most-significant bit to the least significant bit.
 
The size of the basic units allows the arrangement of bytes as half-words, or of bytes or half-words as words. Two common kinds of arrangements are defined for sequences of bytes or half-words. Let $a = (a_7, ..., a_0)$, $b = (b_7, ..., b_0)$, $c = (c_7, ..., c_0)$, and $d = (d_7, ..., d_0)$ be byte values, and $p = (p_{15}, ..., p_0)$ and $q = (q_{15}, ..., q_0)$ be half-word values. 
\begin{itemize}
\item \definition{Big Endian} arrangement maps
\begin{itemize}
\item the byte sequence $(a, b)$ to the half-word $(a_7, ..., a_0, b_7, ..., b_0)$,
\item the byte sequence $(a, b, c, d)$ to the word\\$(a_7, ..., a_0, b_7, ..., b_0, c_7, ..., c_0, d_7, ..., d_0)$, and
\item the half-word sequence $(p, q)$ to the word $(p_{15}, ..., p_0, q_{15}, ..., q_0)$.
\end{itemize}
\item \definition{Little Endian} arrangement maps
\begin{itemize}
\item the byte sequence $(a, b)$ to the half-word $(b_7, ..., b_0, a_7, ..., a_0)$, 
\item the byte sequence $(a, b, c, d)$ to the word\\$(d_7, ..., d_0, c_7, ..., c_0, b_7, ..., b_0, a_7, ..., a_0)$, and
\item the half-word sequence $(p, q)$ to the word $(q_{15}, ..., q_0, p_{15}, ..., p_0)$.
\end{itemize}
\end{itemize}
 
When units of several bits are interpreted as numbers, two different schemes are used. An \definition{unsigned} interpretation maps the bits $(a_N, ..., a_0)$ to the number $\sum_{i=0}^N a_i2^i$. A \definition{signed} (or \definition{two's complement}) interpretation maps the same bit sequence to the number $-a_N2^N + \sum_{i=0}^{N-1}a_i2^i$.
 
The functions $signed$ and $unsigned$ shall denote signed and unsigned interpretation of a bit sequence as a number, respectively.
 
A bit sequence $(a_N, ..., a_0)$ is \definition{truncated} to $M \leq N$ bits by taking the bit sequence $(a_M, ..., a_0)$. The same bit sequence is \definition{zero-extended} to $P \geq N$ bits by taking $(0, ..., 0, a_N, ..., a_0)$, or \definition{sign-extended} to $P$ bits by taking $(a_N, ..., a_N, a_{N-1}, ..., a_0)$. Zero-extension and sign-extension preserve the unsigned or signed interpretation, respectively, if the value can be represented in the target number of bits at all.
 
The function $truncate_N$ shall denote truncation to $N$ bits, $zeroext_N$ shall denote zero-extension to $N$ bits, and $signext_N$ shall denote sign-extension to N bits.
 
\section{Addresses}
\mylabel{addresses}
 
An \definition{address} is a 32-bit unsigned value that indicates a location in RAM, ROM, or in a peripheral device. An address is \definition{half-word-aligned} if it is divisible by 2, that is, its least significant bit is 0. An address is \definition{word-aligned} if it is divisible by 4, that is, its two least significant bits are 0. The design of the \eco ensures that all accesses to the RAM, ROM, or to peripheral devices are aligned with respect to the transferred data size.
 
The \eco distinguishes \name{virtual} and \name{physical} addresses. Virtual addresses are generated by a program to address RAM or device locations. Virtual addresses are converted to physical addresses by the memory management unit. Finally, physical addresses select locations in RAM, ROM, or peripheral devices. See \myref{2}{mmu} for details.
 
The mapping is always defined in such a way that a virtual address is half-word (word) aligned if and only if the corresponding physical address is. Any attempt to access a half-word (word) sized location at an address that is not half-word (word) aligned is called a \definition{misaligned} access and triggers a fault.
 
