Memory Management Unit ARM DDI 0100E Copyright © 1996-2000 ARM Limited. All rights reserved. B3-9 3.3.5 Coarse page table descriptor If the first-level descriptor is a coarse page table descriptor, the fields have the following meanings: Bits[1:0] Identify the type of descriptor (0b01 marks a coarse page table descriptor). Bits[4:2] The meaning of these bits is IMPLEMENTATION DEFINED. Bits[8:5] The domain field specifies one of the sixteen possible domains for all the pages controlled by this descriptor. Bit[9] This bit is not currently used, and should be zero. Bits[31:10] The Page Table Base Address is a pointer to a coarse second-level page table, giving the base address for a second-level fetch to be performed. Coarse second-level page tables must be aligned on a 1KB boundary. If a coarse page table descriptor is returned from the first-level fetch, a second-level fetch is initiated to retrieve a second-level descriptor, as shown in Figure 3-4. Figure 3-4 Accessing coarse page table second-level descriptors Translation table base Virtual address Address of first-level descriptor First-level descriptor First-level fetch 31 01314 Translation base 0 0 Translation base SBZ Domain 0 1 Page table base address IMP Page table base address 0 0 Second-level table index 31 01314 12 First-level table index First-level table index Second-level table index 31 20 19 012 11 Address of second-level descriptor 31 9 012458 31 9 012 10 10 S B Z Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Memory Management Unit B3-10 Copyright © 1996-2000 ARM Limited. All rights reserved. ARM DDI 0100E 3.3.6 Fine page table descriptor If the first-level descriptor is a fine page table descriptor, the fields have the following meanings: Bits[1:0] Identify the type of descriptor (0b11 marks a fine page table descriptor). Bits[4:2] The meaning of these bits is IMPLEMENTATION DEFINED. Bits[8:5] The domain field specifies one of the sixteen possible domains for all the pages controlled by this descriptor. Bit[11:9] These bits are not currently used, and should be zero. Bits[31:12] The Page Table Base Address is a pointer to a fine second-level page table, giving the base address for a second-level fetch to be performed. Fine second-level page tables must be aligned on a 4KB boundary. If a fine page table descriptor is returned from the first-level fetch, a second-level fetch is initiated to retrieve a second-level descriptor, as shown in Figure 3-5. Figure 3-5 Accessing fine page table second-level descriptors Translation table base Virtual address Address of first-level descriptor First-level descriptor First-level fetch 31 01314 Translation base 0 0 Translation base SBZ Domain 1 1Page table base address IMP Page table base address 0 0 Second-level table index 31 01314 12 First-level table index First-level table index 31 20 19 010 9 Address of second-level descriptor 31 01245 8 31 11 012 12 SBZ Second-level table index 1112 9 Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Memory Management Unit ARM DDI 0100E Copyright © 1996-2000 ARM Limited. All rights reserved. B3-11 3.3.7 Second-level descriptor Each entry in a coarse second-level table corresponds to how a 4KB virtual address range is mapped, and each entry in a fine second-level table corresponds to how a 1KB virtual address range is mapped. The entries are page descriptors, and can describe a page which is larger than 4KB or 1KB respectively. When this happens, the descriptor must be repeated enough times in the second-level table to ensure that the same descriptor is always used for the page, regardless of which virtual address is being accessed within the page. There are four possibilities for a second-level descriptor, selected by bits[1:0] of the descriptor as shown in Table 3-2: • If bits[1:0] == 0b00, the associated virtual addresses are unmapped, and attempts to access them generate a translation fault (see Aborts on page B3-18). Software can use bits[31:2] for its own purposes in such a descriptor, as they are ignored by the hardware. Where appropriate, it is suggested that bits[31:2] continue to hold valid access permissions for the descriptor. • If bits[1:0] == 0b01, the entry is a large page descriptor, describing 64KB of virtual addresses. See Translating large page references on page B3-13 for details. A large page descriptor must be repeated 64 times in a fine second-level table or 16 times in a coarse second-level table to ensure that all of its virtual addresses are described. • If bits[1:0] == 0b10, the entry is a small page descriptor, describing 4KB of virtual addresses. See Translating small page references on page B3-14 for details. A small page descriptor must be repeated four times in a fine second-level table to ensure that all of its virtual addresses are described. In a coarse second-level table, only one instance of each small page descriptor is needed. • If bits[1:0] == 0b11, the entry is a tiny page descriptor, describing 1KB of virtual addresses. See Translating tiny page references on page B3-15 for details. Only one instance of each tiny page descriptor is needed in a fine second-level table. Tiny page descriptors must not appear in coarse second-level tables. If they do, the results are UNPREDICTABLE. Table 3-2 Second-level descriptor format 31 1615 