Memory Management Unit
3.3 Address translation
The MMU translates VAs generated by the CPU core, and by CP15 register 13, into physical addresses to access external memory. It also derives and checks the access permission, using a TLB.
The MMU table walking hardware is used to add entries to the TLB. The translation information, that comprises both the address translation data and the access permission data, resides in a translation table located in physical memory. The MMU provides the logic for you to traverse this translation table and load entries into the TLB.
There are one or two stages in the hardware table walking, and permission checking, process. The number of stages depends on whether the address is marked as a section-mapped access or a page-mapped access.
There are three sizes of page-mapped accesses and one size of section-mapped access.
The page-mapped accesses are for:
• large pages
• small pages
• tiny pages.
The translation process always starts out in the same way, with a level one fetch. A section-mapped access requires only a level one fetch, but a page-mapped access requires a subsequent level two fetch.
3.3.1 Translation table base
The hardware translation process is initiated when the TLB does not contain a translation for the requested MVA. The Translation Table Base (TTB) register points to the base address of a table in physical memory that contains section or page descriptors, or both. The 14 low-order bits of the TTB register are set to zero on a read, and the table must reside on a 16KB boundary. Figure 3-1 shows the format of the TTB register.
Figure 3-1 Translation table base register The translation table has up to 4096 x 32-bit entries, each describing 1MB of virtual memory. This allows up to 4GB of virtual memory to be addressed. Figure 3-2 on page 3-7 shows the table walk process.
31 14 13 0
Translation table base
Memory Management Unit
Figure 3-2 Translating page tables Translation
table
4096 entries TTB base
Indexed by modified virtual address bits [31:20]
Level one fetch
Section
1 MB Indexed by
modified virtual address bits [19:0]
Section base
Coarse page table
256 entries Fine page table
1024 entries Indexed by
modified virtual address bits [19:12]
Indexed by modified virtual address bits [19:10]
Coarse page table base
Fine page table base
Level two fetch
Large page
64 KB Small page
4 KB
Tiny page
1 KB Large page base
Indexed by modified virtual address bits [15:0]
Indexed by modified virtual address bits [11:0]
Indexed by modified virtual address bits [9:0]
00
01 10
11 Invalid
00
10 01
11
00
10 01
11
1 KB subpage 1 KB subpage 1 KB subpage 1 KB subpage 16 KB subpage 16 KB subpage 16 KB subpage 16 KB subpage
Small page base
Tiny page base Invalid
Invalid
Invalid
Memory Management Unit
3.3.2 Level one fetch
Bits [31:14] of the TTB register are concatenated with bits [31:20] of the MVA to produce a 30-bit address as shown in Figure 3-3.
Figure 3-3 Accessing translation table level one descriptors This address selects a 4-byte translation table entry. This is a level one descriptor for either a section or a page table.
31 20 19 0
Table index
31 14 13 0
Translation base
31 14 13 2 1 0
Table index 0 0
Translation base
31 0
Level one descriptor
Modified virtual address
Translation table base
Memory Management Unit
3.3.3 Level one descriptor
The level one descriptor returned is either a section descriptor, a coarse page table descriptor, or a fine page table descriptor, or is invalid. Figure 3-4 shows the format of a level one descriptor.
Figure 3-4 Level one descriptor A section descriptor provides the base address of a 1MB block of memory.
The page table descriptors provide the base address of a page table that contains level two descriptors. There are two sizes of page table:
• coarse page tables have 256 entries, splitting the 1MB that the table describes into 4KB blocks
• fine page tables have 1024 entries, splitting the 1MB that the table describes into 1KB blocks.
Level one descriptor bit assignments are shown in Table 3-2.
31 20 19 12 11 10 9 8 5 4 3 2 1 0
0 0
Coarse page table base address Domain 1 0 1
Section base address AP Domain 1 C B 1 0
Fine page table base address Domain 1 1 1
Fault
Coarse page table
Section
Fine page table
Table 3-2 Level one descriptor bits Bits
Description Section Coarse Fine
31:20 31:10 31:12 These bits form the corresponding bits of the physical address
19:12 - - Should be zero
11:10 - - Access permission bits. Domain access control on
page 3-23 and Fault checking sequence on page 3-25 show
Memory Management Unit
The two least significant bits of the level one descriptor indicate the descriptor type as shown in Table 3-3.
9 9 11:9 Should be zero
8:5 8:5 8:5 Domain control bits
4 4 4 Must be 1
3:2 - - These bits, C and B, indicate whether the area of memory mapped by this page is treated as write-back cachable, write-through cachable, noncached buffered, or noncached nonbuffered
- 3:2 3:2 Should be zero
1:0 1:0 1:0 These bits indicate the page size and validity and are interpreted as shown in Table 3-3
Table 3-3 Interpreting level one descriptor bits [1:0]
Value Meaning Description
0 0 Invalid Generates a section translation fault
0 1 Coarse page table Indicates that this is a coarse page table descriptor 1 0 Section Indicates that this is a section descriptor
1 1 Fine page table Indicates that this is a fine page table descriptor
Table 3-2 Level one descriptor bits (continued) Bits
Description Section Coarse Fine
Memory Management Unit
3.3.4 Section descriptor
A section descriptor provides the base address of a 1MB block of memory. Figure 3-5 shows the format of a section descriptor.