Each physical address in the range 0x00000000 through 0x2FFFFFFF selects a byte-sized location in RAM or ROM. Each half-word (word) aligned address in that range selects a half-word (word) in RAM or ROM comprising the corresponding byte locations in a big-endian fashion.
 
Each word-aligned physical address in the range 0x30000000 through 0x3FFFFFFF selects a word-sized location in a peripheral device. Byte or half-word sized access to peripheral devices is not allowed and the effect of such accesses on the device and on values read is undefined.
 
Physical addresses in the range 0x40000000 through 0xFFFFFFFF are not used.
 
\section{Program Counter (PC)}
\mylabel{pc}
 
The \pc is a 32-bit virtual address register that contains the address of the next instruction to execute. Each instruction is 32 bits, or 4 bytes wide. An instruction is \definition{fetched} by loading a word value from the virtual address given by the \pcx, then incrementing it by 4 (thus moving to the next instruction). If the execution of the instruction later modifies the \pcx, it is this new value that is modified.
 
\section{General-Purpose Registers}
\mylabel{general_purpose_registers}
 
Most data processing occurs in a set of 32 general-purpose registers, each 32 bits wide. Instructions exist to perform arithmetic operations, logic operations, multiplication and division, and data type conversion. Such operations load the operands from general-purpose registers, perform the computation, and store the result back in a general-purpose register. General-purpose registers also hold the addresses and data for transfers to and from RAM, ROM, and peripheral devices. The interpretation of a value in a general-purpose register as data or address depends solely on the instructions that operate on that value -- the value itself is an untyped 32-bit unit.
 
Some general-purpose registers have a special function in addition to their
regular behaviour:
\begin{itemize}
\item Register \#0 is not actually backed by a physical register. Reading from
this register always yields the value 0. Writing to this register has no
effect. Register \#0 can be exploited in various cases where a value of zero is
needed in a register, without first loading that value into a register.
\item Registers \#1 through \#29 do not serve any special purpose.
\item Register \#30 is used to store the return address when an exception occurs.
That value is later used by the exception service routine to return to the
place where the exception had occurred. At any time when interrupts are
enabled, this register may not be used, because its value could be overwritten
by an unexpected interrupt.
\item Register \#31 is used to store the return address in a subroutine call.
\end{itemize}
 
\section{Load/Store Architecture}
\mylabel{load_store_architecture}
 
Specific instructions exist to transfer data to or from RAM, ROM, or peripheral devices. No such data transfer occurs except for these instructions, as well as instruction fetching itself. That is, all other instructions operate entirely inside the \eco.
 
A \definition{load} instruction transfers data from an external source into a general-purpose register. A \definition{store} instruction transfers data from a general-purpose register to an external target. The virtual address of the external source or target is determined by taking the value of a general-purpose register and adding a constant value that is encoded into the instruction.
 
Load and store instructions come in variants of word, half-word, and byte transfers with respect to the size of the transferred data. The address computation is not affected by the transfer size, but the resulting address must be aligned to the transfer size. A word transfer affects a full 32-bit general purpose register. A half-word or byte store instruction transfers only the lower 16 or 8 bits, respectively. An unsigned half-word load instruction loads 16 bits from an external source, zero-extends it to 32 bits, and stores the result in a general-purpose register. Similarly, a signed half-word load instruction sign-extends the value to 32 bits. Byte-sized load instructions work analogously.
 
\section{Special-Purpose Registers}
\mylabel{special_purpose_registers}
 
The \eco contains a set of special-purpose registers that are not used for computation, address generation, or data transfer. Instead, these registers control operation of the processor itself. Special purpose registers are accessed with the MVFS and MVTS instructions.
 
