ctlreg.h revision 1.17 1 /* $NetBSD: ctlreg.h,v 1.17 1998/09/06 21:38:36 pk Exp $ */
2
3 /*
4 * Copyright (c) 1996
5 * The President and Fellows of Harvard College. All rights reserved.
6 * Copyright (c) 1992, 1993
7 * The Regents of the University of California. All rights reserved.
8 *
9 * This software was developed by the Computer Systems Engineering group
10 * at Lawrence Berkeley Laboratory under DARPA contract BG 91-66 and
11 * contributed to Berkeley.
12 *
13 * All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by Harvard University.
16 * This product includes software developed by the University of
17 * California, Lawrence Berkeley Laboratory.
18 *
19 * Redistribution and use in source and binary forms, with or without
20 * modification, are permitted provided that the following conditions
21 * are met:
22 * 1. Redistributions of source code must retain the above copyright
23 * notice, this list of conditions and the following disclaimer.
24 * 2. Redistributions in binary form must reproduce the above copyright
25 * notice, this list of conditions and the following disclaimer in the
26 * documentation and/or other materials provided with the distribution.
27 * 3. All advertising materials mentioning features or use of this software
28 * must display the following acknowledgement:
29 * This product includes software developed by the University of
30 * California, Berkeley and its contributors.
31 * 4. Neither the name of the University nor the names of its contributors
32 * may be used to endorse or promote products derived from this software
33 * without specific prior written permission.
34 *
35 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
36 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
37 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
38 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
39 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
40 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
41 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
42 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
43 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
44 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
45 * SUCH DAMAGE.
46 *
47 * @(#)ctlreg.h 8.1 (Berkeley) 6/11/93
48 */
49
50 /*
51 * Sun4m support by Aaron Brown, Harvard University.
52 * Changes Copyright (c) 1995 The President and Fellows of Harvard College.
53 * All rights reserved.
54 */
55
56 /*
57 * Sun 4, 4c, and 4m control registers. (includes address space definitions
58 * and some registers in control space).
59 */
60
61 /*
62 * The Alternate address spaces.
63 */
64
65 /* 0x00 unused */
66 /* 0x01 unused */
67 #define ASI_CONTROL 0x02 /* cache enable, context reg, etc */
68 #define ASI_SEGMAP 0x03 /* [4/4c] segment maps */
69 #define ASI_SRMMUFP 0x03 /* [4m] ref mmu flush/probe */
70 #define ASI_PTE 0x04 /* [4/4c] PTE space (pmegs) */
71 #define ASI_SRMMU 0x04 /* [4m] ref mmu registers */
72 #define ASI_REGMAP 0x06 /* [4/3-level MMU ] region maps */
73 #define ASI_HWFLUSHSEG 0x05 /* [4/4c] hardware assisted version of FLUSHSEG */
74 #define ASI_HWFLUSHPG 0x06 /* [4/4c] hardware assisted version of FLUSHPG */
75 #define ASI_SRMMUDIAG 0x06 /* [4m] */
76 #define ASI_HWFLUSHCTX 0x07 /* [4/4c] hardware assisted version of FLUSHCTX */
77
78 #define ASI_USERI 0x08 /* I-space (user) */
79 #define ASI_KERNELI 0x09 /* I-space (kernel) */
80 #define ASI_USERD 0x0a /* D-space (user) */
81 #define ASI_KERNELD 0x0b /* D-space (kernel) */
82
83 #define ASI_FLUSHREG 0x7 /* [4/4c] flush cache by region */
84 #define ASI_FLUSHSEG 0x0c /* [4/4c] flush cache by segment */
