S3C2410MMU

Many years ago, when people were still using DOS or older operating systems, computer memory was very small, generally calculated in K units. Correspondingly, the program size at that time was not large, so although the memory capacity was small, it could still accommodate the programs at that time. However, with the rise of graphical interfaces and the continuous increase in user needs, the size of application programs has also expanded. Finally, a problem appeared in front of programmers, that is, the application program is too large to be accommodated in the memory. The usual solution is to divide the program into many fragments called overlay blocks. Overlay block 0 runs first, and when it ends, it will call another overlay block. Although the exchange of overlay blocks is completed by the OS, the programmer must first divide the program, which is a time-consuming and laborious task, and it is quite boring. People must find a better way to fundamentally solve this problem. Soon people found a solution, which is virtual memory. The basic idea of ​​virtual memory is that the total size of programs, data, and stacks can exceed the size of physical memory. The operating system keeps the currently used part in memory and saves other unused parts on the disk. For example, for a 16MB program and a machine with only 4MB of memory, the OS can choose which 4MB of content to keep in memory at each time, and exchange program fragments between memory and disk when necessary, so that the 16MB program can be run on a machine with only 4MB of memory. And this 16MB program does not need to be split by the programmer before running.

At any time, there is a set of addresses that a program can generate on the computer, which we call the address range. The size of this range is determined by the number of bits of the CPU. For example, for a 32-bit CPU, its address range is 0~0xFFFFFFFF (4G), and for a 64-bit CPU, its address range is 0~0xFFFFFFFFFFFFFFFF (64T). This range is the address range that our program can generate. We call this address range the virtual address space, and a certain address in this space is called a virtual address. Corresponding to the virtual address space and virtual address are the physical address space and physical address. Most of the time, the physical address space of our system is only a subset of the virtual address space. Here is a simple example to illustrate the two intuitively. For a 32-bit x86 host with 256MB of memory, its virtual address space range is 0~0xFFFFFFFF (4G), and the physical address space range is 0x000000000~0x0FFFFFFF (256MB).
On a machine that does not use virtual memory, the virtual address is sent directly to the memory bus, so that the physical memory with the same address can be read and written. In the case of using virtual memory, the virtual address is not sent directly to the memory address bus, but to the memory management unit - MMU (the protagonist finally appears:]). It consists of one or a group of chips, generally in the coprocessor, and its function is to map virtual addresses to physical addresses.

Most systems that use virtual memory use a method called paging. The virtual address space is divided into units called pages, and the corresponding physical address space is also divided into units called page frames. The size of the page and the page frame must be the same. Next, I will use an example with pictures to illustrate how the mapping between pages and page frames is performed under the scheduling of the MMU.
 

In this example, we have a machine that can generate 16-bit addresses. Its virtual address range is from 0x0000 to 0xFFFF (64K), and this machine has only 32K physical addresses. Therefore, it can run a 64K program, but the program cannot be loaded into the memory at one time. This machine must have an external memory (such as a disk or FLASH) that can store 64K programs to ensure that program fragments can be called when needed. In this example, the page size is 4K, and the page frame size is the same as the page (this must be guaranteed. The transmission between the memory and the peripheral memory is always in pages). Corresponding to the 64K virtual address and 32K physical memory, they contain 16 pages and 8 page frames respectively.

