mmu arm v7

在arm架构中，页表有更多特别的含义。
ARM架构使用多级页表。
The specific mechanism of traversal and the table format are configurable by software and are explained later.

9.1.1 配置和使能MMU

在MMU使能之前，
the translation tables must be written to memory. The TTBR register must
be set to point to the tables.

9.2 The translation lookaside buffer

TLB 是MMU中最近执行页转换的缓存。
On a memory access, the MMU first checks whether the translation is cached in the TLB.
if the requested translation is available, you have a TLB hit, and the TLB provides the translation
of the physical address immediately.
在一次内存访问，MMU首先检查页转换是否在TLB中缓存，
如果请求的转换是可以得到的，你有一个TLB命中。
然后TLB提供立即提供物理地址转换。

If the TLB does not have a valid translation for that address, you have a TLB miss and an external translation table walk is required. This newly loaded translation can then be cached in the TLB for possible reuse

如果TLB没有这个地址的一个有效转换，你有一个TLB miss 和一个外部地址转换表walk的请求。
这个最新的加载转换可以接着在TLB中cached 。

TLB的确切结构在ARM处理器的实现中不同的。
下面是对典型系统的描述，但是个别实现可能与此不同

TLB coherency

当操作系统更改翻译表条目时，TLB可能包含陈旧的翻译信息。操作系统必须采取步骤使TLB项无效。有几个可用的CP15操作允许TLB全局无效或删除特定项。

由于投机的指令获取和数据读取可能会导致转换表遍历，所以在更改有效的转换表条目时，必须使TLB无效。不能将无效的转换表项缓存在TLB中，因此可以在不失效的情况下更改它们。

The Linux kernel has a number of functions that use these CP15 operations, including flush_tlb_all() and flush_tlb_range(). Such functions are not typically required by device drivers.

9.3 Choice of page sizes

页面大小基本上是由操作系统控制的，但是在选择大小时需要注意一些相关的事项。更小的页面大小能够更好地控制内存块，并可能减少页面中未使用的内存数量。如果一个任务需要7KB的数据空间，则分配给它两个4KB的页面，而不是64KB的页面或1MB的部分，那么未使用的空间就会更少。更小的页面大小还可以更好地控制权限、缓存属性等。
但是，随着页面大小的增加，TLB中的每个条目都持有一个对更大内存块的引用。因此，在任何访问中都更有可能出现TLB命中，因此会有更少的转换表遍历来降低外部内存的速度。因此，16MB的超区域可以用于不需要详细映射的大内存块。此外，每个L2转换表需要1KB的内存。

9.4 First Level address translation

Consider the process by which a virtual address is translated to a physical addresss
using level1 translation table entries on an ARM core
The first step is to locate the translation table entry associated with the virtual address。

考虑虚拟地址转换到物理地址的处理，使用level1 转换表条目。第一步是去定位是去定位与虚拟地址相关的转换表条目。
L1转换表将32位核心的完整4GB地址空间划分为4096个大小相同的部分，每个部分描述1MB的虚拟内存空间。

The ARM MMU supports a multi-level translation table architecture with two levels of translation tables, level 1 (L1) and level 2 (L2).

ARM MMU支持多级转换表结构 2levels 转换表level 1和level2.

The base address of the L1 translation table is known as the Translation Table Base Address and is held in CP15 c2

L1 转换表的基地址常叫转换表基地址保存在CP15 C2寄存器

举个简单例子：
假设L1 转换表存在地址0x1230-0000.
处理器发出虚拟地址0x0010-0000.
它的高12位【31:20】定义虚拟地址要访问哪一个1MB。
这个例子里是0x001，那么MMU必须读table entry1 页表条目1
0x001 * 4 bytes = address offset of 0x004

The address of the entry the MMU reads the physical address from is 0x12300000 + 0x004 = 0x12300004.

now that you have the location of the translation table entry, you can use it to determine the
physical memory address.

