System Mmu Architecture ARM
System Mmu Architecture ARM
System Mmu Architecture ARM
Unit
Architecture Specification
Issue
Confidentiality
Change
23 March 2012
Confidential Beta
18 December 2012
Non-Confidential
Proprietary Notice
ARM System MMU (SMMU) Architecture Specification Licence
This end user licence agreement (licence) is a legal agreement between you (either a single individual, or single legal
entity) and ARM Limited (ARM) for the use of the relevant SMMU Architecture Specification accompanying this
licence. ARM is only willing to license the relevant SMMU Architecture Specification to you on condition that you accept
all of the terms in this licence. By clicking I agree or otherwise using or copying the relevant SMMU Architecture
Specification you indicate that you agree to be bound by all the terms of this licence. If you do not agree to the terms of this
licence, ARM is unwilling to license the relevant SMMU Architecture Specification to you and you may not use or copy the
relevant SMMU Architecture Specification and you should promptly return the relevant SMMU Architecture
Specification to ARM.
LICENSEE means You and your Subsidiaries.
Subsidiary means, if You are a single entity, any company the majority of whose voting shares is now or hereafter owned or
controlled, directly or indirectly, by You. A company shall be a Subsidiary only for the period during which such control exists.
1. Subject to the provisions of Clauses 2, 3 and 4, ARM hereby grants to LICENSEE a perpetual, non-exclusive, non-transferable,
royalty free, worldwide licence to:
(i) use and copy the relevant SMMU Architecture Specification for the purpose of developing and having developed products that
comply with the relevant SMMU Architecture Specification;
(ii) manufacture and have manufactured products which either: (a) have been created by or for LICENSEE under the licence
granted in Clause 1(i); or (b) incorporate a product(s) which has been created by a third party(s) under a licence granted by ARM
in Clause 1(i) of such third partys ARM SMMU Architecture Specification Licence; and
(iii) offer to sell, sell, supply or otherwise distribute products which have either been (a) created by or for LICENSEE under the
licence granted in Clause 1(i); or (b) manufactured by or for LICENSEE under the licence granted in Clause 1(ii).
2. LICENSEE hereby agrees that the licence granted in Clause 1 is subject to the following restrictions:
(i) where a product is created under Clause 1(i) or manufactured under Clause 1(ii) it must contain at least one processor core
which has either been (a) developed by or for ARM; or (b) developed under licence from ARM;
(ii) the licences granted in Clause 1(iii) shall not extend to any portion or function of a product that is not itself compliant with
part of the relevant SMMU Architecture Specification; and
(iii) no right is granted to LICENSEE to sublicense the rights granted to LICENSEE under this Agreement.
3. Except as specifically licensed in accordance with Clause 1, LICENSEE acquires no right, title or interest in any ARM
technology or any intellectual property embodied therein. In no event shall the licences granted in accordance with Clause 1 be
construed as granting LICENSEE, expressly or by implication, estoppel or otherwise, a licence to use any ARM technology except
the relevant SMMU Architecture Specification.
4. The relevant SMMU Architecture Specification is provided as is with no warranties express, implied or statutory,
including but not limited to any warranty of satisfactory quality, merchantability, noninfringement or fitness for a
particular purpose.
ii
5. No licence, express, implied or otherwise, is granted to LICENSEE, under the provisions of Clause 1, to use the ARM
tradename in connection with the relevant SMMU Architecture Specification or any products based thereon. Nothing in Clause 1
shall be construed as authority for LICENSEE to make any representations on behalf of ARM in respect of the relevant SMMU
Architecture Specification.
6. This Licence shall remain in force until terminated by you or by ARM. Without prejudice to any of its other rights if LICENSEE
is in breach of any of the terms and conditions of this Licence then ARM may terminate this Licence immediately upon giving
written notice to You. You may terminate this Licence at any time. Upon expiry or termination of this Licence by You or by ARM
LICENSEE shall stop using the relevant SMMU Architecture Specification and destroy all copies of the relevant SMMU
Architecture Specification in your possession together with all documentation and related materials. Upon expiry or termination
of this Licence, the provisions of clauses 6 and 7 shall survive.
7. The validity, construction and performance of this Agreement shall be governed by English Law.
ARM contract references: LES-PRE-20225 ARM System MMU (SMMU) Architecture Specification Licence
ARM Limited, 110 Fulbourn Road, Cambridge, England CB1 9NJ.
Note
The term ARM is also used to refer to versions of the ARM architecture, for example ARMv7 refers to version 7 of the ARM
architecture. The context makes it clear when the term is used in this way.
Confidentiality Status
This document is Non-Confidential. The right to use, copy and disclose this document may be subject to license restrictions in
accordance with the terms of the agreement entered into by ARM and the party that ARM delivered this document to.
Product Status
The information in this document is final, that is for a developed product.
iii
iv
Contents
ARM System Memory Management Unit
Architecture Specification
Preface
About this specification ............................................................................................... x
Using this specification ............................................................................................... xi
Conventions .............................................................................................................. xiii
Additional reading ..................................................................................................... xiv
Feedback .................................................................................................................. xv
Chapter 1
Introduction
1.1
Chapter 2
Chapter 3
2-20
2-22
2-24
2-25
2-30
2-34
2-41
3-44
3-45
3-46
3-47
3-48
3-50
3.7
3.8
3.9
3.10
3.11
Chapter 4
3-51
3-56
3-59
3-60
3-61
Chapter 5
Coherency Issues
5.1
5.2
5.3
5.4
Chapter 6
5-72
5-73
5-74
5-75
Debug Support
6.1
Chapter 7
Chapter 8
7-80
7-81
7-82
7-83
7-84
7-85
7-86
7-87
7-88
Security Extensions
8.1
8.2
8.3
Chapter 9
Chapter 10
Chapter 11
10-104
10-109
10-111
10-113
10-114
10-115
Chapter 12
vi
About the System MMU implementation defined address space ....................... 12-164
Chapter 13
Chapter 14
Chapter 15
Chapter 16
15-186
15-190
15-191
15-193
15-194
Glossary
vii
viii
Preface
This preface introduces the ARM System Memory Management Unit Architecture Specification. It contains the
following sections:
ix
Preface
About this specification
Intended audience
This specification is written for readers who are familiar with system memory management concepts, but who do
not necessarily have any experience of the ARM architecture.
Preface
Using this specification
xi
Preface
Using this specification
xii
Preface
Conventions
Conventions
The following sections describe conventions that this book can use:
Typographic conventions
Register names
Numbers
Pseudocode descriptions.
Typographic conventions
The typographical conventions are:
italic
bold
Denotes signal names, and is used for terms in descriptive lists, where appropriate.
monospace
Used for assembler syntax descriptions, pseudocode, and source code examples.
Also used in the main text for instruction mnemonics and for references to other items
appearing in assembler syntax descriptions, pseudocode, and source code examples.
SMALL CAPITALS
Used for a few terms that have specific technical meanings, and are included in the glossary.
Colored text
Register names
In a register name, s denotes the presence or absence of the Secure register prefix, S. For example, in an
implementation that includes the Security Extensions, the register SMMU_sACR is implemented as both:
Numbers
Numbers are normally written in decimal. Binary numbers are preceded by 0b, and hexadecimal numbers by 0x.
Both are written in a monospace font.
Pseudocode descriptions
This manual uses a form of pseudocode to provide precise descriptions of the specified functionality. This
pseudocode is written in a monospace font.
xiii
Preface
Additional reading
Additional reading
This section lists relevant publications from ARM and third parties.
See the Infocenter, http://infocenter.arm.com, for access to ARM documentation.
ARM publications
See the following documents for other information.
ARM Architecture Reference Manual, ARMv7-A and ARMv7-R edition (ARM DDI 0406)
xiv
Preface
Feedback
Feedback
ARM welcomes feedback on its documentation.
the title
xv
Preface
Feedback
xvi
Chapter 1
Introduction
This chapter contains a brief introduction to the ARM System Memory Management Unit (MMU) architecture. It
contains the following section:
1-17
1 Introduction
1.1 About the ARM System MMU architecture
1.1
An operating system defines the translation tables for its own memory accesses, and for accesses by
applications running under it. It does this believing it is mapping the virtual addresses (VAs) used by the
processor to physical addresses (PAs) in the physical memory system. However, it actually defines addresses
in an intermediate physical address (IPA) memory map.
A hypervisor defines the translation tables that translate the IPAs for a particular guest operating system to
PAs.
This means that any memory access by a Guest OS, or by an application, requires two stages of translation, that
together define a single translation regime:
for any stage of translation, multiple levels of address lookup, to provide fine-grained memory control
1-18
Chapter 2
The Translation Process
This chapter describes the steps that the System MMU performs on receiving a memory access request. It contains
the following sections:
Note
This specification uses a register name scheme described in Register names on page xiii. An understanding of this
scheme is essential for the correct interpretation of register names.
2-19
2.1
address translation
a client transaction is an access by a client device, that the System MMU is to process
a configuration transaction is an access by a device that accesses a register or a command in the System
MMU configuration address space.
Security state determination identifies whether a transaction is from a Secure or Non-secure device.
Context determination identifies the stage 1 or stage 2 context resources the System MMU uses to process a
transaction. In some cases, the System MMU can be configured to permit a transaction to bypass the translation
process, or to fault a transaction, regardless of the requested translation.
Stage 1 and stage 2 translation tables provide translation and memory attribute information. The transaction is then
processed subject to required checks on the memory access.
The acceleration of translation through the use of TLB functionality is supported by the architecture. The System
MMU architecture provides TLB maintenance operations to manage TLBs. The exact behavior of any TLB
functionality is IMPLEMENTATION DEFINED.
2-20
Transaction
Determine
security state
Determine
context
Multiple
contexts?
Yes
No
Valid
context?
No
Yes
Context is
bypass?
Bypass?
No
Yes
Yes
Bypass
No
Context is
fault?
Yes
No
Stage 1
translation
required?
Yes
Perform stage 1
look-up
Error?
No
Stage 2
translation
required?
Yes
No
Yes
Perform stage 2
look-up
Error?
No
Yes
No
Translation result
Fault
Note
For a transaction that requires two stages of address translation, as described in About the ARM System MMU
architecture on page 1-18, translation table addresses for the stage 1 translation are typically defined in the IPA
address space. If so, for each stage 1 lookup the System MMU must perform a stage 2 translation of the translation
table address, to map the IPA to the corresponding PA. This stage 2 translation might fail, generating an error.
Figure 2-1 does not show this possible dependence of a stage 1 lookup on a stage 2 translation.
2-21
2.2
a transaction security state attribute indicating whether the transaction originated from a Secure or
Non-secure device.
The mechanism by which a system determines the security state of a transaction depends on whether the security
state determination address space is present, as defined by the SMMU_IDR1 SSDTP bit. When this address space
is present, SMMU_SSDR registers are provided in the System MMU address space.
Security state determination address is present
There are a number of ways in which a system might determine the security state of a transaction.
The System MMU architecture does not define how this state is determined, but reserves space in
the System MMU address space to provide an address-mapped bit vector that permits the security
state to be determined from an SSD_Index associated with the transaction. See System MMU
security state determination address space on page 14-184 for more information.
Before transferring control to Non-secure software, Secure software must access the the appropriate
SMMU_SSDRn register and:
1.
set to 0 all bits corresponding to devices that must be Secure
2.
set to 1 all other bits
3.
read all bits to verify correct operation.
Security state determination address is not present
A System MMU implementation and the system that incorporates it can adopt alternative
IMPLEMENTATION DEFINED approaches to determine the security state of a transaction. For example:
the transaction source can determine a security state and propagate this with the transaction
to the System MMU
the System MMU can use the Secure memory access status in systems where all sources of
Secure transactions only issue transactions with a Secure transaction status
the System MMU can use other platform-specific knowledge to determine the security status
of each transaction.
In either case, to prevent any device incorrectly being configured as Secure, Secure software must:
be able to identify the system to ensure the appropriate security state determination mechanism is used.
2.2.1
Banked registers
Some System MMU registers are Banked for security. A Non-secure access to a register address accesses the
Non-secure copy of the register. A Secure access accesses the Secure copy in the Secure address space, at the same
address offset as its Non-secure counterpart. For a configuration transaction, the security level determines which
register is accessed. For a client transaction, the security state of the transaction determines which resource to use
to process the transaction.
Not all registers available in both the Secure and Non-secure security states are Banked. The registers that are not
Banked are:
2-22
global address translation commands that are common to the Secure and Non-secure security states.
For information about Banked registers and naming conventions, see Register names on page xiii.
2-23
2.3
Context determination
The System MMU processes a transaction in one of the following ways:
require the resources of one or more translation contexts, each having its own set of translations, attributes
and permissions that apply to a transaction being processed by that context.
Context determination determines which resources the System MMU uses to process a transaction.
In a System MMU that supports two stages of translation, a transaction can be associated with up to two translation
contexts.
2.3.1
Transaction streams
The System MMU can process transactions from multiple sources, potentially using a different translation context
for each transaction. A transaction stream is a sequence of transactions associated with a particular thread of activity
in the system.
Transactions from the same transaction stream are associated with the same translation context, and are therefore
subject to the same type of processing in the System MMU. A device in the system can issue transactions using
more than one transaction stream, and a single transaction stream can contain transactions from more than one
device.
A Stream Identifier (StreamID) associates a transaction with a transaction stream. The StreamID is derived from
transaction identification information carried with the transaction by the system interconnect. The StreamID
uniquely identifies the originator of a transaction, and can commonly be derived from identifier information
conveyed on the bus interconnect, such as the NS bit, the Read not Write (RnW) bit indicating whether a transaction
is a read or a write operation, and the transaction ID.
The number of implemented StreamID bits:
is defined by SMMU_IDR0.NUMSIDB[3:0]
the transaction ID
2-24
2.4
StreamID matching
StreamID indexing.
It is IMPLEMENTATION DEFINED whether a Stream mapping table implements the StreamID matching or StreamID
indexing scheme. SMMU_IDR0.SMS identifies the implemented scheme.
The Stream mapping table consists of a number of entries. Each entry is a Stream mapping register group containing
the following registers, where n defines the Stream mapping register group number:
SMMU_SMRn
SMMU_S2CRn.
In an implementation that uses StreamID matching, SMMU_SMRn determines whether a transaction matches the
group. In an implementation that uses StreamID indexing, the StreamID is an index into the Stream mapping table.
SMMU_S2CRn specifies the first translation context, bypass attributes, or fault condition for the translation
process.
SMMU_IDR0.NUMSMRG specifies the number of IMPLEMENTATION DEFINED Stream mapping register groups.
An attempt by Non-secure software to access a group above the reported implemented number results in one of the
following IMPLEMENTATION DEFINED behaviors:
2.4.1
No match handling
If no match for a transaction is found in the Stream mapping table, the System MMU can either:
2.4.2
StreamID matching
In a register group that uses StreamID matching, SMMU_SMRn specifies conditions that must be met for a
transaction to be associated with the Stream mapping register group to which SMMU_SMRn belongs.
The SMMU_SMRn registers form a table that is searched associatively to find a match for the StreamID of a
transaction. For more information about StreamIDs, see Transaction streams on page 2-24.
If a transaction matches all of the conditions specified in SMMU_SMRn, the translation context, Bypass mode, or
fault context specified by SMMU_S2CRn is used to process the transaction.
SMMU_SMRn provides StreamID and mask fields that permit the masking of StreamID bits irrelevant to the
matching process.
2-25
The Stream mapping table permits a number of StreamID values to be mapped to the same translation context. This
means the state describing that context can be shared. Mapping multiple StreamID values to the same translation
context is achieved using multiple Stream mapping table entries, or using the mask facilities in the SMMU_SMRn
encoding.
The Stream mapping table must be configured so that a StreamID matches, at most, one entry in the Stream mapping
table. During configuration, software must ensure that there is no overlap in Stream mapping table entries for all
StreamIDs that are active.
If the StreamID of a transaction matches multiple Stream mapping table entries, either of the following
IMPLEMENTATION DEFINED options are possible:
The System MMU does not detect the multiple match, and processes the transaction using one of the
matching entries in the Stream mapping table.
SMMU_IDR1.SMCD indicates whether the System MMU detects all Stream match conflicts. This value is
IMPLEMENTATION DEFINED.
SMMU_sCR0.SMCFCFG specifies whether the System MMU permits bypass or raises a Stream match conflict
fault. It is IMPLEMENTATION DEFINED whether this setting is configurable. If it is not configurable,
SMMU_sCR0.SMCFCFG has a fixed value and writes are ignored.
SMMU_sCR0.USFCFG specifies how transactions with no match in the Stream mapping table are handled. It is
IMPLEMENTATION DEFINED whether the System MMU supports all of the possible handling options.
Unimplemented SMMU_SMRn registers, or those reserved by Secure software and therefore invisible to
Non-secure accesses, behave as RAZ/WI. These registers have an IMPLEMENTATION DEFINED option to trap
accesses to unimplemented registers and raise a Configuration access fault. See Chapter 3 The Fault Model.
2.4.3
StreamID indexing
In an implementation that uses StreamID indexing, a one-to-one stream mapping associates a transaction with a
Stream mapping register group. The StreamID associated with the transaction is an index into the Stream mapping
table, and directly selects the Stream mapping register group for processing the transaction. The maximum
StreamID size in a register group that uses StreamID indexing is 7 bits.
It is IMPLEMENTATION DEFINED whether the Stream mapping table implements Stream Match Register functionality.
SMMU_IDR0.SMS indicates whether the register group supports Stream Match Register functionality. In an
implementation that supports StreamID indexing, a Stream Match Register has no effect on the stream mapping
process and is UNK/SBPZ.
2.4.4
SMMU_sCR0.CLIENTPD is 1
the transaction does not match any entries in the Stream mapping table and SMMU_sCR0.USFCFG is 0
the transaction is detected to match multiple entries in the Stream mapping table and
SMMU_sCR0.SMCFCFG is 0.
A transaction that bypasses the Stream mapping table is not subject to address translation, and in most cases, is not
subject to any protection checking:
an instruction fetch might be subject to a permission check if the implementation includes the Security
Extensions.
2-26
Note
Whether Secure Instruction Fetch checks apply to instruction writes is IMPLEMENTATION DEFINED.
2.4.5
stage 1 only
stage 2 only
2-27
These attributes are the starting point for translation. The Translation context bank can modify them. See Memory
type and shareability attributes on page 2-39 for more information.
It is IMPLEMENTATION DEFINED whether a System MMU implementation supports:
Stage 1 and stage 2 nested translation. SMMU_IDR0.NTS specifies whether nested translation is supported.
Note
If nested translation is supported, then both stage 1 and stage 2 translation must be supported. That is, if the
SMMU_IDR0.NTS bit is set to 1, then both the SMMU_IDR0.S1TS and SMMU_IDR0.S2TS bits must be set to 1.
The number of Translation context bank entries for stage 1 or stage 2 translation is IMPLEMENTATION DEFINED. If
SMMU_S2CRn is configured to specify an unimplemented Translation context bank for stage 1 or stage 2, any
transaction processed as part of that stream results in an Unimplemented context bank fault.
An SMMU_S2CRn register reserved by Secure software using SMMU_SCR1.NSNUMSMRGO must only specify
a Translation context bank that is reserved by Secure software.
An SMMU_S2CRn register that is accessible from the Non-secure state must only specify a Translation context
bank that is not reserved by Secure software.
If software does not comply with these restrictions, an Unimplemented context bank fault might arise when a
transaction is mapped to an incorrectly configured Stream-to-Context Register.
Bypass mode
If SMMU_S2CRn.TYPE is configured as Bypass mode, no translation is applied to the transaction. However,
SMMU_S2CRn can specify memory attributes for the transaction. For example, memory type, shareable attributes
and cache allocation hints. See SMMU_S2CRn for more information.
No protection check is applied, except where an instruction fetch by a Secure client is subject to a protection check,
based on the value of SMMU_SCR1.SIF.
Fault context
If SMMU_S2CRn specifies the fault context, all transactions associated with that Stream mapping register group
are subject to an Invalid context fault. See Global faults on page 3-56 for details of Invalid context faults.
2.4.6
transactions from Non-secure devices can only match Stream mapping table entries unreserved by Secure
software
2-28
transactions from Secure devices can only match Stream mapping table entries reserved by Secure software.
SMMU_S2CRn registers must specify a Translation context bank of appropriate security, as follows:
2.4.7
An SMMU_S2CRn register reserved by Secure software can only specify a Translation context bank
reserved by Secure software. If Secure software fails to comply with this requirement, the result is
UNPREDICTABLE.
An SMMU_S2CRn register not reserved by Secure software can only specify a Translation context bank that
is not reserved by Secure software. If Non-secure software fails to comply with this requirement, an
Unimplemented context bank fault is raised for any transactions mapped to that SMMU_S2CRn register.
Reset state
On reset, no initialization is performed on Stream mapping table entries. The required contents of the Stream
mapping table must be initialized before the System MMU is enabled.
2-29
2.5
Translation context
A translation context provides information and resources required by the System MMU to process a transaction.
The System MMU can process multiple transaction streams from different threads of execution, and supports
multiple live translation contexts.
A Translation context bank includes state for configuring the translation process and capturing fault status, and
operations for maintaining cached translations. A Translation context bank specifies largely the same state used by
the ARM processor architecture translation process, principally:
on an implementation that does not support nested translations, only one translation context can be specified
2.5.1
the access generates a Configuration access fault, as Chapter 3 The Fault Model describes.
Some Translation context banks might only support stage 2 translations.
SMMU_IDR1.NUMS2CB specifies the IMPLEMENTATION DEFINED number of Translation context banks that only
support stage 2 translation. The remaining Translation context banks support either stage 1 or stage 2 translation.
Translation context banks that only support stage 2 translation are grouped together, starting at location 0 in the
Translation context bank table. The remaining Translation context banks are similarly grouped and start
immediately after the Translation context banks that only support stage 2 translations.
For Translation context banks that can be used for either stage 1 or stage 2 translations, the translation format is
specified by the SMMU_CBARn.TYPE field associated with the Translation context bank.
2-30
For configuration accesses, Secure software can access all Translation context banks, and Non-secure software can
only access Translation context banks that are not reserved for Secure use. This means Secure software can inspect
Non-secure Translation context banks.
The value written to SMMU_SCR1.NSNUMCBO affects the value read from SMMU_IDR1.NUMCB.
Figure 2-2 gives an overview of the Translation context bank table, SMMU_IDR1 fields and the effect of the
override registers.
127
Unimplemented
Unimplemented
Secure stage 1
Secure stage 1
Non-secure stage 1 or stage 2
SMMU_IDR1 NUMCB
Overridden value
SMMU_SCR1 NSNUMCBO
SMMU_IDR1 NUMS2CB
Non-secure stage 2
Non-secure stage 2
0
Non-secure stage 2
Reset state
On reset, no initialization is performed on Translation context bank table entries. The Translation context bank table
entries must be initialized to the required values before use.
2-31
2.5.2
Bypass mode, performing no stage 2 translation or address protection, but optionally downgrading the
memory attributes from the stage 1 translation, in a similar way to the possible downgrading of memory
attributes by a Stage 2 Translation context bank.
If a Translation context bank is configured to raise an interrupt in the event of a context fault, SMMU_CBARn
specifies the interrupt to be asserted if the context fault occurs.
The SMMU_CBARn registers are organized as a table in the System MMU configuration address space. A
configuration access to an unimplemented SMMU_CBARn register results in one of the following
IMPLEMENTATION DEFINED behaviors:
the access generates a Configuration access fault, as Chapter 3 The Fault Model describes.
SMMU_CBARn.VMID specifies the Virtual Machine Identifier for the corresponding Translation context bank.
When associated with a Non-secure, non-hypervisor Stage 1 Translation context bank, the VMID field is used as
follows:
The VMID is associated with a transaction being translated using this Translation context bank. The VMID
is used for TLB tagging and matching purposes.
The VMID is used for TLB maintenance operations issued in the corresponding Translation context bank.
The VMID is used for TLB matching purposes.
See SMMU_CBARn, Context Bank Attribute Registers on page 11-155 for more information.
Note
The use of VMID is modified for:
it is IMPLEMENTATION DEFINED whether the VMID is visible in translation table walks and client transactions.
Reset state
On reset, the SMMU_CBARn. registers are not initialized. They must be initialized before use.
2-32
2.5.3
2-33
2.6
2.6.1
Name
Description
63:62
WACFG
Write-Allocate Configuration
0b00
Use value supplied from previous stage
0b01
Reserved
0b10
Write-Allocate
0b11
No Write-Allocate.
61:60
RACFG
Read-Allocate Configuration
Use value supplied from previous stage
0b01
Reserved
0b10
Read-Allocate
0b11
No Read-Allocate.
0b00
The values 0b10 and 0b11 cause the allocation hint supplied as part of the transaction to be overridden with the
specified value.
2.6.2
Domains
The System MMU translation process does not support the Domain feature of the ARM Virtual Memory System
Architecture (VMSA) before the addition of the Large Physical Address Extension.
2.6.3
2.6.4
2-34
The System MMU architecture extends this behavior so that the first level descriptor can be fetched from
Non-secure memory by using the NSCFG0 and NSCFG1 fields in SMMU_CBn_TTBCR. This behavior is also
permitted when using the Short-descriptor format.
As with the processor architecture, a Secure translation must be treated as non-global, regardless of the value of the
nG bit in the final descriptor, if either or both of the following apply:
the descriptor is fetched from Non-secure memory, regardless of the mechanism that caused this behavior.
The purpose of this restriction is to provide a safety measure that prevents a Secure process from accidentally
polluting the memory space of another process with a global entry that maps Non-secure memory.
2.6.5
2-35
Transaction
Bypass SMMU?
Yes
No
Search SMT
Search
result?
Single
match
Fault
enabled?
No match
Yes
Unidentified
stream fault
No
Multiple
matches
Bypass1
Yes
Bypass?
Translation
context
Stream to
context
format?
Bypass
No
Stream
match
conflict fault
Bypass2
Invalid
context
fault
Fault
SMMU_CBAR
lookup
S1 with S2 fault?
Yes
No
S1 with S2
bypass?
Yes
Yes
No
Valid S2?
Valid S1 and
S2 nested
No
See Interaction with the Security Extensions on page 2-30 for information about reserving Translation context
banks.
SMMU_sCR0.CLIENTPD determines whether the transaction bypasses:
protection checking
attribute generation.
An instruction fetch by a Secure client is subject to a protection check based on the value of SMMU_SCR1.SIF.