The following special-purpose registers are present in the \ecox:
 
\begin{tabular}{|c|c|}
\hline
Index & Name\\
\hline
0 & PSW\\
\hline
1 & TLB Index\\
\hline
2 & TLB Entry High\\
\hline
3 & TLB Entry Low\\
\hline
4 & TLB Bad Address\\
\hline
\end{tabular}
 
The first special register is the processor status word (\pswx). This register contains the main control parameters for the processor. See \myref{2}{psw} for details. The \psw can only be accessed from Kernel Mode.
 
The remaining special-purpose registers are used to communicate with the memory management unit. See \myref{2}{mmu} for details. The \mmu registers can only be accessed from Kernel Mode.
 
\section{Processor Status Word (PSW)}
\mylabel{psw}
 
The \psw controls execution in various way. It is actually a collection of fields, each of which has its own purpose and effect:
 
\begin{tabular}{|c|c|l|}
\hline
Bit Index & Name & Meaning\\
\hline
31..28 & --- & (ignored) \\
27 & $V$ & Exception Service Routine Vector. \\
26 & $U_C$ & Current privilege mode.\\
25 & $U_P$ & Previous privilege mode.\\
24 & $U_O$ & Old privilege mode.\\
23 & $I_C$ & Current global interrupt enable.\\
22 & $I_P$ & Previous global interrupt enable.\\
21 & $I_O$ & Old global interrupt enable.\\
20..16 & $EID$ & Exception identifier.\\
15..0 & $IEN$ & Channel-specific interrupt enable.\\
\hline
\end{tabular}
 
\subsection{Exception Service Routine Vector}
\mylabel{v_bit}
 
The $V$ bit of the \psw specifies the address of the exception service routines. If the V bit is 0, then service routines are located at a high physical address that lies at the beginning of the ROM. If the V bit is 1, then service routines are located at a low physical address that lies at the beginning of the RAM. See \myref{2}{service_routine_address} for details.
 
\subsection{Privilege Modes}
\mylabel{privilege_modes}
 
The $U_C$, $U_P$, and $U_O$ bits of the \psw form a three-level stack, with $U_C$ at the top. A bit value $X$ is \definition{pushed on} that stack by the following sequence:
\begin{itemize}
\item[] $U_O \leftarrow U_P$
\item[] $U_P \leftarrow U_C$
\item[] $U_C \leftarrow X$
\end{itemize}
A value is \definition{popped off} the stack by the following sequence:
\begin{itemize}
\item[] $U_C \leftarrow U_P$
\item[] $U_P \leftarrow U_O$
\end{itemize}
 
Only $U_C$ affects execution directly. If $U_C$ is 0, then the \eco runs in \definition{Kernel Mode} and can access privileged instructions and privileged addresses. If $U_C$ is 1, then the \eco runs in \definition{User Mode}, and any attempt to access a privileged instruction or privileged address will result in a \name{Privileged Instruction Fault} or \name{Privileged Address Fault}, respectively. When any exception is accepted, a value of 0 is pushed onto the three-level stack to enter \name{Kernel Mode}, and $U_O$ is discarded. The RFX instruction pops the topmost value off the stack to restore the execution state before the exception.
 
A privileged address is any virtual address in the range 0x80000000 through 0xFFFFFFFF. This range is reserved for the operating system, and includes both a page-mapped range from 0x80000000 through 0xBFFFFFFF, and a direct-mapped range from 0xC0000000 through 0xFFFFFFFF. See \myref{2}{mmu} for details.
 
