Download Memory Management Unit (MMU) Operation and Configuration: ARM810 Data Sheet and more Study notes Logic in PDF only on Docsity!
ARM DDI 0081E
- ARM810 Data Sheet 8-
- 8.1 MMU Program Accessible Registers 8- This chapter describes theMemory Management Unit (MMU).
- 8.2 Address Translation 8-
- 8.3 Translation Process 8-
- 8.4 Level One Descriptor 8-
- 8.5 Page Table Descriptor 8-
- 8.6 Section Descriptor 8-
- 8.7 Translating Section References 8-
- 8.8 Level Two Descriptor 8-
- 8.9 Translating Small Page References 8-
- 8.10 Translating Large Page References 8-
- 8.12 MMU Faults and CPU Aborts 8-
- 8.13 Fault Address and Fault Status Registers (FAR and FSR) 8-
- 8.14 Domain Access Control 8-
- 8.15 Fault Checking Sequence 8-
- 8.16 External Aborts 8-
- 8.17 Interaction of the MMU, IDC and Write Buffer 8-
- 8.18 Effect of Reset 8-
8-2 ARM810 Data Sheet
ARM DDI 0081E
The Memory Management MMU performs two primary functions: it translates virtual addresses into physical addresses, and it controls memory access permissions. The MMU hardware required to perform these functions consists of a Translation Look- aside Buffer (TLB), access control logic, and translation table walking logic. The MMU supports memory accesses based on Sections or Pages. Sections are comprised of 1MB blocks of memory. Two different page sizes are supported: Small Pages consist of 4KB blocks of memory and Large Pages consist of 64KB blocks of memory. (Large Pages are supported to allow mapping of a large region of memory while using only a single entry in the TLB). Additional access control mechanisms are extended within Small Pages to 1KB Sub-Pages and within Large Pages to 16KB Sub- Pages. The MMU also supports the concept of domains - areas of memory that can be defined to possess individual access rights. The Domain Access Control Register is used to specify access rights for up to 16 separate domains. The TLB caches 64 translated entries. During most memory accesses, the TLB provides the translation information to the access control logic. If the TLB contains a translated entry for the virtual address, the access control logic determines whether access is permitted. If access is permitted and an off-chip access is required, the MMU outputs the appropriate physical address corresponding to the virtual address. If access is not permitted, the MMU signals the CPU to abort. If the TLB misses (it does not contain a translated entry for the virtual address), the translation table walk hardware is invoked to retrieve the translation information from a translation table in physical memory. Once retrieved, the translation information is placed into the TLB, possibly overwriting an existing value. The entry to be overwritten is chosen by cycling sequentially through the TLB locations. When the MMU is turned off (as happens on reset), the virtual address is output directly onto the physical address bus.
8-4 ARM810 Data Sheet
ARM DDI 0081E
Writing to the TLB Operations Register causes the MMU to perform one of the TLB operations “Invalidate TLB” or “Invalidate TLB Entry” depending on the coprocessor instruction used. For details, see the description of Register 8 in Chapter 5, Configuration. The TLB Lock-Down Control Register allows specific page table entries to be locked into the TLB. Locking entries in the TLB guarantees that accesses to the locked page or section can proceed without incurring the time penalty of a translation table walk. This allows the execution latency for time-critical pieces of code such as interrupt handlers to be minimised. Use of the TLB lock down facilities is described in Chapter 7, Instruction and Data Cache (IDC).
ARM810 Data Sheet 8-
ARM DDI 0081E
8.2 Address Translation
The MMU translates virtual addresses generated by the CPU into physical addresses to access external memory, and also derives and checks the access permission. Translation information, which consists of both the address translation data and the access permission data, resides in a translation table located in physical memory. The MMU provides the logic needed to traverse this translation table, obtain the translated address, and check the access permission. There are three routes by which the address translation (and hence permission check) takes place. The route taken depends on whether the address in question has been marked as a section-mapped access or a page-mapped access; and there are two sizes of page-mapped access (large pages and small pages). However, the translation process always starts out in the same way, as described below, with a Level One fetch. A section-mapped access only requires a Level One fetch, but a page-mapped access also requires a Level Two fetch.