SMMU_sCR0.CLIENTPD controls whether other protection checks are bypassed.
If the transaction bypasses the System MMU:
the address is not translated, which means that the output address is identical to the input address
output attributes of the transaction are a function of the input attributes and SMMU_sCR0 fields.
If SMMU_sCR0.CLIENTPD indicates that the transaction is to be processed, the System MMU searches the Stream
mapping table for a matching Stream mapping register group. See The Stream mapping table on page 2-25.
If no match is found, SMMU_sCR0.USFCFG determines how to handle the match failure. If bypass action is
specified, the address is not translated, and the output attributes are the same as those for bypass at the earlier
SMMU_sCR0.CLIENTPD stage.
If a search of the Stream mapping table yields multiple matches, SMMU_sCR0.SMCFCFG determines whether the
transaction bypasses subsequent System MMU processing or incurs a Stream match conflict fault.
If the transaction is successfully matched in the Stream mapping table, an initial translation context format is
determined using SMMU_S2CRn. If SMMU_S2CRn specifies Bypass mode:
the address is not translated, which means that the output address is identical to the input address
output attributes are a function of the input attributes and the SMMU_S2CRn fields.
If an initial translation context format is determined, a translation context is set where the input attributes to the
translation process are the default input attributes and SMMU_S2CRn fields.
SMMU_CBARn defines additional configuration for the translation context. SMMU_CBARn.TYPE defines the
register format.
For an outline of stage 1 with stage 2 bypass processing, or stage 2 processing, see Figure 2-4. Otherwise, see
Figure 2-5 on page 2-38.
Valid context?
No
Unimplemented
context bank fault
Yes
Stage n MMU
enabled?
No
Obtain result by
stage n defaults
Yes
Obtain result by stage n translation
If the stage 1 context is valid, SMMU_CBn_SCTLR.M is read to see if the System MMU is enabled.
2-37
2.
If the System MMU is enabled, a result is obtained from stage 1 translation tables and SMMU_CBARn.
Otherwise, a result is obtained from default input attributes, stage 1 SMMU_CBn_SCTLR, SMMU_CBARn
and SMMU_S2CRn.
2.
If the stage 2 context is valid and the System MMU is enabled, the result is obtained from the default input
attributes and a stage 2 translation table lookup. Otherwise, the result is obtained from the default input
attributes and stage 2 SMMU_CBn_SCTLR.
Valid S1 and
S2 contexts?
Unimplemented
context bank fault
No
Yes
No
Stage 1 MMU
enabled?
Yes
S2 MMU enabled?
Yes
S2 MMU enabled?
No
Yes
Obtain result by S1
defaults and S2 defaults
No
The stage 1 SMMU_CBn_SCTLR.M bit controls whether the System MMU is enabled for stage 1
translation, and the stage 2 SMMU_CBn_SCTLR.M bit controls whether the System MMU is enabled for
stage 2 translation.
If the stage 1 and stage 2 contexts are valid, but the System MMU is not enabled for stage 1 translation:
if the System MMU is enabled for stage 2 translation, the result is obtained from the default input
attributes, SMMU_S2CRn, the stage 1 SMMU_CBn_SCTLR fields, and a stage 2 translation table
lookup
if the System MMU is not enabled for stage 2 translation, the result is obtained from the default input
attributes, SMMU_S2CRn, the stage 1 SMMU_CBn_SCTLR fields, and the stage 2
SMMU_CBn_SCTLR fields.
If the stage 1 and stage 2 contexts are valid, and the System MMU is enabled for stage 1 translation:
2-38
if the System MMU is enabled for stage 2 translation, the result is obtained from the stage 1 translation
table lookup, and the stage 2 translation table lookup
Copyright 2012 ARM Limited. All rights reserved.
Non-Confidential
if the System MMU is not enabled for stage 2 translation, the result is obtained from the stage 1
translation table lookup and the stage 2 SMMU_CBn_SCTLR fields.
NSCFG
WACFG
RACFG
MemAttr
MTCFG
SHCFG
INSTCFG
The SMMU_CBn_MAIRm,
Memory Attribute Indirection
Registers on page 15-201 provide
memory attribute selection.
Ya
Ya
SMMU_S2CRn, bypass
mode
SMMU_S2CRn, translation
context
Stage 1
SMMU_CBn_SCTLRc
PRIVCFG
Partially determine
permission fault
Partially determine
permission fault
Yb
Stage 2
SMMU_CBn_SCTLRd
SMMU_CBARne
a. Read Allocate and Write Allocate are not defined for processor stage 2 translation tables. However, bits are reserved for the SMMU for this
purpose See Table 2-1 on page 2-34 for more information.
b. For reads only. It is IMPLEMENTATION DEFINED whether this applies to writes.
c. When Stage 1 context bank MMU behavior is disabled.
d. When Stage 2 context bank MMU behavior is disabled.
e. When used as Stage 2.
If any SMMU_sCR0 settings result in a transaction bypassing the Stream mapping table, as Bypassing the Stream
mapping table on page 2-26 describes, then SMMU_sCR0 specifies memory attribute transformation for the
transaction.
Similarly, if the SMMU_S2CRn.TYPE field specifies that the initial translation context is Bypass mode,
SMMU_S2CRn specifies memory attribute transformation for the transaction.
For translations that use a Stage 1 translation context bank, SMMU_S2CRn specifies the first memory attribute
transformation, and then either:
if the SMMU_CBn_SCTLR.M bit is set to 0, that is, context bank MMU behavior is disabled,
SMMU_CBn_SCTLR specifies the next attribute transformation applied
if the SMMU_CBn_SCTLR.M bit is set to 1, the translation table specifies the attributes.
2-39
When a Stage 1 descriptor specifies the attributes, this overrides all attributes except those used for permission
checking, as defined by the IND and PNU bits in SMMU_CBn_FSYNRm. Therefore, the only SMMU_S2CRn
fields that affect such transactions are INSTCFG and PRIVCFG.
The resultant attributes are then combined with the stage 2 attributes, depending on the context bank format that the
SMMU_CBARn.TYPE field specifies:
for Stage 1 context with stage 2 bypass format, the stage 1 context SMMU_CBARn specifies the stage 2
memory attributes
for Stage 1 context with stage 2 context, the setting of the SMMU_CBn_SCTLR.M bit defines the
mechanism for determining the stage 2 attributes. When the SMMU_CBn_SCTLR.M bit:
If SMMU_CBARn specifies the initial translation context to be a stage 2 translation context bank, the stage 1
attributes are treated as the incoming attributes after the SMMU_S2CRn transformation has been applied. The stage
2 attributes are considered to be created in the same way as those for the Stage 1 context with stage 2 context.
Stage 1 and stage 2 attributes are combined in accordance with ARMv7 architectural requirements. The stage 2
attributes can only strengthen memory types, where the memory types are listed strongest to weakest:
Strongly-ordered
Device
Outer Shareable
Inner Shareable
Non-shareable.
In the ARM architecture, stage 2 attributes do not include a read or write allocation hints. In the SMMU architecture
when context bank translation is disabled, the stage 2 SMMU_CBn_SCTLR RACFG and WACFG fields can be
used with stage 1 translation. If the stage 2 SMMU_CBn_SCTLR.M bit is set to 1 then there are extra fields in the
descriptor that specify RACFG and WACFG fields that are used. See Table 2-1 on page 2-34 for more information.
For memory type and shareability attributes, the following behaviors are IMPLEMENTATION DEFINED:
Combining Read and Write hint allocations
It is IMPLEMENTATION DEFINED how read and write allocate hints from stage 2 attributes combine
with stage 1 attributes.
Transforming bypassed transaction encodings
When the appropriate MTCFG field is set to 0, it is IMPLEMENTATION DEFINED whether certain
bypassed client transactions have encodings that cannot be transformed. For example, an
implementation might specify that incoming Strongly-ordered or Device transactions are not
subject to any memory attribute transformation.
Note
In such cases the NSCFG field is guaranteed to be applied if security state determination classes the
transaction as Secure. If the appropriate MTCFG field is set to 1, the transformation is always
applied, regardless of the encoding of the incoming transaction.
Instruction fetch configuration
It is IMPLEMENTATION DEFINED whether a SMMU_S2CRn.INSTCFG field transformation is
applied to writes if that transformation would convert the transaction to an instruction write.
2-40
2.7
Hypervisor-marked contexts
If the implementation supports stage 1 translation, that is, if the SMMU_IDR0.S1TS bit is set to 1, hypervisor
context (HYPC) is available.
Translation banks for the hypervisor context are called HYPC banks, or hypervisor banks, and are intended to be
used by the hypervisor for translating devices that it owns and are operating on its own behalf. Hypervisor context
applies when the SMMU_CBARn.HYPC bit is set to 1.
Note
The register formats do not permit HYPC banks to be nested.
2.7.1
ARMv7 register
Notes
SMMU_CBn_TTBR0
HTTBR
SMMU_CBn_TTBR1 is ignored.
The SMMU_CBn_TTBR0.ASID field is ignored
The following fields have no effect:
SMMU_CBn_SCTLR.AFE
SMMU_CBn_SCTLR.TEX.
SMMU_CBARn.VMID
In the Long-descriptor Table descriptor, the APTable[0],
PXNTable, and PXN bits are reserved, SBZ.
SMMU_CBn_TTBCR
HTCR
SMMU_CBn_MAIRm
HMAIRn
Because there is no separation of privileged and unprivileged execution in HYPC, the Stage 1 address translation
commands in Table 4-1 on page 4-65 might result in different behavior. In any SMMU implementation that uses
HYPC:
SMMU_CBn_ATS1PR
SMMU_CBn_ATS1PW
SMMU_CBn_ATS1UR
SMMU_CBn_ATS1UW.
When targeting a context bank marked as HYPC, the global Stage 1 address translation operations in Table 4-2 on
page 4-68 might result in different behavior, and:
SMMU_sGATS1PR
SMMU_sGATS1PW
SMMU_sGATS1UR
SMMU_sGATS1UW.
Copyright 2012 ARM Limited. All rights reserved.
Non-Confidential
2-41
2.7.2
2.7.3
2.7.4
avoid using HYPC contexts, by ensuring that the SMMU_CBARn.HYPC bit is set to 0 for all Secure context
translation banks
2-42
Chapter 3
The Fault Model
This chapter describes System MMU fault handling. It contains the following sections:
3-43
3.1
translation fault
permission fault
external fault.
a global fault:
permission fault
external fault.
The System MMU provides resources to record, process and report these faults.
For details about:
3-44
3.2
Fault-handling terminology
The following terminology applies to faults:
encounter
record
report
The appropriate fault status register capturing fault status information. See:
The corresponding fault address register capturing the fault address. See:
A System MMU reports a fault by returning an error to the initiator of the transaction that caused
the fault. Alternatively, an external system component processing a transaction issued by the System
MMU might report a fault to the System MMU.
Support for fault reporting in the initiating device and in the interconnect between the device and
the System MMU is IMPLEMENTATION DEFINED.
For exclusive access transactions, In the context of the SMMU, reporting means specifically
reporting an exclusive access transaction as aborting.
interrupt
client
A client access is a memory transaction issued by a client device, that the System MMU is to
process.
configuration A configuration access is a memory transaction issued by a device that accesses a register or a
command in the System MMU configuration address space.
3-45
3.3
3-46
3.4
If a global fault is recorded, the default input attributes IND, PNU and NSATTR are recorded.
If a stage 1 or a stage 2 context fault is recorded, the memory attributes IND, PNU and NSATTR, as presented
to the System MMU after Context determination, are recorded. This means that the values of IND, PNU and
NSATTR are possibly overridden by one of:
SMMU_S2CRn.INSTCFG
SMMU_S2CRn.PRIVCFG
SMMU_S2CRn.NSCFG.
ARM recommends that other memory attributes recorded in the fault syndrome registers are handled in the same
way as the IND, PNU and NSATTR attributes, although the handling of other memory attributes is
IMPLEMENTATION DEFINED.
3-47
3.5
external aborts.
The following fault types are recorded in the SMMU_sGFSR, Global Fault Status Register on page 10-131:
Note
Software executing in global register space must not transfer control of a context bank to software executing at a
lower privilege until the bank is fully configured. For example, this might apply to a hypervisor transferring control
to a Guest OS. This can result in low privilege software affecting accesses to SMMU_sGFSR by higher privilege
software.
3.5.1
the SMMU_CBn_FSYNR0.S1PTWF bit indicates a fault on the stage 1 translation table walk
a result of a client transaction mapping directly to the stage 2 bank, in which case SMMU_CBn_FAR
contains the IPA of the client transaction
Software must therefore be capable of distinguishing such differences, either by:
using separate stage 2 banks for the nested and non-nested cases
matching SMMU_CBFRSYNRAn with the Stream Match Register groups to determine the context.
3.5.2
Note
This is very different from the behavior for non-nested translations, where each transaction in the downstream
memory system aborts independently.
3-49
3.6
Fault interrupts
A System MMU can communicate faults to software using the following types of interrupt:
Global interrupt
Context interrupt.
3.6.1
Global interrupts
A System MMU implements at least the following logical Global interrupts:
SMMU_NsgCfglrpt
SMMU_NSglrpt.
SMMU_NsgCfglrpt is used when a Configuration Access Fault is recorded. SMMU_NSglrpt is used when any
other type of global fault is recorded.
In an implementation that includes the Security Extensions, the System MMU also implements SMMU_gCfglrpt
and SMMU_glrpt. These are the Secure equivalents of SMMU_NsgCfglrpt and SMMU_NSglrpt respectively.
3.6.2
Context interrupts
A Context interrupt is raised for a fault on a Translation context bank. SMMU_IDR0.NUMIRPT specifies the
IMPLEMENTATION DEFINED number of Context interrupts supported by the System MMU.
SMMU_CBARn.IRPTNDX specifies the interrupt number to assert in the event of a Translation context bank fault.
ARM recommends that:
if Secure software gives Non-secure software at least one Translation context bank, the Secure software
provides the Non-secure software with at least one Context interrupt.
An Unimplemented context interrupt fault occurs when all of the following conditions hold true:
3.6.3
Interrupt assertion
A System MMU interrupt is asserted in response to a fault recorded in the Fault Status Register, providing interrupts
are enabled. See SMMU_CBn_FSR and SMMU_sGFSR.for details.
An interrupt is asserted regardless of whether the Fault Status Register is set by a fault or by a non-zero value written
to SMMU_sGFSRRESTORE or SMMU_CBn_FSRRESTORE.
A value of 1 written to any non-reserved bit in SMMU_CBn_FSR or SMMU_sGFSR clears that bit. A value of 0
written to any of these bits leaves the bit unchanged.
When all of the relevant bits in a Fault Status Register are cleared, the corresponding interrupt is deasserted,
providing no other Fault Status Register is contributing to the assertion of the interrupt.
3-50
3.7
Context faults
A context fault is associated with a particular Translation context bank. The following types of context fault exist:
translation fault
permission fault
external fault.
A translation fault occurs if the System MMU does not obtain a translation for a transaction.
A permission fault occurs if the System MMU retrieves a translation for a transaction, but the transaction has
insufficient privileges to reach completion.
An external fault occurs if an external abort is reported to the System MMU during transaction processing.
3.7.1
Note
For client transactions that use stage 1 or stage 2 context resources, the instruction fetch configuration attribute
specified by the SMMU_S2CRn. INSTCFG bit can override the IND, PNU and NSATTR memory attributes. See
Stream-to-Context Register, SMMU_S2CRn on page 2-27. When referring to instruction fetches in this document,
it is assumed that any such overrides are accounted for.
3.7.2
SMMU_CBn_FSR
SMMU_CBn_FAR
SMMU_CBn_FSYNRm.
SMMU_CBFRSYNRAn records additional fault syndrome details about the fault, where n is the index into the
Translation context bank.
if no stage 2 fault is encountered, a context fault that occurs is recorded for the stage 1 translation context
if a stage 2 fault is encountered, the fault is recorded for the stage 2 translation context.
3-51
External faults
If an external fault is reported to the System MMU in response to a fetch issued as part of a translation table walk,
the fault is recorded synchronously in the Translation context bank. If any other external fault is reported to the
System MMU in response to a transaction associated with a Translation context bank, it is IMPLEMENTATION
DEFINED whether the fault is:
recorded synchronously
recorded asynchronously
not recorded.
Synchronous recording of an external fault updates the following registers:
SMMU_CBn_FSR
SMMU_CBn_FAR
SMMU_CBn_FSYNRm
SMMU_CBFRSYNRAn.
Asynchronous recording of an external fault updates the following registers:
SMMU_CBn_FSR
SMMU_CBn_FSYNRm
SMMU_CBn_FAR.
For more information about external faults, see External faults on page 3-60.
Multiple faults
SMMU_CBn_FSR.MULTI indicates the presence of multiple outstanding faults.
If a fault is encountered when all of the fields in SMMU_CBn_FSR are zero, including SMMU_CBn_FSR.MULTI,
the following registers record full details of the fault:
SMMU_CBn_FSR
SMMU_CBn_FAR
SMMU_CBn_FSYNRm.
If a fault is encountered when SMMU_CBn_FSR is non-zero:
3-52
The SMMU_CBFRSYNRAn registers are organized as a table. Because a SMMU_CBFRSYNRAn register exists
for each Translation context bank, a System MMU implementation must implement the same number of
SMMU_CBFRSYNRAn registers as the number of Translation context banks. This means that the number of
SMMU_CBFRSYNRAn registers implemented must match the number of Translation context bank table entries.
A configuration access to an unimplemented SMMU_CBFRSYNRAn register results in either of the following
behaviors:
IMPLEMENTATION DEFINED
For more information about Configuration access faults, see Configuration access on page 3-59.
In an implementation that includes the Security Extensions, SMMU_SCR1.NSNUMCBO reserves a Translation
context bank and an SMMU_CBFRSYNRAn register for that Translation context bank. The number of
SMMU_CBFRSYNRAn registers visible to Non-secure software adjusts accordingly.
SMMU_IDR1.NUMCB indicates the number of implemented SMMU_CBFRSYNRAn registers.
3.7.3
3-53
The number of transactions processed after the original faulty transaction is IMPLEMENTATION DEFINED.
The number of subsequent transactions that can raise a fault before no more transactions are processed for
that Translation context bank until the original fault condition is cleared, is also IMPLEMENTATION DEFINED.
Depending on the System MMU implementation, system topology, and devices connected to the System MMU, it
might not be possible to guarantee that a transaction in one translation context is unaffected by a stalled transaction
in another context. Therefore, use of the Stall fault model in a translation context might not be appropriate.
SMMU_sCR0.STALLD can be configured to globally disable the Stall fault model. This forces each stage 1
SMMU_CBn_SCTLR.CFCFG or stage 2 SMMU_CBn_SCTLR.CFCFG to be RAZ/WI.
In an implementation that includes the Security Extensions:
SMMU_CR0.STALLD must apply to Non-secure contexts banks, and can optionally apply to Secure
Translation context banks
Fixes the faulty translation and retries processing the stalled transaction by writing the appropriate value to
SMMU_CBn_RESUME. Fixing the faulty transaction might involve updating translation tables and TLB
maintenance.
Terminates the stalled transaction by writing the appropriate value to SMMU_CBn_RESUME. A transaction
terminated in this way returns no data for reads, and writes are ignored.
Depending on the setting of stage 1 SMMU_CBn_SCTLR.CFRE or stage 2 SMMU_CBn_SCTLR.CFRE,
the System MMU can report an abort to the initiator of the transaction. See Context fault interrupts on
page 3-55.
Fault recording does not occur for a transaction terminated by the SMMU_CBn_RESUME operation. This
is because the fault is logged when the transaction first stalls.
Hit-under-fault
A System MMU can optionally continue to process a transaction before the condition causing an existing fault is
rectified. For a translation context, Hit-under-fault behavior, if enabled, means that any subsequent transaction
mapped to that context is processed, regardless of whether an outstanding fault is recorded for that context.
The following types of behavior apply:
If termination behavior is selected for a translation context and a fault is active for that context, each
subsequent transaction is processed separately. If a fault is raised on a subsequent transaction, it terminates
and SMMU_CBn_FSR records a multiple fault condition.
If stall behavior is selected for a translation context and a fault is active for that context, each subsequent
transaction is processed separately. If a fault is raised on a subsequent transaction, that transaction waits, no
fault status information is recorded on it, and it is retried after the original fault condition clears.
If Hit-under-fault is not enabled, any subsequent transaction mapped to that translation context is processed the
same as the original faulty transaction, as follows:
3-54
If termination behavior is selected for a translation context and a fault is active for that context, each
subsequent transaction terminates. SMMU_CBn_FSR does not record any fault condition for any subsequent
transaction beyond the original transaction. The termination of a subsequent transaction is regarded as a
side-effect of the original fault.
If stall behavior is selected for a translation context and a fault is active for that context, any subsequent
transaction stalls, and only resumes after the original fault condition is cleared.
3.7.4
aside from the value in IRPTNDX, a context fault in the associated Translation context bank would result in
the assertion of a context interrupt.
3.7.5
3.7.6
In an implementation that supports global stalling, SMMU_sCR0.STALLD can disable global stalling. When
SMMU_sCR0.STALLD is 1, SMMU_sCR0.GSE is RAZ/WI.
SMMU_CR0.GSE must apply to Non-secure Translation context banks, and an implementation is permitted
to apply the setting of SMMU_CR0.GSE to transactions processed by Secure Translation context banks.
3-55
3.8
Global faults
A global fault is a fault that occurs when either:
a transaction being processed by the System MMU has no associated Translation context bank
a Translation context bank is not the appropriate place to record the fault.
A global fault can occur because of:
3.8.1
An Invalid context fault, where the fault context has been selected in either:
the SMMU_CBARn register of the initial context specified by the Stream Mapping process.
A Stream match conflict fault, where multiple matches for a transaction are detected in the stream matching
registers and SMMU_sCR0.SMCFCFG has enabled the relevant fault reporting capability.
An Unimplemented context bank fault, where the transaction maps to a an unimplemented translation
context. For example, in an implementation that does not include stage 2 nested translation, an attempt to use
a Stage 2 Translation context bank might result in an Unimplemented context bank fault.
An Unimplemented context interrupt fault, where a transaction causes a fault in a Translation context bank,
and that translation context has been configured to assert a context interrupt that is not implemented.
A Configuration access fault, where a configuration access is made to a non-existent System MMU
configuration register.
An external fault, where an external abort has been reported during the processing of a transaction.
SMMU_sGFSR
SMMU_sGFAR
SMMU_sGFSYNR0
SMMU_sGFSYNR1.
For Configuration access faults, the following conditions apply:
SMMU_sGFSR is updated
NSSTATE is UNK.
SMMU_sGFAR is updated
SMMU_sGFSYNR1 is UNK.
For external faults, the following conditions apply:
SMMU_sGFSR is updated
3-56
SMMU_sGFSR
SMMU_sGFAR
SMMU_sGFSYNR0
SMMU_sGFSYNR1.
If a global fault occurs when SMMU_sGFSR is non-zero, including SMMU_sGFSR.MULTI, the
SMMU_sGFSR.MULTI bit is set to 1 and no other fault status or syndrome state is updated.
Two-stage faults
SMMU_sGFSYNR0.NESTED provides information for the following types of fault in SMMU_sGFSR:
the initial translation context specified by the stream mapping process in SMMU_S2CRn
a stage 2 nested translation context specified in the SMMU_CBARn register of the initial context.
Permission faults
Secure instruction fetch transactions can be subject to a protection check. If the SMMU_SCR1.SIF bit is set to 1, a
permission fault is recorded when a Secure domain access attempts to exit the SMMU as a Non-secure instruction.
This check applies globally, and if not associated with a Translation context bank records faults to SMMU_SGFSR.
Otherwise, faults are recorded in the associated SMMU_CBn_FSR.
3.8.2
3.8.3
SMMU_NSgCfgIrpt, to indicate that a Configuration Access Fault has been recorded, where
SMMU_sCR0.GCFGFIE enables reporting of the fault. SMMU_sGFSR.CAF specifies whether a
Configuration Access Fault has been recorded.
SMMU_NSgIrpt, to indicate whether any other global fault has been recorded, where SMMU_sCR0.GFIE
enables reporting of the fault. SMMU_sGFSR specifies whether such a fault has been recorded.
3-57
Note
If SMMU_sGFSR.MULTI is 1 because of a Configuration access fault, SMMU_NSglrpt is asserted instead of
SMMU_NSgCfglrpt.
In an implementation that includes the Security Extensions, the interrupt for communicating these fault classes
depends on which Banked copy of SMMU_sGFSR is updated. If the global fault updates SMMU_sGFSR, interrupt
signaling is as previously stated. If the global fault updates SMMU_sGFSR:
SMMU_gIrpt indicates all other global faults. SMMU_SCR0.GFIE enables its assertion.
See SMMU_sCR0, Configuration Register 0 on page 10-120 for more information.
3-58
3.9
Configuration access
System MMU configuration is performed through a register space in the system address map. This address map
might be partially populated, with the possibility of fully implemented, partially implemented and unimplemented
registers throughout that address space.
The following behaviors are permitted for access to an unimplemented register or an unimplemented register bit in
the System MMU configuration space:
Access to an unimplemented configuration register can be RAZ/WI, or can result in a Configuration access
fault. Such behavior is also permitted for a Non-secure access to a configuration resource reserved by Secure
software.
Access to an unimplemented bit in a configuration register where at least one bit is implemented can behave
as RAZ/WI.
A System MMU implementation can restrict access to some or all of the configuration addresses based on the
privilege of the access, with the following behaviors permitted where the transaction does not have sufficient access
permissions:
Note
This behavior means that Non-secure software can inject faults into SMMU_SGFSR, possibly preventing Secure
software from detecting or managing other faults.
3-59
3.10
External faults
A fault encountered outside the System MMU can be reported to the System MMU across the system interconnect.
An external fault encountered in an instruction read, a data read or a data write can be reported to the System MMU,
which might record the fault synchronously or asynchronously.
External fault support in a System MMU implementation is only required when an external fault is returned in
response to a read issued as part of a translation table walk:
If the translation table walk is part of processing a client access, the System MMU records the external fault
in the appropriate fault status register.
If the translation table walk is part of processing an address translation operation initiated by a configuration
access, the fault status is generally captured in SMMU_sGPAR or SMMU_CBn_PAR. An exception to this
is where an external fault is encountered during a stage 2 translation table walk that is performed as part of
processing an address translation operation initiated in a Stage 1 Translation context bank. In this case, stage
2 SMMU_CBn_FSR and related registers might capture a fault status. Depending on how the fault is
serviced, the corresponding Stage 1 Translation context bank SMMU_CBn_PAR captures an Address
Translation Operation Terminated (ATOT) status.