\subsection{Interrupt Enable}
\mylabel{ien}
 
The $I_C$, $I_P$, and $I_O$ bits of the \psw form a three-level stack, with $I_C$ at the top. A bit value $X$ is \definition{pushed on} that stack by the following sequence:
\begin{itemize}
\item[] $I_O \leftarrow I_P$
\item[] $I_P \leftarrow I_C$
\item[] $I_C \leftarrow X$
\end{itemize}
A value is \definition{popped off} the stack by the following sequence:
\begin{itemize}
\item[] $I_C \leftarrow I_P$
\item[] $I_P \leftarrow I_O$
\end{itemize}
 
Only $I_C$ affects execution directly. If $I_C$ is 0, then interrupts are globally disabled. If any device signals an interrupt while $I_C$ is 0, then admission of that interrupt is postponed. If $I_C$ is 1, then interrupts are globally enabled (note that interrupts may still be disabled on a per-channel basis, see below). When any exception is accepted, a value of 0 is pushed onto the three-level stack to disable all interrupts, and $I_O$ is discarded. The RFX instruction pops the topmost value off the stack to restore the execution state before the exception.
 
The $IEN$ field controls admission of interrupts on a per-channel basis. An interrupt is only  accepted if both the global $I_C$ and the corresponding bit of the $IEN$ are set. Otherwise, admission of the interrupt is postponed until this condition arises. An interrupt may be {\it overlooked} if the device negates the interrupt signal again before $I_C$ and the corresponding $IEN$ bit are both set.
 
\subsection{Exception Identifier}
\mylabel{eid}
 
When an exception is accepted, the $EID$ field of the \psw is loaded with a number that identifies the cause of the exception. The meaning of these numbers is defined in the following table:
 
\begin{tabular}{|l|l|}
\hline
Value & Meaning \\
\hline
0..15 & Device Interrupt 0..15\\
16 & Bus Timeout\\
17 & Illegal Instruction\\
18 & Privileged Instruction\\
19 & Division by Zero\\
20 & Trap Instruction\\
21 & TLB Miss\\
22 & TLB Write\\
23 & TLB Invalid\\
24 & Illegal Address\\
25 & Privileged Address\\
26..31 & (unused - never loaded by the hardware)\\
\hline
\end{tabular}
 
\section{Exceptions: Interrupts and Faults}
\mylabel{exceptions}
 
An \definition{Exception} is a control transfer from user code to operating system code. There are two kinds of exceptions: An \definition{Interrupt} occurs when a peripheral device needs the attention of the \ecox. A \definition{Fault} occurs when the execution of an instruction fails.
 
Interrupts are only accepted between the execution of two instructions, and only if the $I_C$ and $IEN$ fields of the \psw allow so (see \myref{2}{ien}). Operating system code can control these fields to disable interrupts during time-critical code sequences or to achieve mutual exclusion. Typically, the interrupt service routine communicates with the device that caused the interrupt, then returns to the interrupted code and continues its execution as if nothing had happened (except that register \#30 had been overwritten, see below). Register \#30 should not be used for computations, since it would lose its value during an unexpected interrupt.
 
Faults occur during the execution of an instruction. Typically, a fault service routine would either correct the problem and restart the failed instruction, or terminate the corresponding program. In certain cases, a fault indicates a voluntary control transfer to the operating system to perform some action on behalf of the user program. In that case, the fault service routine would not restart the faulting instruction, but return to the instruction immediately following it.
 
\subsection{Accepting an Exception}
\mylabel{accept_exception}
 
When an exception is accepted, the following steps are taken automatically by the \eco:
\begin{enumerate}
\item Store the return address in the general-purpose register \#30. For interrupts (which occur between two instructions), this is the address of the instruction directly following the occurence of the interrupt. For faults, this is the address of the faulting instruction. Note that although fetching the faulting instruction had already increased
the PC by 4, a fault subtracts 4 again to obtain the original address of that instruction.
\item Push 0 on the $(I_C, I_P, I_O)$ stack in the \psw to disable interrupts, and to remember the previous interrupt enable state.
\item Push 0 on the $(U_C, U_P, U_O)$ stack in the \psw to enter Kernel Mode, and to remember the previous privilege mode.
\item Set the $EID$ field of the \psw to the corresponding exception identifier (see \myref{2}{eid})
\item Load the address of the service routine into the PC register (see \myref{2}{service_routine_address})
\end{enumerate}
 
