Memory Management Unit

6.11Hardware page table translation

The processor MMU implements the hardware page table walking mechanism from ARMv4 and ARMv5 cached processors with the exception of the removal of the fine page table descriptor and the addition the page table walk disable bits in the TTB Control register.

The processor implements the page table walk disable feature. Two bits, PD0 and PD1, are implemented in the TTB Control register. These bits are banked for the Secure and Non-secure worlds for the support of TrustZone.

Each time a TLB miss occurs, the TLB computes the parameters for an automatic hardware page table walk. The address of the page table walk is computed from TTB0 or TTB1, see First-level descriptor address on page 6-43. If the address is computed with TTB0, and the PD0 bit is set in the TTB Control register of the corresponding world, or if the address is computed using TTB1 and the PD1 bit is set, then the processor does not perform the automatic hardware page table walk, and it generates a Section translation fault instead.

With this feature, only a small portion of the memory can be mapped in one world, for example the Secure world, if the code that runs in this world is expected to be small. This gives the system a simple way to avoid using a lot of memory to store full page tables.

When hardware page table walks are not disabled, the processor performs the page table walk in the usual way. A hardware page table walk occurs whenever there is a TLB miss. Processor hardware page table walks do not cause a read from the level one Unified/Data Cache. or the TCM. The P, RGN, S, and C bits in the Translation Table Base Registers determine the memory region attributes for the page table walk.

Two formats of page tables are supported:

•A backwards-compatible format supporting subpage access permissions. These have been extended so that certain page table entries support extended region types and with the NS Attribute bit for TrustZone.

•ARMv6 format, not supporting sub-page access permissions, but with support for ARMv6 MMU features. The NS Attribute bit for TrustZone has also been added. These features are:

—extended region types

—global and process specific pages

—more access permissions

—marking of Shared and Non-Shared regions

—marking of Execute-Never regions.

Additionally, two translation table base registers are provided in each world. On a TLB miss, the Translation Table Base Control Register, CP15 c2 that is also duplicated in each world, and the top bits of the virtual address determine if the first or second translation table base is used. See c2, Translation Table Base Control Register on page 3-61 for details. The first-level descriptor indicates whether the access is to a section or to a page table. If the access is to a page table, the processor MMU fetches a second-level descriptor.

A page table holds 256 32-bit entries 4KB in size. You can determine the page type by examining bits [1:0] of the second-level descriptor. For both first and second level descriptors if bits [1:0] are b00, the associated virtual addresses are unmapped, and attempts to access them generate a translation fault. Software can use bits [31:2] for its own purposes in such a descriptor, because they are ignored by the hardware. Where appropriate, ARM Limited recommends that bits [31:2] continue to hold valid access permissions for the descriptor.

Memory Management Unit

For both level 1 and level 2 page table walks, the processor performs external accesses with Secure or Non-secure rights depending on the Secure or Non-secure state of the MMU request that causes the page table walk. This ensures that Secure translation table descriptors are always fetched from a Secure memory, and that Non-secure translation table descriptors are always fetched from Non-secure memory.

6.11.1Backwards-compatible page table translation subpage AP bits enabled

When the CP15 Control Register c1 bit 23 is set to 0, the subpage AP bits are enabled and the page table formats are backwards-compatible with ARMv4 and ARMv5 MMU architectures. This bit is duplicated as Secure and Non-secure versions so that the system can enable or disable subpages independently in each world.

All mappings are treated as global, and executable, XN = 0. All Normal memory is Non-Shared. Device memory can be Shared or Non-Shared as determined by the TEX bits and the C and B bits. For large and small pages, there can be four subpages defined with different access permissions. For a large page, the subpage size is 16KB and is accessed using bits [15:14] of the page index of the virtual address. For a small page, the subpage size is 1KB and is accessed using bits [11:10] of the page index of the virtual address.

The use of subpage AP bits where AP3, AP2, AP1, and AP0 contain different values is deprecated.

Backwards-compatible page table format

Figure 6-4 shows a backwards-compatible format first-level descriptor.