Figure 3-5 Section descriptor Section descriptor bit assignments are described in Table 3-4.
SBZ
31 20 19 12 11 10 9 8 5 4 3 2 1 0
Section base address SBZ AP Domain 1 C B 1 0
Table 3-4 Section descriptor bits Bits Description
31:20 Form the corresponding bits of the physical address for a section 19:12 Always written as 0
11:10 (AP) Specify the access permissions for this section 9 Always written as 0
8:5 Specify one of the 16 possible domains (held in the domain access control register) that contain the primary access controls
4 Should be written as 1, for backward compatibility
3:2 These bits (C and B) indicate whether the area of memory mapped by this section is treated as write-back cachable, write-through cachable, noncached buffered or noncached nonbuffered
1:0 These bits must be 10 to indicate a section descriptor
Memory Management Unit
3.3.5 Coarse page table descriptor
A coarse page table descriptor provides the base address of a page table that contains level two descriptors for either large page or small page accesses. Coarse page tables have 256 entries, splitting the 1MB that the table describes into 4KB blocks. Figure 3-6 shows the format of a coarse page table descriptor.
Figure 3-6 Coarse page table descriptor Note
If a coarse page table descriptor is returned from the level one fetch, a level two fetch is initiated.
Coarse page table descriptor bit assignments are described in Table 3-5.
31 10 9 8 5 4 3 2 1 0
Coarse page table base address Domain 1 SBZ 0 1
SBZ
Table 3-5 Coarse page table descriptor bits Bits Description
31:10 These bits form the base for referencing the level two descriptor (the coarse page table index for the entry is derived from the MVA)
9 Always written as 0
8:5 These bits specify one of the 16 possible domains (held in the domain access control registers) that contain the primary access controls
4 Always written as 1 3:2 Always written as 0
1:0 These bits must be 01 to indicate a coarse page table descriptor
Memory Management Unit
3.3.6 Fine page table descriptor
A fine page table descriptor provides the base address of a page table that contains level two descriptors for large page, small page, or tiny page accesses. Fine page tables have 1024 entries, splitting the 1MB that the table describes into 1KB blocks. Figure 3-7 shows the format of a fine page table descriptor.
Figure 3-7 Fine page table descriptor Note
If a fine page table descriptor is returned from the level one fetch, a level two fetch is initiated.
Fine page table descriptor bit assignments are described in Table 3-6.
31 12 11 9 8 5 4 3 2 1 0
Fine page table base address SBZ Domain 1 SBZ 1 1
Table 3-6 Fine page table descriptor bits Bits Description
31:12 These bits form the base for referencing the level two descriptor (the fine page table index for the entry is derived from the MVA)
11:9 Always written as 0
8:5 These bits specify one of the 16 possible domains (held in the domain access control registers) that contain the primary access controls
4 Always written as 1 3:2 Always written as 0
1:0 These bits must be 11 to indicate a fine page table descriptor
Memory Management Unit
3.3.7 Translating section references
Figure 3-8 shows the complete section translation sequence.
Figure 3-8 Section translation Note
You must check access permissions contained in the level one descriptor before generating the physical address.
31 14 13 0
Translation base
31 14 13 2 1 0
Table index 0 0
Translation base
Modified virtual address
Translation table base
31 20 19 0
Table index Section index
31 20 19 0
Section index Section base address
Section level one descriptor
Physical address
31 20 19 0
Section base address AP Domain 1 C B 1 0 2 1 3 4 5 8 9 10 11 12
Memory Management Unit
3.3.8 Level two descriptor
If the level one fetch returns either a coarse page table descriptor or a fine page table descriptor, this provides the base address of the page table to be used. The page table is then accessed and a level two descriptor is returned. Figure 3-9 shows the format of level two descriptors.
Figure 3-9 Level two descriptor A level two descriptor defines a tiny, a small, or a large page descriptor, or is invalid:
• a large page descriptor provides the base address of a 64KB block of memory
• a small page descriptor provides the base address of a 4KB block of memory
• a tiny page descriptor provides the base address of a 1KB block of memory.
Coarse page tables provide base addresses for either small or large pages. Large page descriptors must be repeated in 16 consecutive entries. Small page descriptors must be repeated in each consecutive entry.
Fine page tables provide base addresses for large, small, or tiny pages. Large page descriptors must be repeated in 64 consecutive entries. Small page descriptors must be repeated in four consecutive entries and tiny page descriptors must be repeated in each consecutive entry.