\subsection{Exception Service Routine Addresses}
\mylabel{service_routine_address}
 
The address of the exception service routine, that is, the value loaded into the \pcx, is determined as follows. First, a base address is computed depending on the value of the $V$ field of the \pswx. If the $V$ bit is 0, then the base address is E0000000. If the $V$ bit is 1, then the base address is C0000000. Since these addresses are loaded into the \pcx, they are virtual. With $V$ set to 0, the address is a direct-mapped address that denotes the physical address 0x20000000, i.e. the first address associated with the ROM. With $V$ set to 1, the address is a direct-mapped address that denotes the physical address 0x00000000, i.e. the first address associated with the RAM. The $V$ bit can therefore be used to handle exceptions in a service routine located in ROM directly after startup, as well as handle them in a service routine located in RAM once an operating system is loaded.
 
Next, the cause of the exception is inspected. One specific kind of fault, the User Space TLB Miss, is given special treatment. For this fault, the actual address of the service routine is (base address + 8). For all other faults, as well as for all interrupts, the address of the service routine is (base address + 4). This leaves only enough space for a single instruction at (base address + 4), which is therefore typically a jump instruction. The special treatment for User Space TLB misses allows very fast handling of such faults. 
 
\subsection{Returning Control}
\mylabel{rfx}
 
The exception service routine of the operating system can then handle the exception. When the service routine is finished, it typically returns control:
\begin{itemize}
\item An interrupt service routine would return to the saved address in register \#30 to continue the interrupted code.
\item A fault service routine that has corrected a problem with the faulting instruction would reutrn to the saved address in register \#30 to restart that instruction.
\item A fault service routine that could not correct the problem would not return control. What happens in that case depends on the operating system architecture.
\item A fault service routine that performs an action on behalf of a user code request would not return to the faulting instruction, but to the instruction immediately following it. This can be achieved by adding 4 to register \#30 before returning.
\end{itemize}
 
A single instruction called RFX (return from exception) handles all these cases. This instruction performs the following sequence:
\begin{enumerate}
\item Load the value in register \#30 into the PC.
\item Restore the remembered state of the interrupt enable flag and privilege mode by popping the top value off the $(I_C, I_P, I_O)$ and $(U_C, U_P, U_O)$ stacks.
\end{enumerate}
 
\section{Memory Management Unit (MMU)}
\mylabel{mmu}
 
All addresses generated by the \ecox, including both the \pc as well as those from load and store instructions, are \definition{virtual} addresses. These addresses are transformed to \definition{physical} addresses by the memory management unit (MMU). The physical addresses are finally sent over the SoC bus to the memory controller or to peripheral hardware.
 
The memory management unit (MMU) distinguishes two parts of the virtual address space and uses different mapping algorithms for them. The page-mapped space ranges from virtual address 0x00000000 through 0xBFFFFFFF. The direct-mapped space ranges from virtual address 0xC0000000 through 0xFFFFFFFF. Note that this leaves the direct-mapped space entirely in the range of privileged addresses, such that only operating system code can access direct-mapped addresses.
 
\subsection{Direct-Mapped Space}
 
Virtual addresses in the direct-mapped space are transformed to physical addresses by subtracting the start address of that space, 0xC0000000. Thus, the direct-mapped space can be used to directly access any RAM, ROM, or device location in the physical address space.
 
\subsection{Page-Mapped Space}
 
Virtual addresses in the page-mapped space are subdivided into blocks of 4096 bytes called \definition{pages}. Each page is a continuous range of 4096 virtual addresses, and is mapped to a continuous range of 4096 physical addresses called a \definition{page frame}. Both pages and page frames are aligned to their size. Thus, in the page-mapped space, the upper 20 bits of the physical address (the \definition{page frame number}) are computed through a mapping function from the upper 20 bits of the virtual address (the \definition{page number}), and the 12 lower bits of the physical address are directly taken from the 12 lower bits of the virtual address.
 