For external faults reported to the System MMU in all other cases, it is IMPLEMENTATION DEFINED which external
faults, if any, the System MMU records.
An external abort reported by the System MMU selects a fault status register group and updates the fault status
register in this group with a fault status code. A synchronously recorded external abort selects the fault status register
group corresponding to the System MMU resources that processed the faulty transaction. If the transaction bypassed
translation, the global fault status group is used. If the transaction was processed with one or more Translation
context banks, the fault status group belonging to the Translation context bank is used.
For nested translation, the Stage 2 Translation context bank is always used.
For an asynchronously recorded external abort, the fault status register group selected is IMPLEMENTATION DEFINED.
The selected register group can be a fault status register group as specified for synchronous reporting or the global
fault status register group.
A synchronously recorded external abort updates the fault status register and the fault address and fault syndrome
registers. The fault status register is updated to indicate that an external fault has occurred. The fault address and
fault syndrome registers are updated with syndrome information about the transaction that caused the fault.
An asynchronously recorded external abort updates the fault status register to indicate that an external fault has
occurred. The fault address and syndrome registers are UNKNOWN.
3.10.1
3-60
3.11
succeeded
failed
aborted.
In the SMMU, reporting means specifically reporting an exclusive access transaction as aborting. When the SMMU
is configured so that aborts are not reported, that is, when either the SMMU_sCR0.GFRE bit or the
SMMU_CBn_SCTLR.CFRE bit is set to 0, ARM recommends that an implementation reports that the transaction
has failed.
3-61
3-62
Chapter 4
Address Translation Commands
This chapter describes address translation commands. It contains the following sections:
4-63
4.1
4-64
4.2
Functionality
SMMU_CBn_ATS1UR
SMMU_CBn_ATS1UW
SMMU_CBn_ATS1PR
SMMU_CBn_ATS1PW
To begin translation, software writes the address that is to be translated, to the required command address. The stage
1 translation tables give the result of a successful translation. This result is an intermediate physical address.
4.2.1
Usage model
The address translation commands are used with the following registers in the same Translation context bank:
SMMU_CBn_PAR
SMMU_CBn_ATSR.
If the operation invoked by the command succeeds, SMMU_CBn_PAR holds the translated address.
SMMU_CBn_ATSR tracks the progress of an address translation operation. SMMU_CBn_ATSR.ACTIVE is set to
1 when a new address translation operation starts, and remains set at this value until the previously requested
operation completes. UNPREDICTABLE behavior arises if an address translation operation is requested in the same
Translation context bank before the previously requested address translation operation completes.
4.2.2
Fault handling
If an address translation operation fails, SMMU_CBn_PAR generally captures a fault code. See also Fault handling
within nested translation operations initiated in a context bank.
Note
Address translation operations in a stage 1 translation context operate independently from the translation of client
transactions within that stage 1 translation context bank. A fault in a stage 1 context bank, which is indicated by
SMMU_CBn_FSR having a non-zero value, does not restrict address translation operations.
4.2.3
4.2.4
4-65
If an address translation operation is initiated in a Stage 1 Translation context bank that is associated with a Stage 2
Translation context bank, the handling of a fault that is encountered when processing an address translation
operation is modified for the following conditions:
an external abort
an external abort
a fault during stage 2 translation required by a stage 1 initiated address translation, including:
the stage 2 SMMU_CBn_FAR register captures the input address to the address translation operation
Note
This is the virtual address, as would be the case for a nested client transaction faulting in stage 2.
the stage 2 SMMU_CBn_FSYNR0 register captures other syndrome information about the fault, including:
the ATOF bit, to indicate that the fault is a result of a stage 1 address translation operation
the S1PTWF bit, to indicate that the fault is related to a stage 1 translation table walk
If the fault is not recorded, that is, if the value in the stage 2 SMMU_CBn_FSR register is not 0 prior to the fault,
the stage 2 SMMU_CBn_FSR.MULTI bit is set to 1.
If the fault is recorded and stalling is permitted in stage 2 then the address translation operation is stalled in the same
way as a client transaction, and:
the stage 1 SMMU_CBn_ATSR.ACTIVE register bit is not reset, indicating that the operation is active
the stage 2 SMMU_CBn_RESUME command can be used to resume the operation in stage 2
If the stage 2 context is configured to use the Terminate fault model, the System MMU terminates the address
translation operation, as follows:
4-66
the stage 1 SMMU_CBn_PAR register updates with the Address Translation Operation Terminated (ATOT)
fault code, regardless of the value of the stage 2 SMMU_CBn_SCTLR.CFRE bit.
Note
If stage 2 is already faulting and the stage 2 SMMU_CBn_SCTLR.HUPCF bit is set to 0 so that the bank
terminates subsequent transactions, then the address translation operation is terminated regardless of whether
the operation might have completed successfully.
Handling faults that are recorded in the Global Fault Status Registers
This category of fault handling applies to faults encountered during a stage 2 translation operation that is required
by an address translation operation initiated in a Stage 1 context bank. These include:
Nested
NSSTATE
NSATTR
ATS
WNR
PNU
IND.
SMMU_sGFAR
SMMU_sGFSYNR1
Note
These address translation operations are not recoverable, because these faults are caused by the hypervisor failing
to configure the SMMU correctly. The UNKNOWN fields cannot be used for diagnostic purposes.
If the fault is not recorded, that is, if the value in SMMU_sGFSR is not 0 prior to the fault:
the SMMU_sGFSR.MULTI bit is set to 1 and the other bits in SMMU_sGFSR are not updated
SMMU_sGFAR
SMMU_sGFSYNR0
SMMU_sGFSYNR1
SMMU_sGFSYNR2
the stage 1 SMMU_CBn_PAR register is updated with the ATOT fault code.
4-67
4.3
Functionality
SMMU_sGATS1UR
SMMU_sGATS1UW
SMMU_sGATS1PR
SMMU_sGATS1PW
SMMU_sGATS12UR
SMMU_sGATS12UW
SMMU_sGATS12PR
SMMU_sGATS12PW
To begin translation, software writes to the required command address. All of the commands require an input
address and a Stage 1 Translation context bank index as arguments.
If a command receives as its input argument, an invalid index from the software, an Unimplemented context bank
fault is recorded by the System MMU in the global context bank. An example of an invalid index is an index that
corresponds to either:
a Translation context bank configured in the format of a Stage 2 Translation context bank.
A Secure command, for example SMMU_SGATS1UR, accepts an index of either a Secure or a Non-secure Stage
1 Translation context bank. A Non-secure command, for example SMMU_GATS1UR, accepts an index of a
Non-secure Translation context bank.
See the following sections for more information:
Usage model
4.3.1
Usage model
Address translation commands are used with the following registers in the same Translation context bank:
SMMU_sGPAR
SMMU_sGATSR.
If the operation is successful, the corresponding SMMU_sGPAR register holds the translated address.
SMMU_sGATSR tracks translation progress. When an operation invoked by an address translation command starts,
SMMU_sGATSR.ACTIVE is set to 1, and remains set at 1 until the previously requested command completes.
If software invokes an address translation command before the previously requested command completes, the
resulting behavior is UNPREDICTABLE.
Secure address translation operations work in combination with SMMU_SGPAR and SMMU_SGATSR.
Non-secure address translation operations work in combination with SMMU_GPAR and SMMU_GATSR.
After using any of these commands, software must read SMMU_sGATSR.ACTIVE to determine whether:
SMMU_sGPAR has been updated to show the outcome of the last requested address translation operation
4-68
4.3.2
Fault handling
If a global translation fails, the corresponding SMMU_sGPAR register captures a fault code. The handling of faults
arising from global address translation operations is more simple than that of Translation context bank address
translation operations, because global address translation operations do not require any consideration for the
interaction between a hypervisor and an operating system.
Global address translation operations that are initiated in global register space are not subject to stalls. For these
operations, the SMMU reports faults to SMMU_sGPAR rather than the stage 1 or stage 2 context resources,
regardless of whether:
4.3.3
4.3.4
4-69
4-70
Chapter 5
Coherency Issues
5-71
5 Coherency Issues
5.1 Atomic update of state
5.1
5-72
5 Coherency Issues
5.2 Translation table walk coherency
5.2
5-73
5 Coherency Issues
5.3 Broadcast TLB maintenance operations
5.3
5.3.1
Note
This hint has no effect on Secure broadcast TLB Invalidate operations because they have no associated VMID.
5.3.2
5-74
5 Coherency Issues
5.4 Memory-mapped TLB maintenance operations
5.4
SMMU_CBn_TLBIVAAL, TLB Invalidate by VA, All ASID, Last level on page 15-218
Operations in the Translation context bank address space are for the maintenance of translation tables associated
with a particular translation context. Because of the location of the operations in the Translation context bank
address space, a Guest OS can directly maintain its own translations.
Operations in the global address space are for supervisory code that might have to perform maintenance operations
and confirm completion of TLB maintenance operations globally across the System MMU instance.
A write to any of the following locations is an invalidation request. The SMMU_CBn_TLBSYNC command and
the SMMU_CBn_TLBSTATUS register manage the completion of each operation:
SMMU_CBn_TLBIALL
SMMU_CBn_TLBIASID
SMMU_CBn_TLBIVA
SMMU_CBn_TLBIVAA
SMMU_CBn_TLBIVAAL
SMMU_CBn_TLBIVAL.
A write to SMMU_CBn_TLBSYNC is a synchronization request. SMMU_CBn_TLBSTATUS indicates the
completion of the request.
A write to any of the following locations is a global invalidation request:
SMMU_STLBIALL
SMMU_TLBIALLH
SMMU_TLBIALLNSNH
SMMU_TLBIVMID.
A write to SMMU_sTLBGSYNC is a synchronization request As a minimum, the synchronization operation applies
to the specified security state, and includes all TLB Invalidate operations initiated in context banks associated with
that security state.
SMMU_sTLBGSTATUS indicates completion of all the TLB invalidate operations initiated before the most recent
write to SMMU_sTLBGSYNC.
5-75
5 Coherency Issues
5.4 Memory-mapped TLB maintenance operations
5.4.1
every translation held in a TLB that is a target of a TLB Invalidate operation has been discarded
every transaction already in progress that has used the translations held in the TLB has been globally
observed.
A System MMU must accept an unbounded number of memory-mapped TLB maintenance operations without
relying on the forward progress of client transactions.
Software can use a SYNC operation to determine that a memory-mapped TLB maintenance operation is complete.
A SYNC operation accepted in a Translation context bank only ensures the completion of a TLB maintenance
operation accepted in that Translation context bank. A SYNC operation accepted in the global address space ensures
the completion of a TLB maintenance operation accepted in either the global address space or in any Translation
context bank.
POST
The outline assembly language source code for posting a new TLB Invalidate operation is as follows, assuming the
operation is to invalidate by virtual address:
MOV
MOV
STR
R0,#VA
R1,#SMMU_CBn_TLBIVA
R0,[R1]
SYNC
The outline assembly language source code for ensuring the completion of one or more posted TLB Invalidate
operations is as follows:
MOV
MOV
STR
Loop:
LDR
ANDS
BNE
DSB
5.4.2
R0,#SMMU_CBn_TLBSYNC
R1,#SMMU_CBn_TLBSTATUS
R0,[R0] ; Initiate TLB SYNC
R0,[R1]
R0,R0, #1 ; TLB SYNC ACTIVE STATUS
Loop
Thread safety
Memory-mapped TLB maintenance operations do not provide atomic behavior. However, the state necessary for
initiating and tracking the completion of a TLB maintenance operation is duplicated so that multiple threads can
work independently:
in an implementation that includes the Security Extensions, the global TLB maintenance operation state is
banked for security
the Translation context bank TLB maintenance operation state is provided per Translation context bank.
Software arbitration is required if there is the potential for multiple threads of activity to use the same TLB
maintenance operation state concurrently. For example, a software lock is required if it is possible for multiple
threads to attempt to perform TLB maintenance operations in a single Translation context bank.
5-76
Chapter 6
Debug Support
6-77
6 Debug Support
6.1 TLB visibility
6.1
TLB visibility
The System MMU architecture does not require the provision of debug support features. However, ARM strongly
recommends that an implementation provides a mechanism to read the content of any TLB structure in the
implementation. The method by which the System MMU provides this feature is IMPLEMENTATION DEFINED. Space
is reserved in the global register map to provide access to such a function. See Chapter 10 System MMU Global
Register Space 0 for more information.
If an implementation includes the Security Extensions, a Non-secure debug agent must not be able to read any data
relating to Secure transaction handling.
6-78
Chapter 7
System MMU Performance Monitors Extension
This chapter describes the System MMU Performance Monitors Extension. It contains the following sections:
7-79
7.1
7-80
7.2
7-81
7.3
Event classes
Table 7-1 shows the event classes of the System MMU Performance Monitors Extension.
Table 7-1 System MMU performance monitoring events
Category
Event Number
Description
Cycle
0x00
0x01
Cycle count divided by 64 event, occurs every 64th System MMU clock
cycle
0x08
TLB Refill, occurs when a System MMU refills a TLB to load a translation
0x09
0x0A
0x10
0x11
Access Read
0x12
Access Write
TLB
Access
It is IMPLEMENTATION DEFINED which event classes are included in an implementation. See PMCEID0,
Performance Monitors Common Event Identifier 0 register on page 13-171 for more information.
All unused encodings are reserved:
unused encodings in the range 0x00-to 0x7F are reserved for future architectural event classes
unused encodings in the range 0x80-to 0xFF are reserved for IMPLEMENTATION DEFINED event classes.
7-82
7.4
StreamID groups
The System MMU Performance Monitors Extension includes the concept of a StreamID group. A StreamID group
is a set of StreamIDs. Transactions with a StreamID that is a member of a StreamID group are associated with that
group. The number of StreamID groups, and the mapping of StreamIDs to StreamID groups, is IMPLEMENTATION
DEFINED.
Event counters are affiliated with a StreamID group. An event counter can only count events caused by the
processing of transactions associated with that group.
It is permissible to define a number of StreamID groups with potentially overlapping membership. A global
StreamID group can be defined to contain all StreamIDs as members. ARM suggests StreamID group 0 be reserved
for this purpose.
The concept of StreamID groups caters for distributed systems where a remote TLB might service only a subset of
client devices, therefore only having visibility of a subset of transactions processed by the System MMU. The
StreamID group definition makes counting events limited to such a subset of transactions permissible.
Event counters are affiliated with a StreamID group on a fixed basis. There is no mechanism to change the
relationship. The affiliation with a StreamID is made on a per-counter group basis.
7-83
7.5
Counter groups
The System MMU Performance Monitors Extension provides:
For each Counter group, PMCGCRn.CGNC indicates the IMPLEMENTATION DEFINED number of event
counters associated with Counter group n.
7-84
7.6
Event filtering
A Counter group counts events on a global, translation context, or StreamID basis:
If configured to count all events, it considers all transactions associated with the StreamID group that the
Counter group is affiliated with.
If configured to filter events on a translation context basis, it only considers transactions processed by the
System MMU translation context designated by PMCGCRn.NDX, and limited by the scope of the StreamID
group that the Counter group is affiliated with.
If configured to filter events on a StreamID basis, it only considers transactions that match the ID and the
mask designated by PMCGSMRn.ID and PMCGSMRn.MASK, and limited by the scope of the StreamID
group that the Counter group is affiliated with. An implementation must provide the same number of
PMCGSMRn.ID and PMCGSMRn.MASK bits for every implemented PMCGSMRn register.
PMCGCRn.TCEFCFG selects the type of filtering on which the event counting is based.
7-85
7.7
if enabled by PMCGCRn.CBAEN, PMCGCRn.NDX specifies the Translation context bank to assign the
Counter group to.
Only one Counter group can be revealed in a Translation context bank. Behavior is UNPREDICTABLE if multiple
PMCGCRn registers specify the same Translation context bank.
Translation context bank assignment can only be enabled after the following event filtering modes of operation are
configured:
7.7.1
7.7.2
SMMU_CBn_PMCR banking
PMCR only operates on event counters of Counter groups that are not revealed in a Translation context bank.
A separate register, SMMU_CBn_PMCR, controls event counters in a Counter group that is revealed in a
Translation context bank. This register is revealed as part of the designated Translation context bank. For state save
and restore purposes, the active RW bits of this Banked register are available in the PMCGCRn register associated
with that Counter group.
7.7.3
7-86
7.8
7-87
7.9
7-88
Chapter 8
Security Extensions
This chapter describes the relationship between the System MMU architecture and the OPTIONAL Security
Extensions. It contains the following sections:
8-89
8 Security Extensions
8.1 Sharing resources between Secure and Non-secure domains
8.1
8-90
8 Security Extensions
8.2 Excluding the Security Extensions
8.2
the System MMU implementation does not translate transactions from Secure devices
Stream match register groups, Translation context banks and interrupts are not reserved
Note
Regardless of whether a System MMU implementation excludes the Security Extensions, the introduction of a
System MMU must not create any type of security loophole.
8-91
8 Security Extensions
8.3 Including the Security Extensions
8.3
8.3.1
Translation restrictions
In a System MMU implementation that includes the Security Extensions, the following restrictions apply to a
transaction from a Secure device:
8.3.2
a transaction from a Secure device must only be translated by a stage 1 context that is reserved by Secure
software.
Resource reservation
In a System MMU implementation that includes the Security Extensions, a number of resources are shared between
Secure and Non-secure domains. For some of these resources, Secure software might reserve some or all of the
resource for the sole use of the Secure software. Such shared resources include:
the reservation occurs at Secure system boot time and is static for the duration of system uptime
a software interface between Secure and Non-secure domains is implemented that supports the dynamic
partitioning of System MMU resources.
As a consequence of the restrictions specified in Translation restrictions, the following conditions apply:
8.3.3
A transaction that is determined to be Secure by security state determination must only match a Stream
mapping register group that is reserved by Secure software.
A Stream mapping register group that is reserved by Secure software must only specify:
Bypass mode
The SMMU_CBARn register associated with a Translation context bank reserved by Secure software must
only specify a Context interrupt that is reserved by Secure software.
Any Translation context bank reserved by Secure software must be placed above the Translation context bank
indicated by SMMU_IDR1.NUMS2CB. This field indicates the last Translation context bank that only
supports the stage 2 translation format.
8-92
The Secure domain must be able to operate in isolation from the Non-secure domain.
8 Security Extensions
8.3 Including the Security Extensions
This implies that the Secure domain must have access to registers, instruction memory, and data memory that
the Non-secure domain does not have access to. Under the Security Extensions, this is achieved by a
combination of dedicated Secure resources and shared resources that the Secure domain acts as a gatekeeper
for. In the System MMU architecture, this concept is extended by the ability of Secure software to reserve
the following System MMU resources:
Context interrupts.
Secure and Non-secure domains must be able to communicate. Under the Security Extensions this is
primarily facilitated by permitting the Secure domain to access Non-secure memory.
Under the processor architecture, the basic model is extended in the following ways:
It is generally useful to give the Secure domain read and write access to any Non-secure domain state in the
system.
Note
Read and write access to the Non-secure state is not equivalent to being able to use that state in all cases. For
example, Secure software can read from and write to the Non-secure SMMU_CBn_TTBCR registers, but
cannot execute a LDR or STR instruction using those registers.
Inside Non-secure memory, the Secure domain can store translation table mappings that specify translations
to Non-secure memory. This reduces the requirements to use Secure memory, which is generally an on-chip,
and therefore expensive, resource.
Figure 8-1 shows the relationship between transaction processing and resource usage. The connections shown are
mandatory for enabling basic and fundamental operation.
Translation
context bank
Stream
mapping table
T-S
T-S
T-S
T-S
NS
T-NS
L2
L3
MEM
S
T-NS
T-NS
L1
S
Context
NS interrupts
NS
NS
T-NS
Non-secure
nested translation
L1
L2
L3
MEM
Figure 8-1 Basic relationship between processing transactions and using resource
With regard to boundary control between Secure and Non-secure resources:
Secure software controls the boundary between Secure and Non-secure resource.
In the Stream mapping table, Secure software can claim Stream mapping register groups using
SMMU_SCR0.NSNUMSMRGO. See SMMU_sCR0, Configuration Register 0 on page 10-120.
In the Translation context bank space, SMMU_SCR0.NSNUMCBO enables Secure software to adjust the
number of Translation context banks visible to Non-secure accesses. This control also has the effect of
reserving the SMMU_CBARn and SMMU_CBFRSYNRAn registers associated with the Translation context
banks that have been reserved.
8-93
8 Security Extensions
8.3 Including the Security Extensions
In the Context interrupts space, SMMU_SCR1.NSNUMIRPTO can be configured to reserve some of the
interrupts for Secure software.
In addition to the basic relationship between transaction processing and resource usage, the following connections
are permitted:
L2
S
T-S
T-S
T-S
S
NS
NS
L1
L2
L3
Figure 8-2 Permitted relationships between Secure and Non-secure resource usage
Figure 8-1 on page 8-93 and Figure 8-2 show all permitted relationships between Secure and Non-secure resource
usage. No other relationships are permitted.
Prohibited relationships
Security requirements mean that the following relationships are not permitted:
a transaction originating from a bus master operating for the Non-secure domain must never be permitted to
map to a transaction stream or translation context in the Secure part of the Stream mapping table
a transaction associated with the Non-secure part of the Stream mapping table must never be associated with
a Secure Translation context bank
a transaction associated with a Non-secure Translation context bank must never be associated with a Secure
Context interrupt
a transaction associated with a Non-secure Translation context bank must never be associated with a Secure
level 1 translation table walk
a transaction in the Non-secure level 1 part of a translation table walk must never be permitted to enter the
Secure level 2 part of a translation table walk
a transaction in the Non-secure level 2 part of a translation table walk must never be permitted to enter the
Secure level 3 part of a translation table walk
a transaction in the Non-secure level 3 part of a translation table walk must never be associated with target
memory managed by Secure software.
8-94
a transaction originating from a bus master operating for the Secure domain must not be permitted to map to
a transaction stream or translation context in the Non-secure part of the Stream mapping table
8 Security Extensions
8.3 Including the Security Extensions
a transaction associated with the Secure part of the Stream mapping table must not be associated with a
Non-secure Translation context bank
nested translation is not permitted in the Secure part of the Translation context bank
a transaction associated with a Secure Translation context bank must not be associated with a Non-secure
Context interrupt.
8-95
8 Security Extensions
8.3 Including the Security Extensions
8-96
Chapter 9
System MMU Address Space
This chapter specifies the address space of a System MMU implementation. It contains the following sections:
9-97
9.1
Translation context
bank address space
SMMU_CB_BASE
SMMU_GLOBAL_TOP
Global address
space
SMMU_BASE
SMMU_IDR1.PAGESIZE
SMMU_IDR1.NUMPAGENDXB.
9.1.1
9.1.2
9-98
9.2
Description
Notes
(5 PAGESIZE) to SMMU_GLOBAL_TOP
Reserved
RAZ/WI
9.2.1
Description
Value
SMMU_GR0_BASE
SMMU_BASE + (0 PAGESIZE)
SMMU_GR1_BASE
SMMU_BASE + (1 PAGESIZE)
SMMU_GID_BASE
SMMU_BASE + (2 PAGESIZE)
SMMU_PM_BASE
SMMU_BASE + (3 PAGESIZE)
SMMU_SSD_BASE
SMMU_BASE + (4 PAGESIZE)
9.2.2
9-99
Setting SMMU_SCR1.GASRAE to 1 enables a restricted access mode of operation. In this mode, with the possible
exception of the IMPLEMENTATION DEFINED address space, all of the global address space and the stage 2 format
Translation context banks are accessible by Secure configuration access only. It is IMPLEMENTATION DEFINED
whether SMMU_SCR1.GASRAE only permits Secure accesses to the IMPLEMENTATION DEFINED address space.
These restrictions are in addition to any underlying Secure-only resource that might exist.