31 12 11 10 9 8 5 4 3 2 1 0
0 0
Large page base address 0 1
Small page base address C B 1 0
Tiny page base address 1 1
Fault
Large page
Small page
Tiny page 7 6
16 15
B C C B ap0
ap0
ap ap1 ap2 ap3
ap1 ap2 ap3
Memory Management Unit
Level two descriptor bit assignments are described in Table 3-7.
The two least significant bits of the level two descriptor indicate the descriptor type as shown in Table 3-8.
Note
Tiny pages do not support subpage permissions and therefore only have one set of access permission bits.
Table 3-7 Level two descriptor bits Bits
Description Large Small Tiny
31:16 31:12 31:10 These bits form the corresponding bits of the physical address
15:12 - 9:6 Should be zero
11:4 11:4 5:4 Access permission bits. Domain access control on page 3-23 and Fault checking sequence on page 3-25 show how to interpret the access permission bits
3:2 3:2 3:2 These bits, C and B, indicate whether the area of memory mapped by this page is treated as write-back cachable, write-through cachable, noncached buffered, or noncached nonbuffered
1:0 1:0 1:0 These bits indicate the page size and validity and are interpreted as shown in Table 3-8
Table 3-8 Interpreting page table entry bits [1:0]
Value Meaning Description
0 0 Invalid Generates a page translation fault
0 1 Large page Indicates that this is a 64KB page
1 0 Small page Indicates that this is a 4KB page
1 1 Tiny page Indicates that this is a 1KB page
Memory Management Unit
3.3.9 Translating large page references
Figure 3-10 on page 3-17 shows the complete translation sequence for a 64KB large page.
Figure 3-10 Large page translation from a coarse page table Because the upper four bits of the page index and low-order four bits of the coarse page table index overlap, each coarse page table entry for a large page must be duplicated 16 times (in consecutive memory locations) in the coarse page table.
31 14 13 0
Translation base
31 14 13 2 1 0
Table index 0 0
Translation base
Modified virtual address
Translation table base
31 20 19 0
Table index Page index
Level one descriptor
Physical address
31 0
Coarse page table base address Domain 1 1 2 1 3 4 5 8 9 10
L2
table index
16 15 12 11
31 16 15 0
Page index Page base address
Level two descriptor
31 0
Coarse page table base address L2 table index 0 2 1 9
10
31 16 15 0
Page base address ap3
0
0
ap2 ap1 ap0C B01 1 2 3 4 5 6 7 8 9 10 11 12
Memory Management Unit
If a large page descriptor is included in a fine page table, the high-order six bits of the page index and low-order six bits of the fine page table index overlap. Each fine page table entry for a large page must therefore be duplicated 64 times.
3.3.10 Translating small page references
Figure 3-11 shows the complete translation sequence for a 4KB small page.
Figure 3-11 Small page translation from a coarse page table
31 14 13 0
Translation base
31 14 13 2 1 0
Table index 0 0
Translation base
Modified virtual address
Translation table base
31 20 19 0
Table index Page index
Level one descriptor
Physical address
31 0
Coarse page table base address Domain 1 1 2 1 3 4 5 8 9 10
Level 2 table index
12 11
31 0
Page index Page base address
Level two descriptor
31 0
Coarse page table base address L2 table index 0 2 1 9
10
31 0
Page base address ap3
0
0
ap2 ap1 ap0C B10 1 2 3 4 5 6 7 8 9 10 11 12
11 12
Memory Management Unit
If a small page descriptor is included in a fine page table, the upper two bits of the page index and low-order two bits of the fine page table index overlap. Each fine page table entry for a small page must therefore be duplicated four times.
3.3.11 Translating tiny page references
Figure 3-12 shows the complete translation sequence for a 1KB tiny page.
Figure 3-12 Tiny page translation from a fine page table
31 14 13 0
Translation base
31 14 13 2 1 0
Table index 0 0
Translation base
Modified virtual address
Translation table base
31 20 19 0
Table index Page index
Level one descriptor
Physical address
31 0
Fine page table base address Domain 1 1 2 1 3 4 5 8 9 11
Level 2 table index
10 9
31 0
Page index Page base address
Level two descriptor
31 0
Fine page table base address L2 table index 0 2 1
31 0
Page base address
1
0
ap C B11 1 2 3 4 5 6 9 10 12
11 12
9 10
Memory Management Unit
Page translation involves one additional step beyond that of a section translation. The level one descriptor is the fine page table descriptor and this is used to point to the level one descriptor.
Note
The domain specified in the level one description and access permissions specified in the level one description together determine whether the access has permissions to proceed. See section Domain access control on page 3-23 for details.
3.3.12 Subpages
You can define access permissions for subpages of small and large pages. If, during a page walk, a small or large page has a non-identical subpage permission, only the subpage being accessed is written into the TLB. For example, a 16KB (large page) subpage entry is written into the TLB if the subpage permission differs, and a 64KB entry is put in the TLB if the subpage permissions are identical.
When you use subpage permissions, and the page entry then has to be invalidated, you must invalidate all four subpages separately.
Memory Management Unit