ARM810 Data Sheet^ 8-
ARM DDI 0081E
8.4 Level One Descriptor
The Level One Descriptor returned is either a Page Table Descriptor or a Section Descriptor, and its format varies accordingly. The following figure illustrates the format of Level One Descriptors.
Figure 8-3: Level one descriptors
The two least significant bits indicate the descriptor type and valididty, and are interpreted as shown below..
31 2019 121110 9 8 5 4 3 2 1 0
0 Fault
Page
Section
Reserved
C B
Domain
AP Domain
Page Table Base Address
Section Base Address 1
Value Meaning Notes
0 0 Invalid Generates a Section Translation Fault
0 1 Page Indicates that this is a Page Descriptor
1 0 Section Indicates that this is a Section Descriptor
1 1 Reserved Reserved for future use
Table 8-2: Interpreting level one descriptor bits [1:0]
8-8 ARM810 Data Sheet
ARM DDI 0081E
8.5 Page Table Descriptor
Bits 3:2 are always written as 0. Bit 4 should be written to 1 for backward compatibility. Bits 8:5 specify one of the sixteen possible domains (held in the Domain Access Control Register) that contain the primary access controls. Bits 31:10 form the base for referencing the Page Table Entry. (The page table index for the entry is derived from the virtual address as illustrated in Figure 8-6: Small page translation on page 8-12). If a Page Table Descriptor is returned from the Level One fetch, a Level Two fetch is initiated as described below.
8-10 ARM810 Data Sheet
ARM DDI 0081E
8.7 Translating Section References
Figure 8-4: Section translation illustrates the complete Section translation sequence. Note that the access permissions contained in the Level One Descriptor must be checked before the physical address is generated. The sequence for checking access permissions is described below.
Figure 8-4: Section translation
31 2019 0
Section Base Address AP Domain C B 1 0
31 0
Table Index Section Index
Virtual Address
Translation Base
31 2019 121110 9 8 5 4 3 2 1 0
1413
Translation Table Base
31 0
Translation Base
1413
0 0
2 1
Table Index
First Level Descriptor
31 2019 0
Section Base Address Section Index
Physical Address
12
20
18
12
ARM810 Data Sheet^ 8-
ARM DDI 0081E
8.8 Level Two Descriptor
If the Level One fetch returns a Page Table Descriptor, this provides the base address of the page table to be used. The page table is then accessed as described in Figure 8-6: Small page translation on page 8-12, and a Page Table Entry, or Level Two Descriptor, is returned. This in turn may define either a Small Page or a Large Page access. The figure below shows the format of Level Two Descriptors .
Figure 8-5: Page table entry (level two descriptor)
The two least significant bits indicate the page size and validity, and are interpreted as follows.
Bit 3:2 (C : B) - The C & B bits together indicate whether the area of memory mapped by this section is treated as write-back cacheable, write-through cacheable, non cached buffered or non-cached non-buffered. Reference section 7.1.1 Cacheable and Bufferable Status of Memory Regions. Bits 11:4 specify the access permissions (ap3 - ap0) for the four sub-pages and interpretation of these bits is described earlier in Table 8-2: Interpreting level one descriptor bits [1:0] on page 8-7. For large pages, bits 15:12 are programmed as 0. Bits 31:12 (small pages) or bits 31:16 (large pages) are used to form the corresponding bits of the physical address - the physical page number. (The page index is derived from the virtual address as illustrated in Figure 8-6: Small page translation on page 8-12 and Figure 8-7: Large page Ttanslation on page 8-13).