L1 translation table entries 有四种可能类型

1. 1MB 转换条目部分。映射一个1MB空间到一个物理地址。
2. 一个指向l2转换表入口的指针。这使能1个1MB片的内存，可以被细分到页。
3. 16MB supersection.
4. A fault entry that generates an abort exception. This can be either a prefetch or data abort, depending on the type of access. This effectively indicates virtual addresses that are unmapped.
   一个故障入口，that 产生一个中止异常。这个可以是prefetch或者data abort 依赖于访问的类型。
   这个有效的
   
   error
   Error is deviation from actual and expected value.
   It represents mistake made by people.

fault
Fault is incorrect step, process or data definition in a computer program which causes the program to behave in an unintended or unanticipated manner.
It is the result of the error.

failure
Failure is the inability of a system or a component to perform its required functions within specified performance requirements.
Failure occurs when fault executes.

exception
简而言之，异常就是那些我们能够预料到的，可能会出现的使得程序不能正常运行的行为

https://blog.csdn.net/qq_14982047/article/details/51016905

The least significant two bits [1:0] in the entry define whether the entry is a fault entry, a translation table entry, or a section entry. Bit [18] is used to distinguish between a normal section and supersection.

最低有效 2bit【1:0】在entry中，定义是否entry是一个fault entry。一个转换表entry或者是一个section entry。bit【18】是用来区分normal section 和 superseciton

Figure 9.6 shows the simplest case in which the physical address of a 1MB section is directly generated from the contents of a single entry in the level 1 translation table.

图示 最简单的case 在这个case中1MB 段的物理地址是直接从level1转换表中一个单独条目生成的。

9.5. Level 2 translation tables

An L2 translation table has 256 word-sized (4 byte) entries, requires 1KB of memory space and must be aligned to a 1KB boundary. Each entry translates a 4KB block of virtual memory to a 4KB block in physical memory. A translation table entry can give the base address of either a 4KB or 64KB page.

一个Level2 转换表有256 个4byte的entries，需要1KB的memory 空间而且必须是1KB boundary。
每一个entry转换1个4KB 块的虚拟存储到4KB块的存储。一个转换表entry可以提供4kb或者64KB页的基地址。

9.6. Memory attributes

9.7. Multi-tasking and OS usage of translation tables

In most systems using Cortex-A series processors, you will have a number of applications or tasks running concurrently. Each task can have its own unique translation tables residing in physical memory. Typically, much of the memory system is organized so that the virtual-to-physical address mapping is fixed, with translation table entries that never change. This typically is used to contain operating system code and data, and also the translation tables used by individual tasks.

Whenever an application is started, the operating system will allocate it a set of translation table entries that map both the code and data used by the application to physical memory. If the application has to map in code or extra data space (for example through a malloc() call), the kernel can subsequently modify these tables. When a task completes and the application is no longer running, the kernel can remove any associated translation table entries and re-use the space for a new application. In this way, multiple tasks can be resident in physical memory. On a task switch, the kernel switches translation table entries to the page in the next thread to be run. In addition, the dormant tasks are completely protected from the running task. This means that the MMU can prevent the running task from accessing the code or data of other tasks.

在多数使用cortex-A处理器系统，你将有一些 应用或者tasks同步执行。
每一个task可以有它自己独特的转换表贮存在物理内存中。
典型的，许多内存系统是有组织的，所以虚拟到物理地址映射是fixed。转换表条目是不会改变。

无论什么时候一个应用启动，操作系统会分配它一组转换表，它映射包括应用使用的code和data到物理存储。 如果应用程序必须在代码或额外的数据空间中进行映射(例如通过malloc()调用)，内核随后可以修改这些表 当一个task完成二期应用是不在运行，kernel可以remove 一些关联的转换表条目 然后
重新使用空间给一个新的应用。
在这种情况下，多个task可以贮存在物理内存中。
在一个task 切换，内核switches转换表条目到 The page 下一个thread to be run。
补充，一个休眠的task是完全不受正在运行的task的影响。
这意味着MMU可以保护正在运行的任务访问其他任务的代码或者数据。

9.7.1. Address Space ID 地址空间ID

When we described the translation table bits in Level 2 translation tables we noted a bit called nG (non-global). If the nG bit is set for a particular page, the page is associated with a specific application. When the MMU performs a translation, it uses both the virtual address and an ASID value.