85 #define ASI_FLUSHPG 0x0d /* [4/4c] flush cache by page */
86 #define ASI_FLUSHCTX 0x0e /* [4/4c] flush cache by context */
87
88 #define ASI_DCACHE 0x0f /* [4] flush data cache */
89
90 #define ASI_ICACHETAG 0x0c /* [4m] instruction cache tag */
91 #define ASI_ICACHEDATA 0x0d /* [4m] instruction cache data */
92 #define ASI_DCACHETAG 0x0e /* [4m] data cache tag */
93 #define ASI_DCACHEDATA 0x0f /* [4m] data cache data */
94 #define ASI_IDCACHELFP 0x10 /* [4m] flush i&d cache line (page) */
95 #define ASI_IDCACHELFS 0x11 /* [4m] flush i&d cache line (seg) */
96 #define ASI_IDCACHELFR 0x12 /* [4m] flush i&d cache line (reg) */
97 #define ASI_IDCACHELFC 0x13 /* [4m] flush i&d cache line (ctxt) */
98 #define ASI_IDCACHELFU 0x14 /* [4m] flush i&d cache line (user) */
99 #define ASI_BYPASS 0x20 /* [4m] sun ref mmu bypass,
100 ie. direct phys access */
101 #define ASI_HICACHECLR 0x31 /* [4m] hypersparc only: I-cache flash clear */
102 #define ASI_ICACHECLR 0x36 /* [4m] ms1 only: I-cache flash clear */
103 #define ASI_DCACHECLR 0x37 /* [4m] ms1 only: D-cache flash clear */
104 #define ASI_DCACHEDIAG 0x39 /* [4m] data cache diagnostic register access */
105
106 /*
107 * [4/4c] Registers in the control space (ASI_CONTROL).
108 */
109 #define AC_IDPROM 0x00000000 /* [4] ID PROM */
110 #define AC_CONTEXT 0x30000000 /* [4/4c] context register (byte) */
111 #define AC_SYSENABLE 0x40000000 /* [4/4c] system enable register (byte) */
112 #define AC_DVMA_ENABLE 0x50000000 /* [4] enable user dvma */
113 #define AC_BUS_ERR 0x60000000 /* [4] bus error register */
114 #define AC_SYNC_ERR 0x60000000 /* [4c] sync (memory) error reg */
115 #define AC_SYNC_VA 0x60000004 /* [4c] sync error virtual addr */
116 #define AC_ASYNC_ERR 0x60000008 /* [4c] async error reg */
117 #define AC_ASYNC_VA 0x6000000c /* [4c] async error virtual addr */
118 #define AC_DIAG_REG 0x70000000 /* [4] diagnostic reg */
119 #define AC_CACHETAGS 0x80000000 /* [4/4c?] cache tag base address */
120 #define AC_CACHEDATA 0x90000000 /* [4] cached data [sun4/400?] */
121 #define AC_DVMA_MAP 0xd0000000 /* [4] user dvma map entries */
122 #define AC_VMEINTVEC 0xe0000000 /* [4] vme interrupt vector */
123 #define AC_SERIAL 0xf0000000 /* [4/4c] special serial port sneakiness */
124 /* AC_SERIAL is not used in the kernel (it is for the PROM) */
125
126 /* XXX: does not belong here */
127 #define ME_REG_IERR 0x80 /* memory err ctrl reg error intr pending bit */
128
129 /*
130 * [4/4c]
131 * Bits in sync error register. Reading the register clears these;
132 * otherwise they accumulate. The error(s) occurred at the virtual
133 * address stored in the sync error address register, and may have
134 * been due to, e.g., what would usually be called a page fault.
135 * Worse, the bits accumulate during instruction prefetch, so
136 * various bits can be on that should be off.
137 */
138 #define SER_WRITE 0x8000 /* error occurred during write */
139 #define SER_INVAL 0x80 /* PTE had PG_V off */
140 #define SER_PROT 0x40 /* operation violated PTE prot */
141 #define SER_TIMEOUT 0x20 /* bus timeout (non-existent mem) */
142 #define SER_SBUSERR 0x10 /* S-Bus bus error */
143 #define SER_MEMERR 0x08 /* memory ecc/parity error */
144 #define SER_SZERR 0x02 /* [4/vme?] size error, whatever that is */
145 #define SER_WATCHDOG 0x01 /* watchdog reset (never see this) */
146
147 #define SER_BITS \
148 "\20\20WRITE\10INVAL\7PROT\6TIMEOUT\5SBUSERR\4MEMERR\2SZERR\1WATCHDOG"
149
150 /*
151 * [4/4c]
152 * Bits in async error register (errors from DVMA or Sun-4 cache
153 * writeback). The corresponding bit is also set in the sync error reg.
