MIPS System Control (Coprocessor 0) and the TLB

Introduction

Coprocessor 0 is the system control coprocessor: exceptions, interrupts, the memory-management unit with its TLB and the caches. Its registers are read and written only by the instructions below and, apart from a few, only in kernel mode. The explorer decodes the instructions; the register number in mfc0 $v0, $12, 0 is named in the detail line.

Register moves

Instruction	Encoding	ISA	What it does
`mfc0 rt, rd[, sel]`	`010000 00000 rt rd 0 sel`	MIPS I	Copy coprocessor 0 register `rd` (select `sel`, from MIPS32) to `rt`. A load delay slot on MIPS I.
`mtc0 rt, rd[, sel]`	`010000 00100 rt rd 0 sel`	MIPS I	Write `rt` to the register. Hazards: the effect may take several instructions (`ehb` waits for it on Release 2).
`dmfc0 rt, rd[, sel]`	`010000 00001 rt rd 0 sel`	MIPS III	Copy the 64-bit register.
`dmtc0 rt, rd[, sel]`	`010000 00101 rt rd 0 sel`	MIPS III	Write the 64-bit register.
`rdpgpr rd, rt`	`010000 01010 rt rd 0`	Release 2	Read general register `rt` of the previous shadow register set into `rd`.
`wrpgpr rd, rt`	`010000 01110 rt rd 0`	Release 2	Write `rt` to general register `rd` of the previous shadow set.
`di [rt]`	`010000 01011 rt 01100 00000 0 00000`	Release 2	Disable interrupts; `rt` receives the old Status register. Atomic.
`ei [rt]`	`010000 01011 rt 01100 00000 1 00000`	Release 2	Enable interrupts.
`dvp [rt]`	`010000 01011 rt 00000 00000 1 00100`	Release 6	Disable virtual processors (multithreading); `rt` gets the old state.
`evp [rt]`	`010000 01011 rt 00000 00000 0 00100`	Release 6	Enable virtual processors.

The TLB and exception return

Encoding: 010000 1 0…0 function. The R3000 has a 64-entry TLB with 4 KB pages; the R4000 a paired-entry TLB (EntryLo0 and EntryLo1) with variable page sizes; the PlayStation CPU has no TLB at all.

Instruction	Function	ISA	What it does
`tlbr`	`000001`	MIPS I	Read the TLB entry selected by Index into EntryHi, EntryLo and PageMask.
`tlbwi`	`000010`	MIPS I	Write those registers into the entry selected by Index.
`tlbinv`	`000011`	Release 3 and later	Invalidate the TLB entries that match EntryHi (and the address-space ID).
`tlbinvf`	`000100`	Release 3 and later	Invalidate every TLB entry. llvm has neither TLBINV instruction in these configurations.
`tlbwr`	`000110`	MIPS I	Write into the entry selected by Random: the usual refill.
`tlbp`	`001000`	MIPS I	Probe: find the entry that matches EntryHi and put its number (or the P bit) in Index.
`rfe`	`010000`	MIPS I to III	Restore from exception: pop the three-level mode and interrupt-enable stack in Status (the R3000 returns by `jr $k0` with `rfe` in its delay slot). The PlayStation uses this.
`eret`	`011000`	MIPS III and later	Return from exception: jump to EPC (or ErrorEPC) and clear the exception level. No delay slot. llvm and some tools show it as `eret`.
`deret`	`011111`	MIPS32	Return from debug exception.
`wait [code]`	`100000`	MIPS32	Stop the pipeline until an interrupt: low-power idle. llvm decodes `wait` only in a few configurations.

The coprocessor 0 registers

MIPS32 and MIPS64 (the names the explorer shows for select 0, with the common selects):

Number	Name	What it holds
0	Index	The TLB entry that tlbr and tlbwi use, and the result of tlbp.
1	Random	A counter that picks the entry for tlbwr.
2, 3	EntryLo0, EntryLo1	The physical page number and flags of the even and odd page.
4	Context	A pointer into the page table, set up for a quick TLB refill.
5	PageMask	The page size.
6	Wired	How many entries are protected from tlbwr.
7	HWREna	Which hardware registers rdhwr may read in user mode.
8	BadVAddr	The address that caused the last address or TLB exception.
9	Count	A timer that counts at half the pipeline clock or as the chip defines.
10	EntryHi	The virtual page number and address-space ID.
11	Compare	The timer interrupt fires when Count equals it.
12	Status	Interrupt masks, the interrupt-enable and kernel/user mode bits, the coprocessor-usable bits, FR for the FPU.
13	Cause	The exception code, pending interrupts and the branch-delay bit (BD).
14	EPC	The address to return to after the exception (the branch when the instruction was in a delay slot).
15	PRId	The processor type and revision.
16	Config	The chip's configuration; Config1 to Config3 are selects 1 to 3.
17	LLAddr	The address of the last `ll`.
18, 19	WatchLo, WatchHi	A watchpoint address.
20	XContext	The 64-bit page table pointer.
23, 24	Debug, DEPC	The EJTAG debug registers.
26, 27	ECC, CacheErr	Cache error handling.
28, 29	TagLo, TagHi	The cache tag registers used by `cache`.
30	ErrorEPC	The return address after an error exception.
31	DESAVE	Scratch for the debug handler.

The PlayStation R3000A

The PlayStation's coprocessor 0 has no TLB registers. Its registers (from the nocash PSX specifications):

Number	Name	What it holds
3	BPC	The breakpoint address for code.
5	BDA	The breakpoint address for data.
6	JUMPDEST	The target of the last jump taken (for the debugger).
7	DCIC	The debug control: which breakpoints are on.
8	BadVaddr	The faulting address.
9	BDAM	The mask for the data breakpoint address.
11	BPCM	The mask for the code breakpoint address.
12	SR	The status register: interrupt mask, the mode stack, which coprocessors are usable, cache isolation (bit 16).
13	CAUSE	The exception code and pending interrupts.
14	EPC	The return address.
15	PRID	The processor identification.

Not described

Known, not yet covered

Reference: the bit layout of Status, Cause, Config and EntryLo, the exception codes and the exception vectors, which are chip manual material.
Reference: the VR4300's own coprocessor 0 registers (for example Config's N64-specific bits) and its TLB details; the VR4300 manual was not read.
Reference: the MT, VZ and EVA coprocessor 0 instructions (mftr, mttr, hypcall, mfgc0, tlbginv and others).

Unknown

Reference: none known.