1211109876543210 Fault IGN 0 0 Large page Large table base address SBZ AP3 AP2 AP1 AP0 C B 0 1 Small page Small page base address AP3 AP2 AP1 AP0 C B 1 0 Tiny page Tiny page base address SBZ AP C B 1 1 Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Memory Management Unit B3-12 Copyright © 1996-2000 ARM Limited. All rights reserved. ARM DDI 0100E Large page descriptor fields The fields in a large page descriptor have the following meanings: Bits[1:0] Identify the type of descriptor. Bits[3:2] Are the cachable and bufferable bits (see Cachability and bufferability on page B5-8). Bits[11:4] Are the access permission bits. These bits control access to the page. See Table 3-3 on page B3-16 for the interpretation of these bits. Large pages are split into four subpages: AP0 Encodes the access permissions for the first subpages. AP1 Encodes the access permissions for the second subpages. AP2 Encodes the access permissions for the third subpages. AP3 Encodes the access permissions for the fourth (last) subpages. Bits[15:12] Are not currently used, and must be zero. Bits[31:16] Are used to form the corresponding bits of the physical address. Small page descriptor fields The fields in a small page descriptor have the following meanings: Bits[1:0] Identify the type of descriptor. Bits[3:2] Are the cachable and bufferable bits (see Cachability and bufferability on page B5-8). Bits[11:4] Are the access permission bits. These bits control access to the page. See Table 3-3 on page B3-16 for the interpretation of these bits. Small pages are split into four subpages: AP0 Encodes the access permissions for the first subpages. AP1 Encodes the access permissions for the second subpages. AP2 Encodes the access permissions for the third subpages. AP3 Encodes the access permissions for the fourth (last) subpages. Bits[31:12] Are used to form the corresponding bits of the physical address. Tiny page descriptor fields The fields in a tiny page descriptor have the following meanings: Bits[1:0] Identify the type of descriptor. Bits[3:2] Are the cachable and bufferable bits (see Cachability and bufferability on page B5-8). Bits[5:4] Are the access permission bits. See Table 3-3 on page B3-16 for the interpretation of these bits, which apply to the entire tiny page. Bits[9:6] Are not currently used, and must be zero. Bits[31:10] Are used to form the corresponding bits of the physical address. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Memory Management Unit ARM DDI 0100E Copyright © 1996-2000 ARM Limited. All rights reserved. B3-13 3.3.8 Translating large page references Figure 3-6 shows the complete translation sequence for a 64KB large page in a coarse second-level table. The translation sequence for a large page in a fine second-level table is similar, but with the address of the second-level descriptor being determined as shown in Fine page table descriptor on page B3-10. Note As the upper four bits of the Page Index and low-order four bits of the Second-level Table Index overlap, each page table entry for a large page must be repeated 16 times (in consecutive memory locations) in a coarse page table. Similarly, each page table entry for a large page must be repeated 64 times in a fine page table. Figure 3-6 Large page translation in a coarse second-level table Second-level fetch Large page base address 0 1BCAP3 AP2 AP1 AP0 Translation table base Virtual address Address of first-level descriptor First-level descriptor First-level fetch 31 01314 Translation base 0 0 Translation base SBZ Page table base address 0 0 Second-level table index 31 01314 12 First-level table index First-level Second- 31 20 19 012 11 Address of second-level descriptor 31 31 910 012 Page index 16 15 Large page base address SBZ 31 16 15 021438510 912 11 67 Page index Second-level descriptor Physical address 31 16 15 0 Page table base address Domain 0 1IMP 910 012458 S B Z table index level table index Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Memory Management Unit B3-14 Copyright © 1996-2000 ARM Limited. All rights reserved. ARM DDI 0100E 3.3.9 Translating small page references Figure 3-7 shows the complete translation sequence for a 4KB small page in a coarse second-level table. The translation sequence for a small page in a fine second-level table is similar, but with the address of the second-level descriptor being determined as shown in Fine page table descriptor on page B3-10. Note When a small page appears in a fine second-level table, the upper two bits of the Page Index and the low-order two bits of the Second-level Table Index overlap. So each page table entry for a small page must be repeated four times (in consecutive memory locations) in a fine page table. Figure 3-7 Small page translation in a coarse second-level table Second-level fetch Small page base address 1 0BAP2 AP1 AP0 Translation table base Virtual address Address of first-level descriptor First-level descriptor First-level fetch 31 01314 Translation base 0 0 Translation base SBZ Domain 0 1Page table base address IMP Page table base address 0 0 Second-level table index 31 01314 12 First-level table index First-level table index Second-level table index 31 20 19 012 11 Address of second-level descriptor 31 012458 31 910 012 Page index Small page base address 31 021438510 912 11 