154 *
155 * A writeback invalid error means there is a bug in the PTE manager.
156 *
157 * The word is that the async error register does not work right.
158 */
159 #define AER_WBINVAL 0x80 /* writeback found PTE without PG_V */
160 #define AER_TIMEOUT 0x20 /* bus timeout */
161 #define AER_DVMAERR 0x10 /* bus error during DVMA */
162
163 #define AER_BITS "\20\10WBINVAL\6TIMEOUT\5DVMAERR"
164
165 /*
166 * [4/4c] Bits in system enable register.
167 */
168 #define SYSEN_DVMA 0x20 /* Enable dvma */
169 #define SYSEN_CACHE 0x10 /* Enable cache */
170 #define SYSEN_IOCACHE 0x40 /* Enable IO cache */
171 #define SYSEN_VIDEO 0x08 /* Enable on-board video */
172 #define SYSEN_RESET 0x04 /* Reset the hardware */
173 #define SYSEN_RESETVME 0x02 /* Reset the VME bus */
174
175
176 /*
177 * [4m] Bits in ASI_CONTROL? space, sun4m only.
178 */
179 #define MXCC_ENABLE_ADDR 0x1c00a00 /* Enable register for MXCC */
180 #define MXCC_ENABLE_BIT 0x4 /* Enable bit for MXCC */
181
182 /*
183 * Bits in ASI_SRMMUFP space.
184 * Bits 8-11 determine the type of flush/probe.
185 * Address bits 12-31 hold the page frame.
186 */
187 #define ASI_SRMMUFP_L3 (0<<8) /* probe L3 | flush L3 PTE */
188 #define ASI_SRMMUFP_L2 (1<<8) /* probe L2 | flush L2/L3 PTE/PTD's */
189 #define ASI_SRMMUFP_L1 (2<<8) /* probe L1 | flush L1/L2/L3 PTE/PTD's*/
190 #define ASI_SRMMUFP_L0 (3<<8) /* probe L0 | flush L0/L1/L2/L3 PTE/PTD's */
191 #define ASI_SRMMUFP_LN (4<<8) /* probe all | flush all levels */
192
193 /*
194 * [4m] Registers and bits in the SPARC Reference MMU (ASI_SRMMU).
195 */
196 #define SRMMU_PCR 0x00000000 /* Processor control register */
197 #define SRMMU_CXTPTR 0x00000100 /* Context table pointer register */
198 #define SRMMU_CXR 0x00000200 /* Context register */
199 #define SRMMU_SFSTAT 0x00000300 /* Synchronous fault status reg */
200 #define SRMMU_SFADDR 0x00000400 /* Synchronous fault address reg */
201 #define SRMMU_AFSTAT 0x00000500 /* Asynchronous fault status reg (HS) */
202 #define SRMMU_AFADDR 0x00000600 /* Asynchronous fault address reg (HS)*/
203 #define SRMMU_PCFG 0x00000600 /* Processor configuration reg (TURBO)*/
204 #define SRMMU_TLBCTRL 0x00001000 /* TLB replacement control reg */
205
206
207 /*
208 * [4m] Bits in SRMMU control register. One set per module.