The mapping function from pages to page frames can be defined and implemented freely by the operating system. No overall representation of the mapping is implemented by the \eco itself. Specifically, the \eco does not have a notion of a \name{page table} as found in other architectures. Instead, the mapping of pages to page frames is defined by a software function implemented by the operating system, and the results of that function are cached in a special memory called the \definition{translation look-aside buffer} (\definition{TLB}).
 
\subsection{Translation Lookaside Buffer (TLB)}
 
The TLB is a table of 32 entries, each mapping a 20-bit page number to a 20-bit page frame number. Both numbers are stored in an entry. When accessing a page-mapped virtual address, the TLB is searched for the page number. If an entry is found, then its page frame number is concatenated with the 12-bit page local address to yield the physical address. It is an error to have two entries with the same virtual page number, and the result of the mapping is undefined in that case. Having two entries with the same physical page number is fine however, and can be used to {\it mirror} a physical page frame at multiple virtual pages.
 
A full page mapping function is defined by $(2^{20} - 2^{18})$ mappings of pages to page frames. The 32 TLB entries contain a subset of these mappings, preferably those that are most needed in the near future. By writing to the TLB, a different subset can be loaded. It is also possible to change the mapping function itself by removing (overwriting) the old TLB entries and filling in the mappings of the new function.  The \eco is not concerned with the notion of the overall mapping function, but simply searches the TLB for a matching page number.
 
Each TLB entry always contains a mapping from a virtual page to a physical page frame. However, entries can be effectively {\it blanked} by entering a never-occuring page number. For example, virtual addresses in the range 0xC0000000 through 0xFFFFFFFF are direct-mapped, and thus never occur as virtual addresses in a TLB lookup.
 
In no entry is found in a lookup, a \name{TLB Miss Fault} occurs. This is either a \name{User Space TLB Miss} if the virtual address is in the range 0x00000000 through 0x7FFFFFFF (that is, it is an unprivileged address), or a \name{Kernel Space TLB Miss} if the virtual address is in the range 0x80000000 through 0xBFFFFFFF (that is, it is a privileged address). The control transfer to the service routine works slightly different for privileged and unprivileged addresses (see \myref{2}{service_routine_address}). The service routine for \name{TLB Miss Faults} typically loads an appropriate mapping into the TLB, then executes the RFX instruction to restart the failed instruction. In terms of an overall mapping function, the TLB miss service routine moves the TLB to a different subset of the mapping function, such that the new subset contains the faulting address.
 
\subsection{TLB Entry Flags}
 
TLB entries may be flagged {\it valid} (the {\it valid} flag is set) or {\it invalid} (the {\it valid} flag is not set), and they may be flagged {\it writeable} (the {\it write} flag is set) or {\it write-protected} (the {\it write} flag is not set). These flags only come to effect in a TLB entry whose page number is found during a lookup. If the valid flag is not set for such an entry, then a \name{TLB Invalid Fault} is triggered. If the write flag is not set for such an entry and the access is a write access, then a \name{TLB Write Fault} is triggered. Otherwise, the access succeeds. 
 
Note that the name of the {\it valid} flag is slightly misleading. The name might suggest that unsetting this flag marks a TLB entry as invalid and causes the lookup algorithm to overlook that entry. However, unsetting the {\it valid} flag actually marks the corresponding {\it page} as invalid and does not interfere with the lookup algorithm; instead, when the entry is found during lookup, it triggers a \name{TLB Invalid Fault}. To mark a TLB entry invalid and thus cause the lookup algorithm to overlook that entry, place an unused virtual page number into the entry, such as a page number from the direct-mapped virtual address range (0xC0000000 through 0xFFFFFFFF).
 