67 Page index Second-level descriptor Physical address 31 12 11 0 AP3 C S B Z 910 Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Memory Management Unit ARM DDI 0100E Copyright © 1996-2000 ARM Limited. All rights reserved. B3-15 3.3.10 Translating tiny page references Figure 3-8 shows the complete translation sequence for a 1KB tiny page in a fine second-level table. Note Tiny pages can not appear in a coarse second-level table. Figure 3-8 Tiny page translation in a fine second-level table Second-level fetch Tiny page base address 1 1BSBZ AP Translation table base Virtual address Address of first-level descriptor First-level descriptor First-level fetch 31 01314 Translation base 0 0 Translation base SBZ Domain 1 1Page table base address IMP Page table base address 0 0 Second-level table index 31 01314 12 First-level table index First-level table index Second-level table index 31 20 19 010 9 Address of second-level descriptor 31 012458 31 012 Page index Tiny page base address 31 02143510 9 6 Second-level descriptor Physical address 31 0 C SBZ 1112 9 1112 10 9 Page index Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Memory Management Unit B3-16 Copyright © 1996-2000 ARM Limited. All rights reserved. ARM DDI 0100E 3.4 Access permissions The access permission bits in section and page descriptors control access to the corresponding section or page. The access permissions are modified by the System (S) and ROM (R) control bits in CP15 register 1. Table 3-3 describes the meaning of the access permission bits in conjunction with the S and R bits. If an access is made to an area of memory without the required permission, a Permission Fault is raised (see Aborts on page B3-18). Table 3-3 MMU access permissions AP S R Privileged permissions User permissions 0b00 0 0 No access No access 0b00 1 0 Read only No access 0b00 0 1 Read only Read only 0b00 1 1 UNPREDICTABLE UNPREDICTABLE 0b01 x x Read/write No access 0b10 x x Read/write Read only 0b11 x x Read/write Read/write Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Memory Management Unit ARM DDI 0100E Copyright © 1996-2000 ARM Limited. All rights reserved. B3-17 3.5 Domains A domain is a collection of sections, large pages and small pages. The ARM architecture supports 16 domains. Access to each domain is controlled by a 2-bit field in the Domain Access Control Register. Each field allows the access to an entire domain to be enabled and disabled very quickly, so that whole memory areas can be swapped in and out of virtual memory very efficiently. Two kinds of domain access are supported: Clients Are users of domains (execute programs, access data), and are guarded by the access permissions of the individual sections and pages that make up the domain. Managers Control the behavior of the domain (the current sections and pages in the domain, and the domain access), and are not guarded by the access permissions of individual sections and pages in the domain. One program can be a client of some domains, and a manager of some other domains, and have no access to the remaining domains. This allows very flexible memory protection for programs that access different memory resources. Table 3-4 illustrates the encoding of the bits in the Domain Access Control Register. Table 3-4 Domain Access Values Value Access types Description 0b00 No access Any access generates a domain fault 0b01 Client Accesses are checked against the access permission bits in the section or page descriptor 0b10 Reserved Using this value has UNPREDICTABLE results 0b11 Manager Accesses are not checked against the access permission bits in the section or page descriptor, so a permission fault cannot be generated Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Memory Management Unit B3-18 Copyright © 1996-2000 ARM Limited. All rights reserved. ARM DDI 0100E 3.6 Aborts Mechanisms that can cause the ARM processor to halt execution because of memory access restrictions are: MMU fault The MMU detects the restriction and signals the processor. External abort The external memory system signals an illegal memory access. Collectively, MMU faults and external aborts are just called aborts. Accesses that cause aborts are said to be aborted. If the memory request that is aborted is an instruction fetch, then a Prefetch Abort exception is raised if and when the processor attempts to execute the instruction corresponding to the illegal access. If the aborted access is a data access, a Data Abort exception is raised. See Exceptions on page A2-13 for more information about Prefetch and Data Aborts. 