9-100
9.3
Description
Notes
9-101
9-102
Chapter 10
System MMU Global Register Space 0
This chapter specifies System MMU Global Register Space 0. It contains the following sections:
10-103
10.1
Offset
Name
Type
Description
Notes
0x00000
SMMU_sCR0
RW
Banked with
security
0x00004
SMMU_SCR1
RW
Secure only
0x00008
SMMU_sCR2
RW
Banked with
security
0x0000C
Reserved
0x00010
SMMU_sACR
RW
Banked with
security
0x000140x0001C
Reserved
0x00020
SMMU_IDR0
RO
0x00024
SMMU_IDR1
0x000280x0003C
SMMU_IDR2-SMMU_IDR7
0x00040
SMMU_sGFAR[31:0]
RW
Banked with
security
0x00044
SMMU_sGFAR[63:32]
0x00048
SMMU_sGFSR
RW
Banked with
security
0x0004C
SMMU_sGFSRRESTORE
WO
Banked with
security
0x00050
SMMU_sGFSYNR0
RW
Banked with
security
0x00054
SMMU_sGFSYNR1
RW
Banked with
security
0x00058
SMMU_sGFSYNR2
RW
Banked with
security
0x0005C
Reserved
0x00060
SMMU_STLBIALL
WO
Secure only
0x00064
SMMU_TLBIVMID
WO
0x00068
SMMU_TLBIALLNSNH
WO
10-104
Name
Type
Description
Notes
0x0006C
SMMU_TLBIALLH
WO
0x00070
SMMU_sTLBGSYNC
WO
Banked with
security
0x00074
SMMU_sTLBGSTATUS
RO
Banked with
security
0x00078
SMMU_TLBIVAH
WO
0x0007C
Reserved
0x000800x0009C
IMPLEMENTATION DEFINED
0x000A00x000FC
Reserved
0x00100
SMMU_sGATS1UR
WO
0x00104
Reserved
0x00108
SMMU_sGATS1UW
WO
0x0010C
Reserved
0x00110
SMMU_sGATS1PR
WO
0x00114
Reserved
0x00118
SMMU_sGATS1PW
WO
0x0011C
Reserved
0x00120
SMMU_sGATS12UR
WO
0x00124
Reserved
0x00128
SMMU_sGATS12UW
WO
0x0012C
Reserved
0x00130
SMMU_sGATS12PR
WO
0x00134
Reserved
0x00138
SMMU_sGATS12PW
WO
0x0013C
Reserved
10-105
Name
Type
Description
Notes
0x001400x0017C
Reserved
0x00180
SMMU_sGPAR[31:0]
RW
Banked with
security
0x00184
SMMU_sGPAR[63:32]
0x00188
SMMU_sGATSR
RO
Banked with
security
0x0018C0x003FC
Reserved
0x00400
SMMU_NSCR0
RW
Secure only
0x00404
Reserved
0x00408
SMMU_NSCR2
RW
Secure only
0x0040C
Reserved
0x00410
SMMU_NSACR
RW
Secure only
0x004140x0041C
Reserved
0x004200x0043C
Reserved
0x00440
SMMU_NSGFAR[31:0]
RW
0x00444
SMMU_NSGFAR[63:32]
0x00448
SMMU_NSGFSR
RW
Secure only
0x0044C
SMMU_NSGFSRRESTORE
WO
Secure only
0x00450
SMMU_NSGFSYNR0
RW
Secure only
0x00454
SMMU_NSGFSYNR1
RW
Secure only
0x00458
SMMU_NSGFSYNR2
RW
Secure only
0x0045C 0x0046C
Reserved
0x00470
SMMU_NSTLBGSYNC
WO
Secure only
10-106
Name
Type
Description
Notes
0x00474
SMMU_NSTLBGSTATUS
RO
Secure only
0x004780x0047C
Reserved
0x004800x0049C
IMPLEMENTATION DEFINED
Secure only
0x004A00x004FC
Reserved
0x00500
SMMU_NSGATS1UR
WO
Secure only
0x00504
Reserved
0x00508
SMMU_NSGATS1UW
WO
Secure only
0x0050C
Reserved
0x00510
SMMU_NSGATS1PR
Secure only
0x00514
Reserved
0x00518
SMMU_NSGATS1PW
WO
Secure only
0x0051C
Reserved
0x00520
SMMU_NSGATS12UR
WO
Secure only
0x00524
Reserved
0x00528
SMMU_NSGATS12UW
WO
Secure only
0x0052C
Reserved
0x00530
SMMU_NSGATS12PR
WO
Secure only
0x00534
Reserved
0x00538
SMMU_NSGATS12PW
WO
Secure only
10-107
Name
Type
Description
Notes
0x0053C0x0057C
Reserved
0x0580
SMMU_NSGPAR[31:0]
RW
Secure only
0x00584
SMMU_NSGPAR[63:32]
0x00588
SMMU_NSGATSR
RO
Secure only
0x0058C0x007FC
Reserved
0x00800
SMMU_SMR0
RW
0x00804
SMMU_SMR1
0x008080x009FC
SMMU_SMR2 to
SMMU_SMR127
RAZ/WI in an
implementation
with StreamID
indexing
0x00A000x00BFC
Reserved
0x00C00
SMMU_S2CR0
RW
0x00C04
SMMU_S2CR1
0x00C080x00DFC
SMMU_S2CR2 to
SMMU_S2CR127
0x00E00 -
Reserved
(PAGESIZE
0x4)
10-108
10.2
Reset values
Table 10-2 shows the register field values in System MMU Global Register Space 0 following a system reset. The
fields that do not appear in Table 10-2 reset to UNKNOWN values.
Table 10-2 Reset values
Field
Reset
Notes
SMMU_sCR0.CLIENTPD
0b1
SMMU_sCR0.GFIE
0b0
SMMU_sCR0.GFRE
0b0
SMMU_sCR0.GCFGFIE
0b0
SMMU_sCR0.GCFGFRE
0b0
SMMU_sCR0.GSE
0b0
SMMU_sCR0.MTCFG
0b0
SMMU_sCR0.SHCFG
0b00
SMMU_sCR0.RACFG
0b00
SMMU_sCR0.WACFG
0b00
SMMU_sCR0.TRANSIENTCFG
0b00
SMMU_SCR0.STALLD
0b0
SMMU_SCR0.NSCFG
0b00
SMMU_sTLBGSTATUS.GSACTIVE
0b0
SMMU_SCR1.NSNUMCBO
Implemented
NUMCB
SMMU_SCR1.GASRAE
0b0
SMMU_SCR1.SPMEN
0b0
10-109
Reset
Notes
SMMU_SCR1.SIF
0b0
SMMU_SCR1.NSNUMIRPTO
Implemented
NUMIRPT
SMMU_SCR1.NSNUMSMRGO
Implemented
NUMSMRG
10-110
10.3
SMMU_NSCR0
SMMU_NSCR2
SMMU_NSACR
SMMU_NSGFAR
SMMU_NSGFSR
SMMU_NSGFSRRESTORE
SMMU_NSGFSYNRn
SMMU_NSGPAR
SMMU_NSGATSR
SMMU_NSGATS1*.
For example, a Secure access to SMMU_NSGFSYNR1 is the only mechanism for obtaining the
SSD_Index for a faulty Non-secure transaction.
The SMMU architecture provides separate Secure and Non-secure address translation resources. If
Secure software is managing the Non-secure resources, it can use the Non-secure address translation
commands, and the Secure resources remain available for Secure software to use as required..
Note
Although the SMMU architecture provides separate Secure and Non-secure TLB Invalidation
resources, Secure software cannot initiate a TLB Invalidate operation directly using Non-secure
resources. In this usage case, Secure software must use Secure resources to initiate these operations.
Save and restore, or Powerdown operations
During save and restore operations, such as before Powerdown, Secure software can save the
Non-secure state by accessing the following aliases:
SMMU_NSCR0
SMMU_NSCR2
SMMU_NSACR
SMMU_NSGFAR
SMMU_NSGFSR
SMMU_NSGFSRRESTORE
SMMU_NSGFSYNRn
SMMU_NSGPAR.
During Powerdown, Secure software must ensure that the SMMU is quiescent by:
10-111
Note
When Secure software issues a SMMU_TLBIALLNSNH or SMMU_TLBIALLH operation, it uses
Secure TLB Invalidate resources, and manages them using SMMU_STLBGSYNC and
SMMU_STLBGSTATUS. This is distinct from a requirement to use SMMU_NSTLBGSYNC or
SMMU_NSTLBGSTATUS. In general, the Secure alias must only be used when an operation is not
otherwise possible.
10-112
10.4
when MemAttr[3:2] == 0b00, indicating Strongly-ordered or Device memory, Table 10-4 shows the encoding
of MemAttr[1:0]
when MemAttr[3:2] != 0b00, indicating Normal memory, Table 10-5 shows the encoding of MemAttr[1:0].
Table 10-3 MemAttr[3:2] encoding
MemAttr[3:2]
Memory type
Cacheability
0b00
Not applicable
0b01
Normal
Outer Non-cacheable
0b10
0b11
0b00
Strongly-ordered memory
0b01
Device memory
0b10
UNPREDICTABLE
0b11
UNPREDICTABLE
MemAttr[1:0]
0b00
UNPREDICTABLE
0b01
Inner Non-cacheable
0b10
0b11
10-113
10.5
A read must return the value that was last successfully written to that field, regardless of how the register is
used. If the field has not been written to since reset, the read must return the specified reset value, if one exists,
or an UNKNOWN value. See Reset values on page 10-109.
A write must update a storage location associated with the written field.
The state of the storage location associated with a field must have no other effect on the processor behavior,
other than determining the value to be read back while the use of the register means that the field is reserved.
If the TYPE field changes so that a reserved field becomes a field with defined behavior, the value last written to
that field takes effect as specified by the individual register descriptions.
Each behavior only applies to a field that is:
10-114
10.6
10-115
10.6.1
Usage constraints
Configurations
In an implementation that includes the Security Extensions, the behavior of some fields
depends on whether Secure or Non-secure software is accessing the register. See the field
descriptions for more information.
Attributes
SMMU_IDR0
The SMMU_IDR0 bit assignments are:
31 30 29 28 27 26 25 24 23
16 15 14 13 12
9 8 7
NUMIRPT[7:0]
SES S2TS SMS
PTFS
S1TS NTS Reserved
SES, bit[31]
Reserved
0
NUMSMRG[7:0]
Reserved
BTM
CTTW NUMSIDB[3:0]
S1TS, bit[30] Stage 1 Translation Support. The possible values of this bit are:
0
Stage 1 translation is unsupported.
1
Stage 1 translation is supported.
If the NTS bit is set to 1, this bit must also be set to 1.
S2TS, bit[29] Stage 2 Translation Support. The possible values of this bit are:
0
Stage 2 translation is unsupported.
1
Stage 2 translation is supported.
This field only applies to Non-secure client transactions.
If the NTS bit is set to 1, this bit must also be set to 1.
NTS, bit[28]
Note
If this bit is set to 1, then both the S1TS and S2TS bits must be set to 1 also.
SMS, bit[27] Stream Match Support. The possible values of this bit are:
0
Stream Match Register functionality is not included.
1
Stream Match Register functionality is included.
Bits[26:25]
Reserved.
PTFS, bit[24] Support for translation table formats. The possible values of this bit are:
0
Short-descriptor and Long-descriptor formats are supported.
1
Long-descriptor format is supported.
10-116
NUMIRPT[7:0], bits[23:16]
Number of implemented Context fault interrupts.
Indicates the number of Context fault interrupts supported by the System MMU, in the range 0-128.
NUMIRPT==0 is permitted in an implementation that does not provide a Translation context bank.
In an implementation that includes the Security Extensions, access to this field by Non-secure
software gives the value configured in SMMU_SCR1.NSNUMIRPTO.
Bit[15]
Reserved.
CTTW, bit[14] Coherent Translation Table Walk. The possible values of this bit are:
0
Coherent translation table walks are unsupported.
1
Coherent translation table walks are supported.
BTM, bit[13] Broadcast TLB Maintenance. The possible values of this bit are:
0
Broadcast TLB maintenance is unsupported.
1
Broadcast TLB maintenance is supported.
NUMSIDB[3:0], bits[12:9]
Number of StreamID Bits.
Indicates the number of implemented StreamID bits, in the range 0-15.
Bit[8]
Reserved.
NUMSMRG[7:0], bits[7:0]
Number of Stream Mapping Register Groups.
Indicates the number of Stream mapping register groups in the Stream match table, in the range
0-127.
In an implementation that includes Stream matching, the value of this field is greater than or equal
to 1.
In an implementation that includes the Security Extensions, access to this field by Non-secure
software gives the value configured in SMMU_SCR1.NSNUMSMRGO.
SMMU_IDR1
The SMMU_IDR1 bit assignments are:
31 30
28 27
24 23
Reserved
16 15 14 13 12 11
8 7
NUMS2CB[7:0]
NUMPAGENDXB
PAGESIZE
0
NUMCB[7:0]
SMCD SSDTP
Reserved NUMSSDNDXB[3:0]
PAGESIZE, bit[31]
System MMU Page Size.
Indicates the size of each page in the System MMU register map.
The possible values of this bit are:
0
4KB.
1
64KB.
NUMPAGENDXB, bits[30:28]
System MMU Number of Page Index Bits.
Indicates how many PAGESIZE pages occupy the global address space or the translation context
address space, where NUMPAGE = 2(SMMU_IDR.NUMPAGENDXB + 1).
Bits[27:24]
ARM IHI 0062B
ID121912
Reserved.
Copyright 2012 ARM Limited. All rights reserved.
Non-Confidential
10-117
NUMS2CB[7:0], bits[23:16]
Number of Stage 2 Context Banks.
Indicates the number of Translation context banks that only support the stage 2 translation format,
in the range 0-127.
This field is validated by SMMU_IDR0.S2TS.
SMCD, bit[15] Stream Match Conflict Detection.
The possible values of this bit are:
0
The detection of all Stream match conflicts is not guaranteed.
1
The detection of all Stream match conflicts is guaranteed.
See StreamID matching on page 2-25 for more information about stream matching.
Bits[14:13]
Reserved.
SSDTP, bit[12] Security State Determination Table Present. The possible values of this bit are:
0
The Security state determination address space is UNK/WI.
1
The Security state determination address space is populated.
In an implementation that includes the Security Extensions, Non-secure access to this field is RAZ.
NUMSSDNDXB[3:0], bits[11:8]
Number of SSD_Index bits.
Indicates the number of SSD_Index bits for indexing the security state determination table. This
field is only valid if SSDTP==1. Otherwise, it is reserved.
In an implementation that includes the Security Extensions, Non-secure access to this field is RAZ.
NUMCB, bits[7:0]
Number of Context Banks.
Indicates the total number of implemented Translation context banks, in the range 0-128.
The value reported in NUMCB includes Translation context banks that only support the stage 2
format. If an implementation includes stage 1 translation, the number of Translation context banks
that support the stage 1 format is given by SMMU_IDR1.NUMCB SMMU_IDR1.NUMS2CB.
In an implementation that includes the Security Extensions, a read of this field by Non-secure
software gives the value configured in SMMU_SCR1.NSNUMCBO.
SMMU_IDR2
The SMMU_IDR2 bit assignments are:
31
8 7
Reserved
Bits[31:8]
4 3
OAS
0
IAS
Reserved.
OAS, bits[7:4] Output Address Size. The encoding of this field is:
0b0000
32-bit output address size.
0b0001
36-bit output address size.
0b0010
40-bit output address size.
All other encodings are reserved.
IAS, bits[3:0] Input Address Size. The encoding of this field is:
0b0000
32-bit input address size.
0b0001
36-bit input address size.
0b0010
40-bit input address size.
10-118
10-119
SMMU_IDR3
The SMMU_IDR3 bit assignments are reserved.
SMMU_sIDR4-5
The SMMU_IDR4-5 bit assignments are IMPLEMENTATION DEFINED.
SMMU_IDR6
The SMMU_IDR6 bit assignments are reserved.
SMMU_IDR7
The SMMU_IDR7 bit assignments are:
31
8 7
Reserved
Bits[31:8]
4 3
MAJOR
0
MINOR
Reserved.
10.6.2
Usage constraints
Configurations
Attributes
10.6.3
Usage constraints
The Non-secure register, SMMU_CR0, does not provide full top-level control of the System
MMU for Secure transactions.
Configurations
Attributes
10-120
A 32-bit RW register. See the field descriptions for information about the reset values.
16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
MemAttr
Reserved WACFG
SHCFG MTCFG
NSCFG
RACFG SMCFCFG
BSU
FB
PTM
VMIDPNE
USFCFG
GSE
STALLD
TRANSIENTCFG
GCFGFIE
GCFGFRE
Reserved
GFIE
GFRE
CLIENTPD
Bits[31:30]
Reserved.
NSCFG, bits[29:28]
Non-secure Configuration.
This field only exists in SMMU_SCR0. In SMMU_CR0, these bits are reserved.
This field only applies to Secure transactions bypassing the System MMU stream mapping process.
See Bypassing the Stream mapping table on page 2-26.
The encoding of this field is:
0b00
Use the default NS attribute
0b01
Reserved
0b10
Secure
0b11
Non-secure.
These bits reset to 0.
WACFG, bits[27:26]
Write-Allocate Configuration, controls the allocation hint for write accesses.
This field applies to transactions that bypass the Stream mapping table. See Bypassing the Stream
mapping table on page 2-26.
The encoding of this field is:
0b00
Default attributes.
0b01
Reserved.
0b10
Write-Allocate.
0b11
No Write-Allocate.
These bits reset to 0.
10-121
RACFG, bits[25:24]
Read-Allocate Configuration. Controls the allocation hint for read accesses.
Applies to transactions that bypass the Stream mapping table. See Bypassing the Stream mapping
table on page 2-26.
The encoding of this field is:
0b00
Default allocation attributes.
0b01
Reserved.
0b10
Read-Allocate.
0b11
No Read-Allocate.
These bits reset to 0.
SHCFG, bits[23:22] Shared Configuration.
Applies to transactions that bypass the Stream mapping table. See Bypassing the Stream mapping
table on page 2-26.
The encoding of this field is:
0b00
Default Shareable attribute.
0b01
Outer Shareable.
0b10
Inner Shareable.
0b11
Non-shareable.
These bits reset to 0.
SMCFCFG, bit[21]
Stream Match Conflict Fault Configuration. Controls transactions with multiple matches in the
Stream mapping table.
The possible values of this bit are:
0
Permit the transaction to bypass the System MMU.
1
Raise a Stream match conflict fault.
It is IMPLEMENTATION DEFINED whether:
The System MMU guarantees the detection of every Stream match conflict. See StreamID
matching on page 2-25 for more information.
Stream match conflict handling is configurable. If not configurable, the value of SMCFCFG
is fixed and writes are ignored.
10-122
Applies to transactions bypassing the Stream mapping table. See Bypassing the Stream mapping
table on page 2-26.
The encoding of this field is:
No effect.
0b01
Inner Shareable.
0b10
Outer Shareable.
0b11
Full system.
0b00
This functionality might not be supported by all system topologies. In an implementation that does
not support it, BSU is RAZ/SBZP.
These bits reset to an UNKNOWN value.
FB, bit[13]
Force Broadcast of TLB, branch predictor and instruction cache maintenance operations. Applies to
transactions bypassing the Stream mapping table. See Bypassing the Stream mapping table on
page 2-26.
Affects client TLB maintenance, BPIALL and ICIALLU operations. If FB==1, any affected
operation is modified to the equivalent broadcast variant in the Inner Shareable domain. The
possible values of this bit are:
0
Process affected operations as presented.
1
Upgrade affected operations to be broadcast within the Inner Shareable domain.
This bit resets to an UNKNOWN value.
PTM, bit[12] Private TLB Maintenance. The possible values of this bit are:
0
The System MMU participates in broadcast TLB maintenance with the wider system, if
supported in the implementation and as indicated by SMMU_IDR0.BTM.
System MMU TLBs are privately managed and are not required to respond to broadcast
TLB maintenance operations from the wider system.
The PTM field is a hint. A broadcast TLB Invalidate operation is still permitted to affect all cached
translations that are unlocked in the System MMU.
This bit resets to an UNKNOWN value.
VMIDPNE, bit[11]
VMID Private Namespace Enable. The possible values of this bit are:
0
System MMU VMID values are a private namespace, not coordinated with the wider
system.
If VMIDPNE==1, broadcast TLB Invalidate operations specifying a VMID value are not required
to apply to cached translations in the system MMU.
The VMIDPNE field is a hint. A broadcast TLB Invalidate operation is still permitted to affect all
cached translations that are unlocked in the System MMU.
This bit resets to an UNKNOWN value.
In SMMU_SCR0, VMIDPNE is reserved.
USFCFG, bit[10]
Unidentified Stream Fault Configuration. The possible values of this bit are:
0
Permit any transaction that does not match any entries in the Stream mapping table to
pass through.
Raise an Unidentified stream fault on any transaction that does not match any Stream
mapping table entries.
10-123
This field is only writable if the implementation has global stall behavior. Otherwise, it is RAZ/WI.
This bit resets to 0.
STALLD, bit[8]
Stall Disable. The possible values of this bit are:
0
Permit per-context stalling on context faults.
1
Disable per-context stalling on context faults.
Setting this bit to 1 disables SMMU_sCR0.GSE and causes SMMU_sCR0.GSE to be RAZ/WI.
In an implementation that includes the Security Extensions, SMMU_CR0.STALLD must apply to
a Non-secure Translation context bank, and must affect SMMU_CR0.GSE. It is permitted to apply
to a Secure Translation context bank, and is permitted to affect SMMU_SCR0.GSE.
In an implementation that includes the Security Extensions, this bit resets to 0. In an implementation
that does not include the Security Extensions, it resets to an UNKNOWN value.
TRANSIENTCFG, bits[7:6]
Transient Configuration, controls the transient allocation hint.
Applies to any transaction that bypasses the Stream mapping table. See Bypassing the Stream
mapping table on page 2-26.
The encoding of this field is:
Default transient allocation attributes.
0b01
Reserved.
0b10
Non-transient.
0b11
Transient.
0b00
Reserved.
GFIE, bit[2]
Global Fault Interrupt Enable. The possible values of this bit are:
0
Do not raise an interrupt on a Global fault.
1
Raise an interrupt on a Global fault.
This bit resets to 0.
GFRE, bit[1] Global Fault Report Enable. The possible values of this bit are:
0
Do not return an abort on a Global fault.
1
Return an abort on a Global fault.
This bit resets to 0.
10-124
For exclusive access transactions, when this bit is set to 0, ARM recommends that the SMMU
reports the transaction as failed. See Reporting exclusive access transactions on page 3-61 for more
information.
CLIENTPD, bit[0]
Client Port Disable. The possible values of this bit are:
0
Each System MMU client access is subject to System MMU translation, access control,
and attribute generation.
1
Each System MMU client access bypasses System MMU translation, access control,
and attribute generation.
This bit resets to 1.
10.6.4
Usage constraints
Configurations
Attributes
A 32-bit RW register.
8 7
Reserved
Bits[31:8]
0
BPVMID
Reserved.
BPVMID, bits[7:0]
Bypass VMID.
This field is reserved for IMPLEMENTATION DEFINED use as a VMID field applied to client
transactions that bypass the System MMU. See Bypassing the Stream mapping table on page 2-26.
Whether this field is implemented, and the effect it has, is IMPLEMENTATION DEFINED.
In an implementation that does not support this field, these bits are RAZ/WI.
If an implementation that includes the Security Extensions does not provide a VMID for Secure
translation regimes, any Secure VMID field is ignored. See Interaction with the Security Extensions
on page 2-32 for more information.
10.6.5
Usage constraints
Configurations
10-125
Attributes
A 32-bit WO command.
12 11
Addr
8 7
Reserved
0
NDX
Addr, bits[31:12]
Address translation operation.
The translation is performed as though the address is associated with a privileged read.
Bits[11:8]
Reserved.
10.6.6
Usage constraints
Configurations
Attributes
A 32-bit WO command.
12 11
Addr
8 7
Reserved
0
NDX
Addr, bits[31:12]
Address translation operation.
The translation is performed as though the address is associated with a privileged write.
Bits[11:8]
Reserved.
10.6.7
10-126
Purpose
Usage constraints
Configurations
A 32-bit WO command.
12 11
Addr
8 7
Reserved
0
NDX
Reserved.
10.6.8
Usage constraints
Configurations
Attributes
A 32-bit WO command.
12 11
Addr
8 7
Reserved
0
NDX
Addr, bits[31:12]
Address translation operation.
The translation is performed as though the address is associated with an unprivileged write.
Bits[11:8]
Reserved.
10.6.9
Purpose
Usage constraints
10-127
Configurations
Attributes
A 32-bit WO command.
12 11
Addr
8 7
Reserved
0
NDX
Addr, bits[31:12]
Address translation operation.
The translation is performed as though the address is associated with a privileged read.
Bits[11:8]
Reserved.
Usage constraints
Configurations
Attributes
A 32-bit WO command.
12 11
Addr
8 7
Reserved
0
NDX
Addr, bits[31:12]
Address translation operation.
The translation is performed as though the address is associated with a privileged write.
Bits[11:8]
Reserved.
Usage constraints
Configurations
Attributes
A 32-bit WO command.
12 11
Addr
8 7
Reserved
0
NDX
Addr, bits[31:12]
Address translation operation.
The translation is performed as though the address is associated with an unprivileged read.
Bits[11:8]
Reserved.
Usage constraints
Configurations
Attributes
A 32-bit WO command.
12 11
Addr
8 7
Reserved
0
NDX
Addr, bits[31:12]
Address translation operation.
The translation is performed as though the address is associated with an unprivileged write.
Bits[11:8]
Reserved.
10-129
Usage constraints
Configurations
Attributes
1 0
Reserved
ACTIVE
Bits[31:1]
Reserved.
ACTIVE, bit[0]
Address Translation Active.
The possible values of this bit are:
0
Address translation not active.
1
Address translation active, SMMU_sGPAR is yet to be updated.
Usage constraints
See Handling multiple memory faults on page 3-46 for information about when this register
is updated. See also Multiple faults on page 3-52.
Configurations
If an implementation includes 64-bit atomic access, this register can be accessed as a 64-bit
quantity.
In an implementation that includes the Security Extensions, this register is Banked.
SMMU_NSGFAR is provided as a Secure alias of the Non-secure SMMU_GFAR. See
Table 10-1 on page 10-104 and Secure alias for Non-secure registers on page 10-111.
A 64-bit RW register with an UNKNOWN reset value.
Attributes
63
36 35
32 31
0
FADDR
Reserved, RAZ
N
Reserved or FADDR
Bits[63:N]
10-130
Reserved.
FADDR, bits[N-1:0]
Fault Address, the input address of the faulty access. For a Configuration access fault, this is the
physical address resulting in the fault. For other fault classes, it is the input address of the faulting
access, that the system can interpret in a number of ways.
Depending on the implemented input address space, the value of N can be:
Gives the fault status for each of the following possible faults:
External fault.
Usage constraints
Configurations
Attributes
A 32-bit RW clear register. A value of 1 written to any non-reserved bit clears that bit. A
value of 0 written to any of these bits leaves the bit unchanged.
This register resets to an UNKNOWN value.
31 30
Reserved
PF
EF
MULTI
CAF
UCIF
UCBF
SMCF
USF
ICF
MULTI, bit[31] Multiple error condition. The possible values of this bit are:
0
No multiple error condition was encountered.
1
An error occurred while the value in SMMU_sGFSR was nonzero.
Bits[30:8]
Reserved.
PF, bit[7]
Permission Fault.
In SMMU_GFSR, this field is reserved.
10-131
Note
If a transaction is associated with a particular Translation context bank, faults are recorded in
SMMU_CBn_FSR instead of SMMU_SGFSR.
EF, bit[6]
CAF, bit[5]
UCIF, bit[4]
Unimplemented Context Interrupt Fault. The possible values of this bit are:
0
No Unimplemented context interrupt fault.
1
Unimplemented context interrupt fault.
UCBF, bit[3] Unimplemented Context Bank Fault. The possible values of this bit are:
0
No Unimplemented context bank fault.
1
Unimplemented context bank fault.
SMCF, bit[2] Stream Match Conflict Fault. The possible values of this bit are:
0
No Stream match conflict fault.
1
Stream match conflict fault.
USF, bit[1]
ICF, bit[0]
Usage constraints
Configurations
Attributes
A 32-bit WO register.
10-132
Usage constraints
Configurations
Attributes
16 15
Reserved
8 7 6 5 4 3 2 1 0
IMPLEMENTATION DEFINED
Reserved
ATS
NSATTR
NSSTATE
IND
PNU
WNR
Nested
Bits[31:16]
Reserved.
Bits[15:8]
IMPLEMENTATION DEFINED.
Bit[7]
Reserved.
ATS, Bit[6]
Address translation operation fault. The possible values of this bit are:
0
The fault was not caused by the processing of an SMMU_CBn_ATS operation initiated
in a Stage 1 Translation context bank.