31 2019 121110 9 8 5 4 3 2 1 0
0 Fault
Large Page
Small Page
Reserved
ap3 C B
Large Page Base Address
Small Page Base Address
1615 7 6
ap
ap
ap
ap
ap
ap
ap0 C B
Value Meaning Notes
0 0 Invalid Generates a Page Translation Fault
0 1 Large Page Indicates that this is a 64 KB Page
1 0 Small Page Indicates that this is a 4 KB Page
1 1 Reserved Reserved for future use
Table 8-4: Interpreting page table entry Bits 1:
ARM810 Data Sheet^ 8-
ARM DDI 0081E
8.10 Translating Large Page References
Figure 8-7: Large page Ttanslation illustrates the complete translation sequence for a 64 KB Large Page. Note that since the upper four bits of the Page Index and low- order four bits of the Page Table index overlap, each Page Table Entry for a Large Page must be duplicated 16 times (in consecutive memory locations) in the Page Table.
Figure 8-7: Large page Ttanslation
31 2019 0
31 0
Table Index Page Index
Virtual Address
Translation Base
1413
Translation Table Base
31 0
Translation Base
1413
0 0
2 1
Table Index
First Level Descriptor
18
12
Page Table Base Address Domain 0 1
31 10 9 8 5 4 2 1 0
Page Table Base Address 0 0
31 10 9 2 1 0
L2 Table Index
1211
L2 Table Index
Page Base Address ap3 C B 0 1
31 121110 9 8 5 4 3 2 1 0
Second Level Descriptor 7 6
ap2 ap1 ap
Page Base Address
31 0
Page Index
Physical Address
12 8
1615
1615
1615
8-14 ARM810 Data Sheet
ARM DDI 0081E
8.11 Cacheable and Bufferable Status of Memory Regions
For first level translation table descriptor for each Section, and the second level translation table descriptor for each Large Page, and each Small Page contain two bits—the C-bit and the B-bit—which specify whether the memory in that Section or Page will be cached or buffered, and whether it will be cached with Write-Through or Write-Back behaviour.† In addition the cache and write buffer behaviour is controlled by the cache enable bit (C-bit) and write buffer enable bit (W-bit) in the CP15 Control Register. To differentiate the two C bits, we shall add the subscript “tt” to the translation table bits giving us Ctt and Btt, and the subscript “cr” to the control register bits giving us Ccr and Wcr. The Cache and Write Buffer Configuration is determined by the values of Ctt, Btt, Ccr, Wcr as shown in Table 8-5: Cache and write buffer configuration. Note †Write-Back caches are also known as Copy-Back caches. “AND” means bitwise AND function.
Ctt AND Ccr Btt AND Wcr Cache, Writebuffer & External Abort Operation
0 0 Non-Cached, Non-Buffered (NCNB)
- Reads and Writes are not cached.
- Writes are not buffered.
- Reads and writes may be externally aborted.*
0 1 Non-Cached Buffered (NCB)
- Reads and Writes are not cached.
- Writes are buffered.
- Reads may be externally aborted.
- Writes cannot be externally aborted.
1 0 Cached, Write-Through Mode. (WT)
- Reads which hit in the cache read the data from the cache and do not perform an external access.
- Reads which miss in the cache cause line fills which may be externally aborted.
- All writes go off chip and are buffered.
- Writes which hit in the cache update the cache.
- Writes cannot be externally aborted.
Table 8-5: Cache and write buffer configuration
8-16 ARM810 Data Sheet
ARM DDI 0081E
8.12 MMU Faults and CPU Aborts
The MMU generates six types of faults: Alignment Fault Translation Fault Domain Fault Permission Fault Terminal Fault Vector Fault In addition, an external abort may be raised on external data access. The access control mechanisms of the MMU detect the conditions that produce these faults. If a fault is detected as the result of a memory access, the MMU will abort the access and signal the fault condition to the CPU. The MMU is also capable of retaining status and address information about the abort. The CPU recognises two types of abort: data aborts and prefetch aborts, and these are treated differently by the MMU. See 8.13 Fault Address and Fault Status Registers (FAR and FSR). If the MMU detects an access violation, it will do so before the external memory access takes place, and it will therefore inhibit the access. External aborts will not necessarily inhibit the external access, as described in the section on external aborts.
