ARM MMU

Here is a summary of the three major functions of MMU:

1. Conversion from virtual address to physical address

2.Cache control

3. Memory access rights protection

The Linux kernel uses three levels of page tables: PGD, PMD, and PTE. For many architectures, the PMD level has only one entry.

The hardware operation sequence when the CPU accesses memory

The order of hardware operations when the CPU accesses memory. Each step has a corresponding label in the figure:

1 The CPU core (ARM in the figure) sends a VA request to read data, and the TLB (translation lookaside buffer) receives the address. Why does the TLB receive the address first? Because the TLB is a cache in the MMU (also a cache, a cache between the CPU core and the physical memory), it caches the page table entries corresponding to the recently searched VA. If the TLB caches the page table entry of the current VA, there is no need to do a translation table walk. Otherwise, the page table entry is read from the physical memory and saved in the TLB. The TLB cache can reduce the number of accesses to the physical memory.

2 The page table entry not only stores the base address of the physical page, but also stores the permissions and whether the cache is allowed. The MMU first checks the permission bit. If there is no access permission, an exception is raised to the CPU core. Then it checks whether the cache is allowed. If the cache is allowed, the cache and CPU core interoperation is enabled.

3 If cache is not allowed, PA is directly issued to read data from physical memory to the CPU core.

4 If cache is allowed, VA is used as the index to search the cache to see if the data to be read is cached. If the data is already cached in the cache (called a cache hit), it is directly returned to the CPU core. If the data is not cached in the cache (called a cache miss), PA is issued to read the data from the physical memory and cache it in the cache, and then return it to the CPU core. However, the cache does not only cache the data required by the CPU core, but also caches all adjacent data, which is called a cache line. The cache line of ARM920T is 32 bytes. For example, if the CPU core wants to read 4 bytes of data at address 0x30000134~0x3000137, the cache will cache the 32 bytes at address 0x30000120~0x3000137 (aligned to the 32-byte address boundary).

The following full text reproduces the s3c6410_MMU address mapping process details

refer to:

1) "ARM1176 JZF-S Technical Reference Manual":

Chapter 3 System Control Coprocessor

Chapter 6 Memory Management Unit

2) u-boot source code:

u-boot-xxx/cpu/s3c64xx/start.S

u-boot-xxx/board/samsung/smdk6410/lowlevel_init.S

1. Brief Introduction of ARMv6 MMU

1) MMU is controlled by coprocessor CP15;

2) MMU functions: address mapping (VA->PA), memory access permission control;

3) Virtual address to physical address conversion process: Micro TLB->Main TLB->Page Table Walk

Refer to "ARM1176 JZF-S Technical Reference Manual" Section 6.3, Memory access sequence

An excerpt from the reference manual:

When the processor generates a memory access, the MMU:

1. Performs a lookup for a mapping for the requested virtual address and current ASID and

current world, Secure or Non-secure, in the relevant Instruction or Data MicroTLB.

2. If step 1 misses then a lookup for a mapping for the requested virtual address and current

ASID and current world, Secure or Non-secure, in the main TLB is performed.

If no global mapping, or mapping for the currently selected ASID, or no matching NSTID, for

the virtual address can be found in the TLBs then a translation table walk is automatically

performed by hardware, unless Page Table Walks are disabled by the PD0 or PD1 bits in the

TTB Control register, that cause the processor to return a Section Translation fault. See

Hardware page table translation on page 6-36.

If a matching TLB entry is found then the information it contains is used as follows:

1. The access permission bits and the domain are used to determine if the access is permitted.

If the access is not permitted the MMU signals a memory abort, otherwise the access is

enabled to proceed. Memory access control on page 6-11 describes how this is done.

2. The memory region attributes control the cache and write buffer, and determine if the

access is Secure or Non-secure cached, uncached, or device, and if it is shared, as Memory

region attributes on page 6-14 describes.

3. The physical address is used for any access to external or tightly coupled memory to

perform Tag matching for cache entries.

2. Detailed description of address mapping process

Refer to "ARM1176 JZF-S Technical Reference Manual" section 6.11, Hardware page table translation

About page tables: ARMv6's MMU involves two types of page tables when performing address mapping, the first level page table and the coarse page table.