1
The fault was caused by the processing of an SMMU_CBn_ATS operation initiated in
a Stage 1 Translation context bank. See Fault handling within nested translation
operations initiated in a context bank on page 4-65 for more information.
In SMMU_SGFSYNR0 this field is reserved.
NSATTR, bit[5]
Non-Secure Attribute.The possible values of this bit are:
0
The faulty transaction has the Secure attribute.
1
The faulty transaction has the Non-secure attribute.
In SMMU_GFSYNR0 this field is reserved.
NSSTATE, bit[4]
Non-Secure State. The possible values of this bit are:
0
The faulty transaction is associated with a Secure device.
1
The faulty transaction is associated with a Non-secure device.
In SMMU_GFSYNR0 this field is reserved.
10-133
This field is set to 1 if a fault encountered when processing a Non-secure client transaction is
reported to SMMU_SGFSR, for example, when:
IND, bit[3]
PNU, bit[2]
WNR, bit[1]
Nested, bit[0] Nested fault. The possible values of this bit are:
0
The fault occurred in the initial stream context.
1
The fault occurred in a nested context.
In SMMU_SGFSYNR0 this field is reserved.
Usage constraints
Configurations
Attributes
16 15 14
SSD_Index
Reserved
Bit[31]
0
StreamID
Reserved
Reserved.
SSD_Index, bits[30:16]
SSD_Index of the transaction that caused the fault.
The number of SSD_Index bits is IMPLEMENTATION DEFINED. Unimplemented bits behave as
RAZ/WI.
The SSD_Index field is only accessible to configuration accesses by Secure software, using
SMMU_NSGFSYNR1. Non-secure configuration accesses treat this field as RAZ/WI. This means
that software must access SMMU_NSGFSYNR1 to obtain the SSD_Index for a faulty Non-secure
transaction,
Bit[15]
10-134
Reserved.
StreamID, bits[14:0]
StreamID of the transaction that caused the fault.
The number of StreamID bits is IMPLEMENTATION DEFINED. Unimplemented bits behave as
RAZ/WI.
Usage constraints
Configurations
Attributes
Usage constraints
Configurations
Attributes
32 31
63
Reserved, RAZ
PA
(0)
4 3 2 1 0
(0)
NOS
NS
IMP
SH
Inner[2:0]
Outer[1:0]
SS
F
10-135
Bits[63:32]
Reserved.
NS, bit[9]
Non-Secure. The NS attribute for a translation table entry read from a Secure Translation context
bank.
This bit is UNKNOWN for a translation table entry read from a Non-secure Translation context bank.
In SMMU_GPAR this field is reserved.
IMP, bit[8]
IMPLEMENTATION DEFINED.
SH, bit[7]
Shareable attribute. Indicates whether the physical memory is shareable. The possible values of this
bit are:
0
Physical memory is not shareable.
1
Physical memory is shareable.
Inner[2:0], bits[6:4]
Inner memory attributes from the translation table entry.
The encoding of this field is:
Write-Back, no Write-Allocate.
0b110
Write-Through.
0b101
Write-Back, Write-Allocate.
0b011
Device.
0b001
Strongly-ordered.
0b000
Non-cacheable.
0b111
F(0), bit[0]
10-136
SuperSection, indicates whether the result is a supersection. The possible values of this bit are:
0
63
40 39
MATTR
12 11 10 9 8 7 6
PA[39:12]
Reserved
(1)
SH
1 0
Reserved
IMP
NS
(0)
F
MATTR, bits[63:56]
Memory Attributes. These attributes have the encoding of the MAIR field. See
SMMU_CBn_MAIRm, Memory Attribute Indirection Registers on page 15-201 for more
information.
Bits[55:40]
Reserved.
PA[39:12], bits[39:12]
Bits[39:12] of the physical address.
IMP, bit[10]
IMPLEMENTATION DEFINED.
NS, bit[9]
Non-secure, the NS attribute for a translation table entry read from a Secure Translation context
bank.
This bit is UNKNOWN for a translation table entry read from a Non-secure Translation context bank.
In SMMU_GPAR this field is reserved.
Reserved.
F(0), bit[0]
Fault format
If a translation fails to complete successfully, the format of the SMMU_sGPAR bit assignments, irrespective of the
translation format, is:
7 6 5 4 3 2 1 0
36 35 34 33 32 31 30 29 28
63
PLVL
Reserved
Reserved
STAGE
Reserved
Reserved
UCBF
ICF
Bits[63:36]
TLBLKF
TLBMCF
EF
PF
AFF
TF
F(1)
Reserved.
STAGE, bit[35]
The stage of translation that encountered the fault. The possible values of this bit are:
0
Fault encountered in stage 1 translation.
1
Fault encountered in stage 2 translation.
Bit[34]
Reserved.
10-137
PLVL, bit[33:32]
Page Level.
Level of translation table walk that encountered the fault. The possible values of this bit are:
0b01
Fault encountered in a level 1 translation table walk.
0b10
Fault encountered in a level 2 translation table walk.
0b11
Fault encountered in a level 3 translation table walk.
Bit[31]
Reserved.
UCBF, bit[30] Unimplemented Context Bank Fault. The possible values of this bit are:
0
No fault.
1
Fault encountered because an unimplemented context bank was specified.
ICF, Bit[29]
Bits[28:7]
Reserved.
TLBLKF, bit[6]
TLB Lock Fault. The possible values of this bit are:
0
No fault.
1
TLB Lock fault.
TLBMCF, bit[5]
TLB Match Conflict Fault. The possible values of this bit are:
0
No fault.
1
Fault is a result of multiple matches detected in the TLB.
EF, bit[4]
PF, bit[3]
AFF, bit[2]
TF, bit[1]
F(1), bit[0]
Fault.
This bit is set to 1 if the translation aborts.
10-138
Gives the status of a TLB maintenance operation. See Memory-mapped TLB maintenance
operations on page 5-75 for more information.
Usage constraints
Configurations
Attributes
A 32-bit RO register.
1 0
Reserved
GSACTIVE
Bits[31:1]
Reserved.
GSACTIVE, bit[0]
Global Synchronize TLB Invalidate Active. The possible values of this bit are:
0
No Global TLB synchronization operation is active.
1
A Global TLB synchronization operation is active.
This bit resets to 0.
Starts a global synchronization operation that ensures the completion of any previously
accepted TLB Invalidate operation. As a minimum, the operation applies to the specified
security state, and includes all TLB Invalidate operations initiated in context banks
associated with that security state. See Memory-mapped TLB maintenance operations on
page 5-75 for more information.
Usage constraints
Configurations
Attributes
A 32-bit WO command.
Specifies an initial translation context for processing a transaction, where the transaction
matches the Stream mapping group that this register belongs to.
10-139
Usage constraints
Configurations
The format of this register depends on the state of its TYPE[17:16] field. See:
Attributes
0
CBNDX
TYPE
SHCFG
NSCFG
Reserved
MTCFG
RACFG
WACFG
PRIVCFG
INSTCFG
TRANSIENTCFG
IMPLEMENTATION DEFINED
Bits[31:30]
IMPLEMENTATION DEFINED.
TRANSIENTCFG, bits[29:28]
Transient Allocate Configuration, controls the transient allocation hint.
The encoding of this field is:
Use the default transient allocation attributes.
0b01
Reserved.
0b10
Non-transient.
0b11
Transient.
0b00
It is IMPLEMENTATION DEFINED whether this field is present. If not present, these bits are RAZ/WI.
INSTCFG, bits[27:26]
Instruction Fetch Attribute Configuration. The encoding of this field is:
0b00
Default instruction fetch attribute.
0b01
Reserved.
10-140
Data.
Instruction.
0b10
0b11
PRIVCFG, bits[25:24]
Privileged Attribute Configuration. The encoding of this field is:
0b00
Default privilege attributes.
0b01
Reserved.
0b10
Unprivileged.
0b11
Privileged.
WACFG, bits[23:22]
Write Allocation Configuration, controls the allocation hint for write accesses. The encoding of this
field is:
0b00
Default allocation attributes.
0b01
Reserved.
0b10
Write-Allocate.
0b11
No Write-Allocate.
RACFG, bits[21:20]
Read Allocate Configuration, controls the allocation hint for read accesses. The encoding of this
field is:
0b00
Default allocation attributes.
0b01
Reserved.
0b10
Read-Allocate.
0b11
No Read-Allocate.
NSCFG, bits[19:18]
Non-Secure Configuration. The encoding of this field is:
0b00
Default security attribute.
0b01
Reserved.
0b10
Secure configuration that only affects Secure SMMU_S2CRn entry.
0b11
Non-secure.
This field only exists for Secure Stream mapping register groups. For Non-secure Stream mapping
register groups, it is reserved.
TYPE, bits[17:16]
Register type. Indicates the meaning of the remaining fields in this register. The encoding of this
field is:
0b00
Translation context bank index.
0b01
Bypass mode.
0b10
Fault, no index.
0b11
Reserved.
MemAttr, bits[15:12]
Memory Attributes. See Memory attribute, MemAttr on page 10-113.
10-141
Specify a Translation context bank configured for the Stage 1 context with stage 2 bypass
format.
MTCFG, bit[11]
Memory Type Configuration. The possible values of this bit are:
0
Default memory attributes.
1
MemAttr field attributes.
Bit[10]
Reserved.
SHCFG, bits[9:8]
Shared Configuration. The encoding of this field is:
0b00
Default Shareable attribute.
0b01
Outer Shareable.
0b10
Inner Shareable.
0b11
Non-shareable.
CBNDX, bits[7:0]
Context Bank Index. The Translation context bank index for a stage 1 or a stage 2 translation.
The number of CBNDX bits implemented is IMPLEMENTATION DEFINED. This field must be capable
of selecting all of the implemented Translation context banks.
An implementation provides the same number of CBNDX bits for every implemented
SMMU_S2CRn.
Unimplemented bits behave as RAZ/WI.
10-142
0
VMID
TYPE
SHCFG
NSCFG
Reserved
MTCFG
RACFG
WACFG
BSU
FB
Reserved
TRANSIENTCFG
IMPLEMENTATION DEFINED
Bits[31:30]
IMPLEMENTATION DEFINED.
TRANSIENTCFG, bits[29:28]
Transient Allocate Configuration.
The encoding of this field is:
Use default transient allocation attributes.
0b01
Reserved.
0b10
Non-transient.
0b11
Transient.
0b00
Reserved.
FB, bits[26]
Force Broadcast. Force Broadcast of TLB, branch predictor and instruction cache maintenance
operations.
This field affects client TLB maintenance, BPIALL and ICIALLU operations. If it has the value 1,
any affected operation is modified to the equivalent broadcast variant within the Inner Shareable
domain.
The possible values of this bit are:
0
Process affected operations as presented.
1
Upgrade affected operations to be broadcast within the Inner Shareable domain.
BSU, bits[25:24]
Barrier Shareability Upgrade.
This field upgrades the required shareability domain of barriers issued by client devices mapped to
this Stream mapping register group by setting the minimum shareability domain applied to any
barrier.
The encoding of this field is:
No effect.
0b01
Inner Shareable.
0b10
Outer Shareable.
0b11
Full system.
0b00
Upgrade of the barrier shareability domain might not be supported in all system topologies. In an
implementation that does not have this upgrade behavior, this field is RAZ/SBZP.
10-143
WACFG, bits[23:22]
Write-Allocate Configuration, an allocation hint for write accesses. The encoding of this field is:
0b00
Default allocation attributes.
0b01
Reserved.
0b10
Write-Allocate.
0b11
No Write-Allocate.
RACFG, bits[21:20]
Read-Allocate Configuration. Gives an allocation hint for read accesses. The encoding of this field
is:
0b00
Default allocation attributes.
0b01
Reserved.
0b10
Read-Allocate.
0b11
No Read-Allocate.
NSCFG, bits[19:18]
Non-Secure Configuration. The encoding of this field is:
0b00
Default security attribute.
0b01
Reserved.
0b10
Secure configuration that only affects Secure SMMU_S2CRn entry.
0b11
Non-secure.
This field only exists for Secure Stream mapping register groups. For Non-secure Stream mapping
register groups, it is reserved.
TYPE, bits[17:16]
Register type. Indicates the meaning of the remaining fields in this register. The encoding of this
field is:
0b00
Translation context bank index.
0b01
Bypass mode.
0b10
Fault, no index.
0b11
Reserved.
MemAttr, bits[15:12]
Memory Attributes. See Memory attribute, MemAttr on page 10-113.
In an implementation that includes the Security Extensions, a Secure SMMU_S2CRn register
configured to specify a Translation context bank is only permitted to:
specify a CBNDX corresponding to a Translation context bank that is also reserved by Secure
software
specify a Translation context bank configured to the Stage 1 context with stage 2 bypass
format.
MTCFG, bit[11]
Memory Type Configuration. The possible values of this bit are:
0
Default memory attributes.
1
MemAttr field attributes.
Bit[10]
Reserved.
SHCFG, bits[9:8]
Shared Configuration. The encoding of this field is:
0b00
Default Shareable attribute.
0b01
Outer Shareable.
0b10
Inner Shareable.
10-144
Non-shareable.
0b11
VMID, bits[7:0]
Reserved for IMPLEMENTATION DEFINED use of a VMID field, where such use is relevant to all
transactions, including those not subject to any translation.
It is IMPLEMENTATION DEFINED whether this field is implemented, and what effect it has.
In an implementation that does not include this behavior, this field is RAZ/WI.
If an implementation that includes the Security Extensions does not support a VMID for Secure
translation regimes, any Secure VMID field is ignored. See Interaction with the Security Extensions
on page 2-32 for more information.
28 27
18 17 16 15
Reserved
TYPE
0
Reserved
IMPLEMENTATION
DEFINED
Bits[31:28]
IMPLEMENTATION DEFINED.
Bits[27:18]
Reserved.
TYPE, bits[17:16]
Register Type. Indicates the meaning of the remaining fields in this register. The encoding of this
field is:
0b00
Translation context bank index.
0b01
Bypass mode.
0b10
Fault, no index.
0b11
Reserved.
Bits[15:0]
Reserved.
Purpose
Usage constraints
Configurations
Attributes
A 32-bit RW register. See the field descriptions for information about the reset values.
10-145
28 27 26 25 24 23
Reserved
16 15
NSNUMIRPTO
8 7
NSNUMSMRGO
0
NSNUMCBO
GASRAE
GEFRO
SIF
SPMEN
Bits[31:28]
Reserved.
SPMEN, bit[27]
Secure Performance Monitor Enable. The possible values of this bit are:
0
Any event caused by Secure transaction processing does not contribute towards
performance monitor counting.
Raise a permission fault if a Secure domain access attempts to exit the SMMU as a
Non-secure instruction.
See Secure Instruction Fetch (SIF) permission faults on page 3-51 for more information.
This bit resets to 0.
Note
If a transaction is associated with a particular Translation context bank, faults are recorded in
SMMU_CBn_FSR. Otherwise they are recorded in SMMU_SGFSR.
GEFRO, bit[25]
Global External Fault Report Override. The possible values of this bit are:
0
Permit SMMU_GFSR to report external faults.
1
SMMU_SGFSR reports all external faults.
If SMMU_SCR1.GEFRO==1, all external aborts that would have been recorded in SMMU_GFSR
are instead recorded in SMMU_SGFSR. See SMMU_sGFSR, Global Fault Status Register on
page 10-131.
This bit resets to an UNKNOWN value.
GASRAE, bit[24]
Global Address Space Restricted Access Enable. The possible values of this bit are:
0
The Global address space has default access permission, permitting Secure and
Non-secure configuration memory accesses.
The Global address space is only accessible by Secure configuration memory accesses.
Stage 2 format context banks are only accessible by Secure configuration accesses.
Whether SMMU_SCR1.GASRAE==1 affects the IMPLEMENTATION DEFINED address
space is IMPLEMENTATION DEFINED.
10-146
UNPREDICTABLE
10-147
10-148
Usage constraints
During configuration, the Stream Match Register table can have multiple entries that match
the same Stream Identifier value, possibly resulting in UNPREDICTABLE behavior. See
StreamID matching on page 2-25 for more information about multiple matches. To prevent
multiple matches, software must ensure that no transactions that might match the StreamID
are received, by:
ensuring that no outstanding transactions from these client devices are in progress.
As an extra precaution, software can first disable all affected SMMU_SMRn table entries
by setting the SMMU_SMRn.VALID bit to 1, then reprogramming the entries as
appropriate.
An implementation must provide the same number of ID and MASK bits for every
implemented Stream Match Register.
Configurations
Attributes
32-bit RW registers with access attributes that depend on the configuration of the
implementation. See the configuration details for information.
This register resets to an UNKNOWN value.
16 15 14
MASK
0
ID
VALID
VALID, bit[31]
The possible values of this bit are:
0
Entry is included in the Stream mapping table search.
1
Entry is not included in the Stream mapping table search.
MASK, bits[30:16]
Masking of StreamID bits irrelevant to the matching process:
Reserved.
Invalidates all unlocked Secure entries in the TLB. See Memory-mapped TLB maintenance
operations on page 5-75 for more information.
10-149
Usage constraints
This command must apply to all unlocked Hyp-tagged entries. Optionally, it can apply to
other individual unlocked entries, regardless of their tagging.
Configurations
In an implementation that does not include the Security Extensions, this command is
reserved.
Attributes
A 32-bit WO command.
Invalidates all Hyp tagged entries in the TLB. See Memory-mapped TLB maintenance
operations on page 5-75 for more information.
Usage constraints
This command must apply to all unlocked Hyp-tagged entries. Optionally, it can apply to
other individual unlocked entries, regardless of their tagging.
Configurations
None.
Attributes
A 32-bit WO command.
Invalidates all Non-secure non-Hyp tagged entries in the TLB. See Memory-mapped TLB
maintenance operations on page 5-75 for more information.
Usage constraints
This command must apply to all unlocked Non-secure non-Hyp tagged entries. Optionally,
it can apply to other individual unlocked entries, regardless of their tagging.
Configurations
None.
Attributes
A 32-bit WO command.
Invalidates all Hyp TLB entries that match the specified virtual address. See
Memory-mapped TLB maintenance operations on page 5-75 for more information.
Usage constraints
This command must operate on all unlocked Hyp-tagged TLB entries associated with the
specified virtual address. Optionally, it can apply to other individual unlocked entries in a
TLB, regardless of their tagging.
Configurations
None.
Attributes
A 32-bit WO command.
12 11
Address
0
Reserved
10-150
Bits[11:0]
Reserved.
Invalidates all Non-secure non-Hyp TLB entries having the specified VMID. See
Memory-mapped TLB maintenance operations on page 5-75 for more information.
Usage constraints
This command must operate on all unlocked Non-secure non-Hyp TLB entries associated
with the specified VMID. Optionally, it can apply to other individual unlocked entries in a
TLB, regardless of their tagging.
This command does not affect Secure TLB entries.
Note
In implementations that support a VMID for Secure context banks, TLB entries created by
Secure banks are not tagged with the VMID. This command does not affect such entries.
See Interaction with the Security Extensions on page 2-32 for more information.
Configurations
None.
Attributes
A 32-bit WO command.
8 7
Reserved
Bits[31:8]
0
VMID
Reserved.
VMID, bits[7:0] The Virtual Machine Identifier to use in the Invalidate operation.
10-151
10-152
Chapter 11
System MMU Global Register Space 1
This chapter defines System MMU Global Register Space 1. It contains the following sections:
11-153
11.1
11-154
Offset
Name
Type
Description
0x00000
SMMU_CBAR0
RW
0x00004
SMMU_CBAR1
0x00008-0x001FC
SMMU_CBAR2 to
SMMU_CBAR127
0x00200-0x003FC
Reserved
0x00400
SMMU_CBFRSYNRA0
RW
0x00404
SMMU_CBFRSYNRA1
SMMU_CBFRSYNRAn, Context
Bank Fault Restricted Syndrome
Register A on page 11-161
0x00408-0x005FC
SMMU_CBFRSYNRA2 to
SMMU_CBFRSYNRA127
0x00600-(PAGESIZE 0x4)
Reserved
11.2
11.2.1
Usage constraints
Configurations
The format of this register depends on the state of its TYPE field. See:
Attributes
32-bit RW registers.
24 23
IRPTNDX[7:0]
20 19 18 17 16 15
Reserved
SBZ TYPE
8 7
Reserved
0
VMID
IRPTNDX[7:0], bits[31:24]
Interrupt Index. The Context interrupt number to assert in the event of an interrupt raising a fault in
the associated Translation context bank.
SMMU_IDR0.NUMIRPT specifies the range of values that software can configure this field in.
It is IMPLEMENTATION DEFINED whether this field is fully implemented with writable storage. A
portion of this field is permitted to behave as RAZ/WI because the System MMU implementation
might not provide sufficient interrupts for some of the upper bits of SMMU_CBARn.IRPTNDX to
be relevant. The implemented range of this field is the same for all SMMU_CBARn registers in an
implementation.
Bits[23:20]
Reserved.
11-155
SBZ, bits[19:18]
Should-Be-Zero.
TYPE, bits[17:16]
Register Type, indicates the format of the remaining fields in this register. The encoding of this field
is:
0b00
Stage 2 context.
0b01
Stage 1 context with stage 2 bypass.
0b10
Stage 1 context with stage 2 fault.
0b11
Stage 1 context with stage 2 context, that is, nested translation.
Bits[15:8]
Reserved.
VMID, bits[7:0]
The Virtual Machine Identifier to be associated with the Translation context bank.
31
IRPTNDX[7:0]
BSU TYPE
WACFG
RACFG
12 11 10 9 8 7
MemAttr
0
VMID
FB BPSHCFG
HYPC
IRPTNDX[7:0], bits[31:24]
Interrupt Index. The Context interrupt number to assert in the event of an interrupt raising a fault in
the associated Translation context bank.
SMMU_IDR0.NUMIRPT specifies the range of values that software can configure this field in.
It is IMPLEMENTATION DEFINED whether this field is fully implemented with writable storage. A
portion of this field is permitted to behave as RAZ/WI. This is permitted because the
implementation might not provide sufficient interrupts for some of the upper bits of
SMMU_CBARn.IRPTNDX to be relevant. The implemented range of this field is the same for all
SMMU_CBARn registers in an implementation.
WACFG, bits[23:22]
Write-Allocate Configuration, allocation hint for write accesses. The encoding of this field is:
0b00
Default allocation attributes.
0b01
Reserved.
0b10
Write-Allocate.
0b11
No Write-Allocate.
RACFG, bits[21:20]
Read-Allocate Configuration, allocation hint for read accesses. The encoding of this field is:
0b00
Default allocation attributes.
0b01
Reserved.
0b10
Read-Allocate.
0b11
No Read-Allocate.
BSU, bits[19:18]
Barrier Shareability Upgrade.
11-156
This field upgrades the required shareability domain of barriers issued by client devices mapped to
this Stream mapping register group by setting the minimum shareability domain that is applied to
any barrier.
The encoding of this field is:
0b00
No effect.
0b01
Inner Shareable.
0b10
Outer Shareable.
0b11
Full system.
Upgrade of the barrier shareability domain might not be supported in all system topologies. In an
implementation that does not include this upgrade behavior, BSU is RAZ/SBZP.
TYPE, bits[17:16]
Register Type. Indicates the format of the remaining fields in this register. The encoding of this field
is:
0b00
Stage 2 context.
0b01
Stage 1 context with stage 2 bypass.
0b10
Stage 1 context with stage 2 fault.
0b11
Stage 1 context with stage 2 nested.
MemAttr, bits[15:12]
Memory Attributes. See Memory attribute, MemAttr on page 10-113.
This field is combined with the shared attributes of the previous translation stage. See Table 11-2 on
page 11-158.
FB, bit[11]
Force Broadcast.
Force Broadcast of TLB, branch predictor and instruction cache maintenance operations.
This field affects client TLB maintenance, BPIALL and ICIALLU operations. If this field is 1, the
affected operation is modified to the equivalent broadcast variant in the Inner Shareable domain.
The possible values of this bit are:
0
Process the affected operations as presented.
1
Upgrade the affected operations to be broadcast in the Inner Shareable domain.
HYPC, bit[10] Hypervisor Context. The possible values of this bit are:
0
Non-hypervisor context. Use VMID and ASID for TLB tagging.
1
Hypervisor context. Do not use VMID and ASID for TLB tagging.
In an interaction with the Security Extensions, the following restrictions apply to Secure software:
If SMMU_SCR1.GASRAE==0, Secure software must not set HYPC to 1 for any Secure
Translation context bank.
If SMMU_SCR1.GASRAE==1, Secure software must not set HYPC to 1 for any Non-secure
Translation context bank.
11-157
This field is combined with the shared attributes of the previous translation stage, as shown in
Table 11-2.
Table 11-2 Shared attribute combination results
Stage 1 shareability
Stage 2 shareability
Resulting shareability
Outer Shareable
Outer Shareable
Inner Shareable
Outer Shareable
Outer Shareable
Inner Shareable
Inner Shareable
Inner Shareable
Inner Shareable
Non-Shareable
Inner Shareable
Non-Shareable
Outer Shareable
Outer Shareable
Non-Shareable
Outer Shareable
Outer Shareable
Non-Shareable
Inner Shareable
Inner Shareable
Non-Shareable
Non-Shareable
Non-Shareable
VMID, bits[7:0]
The Virtual Machine Identifier to be associated with the Translation context bank.
If an implementation that includes the Security Extensions does not support a VMID for Secure
translation regimes, any Secure VMID field is ignored. See Interaction with the Security Extensions
on page 2-32 for more information.
24 23
IRPTNDX[7:0]
20 19 18 17 16 15
Reserved
SBZ TYPE
8 7
Reserved
0
VMID
IRPTNDX[7:0], bits[31:24]
Interrupt Index. The Context interrupt number to assert in the event of an interrupt raising a fault in
the associated Translation context bank.
SMMU_IDR0.NUMIRPT specifies the range of values that software can configure this field in.
It is IMPLEMENTATION DEFINED whether this field is fully implemented with writable storage. A
portion of this field is permitted to behave as RAZ/WI, because the implementation might not
provide sufficient interrupts for some of the upper bits of SMMU_CBARn.IRPTNDX to be
relevant. The implemented range of this field is the same for all SMMU_CBARn registers in an
implementation.
Bits[23:20]
Reserved.
SBZ, bits[19:18]
Should-Be-Zero.
11-158
TYPE, bits[17:16]
Register Type. Indicates the format of the remaining fields in this register. The encoding of this field
is:
0b00
Stage 2 context.