Figure 6-4 Backwards-compatible first-level descriptor format

If the P bit is supported and set for the memory region, it indicates to the system memory controller that this memory region has ECC enabled. ARM1176JZ-S processors do not support the P bit.

When bits [1:0] of the first-level descriptor are b01, the descriptor points to a second-level page table, called a Coarse page table. Figure 6-5 on page 6-38 shows a backwards-compatible format second-level descriptors.

Memory Management Unit

Figure 6-5 Backwards-compatible second-level descriptor format

For extended small page table entries without a TEX field you must use the value b000.For details of TEX encodings see C and B bit, and type extension field encodings on page 6-14.

Note

For any Supersection description in a first-level page table, and any Large page description in a second-level page table:

•you must repeat the description in 16 consecutive page table locations

•the first description must occur on a 16-word boundary

For more information see the ARM Architecture Reference Manual.

Figure 6-6 shows an overview of the section, supersection, and page translation process using backwards-compatible descriptors.

Figure 6-6 Backwards-compatible section, supersection, and page translation

Memory Management Unit

6.11.2ARMv6 page table translation subpage AP bits disabled

When the CP15 Control Register c1 Bit 23 is set to 1 in the corresponding world, the subpage AP bits are disabled and the page tables have support for ARMv6 MMU features. Four new page table bits are added to support these features:

•The Not-Global (nG) bit, determines if the translation is marked as global (0), or process-specific (1) in the TLB. For process-specific translations the translation is inserted into the TLB using the current ASID, from the ContextID Register, CP15 c13.

•The Shared (S) bit, determines if the translation is for Non-Shared (0), or Shared (1) memory. This only applies to Normal memory regions. Device memory can be Shared or Non-Shared as determined by the TEX bits and the C and B bits.

•The Execute-Never (XN) bit, determines if the region is Executable (0) or Not-executable

(1).

•Three access permission bits. The access permissions extension (APX) bit, provides an extra access permission bit.

All ARMv6 page table mappings support the TEX field.

ARMv6 page table format

With the sub-pages enabled or not, all first level descriptors have been enhanced with the addition of the NS Attribute bit to enable the support of TrustZone.

Figure 6-7 shows the format of an ARMv6 first-level descriptor when subpages are disabled.

Figure 6-7 ARMv6 first-level descriptor formats with subpages disabled

If the P bit is supported and set for the memory region, it indicates to the system memory controller that this memory region has ECC enabled. ARM1176JZ-S processors do not support the P bit. In addition to the invalid translation, bits [1:0] = b00, translations for the reserved entry, bits [1:0] = b11, result in a translation fault.

As shown in Figure 6-7, bits [1:0] of a level 1 page table entry determine the type of the entry:

Bits [1:0] == b00

Translation fault.

Bits [1:0] == b01

The entry points to a second-level page table, called a Coarse page table. Figure 6-8 on page 6-40 shows the formats of the possible entries in the Coarse page table.

Memory Management Unit

Bits [1:0] == b10

The entry points to a either a 1MB Section of memory or a 16MB Supersection of memory. Bit [18] of the descriptor selects between a Section and a Supersection. For details of supersections see Supersections on page 6-6.

Note

You must repeat any Supersection description in 16 consecutive page table locations, with the first description occurring on a 16-word boundary. For more information see the ARM Architecture Reference Manual.

Bits [1:0] == b11

Reserved.

Figure 6-8 shows the format of an ARMv6 second-level descriptor.

As shown in Figure 6-8, bits [1:0] of a second-level descriptor determine the type of the descriptor:

Bits [1:0] == b00

Translation fault.

Bits [1:0] == b01

The entry points to a 64KB Large page in memory.

Note

You must repeat any Large page description in 16 consecutive page table locations, with the first description occurring on a 16-word boundary. For more information see the ARM Architecture Reference Manual.

Bits [1:0] == b1x

The entry points to a 4KB Extended small page in memory.

Bit [0] of the entry is the XN bit for the entry.

Figure 6-9 on page 6-41 shows an overview of the section, supersection, and page translation process using ARMv6 descriptors.