\subsection{Random Replacement and Fixed TLB Entries}
\mylabel{tlb_random}
 
The TLB miss service routine typically replaces a TLB entry with a mapping for the faulting address, then restarts the faulting instruction. The question remains which entry to replace. The optimal strategy would be to modify the TLB in such a way that, out of the total $(2^{20} - 2^{18})$ mappings, it contains the 32 entries most needed in the near future. It has been shown that replacing random entries moves towards that set quite quickly. Therefore, the \eco is designed to replace a random TLB entry easily, using a simple hardware random-number generator.
 
However, for certain purposes it is useful to exclude some TLB entries from being indexed by such random numbers. Therefore, the \eco has 4 \definition{fixed} TLB entries at index 0..3, and 28 non-fixed TLB entries at index 4..31. Random replacement always chooses one of the non-fixed entries. The mapping stored in the fixed entries can only be changed by accessing them directly, i.e. not by random indexing.
 
\subsection{TLB Access Registers}
 
A set of special purpose registers is used to communicate with the TLB. The primary use for these registers is loading an entry into the TLB within a TLB Miss service routine. Another use would be to blank all TLB entries to move to a different overall mapping function. The TLB access registers are special-purpose registers that must be accessed with the MVFS and MVTS instructions. The special TBS, TBWR, TBRI, and TBWI instructions causes the actual operations between these registers and the TLB.
 
The purpose of these registers is as follows:
\begin{itemize}
\item the TLB Index Register contains the \definition{Index} of an entry that is read with the next TLB read-by-index instruction (TBRI), written with the next TLB write-by-index instruction (TBWI), or found by the TLB search instruction (TBS). The index is a number in the range 0..31.
\item the TLB Entry High Register contains the {\it high} part of an entry that was read or shall be written. The high part of an entry contains the virtual page number of that entry in the upper 20 bits. The lower 12 bits are ignored. After a \name{TLB Miss Fault}, \name{TLB Invalid Fault}, or \name{TLB Write Fault}, the TLB Entry High register contains the faulting page number.
\item the TLB Entry Low Register contains the {\it low} part of an entry that was read or shall be written. The low part of an entry contains the physical page frame number of that entry in the upper 20 bits. It also contains the valid flag of that entry in bit 0, and the write-protection flag in bit 1. The remaining bits are ignored.
\item the TLB Bad Address Register contains the faulting address after an \name{Invalid Address Fault}, \name{Privileged Address Fault}, \name{TLB Miss Fault}, \name{TLB Invalid Fault}, or \name{TLB Write Fault}.
\end{itemize}
 
\section{Overall Memory Map}
\mylabel{memory_map}
 
Taking all rules into account, the \eco distinguishes the following virtual address ranges:
\begin{itemize}
\item 0x00000000 through 0x7FFFFFFF: Page-mapped User Space
\item 0x80000000 through 0xBFFFFFFF: Page-mapped Kernel Space
\item 0xC0000000 through 0xDFFFFFFF: Direct-mapped Kernel Space, maps to RAM
\item 0xE0000000 through 0xEFFFFFFF: Direct-mapped Kernel Space, maps to ROM
\item 0xF0000000 through 0xFFFFFFFF: Direct-mapped Kernel Space, maps to peripheral devices
\end{itemize}
 
\section{Reset State}
\mylabel{reset_state}
 
After a hardware reset, the \eco is in the following state:
\begin{itemize}
\item the general-purpose registers contain undefined values (except for register \#0, which is not backed by a physical register, and always has the value 0).
\item all bits of the \psw are set to 0, indicating in particular
\begin{itemize}
\item that the exception service routines are located at virtual addresses 0xE0000004 and 0xE0000008 (at the beginning of the ROM)
\item that interrupts are globally disabled and that all interrupt channels are individually disabled
\item that the \eco executes in Kernel Mode
\end{itemize}
\item the \pc is set to 0xE0000000, i.e. the first address in ROM. This location typically contains a jump instruction to escape the general exception service routine at 0xE0000004.
\end{itemize}