About mapping mode: There are two mapping modes, segment mapping and page mapping. Segment mapping only uses the first-level page table, while page mapping uses the first-level page table and the second-level page table.

Regarding mapping granularity: There are two mapping granularities for segment mapping, 1M section and 16M supersection; there are also two mapping granularities for page mapping, 4K small page and 64K large page.

When the hardware is doing address translation, how does it know the current mapping mode and mapping granularity?

This information can be obtained from the entry descriptor of the page table.

The format of the first-level descriptor entry of the first-level page table is as follows:

Bits [1:0] determine the mapping method:

When [1:0]=10b, it is segment mapping. In this case, only one level of mapping is required. The highest 12 or 8 bits of the descriptor store the segment base address.

When [1:0]=01b, it is page mapping. At this time, the conversion of virtual address to physical address needs to go through secondary mapping. The highest 22 bits of the descriptor store the physical address of the secondary page table.

Bit [18] determines the granularity of the segment mapping:

When [18]=0b, the mapping granularity is 1M, and the highest 12 bits of the descriptor store the segment base address;

When [18]=1b, the mapping granularity is 16M, and the highest 8 bits of the descriptor store the segment base address;

When the mapping mode is page mapping, we use the second-level page table. The format of the entry descriptor of the second-level page table is as follows:

Bits [1:0] determine the mapping granularity of the page mapping:

When [1:0]=10b or 11b, the mapping granularity is 4KB, and the highest 20 bits of the descriptor are the page base address;

When [1:0]=01b, the mapping granularity is 64KB, and the highest 16 bits of the descriptor are the page base address;

The following describes the address mapping process in detail in four cases:

1) Segment mapping, mapping granularity is 1M

2) Segment mapping, mapping granularity is 16M

3) Page mapping, mapping granularity is 4K

4) Page mapping, mapping granularity is 64K

2.1 segment mapping, mapping granularity is 1M

When the mapping mode is segment mapping and the mapping granularity is 1M, the mapping diagram is as follows:

The mapping process from virtual address to physical address is as follows:

1. The [31:20] bits of the virtual address store the entry index of the first-level page table, and the [19:0] bits store the segment offset;

2. Get the base address of the first-level page table from the TTBR (translation table base register, a register in the coprocessor CP15, used to store the base address of the first-level page table) register;

3. Level 1 page table base address + VA[31:20] = the entry address of the page table descriptor corresponding to the virtual address;

4. Bits [31:20] of the page table descriptor are the physical segment base address corresponding to the virtual address;

5. Physical segment base address + VA[19:0] segment offset = physical address

From the mapping diagram, we can see that a virtual address can index 2^12 first-level page table entries, each entry maps 2^20 memory, so the maximum physical memory that the virtual address can map is: 2^12 * 2^20, which is 4G.

2.2 Segment mapping, mapping granularity is 16M

When the mapping mode is segment mapping and the mapping granularity is 16M, the mapping diagram is as follows:

The mapping process from virtual address to physical address is as follows:

1. The [31:24] bits of the virtual address store the entry index of the first-level page table, and the [23:0] bits store the segment offset;

2. Get the base address of the first-level page table from the TTBR (translation table base register, a register in the coprocessor CP15, used to store the base address of the first-level page table) register;

3. Level 1 page table base address + VA[31:24] = the entry address of the page table descriptor corresponding to the virtual address;

4. Bits [31:24] of the page table descriptor are the physical segment base address corresponding to the virtual address;

5. Physical segment base address + VA[23:0] segment offset = physical address

From the mapping diagram, we can see that a virtual address can index 2^8 first-level page table entries, each entry maps 2^24 memory, so the maximum physical memory that the virtual address can map is: 2^8 * 2^24, which is 4G.

2.3 Page mapping, mapping granularity is 4K

When the mapping mode is page mapping and the mapping granularity is 4K, the mapping diagram is as follows:

The mapping process from virtual address to physical address is as follows:

1. The [31:20] bits of the virtual address store the entry index of the first-level page table, the [19:12] bits store the entry index of the second-level page table, and the [11:0] bits store the page offset;