209 */
210 #define VIKING_PCR_ME 0x00000001 /* MMU Enable */
211 #define VIKING_PCR_NF 0x00000002 /* Fault inhibit bit */
212 #define VIKING_PCR_PSO 0x00000080 /* Partial Store Ordering enable */
213 #define VIKING_PCR_DCE 0x00000100 /* Data cache enable bit */
214 #define VIKING_PCR_ICE 0x00000200 /* SuperSPARC instr. cache enable */
215 #define VIKING_PCR_SB 0x00000400 /* Store buffer enable bit */
216 #define VIKING_PCR_MB 0x00000800 /* MBus mode: 0=MXCC, 1=no MXCC */
217 #define VIKING_PCR_PE 0x00001000 /* Enable memory parity checking */
218 #define VIKING_PCR_BM 0x00002000 /* 1 iff booting */
219 #define VIKING_PCR_SE 0x00004000 /* Coherent bus snoop enable */
220 #define VIKING_PCR_AC 0x00008000 /* 1=cache non-MMU accesses */
221 #define VIKING_PCR_TC 0x00010000 /* 1=cache table walks */
222
223 #define HYPERSPARC_PCR_ME 0x00000001 /* MMU Enable */
224 #define HYPERSPARC_PCR_NF 0x00000002 /* Fault inhibit bit */
225 #define HYPERSPARC_PCR_CE 0x00000100 /* Cache enable bit */
226 #define HYPERSPARC_PCR_CM 0x00000400 /* Cache mode: 1=write-back */
227 #define HYPERSPARC_PCR_MR 0x00000800 /* Memory reflection: 1 = on */
228 #define HYPERSPARC_PCR_CS 0x00001000 /* cache size: 1=256k, 0=128k */
229 #define HYPERSPARC_PCR_C 0x00002000 /* enable cache when MMU off */
230 #define HYPERSPARC_PCR_BM 0x00004000 /* 1 iff booting */
231 #define HYPERSPARC_PCR_MID 0x00078000 /* MBus module ID MID<3:0> */
232 #define HYPERSPARC_PCR_WBE 0x00080000 /* Write buffer enable */
233 #define HYPERSPARC_PCR_SE 0x00100000 /* Coherent bus snoop enable */
234 #define HYPERSPARC_PCR_CWR 0x00200000 /* Cache wrap enable */
235
236 #define CYPRESS_PCR_ME 0x00000001 /* MMU Enable */
237 #define CYPRESS_PCR_NF 0x00000002 /* Fault inhibit bit */
238 #define CYPRESS_PCR_CE 0x00000100 /* Cache enable bit */
239 #define CYPRESS_PCR_CL 0x00000200 /* Cache Lock (604 only) */
240 #define CYPRESS_PCR_CM 0x00000400 /* Cache mode: 1=write-back */
241 #define CYPRESS_PCR_MR 0x00000800 /* Memory reflection: 1=on (605 only) */
242 #define CYPRESS_PCR_C 0x00002000 /* enable cache when MMU off */
243 #define CYPRESS_PCR_BM 0x00004000 /* 1 iff booting */
244 #define CYPRESS_PCR_MID 0x00078000 /* MBus module ID MID<3:0> (605 only) */
245 #define CYPRESS_PCR_MV 0x00080000 /* Multichip Valid */
246 #define CYPRESS_PCR_MCM 0x00300000 /* Multichip Mask */
247 #define CYPRESS_PCR_MCA 0x00c00000 /* Multichip Address */
248
249 #define MS1_PCR_ME 0x00000001 /* MMU Enable */
250 #define MS1_PCR_NF 0x00000002 /* Fault inhibit bit */
251 #define MS1_PCR_DCE 0x00000100 /* Data cache enable */
252 #define MS1_PCR_ICE 0x00000200 /* Instruction cache enable */
253 #define MS1_PCR_RC 0x00000c00 /* DRAM Refresh control */
254 #define MS1_PCR_PE 0x00001000 /* Enable memory parity checking */
255 #define MS1_PCR_BM 0x00004000 /* 1 iff booting */
256 #define MS1_PCR_AC 0x00008000 /* 1=cache if ME==0 (and [ID]CE on) */
257 #define MS1_PCR_ID 0x00010000 /* 1=disable ITBR */
258 #define MS1_PCR_PC 0x00020000 /* Parity control: 0=even,1=odd */