0b01
Stage 1 context with stage 2 bypass.
0b10
Stage 1 context with stage 2 fault.
0b11
Stage 1 context with stage 2 nested context.
Bits[15:8]
Reserved.
VMID, bits[7:0]
The Virtual Machine Identifier to be associated with the Translation context bank.
24 23
IRPTNDX[7:0]
20 19 18 17 16 15
Reserved
SBZ TYPE
8 7
CBNDX
0
VMID
IRPTNDX[7:0], bits[31:24]
Interrupt Index. The Context interrupt number to assert in the event of an interrupt raising a fault in
the associated Translation context bank.
SMMU_IDR0.NUMIRPT specifies the range of values that software must configure this field in.
It is IMPLEMENTATION DEFINED whether this field is fully implemented with writable storage. A
portion of this field is permitted to behave as RAZ/WI, because the implementation might not
provide sufficient interrupts for some of the upper bits of SMMU_CBARn.IRPTNDX to be
relevant. The implemented range of this field is the same for all SMMU_CBARn registers in an
implementation.
Bits[23:20]
Reserved.
11-159
VMID, bits[7:0]
The Virtual Machine Identifier to be associated with the Translation context bank.
11-160
11.2.2
Gives fault syndrome information about the access that caused an exception in the
associated Translation context bank.
Usage constraints
The value of this register is UNKNOWN if the recorded fault was an address translation fault,
that is, if the SMMU_CBn_FSYNR0.ATOF bit is set to 1.
Configurations
Attributes
32-bit RW registers.
16 15 14
SSD_Index
Reserved
Bit[31]
0
StreamID
Reserved
Reserved.
SSD_Index, bits[30:16]
The SSD_Index of the transaction that caused the fault.
The number of SSD_Index bits is IMPLEMENTATION DEFINED. Unimplemented bits behave as
RAZ/WI.
This field is only accessible to configuration accesses by Secure software. Non-secure configuration
accesses treat this field as RAZ/WI.
Bit[15]
Reserved.
StreamID, bits[14:0]
The StreamID of the transaction that caused the fault.
The number of StreamID bits is IMPLEMENTATION DEFINED. Unimplemented bits behave as
RAZ/WI.
11-161
11-162
Chapter 12
System MMU IMPLEMENTATION DEFINED Address Space
This chapter specifies the System MMU IMPLEMENTATION DEFINED address space. It contains the following section:
About the System MMU implementation defined address space on page 12-164.
12-163
12.1
12-164
Offset
Name
Description
0x00000-(PAGESIZE 0x4)
IMPLEMENTATION DEFINED
Chapter 13
System MMU Performance Monitors Extension
Register Map
This chapter describes the recommended memory-mapped and external debug interface to the Performance
Monitors Extension. It contains the following sections:
13-165
13.1
13-166
Offset
Name
Type
Description
0x00000+m
PMEVCNTRn
RW
(0x00000+m)-0x003FC
0x00400+m
PMEVTYPERn
RW
(0x00400+m)-0x007FC
0x00800+m
PMCGCRn
RWa
(0x00800+m)-0x009FC
0x00A00+m
PMCGSMRn
RW
(0x00A00+m) -0x00BFC
0x00C00-0x00C1C
PMCNTENSETx
RW
0x00C20-0x00C3C
PMCNTENCLRx
RW
0x00C40-0x00C5C
PMINTENSETx
RW
0x00C60-0x00C7C
PMINTENCLRx
RW
0x00C80-0x00C9C
PMOVSCLRx
RW
0x00CA0-0x00CBC
Reserved.
0x00CC0-0x00CDC
PMOVSSETx
RW
0x00CE0-0x00D7C
Reserved.
0x00D80-0x00DFC
IMPLEMENTATION DEFINED.
0x00E00
PMCFGR
ROa
0x00E04
PMCR
RW
0x00E08
Reserved.
0x00E0C-0x00E1C
Reserved.
Table 13-1 System MMU Performance Monitors Extension register map (continued)
Offset
Name
Type
Description
0x00E20
PMCEID0
RO
0x00E24
PMCEID1
0x00E28-0x00E7C
Reserved.
0x00E80-0x00EFC
IMPLEMENTATION
DEFINED
0x00F00
0x00F04-0x00FB4
Reserved.
0x00FB8
PMAUTHSTATUS
RO
0x00FBC-0x00FC8
Reserved.
0x00FCC
PMDEVTYPE
RO
0x00FD0-0x00FFC
PMPIDy, PMCIDz
RO
0x01000-
Reserved
(PAGESIZE0x4)
13-167
13.2
the number of implemented instances of the specified register is (PMCFGR.N DIV 32) +1.
PMCNTENSETx
PMCNTENCLRx
PMINTENSETx
PMINTENCLRx
PMOVSCLRx
PMOVSSETx.
13-168
13.2.1
Indicates the implemented debug features and provides the current values of the
configuration inputs that determine the debug permissions.
Usage constraints
Configurations
Attributes
A 32-bit RO register.
In an implementation that includes the Security Extensions, the PMAUTHSTATUS bit assignments are:
31
8 7 6 5 4 3 2 1 0
Reserved
0 0 1
0 0
SNI
SNE
SI
SE
NSNI
NSNE
NSI
NSE
Bits[31:8]
Reserved.
SNI, bit[7]
Secure non-invasive debug features implemented. This bit is RAO, Secure non-invasive debug
features are implemented.
SNE, bit[6]
Secure non-invasive debug enabled. This bit indicates whether counting of Secure transactions is
permitted. For the recommended external debug interface, this bit is the logical result of
(DBGEN OR NIDEN) AND (SPIDEN OR SPNIDEN).
SI, bit[5]
Secure invasive debug features implemented. This bit is RAZ, Secure invasive debug features are
not implemented.
SE, bit[4]
NSNI, bit[3]
Non-secure non-invasive debug features implemented. This bit is RAO, Non-secure non-invasive
debug features are implemented.
NSNE, bit[2] Non-secure non-invasive debug enabled. For the recommended external debug interface, this bit
indicates the logical result of DBGEN OR NIDEN.
NSI, bit[1]
Non-secure invasive debug features implemented. This bit is RAZ, Non-secure invasive debug
features are not implemented.
NSE, bit[0]
13-169
In an implementation that does not include the Security Extensions, the PMAUTHSTATUS bit assignments are:
31
8 7 6 5 4 3 2 1 0
Reserved
0 0 0 0 0 0
SNI
SNE
SI
SE
NSNI
NSNE
NSI
NSE
Bits[31:8]
Reserved.
SNI, bit[7]
Secure non-invasive debug features implemented. This bit is RAO, Secure non-invasive debug
features are implemented.
SNE, bit[6]
Secure non-invasive debug enabled. This bit indicates whether non-invasive debug is permitted in
Secure PL1 modes. For the recommended external debug interface, this bit is the logical result of
DBGEN OR NIDEN.
SI, bit[5]
Secure invasive debug features implemented. This bit is RAZ, Secure invasive debug features are
not implemented.
SE, bit[4]
Secure invasive debug enabled. This bit is RAZ. It indicates whether invasive halting debug is
permitted in Secure PL1 modes.
NSNI, bit[3]
Non-secure non-invasive debug features implemented. This bit is RAZ, Non-secure non-invasive
debug features are not implemented.
NSNE, bit[2] Non-secure non-invasive debug enabled. This bit is RAZ, Non-secure non-invasive debug is not
enabled.
13-170
NSI, bit[1]
Non-secure invasive debug features implemented. This bit is RAZ, Non-secure invasive debug
features are not implemented.
NSE, bit[0]
Non-secure invasive debug enabled. This bit is RAZ, Non-secure invasive debug is not enabled.
13.2.2
Usage constraints
Configurations
See About the System MMU Performance Monitors Extension on page 7-80 for information
about when this register is configured.
Attributes
A 32-bit RO register.
19 18 17 16 15
Reserved
Reserved
Event 0x12
Event 0x11
Event 0x10
Bits[31:19]
11 10 9 8 7
Event 0x0A
Event 0x09
Event 0x08
2 1 0
Reserved
Event 0x01
Event 0x00
Reserved.
Reserved.
Reserved.
13-171
13.2.3
13.2.4
If this extension is supported, all of the bits in this 32-bit read-only register are reserved and are UNK.
If this extension is not supported, the register map corresponding to the Performance Monitors registers is
UNK/SBZP.
Usage constraints
Configurations
Attributes
A 32-bit RO register.
24 23
NCG
20 19 18 17 16 15 14 13
Reserved (0)
(0) (0)
8 7
SIZE
0
N
EX CC
UEN
Reserved CCD
Reserved.
UEN, bit[19] Unprivileged-mode Enable, reads as the value 0 indicating that this feature is not supported.
Bits[18:17]
Reserved.
EX, bit[16]
CCD, bit[15] Cycle Counter pre-scale, reads as the value 0 indicating that there is no cycle counter pre-scale.
CC, bit[14]
Cycle Counter, reads as the value 0 indicating that a dedicated cycle counter is not implemented.
SIZE, bits[13:8]
Counter size, reads as the value 0b011111 indicating 32-bit event counters.
13-172
N, bits[7:0]
Indicates the number of implemented event counters, up to a maximum of 256 counters. The number
of counters implemented is N+1.
Note
In the CPU PMU, the number of counters implemented is N. This is because the CPU PMU
implements an extra counter, PMCCNTR, which is not defined in the System MMU architecture.
13.2.5
Usage constraints
Configurations
Attributes
28 27
Reserved
24 23 22
CGNC
16 15
SIDG
Reserved
Bits[31:28]
13 12 11 10 9 8 7
0
NDX
Reserved
E
TCEFCFG
X CBAEN
Reserved.
CGNC, bits[27:24]
Counter Group Number of Counters, is the number of counters in this Counter group, in the range
1-15, so that a value of 0b0001 == 1 counter.
This field is RO/WI.
Bit[23]
Reserved.
SIDG, bits[22:16]
StreamID Group, indicates the StreamID group that this Counter group is affiliated with.
This field is RO/WI.
Bits[15:13]
Reserved.
X, bit[12]
Export, corresponds to the Performance Monitors Event Export field, SMMU_CBn_PMCR.X, for
this Counter group.
E, bit[11]
CBAEN, bit[10]
Context Bank Assignment Enable.
The possible values of this bit are:
0
13-173
TCEFCFG, bits[9:8]
Translation Context Event Filtering Configuration.
The possible values of this bit are:
0b00
0b01
0b10
0b11
Reserved.
13.2.6
Usage constraints
Configurations
Attributes
16 15 14
MASK
Reserved
Bit[31]
0
ID
Reserved
Reserved.
MASK, bits[30:16]
if MASK[i] == 1, ID[i] is ignored and SBZ.
if MASK[i] == 0, ID[i] is valid for matching.
The number of MASK bits actually present is IMPLEMENTATION DEFINED. Unimplemented bits are
RAZ/WI.
Bit[15]
Reserved.
13.2.7
Disables any implemented event counter, PMNi, for i in the range (x 32) to (x 32) + 31.
Reading this register shows which counters are enabled.
13-174
Usage constraints
Configurations
Attributes
31
0
Event counter disable for event counter i, i = (x * 32) + j
RAZ/WI
Note
See SMMU Performance Monitors Extension register descriptions on page 13-168 for the definitions of m, x and j.
Bits[31:m]
RAZ/WI.
Meaning on read
Action on write
Note
PMCR.E can override the settings in this register and disable all counters. PMCNTENCLRx retains its value when
PMCR.E is 0, even though its settings are ignored.
13.2.8
Purpose
Configurations
Attributes
31
0
Event counter enable bits, Pi, for event counter i, i = (x * 32) + j
RAZ/WI
Note
See SMMU Performance Monitors Extension register descriptions on page 13-168 for the definitions of m, x and j.
Bits[31:m]
RAZ/WI.
13-175
Table B4-5 shows the behavior of this bit on reads and writes.
Table 13-3 Read and write values for the PMCNTENSETx.Pi bits
13.2.9
Px value
Meaning on read
Action on write
Usage constraints
Configurations
Attributes
24 23
IMP
5 4 3 2 1 0
Reserved
P E
Reserved
IMP, bits[31:24]
allocated by ARM
the value 0.
This RO field is IMPLEMENTATION DEFINED.
Bits[23:5]
Reserved.
X, bit[4]
Bits[3:2]
Reserved.
P, bit[1]
Event counter reset. This bit is WO. The effects of writing to this bit are:
0
No action.
1
Reset all event counters to zero.
See SMMU_CBn_PMCR banking on page 7-86 for information about PMCR banking.
E, bit[0]
13-176
Provides the CoreSight device type information for the Performance Monitors, and
indicates the type of debug component.
Usage constraints
Configurations
Attributes
A 32-bit RO register.
8 7
Reserved
4 3
T
0
C
Bits[31:0]
Reserved.
T, bits[7:4]
Sub-type, a fixed value of 0x5, which indicates association with a memory management unit
conforming to the ARM System MMU Architecture.
C, bits[3:0]
Class, a fixed value of 0x6, which indicates a Performance Monitor device type.
Usage constraints
Configurations
Attributes
0
PMNn
PMNx, bits[31:0]
Note
PMEVCNTRn can be written to by software even when the counter is disabled. This is true regardless of why the
counter is disabled, which can be any of:
because PMCR.E is 0.
Purpose
Usage constraints
Configurations
13-177
Attributes
8 7
P U
Reserved
0
EVENT
NSP
NSU
P, bit[31]
Privileged transactions filtering bit. Controls the counting of Secure privileged transactions.
The possible values of this bit are:
0
Count events relating to Secure privileged transactions.
1
Do not count events relating to Secure privileged transactions.
U, bit[30]
Unprivileged transactions filtering bit. Controls the counting of Secure unprivileged transactions.
The possible values of this bit are:
0
Count events relating to Secure unprivileged transactions.
1
Do not count events relating to Secure unprivileged transactions.
NSP, bit[29]
Non-secure Privileged transactions filtering bit. Controls the counting of Non-secure privileged
transactions.
The possible values of this bit are:
P==NSP Count events relating to Non-secure privileged transactions.
P!=NSP Do not count events relating to Non-secure privileged transactions.
NSU, bit[28] Non-secure unprivileged transactions filtering bit. Controls counting of Non-secure unprivileged
transactions.
The possible values of this bit are:
U==NSU Count events relating to Non-secure unprivileged transactions.
U!=NSU Do not count events relating to Non-secure unprivileged transactions.
Bits[27:8]
Reserved.
EVENT, bits[7:0]
Event type. See Event classes on page 7-82.
Disables the generation of interrupt requests on overflows from each implemented event
counter, PMNi, for i in the range (x 32) to (x 32) + 31.
Reading the register shows which overflow interrupt requests are enabled.
Usage constraints
Configurations
Attributes
31
RAZ/WI
13-178
Note
See SMMU Performance Monitors Extension register descriptions on page 13-168 for the definitions of m, x and j.
Bits[31:m]
RAZ/WI.
Meaning on read
Action on write
Enables the generation of interrupt requests on overflows from each implemented event
counter, PMNi, for i in the range (x 32) to (x 32) + 31.
Reading PMINTENSETx shows which overflow interrupt requests are enabled.
Usage constraints
Configurations
Attributes
31
RAZ/WI
Note
See SMMU Performance Monitors Extension register descriptions on page 13-168 for the definitions of m, x and j.
Bits[31:m]
RAZ/WI.
Meaning on read
Action on write
When an interrupt is signaled, software can remove it by writing a 1 to the corresponding overflow bit in
PMOVSCLRx.
13-179
Note
ARM expects that the interrupt request that can be generated on a counter overflow is exported from the processor,
meaning it can be factored into a system interrupt controller if applicable. This means that normally the system has
more levels of control of the interrupt generated.
Clears the state of the overflow bit for each implemented event counter, PMNi, for i in the
range (x 32) to (x 32) + 31.
Reading the register shows the current overflow status.
Usage constraints
Configurations
Attributes
31
0
Overflow status clear for event counter Pi, i = (x * 32) + j
Reserved
Note
See SMMU Performance Monitors Extension register descriptions on page 13-168 for the definitions of m, x and j.
Bits[31:m]
RAZ/WI.
Meaning on read
Action on write
Set bit to 0.
Sets the state of the overflow bit for each of the implemented event counters, PMNi, for i in
the range (x 32) to (x 32) + 31.
Reading the register shows the current overflow status.
13-180
Usage constraints
Configurations
See About the System MMU Performance Monitors Extension on page 7-80 for information
about when this register is configured.
Attributes
31
0
Overflow status set for event counter Pi, i = (x * 32) + j
Reserved
Note
See SMMU Performance Monitors Extension register descriptions on page 13-168 for the definitions of m, x and j.
Bits[31:m]
RAZ/WI.
Meaning on read
Action on write
Set bit to 1.
Note
The part number defined by PMPID1[3:0] and PMPID0[7:0] must be a different part number to that defined by
DBGPID1[3:0] and DBGPID0[7:0].
13-181
13-182
Chapter 14
The Security State Determination Address Space
This chapter gives an overview of the security state determination address space. It contains the following section:
14-183
14.1
Name
Description
0x00000
SMMU_SSDR0
0x00004
SMMU_SSDR1
0x00008 - 0x00FFC
SMMU_SSDR1023 SMMU_SSDR2
Reserved
If the security state determination register space is implemented, the behavior of each SMMU_SSDRn bit is:
// SMMU_SSDRn selected using SSD_Index<15:5>
if (SMMU_SSDRn[SSD_Index<4:0>] == 1) {
// Transaction is Non-secure
} else {
// Transaction is Secure
}
14-184
Chapter 15
Stage 1 Translation Context Bank Format
This chapter specifies the format of a Stage 1 Translation context bank. It contains the following sections:
15-185
15.1
Offset
Name
Type
Description
0x00000
SMMU_CBn_SCTLR
RW
0x00004
SMMU_CBn_ACTLR
RW
0x00008
SMMU_CBn_RESUME
WO
0x0000C-0x0001C
Reserved
0x00020
SMMU_CBn_TTBR0[31:0]
RWa
0x00024
SMMU_CBn_TTBR0[63:32]
RWa
0x00028
SMMU_CBn_TTBR1[31:0]
RWa
0x0002C
SMMU_CBn_TTBR1[63:32]
RWa
0x00030
SMMU_CBn_TTBCR
RW
0x00034
SMMU_CBn_CONTEXTIDR
RW
0x00038
SMMU_CBn_PRRR or
SMMU_CBn_MAIR0
RW
0x0003C
SMMU_CBn_NMRR or
SMMU_CBn_MAIR1
RW
0x00040-0x00044
Reserved
0x00048-0x0004C
Reserved
0x00050
SMMU_CBn_PAR[31:0]
RW
0x00054
SMMU_CBn_PAR[63:32]
0x00058
SMMU_CBn_FSR
RW
0x0005C
SMMU_CBn_FSRRESTORE
WO
15-186
Name
Type
Description
0x00060
SMMU_CBn_FAR[31:0]
RW
0x00064
SMMU_CBn_FAR[63:32]
0x00068
SMMU_CBn_FSYNR0
RW
0x0006C
SMMU_CBn_FSYNR1
0x00070-0x005FC
Reserved
0x00600
SMMU_CBn_TLBIVA[31:0]
WO
0x00604
Reserved
0x00608
SMMU_CBn_TLBIVAA[31:0]
WO
0x0060C
Reserved
0x00610
SMMU_CBn_TLBIASID
WO
0x00614
Reserved
0x00618
SMMU_CBn_TLBIALL
WO
0x0061C
Reserved
0x00620
SMMU_CBn_TLBIVAL[31:0]
WO
0x00624
Reserved
0x00628
SMMU_CBn_TLBIVAAL[31:0]
WO
0x0062C-0x007EC
Reserved
0x007F0
SMMU_CBn_TLBSYNC
WO
0x007F4
SMMU_CBn_TLBSTATUS
RO
0x007F8-0x007FC
Reserved
0x00800
SMMU_CBn_ATS1PR[31:0]
WO
0x00804
Reserved
0x00808
SMMU_CBn_ATS1PW[31:0]
WO
0x0080C
Reserved
0x00810
SMMU_CBn_ATS1UR[31:0]
WO
0x00814
Reserved
0x00818
SMMU_CBn_ATS1UW[31:0]
WO
15-187
Name
Type
Description
0x0081C-0x008EC
Reserved
0x008F0
SMMU_CBn_ATSR
RO
0x008F4-0x00CFC
Reserved
0x00D00-0x00DFC
IMPLEMENTATION DEFINED
RW
0x00E00-0x00E38
SMMU_CBn_PMEVCNTRm
RW
0x00E3C-0x00E7C
Reserved
0x00E80-0x00EB8
SMMU_CBn_PMEVTYPERm
RW
0x00EBC-0x00EFC
Reserved
0x00F00
SMMU_CBn_PMCFGR
RO
0x00F04
SMMU_CBn_PMCR
RW
0x00F08-0x00F1C
Reserved
0x00F20
SMMU_CBn_PMCEID0
RO
0x00F24
SMMU_CBn_PMCEID1
RO
0x00F28-0x00F3C
Reserved
0x00F40
SMMU_CBn_PMCNTENSET
RW
0x00F44
SMMU_CBn_PMCNTENCLR
RW
0x00F48
SMMU_CBn_PMINTENSET
RW
0x00F4C
SMMU_CBn_PMINTENCLR
RW
0x00F50
SMMU_CBn_PMOVSCLR
RW
0x00F54
Reserved
0x00F58
SMMU_CBn_PMOVSSET
0x00F5C-0x00FB4
Reserved
0x00FB8
SMMU_CBn_PMAUTHSTATUS
RO
15-188
Name
Type
Description
0x00FBC-0x00FCC
Reserved
0x00FD0-0x00FFC
IMPLEMENTATION DEFINED
0x01000 -
Reserved
(PAGESIZE 0x4)
15-189
15.2
Reset values
In each System MMU Stage 1 Translation context bank, the value of each register field is UNPREDICTABLE after a
system reset, with the exceptions shown in Table 15-2.
Table 15-2 Predictable post-reset values
15-190
Field
Reset value
Notes
SMMU_CBn_FSR.SS
SMMU_CBn_SCTLR.CFIE
SMMU_CBn_SCTLR.CFRE
15.3
Meaning
0b0000
0b00RW
0b0100
0b01RW
0b10RW
0b11RW
The transient variants provide a hint that the data being accessed has a transient access property. The memory system
might adjust its handling of the data accordingly.
All other values are UNPREDICTABLE.
Table 15-4 shows the encoding of each MAIR[3:0] field, where:
Bits[3:0]
0b0000
Strongly-ordered
UNPREDICTABLE.
0b00RW
UNPREDICTABLE
0b0100
Device
15-191
0b01RW
UNPREDICTABLE
0b10RW
UNPREDICTABLE
0b11RW
UNPREDICTABLE
15-192
15.4
15-193
15.5
15.5.1
Usage constraints
Configurations
Attributes
15.5.2
Usage constraints
Configurations
Attributes
12 11
Addr
0
Reserved
Addr, bits[31:12]
Addr, the input address.
Bits[11:0]
15.5.3
Reserved.
15-194
Purpose
Translates the argument-supplied input address and writes the result to SMMU_CBn_PAR.
Usage constraints
Configurations
Attributes
12 11
Addr
0
Reserved
Addr, bits[31:12]
Addr, the input address.
Bits[11:0]
15.5.4
Reserved.
Translates the argument-supplied input address and writes the result to SMMU_CBn_PAR.
Usage constraints
Configurations
Attributes
12 11
Addr
0
Reserved
Addr, bits[31:12]
Addr, the input address.
Bits[11:0]
15.5.5
Reserved.
Translates the argument-supplied input address and writes the result to SMMU_CBn_PAR.
Usage constraints
Configurations
Attributes
12 11
Addr
0
Reserved
Reserved.
15-195
15.5.6
Provides status information about active address translation operations for a Translation
context bank.
Usage constraints
Configurations
Attributes
1 0
Reserved
ACTIVE
Bits[31:1]
Reserved.
ACTIVE, bit[0]
Address Translation Active. The possible values of this bit are:
0
Operation not active.
1
Operation active. SMMU_CBn_PAR contents are yet to be updated.
15.5.7
Identifies the current process identifier and the current address space identifier.
Usage constraints
Configurations
Attributes
8 7
PROCID
0
ASID
PROCID, bits[31:8]
Process Identifier.
ASID, bits[7:0]
Address Space Identifier.
15-196
0
PROCID
PROCID, bits[31:0]
Process Identifier.
15.5.8
Holds the input address of the memory access that caused a synchronous abort exception.
Usage constraints
Configurations
For a Stage 1 Translation context bank, the value of N is 32, equating to 4GB.
For a Stage 2 Translation context bank, the value of N depends on the size of the input
address implemented by the System MMU, and can be:
Attributes
40 39
36 35
32 31
0
FADDR
Reserved, RAZ
N
Reserved or FADDR
Bits[31:N]
Reserved.
FADDR, bits[N-1:0]
Fault Address, the input address of the faulting access.
15.5.9
Purpose
Usage constraints
Configurations
Attributes
A 32-bit RW clear register. A value of 1 written to any non-reserved bit clears that bit. A
value of 0 written to any of these bits leaves the bit unchanged.
15-197
7 6 5 4 3 2 1 0
Reserved
MULTI
SS
TLBLKF EF
AFF Reserved
TLBMCF PF
TF
MULTI, bit[31]
Multiple Faults, indicates that an additional context fault occurred while the value in
SMMU_CBn_FSR was nonzero.
SS, bit[30]
Stalled Status. The possible values of this read-only bit are:
0
The context is not stalled.
1
The context is stalled because of an exception in the context bank.
When the context is stalled, this bit is set to 1. A write to SMMU_CBn_RESUME is the only way
to reset this bit, and depending on the value written, the write either resumes or terminates the stalled
transaction.
Note
This bit is not affected by any SMMU_CBn_FSRRESTORE operation.
This bit resets to 0.
Bits[29:7]
Reserved.
TLBLKF, bit[6]
TLB Lock Fault. The possible values of this bit are:
0
There is no TLB lock fault.
1
A TLB lock fault has occurred.
TLBMCF, bit[5]
TLB Match Conflict Fault. The possible values of this bit are:
0
There is no TLB Match conflict fault.
1
A fault caused by multiple matches was detected in the TLB.
EF, bit[4]
External Fault. The possible values of this bit are:
0
There is no External fault.
1
An External fault has occurred.
PF, bit[3]
Permission Fault. The possible values of this bit are:
0
There is no Permission fault.