3.6.1 MMU faults The MMU generates four types of fault: • alignment fault • translation fault • domain fault • permission fault. The memory system can abort three types of access: • line fetches • memory accesses (uncached or unbuffered accesses) • translation table accesses. Aborts that are detected by the MMU are stopped before any external memory access takes place. It is the responsibility of the external system to stop external accesses that cause external aborts. The System Control coprocessor contains two registers which are updated when a data access is aborted. These registers are not updated for Prefetch Aborts, as the aborted instruction might not be executed due to changes in program flow. Fault Address Register (FAR) and Fault Status Register (FSR) Aborts resulting from data accesses (Data Aborts) are immediately acted upon by the CPU. The Fault Status Register (FSR) is updated with a 4-bit Fault Status (FS[3:0]) and the domain number of the access. In addition, the virtual address which caused the Data Abort is written into the Fault Address Register (FAR). If a data access simultaneously generates more than one type of Data Abort, they are prioritized in the order given in Table 3-5 on page B3-19. Aborts arising from instruction fetches are flagged as the instruction enters the instruction pipeline. Only when (and if) the instruction is executed does it cause a Prefetch Abort exception. An abort resulting from an instruction fetch is not acted upon if the instruction is not used (for example, if it is branched around). Normally, the fault address associated with a Prefetch Abort exception is determined from the value saved in R14_abt when the Prefetch Abort exception vector is entered. It is IMPLEMENTATION DEFINED whether Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. [...]... desired effect ARM DDI 0100E Copyright © 1996-2000 ARM Limited All rights reserved Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark B3-29 Memory Management Unit B3-30 Copyright © 1996-2000 ARM Limited All rights reserved Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark ARM DDI 0100E Chapter B4 Protection Unit This chapter describes the ARM Protection... regions on page B4-5 • CP15 registers on page B4-6 ARM DDI 0100E Copyright © 1996-2000 ARM Limited All rights reserved Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark B4-1 Protection Unit 4.1 About the Protection Unit The Protection Unit memory system architecture provides a considerably simpler alternative to the MMU memory system architecture described in Chapter B3 Memory Management... corresponding data protection region to allow the code to access its inline literals B4-2 Copyright © 1996-2000 ARM Limited All rights reserved Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark ARM DDI 0100E Protection Unit 4.1.2 Memory access sequence When the ARM processor generates a memory access, the Protection Unit checks whether the address lies within the range of... B4-7 If the requested type of access is not permitted, an abort is signaled to the ARM processor Table 4-1 Protection Unit access permissions AP User permissions 0b00 No access No access 0b01 Read/write No access 0b10 Read/write Read only 0b11 ARM DDI 0100E Privileged permissions Read/write Read/write Copyright © 1996-2000 ARM Limited All rights reserved Please purchase PDF Split-Merge on www.verypdf.com... abort (an interrupt for example) The value of a memory location that causes an abort is UNPREDICTABLE after the abort B3-22 Copyright © 1996-2000 ARM Limited All rights reserved Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark ARM DDI 0100E Memory Management Unit 3.7 CP15 registers The MMU is controlled with the System Control coprocessor registers 2, 3, 4, 5, 6, 8 and 10,... Bits[13:0] must be written as zero or as a value previously read from bits[13:0] of this register The CRm and opcode2 fields are ignored when writing CP15 register 2 and should be zero ARM DDI 0100E Copyright © 1996-2000 ARM Limited All rights reserved Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark B3-23 Memory Management Unit 3.7.3 Register 3: Domain access control 31 30... value previously read from the FSR The CRm and opcode2 fields are ignored when writing CP15 register 5 and should be zero B3-24 Copyright © 1996-2000 ARM Limited All rights reserved Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark ARM DDI 0100E Memory Management Unit 3.7.6 Register 6: Fault address 31 0 Fault address Reading CP15 register 6 returns the value of the FAR The FAR... Otherwise, if a function not relevant to a particular implementation is performed, the results are UNPREDICTABLE Attempting to read CP15 register 8 with an MRC instruction is UNPREDICTABLE ARM DDI 0100E Copyright © 1996-2000 ARM Limited All rights reserved Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark B3-25 Memory Management Unit The invalidate single entry operations can be... the functions in Table 3-6 are passed as data This means that no address modification is performed for them by the FCSE B3-26 Copyright © 1996-2000 ARM Limited All rights reserved Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark ARM DDI 0100E Memory Management Unit 3.7.8 Register 10: TLB lockdown Translation table walks can take a considerable amount of time, especially as... has UNPREDICTABLE results Reading register 10 returns the last values written to the base field and the P bit, and the number of the next TLB entry to be replaced in the victim field ARM DDI 0100E Copyright © 1996-2000 ARM Limited All rights reserved Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark B3-27 Memory Management Unit TLB lockdown procedure The normal procedure to . watermark. Memory Management Unit ARM DDI 0100E Copyright © 1996-2000 ARM Limited. All rights reserved. B3-13 3.3.8 Translating large page references Figure 3-6 shows. Management Unit B3-14 Copyright © 1996-2000 ARM Limited. All rights reserved. ARM DDI 0100E 3.3.9 Translating small page references Figure 3-7 shows the complete