当我们描述转换表bit 在level2转换表中的bit时候，我们注意到a bit called nG
如果nGbit 是设置为了特别的page，这个page是和特殊的应用关联的。
当MMU执行一个转换，它同时使用虚拟第孩子和ASID值。

The ASID is a number assigned by the OS to each individual task. This value is in the range 0-255 and the value for the current task is written in the ASID register (accessed using CP15 c13). When the TLB is updated and the entry is marked as non-global, the ASID value will be stored in the TLB entry in addition to the normal translation information. Subsequent TLB look-ups will only match on that entry if the current ASID matches with the ASID that is stored in the entry. You can therefore have multiple valid TLB entries for a particular page (marked as non-global), but with different ASID values. This significantly reduces the software overhead of context switches, as it avoids the requirement to flush the on-chip TLBs. The ASID forms part of a larger (32-bit) process ID register that can be used in task-aware debugging.

NOTE
A context switch denotes the scheduler transferring execution from one process to another. This typically requires saving the current process state and restoring the state of the next process waiting to be run.
一个上下文切换标识调度程序转换执从一个进程到另外一个。
这个典型需要保存当前进程的状态和恢复下一个等待执行的进程状态。

Figure 9.11 illustrates this. Here, you have multiple applications (A, B and C), each of which is linked to run from virtual address 0. Each application is located in a separate address space in physical memory. There is an ASID value associated with each application so you can have multiple entries within the TLB at any particular time, that will be valid for virtual address 0.

举例说明，这里，你有多个应用，每一个是linked to run from virtual address0

每一个程序是located in 在一个分开的地址空间在物理地址。
这有一个ASID值关联到每一个应用，这样你可以有一个多条目在TLB中，在任何独特的时间。
这样会有效对于虚拟地址0.

9.7.2. Translation Table Base Register 0 and 1

与管理多个应用程序及其各自的翻译表相关的另一个潜在困难是L1翻译表可能有多个副本，每个应用程序一个副本

An additional potential difficulty associated with managing multiple applications with their individual translation tables is that there could be multiple copies of the L1 translation table, one for each application. Each of these will be 16KB in size. Most of the entries will be identical in each of the tables, as typically only one region of memory will be task-specific, with the kernel space being unchanged in each case. Furthermore, if a global translation table entry is to be modified, the change will be required in each of the tables.
一个额外潜在困难关于管理多应用和他们独立的转换表，是这样：这可以是多copies 对于L1转换表。每个应用一个。
每一个这些将会在大小上是16KB。
多数entries将会完全一样的在每一个表， as typically only one region of memory 将会是任务特异的。
在每种情况下，内核空间都是不变的。
而且，如果一个全局的转换表entry是被modified，改变是需要的对于每一个tables

To help reduce the effect of these problems, a second translation table base register is provided. CP15 contains two Translation Table Base Registers, TTBR0 and TTBR1. A control register (the TTB Control Register) is used to program a value in the range 0 to 7. This value (denoted by N) tells the MMU how many of the upper bits of the virtual address it must check to determine which of the two TTB registers to use

为了帮助减少这些问题的影响，一个第二转换表基寄存器是被提供，
cp15包含两个转换表基寄存器，TTBR0和TTBR1。 一个控制寄存器是被用来编写一个值在范围0-7.
这个值告诉MMU多少高位bit属于虚拟地址的，它必须检查去决定哪个属于两TTB寄存器去使用。

For example, if N is set to 7, any address in the bottom 32MB of memory will use TTBR0 and the rest of memory will use TTBR1. As a result, the application-specific translation table pointed to by TTBR0 will contain only 32 entries (128 bytes). The global mappings are in the table pointed to by TTBR1 and only one table must be maintained.

When these features are used, a context switch will typically require the operating system to change the TTBR0 and ASID values, using CP15 instructions. However, as these are two separate, non-atomic operations, some care is required to avoid problems associated with speculative accesses occurring using the new value of one register together with the older value of the other. OS programmers making use of these features should become familiar with the sequences recommended for this purpose in the ARM Architecture Reference Manual.

9.7.3. The Fast Context Switch Extension 该快速上下文转换扩展
the Fast Context Switch Extension (FCSE) was added to the ARMv4 architecture but has been deprecated since ARMv6. It enabled multiple independent tasks to run in a fixed, overlapping area at the bottom of the virtual memory space without having to clean the cache or TLB on a context switch. It did this by modifying virtual addresses by substituting a process ID value into the top seven bits of the virtual address (but only if that address lay within the bottom 32MB of memory). Some ARM documentation distinguishes Modified Virtual Addresses (MVA) from Virtual Addresses (VA). This distinction is useful only when the FCSE is used.

该FCSE This distinction is useful only when the FCSE is used.