Let's first explain several terms used after paging based on the above figure. We have already touched on pages and page frames above. The green part in the above figure is the physical space, in which each grid represents a physical page frame. The orange part is the virtual space, each grid represents a page, which consists of two parts, namely Frame Index and bit p (present bit). The meaning of Frame Index is obvious, it indicates which physical page frame this page is mapped to, and the meaning of bit p is to indicate whether the mapping of this page is valid. As shown in the figure above, when a page is not mapped (or "invalid mapping", the Frame Index part is X), the bit is 0, and the bit is 1 when the mapping is valid.
We execute the following instructions (the instructions in this example are not for any specific model, they are all pseudo instructions)
Example 1:
MOVE REG,0 // Pass the value of address 0 into register REG.
Virtual address 0 will be sent to MMU, MMU sees that the virtual address falls within the range of page 0 (page 0 range is 0 to 4095), from the figure above we can see that the corresponding (mapped) page frame of page 0 is 2 (the address range of page frame 2 is 8192 to 12287), so MMU converts the virtual address into physical address 8192 and sends address 8192 to the address bus. Memory knows nothing about the MMU's mappings, it just sees a read request for address 8192 and executes it. The MMU thus maps virtual addresses 0 to 4096 to physical addresses 8192 to 12287.
Example 2:
MOVE REG,8192
is converted to
MOVE REG,24576 
because virtual address 8192 is in page 2, which is mapped to page frame 6 (physical addresses from 24576 to 28671)
Example 3:
MOVE REG,20500
is converted to
MOVE REG,12308
Virtual address 20500 is 20 bytes from the beginning of virtual page 5 (virtual address range is 20480 to 24575), which is mapped to page frame 3 (page frame 3 address range is 12288 to 16383), so it is mapped to physical address 12288+20=12308.
By properly setting the MMU, 16 virtual pages can be mapped to any of the 8 page frames, but this method does not effectively solve the problem that the virtual address space is larger than the physical address space. From the above figure, we can see that we only have 8 page frames (physical addresses), but we have 16 pages (virtual addresses), so we can only map 8 of the 16 pages effectively. Let's see what happens in Example 4.
MOV REG, 32780
virtual address 32780 falls within the range of page 8. From the above figure, we can see that page 8 is not effectively mapped (the page is marked with an X). What happens? The MMU notices that this page is not mapped, so it notifies the CPU that a page fault has occurred. In this case, the operating system must handle this page fault. It must find a page frame that is currently rarely used from the 8 physical page frames and write the contents of the page frame to the peripheral memory (this action is called page copy), then map the page to be referenced (page 8 in Example 4) to the page frame just released (this action is called modifying the mapping relationship), and then re-execute the instruction that caused the fault (MOV REG, 32780). Assuming that the operating system decides to release page frame 1, it will load virtual page 8 into the physical address 4-8K and make two modifications: first, mark virtual page 1 as unmapped (originally virtual page 1 was mapped to page frame 1), so that any subsequent access to virtual addresses 4K to 8K will cause a page fault and the operating system will take appropriate actions (this action is what we are discussing now), and secondly, it changes the page frame number corresponding to virtual page 8 from X to 1, so when MOV REG, 32780 is re-executed, MMU will map 32780 to 4108.

We have a general understanding of what role MMU plays in our machine and what its basic work content is. Below we will give an example to illustrate how it works (note that the MMU in this example is not targeted at a specific model, it is an abstraction of all MMU work).

We already know that most systems that use virtual memory use a technique called paging. Just like the example we just gave, the virtual address space is divided into a group of pages of the same size, and each page has a page number to identify it (this page number is generally its index in the group, which is similar to an array in C/C++). In the above example, the page number of 0~4K is 0, the page number of 4~8K is 1, the page number of 8~12K is 2, and so on. The virtual address (note: it is a fixed address, not a space) is divided into two parts by the MMU. The first part is the page index (page index), and the second part is the offset relative to the first address of the page. Let's use the 16-bit machine just now and combine it with the figure below to illustrate an example. In this example, the virtual address 8196 is sent to the MMU, and the MMU maps it to a physical address. The total address range that a 16-bit CPU can generate is 0~64K. Calculated based on the size of 4K per page, the space must be divided into 16 pages. The range that can be expressed by the first part of our virtual address must also be equal to 16 (so that every page in the page group can be indexed), which means that this part requires at least 4 bits. The size of a page is 4K (4096), which means that the offset part must be represented by 12 bits (2^12=4096, so that all addresses in a page can be accessed). The binary code of 8196 is shown in the figure below:

The page number index of this address is 0010 (binary code), that is, the indexed page is page 2, the second part is 000000000100 (binary), and the offset is 4. The page frame number in page 2 is 6 (page 2 is mapped to page frame 6, see the figure above), and we can see that the physical address of page frame 6 is 24~28K. So the MMU calculates that the virtual address 8196 should be mapped to the physical address 24580 (page frame first address + offset = 24576 + 4 = 24580). Similarly, if we read the virtual address 1026, the binary code of 1026 is 0000010000000010, page index = 0000 = 0, offset = 010000000010 = 1026. The page number is 0, the page frame number mapped to this page is 2, and the physical address range of page frame 2 is 8192~12287, so the MMU maps the virtual address 1026 to the physical address 9218 (page frame first address + offset = 8192 + 1026 = 9218).
The above is the working process of the MMU.
Next, we will explain the MMU (Note 1) of s3c2410.
S3c2410 has a total of 4 memory mapping modes, namely:
1. Fault (no mapping)
2. Coarse Page (coarse table
) 3. Section (segment)
4. Fine Page (fine table)
We will explain it with Section.