1
A fault caused by insufficient permission to complete a memory access has occurred.
AFF, bit[2]
Access Flag Fault. The possible values of this bit are:
0
There is no Access flag fault.
1
A fault caused by the access flag being set for the address being accessed has occurred.
TF, bit[1]
Translation Fault. The possible values of this bit are:
0
There is no Translation fault.
1
A Translation fault has occurred. The mapping for the address being accessed is invalid.
Bit[0]
Reserved.
15-198
Usage constraints
The bit corresponding to the SMMU_CBn_FSR.SS bit is ignored. The only way to reset the
SS bit is by writing to SMMU_CBn_RESUME.
Configurations
Attributes
A 32-bit WO register.
0
FSRRESTORE
Holds fault syndrome information about the memory access that caused a synchronous abort
exception.
Usage constraints
Configurations
Attributes
SMMU_CBn_FSYNR0
The SMMU_CBn_FSYNR0 bit assignments are:
31
24 23
Reserved
16 15
S1CBNDX
12 11 10 9 8 7 6 5 4 3 2 1 0
Reserved
PLVL
AFR
PTWF
Reserved
NSATTR
Reserved
IND
PNU
WNR
Reserved
Bits[31:24]
Reserved.
S1CBNDX[23:16]
Stage 1 Context Bank Index associated with the transaction that caused the fault.
For nested translation, this field contains the Stage 1 Translation context bank index for processing
the transaction.
For stage 2 only translation, this field is UNKNOWN.
This field is only present in a stage 2 format Translation context bank. In a stage 1 format
Translation context bank, it is UNK/SBPZ.
This field is only valid if SMMU_IDR0.NTS==1. In an implementation that does not include nested
translation, this field is UNK/WI.
15-199
Bits[15:12]
Reserved.
AFR, bit[11] Asynchronous Fault Recorded. The possible values of this bit are:
0
A fault was recorded synchronously.
1
A fault was recorded asynchronously.
PTWF, bit[10] A walk fault on a translation table access. The possible values of this bit are:
0
A walk fault did not occur.
1
A fault occurred during processing of a translation table walk.
Bit[9]
Reserved.
NSATTR, bit[8]
Non-secure Attribute. The possible values of this bit are:
0
The input transaction has a Secure attribute.
1
The input transaction has a Non-secure attribute.
In a Non-secure context bank, this bit is reserved. In a Secure context bank, this bit records the
attributes of the transaction after applying the SMMU_S2CRn.NSCFG bit transformation. See
Recording memory attributes on page 3-47 for more information.
Bit[7]
Reserved.
IND, bit[6]
PNU, bit[5]
WNR, bit[4]
Bits[3,2]
Reserved.
PLVL, bits[1:0]
Translation Table Level, the level in the translation table walk that the fault is associated with. The
encoding of this field is:
0b01
Level 1.
0b10
Level 2.
0b11
Level 3.
Faults and translation table level association
The translation table level a fault is associated with is:
15-200
For a fault associated with a translation table walk, the level of table walk being performed.
For a translation fault, the level of translation table that gave the fault. If a disabled translation table walk
causes the fault or if the size of the address presented is out of the range specified for matching with any base
address register, the fault is reported for level 1.
For an access fault, the level of translation table that gave the fault.
For a permission fault, including a fault caused by a hierarchical permission, the final level of translation
table used for that translation.
SMMU_CBn_FSYNR1
The 32-bit SMMU_CBn_FSYNR1 register bit assignments are IMPLEMENTATION DEFINED.
Provide a revised version of the TEX-Remap system to redirect the selection of memory
attributes from the translation table entries.
Usage constraints
Configurations
These registers are included when the Long-descriptor format translation tables are selected,
that is, when SMMU_CBn_TTBCR.EAE has the value 1.
When the legacy Short-descriptor translation table format is selected,
SMMU_CBn_MAIR1 and SMMU_CBn_MAIR0 are replaced by SMMU_CBn_PRRR and
SMMU_CBn_NMRR.
See Memory attribute indirection on page 15-191.
It is IMPLEMENTATION DEFINED whether the system implements stage 1 translation. See
SMMU_IDR0.S1TS for more information.
Attributes
24 23
Attr3
16 15
Attr2
8 7
Attr1
0
Attr0
24 23
Attr7
16 15
Attr6
8 7
Attr5
0
Attr4
Provides additional mapping controls for memory regions that are mapped as Normal
memory by their entry in SMMU_CBn_PRRR.
Usage constraints
Configurations
Attributes
15-201
IR7
IR6
IR5
IR4
IR3
IR2
IR1
IR0
Receives the physical address during any virtual to physical address translation.
Usage constraints
Configurations
Attributes
15-202
63
12 11 10 9 8 7 6
PA[31:12]
Reserved
(0)
4 3 2 1 0
(0)
NOS
NS
IMP
SH
Inner[2:0]
Outer[1:0]
SS
F
Bits[63:32]
Reserved.
PA[31:12], bits[31:12]
Bits[31:12] of the physical address.
Bit[11], 0
NOS, bit[10] Not Outer Shareable attribute, indicates whether the physical memory is Outer Shareable. The
possible values of this bit are:
0
Memory is Outer Shareable.
1
Memory is not Outer Shareable.
Whether an implementation distinguishes between Inner Shareable and Outer Shareable memory is
IMPLEMENTATION DEFINED. If an implementation does not make this distinction, this field is
UNK/SBZP.
NS, bit[9]
Non-Secure, the NS attribute for a translation table entry read from a Secure Translation context
bank.
This bit is UNKNOWN for a translation table entry read from a Non-secure Translation context bank.
IMP, bit[8]
SH, bit[7]
Inner[2:0], bits[6:4]
Inner memory attributes from the translation table entry.
The encoding of this field is:
Write-back, no Write-Allocate.
0b110
Write-Through.
0b101
Write-back, Write-Allocate.
0b011
Device.
0b001
Strongly-ordered.
0b000
Non-cacheable.
0b111
15-203
F(0), bit[0]
The page is not a supersection. PAR[31:12] contains PA[31:12], regardless of the page
size.
63
40 39
Reserved
MATTR
12 11 10 9 8 7 6
PA[39:12]
(1)
1 0
Reserved
(0)
IMP
NS
SH[1:0]
F
MATTR, bits[63:56]
Memory Attributes. See SMMU_CBn_MAIRm, Memory Attribute Indirection Registers on
page 15-201 for more information.
Bits[55:40]
Reserved.
PA[39:12], bits[39:12]
Bits 39:12 of the physical address.
Bit[11], 1
IMP, bit[10]
IMPLEMENTATION DEFINED.
NS, bit[9]
Non-Secure, the NS attribute for a translation table entry read from a Secure Translation context
bank.
This bit is UNKNOWN for a translation table entry read from a Non-secure Translation context bank.
SH[1:0], bits[8:7]
Shareability.
15-204
Bits[6:1]
Reserved.
F(0)
Fault format
If the translation fails to complete successfully, the bit assignments are, irrespective of translation format:
36 35 34 33 32 31 30
63
Reserved
7 6 5 4 3 2 1 0
Reserved
STAGE
Reserved
PLVL
ATOT
Bits[63:36]
(1)
TLBLKF
TLBMCF
EF
PF
AFF
TF
F
Reserved.
STAGE, bit[35]
Stage of translation that encountered the fault. The possible values of this bit are:
0
Stage 1.
1
Stage 2.
Bit[34]
Reserved.
PLVL, bits[33:32]
Page level, the level of translation table walk that encountered the fault. The encoding of this field is:
Level 1.
0b10
Level 2.
0b11
Level 3.
0b01
ATOT, bit[31] Address Translation Operation Terminated. The possible values of this bit are:
0
This fault does not apply.
1
The address translation operation was terminated. The requested operation could not be
completed.
Bits[30:7]
Reserved.
TLBLKF, bit[6]
TLB Lock Fault. The possible values of this bit are:
0
This fault does not apply.
1
TLB lock fault applies.
TLBMCF, bit[5]
TLB Match Conflict Fault. The possible values of this bit are:
0
This fault does not apply.
1
Fault caused by multiple matches detected in the TLB.
EF, bit[4]
PF, bit[3]
AFF, bit[2]
15-205
TF, bit[1]
F(1), bit[0]
NCG is UNK
15-206
For more information, see Chapter 7 System MMU Performance Monitors Extension.
the event counter registers of the group are arranged in sequence starting from the first
SMMU_CBn_PMEVCNTRm address offset
an SMMU_CBn_PMEVCNTRm register that corresponds to an offset greater than the number of event
counter registers in the Counter group is UNK/SBZP.
If no Counter group is revealed in the Translation context bank, all of the SMMU_CBn_PMEVCNTRm registers
are UNK/SBZP.
For more information, see Chapter 7 System MMU Performance Monitors Extension.
the event type registers of that group are arranged in sequence, starting from the first
SMMU_CBn_PMEVTYPERm address offset
an SMMU_CBn_PMEVTYPERm register that corresponds to an offset greater than the number of event type
registers in the Counter Group is UNK/SBZP.
If no Counter group is revealed in the Translation context bank, all of the SMMU_CBn_PMEVTYPERm registers
are WI.
15-207
For more information, see Chapter 7 System MMU Performance Monitors Extension.
15-208
Purpose
Usage constraints
Configurations
This register is included when the legacy Short-descriptor translation table format is
selected. That is, when SMMU_CBn_TTBCR.EAE is 0. When the Long-descriptor
translation table format is selected, is replaced by SMMU_CBn_MAIR0 replaces
SMMU_CBn_PRRR. See SMMU_CBn_MAIRm, Memory Attribute Indirection Registers
on page 15-201.
It is IMPLEMENTATION DEFINED whether the system implements stage 1 translation. See
SMMU_IDR0.S1TS for more information.
Attributes
20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Reserved
NOS0
NOS1
NOS2
NOS3
NOS4
NOS5
NOS6
NOS7
NOSm, bits[31:24]
Outer Shareable property mapping for memory attributes in n, if the region is mapped as Normal
memory that is Shareable where n is the value of the TEX[0] C and B bits in the translation table.
The possible value of each NOS bit is:
0
If the region is mapped as shareable Normal memory, the region is Outer Shareable.
1
The region is not Outer Shareable.
The meaning of the field where m = 6 is IMPLEMENTATION DEFINED and might differ from the
meaning given in this specification. This is because the meaning of the attribute combination
TEX[0] = 1, C = 1, B = 0 is IMPLEMENTATION DEFINED. If the implementation does not distinguish
between Inner Shareable and Outer Shareable, these bits are reserved and are RAZ/WI.
Bits[23:20]
Reserved.
NS1, bit[19]
Mapping of the S = 1 attribute for Normal memory. This bit gives the mapped Shareable attribute
for a region of memory that is mapped as Normal memory and has the S bit set to the value 1.
The possible values of this bit are:
0
The region is not shareable.
1
The region is shareable.
NS0, bit[18]
Mapping of S = 0 attribute for Normal memory. This bit gives the mapped Shareable attribute for a
region of memory that is mapped as Normal memory and has the S bit set to the value 0.
The possible values of this bit are:
0
The region is not shareable.
1
The region is shareable.
DS1, bit[17]
Mapping of S = 1 attribute for Device memory. This bit gives the mapped Shareable attribute for a
region of memory that is mapped as Device memory and has the S bit set to the value 0.
The possible values of this bit are:
0
The region is not shareable.
1
The region is shareable.
DS0, bit[16]
Mapping of S = 0 attribute for Device memory. This bit gives the mapped Shareable attribute for a
region of memory that is mapped as Device memory and has the S bit set to the value 0.
15-209
The meaning of the field with n = 6 is IMPLEMENTATION DEFINED and might differ from the meaning
given here. This is because the meaning of the attribute combination TEX[0] = 1, C = 1, B = 0 is
IMPLEMENTATION DEFINED.
Table 15-5 shows the mapping between the memory region attributes and the value n used in the
SMMU_CBn_PRRR.NOSn and SMMU_CBn_PRRR.TRn field descriptions.
Table 15-5 TEX[0] mappings
TEX[0]
n value
Note
Optionally, an implementation can retry a transaction from an earlier stage of the translation
process. For example, transactions could be subject to security state determination again.
See Handling a Context fault on page 3-53 for more information about writing to this
register.
15-210
Usage constraints
Configurations
Attributes
A 32-bit WO register.
1 0
Reserved
TnR
Bits[31:1]
Reserved.
TnR, bit[0]
Provides top-level control of the translation system for the related Translation context bank.
Usage constraints
Configurations
Attributes
16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
MemAttr
NSCFG
RACFG
Reserved WACFG SHCFG
Reserved
MTCFG
TRANSIENTCFG
Reserved
ASIDPNE
Reserved
UWXN
WXN
HUPCF
CFCFG
CFIE
CFRE
AFFD
AFE
TRE
Bits [31:30]
Reserved.
15-211
NSCFG, bits[29:28]
Non-Secure Configuration, controls the Non-secure attribute for any transaction where the
Translation context bank translation is disabled. That is, where SMMU_CBn_SCTLR.M==0.
SMMU_CBn_SCTLR.NSCFG only exists in a Translation context bank reserved by Secure
software. In a Non-secure Translation context bank, this field is UNK/SBZP.
The encoding of this field is:
Default Non-secure attribute.
0b01
Reserved.
0b10
Secure.
0b11
Non-secure.
0b00
WACFG, bits[27:26]
Write-Allocate Configuration, controls the allocation hint for a write transaction where the
Translation context bank translation is disabled. That is, where SMMU_CBn_SCTLR.M==0.
The encoding of this field is:
0b00
Default allocation attributes.
0b01
Reserved.
0b10
Write-Allocate.
0b11
No Write-Allocate.
RACFG, bits[25:24]
Read-Allocate Configuration, controls the allocation hint for a read transaction where the
Translation context bank translation is disabled. That is, where SMMU_CBn_SCTLR.M==0.
The encoding of this field is:
0b00
Default allocation attributes.
0b01
Reserved.
0b10
Read-Allocate.
0b11
No Read-Allocate.
SHCFG, bits[23:22]
Shared Configuration, controls the shareable attribute of a transaction where the Translation context
bank is disabled. That is, where SMMU_CBn_SCTLR.M==0.
The encoding of this field is:
0b00
Default shareable attribute.
0b01
Outer Shareable.
0b10
Inner Shareable.
0b11
Non-shareable.
Bit[21]
Reserved.
MTCFG, bit[20]
Memory Type Configuration, controls the memory type attribute of a transaction where the
Translation context bank translation is disabled. That is, where SMMU_CBn_SCTLR.M==0.
The possible values of this bit are:
0
Default memory attributes.
1
Use the MemAttr field for memory attributes.
MemAttr, bits[19:16]
Memory Attributes. These attributes are permitted to be overlaid if SMMU_CBn_SCTLR.M==0
and SMMU_CBn_SCTLR.MTCFG==1.
15-212
Table 15-6 and Table 15-7 show the MemAttr field encoding.
Table 15-6 MemAttr bit values
Bits[3:2]
Meaning
0b00
0b01
0b10
0b11
Bits[1:0]
0b00
Strongly-ordered
Reserved
0b01
Device
0b10
Reserved
0b11
Reserved
TRANSIENTCFG, bits[15:14]
Transient Allocate Configuration, controls the transient allocation hint.
The encoding of this field is:
0x00
Default transient allocation attributes.
0x01
Reserved.
0x10
Non-transient.
0x11
Transient.
This field applies where SMMU_CBn_SCTLR.M== 0.
It is IMPLEMENTATION DEFINED whether this field is present. If not implemented, these bits behave
as RAZ/WI.
Bit[13]
Reserved.
ASIDPNE, bit[12]
Address Space Identifier Private Namespace Enable.
The possible values of this bit are:
0
The System MMU ASID values for this Translation context bank are coordinated with
the wider system.
The System MMU ASID values for this Translation context bank are a private
namespace that is not coordinated with the wider system.
If ASIDPNE==1, a broadcast TLB Invalidate operation specifying an ASID value is not required to
apply to cached translations in the System MMU. This field is a hint. A Broadcast TLB Invalidate
operation is still permitted to affect cached translation in the System MMU and is permitted to apply
to all unlocked entries.
The scope of the ASID namespace for a Translation context bank is limited by the VMID associated
with that Translation context bank in the stream to context mapping process.
Bit[11]
Reserved.
UWXN, bit[10]
Unprivileged Writable Execute Never.
ARM IHI 0062B
ID121912
15-213
Raise a stage 1 permission fault if an instruction fetch occurs from a memory location
that permits writes for unprivileged accesses.
Note
This field only applies to translated transactions. That is, when SMMU_CBn_SCTLR.M==1.
WXN, bit[9]
Raise a stage 1 permission fault if an instruction fetch occurs from a memory location
that permits writes.
Note
This field only applies to translated transactions. That is, when SMMU_CBn_SCTLR.M==1.
HUPCF, bit[8] Hit Under Previous Context Fault.
The possible values of this bit are:
0
AFFD, bit[3] Access Flag Fault Disable, determines whether Access flag faults are enabled. This bit only applies
when AFE==1.
The possible values of this bit are:
0
Access flag faults are enabled.
15-214
If AFFD==0, AP[0]==0 in the translation table entry causes an Access flag fault, which is reported
by SMMU_CBn_FSR.
If AFFD==1, hardware behaves as if AP[0]==1, regardless of the translation table entry value.
For more information about the Access permission (AP) bit, see the ARM Architecture Reference
Manual, ARMv7-A and ARMv7-R edition.
AFE, bit[2]
Access Flag Enable, enables the AP[0] bit in the translation table descriptors to be used as an access
flag.
The possible values of this bit are:
0
In the translation table descriptors, AP[0] is an access permissions bit. The full range of
access permissions is supported. No access flag is implemented.
In the translation table descriptors, AP[0] is an access flag. Only the simplified model
for access permissions is supported.
TEX Remap Enable, enables remapping of the TEX[2:1] bits for use as two translation table bits
that can be managed by the operating system. Enabling this remapping also changes the scheme that
describes the memory region attributes in the VMSA.
The possible values of this bit are:
0
TEX Remap is disabled. Bits TEX[2:0] are used with the C and B bits to describe the
memory region attributes.
TEX Remap is enabled. Bits TEX[2:1] are reassigned for use as flags managed by the
operating system. The TEX[0], C and B bits describe the memory region attributes, with
the MMU remap registers.
If the Long-descriptor translation table format is enabled, that is, if SMMU_CBn_TTBCR.EAE has
the value 1, this bit has no effect and the System MMU behaves as if the bit is set. ARM
recommends that software treats this bit as UNK/SBOP when SMMU_CBn_TTBCR.EAE has the
value 1.
M, bit[0]
MMU Enable, a global enable bit for the involved Translation context bank.
The possible values of this bit are:
0
MMU behavior for this Translation context bank is disabled.
1
MMU behavior for this Translation context bank is enabled.
Invalidates all of the unlocked TLB entries that are tagged as:
Non-secure, using the VMID of the context bank, if the context bank is Non-secure,
non-hypervisor context
This operation requires no arguments, and only has to apply to TLB entries associated with
the VMID used for the Stage 1 Translation context bank.
15-215
If SMMU_CBARn.HYPC has the value 1, this operation only has to apply to TLB entries
associated with hypervisor contexts. The VMID is therefore irrelevant to the operation. See
Hypervisor-marked contexts on page 2-41 for more information.
In an implementation that includes the Security Extensions, this operation only has to apply
to TLB entries associated with the security domain that the Stage 1 Translation context bank
is a member of. The VMID of Secure context banks is ignored, even in implementations that
support a VMID for Secure banks. See Interaction with the Security Extensions on
page 2-32 for more information.
See Memory-mapped TLB maintenance operations on page 5-75 for more details about the
usage model.
Configurations
Attributes
Invalidates all of the unlocked TLB entries that match the ASID provided as an argument.
Optionally, in addition, an SMMU implementation can over-invalidate, removing any
arbitrary set of unlocked TLB entries, including those allocated from other context banks.
Usage constraints
This operation only has to apply to unlocked non-global TLB entries that match the VMID
used for the Stage 1 Translation context bank. If SMMU_CBARn.HYPC is 1, this operation
is UNPREDICTABLE.
In addition, in an implementation that includes the Security Extensions, this operation only
has to apply to unlocked TLB entries associated with the security domain that the Stage 1
Translation context bank is a member of.
See Memory-mapped TLB maintenance operations on page 5-75 for more details about the
usage model.
Configurations
Attributes
8 7
Reserved
Bits[31:8]
0
ASID
Reserved.
ASID, bits[7:0]
Address Space Identifier, the input to the invalidation operation.
Invalidates all of the unlocked TLB entries that match both the VA provided and the TLB
tagging scheme of the context bank, including any global entries if appropriate.
Optionally, in addition, an SMMU implementation can over-invalidate, removing any
arbitrary set of unlocked TLB entries, including those allocated from other context banks.
15-216
Usage constraints
This operation only has to apply to unlocked TLB entries associated with the ASID and
VMID used for a Stage 1 Translation context bank. The ASID is not checked for global
entries in the TLB. The VMID of Secure context banks is ignored for TLB matching
purposes, even in implementations that support a VMID for Secure banks. See Interaction
with the Security Extensions on page 2-32 for more information.
If SMMU_CBARn.HYPC has the value 1, this operation only has to apply to unlocked TLB
entries associated with hypervisor contexts. The VMID and ASID are therefore irrelevant
to the operation. See Hypervisor-marked contexts on page 2-41 for more information.
In an implementation that includes the Security Extensions, this operation is only required
to apply to unlocked TLB entries associated with the security domain that the Stage 1
Translation context bank is a member of.
See Memory-mapped TLB maintenance operations on page 5-75 for more details about the
usage model.
Configurations
Attributes
12 11
VA
8 7
Reserved
0
ASID
VA, bits[31:12]
Virtual Address, the input address to the invalidation operation.
Bits[11:8]
Reserved.
ASID, bits[7:0]
Address Space Identifier, the input to the invalidate operation.
Invalidates all of the unlocked TLB entries that match the VA provided as an argument, and
the VMID of the context bank, regardless of the ASID. This operation includes global
entries if appropriate.
Optionally, in addition, an SMMU implementation can over-invalidate, removing any
arbitrary set of unlocked TLB entries, including those allocated from other context banks.
Usage constraints
This operation only has to apply to unlocked TLB entries associated with the VMID used
for a Stage 1 Translation context bank. If SMMU_CBARn.HYPC has the value 1, this
operation is UNPREDICTABLE.
In an implementation that includes the Security Extensions, this command must operate on
all unlocked TLB entries associated with the security domain that the Stage 1 Translation
context bank is a member of. The VMID of Secure context banks is ignored for TLB
matching purposes, even in implementations that support a VMID for Secure banks. See
Interaction with the Security Extensions on page 2-32 for more information.
See Memory-mapped TLB maintenance operations on page 5-75 for more details about the
usage model.
Configurations
Attributes
15-217
12 11
VA
0
Reserved
VA, bits[31:12]
Virtual Address, the input address to the invalidate operation.
Bits[11:0]
Reserved.
Invalidates all of the unlocked TLB entries that match the VA provided as an argument, and
the VMID of the context bank, regardless of the ASID. This operation includes global
entries if appropriate.
Optionally, in addition, an SMMU implementation can over-invalidate, removing any
arbitrary set of unlocked TLB entries, including those allocated from other context banks.
Usage constraints
Configurations
Attributes
12 11
VA
0
Reserved
VA, bits[31:12]
Virtual Address. This is the input address to the invalidate operation.
Bits[11:0]
Reserved.
Invalidates all of the unlocked TLB entries that match the VA and ASID provided as
arguments, and the VMID of the context bank.
Optionally, in addition, an SMMU implementation can over-invalidate, removing any
arbitrary set of unlocked TLB entries, including those allocated from other context banks.
15-218
Usage constraints
Configurations
Attributes
12 11
VA
8 7
Reserved
0
ASID
VA, bits[31:12]
Virtual Address, the input address to the invalidation operation.
Bits[11:8]
Reserved.
ASID, bits[7:0]
Address Space Identifier, the input ASID to the invalidation operation.
Usage constraints
Configurations
Attributes
1 0
Reserved
SACTIVE
Bits[31:1]
Reserved.
SACTIVE, bit[0]
Synchronize TLB Invalidate Active.
15-219
Initiates a synchronization operation that ensures the completion of any TLB invalidate
operations previously accepted in the corresponding Translation context bank.
Usage constraints
This operation operates in the scope of the Translation context bank it resides in. After being
accepted, the operation does not complete until all Translation context bank TLB invalidate
operations accepted by the System MMU before the synchronize operation was accepted are
complete.
See Memory-mapped TLB maintenance operations on page 5-75 for more details about the
usage model.
Configurations
Attributes
15-220
Usage constraints
Configurations
The format of this register depends on the value of SMMU_CBn_TTBCR.EAE. For more
information, see:
Attributes
15 14 13
Reserved
EAE
NSCFG1
6 5 4 3 2
Reserved
NSCFG0
T0SZ
PD0
PD1 SBZ
Reserved.
NSCFG0, bit[14]
Non-secure attribute for the memory associated with a translation table walk using
SMMU_CBn_TTBR0. This field only applies to a Secure Translation context bank. Otherwise, it is
ignored. See SMMU_CBn_TTBRm, Translation Table Base Registers on page 15-224.
Bits[13:6]
Reserved.
PD1, bit[5]
PD0, bit[4]
SBZ, bit[3]
Should-be-Zero.
T0SZ, bits[2:0] The size offset of the SMMU_CBn_TTBR0 addressed region, encoded as a 3-bit unsigned number
giving the size of the region as 232-T0SZ. See SMMU_CBn_TTBRm, Translation Table Base
Registers on page 15-224.
15-221
19 18
16 15 14 13 12 11 10 9 8 7 6
3 2
SH0
EAE
SH1
IRGN1
A1
T1SZ
NSCFG0
IRGN0
Reserved
NSCFG1 ORGN1
EPD1 Reserved
Reserved
ORGN0
EPD0
EAE
T0SZ
NSCFG1, bit[30]
Non-secure attribute for the memory associated with a translation table walk using
SMMU_CBn_TTBR1. See SMMU_CBn_TTBRm, Translation Table Base Registers on
page 15-224 for more information.
This field only applies to a Secure Translation context bank. Otherwise, it is ignored.
SH1, bits [29:28]
Shareable attributes for the memory associated with the translation table walks using
SMMU_CBn_TTBR1. See SMMU_CBn_TTBRm, Translation Table Base Registers on
page 15-224 and SH1, SH0 encoding on page 15-224 for more information.
