The processor MMU implements the hardware page table walking mechanism from ARMv4 and ARMv5 cached processors with the exception of the removal of the fine page table descriptor and the addition the page table walk disable bits in the TTB Control register.

The processor implements the page table walk disable feature. Two bits, PD0 and PD1, are implemented in the TTB Control register. These bits are banked for the Secure and Non-secure worlds for the support of TrustZone.

Each time a TLB miss occurs, the TLB computes the parameters for an automatic hardware page table walk. The address of the page table walk is computed from TTB0 or TTB1, see First-level descriptor address. If the address is computed with TTB0, and the PD0 bit is set in the TTB Control register of the corresponding world, or if the address is computed using TTB1 and the PD1 bit is set, then the processor does not perform the automatic hardware page table walk, and it generates a Section translation fault instead.

With this feature, only a small portion of the memory can be mapped in one world, for example the Secure world, if the code that runs in this world is expected to be small. This gives the system a simple way to avoid using a lot of memory to store full page tables.

When hardware page table walks are not disabled, the processor performs the page table walk in the usual way. A hardware page table walk occurs whenever there is a TLB miss. Processor hardware page table walks do not cause a read from the level one Unified/Data Cache. or the TCM. The P, RGN, S, and C bits in the Translation Table Base Registers determine the memory region attributes for the page table walk.

Two formats of page tables are supported:

Additionally, two translation table base registers are provided in each world. On a TLB miss, the Translation Table Base Control Register, CP15 c2 that is also duplicated in each world, and the top bits of the virtual address determine if the first or second translation table base is used. See c2, Translation Table Base Control Register for details. The first-level descriptor indicates whether the access is to a section or to a page table. If the access is to a page table, the processor MMU fetches a second-level descriptor.

A page table holds 256 32-bit entries 4KB in size. You can determine the page type by examining bits [1:0] of the second-level descriptor. For both first and second level descriptors if bits [1:0] are b00, the associated virtual addresses are unmapped, and attempts to access them generate a translation fault. Software can use bits [31:2] for its own purposes in such a descriptor, because they are ignored by the hardware. Where appropriate, ARM Limited recommends that bits [31:2] continue to hold valid access permissions for the descriptor.

For both level 1 and level 2 page table walks, the processor performs external accesses with Secure or Non-secure rights depending on the Secure or Non-secure state of the MMU request that causes the page table walk. This ensures that Secure translation table descriptors are always fetched from a Secure memory, and that Non-secure translation table descriptors are always fetched from Non-secure memory.