ARM810 Data Sheet^ 8-
ARM DDI 0081E
8.13 Fault Address and Fault Status Registers (FAR and FSR)
Aborts resulting from data accesses (data aborts) are acted upon by the CPU immediately, and the MMU places an encoded 4 bit value FS[3:0], along with the 4 bit encoded Domain number, in the Fault Status Register (FSR). In addition, the virtual processor address associated with the data abort is latched into the Fault Address Register (FAR). If an access violation simultaneously generates more than one source of abort, they are encoded in the priority given in Table 8-6: Priority Encoding of Fault Status on page 8-17. CPU instructions on the other hand are prefetched, so a prefetch abort simply flags the instruction as it enters the instruction pipeline. Only when (and if) the instruction is executed does it cause an abort; an abort is not acted upon if the instruction is not used (i.e. it is branched around). Because instruction prefetch aborts may or may not be acted upon, the MMU status information is not preserved for the resulting CPU abort; for a prefetch abort, the MMU does not update the FSR or FAR. The sections that follow describe the various access permissions and controls supported by the MMU and detail how these are interpreted to generate faults.
Notes 1 Alignment faults may write either 0b0001 or 0b0011 into FS[3:0]. 2 Invalid values in Domain[3:0] occur because the fault is raised before a valid domain field has been selected.
Source Priority Domain[3:0] FAR
highest priority
Terminal Exception 0b0010 invalid VA of start of cache line being written-back
Vector Exception 0b0000 invalid VA of access causing abort
Alignment 0b00x1 invalid VA of access causing abort
External Abort on Translation First level Second level
0b 0b
invalid valid VA of access causing abort
Translation Section Page
0b 0b
invalid valid VA of access causing abort
Domain Section Page
0b 0b
valid valid VA of access causing abort
Permission Section Page
0b 0b
valid valid VA of access causing abort
External Abort on linefetch Section Page
0b 0b
valid valid
VA of start of cache line being loaded
External Abort on non-linefetch Section Page
0b 0b
valid valid VA of access causing abort
lowest priority
Table 8-6: Priority Encoding of Fault Status
ARM810 Data Sheet^ 8-
ARM DDI 0081E
8.14 Domain Access Control
MMU accesses are primarily controlled via domains. There are 16 domains, and each has a 2-bit field to define it. Two basic kinds of users are supported: Clients and Managers. Clients use a domain; Managers control the behaviour of the domain. The domains are defined in the Domain Access Control Register. Figure 8-8: Domain Access Control Register format on page 8-19 illustrates how the 32 bits of the register are allocated to define the sixteen 2-bit domains.
Figure 8-8: Domain Access Control Register format
Table 8-7: Interpreting access bits in Domain Access Control Register defines how the bits within each domain are interpreted to specify the access permissions.
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Value Meaning Notes
00 No Access Any access will generate a Domain Fault.
01 Client Accesses are checked against the access permission bits in the Section or Page descriptor.
10 Reserved Reserved. Currently behaves like the no access mode.
11 Manager Accesses are NOT checked against the access Permission bits so a Permission fault cannot be generated.
Table 8-7: Interpreting access bits in Domain Access Control Register
8-20 ARM810 Data Sheet
ARM DDI 0081E
8.15 Fault Checking Sequence
The sequence by which the MMU checks for access faults is slightly different for Sections and Pages. The figure below illustrates the sequence for both types of accesses. The sections and figures that follow describe the conditions that generate each of the faults.
Figure 8-9: Sequence for checking faults
violation
no access(00) reserved(10)
Virtual Address
Check Address Alignment
get Level One Descriptor
Section Page
misaligned AlignmentFault
invalid
Section Translation Fault
get Page Table Entry
check Domain Status
invalid
Page Translation Fault
no access(00) Page Domain Fault
reserved(10)
Section Domain Fault Section Page
client(01) client(01)
manager(01)
Check Access Permissions
Check Access Permissions
Physical Address
Section Permission Fault
violation
sub-Page Permission Fault
Check Vector Exception
26 bit data access to vecs
Vector Fault