ORGN1, bits [27:26]
Outer Cacheability Attributes for the memory associated with the translation table walks using
SMMU_CBn_TTBR1. See SMMU_CBn_TTBRm, Translation Table Base Registers on
page 15-224 and ORGN1, ORGN0, IRGN1, IRGN0 encoding on page 15-224 for more information.
IRGN1, bits [25:24]
Inner Cacheability Attributes for the memory associated with the translation table walks using
SMMU_CBn_TTBR1. See SMMU_CBn_TTBRm, Translation Table Base Registers on
page 15-224 and ORGN1, ORGN0, IRGN1, IRGN0 encoding on page 15-224 for more information.
EPD1, bit[23] Translation Walk Disable for the SMMU_CBn_TTBR1 region where
SMMU_CBn_TTBCR.EAE==1. See SMMU_CBn_TTBRm, Translation Table Base Registers on
page 15-224 for more information. Controls whether a translation table walk is performed on a TLB
miss when SMMU_CBn_TTBR1 is used.
This bit is UNK/SBZ if either:
SMMU_CBn_TTBCR.EAE==0
SMMU_CBARn.HYPC==1.
The possible values of this bit are:
0
This function is the same as PD1. The bit position is moved depending on the setting of
SMMU_CBn_TTBCR.EAE.
A1, bit[22]
Select the ASID from the SMMU_CBn_TTBR1 or SMMU_CBn_TTBR0 ASID field. See
SMMU_CBn_TTBRm, Translation Table Base Registers on page 15-224 for more information.
The possible values of this bit are:
0
Select the ASID from the SMMU_CBn_TTBR0 ASID field.
15-222
1
Bits[21:19]
Reserved.
T1SZ, bits[18:16]
The size offset of the SMMU_CBn_TTBR1 addressed region, encoded as a 3-bit unsigned number,
giving the size of the region as 232-T1SZ. See SMMU_CBn_TTBRm, Translation Table Base
Registers on page 15-224.
Bit[15]
Reserved.
NSCFG0, bit[14]
Non-secure attribute for the memory associated with a translation table walk using
SMMU_CBn_TTBR0. This field only applies to a Secure Translation context bank. Otherwise, it is
ignored. See SMMU_CBn_TTBRm, Translation Table Base Registers on page 15-224.
SH0, bits[13:12]
Shareable attributes for the memory associated with the translation table walks using
SMMU_CBn_TTBR0. See SMMU_CBn_TTBRm, Translation Table Base Registers on
page 15-224 and SH1, SH0 encoding on page 15-224 for more information.
ORGN0, bits[11:10]
Outer Cacheability Attributes for the memory associated with the translation table walks using
SMMU_CBn_TTBR0. See SMMU_CBn_TTBRm, Translation Table Base Registers on
page 15-224 and ORGN1, ORGN0, IRGN1, IRGN0 encoding on page 15-224 for more information.
IRGN0, bits[9:8]
Inner Cacheability Attributes for the memory associated with the translation table walks using
SMMU_CBn_TTBR0. See SMMU_CBn_TTBRm, Translation Table Base Registers on
page 15-224 and ORGN1, ORGN0, IRGN1, IRGN0 encoding on page 15-224 for more information.
EPD0, bit[7] Translation Walk Disable for the SMMU_CBn_TTBR0 region, where EAE==1. See
SMMU_CBn_TTBRm, Translation Table Base Registers on page 15-224 for more information.
Controls whether a translation table walk is performed on a TLB miss when SMMU_CBn_TTBR0
is used.
This bit is UNK/SBZ if either:
SMMU_CBn_TTBCR.EAE==0
SMMU_CBARn.HYPC==1.
The possible values of this bit are:
0
This function is the same as PD0. The bit position is moved depending on the setting of
SMMU_CBn_TTBCR.EAE.
Bits[6:3]
Reserved.
T0SZ, bits[2:0]
The size offset of the SMMU_CBn_TTBR0 addressed region, encoded as a 3-bit unsigned number,
giving the size of the region as 232-T0SZ. See SMMU_CBn_TTBRm, Translation Table Base
Registers on page 15-224.
15-223
SH[0]
Normal memory
Non-shareable
UNPREDICTABLE
Outer Shareable
Inner Shareable
RGN[0]
Description
Write-Through cacheable
Usage constraints
Configurations
Two formats of Translation Table Base Register can be selected, the legacy Short-descriptor
translation table format, and the more recent Long-descriptor translation table format. For
more information, see:
Attributes
15-224
63
7 6 5 4 3 2 1 0
14-N 13-N
Reserved
Reserved
Translation table base address [31:N]
Bits[63:32]
RGN
IRGN[0]
NOS
IMP
IRGN[1]
Reserved.
Reserved.
IRGN[0], bit[6]
Inner Region bits. See also SMMU_CBn_TTBRm.IRGN[1].
These bits indicate the Inner cacheability attributes for the memory associated with the translation
table walks.
The encoding of bits[0,6] is:
Inner Non-cacheable Normal memory.
0b01
Inner Write-Back Write-Allocate cacheable Normal memory.
0b10
Inner Write-Through cacheable Normal memory.
0b11
Inner Write-Back no Write-Allocate cacheable Normal memory.
0b00
NOS, bit[5]
RGN, bits[4:3] Region bits, indicate the Outer cacheable attributes for the memory associated with the translation
table walk.
The encoding of this field is:
0b00
Non-cacheable Normal memory.
0b01
Outer Write-Back Write-Allocate cacheable.
0b10
Outer Write-Through cacheable.
0b11
Outer Write-Back no Write-Allocate cacheable.
IMP, bit[2]
S, bit[1]
Shareable bit, indicates the Shareable attribute for the memory associated with a translation table
walk.
15-225
63
Reserved
48 47
ASID[7:0]
Bits[63:56]
40 39
Reserved
x x1
Base address [39:x]
0
Reserved
Reserved.
ASID[7:0], bits[55:48]
The Address Space Identifier associated with this base address.
SMMU_CBn_TTBCR.A1 determines the selection between SMMU_CBn_TTBR0.ASID and
SMMU_CBn_TTBR1.ASID.
Bits[47:40]
Reserved.
Bits[x-1:0]
15-226
Reserved.
Chapter 16
Stage 2 Translation Context Bank Format
This chapter gives the layout of the Stage 2 Translation context bank. It contains the following sections:
16-227
16.1
16-228
SMMU_CBn_NMRR
SMMU_CBn_PRRR
SMMU_CBn_TTBR1
SMMU_CBn_CONTEXTIDR.
SMMU_CBn_ATSR
SMMU_CBn_MAIR1, SMMU_CBn_MAIR0
SMMU_CBn_PAR
SMMU_CBn_TLBSTATUS.
SMMU_CBn_ATS1PR
SMMU_CBn_ATS1PW
SMMU_CBn_ATS1UR
SMMU_CBn_ATS1UW
SMMU_CBn_TLBIALL
SMMU_CBn_TLBIASID
SMMU_CBn_TLBIVA
SMMU_CBn_TLBIVAA
SMMU_CBn_TLBIVAAL
SMMU_CBn_TLBIVAL
SMMU_CBn_TLBSYNC.
A Stage 2 Translation context bank only supports the LPAE mode of operation. This means that
SMMU_CBn_TTBCR.EAE has a fixed value of 1.
16.2
Offset
Name
Type
Description
Notes
0x00000
SMMU_CBn_SCTLR
RW
0x00004
SMMU_CBn_ACTLR
RW
0x00008
SMMU_CBn_RESUME
WO
0x0000C-0x0001C
Reserved
0x00020
SMMU_CBn_TTBR0[31:0]
0x00024
SMMU_CBn_TTBR0[63:32]
RWa
64-bit
0x00028-0x0002C
Reserved
0x00030
SMMU_CBn_TTBCR
RW
0x00034-0x0003C
Reserved
0x00040-0x00044
Reserved
0x0004C-0x00054
Reserved
0x00058
SMMU_CBn_FSR
RW
0x0005C
SMMU_CBn_FSRRESTORE
WO
0x00060
SMMU_CBn_FAR[31:0]
RW
0x00064
SMMU_CBn_FAR[63:32]
0x00068
SMMU_CBn_FSYNR0
RW
0x0006C
SMMU_CBn_FSYNR1
0x00070-0x00CFC
Reserved
16-229
Name
Type
Description
Notes
0x00DFC-0x00D00
IMPLEMENTATION DEFINED
RW
0x00E00-0x00E38
SMMU_CBn_PMEVCNTRm
RW
SMMU_CBn_PMEVCNTRm, Performance
Monitors Event Counter registers on
page 15-207.
0x00E3C-0x00E7C
Reserved
0x00E80-0x00EBC
SMMU_CBn_PMEVTYPERm
RW
SMMU_CBn_PMEVTYPERm, Performance
Monitors Event Type Registers on
page 15-207.
0x00EBC-0x00EFC
Reserved
0x00F00
SMMU_CBn_PMCFGR
RO
SMMU_CBn_PMCFGR, Performance
Monitors Configuration Register on
page 15-206.
0x00F04
SMMU_CBn_PMCR
RW
0x00F08-0x00F1C
Reserved
0x00F20
SMMU_CBn_PMCEID0
RO
SMMU_CBn_PMCEIDm, Performance
Monitors Common Event Identification
registers on page 15-206.
0x00F24
SMMU_CBn_PMCEID1
RO
SMMU_CBn_PMCEIDm, Performance
Monitors Common Event Identification
registers on page 15-206.
0x00F28-0x00F3C
Reserved
0x00F40
SMMU_CBn_PMCNTENSET
RW
SMMU_CBn_PMCNTENSET, Performance
Monitors Count Enable Set register on
page 15-207.
0x00F44
SMMU_CBn_PMCNTENCLR
RW
SMMU_CBn_PMCNTENCLR, Performance
Monitors Count Enable Clear register on
page 15-206.
0x00F48
SMMU_CBn_PMINTENSET
RW
SMMU_CBn_PMINTENSET, Performance
Monitors Interrupt Enable Set register on
page 15-208.
0x00F4C
SMMU_CBn_PMINTENCLR
RW
SMMU_CBn_PMINTENCLR, Performance
Monitors Interrupt Enable Clear register on
page 15-208.
0x00F50
SMMU_CBn_PMOVSCLR
RW
SMMU_CBn_PMOVSCLR, Performance
Monitors Overflow Status Clear Register on
page 15-208.
0x00F54
Reserved
0x00F58
SMMU_CBn_PMOVSSET
RW
SMMU_CBn_PMOVSSET, Performance
Monitors Overflow Status Set Register on
page 15-208.
16-230
Name
Type
Description
Notes
0x00F5C-0x00FB4
Reserved
0x00FB8
SMMU_CBn_PMAUTHSTATUS
RO
SMMU_CBn_PMAUTHSTATUS,
Performance Monitors Authentication Status
register on page 15-206.
0x00FBC-0x00FC8
Reserved
0x00FCC
Reserved
0x00FD0-0x00FFC
IMPLEMENTATION DEFINED
Reserved for
Primecell ID
0x01000(PAGESIZE 0x4)
Reserved
16-231
16.3
16.3.1
Holds fault syndrome information about the memory access that caused a synchronous abort
exception.
Usage constraints
Configurations
Attributes
SMMU_CBn_FSYNR0
The SMMU_CBn_FSYNR0 bit assignments are:
31
24 23
Reserved
16 15
S1CBNDX
12 11 10 9 8 7 6 5 4 3 2 1 0
Reserved
PLVL
AFR
PTWF
ATOF
NSATTR
NSSTATE
IND
PNU
WNR
S1PTWF
Reserved
Bits[31:24]
Reserved.
S1CBNDX[23:16]
Stage 1 Context Bank Index associated with the transaction that caused the fault.
For nested translation, this field contains the Stage 1 Translation context bank index for processing
the transaction.
For stage 2 only translation, this field is UNKNOWN.
This field is only present in a stage 2 format Translation context bank. In a stage 1 format
Translation context bank, it is UNK/SBPZ.
This field is only valid if SMMU_IDR0.NTS==1. In an implementation that does not include nested
translation, this field is UNK/WI.
Bits[15:12]
Reserved.
AFR, bit[11] Asynchronous Fault Recorded. The possible values of this bit are:
0
A fault was recorded synchronously.
1
A fault was recorded asynchronously.
16-232
PTWF, bit[10] A walk fault on a translation table access. The possible values of this bit are:
0
A walk fault did not occur.
1
A fault occurred during processing of a translation table walk.
ATOF, bit[9] Address Translation Operation Fault. The possible values of this bit are:
0
An ATOF fault did not occur.
1
A fault occurred during the processing of an address translation operation.
NSATTR, bit[8]
Non-secure Attribute. The possible values of this bit are:
0
The input transaction has a Secure attribute.
1
The input transaction has a Non-secure attribute.
NSSTATE, bit[7]
Non-secure State. The possible values of this bit are:
0
The transaction is associated with a Secure client.
1
The transaction is associated with a Non-secure client.
IND, bit[6]
PNU, bit[5]
WNR, bit[4]
S1PTWF, bit[3]
A walk fault on a stage 1 translation table access. The possible values of this bit are:
0
A fault did not occur during stage 2 translation of a stage 1 translation table walk.
1
A fault occurred during stage 2 translation of a stage 1 translation table walk.
This field is only valid if the implementation supports nested translation. That is, if
SMMU_IDR0.NTS==1. In an implementation that does not include nested translation, this field is
UNK/SBZP.
Bit[2]
Reserved.
PLVL, bits[1:0]
Translation Table Level, the level in the translation table walk that the fault is associated with. The
encoding of this field is:
0b01
Level 1.
0b10
Level 2.
0b11
Level 3.
Faults and translation table level association
The translation table level a fault is associated with is:
For a fault associated with a translation table walk, the level of table walk being performed.
For a translation fault, the level of translation table that gave the fault. If a disabled translation table walk
causes the fault or if the size of the address presented is out of the range specified for matching with any base
address register, the fault is reported for level 1.
For an access fault, the level of translation table that gave the fault.
Copyright 2012 ARM Limited. All rights reserved.
Non-Confidential
16-233
For a permission fault, including a fault caused by a hierarchical permission, the final level of translation
table used for that translation.
SMMU_CBn_FSYNR1
The 32-bit SMMU_CBn_FSYNR1 register bit assignments are IMPLEMENTATION DEFINED.
16.3.2
Provides top-level control of the translation system for Stage 2 Translation context bank n.
Usage constraints
Configurations
SMMU_IDR0.S2TS
SMMU_IDR0.NTS
Attributes
A 32-bit RW register.
28 27 26 25 24 23 22 21 20 19
Reserved
16 15 14 13 12
MemAttr
RACFG
WACFG SHCFG
BSU
Reserved
FB
PTW
9 8 7 6 5 4 3 2 1 0
Reserved
HUPCF
CFCFG
CFIE
CFRE
AFFD
AFE
TRE
Bits [31:28]
Reserved.
WACFG, bits[27:26]
Write Allocate Configuration, controls the allocation hint for a write transaction where the
Translation context bank translation is disabled. That is, where SMMU_CBn_SCTLR.M==0.
The encoding of this field is:
0b00
Default allocation attributes.
0b01
Reserved.
0b10
Write-Allocate.
0b11
No Write-Allocate.
RACFG, bits[25:24]
Read Allocate Configuration, controls the allocation hint for read transactions where the Translation
context bank translation is disabled. That is, where SMMU_CBn_SCTLR.M==0.
The encoding of this field is:
0b00
Default allocation attributes.
0b01
Reserved.
0b10
Read-Allocate.
0b11
No Read-Allocate.
16-234
SHCFG, bits[23:22]
Shared Configuration, controls the shareable attributes of a transaction where the Translation
context bank is disabled. That is, where SMMU_CBn_SCTLR.M==0.
The encoding of this field is:
0b00
Reserved.
0b01
Outer Shareable.
0b10
Inner Shareable.
0b11
Non-shareable.
This field differs from the equivalent field in the stage 1 format SMMU_CBn_SCTLR register. The
stage 2 SMMU_CBn_SCTLR.SHCFG field is combined with the shared attributes of the previous
translation step. See Table 11-2 on page 11-158 for more information.
FB, bit[21]
Force Broadcast, forces the Broadcast of TLB maintenance, BPIALL and ICIALLU operations.
Bit[20]
Reserved.
MemAttr, bits[19:16]
Memory Attributes.
The memory attributes are permitted to be overlaid if SMMU_CBn_SCTLR.M==0.
Table 16-2 and Table 16-3 show valid values for this field.
Table 16-2 MemAttr bit values
Bits[3:2]
Meaning
0b00
0b01
0b10
0b11
Bits[1:0]
0b00
Strongly-ordered
Reserved
0b01
Device
0b10
Reserved
0b11
Reserved
This field differs from the equivalent field in the stage 1 SMMU_CBn_SCTLR format. The stage 2
MemAttr field is combined with the memory attributes presented from the previous translation step.
See Table 11-2 on page 11-158.
BSU, bits[15:14]
Barrier Shareability Upgrade, upgrades the required shareability domain of barriers issued by client
devices mapped to this Stream mapping register group, by setting the minimum shareability domain
that is applied to any barrier.
The encoding of this field is:
0b00
No effect.
0b01
Inner Shareable.
0b10
Outer Shareable.
16-235
Full system.
0b11
The upgrade of the barrier shareability domain might not be supported in all system topologies. In
an implementation that does not have this upgrade behavior, this field is RAZ/SBZP.
PTW, bit[13] Protected Translation Walk, only valid for an implementation that has nested translation. In an
implementation that does not have nested translation, it is RAZ/SBZP.
The possible values of this bit are:
Bit[12]
Reserved.
The Stage 2 Translation context bank format does not provide the ASIDPNE field that exists at this
location in the Stage 1 Translation context bank format. For a stage 2 format Translation context
bank, this field is UNK/SBZP.
Bits[11:9]
Reserved.
The Stage 2 Translation context bank format does not provide the WXN and UWXN fields. For a
stage 2 format Translation context bank, these fields are UNK/SBZP.
The distributed nature of some SMMU implementations means there can be significant delays
between detection of a context fault for one upstream client device and transactions from other
upstream client devices being stopped.
When this bit is set to 0, it is not guaranteed that faults from different devices are recorded in
absolute temporal order. When a device faults, although the setting of this bit is obeyed for that
device, no temporal guarantees are made regarding suspension of transactions from different
non-faulting devices.
CFCFG, bit[7] Context Fault Configuration.
The possible values of this bit are:
0
Terminate the transaction.
1
Stall the transaction.
CFIE, bit[6]
16-236
AFFD, bit[3] Access Flag Fault Disable, determines whether Access flag faults are enabled. Only applicable
when AFE==1.
The possible values of this bit are:
0
Access flag faults are enabled.
1
Access flag faults are not enabled.
If enabled, Access flag faults are reported by SMMU_CBn_FSR.
If AFFD==0, AP[0]==0 in the translation table entry causes an Access flag fault, which
SMMU_CBn_FSR reports.
If AFFD==1, hardware behaves as if AP[0]==1 regardless of the translation table entry value.
For more information about the Access permission (AP) bit, see the ARM Architecture Reference
Manual, ARMv7-A and ARMv7-R edition.
AFE, bit[2]
TRE, bit[1]
M, bit[0]
MMU Enable, a global enable bit for the involved Translation context bank.
The possible values of this bit are:
0
MMU behavior for this Translation context bank is disabled.
1
MMU behavior for this Translation context bank is enabled.
16.3.3
Usage constraints
Configurations
SMMU_IDR0.S2TS
SMMU_IDR0.NTS
Attributes
A 32-bit RW register.
14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
(1)
Reserved
EAE
SH0
SL0
(0)
T0SZ
ORGN0
Reserved
IRGN0
S
EAE(1), bit[31]
Extended Address Enable.
For a Stage 2 translation context entry, this field always reads as the value 1. Writes are ignored.
A value of 1 means use the translation system defined in the LPAE.
Bits[30:14]
Reserved.
16-237
SH0, bits[13:12]
Shareability attributes for the memory associated with the translation table walks using
SMMU_CBn_TTBR0.
ORGN0, bits[11:10]
Outer cacheability attributes for the memory associated with the translation table walks using
SMMU_CBn_TTBR0.
IRGN0, bits[9:8]
Inner cacheability attributes for the memory associated with the translation table walks using
SMMU_CBn_TTBR0.
SL0, bits[7:6] Start Level for the SMMU_CBn_TTBR0 addressed region. The encoding of this field is:
0
Level 2.
1
Level 1.
UNPREDICTABLE.
2
UNPREDICTABLE.
3
Bit[5]
Reserved.
S(0), bit[4]
T0SZ, bits[3:0] The Size offset of the SMMU_CBn_TTBR0 addressed region, encoded as a 4-bit signed number
giving the size of the region as 232-T0SZ.
16.3.4
Usage constraints
For a Stage 2 Translation context bank, only the Long-descriptor translation table format is
supported.
Configurations
SMMU_IDR0.S2TS
SMMU_IDR0.NTS
Attributes
A 64-bit RW register.
40 39
63
Reserved
Bits[63:40]
0
Reserved
Reserved.
16-238
Bits[x-1:0]
Reserved.
16-239
16-240
Glossary
Abort
Banked register
A register that has multiple instances, with the instance that is in use depending on the processor mode, security
state, or other processor state.
Byte
Exception
Handles an event. For example, an exception could handle an external interrupt or an undefined instruction.
External abort
Halfword-aligned
Means that the address is divisible by 2.
IMP
An abbreviation used in diagrams to indicate that one or more bits have IMPLEMENTATION DEFINED behavior.
IMPLEMENTATION DEFINED
Means that the behavior is not architecturally defined, but must be defined and documented by individual
implementations.
Intermediate Physical Address (IPA)
In an implementation of virtualization, the address to which a Guest OS maps a VA.
See also Physical address (PA), Virtual address (VA).
IPA
Little-endian memory
Means that:
a byte or halfword at a word-aligned address is the least significant byte or halfword in the word at that
address
a byte at a halfword-aligned address is the least significant byte in the halfword at that address.
Glossary-241
Glossary
Memory coherency
Is the problem of ensuring that when a memory location is read, either by a data read or an instruction fetch, the
value actually obtained is always the value that was most recently written to the location. This can be difficult when
there are multiple possible physical locations, such as main memory and at least one of a write buffer and one or
more levels of cache.
Memory Management Unit (MMU)
Provides detailed control of the part of a memory system that provides a single stage of address translation. Most of
the control is provided using translation tables that are held in memory, and define the attributes of different regions
of the physical memory map.
MMU
Nested
translation
Stage 2 translation.
Offset addressing
Means that the memory address is formed by adding or subtracting an offset to or from the base register value.
PA
RAZ/SBZP
RAZ/WI
Read-allocate cache
Is a cache in which a cache miss on reading data causes a cache line to be allocated into the cache.
Read-As-Zero
(RAZ)
In any implementation, the bit must read as 0, or all 0s for a bit field.
Reserved
SBO
SBOP
SBZ
SBZP
Security hole
Should-Be-One
(SBO)
Should be written as 1, or all 1s for a bit field, by software. Values other than 1 produce UNPREDICTABLE results.
Should-Be-One-or-Preserved (SBOP)
Must be written as 1, or all 1s for a bit field, by software if the value is being written without having been previously
read, or if the register has not been initialized. Where the register was previously read on the same processor, since
the processor was last reset, the value in the field should be preserved by writing the value that was previously read.
Hardware must ignore writes to these fields.
Glossary-242
Glossary
If a value is written to the field that is neither 1 (or all 1s for a bit field), nor a value previously read for the same
field on the same processor, the result is UNPREDICTABLE.
Should-Be-Zero
(SBZ)
Should be written as 0, or all 0s for a bit field, by software. Values other than 0 produce UNPREDICTABLE results.
Should-Be-Zero-or-Preserved (SBZP)
Must be written as 0, or all 0s for a bit field, by software if the value is being written without having been previously
read, or if the register has not been initialized. If the register was previously read, by the same processor that is
writing to the register, since the processor was last reset, the value in the field should be preserved by writing the
value that was previously read from the field by that processor.
Hardware must ignore writes to these fields.
If a value is written to the field that is neither 0 (or all 0s for a bit field), nor a value previously read for the same
field on the same processor, software must expect an UNPREDICTABLE result.
TLB
A table held in memory that defines the properties of memory areas of various sizes from 1KB to 1MB.
UNKNOWN
An UNKNOWN value does not contain valid data, and can vary from moment to moment, instruction to instruction,
and implementation to implementation. An UNKNOWN value must not be a security hole. UNKNOWN values must not
be documented or promoted as having a defined value or effect.
UNK/SBOP
UNKNOWN
In any implementation, the bit must read as 1, or all 1s for a bit field, and writes to the field must be ignored.
Software must not rely on the bit reading as 1, or all 1s for a bit field, and must use an SBOP policy to write to the
field.
UNK/SBZP
In any implementation, the bit must read as 0, or all 0s for a bit field, and writes to the field must be ignored.
Software must not rely on the bit reading as 0, or all 0s for a bit field, and except for writing back to the register
must treat the value as if it is UNKNOWN. Software must use an SBZP policy to write to the field.
See also UNK, Should-Be-Zero-or-Preserved (SBZP).
UNK
An abbreviation indicating that software must treat a field as containing an UNKNOWN value.
In any implementation, the bit must read as 0, or all 0s for a bit field. Software must not rely on the field reading as
zero.
See also UNKNOWN.
UNPREDICTABLE
Means the behavior cannot be relied on. UNPREDICTABLE behavior must not perform any function that cannot be
performed at the current or lower level of privilege using instructions that are not UNPREDICTABLE.
UNPREDICTABLE
Glossary-243
Glossary
Virtual address
(VA)
An address generated by an ARM processor. For a PMSA implementation, the virtual address is identical to the
physical address.
See also Intermediate Physical Address (IPA), Physical address (PA).
Word
Word-aligned
Write-Allocate cache
A cache in which a cache miss on storing data causes a cache line to be allocated into the cache.
Write-Back cache
A cache in which when a cache hit occurs on a store access, the data is only written to the cache. Data in the cache
can therefore be more up-to-date than data in main memory. Any such data is written back to main memory when
the cache line is cleaned or re-allocated. Another common term for a Write-Back cache is a copy-back cache.
Write-Through cache
A cache in which when a cache hit occurs on a store access, the data is written both to the cache and to main memory.
This is normally done using a write buffer, to avoid slowing down the processor.
Glossary-244