259 #define MS1_PCR_MV 0x00100000 /* Memory data View (diag) */
260 #define MS1_PCR_DV 0x00200000 /* Data View (diag) */
261 #define MS1_PCR_AV 0x00400000 /* Address View (diag) */
262 #define MS1_PCR_STW 0x00800000 /* Software Tablewalk enable */
263
264 #define SWIFT_PCR_ME 0x00000001 /* MMU Enable */
265 #define SWIFT_PCR_NF 0x00000002 /* Fault inhibit bit */
266 #define SWIFT_PCR_DCE 0x00000100 /* Data cache enable */
267 #define SWIFT_PCR_ICE 0x00000200 /* Instruction cache enable */
268 #define SWIFT_PCR_RC 0x00003c00 /* DRAM Refresh control */
269 #define SWIFT_PCR_BM 0x00004000 /* 1 iff booting */
270 #define SWIFT_PCR_AC 0x00008000 /* 1=cache if ME=0 (and [ID]CE on) */
271 #define SWIFT_PCR_PA 0x00010000 /* TCX/SX control */
272 #define SWIFT_PCR_PC 0x00020000 /* Parity control: 0=even,1=odd */
273 #define SWIFT_PCR_PE 0x00040000 /* Enable memory parity checking */
274 #define SWIFT_PCR_PMC 0x00180000 /* Page mode control */
275 #define SWIFT_PCR_BF 0x00200000 /* Branch Folding */
276 #define SWIFT_PCR_WP 0x00400000 /* Watch point enable */
277 #define SWIFT_PCR_STW 0x00800000 /* Software Tablewalk enable */
278
279 #define TURBOSPARC_PCR_ME 0x00000001 /* MMU Enable */
280 #define TURBOSPARC_PCR_NF 0x00000002 /* Fault inhibit bit */
281 #define TURBOSPARC_PCR_ICS 0x00000004 /* I-cache snoop enable */
282 #define TURBOSPARC_PCR_PSO 0x00000008 /* Partial Store order (ro!) */
283 #define TURBOSPARC_PCR_DCE 0x00000100 /* Data cache enable */
284 #define TURBOSPARC_PCR_ICE 0x00000200 /* Instruction cache enable */
285 #define TURBOSPARC_PCR_RC 0x00003c00 /* DRAM Refresh control */
286 #define TURBOSPARC_PCR_BM 0x00004000 /* 1 iff booting */
287 #define TURBOSPARC_PCR_PC 0x00020000 /* Parity ctrl: 0=even,1=odd */
288 #define TURBOSPARC_PCR_PE 0x00040000 /* Enable parity checking */
289 #define TURBOSPARC_PCR_PMC 0x00180000 /* Page mode control */
290
291 /* The Turbosparc's Processor Configuration Register */
292 #define TURBOSPARC_PCFG_SCC 0x00000007 /* e-cache config */
293 #define TURBOSPARC_PCFG_SE 0x00000008 /* e-cache enable */
294 #define TURBOSPARC_PCFG_US2 0x00000010 /* microsparc II compat */
295 #define TURBOSPARC_PCFG_WT 0x00000020 /* write-through enable */
296 #define TURBOSPARC_PCFG_SBC 0x000000c0 /* SBus Clock */
297 #define TURBOSPARC_PCFG_WS 0x03800000 /* DRAM wait states */
298 #define TURBOSPARC_PCFG_RAH 0x0c000000 /* DRAM Row Address Hold */
299 #define TURBOSPARC_PCFG_AXC 0x30000000 /* AFX Clock */
300 #define TURBOSPARC_PCFG_SNP 0x40000000 /* DVMA Snoop enable */
301 #define TURBOSPARC_PCFG_IOCLK 0x80000000 /* I/O clock ratio */
302
303
304 /* Implementation and Version fields are common to all modules */
305 #define SRMMU_PCR_VER 0x0f000000 /* Version of MMU implementation */
306 #define SRMMU_PCR_IMPL 0xf0000000 /* Implementation number of MMU */
307
308
309 /* [4m] Bits in the Synchronous Fault Status Register */
310 #define SFSR_EM 0x00020000 /* Error mode watchdog reset occurred */
311 #define SFSR_CS 0x00010000 /* Control Space error */
312 #define SFSR_SB 0x00008000 /* SS: Store Buffer Error */