ARM920T is a 32-bit CPU, and its virtual address space is 2^32=4G. In Section mode, this 4G virtual space is divided into units called sections (which are essentially the same as the pages we talked about above), and the length of each segment is 1M (while the length of the page we used before is 4K). 4G virtual memory can be divided into 4096 segments (1M*4096=4G), so we must use 4096 descriptors to describe this group of segments. Each descriptor occupies 4 bytes, so the size of this group of descriptors is 16KB (4K*4096). These 4096 descriptors form a table, which we call Tralaton Table.
 

The figure above is the structure of the descriptor
Section base address: segment base address (equivalent to the first address of the page frame number)
AP: Access control bit Access Permission
Domain: The index of the access control register. Domain is used in conjunction with AP to check access rights
C: When C is set to 1, it is write-through (WT) mode
B: When B is set to 1, it is write-back (WB) mode
(only one of the C and B bits can be set to 1 at the same time)

The following is a schematic diagram of the memory mapping of s3c2410:
 

The SDRSAM size configured on my s3c2410 is 64M, and the physical address range of the SDRAM is 0x3000 0000~0x33FF FFFF (belonging to Bank 6). Since the size of a Section is 1M, the physical space can be divided into 64 physical segments (page frames).
In Section mode, the virtual address (Note 1) sent to the MMU is divided into two parts (this is the same as the example we gave above), these two parts are Descriptor Index (equivalent to Page Index in the above example) and Offset, the length of descriptor index is 12 bits (2^12=4096, what can you see from this relationship? ：) ), and the length of Offset is 20 bits (2^20=1M, what can you see? ：)). Observe the Section Base Address part in a descriptor, its length is 12 bit, the value inside is the first 12 bits of the physical address of the physical segment (page frame) mapped to the virtual segment (page). Since the length of each physical segment is 1M, the last 20 bits of the physical segment head address are always 0x00000 (each Section is aligned to 1M). The method to determine a physical address is physical page frame base address + offset part in the virtual address = Section Base Address << 20 + Offset. Haha, maybe you are a little confused, so let me give a practical example to illustrate. Assume that the instruction
MOV REG is executed now,
the binary code of the virtual address 0x30000012 is 00110000 00000000 00000000 00010010.
The first 12 bits are Descriptor Index = 00110000 0000 = 768, so the descriptor No. 768 is found in the Translation Table. The Section Base Address of this description = 0x0300, which means that the first address of the physical segment (page frame) mapped by the virtual segment (page) described by the descriptor is 0x3000 0000 (the base address of the physical segment (page frame) = Section Base Address shifted left by 20 bits = 0x0300 << 20 = 0x3000 0000), and Offset = 000000 00000000 00010010 = 0x12, so the physical address mapped to the virtual address 0x30000012 = 0x3000 0000 + 0x12 = 0x3000 0012 (physical page frame base address + offset in the virtual address). You may ask why this virtual address is the same as the mapped physical address? This is determined by the mapping rule we defined. In this example, the mapping rule we defined is to map the virtual address to the physical address that is equal to it. We write the mapping code like this:
void mem_mapping_linear(void)
{
    unsigned long descriptor_index, section_base, sdram_base, sdram_size;
    sdram_base=0x30000000;
    sdram_size=0x 4000000;
    for (section _base= sdram_base,descriptor_index = section _base>>20;
         section _base < sdram_base+ sdram_size; 
         descriptor_index+=1;section _base +=0x100000)
    {
         *(mmu_tlb_base + (descriptor_index)) = (section _base>>20) | MMU_OTHER_SECDESC;
    }
}
The above code maps the virtual space 0x3000 0000~0x33FF FFFF to the physical space 0x3000 0000~0x33FF FFFF, because the virtual space and the physical space are consistent, the virtual address and their corresponding physical address are consistent in value. After initializing the Translation Table, remember to load the first address of the Translation Table (the address of the 0th descriptor) into the Control Register 2 (Control Register 2) of the coprocessor CP15. The name of this control register is called Translation table base (TTB) register.
The above discussion is about the Section Base Address in the descriptor and the mapping relationship between the virtual address and the physical address. However, MMU also has an important function, which is the access control mechanism (Access Permission).

Simply put, the access control mechanism is that the CPU uses some method to determine whether the current program's access to the memory is legal (whether it has the permission to access the memory). If the current program does not have the permission to operate the memory area to be accessed, the CPU will cause an exception. The s3c2410 calls this exception a Permission fault, and the x86 architecture calls this exception a general protection exception (General Protection). What situations will cause a Permission fault? For example, if a program at the User level wants to write to a System level memory area, this operation is unauthorized and should cause a Permission fault. Friends who have worked on the x86 architecture should have heard of the protection mode. The protection mode works based on this idea. So we can also say that the access control mechanism of s3c2410 is actually a protection mechanism. So what elements are involved in the access control mechanism of s3c2410? How do they coordinate with each other? These elements are:
1. Control Register3 in coprocessor CP15: DOMAIN ACCESS CONTROL REGISTER 
2. AP bit and Domain bit in segment descriptor
3. S bit and R bit in Control Register1 (control register 1) in coprocessor CP15 
4. Control Register5 (control register 5) in coprocessor CP15
5. Control Register 6 (DOMAIN ACCESS CONTROL REGISTER) in coprocessor CP15
is the access control register. The effective bits of this register are 32 and are divided into 16 areas. Each area consists of two bits, which describe the level of access rights check for the current memory, as shown in the following figure:
 

There are 4 values ​​that can be filled in each area, namely 00, 01, 10, 11 (binary), and their meanings are as follows:
 

00: At the current level, this memory area is not allowed to be accessed, and any access will cause a domain fault.
01: At the current level, access to this memory area must be checked with the AP bit in the segment descriptor of the memory area.
10: Reserved status (it is best not to fill in this value to avoid uncertain problems).
11: At the current level, no permission check is performed on access to this memory area.
Let's take a look at the Domain area in the discriptor. This area has a total of 4 bits, and the values ​​inside are indexes of the 16 areas in the DOMAIN ACCESS CONTROL REGISTER. The AP bit, together with the S bit and the A bit, describes the access rights of the memory area described by the current descriptor. Their coordination relationship is shown in the figure below: The AP bit also has four values. I will explain it with examples. In the following example, our DOMAIN ACCESS CONTROL REGISTER is initialized to 0xFFFF BDCF, as shown in the figure below: Example 1: domain=4, AP=10 in the discriptor (in this case, S bit and A bit are ignored) Suppose now I want to access the memory area described by the descriptor: Since domain=4, and the value of field 4 in the DOMAIN ACCESS CONTROL REGISTER is 01, the system will check the access rights for this access. Assuming that the current CPU is in Supervisor mode, the program can read and write the memory area described by the descriptor. Assuming that the current CPU is in User mode, the program can read the memory described by the descriptor, and a permission fault will be caused if it is written to it. Example 2: domain=0,AP=10 in Discriptor (S bit, A bit are ignored in this case) domain=0, and the value of field 0 in DOMAIN ACCESS CONTROL REGISTER is 11, the system does not check the access rights for any memory area. Since the system does not check the access rights for any memory area, the program can read and write the memory described by the descriptor smoothly regardless of the CPU mode (Supervisor mode or User mode) Example 3: domain=4,AP=11 in Discriptor (S bit, A bit are ignored in this case) Since domain=4, and the value of field 4 in DOMAIN ACCESS CONTROL REGISTER is 01, the system will check the access rights for this access. Since AP=11, no matter the CPU is in any mode (Supervisor mode or User mode), the program can smoothly read and write the memory described by the descriptor Example 4: domain=4,AP=00, S bit=0,A bit=0 in Discriptor Since domain=4, and the value of field 4 in DOMAIN ACCESS CONTROL REGISTER is 01, the system will check the access rights for the access. Since AP=00, S bit=0,A bit=0, no matter the CPU is in any mode (Supervisor mode or User mode), the program can only read the memory described by the descriptor, otherwise it will cause a permission fault. Through the above 4 examples, we can draw two conclusions: 1. Whether the access to a certain memory area needs to be checked for permissions is determined by the Domain field in the descriptor of the memory area. 2. The access rights of a certain memory area are determined by the AP bit in the descriptor of the memory area and the S bit and R bit in Control Register1 (control register 1) in the coprocessor CP15. This is the end of our discussion on the access control mechanism. Note 1: For s3c2410, MMU uses Modify Visual Address (MVA) for addressing, which is a transformation of Virtual Address. I will introduce MVA to you later when I talk about process switching.