313 #define SFSR_PERR 0x00006000 /* Parity error code */
314 #define SFSR_P 0x00004000 /* SS: Parity error */
315 #define SFSR_UC 0x00001000 /* Uncorrectable error */
316 #define SFSR_TO 0x00000800 /* S-Bus timeout */
317 #define SFSR_BE 0x00000400 /* S-Bus bus error */
318 #define SFSR_LVL 0x00000300 /* Pagetable level causing the fault */
319 #define SFSR_AT 0x000000e0 /* Access type */
320 #define SFSR_FT 0x0000001c /* Fault type */
321 #define SFSR_FAV 0x00000002 /* Fault Address is valid */
322 #define SFSR_OW 0x00000001 /* Overwritten with new fault */
323
324 #define SFSR_BITS "\177\020" \
325 "b\21EM\0b\20CS\0b\17SB\0f\15\2PERR\0" \
326 "b\14UC\0b\13TO\0b\12BE\0f\10\2LVL\0" \
327 "f\05\3AT\0f\02\3FT\0b\01FAV\0b\01OW"
328
329 /* [4m] Synchronous Fault Types */
330 #define SFSR_FT_NONE (0 << 2) /* no fault */
331 #define SFSR_FT_INVADDR (1 << 2) /* invalid address fault */
332 #define SFSR_FT_PROTERR (2 << 2) /* protection fault */
333 #define SFSR_FT_PRIVERR (3 << 2) /* privelege violation */
334 #define SFSR_FT_TRANSERR (4 << 2) /* translation fault */
335 #define SFSR_FT_BUSERR (5 << 2) /* access bus error */
336 #define SFSR_FT_INTERR (6 << 2) /* internal error */
337 #define SFSR_FT_RESERVED (7 << 2) /* reserved */
338
339 /* [4m] Synchronous Fault Access Types */
340 #define SFSR_AT_LDUDATA (0 << 5) /* Load user data */
341 #define SFSR_AT_LDSDATA (1 << 5) /* Load supervisor data */
342 #define SFSR_AT_LDUTEXT (2 << 5) /* Load user text */
343 #define SFSR_AT_LDSTEXT (3 << 5) /* Load supervisor text */
344 #define SFSR_AT_STUDATA (4 << 5) /* Store user data */
345 #define SFSR_AT_STSDATA (5 << 5) /* Store supervisor data */
346 #define SFSR_AT_STUTEXT (6 << 5) /* Store user text */
347 #define SFSR_AT_STSTEXT (7 << 5) /* Store supervisor text */
348 #define SFSR_AT_SUPERVISOR (1 << 5) /* Set iff supervisor */
349 #define SFSR_AT_TEXT (2 << 5) /* Set iff text */
350 #define SFSR_AT_STORE (4 << 5) /* Set iff store */
351
352 /* [4m] Synchronous Fault PT Levels */
353 #define SFSR_LVL_0 (0 << 8) /* Context table entry */
354 #define SFSR_LVL_1 (1 << 8) /* Region table entry */
355 #define SFSR_LVL_2 (2 << 8) /* Segment table entry */
356 #define SFSR_LVL_3 (3 << 8) /* Page table entry */
357
358 /* [4m] Asynchronous Fault Status Register bits */
359 #define AFSR_AFO 0x00000001 /* Async. fault occurred */
360 #define AFSR_AFA 0x000000f0 /* Bits <35:32> of faulting phys addr */
361 #define AFSR_AFA_RSHIFT 4 /* Shift to get AFA to bit 0 */
362 #define AFSR_AFA_LSHIFT 28 /* Shift to get AFA to bit 32 */
363 #define AFSR_BE 0x00000400 /* Bus error */
364 #define AFSR_TO 0x00000800 /* Bus timeout */
365 #define AFSR_UC 0x00001000 /* Uncorrectable error */
366 #define AFSR_SE 0x00002000 /* System error */
367
368 #define AFSR_BITS "\177\020" \
369 "b\15SE\0b\14UC\0b\13TO\0b\12BE\0f\04\4AFA\0b\0AFO\0"
370
371 /* [4m] TLB Replacement Control Register bits */
372 #define TLBC_DISABLE 0x00000020 /* Disable replacement counter */
373 #define TLBC_RCNTMASK 0x0000001f /* Replacement counter (0-31) */
374